FAA air traffic control systems open to possible cyber attack, says IG

The Federal Aviation Administration cannot effectively detect or stop cyber attacks against air traffic control systems, according to the Transportation Department inspector general.

In a letter dated August 5 to two members of the House Transportation and Infrastructure Committee, Calvin Scovel, the DOT IG, says the FAA has yet to fully implement an intrusion detection system at all air traffic control facilities.

"Without [intrusion detection system] capabilities, FAA cannot effectively monitor ATC systems for possible cyber attacks or take action to stop them," Scovel writes.

Specifically, of the 11 Automated Radar Terminal System IIIE computer systems that should have the intrusion detection system installed on them, only seven do, the letter states. The FAA has told auditors they're delaying implementation of the cybersecurity system until January 2011 in order to first perform critical ARTS IIIE software upgrades.

But the FAA also lacks a timetable for deploying the intrusion detection system at other air traffic control facilities, the letter states. The FAA originally had agreed to develop an intrusion detection system deployment strategy for all air traffic control facilities by December 2009 and to complete deployment of intrusion detection system capabilities at facilities housing the ARTS IIIE by February 2010.

The letter, written to Reps. John Mica (R-Fla.) and Tom Petri (R-Wis.)--the senior Transportation and Infrastructure Committee Republican and the ranking member of the aviation subcommittee, respectively--is a follow up to an earlier audit issued by the DOT IG in May 2009.

That audit for that web applications supporting air traffic control systems were not properly secured and that the FAA didn't establish adequate intrusion-detection capability to monitor and detect potential cyber security incidents at air traffic control facilities.

For more:
- download the DOT IG's August 5 letter (.pdf)
- download the May 2009 DOT IG audit of FAA web applications and intrusion detection, FI-2009-049 (.pdf)

Related Articles:
Obama calls for increased NextGen spending
NIST: More research needed for smart grid cybersecurity