Security Concerns Over FAA's Consideration of Chinese-Tied ATC Vendors

Aviation experts are raising serious national security concerns about the Federal Aviation Administration's (FAA) vetting process for companies providing air traffic control (ATC) technologies, particularly those with strong ties to China. They warn that permitting these companies to design or operate American ATC systems could leave the U.S. vulnerable to cyberattacks.

In November 2025, the FAA announced its search for proposals to revolutionize how ATC officials manage flight data and aircraft movements through a new common automation platform (CAP). This initiative is part of Transportation Secretary Sean Duffy's plan to modernize the ATC system.

Reports indicate that the FAA's shortlist includes U.S.-based companies like Leidos and RTX, as well as foreign firms such as Spain's Indra and France's Thales. Both Indra and Thales have extensive histories of collaboration with China's aerospace sector, raising alarms among security experts.

The aviation sector has seen a rise in cybersecurity incidents, with nearly 2,300 reported to the Cybersecurity and Infrastructure Security Agency (CISA) from 2020 to 2025. CISA's 2024 threat priorities report highlighted the risks posed by malicious cyber actors linked to China.

In contrast to the FAA's approach, the European Union has implemented stricter regulations, barring non-EU companies from providing ATC services within its member states. This raises questions about the FAA's risk management procedures, which experts argue need significant upgrades to defend against potential cyber threats that could impact critical infrastructure.

A report from the Department of Transportation's Office of Inspector General noted that the FAA had left many of its systems vulnerable to cyberattacks, which could have catastrophic effects on the National Airspace System (NAS). The Government Accountability Office (GAO) has also recommended that the FAA enhance its cybersecurity measures, including transitioning to a Zero Trust Architecture (ZTA) framework, which emphasizes verifying every user and device.

The U.S. House Committee on Appropriations has mandated that the FAA consult with federal agencies to assess risks from third-party vendors, particularly those with connections to China. The FAA is required to report any contracts with such vendors to Congress, detailing the associated risks and mitigation strategies.

Indra has been a key player in China's air traffic management since 1989, with its systems controlling a significant portion of Chinese airspace. Thales has similarly established a strong presence in China, managing a substantial share of the country's air traffic.

While Leidos supports increased scrutiny of foreign vendors, Thales USA has expressed concerns that such measures could unfairly bias companies operating in China. Nevertheless, industry experts emphasize the importance of safeguarding U.S. infrastructure from potential foreign threats, particularly in light of the FAA's upcoming decisions regarding the CAP.

The implications of these decisions are profound, as the FAA seeks to modernize a critical component of national infrastructure. Experts stress the need for vigilance to prevent any infiltration of the air traffic control system by foreign entities, particularly those linked to China.