Staff Reports
The Federal Aviation Administration’s push to build a single Common Automation Platform (CAP) for U.S. air traffic control should be about safety first. Instead, it has triggered a fight over national security. Aviation experts and at least one big U.S. contractor are warning that companies with deep business ties to China are on the FAA’s short list — and that simple procurement won’t cut it when our skies and flight data are at stake.
Shortlist and China ties: Why experts are alarmed
The FAA invited vendors to show designs for the CAP — the software and systems that will run air traffic control across the country. Industry reporting says the short list includes U.S. firms like Leidos and Collins Aerospace (part of RTX) and foreign firms such as Indra, Thales, and Frequentis. Here’s the problem: Indra and Thales have long, large projects in China that touch air traffic management. That fact alone sets off red flags for cybersecurity and counterintelligence watchers. Federal audits from the DOT Inspector General and the Government Accountability Office already found gaps in FAA cyber defenses. Letting a vendor with deep China ties touch the heart of the National Airspace System without ironclad controls would be reckless.
Congress and industry pushback
That’s why lawmakers on the House Appropriations panel told the FAA to vet third parties for relationships with the People’s Republic of China and to report back if any CAP contractors have those ties. At the same time, Leidos — a U.S. bidder — is pressing Congress to add study language and stronger screening in defense and appropriations bills. This is not a partisan fit; it’s common sense. If the EU can tighten rules to keep risky vendors out of its airspace, the United States can and should demand the same level of scrutiny for systems that control our skies.
Cyber gaps, zero trust, and the real fix
GAO and DOT OIG reports pushed the FAA to adopt “zero trust” principles and to close thousands of missing or outdated security controls. Zero trust means no implicit trust for any user or device — ever. That should be the default for CAP. The agency must demand supply-chain proofs, FOCI mitigations, and runtime isolation so that any vendor-managed piece cannot become a backdoor into FAA operations. If a company’s business model requires continuing access to foreign systems tied to adversary states, then their CAP role must be limited or eliminated.
A simple test and a final word
Call it a test of common sense: if a vendor’s work in China means their engineers, equipment, or software could be compelled or influenced by Beijing, they should not be allowed to operate critical layers of U.S. air traffic control. Transportation Secretary Sean P. Duffy and FAA Administrator Bryan Bedford must make that clear now — not after a crisis. Congress should back the FAA with clear rules that prioritize national security and buy American resilience. We can modernize our air traffic system without handing the keys to vendors whose loyalties are in question. That is the pragmatic, pro‑security choice — and frankly, the only sane one.
