Opinion: flydubai Scare Could Rewrite Cockpit Security To Fight Inside Threat

On September 30, the world was rocked by the news of a terror attack in our neighbourhood involving a flydubai aircraft. It was followed by unbelievable scenes of courage, bravery and singular heroism of the pilot and passengers of flydubai FZ1073 who stopped an attempt by the co-pilot to crash the aircraft or as some alleged, perform a September 11-type attack on Israel.

It is important to recognise that the available data from Flight Radar in the public domain has shocked the world of aviation - how could a Boeing 737 MAX descend that rapidly without breaking up or suffering major damage? The pressure exerted by the "almost freefall" was many Gs more than the aircraft could withstand. Yet we saw how it landed battered and bruised. The apparent act of the Israeli plumber Yaniv Hayoun of pulling the yoke back and stabilising the aircraft are out of an adventure story, but we know it happened. So rather than question or speculate, let us wait for the reports to emerge.

Would such a rescue and recovery be possible under normal circumstances? Not at all, even if it was simulated 100 times, it would fail 99 out of 100 times, but it worked this one time and they are all alive to tell the tale.

Sometimes, it takes many miracles to save the day and this was one such day. If even one of the people in this chain of events had not acted, we would have been mourning the dead.

Just like aviation changed inexorably after the September 11 attacks with the introduction of reinforced steel doors, fresh cockpit and crew protocols and APIS becoming a compulsory advanced screening tool for aviation, we will see changes now. I recall that in the early days after September 11 attacks, pilots and even crew with Muslim names were being delayed clearances by Homeland Security or extensive security backgrounds were sought.

The Pilot Crisis

There is a shortage of trained pilots globally, and to make matters worse, flying conditions for pilots are abysmal with excessive duty hours and shorter rests, transshipments through airports and highly stressed environments.

In India, we have seen a few incidents over the last two years that have either reflected on the weakening safety environment or in the emotional situation. Pilots face perhaps the most stressed civilian jobs in the world, carrying the burden of hundreds of passengers each take-off and landing and then dealing with the elements and sometimes temperamental machines. Not enough care has been taken to ensure the sanctity of their mind space.

The German Wings incident reminds us that there is a mental aspect of pilots that has shown up and is now monitored, but how do you evaluate radicalised minds with suicidal tendencies such as the ones we have seen during 9-11 and now in flydubai?

There are psychometric tests to see the psychological mindset of a pilot and their suitability for flying, but are there enough testing assessments to determine the radicalised situation? Maybe not. Radicals are known to undergo indoctrination to conceal their true thoughts.

What Went Wrong?

We need to understand what exactly went wrong on flydubai and single out the faults in the system that were exposed by the Omani co-pilot that almost caused the biggest act of aviation terror since 9-11.

Prima facie it appears to be a failure of APIS to track the system breach, apparent Lack of pre-advance intelligence of such a threat, breach of bilateral ASA's post the Abraham Accords, failure of flydubai to screen its pilots properly and failure to assess the radicalisation and emotional health of the pilot.

Israel follows the US model of APIS, and the NCPIA hub tracks all incoming passengers and crew. So how did the Israeli NCPIA miss the warning signs of the co-pilot Hamam al-Hammami? This was a major failure at a systemic level that will be investigated deep and hard.

There was apparently no known advance intelligence of such a plot or chatter on the networks, despite Israel and the US being at war with Iran. It would not be out of place to suggest that guards had been lowered post the Abraham Accords and I have a sense that there will be a thorough revaluation of these protocols.

The APIS stipulations are clear, that crew belonging to any nation that refuses to recognise Israel or that treats Israel as an enemy are barred from flying into Israeli airspace, namely Oman, Syria and Iran. Was this relaxed post the Abraham Accords? How did Hammami escape the net despite having both Omani and Syrian connections?

The mental state and emotional health of the pilot was one such issue that failed the crucial test in this incident. How did the system fail to recognise a pilot with radicalised tendencies and send them into a cockpit bound for Israel? This despite him having been allegedly removed from Oman Air due to his radical thoughts. That is a question that flydubai and UAE authorities will have to ruminate deeply over.

Guardrails For The Future

Aviation has grown in leaps and bounds, and the control of predictable technical failures has been at the focus of aviation regulators and manufacturers. This incident highlights to us that there are dangers that lurk inside the cockpit too, and in the minds of many pilots the world over. To add to that there are issues of cyber threats and the future of AI in the cockpit, or a combination of all of them.

The regulatory system has to evolve from "compliance with known risks" to continuous detection of emerging risks. How do we establish guardrails for such situations?

It's something that is close to impossible that aviation and regulators will struggle to achieve. It's easy to place layers of protection around aviation and aviators, but one cannot create a system in which a radicalised mind of a human being with evil intent cannot breach and cause harm.

Traditional Threats Now Have New Meaning

Airlines, regulators and aviation in general are dealing with traditional sabotage and terror, technical failures, GPS spoofing and cyber threats, human failures and fatigue; added to these now we see the emergence of insider threats, radicalisation and artificial intelligence.

Aviation's traditional battlefield is focussed around engine failure, structural failure, flight-control malfunction, software problems, navigation failures, maintenance errors, manufacturing defects and human failure based on fatigue, stress and mental health.

The industry has developed systems around these risks that focus on redundancy, inspections, SMS system, mandatory reporting, simulator training, flight data monitoring; psychological assessment of flight crew, mental health assessment and fatigue monitoring.

Regulators around the world work on the principle of multiple safety barriers, fenced in by safety management systems that are designed to identify hazards, determine risk and continuously monitor whether the processes work. This system, however, is based on the fundamental premise that the human being inside the system is trying to make the aircraft safer, but what happens in a system when that assumption goes horribly wrong, like in flydubai?

ICAO has already identified "insider threat as a distinct aviation-security problem". Its guidance calls for background checks, recurrent checks and, importantly, continuous vetting rather than assuming that somebody who passed a check when hired will remain low-risk forever, that perhaps is the biggest lesson of flydubai for all of us.

Lack Of Cooperation Or Coordination Between Regulators

The deeper issue in this incident is the fact that a pilot asked to leave one airline due to radicalised thoughts so easily joined another airline in another country. This points to a failure by his first employer and regulator. There was no notice of the reasons behind why he was removed.

The second major failure would be at the time of endorsement to another state, that no further background check was done. In the future, there is likely to be greater cooperation between regulators or at least creation of a system that transfers information such as this and brings in deeper security and background checks of aviation crew.

Perhaps there could even be a move to create a worldwide directory of pilots with accreditation type ratings and validations in association with IFALPA or ALPA. Given that pilots are such a precious commodity and are also globally transferable human assets, regulators should work with pilot organisations and airlines globally to create a database of pilots on record.

This would be the opportune moment for the DGCA to delete the abhorrent rule of 6-12 months' notice period for pilots leaving an Indian carrier. We need to see global movements for pilots and make it more secure and also not restrain their trade.

Aviation currently thinks in terms of point-in-time certification, such as medical examination, security clearances, background checks, licensing, type rating and recurrent training. But what it has failed to do is provide a continuous assessment of the personnel. It must be recognised that people can change if their situations change, or their finances, family relationships change, and along with that so does their susceptibility. But for every one Hammami, there are 10 Captain Smit Machchhars among our pilots today.

In the latest case we are hearing that there were issues with Oman Air and Hammami, which resulted in his exit. How come there was no information sharing or credible intelligence between airlines on an issue that was so significant?

The future seems to be one where security will become a process of continued assurance of fitness - mental, physical and emotional - along with trustworthiness. A lot of these probes will border on violating the civil liberties and privacy of people involved in aviation; it is a fine line that we have to walk on but doing it correctly will be a small price to pay when we speak of the safety of millions of passengers worldwide.

Can ideological extremism be identified without turning legitimate political or religious belief into a security risk? We need to build a system guardrail that is able to identify a behaviour that creates a mindset of an aviation security risk at the first instance.

AI And Aviation: Great Safety Paradox

AI can potentially make aviation safer, but there are also fears that AI could make aviation too predictable and capable of manipulation by dark net users of a destructive LLM. Hence that is something that aviation companies will have to dwell on with caution.

On the positive side, AI could detect aircraft abnormalities, fatigue patterns, maintenance issues, discrepancies in pilot workloads, operational decisions and cybersecurity attacks. On the other hand it could also be the poison pill for aviation, removing the human element in decision making, and we would never see a "Sully" or "Miracle on the Hudson" again. What if AI itself becomes the source of hazard? Both EASA and FAA are doing some path breaking research into AI functioning beyond basic assistance and human-AI collaboration. The FAA has already recognised that it presents a safety-assurance challenge because LLMs do not behave in a traditional manner. So the jury is out on this one for now.

What should the guardrails look like?

They must be technical assurance coupled with human assurances, deeper security compliances with continuous risk monitoring, and digital AI assurances with human management over systems that bring in the systemic assurance of operations.

Perhaps the biggest change we need to see is in the regulator itself. Globally, most regulators are reactive and not proactive enough, barring EASA and FAA. Threats and technology move faster than regulation and bureaucracy and thus we need to create guardrails that explore these threats. However, we cannot create an aviation system where everyone is permanently monitored or profiled. The ultimate guardrail is trust combined with verification.

The future of aviation safety will not be about building an impenetrable wall around the aircraft because there is no such wall. The buck stops with the pilot, and hence creates a system of resilience, trust and warmth. Treat your human asset with respect and see how the situation changes.

Aviation must build systems capable of detecting the abnormal earlier, questioning the unexpected sooner and intervening before a threat becomes an accident. The question is whether the system surrounding that aircraft will be intelligent enough to recognise the next threat before it reaches the cockpit?

What flydubai Teaches US

For one, we can expect detailed background checks of aviation persons and pre-authorisation APIS to become stricter, maybe even a restrictive list of pre-qualified Pilots to enter Israeli territory from Arab nations.

For the larger aviation world a similar protocol would not be amiss, since we seem to have lowered our guard. I expect Shin-bet and Mossad and the NCPIA to have greater coordination with Arab, US and Indian intelligence networks and homeland security to screen crew and travellers. The threat is real, a 9-11 or a 30-9 can happen any time again.

The dreaded CCTV (closed circuit cockpit cameras) may come into the larger global discussion once more to ensure that there is some modicum of protocols adhered to and a recording of what transpired.

I also believe that Israel will demand more flights bring in sky marshals, and security around flights departing for TLV have heightened security. The cockpit safety equipment (crash axe) is normally shielded and protected, so there will be a conversation about the use and need for it and how to secure it. Whilst airlines would love to reduce cockpit crew to one if they could, due to commercial considerations, in my view there must be a discussion of having an observer or a third occupant in the cockpit to safeguard the situation.

The regulators and politicians around the world, especially India, must learn and accept that pilots are the reason that we land and take off safely. We need to stop treating them like punching bags. India has the worst working conditions for pilots and yet it was an Indian pilot - who had escaped Indian aviation bureaucracy - who has made India and pilots and indeed all aviation crew all over the world intensely proud.

In the end, aviation is still the safest mode of travel on earth, and pilots are the most misunderstood professionals. India and Israel are two ancient civilisations bound by blood and brotherhood. Thank you Captain Smit Machchar, Tali and Nina Manes and Yaniv and the two unnamed relief pilots, you made us believe in miracles again. Am Yisrael Chai, Jai Hind.

(Sanjay Lazar is an aviation expert, lawyer and author who writes on aviation, terrorism, international relations, leadership and law. He has spent 40 years in aviation and lost his entire family in the Air India Kanishka bombing in 1985. He is @sjlazars on X)