Aviation experts are raising serious national security concerns about ensuring that the U.S. government properly vets risks from companies that provide air traffic control (ATC) technologies to China, pointing out that the U.S. could be vulnerable to cyberattacks if such companies are permitted to design or operate American ATC systems like the new common automation platform (CAP).
The Federal Aviation Administration (FAA) announced last November that it was seeking proposals to revolutionize how ATC officials receive flight data and move aircraft between facilities with a “single, state-of-the-art platform” referred to as a CAP, as part of Transportation Secretary Sean Duffy’s plan to build a brand-new ATC system.
Transportation Secretary Sean Duffy speaks during an event at the White House, Thursday, July 30, 2026, in Washington, DC. (AP Photo/Alex Brandon)
In April of this year, industry outlet Air Current reported that the companies on the FAA’s short list included U.S.-based Leidos and RTX, Spain’s Indra, and France’s Thales. The companies were among those reportedly asked to present their versions of a CAP to agency officials at their Washington, DC, headquarters.
Both Indra and Thales have done extensive work in and for China and have been deeply entrenched with the country’s aerospace industry and systems for decades.
RELATED VIDEO — If China Wins the AI Race, They Will Export Repressive Technology Worldwide:
Threats to information systems like the ones the FAA uses for ATC services have been growing, with nearly 2,300 cybersecurity incidents in the aviation subsector being reported to the Cybersecurity and Infrastructure Security Agency (CISA) between 2020 and 2025. In a 2024 threat priorities report, CISA highlighted the “threat posed by malicious cyber actors” acting on China’s behalf.
While the FAA is considering foreign companies to build a new CAP, the European Union (EU) is more protective over its airspace. In 2024, a regulation was put in place barring non-EU companies from providing ATC services in any member states.
In general, the FAA is in need of upgraded risk management procedures to adequately defend against cyberattacks that could cripple American infrastructure — and the federal government would agree.
According to an April report from the Department of Transportation Office of Inspector General titled “FAA Does Not Effectively Secure Its High-Impact Systems Supporting the National Airspace System,” the FAA had left many of its systems “vulnerable to cyberattacks that could cause severe or catastrophic effects on the NAS.”
RELATED VIDEO — Mike Waltz: We Have to Rely on Domestic Manufacturing for Our Defense:
In July 2026, the Government Accountability Office (GAO) released another report titled “FAA and TSA Are Collaborating on Cybersecurity but Need to Address Key Shortfalls.” That report, which highlighted the growing number of threats reported to CISA, recommended the FAA update its Zero Trust Architecture (ZTA) implementation plan to “include detailed steps for transitioning all operating environments to a zero trust architecture” and “align with [National Institute of Standards & Technology] zero trust best practices.”
As explained by California-based cybersecurity firm PaloAlto, a ZTA is a framework built on the foundational principle of “never trust, always verify.”
“Unlike traditional security models that assume everything inside the perimeter is safe, ZTA treats every user, device, and application as untrusted by default — whether inside or outside the network,” the company explained.
Without taking such actions, the GAO argued the FAA “cannot ensure that it is effectively managing cybersecurity risks, including during NAS [U.S. National Airspace System] modernization.”
In its 2027 report, the Transportation, Housing and Urban Development, and Related Agencies (THUD) panel of the U.S. House Committee on Appropriations stated that the FAA shall consult with the appropriate federal agencies to vet risks posed by third parties as they search for a new CAP, explicitly calling out “those that have legal or business relationships with the People’s Republic of China (PRC) or any other entity otherwise owned or controlled by any governmental organization of the PRC.”
WATCH — Sen. Banks: Trump’s Donroe Doctrine Told China “You’re Not Welcome in Our Backyard”:
THUD went on to state that the FAA will be required to report to the House and Senate Appropriations Committees if any contract, agreement, or other transaction with a third party supporting the CAP project has a relationship with China.
The panel added that a report would have to include the risks posed to personnel, equipment, and operations of the FAA, any measures that the FAA will take to mitigate such risks, any measures that will be taken by that third party or other parties to mitigate such risks, and any other matters the FAA determines to be relevant.
While headquartered in Madrid, Indra has established itself as one of the key companies in the overhaul of China’s air surveillance network and automation centers since they began doing business in the country in 1989. In the air traffic management (ATM) market, Indra does business through a wholly foreign-owned subsidiary founded in 2002, called Indra Information Technology Systems (Beijing) Co., Ltd. — which also operates under the name “Indra China.”
Indra has gotten several major contracts from China, with its ATM systems coordinating the upper airspace of eight Chinese provinces, covering an area about the size of Western Europe. The company has deployed more than 1,000 air navigational aid systems, equipped more than 15 ATC towers, and deployed 50 radars in the Asian nation, with its radar controlling 60 percent of Chinese airspace, and its systems covering 80 percent of aircraft movements.
“Indra has played a critical role … for putting the new Tianfu airport into operation,” a 2022 press release stated. “This is one of the largest air traffic projects the country has launched in recent years. This achievement adds to the company’s long history of success in its collaboration with the Civil Aviation Administration of China (CAAC).”
Thales, which is headquartered in Paris, operates as Thales China in Beijing and has maintained a major presence in the country since delivering its first takeoff and landing system to Beijing Capital International Airport in 1964.
By using an “In China, For China” strategy, Thales has become a major technology supplier to the CAAC and was managing 60 percent of China’s air traffic as of 2019.
Speaking at the China Development Forum in Beijing in 2018, then-CEO of Thales China Laurent Guyot told CNBC, “Thales has been in China for more than 30 years so we have some experience about doing business in technological areas in China. What we can say is that it’s about a question about partnership. If you have the right partners you are engaging to a true business-oriented relationship, you have to develop some technologies in China of course, we want to localize R&D in China. And when you follow this kind of approach, good partners, localization of technologies, I think you can get all the benefits of being there.”
Guyot continued later, “I don’t think that transfer of technology is what we want to do. I think that the new rule of success is to co-develop in China, is to generate technologies from China together with Chinese partners.”
As part of a French President Emmanuel Macron’s state visit to China in December 2025, Thales China CEO Jean-Marc Reynaud stated, “There is a place for a win-win situation for Chinese and French companies. We can see some real prospects in the aviation industry, with strong demand and great ambition for 2050 in China.”
While Leidos, which is based in northern Virginia outside of Washington, DC, is in favor of an amendment to the NDAA to require the FAA to study how a third-party vendor’s foreign business ties might undermine national security, Thales USA vice president Tony Lo Brutto argued that it would needlessly stoke bias against companies that operate in China.
In a July statement published by Bloomberg Government, Lo Brutto called the concerns about Thales’s interests in China a “boogeyman.”
Still, he acknowledged the tension in another recent comment to the Air Current.
When asked how Thales would handle a hypothetical request from China to buy a new CAP system similar to the one the FAA wants, Lo Brutto said, “I’m not sure they would get a positive answer to that, given who our customer is.”
Indra and Thales previously told the Air Current that they reject the notion that their air systems could pose a national security risk to the U.S., though neither responded to Breitbart News’s request for comment.
Speaking with Breitbart News, an aviation industry source stressed the importance of protecting the U.S.’s critical infrastructure from China.
“The big thing that we’ve learned historically, is that America has learned the hard way from outsourcing critical infrastructure, and that air traffic control is definitely a critical component of America’s critical infrastructure,” the source said, before adding that the new CAP the FAA is seeking will be “truly the system of systems.”
“This is an incredibly consequential decision that the FAA is going to make in the next year, and we need to do our best to mitigate China’s ability to infiltrate the air traffic control system,” the aviation expert argued.
Leidos spokesman Greg Hellman highlighted President Donald Trump’s national security goals in a statement to Breitbart News.
“In much the same way President Trump has taken action to protect the U.S. electric grid, the system at the heart of America’s air traffic control network is critical national infrastructure and logically deserves similar security protections,” Hellman said.
Referring to the National Defense Authorization Act, he went on to point out that Congress and past administrations “have regularly included provisions, such as those in the NDAA, to protect sensitive national security technologies from the People’s Republic of China and others, focusing on cyber risks, supply chain security, foreign influence, and technology exposure.”
“Companies with significant ties to China’s air traffic ecosystem should face the highest level of national security and cybersecurity scrutiny, before being considered for providing systems that keep America’s skies moving,” the Leidos spokesman added.
Olivia Rondeau is a politics reporter for Breitbart News based in Washington, DC. Find her on X/Twitter and Instagram.