Audit Reports

-A A +A
skip-to-content
September 29, 2015

FAA’s Contingency Plans and Security Protocols Were Insufficient at Chicago Air Traffic Control Facilities

Senator Richard J. Durbin and Representatives Bill Foster, Mike Quigley, Tammy Duckworth, Jan Schakowsky, and Dan Lipinski
Project ID: 
AV2015112
View PDF Document

On September 26, 2014, a Federal Aviation Administration (FAA) contract employee deliberately started a fire that destroyed critical equipment at FAA’s Chicago Air Route Traffic Control Center in Aurora, IL. As a result of the damage, Chicago Center was unable to control air traffic for more than 2 weeks, thousands of flights were delayed or cancelled, and aviation stakeholders reportedly lost over $350 million.

The contingency plans developed by FAA did not adequately address redundancy or resiliency and were insufficient to quickly restore operations after the Chicago fire. Moreover, the damage highlighted weaknesses in FAA’s current air traffic control infrastructure, which has limited flexibility to respond to system failures. In addition, the security protocols in effect at the time of the fire were insufficient to identify, counter, or mitigate the impact of an insider threat. While FAA has completed reviews of its contingency plans and security protocols following the incident, significant work remains to prevent or mitigate the impact of similar events in the future.

We made seven recommendations to help FAA improve redundancy and resiliency in the National Airspace System and implement improvements to its operational contingency plans and security protocols. FAA concurred with all seven, and we consider them resolved but open pending completion of planned actions.

Recommendations

Open

Closed

Closed on 08.24.2016
No. 1 to FAA

Apply the lessons learned from the Chicago Center incident to the redesign of operational contingency plans for all Center facilities.

No. 2 to FAA

Identify and implement changes needed to improve annual contingency training exercises to simulate more realistic scenarios.

Closed on 09.27.2018
No. 3 to FAA

Evaluate the feasibility and cost of physically separating primary and backup components of critical communication infrastructure when comparing alternative implementation options for all future investments.

Closed on 09.02.2020
No. 4 to FAA

Install a secure wireless network that can provide access to FAA's local area network (LAN) and connectivity to the internet at Center facilities.

Closed on 04.19.2016
No. 5 to FAA

Assess the feasibility and cost of replacing the existing fire suppression systems in critical equipment areas with a waterless system at Center facilities.

No. 6 to FAA

Develop an implementation plan and quantify all costs required for the implementation of each recommendation in FAA's 30-day Review of Contingency Plans.

Closed on 09.21.2016
No. 7 to FAA

Develop an implementation plan and quantify all costs required for the implementation of the 42 recommendations derived from the Comprehensive Security Review.