By Rekpene Bassey
These are unsettling days for civil aviation, not because commercial flying has suddenly become unsafe, but because recent incidents have exposed a disturbing evolution in the threat environment: the aircraft itself can become the theatre of an attack, and the threat may emerge from a person who has already passed through the security perimeter.
The attempted takeover of FlyDubai Flight FZ1073 on September 30, 2026, is therefore more than an alarming aviation incident. The flight, travelling from Dubai to Tel Aviv, experienced a violent cockpit confrontation in which the co-pilot allegedly attacked the captain with the aircraft’s crash axe and attempted to take control of the aircraft.
The plane subsequently diverted to Tabuk, Saudi Arabia, where the incident was brought under control. UAE authorities have now characterised the episode as a terrorist act, although the investigation into the motive and possible connections remains active.
What makes the episode particularly significant for security professionals is the question of insider threat. Aviation security has traditionally concentrated on preventing hostile actors from penetrating the perimeter: screening passengers, inspecting baggage, securing restricted areas, protecting aircraft and controlling access to the cockpit. But an insider who legitimately possesses privileged access can bypass many of the barriers designed to stop an outsider.
That is precisely why insider threat occupies an increasingly important place in contemporary aviation security architecture.
The International Civil Aviation Organization recognises that aviation personnel may possess privileged access to secure areas, sensitive information and operational systems, and that such access can be exploited deliberately or through negligence.
The challenge is therefore not simply to keep dangerous people out of airports, but to identify changing risks among people who have already been admitted.
The FlyDubai case consequently raises a difficult intelligence question: how does an aviation system distinguish a trusted insider from an insider who has become a threat? The answer cannot be found in a single background check conducted at the point of recruitment. Security clearance is not a permanent certificate of harmlessness; risk is dynamic, and human behaviour can change after employment.
This is where the distinction between conventional security screening and security intelligence becomes critical.
Screening asks whether an individual meets defined security requirements. Intelligence asks whether available fragments of information collectively reveal an emerging threat. The latter requires the fusion of personnel records, security reporting, behavioural indicators, law-enforcement information, travel history, credible intelligence and, where lawful, other relevant data.
The aviation industry has long understood the importance of personnel vetting. ICAO guidance calls for background checks and recurrent security assessments for personnel with access to sensitive areas or information, while its insider-threat framework emphasises continuous vigilance.
IATA likewise identifies pre-employment vetting, behavioural awareness, reporting mechanisms and risk-based personnel security as elements of insider-threat mitigation.
However, vetting has an inherent limitation: it is a snapshot of the past. A person may have an impeccable employment history, no criminal record and apparently satisfactory professional credentials, yet still develop a dangerous intention years later. The intelligence challenge is therefore one of continuous security assurance, not merely recruitment screening.
That distinction should reshape the way airlines, airports and national security agencies think about aviation protection. The relevant question is no longer simply, “Was this person properly vetted?” It is also, “What changed after the person was vetted, and did anyone notice?”
The answer requires a stronger security culture across the aviation ecosystem. Pilots, cabin crew, engineers, ground handlers, air-traffic personnel, contractors, cleaners, caterers and other employees with privileged access are not merely components of an operational system; collectively, they constitute an important human-security layer. Their ability to recognise anomalous behaviour and report it without fear or bureaucratic obstruction can become an early-warning mechanism.
Passengers, too, remain part of the security architecture. In the FlyDubai incident, the intervention of passengers and crew became a decisive defensive measure after the cockpit crisis. That should not be interpreted as a substitute for professional aviation security, but it demonstrates the value of human resilience when preventive controls fail.
There is, however, another lesson that intelligence agencies must not overlook: information itself can become a threat vector. A video circulating online, purporting to show a burqa-clad woman attempting to ignite an aircraft seat, has been repeatedly presented in recent reporting as though it were a new incident. Available reporting indicates that the footage is an older episode that resurfaced rather than a newly verified terrorist attack. The distinction is important.
Security intelligence begins with source validation. An image, video, anonymous social media account or sensational claim is not intelligence merely because it attracts attention. It becomes intelligence only after its provenance, authenticity, chronology, context and relevance have been assessed.
The failure to make those distinctions can produce false threat assessments, unnecessary public alarm and potentially discriminatory security responses.
This is particularly important when religious or cultural symbols are involved. A burqa, hijab, nationality, ethnicity or religious identity cannot, by itself, constitute a threat indicator. Intelligence-led aviation security must focus on behaviour, capability, intent, access and corroborated information, not appearance or religious identity. Otherwise, security can become both less effective and less legitimate.
The more serious concern is that terrorist organisations and violent extremists continually search for vulnerabilities rather than merely repeating historical methods. Aviation has already experienced hijacking, sabotage, concealed explosives, insider attacks, cyber risks, supply-chain vulnerabilities and attacks against airports. The threat environment is therefore better understood as an evolving ecosystem of multiple attack vectors rather than a single terrorist methodology.
The cockpit remains the aircraft’s critical command environment. The principle of cockpit security was strengthened dramatically after earlier hijacking eras, and reinforced cockpit doors, access controls and procedural safeguards have become fundamental features of modern aviation security.
But the FlyDubai episode demonstrates the paradox: the door that protects the cockpit from an outsider cannot, by itself, protect the cockpit from a person already inside it.
This is why the contemporary aviation-security model must integrate physical security, personnel security, behavioural threat assessment, intelligence sharing and operational resilience. Each protects against a different failure mode. No single layer is sufficient because sophisticated threats exploit the seams between layers.
The intelligence community therefore has a particular responsibility. Aviation-security information should not remain trapped in institutional compartments. Airlines, airport operators, civil aviation authorities, police, immigration services, intelligence agencies and other relevant national-security institutions need lawful mechanisms for timely information exchange.
ICAO’s global aviation-security framework explicitly emphasises cooperation, risk management and implementation of security standards across states.
For countries such as Nigeria, the lesson is especially pertinent. Nigeria’s international airports are gateways not only for passengers and commerce but also for diplomatic movement, strategic connectivity and national infrastructure. Aviation security should consequently be treated as a component of national security, rather than merely an airport-management function.
That requires strengthening the intelligence cycle around aviation: collection, collation, evaluation, analysis, dissemination and feedback. Threat information received by one agency must be capable of reaching another agency when the legal and operational circumstances require it. Equally important, intelligence disseminated to frontline personnel must be actionable, timely and sufficiently specific to support preventive decisions.
There is also a need for more sophisticated red-team assessments and vulnerability analysis. Security authorities should periodically ask how an informed adversary would attempt to penetrate the aviation system, where the weakest controls would be found, which personnel possess privileged access, how an insider might exploit institutional complacency and what warning indicators might precede an attack.
The objective should not be to create an atmosphere of permanent suspicion in the aviation industry.
Excessive security theatre can be as counterproductive as inadequate security. The objective is risk-based vigilance: identifying credible threats early, concentrating resources where vulnerability and consequence intersect, and continuously testing whether existing controls still work against emerging methods.
The FlyDubai incident should therefore trigger questions rather than premature conclusions. How was the alleged threat identified? What information was available before the flight? Were there previous indicators? Were relevant authorities aware of them? How did personnel vetting operate across jurisdictions? What did the cockpit procedures accomplish, and where were their vulnerabilities exposed? What lessons will emerge from the flight-data recorder, cockpit-voice recorder, communications and personnel investigations?
Those questions belong to the investigators, not commentators. A professional security system must resist the temptation to reach conclusions before the evidence is assembled. Intelligence is not conjecture; it is disciplined inference from verified information, continuously tested against new evidence.
The wider lesson, however, is already clear. The next generation of aviation security cannot depend exclusively on metal detectors, scanners, reinforced doors and passenger profiling. Those measures remain indispensable, but the security perimeter must increasingly extend into the human domain: who has access, who has changed, what has changed, who noticed, who reported it and whether the system responded.
Commercial aviation remains one of the world’s most consequential achievements in mass transportation, and its security record rests upon layers of engineering, regulation, professionalism and international cooperation. But every successful attack begins with a vulnerability, and every vulnerability becomes more dangerous when institutions assume that yesterday’s security architecture will defeat tomorrow’s threat.
The imperative, therefore, is neither panic nor complacency. It is intelligence vigilance. Aviation security must become anticipatory rather than merely reactive; integrated rather than compartmentalised; evidence-driven rather than appearance-driven; and continuously adaptive rather than periodically reinforced after tragedy.
In securing the skies, as in national security generally, the greatest advantage belongs to the side that detects the threat before the threat becomes an incident.
*Rekpene Bassey is the President of the African Council on Narcotics and a Security Specialist.
