Let’s talk about the afternoon the United States stopped every plane in the sky — and nobody could say which system did it.
Friday, the thirteenth of November. Just after lunch on the east coast.
Somewhere over Kansas there’s a plane at cruise, three hours out, seatbelt sign off, somebody’s watching a film on a laptop. In a terminal at Dulles, a few hundred people are standing in front of a board that has stopped updating. And in a control room, an air traffic controller is looking at a comms system that has gone quiet in a way it is not supposed to go quiet.
Picture that controller. Twenty years in. He knows exactly what his screens should look like at two in the afternoon. They don’t look like that.
By the end of that afternoon, the Federal Aviation Administration had ordered every flight in the country grounded. Not a region. Not a weather event. The whole country.
More than six thousand flights cancelled. Ten thousand delayed. Passengers pulled off planes already boarded. Planes parked nose to tail on tarmacs from Atlanta to Seattle.
The stop was lifted around quarter past eight that night. And here’s the scale of what happened: it was only the second nationwide ground stop since they shut American airspace after 9/11. The only other one was a system failure in January 2023.
That’s the size of the thing.
Now here’s the part that made people suspicious, and they had a reason to be.
Three days earlier, the FAA had finished rolling out a new AI system to air route traffic control centers across the country. It’s called SMART — Strategic Management of Airspace Routing Trajectories. It’s built by a company called Air Space Intelligence, and the programme is reported at close to a billion dollars.
What it does, in the FAA’s own description, is watch the shared picture of schedules, weather, airport capacity and airspace all at once, and surface conflicts earlier, while there’s still time and room to fix them. Reroute before the delay happens. Less fuel, fewer cancellations, less waiting on the ground.
That sounds like a good thing. It probably is a good thing.
And three days after it went nationwide, the country’s airspace stopped.
So by Friday evening, three separate parties had lined up to say it wasn’t them.
Air Space Intelligence, at 5:34 in the afternoon: the ground stop “is not based on or a result of the SMART system, any product of ASI or our integration with FAA and ATC.”
Microsoft, on the same evening, because their own services had fallen over that week: no indication this is related to any Microsoft service.
And the Transportation Secretary, at the White House briefing: the cause was old equipment that got overwhelmed. Antiquated. Then he asked Congress for fifty billion dollars to replace it.
Meanwhile the Homeland Security secretary, asked directly about the timing, said: “We’re looking at that.”
Now. Read those three statements again, slowly, because they are not the same kind of statement.
The Secretary’s is a diagnosis. Old kit, too much load. Fine. That’s plausible, and it might well be true — a lot of that equipment really is decades old.
The vendor’s is a denial. Which is what a vendor says.
But nobody produced a single line of evidence that could tell you which machine was involved. Not “here is the log, look at the timestamps, the new system was idle from 13:41.” Not “here’s the trace, the fault was in a forty-year-old switch.” Just: it isn’t plugged in. That’s a sentence. It’s not proof.
And that’s the thing I can’t get past. Not whether AI caused it. Whether anyone could have answered the question if they’d wanted to.
Think about how aviation actually works. Every part on that aircraft you were sitting in has a part number. Every modification has paperwork. Every flight has a tail number. If a component fails, they can put their finger on it, pull it, and say — this one, this serial, this batch, this date.
That is not bureaucracy. That’s how a system gets to be trusted. Not by being perfect. By being traceable.
Now do the same exercise for the software in the control room, three days into a national rollout. Can you name the component? Can you switch off one component and prove the rest still works? Can you separate the new thing’s footprint from the old thing’s, in the record, at the moment it breaks?
If the answer is no, then you didn’t deploy a tool. You deployed a suspect.
And here’s what makes it worse, and bigger than one agency. It’s not that AI broke the airspace. It’s that a machine was added to the country’s most operationally disciplined system, and when that system failed, the first question — was it the new thing? — was unanswerable in public, for at least a day. That’s not an AI problem. That’s a plumbing problem, and it’s the plumbing almost every company in the world now has.
You’ve got a new model sitting in the middle of your quoting, your scheduling, your payments, your support queue. Someone asks you on a Tuesday why a thing went wrong. Can you honestly say the new part was not involved? Or would you say what everyone said on Friday: it isn’t plugged in.
Before I get to what to do about it — one thing deserves credit, and nobody gave it.
The country stopped. Deliberately. A human being, or a room of them, decided they would rather ground every plane in America than run it on information they couldn’t trust. That is a hard call. It cost billions of dollars in a single afternoon and it will be in the news for a month.
That is what oversight actually costs. Not a checkbox. Not a signature on a form. A person, with a career, choosing to stop the machine instead of hoping. Most organisations say they want that. Almost none will pay for it.
And notice what happened next: within hours, the event turned into a budget argument. Fifty billion for new equipment. First the failure, then the ask. The investigation will get eaten by the funding fight, because that’s how Washington works, and because a repair is easier to sell than an answer.
So what do you do, if you’re the one running a system with something new in the middle of it.
Three things. None of them are clever.
One. Run a blackout test before you go live, and then run it again every quarter. Turn the new component off on a normal working day and prove the old path still does the job. Not on a slide. In production. If the business falls over the moment you switch the new thing off, you don’t have a tool, you have a load-bearing wall you never inspected.
Two. Give the new component its own name, its own switch, and its own owner. It should be identifiable in the record on its own. When something breaks, you want to be able to say, in minutes, “the new service was idle” or “the new service took the call at 13:41” — and have that be a fact somebody can check, not a sentence somebody can say. Separate credentials. Separate log. Separate person who can hit stop.
Three. Write the alibi before you need it. Go-live, on the same page, one paragraph: here is how we prove in fifteen minutes that it wasn’t us. If that paragraph takes a committee and a week to produce, you’ve answered your own question about whether the system is under control.
None of that is about being anti-AI. It’s the opposite. It’s the only way you get to keep using the thing.
Because the real risk isn’t that the new system causes the failure. It’s that the new system gets blamed for the old one’s failure, or the old one gets blamed for the new one’s, and nobody can tell the difference. When that happens, two bad outcomes follow. You rip out something that was working. Or you keep something that wasn’t.
And on a long enough timeline, you get the worst outcome of all: people stop believing any of it. They read “it wasn’t us” from a vendor, from a government, from a company, and they file it in the same place. Which is where trust goes to die.
By quarter past eight that night the sky was open again. Planes moving, boards updating, people in terminals finding a chair and a phone charger and calling home.
Nobody has told us yet what closed it.
That’s the part I wouldn’t accept if I were the one signing for the tower. Not the outage — outages happen. The not knowing which machine touched it, and being asked to take someone’s word for it afterwards.
A system you can’t isolate is a system you can’t defend. And a system nobody can defend is one where the person holding the signature carries all the weight and none of the information.
The fix is boring. Traceability. A switch. A name. A test you run before you need it.
Do that, and when the day comes, you get to say the only sentence worth saying: it wasn’t us, and here’s how you can check.