The Air Traffic Control system does transmit information over the internet. The Air Traffic Control system has a number of components, some of which transmit information over the internet. According to Review of Web Applications Security and Intrusion Detection in Air Traffic Control Systems, Office of Inspector General, DoT,
..Federal Aviation Administration (FAA) has increasingly turned
toward the use of commercial software and Internet Protocol (IP) -based
technologies to modernize ATC systems.
Note that the ATC is not connected directly to the internet. It is the behind scene connections, that are routed through the internet. According to a security professional,
... when most managers say there is no connection to the Internet, they are unaware of maintenance connections. Behind the scenes there are almost always semi-direct connections through routers shared between the control system and business systems that can be exploited
Actually, the use of internet for sharing of information is increasing. FAA's NextGEN modernization involves a significant amount of information transmission over the internet. According to US Government Accountability Office,
NextGen is a modernization effort begun in 2004 by FAA to transform the
nation’s ground-based ATC system into a system that uses satellite-
based navigation and other advanced technology. ... These
new technologies will use an Internet Protocol (IP) based network to
Image from GAO report on Air Traffic Control
This increasing connection to the internet does increase the associated risks. From the same GAO report:
... the shift to NextGen technologies will require FAA to replace its proprietary, relatively isolated ATC computer systems with information systems that interoperate and share data throughout FAA’s operations and those of its aviation partners. ... These new systems...will also employ digital and Internet-based computer-networking technologies, exposing the air traffic control (ATC) system to new cybersecurity risks.
As to why the ATC is connected to the internet, it basically boils down to ease of operation. According to [NATS], which manages UK airspace,
We ... are now working all over the world within an industry where systems are connected across organisations, countries and continents.
Such an interconnected worldwide system requires a standard platform, which will not be possible (or atleast very difficult to maintain) if a closed, proprietary platform is used.
So, the ATC does use internet, though this is mainly to transmit information. However, I'm not aware of the security systems, though we can be sure that they do have some sort of encryption (If I'm correct, Lockheed Martin supplies the software) and have firewalls to protect the systems.