As of this brief: the Nov 13 nationwide departure stop is in phased release and is assessed as a common-mode telecommunications failure on the FAA's shared FTI backbone — not, on current evidence, a hostile act. The RAF Lakenheath drone response (1830Z) is a separate thread inside a weeks-long threat pattern around the UK bases; no connection to the FAA event is proven. No second-sector effects observed. Household posture: shelter in place; rally at WANDERER on his call.
1. Situation
FAA event. On Nov 13, a rolling loss of ATC frequencies and/or radar services across multiple Centers surfaced first at Chicago (O'Hare-bound departures stopped 2010Z, Midway ~2017Z). The FAA's Command Center in Herndon issued a nationwide departure ground stop at 2054Z (Advisory 111) "for extraordinary circumstances and reasons of safety" — only the second such stop since 9/11, after the Jan 2023 NOTAM outage. Airborne flights continued and landed; the FAA states every flight was accounted for. By evening the stop was in phased, tiered release as Centers recovered (Advisory 120, 2246Z), with the restriction formally listed through 0400Z Nov 14. FlightAware evening totals: roughly 10,500 U.S. delays and 2,573 cancellations.
UK event. At 1830Z, USAF Security Forces at RAF Lakenheath responded to suspected unauthorized drone activity; personnel sheltered; the UK MoD later said the situation was resolved with no personnel, aircraft, or infrastructure affected. Sirens were also reported at RAF Mildenhall and RAF Feltwell — unconfirmed. UK bases were reported raised to FPCON Delta by open-source monitors; that has not been officially confirmed. The bases were already at FPCON Charlie earlier in the week.
Background noise. A global Microsoft 365 outage ran Nov 12–13 (Microsoft: an earlier network-capacity upgrade surfacing after a network change; explicitly not cyber and no malicious activity). It is logged here because it shared the news cycle, hospitals included — it is not assessed to be part of either event above. A same-evening story of a nationwide weather-radar outage was corrected by the National Weather Service itself: no outage occurred.
2. Threat Picture
Two foreign-intelligence files bear on the UK thread. They are kept separate because the evidence is separate. Neither file is connected to the FAA failure on any evidence in hand.
Iran fileREPORTED
The Lakenheath/Mildenhall alert level (FPCON Charlie) was raised this week on a reported Iran threat picture (WSJ). — Wall Street Journal reporting
RAF Fairford, Sep 27: men in white vans approached the bomber base at night; barrels of fuel and shrapnel material were later described in a U.S. charging document. Two men were charged in the UK, one with assisting a foreign intelligence service, believed to be Iran's; the U.S. DoJ charged three men it describes as Iranian operatives in the same plot, and separately said a member of an Iran-backed militia plotted an attack on Fairford from U.S. detention. Tehran denies involvement. — Reuters; CNN; AP
The head of MI5 said in October that Iran has stepped up attempts against harder targets in Britain, including military sites. An Iranian security official said Nov 12 that Iran would strike U.S. bases beyond the Middle East, including in Europe, if they are used for attacks on Iran — U.S. aircraft flew strikes on Iran from UK bases earlier this year. — CNN; Reuters
Russia fileREPORTEDANALYSIS in source
Drones over Lakenheath and Mildenhall in November 2024 were assessed in an IISS investigation as likely launched from Russia's shadow-fleet cargo ships. — IISS, via The Times
Germany has blamed Russia for an attempted attack at Leipzig/Halle Airport in August, where a drone carrying explosives and a detonator was found. — Reuters
A U.S. Army officer assigned to a NATO unit near Gloucester was arrested this week on suspicion of spying for Russia; police state it is not connected to the Fairford investigations. Logged to keep the two files from blurring. — AP
Working read: tonight's drone, if a drone it was, fits the pattern of a probe — observe the response, time it, photograph the posture — the cheapest reconnaissance there is. Attribution: none official.
3. Friendly Picture
FAA / ATCSCC (Herndon): phased, tiered release of departures as each Center recovers; formal restriction listed through 0400Z Nov 14, next update expected then. Cause stated by FAA: communications failure across the ARTCCs. CONFIRMED
DOT / DHS: Secretary Duffy attributes the failure to the shared communications issue across all 22 Centers. DHS Secretary Mullin: no indication as of this brief of a nefarious attack; not ruled out either, including cyber. CNN, citing two law-enforcement officials: preliminary indications are it is not a cyberattack. REPORTED
USAF / EUCOM (Lakenheath): Security Forces responded; no personnel, aircraft, or infrastructure affected. UK MoD: coordinating, situation resolved. CONFIRMED
White House: officials expected to be briefed during the evening of Nov 13. No standalone CISA, FBI, or White House statement on the FAA event had been issued at last check. REPORTED
4. Analyst Assessment
We assess with moderate-to-high confidence that the FAA event is a common-mode failure of the shared FTI telecommunications backbone — one network, one failure, national effect — in line with its own precedents: the 2014 ZAU fire that took Chicago Center down for 17 days, the September 2026 Northeast-corridor telecom outage, and the October 2026 Houston fiber cut. Baxter's estimate: roughly four chances in five this resolves as infrastructure failure; the main residual risk is the recovery itself flapping and forcing a second stop overnight. We assess the Lakenheath response as a discrete security incident inside a pre-existing threat pattern, unconnected to the FAA event on current evidence.
What would change this assessment: any tripwire in Section 6 tripping — a verified second-sector outage, a CISA emergency directive or attribution statement, a grid emergency alert, a confirmed stateside base alert change, or a credible claim of responsibility. None has.
5. Planning Assumption — Per GHOST's Direction (Not an Assessment)
For readiness purposes, this household plans on the assumption of a hostile cyber operation until it is disproven. This assumption drives preparation only. It does not change the assessment in Section 4, and it is labeled here so no reader mistakes the plan for the evidence.
6. Indicators & Warnings
GREENTripwire 1 — Second infrastructure sector suffers an unexplained failure (power, water, telecom, 911, pipelines, ports, data centers).
GREENTripwire 2 — CISA issues an emergency directive or a statement attributing hostile cyber activity.
GREENTripwire 3 — ERCOT or any U.S. grid operator declares an energy emergency alert.
GREENTripwire 4 — A stateside U.S. base alert / FPCON change is officially confirmed.
GREENTripwire 5 — A credible claim of responsibility for either Nov 13 event.
All five GREEN at last check. Tripwires are flipped by hand, after a check — nothing on this board changes itself.
7. Collection Gaps — What We Don't Know
Root cause of the FTI failure: unattributed. (Single-source reporting of an FBI look at a software update remains unconfirmed.)
FPCON Delta at the UK bases: reported by open-source monitors, not officially confirmed.
Whether radar services actually failed, or frequencies only: the FAA's wording to airlines ("and/or") leaves it open.
The Lakenheath object: type, operator, and motive unconfirmed; officially "suspected" drone activity.
Role, if any, of the FAA's SMART traffic tool (expanded to all 22 Centers on Nov 10): vendor and FAA deny involvement; not independently verified.
Total passengers affected: not verified.
8. Outlook
Next 6 hours: the 0400Z FAA update is the fixed point — full lift, extension, or a second stop from recovery flapping. Cancellations ripple into Saturday regardless.
Next 12 hours: Saturday-morning backlog and repositioning; watch for a first FAA or CISA root-cause statement and any UK follow-up on the drone object.
Next 24 hours: if no tripwire has tripped by then, the infrastructure assessment firms up and this board stands down to daily checks. If one trips, the board goes back to a 30-minute watch and GHOST/WANDERER confer on posture.
9. Chronology — Trailing 14 Days (Zulu)
27 SEP 26
Men in white vans approach RAF Fairford at night. Later charged; prosecutors allege Iran-intelligence links. U.S. bombers subsequently withdrawn from Fairford. REPORTED
13 OCT 26
Fiber cut disrupts Houston Center (ZHU) communications — the same failure class as Nov 13, at single-Center scale. REPORTED
05–07 NOV 26
E-4B movement Offutt → East Coast → Georgia, unexplained in open sources. STRATCOM's Global Thunder 27 exercise has been running since Oct 22 — context, not conclusion. REPORTED
09 NOV 26
At least 12 KC-135s disperse from RAF Mildenhall across Europe; Lakenheath and Mildenhall reported at FPCON Charlie on an Iran threat picture; emergency drone restrictions imposed around both bases and RAF Feltwell. REPORTED
12 NOV 26 · ~1540Z
Microsoft 365 global outage begins. Microsoft attributes it to a network-capacity upgrade/change and states there is no malicious activity. CONFIRMED
13 NOV 26 · 1830Z
USAF Security Forces respond to suspected unauthorized drone activity, RAF Lakenheath. Resolved; no effects. CONFIRMED
FAA nationwide departure ground stop (Advisory 111). Phased release under Advisory 120 from 2246Z; next update 0400Z Nov 14. CONFIRMED
10. Relay Log — All Noticed Activity
Everything the watch notices gets an entry here — whether or not it earns a pin. Nothing is silently filtered. Baxter's judgment rides on each entry as a disposition: CONFIRMED INCIDENT · REPORTED — UNVERIFIED · EXPLAINED — KNOCK-ON EFFECT · EXPLAINED — UNRELATED · FALSE OR RECYCLED. Entries are data, re-read with the pins every 5 minutes.
Loading the relay log…
11. Command & Signal
GHOST — Sean. Leads the household. WANDERER — Sarge. Advises on posture and timing; the rally call is his.
Rally point: WANDERER's house, ~15 minutes from Home, when he calls it. Plan: shelter at Home first; Ruidoso only in an early window with roads clear and power on.
Comms: the COMMS LOG at the bottom of this page is the standing net for GHOST, WANDERER, and BAXTER. Baxter monitors it on a relay — see the note there.
Updates: this page re-reads its pin data every 5 minutes; the overnight watch sweeps the wires every ~30 minutes and posts changes here and in the log. Next fixed point: FAA update, 0400Z Nov 14.
Food: 2–3 days of canned goods and bottled water packed and staged.
Warmth: no freeze risk this week (Mansfield lows 42–45°F); space blankets staged; one-room warmth rule if power goes.
Vehicles: Honda CRV is the go-vehicle (fuel first, idle-and-brake check before any move). Tesla is on 110V trickle charge and serves as the local car / power reserve.
Power discipline: fridge 4 hours, freezer 48 hours, unopened. Manual can opener confirmed in the go-kit.
COMMS LOG — GHOST / WANDERER
Standing net for this board. WANDERER and GHOST transmit here; BAXTER monitors this net — traffic is relayed to him and his replies post back as BAXTER. Expect replies within minutes, not instantly.