Homeland Security Secretary Markwayne Mullin told reporters Friday night it “doesn’t appear” that a cyberattack was involved though he admitted that “there’s nothing certain right now.” 

Transportation Secretary Sean Duffy expressed confidence Saturday that foul play wan’t involved, and reiterated that message on the Sunday talk shows—but still qualified his statements.

In an interview with ABC’s This Week, he said the director of national intelligence, the National Security Agency, the FBI, and the Cybersecurity and Infrastructure Security Agency were all on a call together with “our intelligence partners” after the FAA’s communication problems emerged.

They didn’t see any chatter or “footprints” that are normally associated with a cyberattack, he added. Instead, the FAA has zeroed in on a copper wire line that was being updated to a fiber-optic cable by contractor L3Harris.

“We felt pretty comfortable that this was an internal network issue that’s owned and operated for us by L3 Harris, not an outside a factor,” Duffy said. “We feel pretty good still today that it is not a hacking event. But if the FBI comes in and says ‘no, we found something,’ obviously we’ll share that with the American people. But we have no indication that this was a hack.”

In a briefing on Saturday, Duffy explained that the changeover to the fiber-optic cable caused routers across the air traffic control system to be flooded with more than 1,000 connection attempts every four to five seconds. Because it disrupted some radar feeds, the FAA ordered the ground stop to ensure safety. It was lifted about four hours later.

The installation took place in El Dorado, Arkansas, and a router from that location is now at an L3Harris lab in Florida with FAA staff, he told Fox News Sunday, adding that the FBI is offering assistance and suggesting a cyberattack still hasn’t been totally ruled out.

“We think it was the installation or the router that was the bad actor,” Duffy reiterated. “But we’re open. If we see something else, we’re going to continue to investigate with our federal partners and law enforcement. But at this point, we don’t think [a cyberattack] was the cause.”

While the router in Arkansas is under scrutiny, a separate one in Amarillo, Texas, also acted up, raising another question about the disruption.

Duffy said the upgrade in Texas had been done weeks earlier, but started to broadcast data into the FAA network at the same time as the Arkansas router.

He told CBS’s Face the Nation that the FAA is investigating why that happened, noting both routers are at the L3Harris lab in Florida where the FBI is offering support.

ABC asked if sabotage has been ruled out, and Duffy replied “we’re looking at a full suite of issues with the router and with the installation.”

The FAA knows who performed the installation, and Duffy called the technician a “good American patriot” who is believed to be a veteran as well.

“So we don’t think that someone tried to sabotage the network on the install at all,” he added. “But we don’t actually have the root cause, which is why we do the investigation with our L3Harris partner on the network and the FBI and the FAA.”

For its part, an L3Harris spokesperson said Saturday that the company has been modernizing the communications infrastructure for the National Airspace System in close coordination with the FAA. 

Along with its telecom partners and the FAA, L3Harris added that it has completed more than 70% of the conversion from legacy copper wires to a fiber optic system.

“We are supporting the FAA in its investigation to understand the conditions that led to the Nov. 13 ground stop of our nation’s air travel,” the spokesperson said in a statement. “L3Harris takes the nationwide ground stop and its impact on travelers, airlines and air traffic operations seriously.”