After FAA Halt and River Crash, Johnson Warns the U.S. Is Under Attack

Nov 13

On Friday, a rare nationwide FAA ground stop halted takeoffs across the United States, and a tanker struck a docked river cruise boat on the Mississippi River in New Orleans, capsizing the vessel. In a video posted later Friday, commentator Benny Johnson said he believes the country is "in the early stages of a major major kinetic attack on the United States and Europe" and that "the West is under attack." He linked the day's events to the 2024 collapse of Baltimore's Francis Scott Key Bridge and said it "seems like we are in the midst of a massive cyber attack with our air traffic control system."

I share the concern that the United States is under attack right now. Friday's emergencies were real. Whether they were the opening move of such an attack is a claim, not a finding that federal officials have made.

The FAA Ground Stop

The Federal Aviation Administration issued a nationwide ground stop on Friday afternoon "following communication issues impacting multiple Air Route Traffic Control Centers," the agency said. It was among the most severe nationwide stops since the Sept. 11, 2001, attacks. Transportation Secretary Sean Duffy said the trouble began at 3:36 p.m. Eastern and that U.S. airspace reopened at 8:15 p.m. Eastern. "It's going to be slow," he told reporters, according to Reuters. Flightradar24, cited by Reuters, reported more than 6,600 cancellations and 8,600 delays, with more cancellations already posted for Sunday.

Johnson described the stop as a communications crisis and said every airplane in the sky had to land. A ground stop restricts takeoffs. Duffy said controllers never completely lost radar or communications and were able to land thousands of planes already in the air.

Duffy blamed aging equipment. "Our switches, our routers actually got overloaded with data and they started to give us inconsistencies in the data from those routers and because of that we shut the system down," he said, according to Reuters. Homeland Security Secretary Markwayne Mullin said officials had seen "zero evidence" of a cyberattack, Reuters and GeekWire reported. "It appears this was mechanically driven, however, we're still looking," Mullin said. He also said there was "no connection" to a separate Microsoft outage, and Microsoft said it had no indication the events were related. Mullin still said officials were "not going to rule that out." Reuters reported that two airline officials said the problem appeared to involve a telecommunications network overseen by L3Harris Technologies; the company did not immediately comment.

The Mississippi River Collision

Near midday in New Orleans, the tanker Atlantic Asphalt struck the docked American Heritage, a paddlewheel river cruise boat, at about 12:30 p.m. local time, the Port of New Orleans said, according to CBS News. The boat later listed and capsized. Port officials said about 129 passengers were aboard, plus crew. Mayor Helena Moreno said the tanker "lost control" and crashed into the ship, which "began to sink, and then eventually toppled over and flipped." She said everyone was accounted for, there were no deaths, and 32 passengers were taken to hospitals with no critical injuries. U.S. Coast Guard Capt. Melanie Burnham said, "there seems to be some kind of a loss of steering. The exact reason why, we don't know that." The Coast Guard and the National Transportation Safety Board opened investigations.

Johnson said the tanker "looks like" it was "targeting" the boat, compared the footage to the Netflix film "Leave the World Behind," and, citing early reports, said officials did not know whether anyone had drowned. Those early uncertainty reports were overtaken later Friday by the official accounting. No official has said the tanker was steered into the boat on purpose. The cause remains under investigation.

The Baltimore Bridge

Johnson also said the March 26, 2024, strike on the Francis Scott Key Bridge in Baltimore had never been explained and "seemed like the bridge was being targeted," with a power loss on the ship offered as a possible sign of a cyberattack. In November 2025, the National Transportation Safety Board found that a loose signal wire on the Singapore-flagged containership Dali caused an electrical blackout and a loss of propulsion and steering close to the bridge. Six highway workers were killed. That is a documented electrical failure, not a confirmed cyberattack. The crossing has not been reopened. Maryland's official rebuild dashboard, updated Nov. 1, 2026, shows foundation work underway, with a completion target of 2030.

What Officials Have Documented About Foreign Threats

None of that official record attributes Friday's flight halt or the New Orleans collision to a foreign attack. It is also true, separately, that U.S. intelligence and cybersecurity agencies have spent years warning that hostile governments have already been inside American networks and could use that access in a crisis.

The Office of the Director of National Intelligence's March 2025 Annual Threat Assessment said the People's Republic of China "remains the most active and persistent cyber threat to U.S. government, private-sector, and critical infrastructure networks." It cited "the PRC's campaign to preposition access on critical infrastructure for attacks during crisis or conflict, tracked publicly as Volt Typhoon," and "its more recently identified compromise of U.S. telecommunications infrastructure, also referred to as Salt Typhoon." If Beijing believed a major conflict with Washington was imminent, the assessment said, it "could consider aggressive cyber operations against U.S. critical infrastructure and military assets" designed to impede U.S. decision-making, induce "societal panic," and interfere with the deployment of U.S. forces.

The 2026 Annual Threat Assessment again called China "the most active and persistent cyber threat to U.S. Government, private-sector, and critical infrastructure networks" and said Russia "poses a persistent, advanced cyber attack and foreign intelligence threat." Both countries, it said, "are continuing their R&D and pre-positioning efforts to advance their premier cyber attack capabilities for use against the U.S." Iran, the same report said, "poses a threat to U.S. networks and critical infrastructure in the form of cyber espionage and cyber attacks."

In a February 2024 joint advisory, CISA, the NSA, and the FBI said they have confirmed that Volt Typhoon "has compromised the IT environments of multiple critical infrastructure organizations," primarily in the communications, energy, transportation, and water sectors. They assessed "with high confidence" that this was not ordinary espionage and that the actors were "pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions," in some cases for "at least five years."

In August 2025, CISA, the NSA, the FBI, and foreign partners issued another joint advisory on a campaign that overlaps with industry reporting on Salt Typhoon. It said PRC state-sponsored actors have targeted telecommunications, government, transportation, lodging, and military networks, often by compromising routers, and that stolen data "ultimately can provide Chinese intelligence services with the capability to identify and track their targets' communications and movements around the world." CISA's current China threat overview, citing the 2026 assessment, says Chinese government-linked actors are positioning themselves on IT networks in a way that "allows them to disrupt critical functions at a time of their choosing."

Those are official assessments of capability, access, and intent in a future crisis. They are not an official attribution of Friday's outage or the river collision.

Federal law enforcement has also taken public action against other China-linked cyber activity. On March 5, 2025, the Justice Department announced charges against 12 Chinese nationals, including Ministry of Public Security officers and employees of the contractor i-Soon, in campaigns also linked to the group known as APT27 or Silk Typhoon. Those are charges, not convictions; the department said the defendants are presumed innocent unless proven guilty. On August 26, 2026, the Justice Department and the FBI announced court-authorized seizures of hacking platforms used by a PRC state-sponsored group known as QTFY, which court documents said had targeted U.S. critical infrastructure and other sensitive networks, including NASA, the Federal Reserve, and the U.S. Senate. The same announcement said the FBI in 2024 disabled a botnet that the PRC-sponsored group Flax Typhoon was providing to Chinese government customers, and that in 2023 it disrupted a botnet used by Volt Typhoon.

The Department of Homeland Security's Homeland Threat Assessment 2025 also warned of unauthorized drone activity over sensitive infrastructure sites, which "could interfere with regular facility operations, disrupt emergency response or authorized flight operations, and provide intelligence to malign actors." It said many such flights belong to unknown operators and that, at the time of the report, there was "no information suggesting violent extremists are using drones in attack planning."

The official record does not show that Washington has confirmed a kinetic or cyber attack on Friday. It does show that the government has already warned, in its own name, that foreign services have burrowed into U.S. infrastructure, including transportation and communications, and could try to use that access in a conflict. Johnson and I argue that the country is under attack now. Officials investigating Friday's ground stop have said they have seen no evidence of a cyberattack and that the failure appears mechanical, while still looking. Officials investigating the New Orleans collision have described a loss of steering, with the cause not yet known. Those findings and those warnings are both real, and they should be kept distinct.