The Enemy in the Cockpit. The Flydubai Case and the Internal Vulnerability

by Claudio Bertolotti.

What happened on 30 September 2026 aboard Flydubai flight FZ1073, which departed from Dubai bound for Tel Aviv, calls for reflection that goes beyond the dramatic nature of the incident and beyond its still uncertain classification as a terrorist act. What emerges from the dynamics of the event, even before any possible ideological motive, is the existence of a structural vulnerability: the internal threat, the insider threat, when the potentially hostile actor is someone to whom the system itself grants access, trust and operational capabilities.

While the fundamental question of motive remains open, the information currently available allows for a more precise reconstruction of what happened. According to the Israeli authorities, the co-pilot of the Boeing 737 MAX 8, an Omani national, allegedly attacked the captain with a knife. The captain was identified by Indian sources as Smit Machchhar, an Indian national and a Flydubai captain since 2022. According to the Israeli reconstruction, the co-pilot then attempted to take control of the aircraft and cause it to crash. The airline confirmed that a violent altercation occurred inside the cockpit, although it has not publicly attributed any motive to the attacker.

Flight data add a particularly significant element. The aircraft, which was flying at more than 30,000 feet, reportedly lost over 14,000 feet of altitude in approximately thirty seconds. Flightradar24 then recorded transponder code 7700, indicating a general emergency, followed by code 7500, internationally used to signal unlawful interference aboard an aircraft. The signal subsequently returned to 7700 during the diversion to Saudi Arabia.

It is within those few seconds that the nature of the incident appears to have changed, shifting from the hypothesis of a mere violent confrontation between two crew members to a situation in which violence inside the cockpit directly endangered the aircraft and everyone on board.

According to testimonies collected by Reuters, the injured captain reportedly managed to open the cockpit door before collapsing. At that point, several passengers intervened and succeeded in restraining the co-pilot. A reserve Flydubai crew travelling on board subsequently took control of the aircraft and landed it safely at Tabuk Airport in Saudi Arabia. Videos recorded after the attack, again according to Reuters, show both pilots injured and covered in blood.

Terrorism or something else?

The alleged attacker, who survived and was arrested by the Saudi authorities, is the key element from which any analysis of the incident must begin, in order to determine whether this was terrorism or another form of individually motivated violence. The motive has not been made public by the Saudi authorities, and Flydubai has not confirmed the existence of a political, religious or ideological motivation.

Israeli Defence Minister Israel Katz, however, described the incident as a jihadist terrorist attack, a hypothesis also supported by Prime Minister Benjamin Netanyahu. Such an interpretation is certainly possible, although no evidence currently available through open sources is sufficient to confirm it. It remains under examination by the Israeli authorities.

The central question is therefore not whether the co-pilot attempted to cause the aircraft to crash, but why he might have wanted to do so.

The fact that the flight was bound for Tel Aviv, that more than 170 Israeli citizens were reportedly on board, and that the attacker was a citizen of Oman, a country that does not maintain diplomatic relations with Israel, are elements of relevance to the analysis. They are even more significant from an investigative perspective. They may suggest an ideological motivation of a jihadist or anti-Zionist nature, but they are not concrete evidence capable of proving it. At the same time, nothing can yet be excluded.

We currently have no information indicating whether the attacker was in any way connected to terrorist organisations, whether he had previously expressed clearly defined ideological positions, or whether he was undergoing a process of radicalisation. Nothing at all. But not because nothing has been found; rather, because it is simply too early. No message, no claim of responsibility. It should also be recalled that the Islamic State claims only successful terrorist operations, and this operation was not successful.

To attribute the attack prematurely to the Islamic State, al-Qa’ida or to a more generic form of jihadism would therefore mean confusing a hypothesis with a fact. This does not exclude such a possibility, but neither does it confirm it.

What is certain is that, regardless of any hypothesis concerning ideological adherence, what we have witnessed is a clear example of an insider threat, in which the security system is bypassed from within. If the intentional nature of the action were confirmed, the most important strategic element would not be the knife itself, but the identity of the person holding it, because the attacker was not a passenger who had unlawfully passed through airport security controls. He was the co-pilot. And it is precisely this fact that exposes the most significant vulnerability.

Since 11 September 2001, much of the Western aviation-security architecture has been built around the principle of separation between passengers and the cockpit, through reinforced doors, access procedures, passenger checks, restrictions on the carriage of objects and liquids, and increasingly sophisticated screening systems. The purpose has always been to prevent an attacker from reaching the aircraft’s operational and decision-making centre.

In the Flydubai case, the dynamic is reversed. The hostile individual was already inside the cockpit. He had access to the controls, knew how the aircraft functioned, understood the procedures and operational vulnerabilities, and had no need to cross a barrier, because that barrier was already behind him and, in effect, protected him from external attempts to stop his action. The very physical barrier designed to protect the aircraft from an external aggressor may therefore have contributed, at least initially, to separating the attacker from those who could have prevented him from acting.

This is precisely the paradox of the insider threat: the greater the level of trust attributed to a given function, the greater the potential damage when that trust is betrayed. The system is therefore not penetrated from the outside; it is turned against itself.

And what if it really was terrorism?

In that case, the incident would be entirely consistent with the now well-established evolution of the threat posed by contemporary terrorism, in which the tactical and operational complexity required to generate potentially strategic consequences has progressively decreased. This has been evident for many years and is now a consolidated analytical assumption, highlighted over time through the annual report on radicalism and counter-terrorism produced by the #ReaCT Observatory.

An attack on a commercial aircraft does not necessarily require sophisticated explosives, structured cells, infiltrated operational teams or months of preparation when a single individual may be sufficient. In this particular case, one individual placed in the right position, at the right time, with privileged access to a complex system.

Here we encounter the concept of maximising effects while minimising resources: a dynamic that can be observed in many manifestations of contemporary terrorism and that I have associated with the progressive individualisation of violence. The organisation tends to lose operational centrality while the individual increasingly gains the capacity to transform ordinary tools, professional access or simple opportunities into offensive capabilities.

This does not mean that organised terrorism has disappeared. It means, rather, that the relationship between organisation, ideology and operational actor has become more flexible and, in most cases, less tangible. An organisation may direct an attack, facilitate it, inspire it, or have no direct relationship with the perpetrator at all, limiting itself to providing a sense of belonging, an ideological imaginary within which the individual independently legitimises his own actions, identifies with the organisation or the ideology, and is in turn recognised by the organisation as one of its “soldiers”, a mujaheddin: in other words, a testimonial. It is precisely this relationship that the investigation into the co-pilot will have to clarify.

The target: Israel?

Why that particular flight?

If it were demonstrated that the co-pilot deliberately selected flight FZ1073 because it was bound for Tel Aviv and because most of its passengers were Israeli citizens, the ideological component would acquire an entirely different significance. The target would no longer simply be a civilian aircraft, but an Israeli target by virtue of its destination and the composition of its passengers. The fact that the airline itself was Emirati would become only a secondary element.

In such a scenario, the aircraft would assume a dual function: both a material and a symbolic target.

The symbolic dimension is essential to understanding and defining terrorism. A terrorist does not strike only what he intends to destroy; he strikes what he intends to represent.

Civil aviation, twenty-five years after 11 September, still retains extraordinary symbolic value because an aircraft is an enclosed space, beyond the control of those travelling inside it, technologically complex and potentially vulnerable to the actions of very few individuals. Above all, it is a means through which a limited number of potential victims can be transformed into a global audience of millions of spectators.

From this perspective, the attack becomes an instrument of communication and psychological conditioning, with obvious consequences in terms of threat perception, fear and even overreaction.

The strategic effect of a failed attack: functional blockade

When terrorism fails, it still achieves a result. Whatever that result may be, it contributes to the production of fear.

The fact that the aircraft did not crash does not mean that the possible attack, should its terrorist nature be confirmed, was entirely ineffective. The success or failure of a terrorist act cannot be measured solely by the number of casualties. It is necessary to observe the effects it produces, whose outcome is the “functional blockade”, a concept I have sought to introduce into the analysis of terrorism and which increasingly appears to be a determining factor, perhaps even the real result that terrorism seeks and achieves.

Functional blockade is the effect through which a terrorist action, regardless of its tactical success, causes a reduction, interruption or alteration of the normal functions of the system under attack, imposing costs, behavioural changes, new security measures and a reallocation of resources.

The incident triggered emergency procedures, the deployment of Israeli military aircraft, the involvement of the Saudi authorities, intervention by Israeli security services, a potentially complex diplomatic and operational crisis and, above all, an immediate review of security procedures. Israel has already announced its intention to strengthen checks on pilots operating flights bound for the country.

And this is precisely functional blockade: the ability of an act of violence to impose changes in behaviour, protocols and resource allocation even without fully achieving its tactical objective.

Terrorism works when it forces the targeted system to react.

Every new control has a cost, just as every additional procedure requires personnel, time and infrastructure. Likewise, every perception of vulnerability changes the behaviour of the public. In this sense, even an attack that materially fails may still produce a functional outcome.

There is, however, an opposite effect as well: a disproportionate response may indirectly amplify the impact of the attack. One of the major challenges of contemporary security is precisely to strengthen preventive capacity without transforming every exposed vulnerability into a permanent multiplier of fear.

This brings us to the growing importance of cognitive vulnerability, which operates on the informational and communicative level.

In the first hours after the incident, widely different interpretations circulated: a fight between two pilots, one Russian and one Ukrainian; an attempted hijacking; a suicide attack; jihadist terrorism.

This is predictable when information travels faster than investigation. And when an event contains highly symbolic elements — an aircraft, Israel, a Muslim attacker, the possibility of an attempted crash — the process through which public opinion constructs an explanation inevitably tends to precede the process through which investigators gather evidence.

This cognitive vulnerability shifts the centre of gravity from control of the aircraft to control of the narrative.

From this perspective, immediately accepting the perpetrator’s identity as that of a “jihadist terrorist” before his motivations are known may be understandable in terms of political expediency — or political opportunism — or emotional reaction, but analytically it risks anticipating the conclusions. Yet caution must also apply in the opposite direction: ruling out terrorism a priori would be equally methodologically incorrect, and could represent a serious mistake in terms of preventing and countering the terrorist threat.

The answer perhaps lies in the ability to keep three dimensions separate: what we know, what we consider probable and what still needs to be demonstrated.

What we know is that a co-pilot violently attacked the captain of a flight bound for Tel Aviv; that the aircraft experienced an extremely rapid loss of altitude; that the transponder code indicating unlawful interference was transmitted; that the attacker was restrained; that a reserve crew regained control of the aircraft; and that the man is now in Saudi custody.

What the Israeli authorities claim is that the man deliberately attempted to crash the aircraft and that the incident may have been an act of jihadist terrorism.

We await confirmation.

The question, therefore, is not simply how a knife could have been brought into a cockpit. It is something more complex: how can the long-term reliability of an individual entrusted with the control of a system capable, if deliberately used in a hostile manner, of being transformed into a weapon be guaranteed?

Perhaps it is time to begin seriously considering that question.