Threat Analysis · November 13, 2026, 7:17 PM CST
In one day, three very different systems broke.
The FAA stopped every departing flight in the country. Microsoft’s email went dark across Australia and the Pacific. A tanker ran into a docked river cruise ship in New Orleans and left it on its side in the Mississippi.[1][3][15]
None of these has been called an attack. But accidents and attacks hit the same weak spots.
This briefing looks at what each failure revealed about how much of the country runs on a single link, and what that means for security.
Video: CBS News, November 13, 2026 — “What we know about nationwide FAA ground stop, Mullin says no indication of attack | Special Report”. Watch the original for full context.
The bottom line
- Aviation: The FAA blamed a “temporary telecommunications outage” affecting the regional centers that guide planes at cruising altitude.[4] As of 8 p.m. Eastern, the stop was still in place, and the FAA said it would last “through at least 11 tonight.”[4]
- Cloud: Microsoft said a secure-connection process on its servers “becomes overwhelmed, causing the servers to stop processing requests.” It said there was “no indication” of a cyberattack.[3]
- Maritime: Officials said the tanker Atlantic Asphalt “lost control” before hitting the American Heritage. All passengers were accounted for, and 32 were taken to hospitals, none with critical injuries.[5]
- Attack? Homeland Security Secretary Markwayne Mullin said there was no indication of a “nefarious attack,” but added, “as of right now, that’s not known.”[2]
We found no evidence that the three events are connected, and this analysis does not claim they are.
Three corrections to what’s circulating
1. This was not a CrowdStrike outage. That global failure was on July 19, 2024. Microsoft said the faulty CrowdStrike update hit “8.5 million Windows devices, or less than one percent of all Windows machines.”[6] Friday’s Microsoft disruption is a separate event with a different cause.[3]
2. The New Orleans boat did not sink out on the river. The American Heritage, which can carry 150 passengers, was tied up at the riverfront with about 129 passengers aboard when it was hit at about 12:30 p.m.[15][16] It ended up on its side, largely underwater.[15]
3. There is no active federal terror advisory. The Department of Homeland Security’s National Terrorism Advisory System page says, “There are no current advisories.” The last bulletin, about the Iran conflict, expired September 22, 2025.[7]
Timeline of fragility
1. Aviation: the voice link was a single thread
At 4:16 p.m. Eastern, Transportation Secretary Sean Duffy said the FAA had grounded departures nationwide after “a communication issue impacting all Air Route Traffic Control Centers.”[4]
There are 22 of those centers. They handle flights above 18,000 feet.[2]
Trouble showed up first in Chicago. O’Hare and Midway were already under their own ground stops for an “equipment outage.”[1] One pilot, quoted by a reporter, said the outage “started in Kansas City Center” and then “spread nationwide.” The FAA has not confirmed that.[9]
Video: NBC News, November 13, 2026 — “Special Report: FAA orders nationwide ground stop after 'telecommunications outage'”. Watch the original for full context.
By 7:30 p.m. Eastern, FlightAware counted 10,079 U.S.-related delays and 4,238 cancellations.[4] Cirium reported about 600 diversions.[8]
Mullin said controllers could still talk to planes, though at reduced clarity: “My understanding is that we can still communicate.”[4]
Video: C-SPAN, November 13, 2026 — “Mullin on FAA nationwide ground stop: "This was a telecommunication outage throughout FAA"”. Watch the original for full context.
The technical lesson. Air traffic control is only as strong as the phone and data lines underneath it. Parts of the FAA’s network still run on old copper lines. The contractor converting them to fiber, L3Harris, passed the halfway mark this spring.[19]
If those lines fail, controllers can’t reliably talk to aircraft. There is no slack in that system.
| Date | Event | Cause |
|---|---|---|
| Jan. 2023 | Nationwide ground stop, the first since 9/11[18] | Contractors accidentally deleted files while syncing the pilot-notice (NOTAM) database[11] |
| 2025 | Controllers lose contact with Newark flights | Equipment failure[8] |
| Sept. 21, 2026 | New York-area and Philadelphia arrivals halted | Main circuit failed; backup fiber already cut[10] |
| Nov. 13, 2026 | Nationwide ground stop | “Temporary telecommunications outage” (under investigation)[4] |
None of these was an attack. Each one showed a backup that existed on paper but failed in practice.
That is the most important point for security planning. An attacker doesn’t need to beat a backup that’s already broken.
Video: CBS New York, November 13, 2026 — “Passengers describe impacts of FAA nationwide ground stop”. Watch the original for full context.
2. Cloud: sign-in is the hidden dependency
Microsoft’s trouble began just after 3 a.m. in eastern Australia. Outlook and other services stopped responding, and Australian organizations reported being “brought to a standstill.”[3]
The detail that matters most: some users said they couldn’t use two-factor codes to log in to other services.[3] An email outage became a sign-in outage.
Microsoft said it was investigating “recent configuration changes.” Australia’s National Cyber Security Coordinator, Lt. Gen. Michelle McGuinness, was “looking into it.”[3] Late Friday, Microsoft said it had “no indication that the FAA nationwide ground stop is related.”[4]
Video: CNN, November 13, 2026 — “Microsoft outage impacts millions. Tech expert explains the ripple effects”. Watch the original for full context.
The lesson. For many organizations, one company’s login system is the front door to everything. CrowdStrike showed the same thing in 2024. Less than 1% of Windows machines failed, but they belonged to enterprises running “many critical services.”[6]
What matters is not how many machines a failure touches. It’s how much depends on them.
3. Maritime: a chokepoint with no detour
The Atlantic Asphalt carries asphalt and bitumen, according to MarineTraffic.[15] Public records show it is based in the Marshall Islands and owned by Chinese and Liberian companies.[5]
Officials said it “lost control” and hit the moored American Heritage. The Coast Guard and the National Transportation Safety Board are investigating.[5]
Mayor Helena Moreno called the outcome “a miracle on the Mississippi.”[5]
Video: CNN, November 13, 2026 — “Tanker crashes into river cruise ship in New Orleans; 130 on board”. Watch the original for full context.
The Coast Guard closed about three miles of the river, between mile markers 93 and 96.[5][17]
Then the failures overlapped. The federal investigators’ trip to New Orleans was delayed by the nationwide ground stop.[5]
Video: WWL-TV, November 13, 2026 — “Passengers being rescued after tanker crashes into American Heritage cruise ship”. Watch the original for full context.
The lesson. The lower Mississippi is one channel. Ships can’t route around a wreck inside a closure zone.
New Orleans has seen this before. In 1996, the freighter Bright Field lost power and crashed into the city’s Riverwalk.[12] Big ships in a narrow, busy river have very little room to recover when something goes wrong.
Video: WDSU News, November 13, 2026 — “Witness describes chaotic moment he saw tanker strike a cruise ship in New Orleans”. Watch the original for full context.
Video: USA TODAY, November 13, 2026 — “New Orleans boat crash: Atlantic Asphalt tanker, American Heritage riverboat aftermath footage”. Watch the original for full context.
Where the river collision happened
Where the tanker Atlantic Asphalt struck the docked riverboat American Heritage on Nov. 13, 2026. Map data: OpenStreetMap contributors.
The threat matrix
This section separates two things: weaknesses Friday showed, and threats the government has already assessed in public. It does not say anyone caused Friday’s failures.
What federal agencies have already warned about
China-linked hackers. In February 2024, CISA, the NSA and the FBI said Chinese state-sponsored hackers known as Volt Typhoon were trying to “pre-position themselves on IT networks for disruptive or destructive cyberattacks” on U.S. infrastructure “in the event of a major crisis or conflict with the United States.”[13]
The sectors where they found intrusions: Communications, Energy, Transportation Systems, and Water.[13] Friday’s two biggest failures were in communications and transportation.
Video: CBS News, archive — “FBI Director Wray says China targeting U.S. civilian infrastructure, economic security”. Archival clip from Wray’s tenure as FBI director, for background.
Iran-aligned actors. DHS’s last terror bulletin, from June 2025, warned that “low-level cyber attacks against US networks by pro-Iranian hacktivists are likely,” and that Iranian government-linked cyber actors “may conduct attacks against US networks.”[7] That bulletin has expired. The groups it described have not gone away.
Planning for outages, not just break-ins. On September 2, 2026, CISA, the FBI and partners in Australia, Canada, New Zealand and the U.K. released “Communicating Under Pressure,” guidance for service providers on talking to the public during outages and cyber incidents.[14] It ties into CISA’s CI Fortify program, launched in May 2026 around isolation and recovery.[14]
Friday’s weaknesses, mapped
| Weakness exposed | Shown by | Who has a stated interest | Why it matters |
|---|---|---|---|
| Aging telecom lines under safety-critical systems | FAA, Nov. 13 and Sept. 21 | State hackers pre-positioning (per CISA) | One link can halt national airspace for hours |
| Backups that fail silently | Philadelphia, Sept. 21 | Any capable actor | A backup nobody tests isn’t a backup |
| One company’s login as the front door | Microsoft, Nov. 13; CrowdStrike, 2024 | State actors; ransomware gangs | One vendor failure locks people out of many systems |
| Single-channel waterways | New Orleans, Nov. 13 | Anyone able to stage an “accident” | A blocked channel is cheap to cause and slow to clear |
| Confusion in the first hours | All three | Influence and disinformation operations | Rumors spread before official answers arrive |
The lookalike problem
The biggest concern isn’t that Friday was an attack. It’s that a real attack could be made to look like Friday.
A failure that resembles a cut cable or a bad software update takes time to explain. In those first hours, as Mullin put it, “You just can’t rule out anything at this point.”[4] That delay is valuable to anyone who wants to hide.
Rumors moved fast Friday. Claims spread that the National Weather Service’s radar had gone down nationwide. The Weather Service said its radars were working normally and only an outdated web page was affected.[4] An FAA vendor had to say publicly that the stop was “not based on or a result of” its new SMART routing system.[4]
That is why fast, specific public statements matter. The September CISA guidance says that for non-malicious outages, “forthcoming transparency should be the default.”[14]
When failures stack
- A ground stop slowed a maritime investigation. NTSB and Coast Guard investigators were delayed getting to New Orleans.[5]
- Freight carriers went to backup plans. FedEx said it was prepared to activate contingency plans and would resume normal operations when the FAA allowed.[4]
- Sign-in outages slow every other recovery. When staff can’t log in, they can’t coordinate a response to anything else.
We have not found reliable cost estimates for Friday’s disruptions, and we won’t guess.
Conclusion: resilience is what works, not what’s planned
As far as the public record shows, Friday was not a coordinated attack. It was still a stress test.
Every system that failed had backups and emergency plans on paper. What Friday measured was the gap between the plan and what actually worked.
What the evidence says needs to happen
- Test the switch to the backup, not just the backup. Philadelphia’s backup was already broken when it was needed.[10]
- Keep main and backup lines physically apart. Two lines in the same trench, or from the same vendor, can fail together.
- Treat sign-in systems as critical infrastructure. Keep offline backup codes and a second way to log in.
- Finish the unglamorous upgrades. Old lines, old equipment and configuration mistakes caused most of these failures. The copper-to-fiber conversion is only about half done.[19]
- Explain early and specifically. Clear statements cut off rumors and make it harder for a real attack to hide behind a lookalike accident.[14]
- Plan for failures that stack. Drills that test one failure at a time would have missed Friday, when a ground stop delayed the response to a river accident.
This is a developing analysis. The FAA, Microsoft, the Coast Guard and the NTSB have not released their findings. We will update this briefing when they do.
References
- FAA issues nationwide ground stop 'due to extraordinary circumstances' and 'safety' (NBC Chicago)
- FAA issues rare nationwide ground stop; no indication of 'nefarious attack' (ABC News)
- Access to Microsoft Outlook and other services being restored as cyber security chief investigates (ABC News (Australia))
- Live updates: FAA issues sudden and stunning ground stop for all flights (NBC News)
- Everyone accounted for after tanker collides with a New Orleans riverboat (NBC News)
- Helping our customers through the CrowdStrike outage (July 20, 2024) (Microsoft)
- National Terrorism Advisory System (bulletin of June 22, 2025, expired Sept. 22, 2025) (U.S. Department of Homeland Security)
- FAA grounds departing flights nationwide, citing air traffic communication system outage (CNBC)
- FAA issues nationwide ground stop on all departing flights, citing 'communication issue' (Yahoo News)
- FAA fiber optic cable flight disruptions (citing Reuters and NJ Transit), September 2026 (Travel Noire)
- FAA Attributes Ground-Stop Glitch To Contractor Error (January 2023) (Government Executive)
- MV Bright Field (1996 New Orleans Riverwalk allision) (Wikipedia)
- Advisory AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Feb. 7, 2024) (CISA, NSA, FBI)
- CISA, Partners Issue Guidance for Critical Infrastructure Crisis Comms (September 2026) (SecureWorld)
- River cruise ship, tanker crash in New Orleans on Mississippi River (CBS News / AP)
- Mississippi River cruise line collision: What we know amid rescues, massive response (WDSU)
- Emergency crews responding to vessel collision near Port of New Orleans on Mississippi River (ABC7 / ABC News)
- FAA nationwide ground stop delays 200-plus flights at O'Hare, Midway airports (NBC Chicago)
- FAA's ATC overhaul: modernization partners on fiber, radar and radio (May 4, 2026) (FedScoop)
Kemetic Minds Editorial Desk
Verified NewsroomPrimary-sourced investigative intelligence on civil rights, voting rights, federal policy, and consumer protection. Sourced from primary legal filings, government statistics, and direct field reporting.