How do airlines decide if a bomb threat is credible?

A series of suspected bomb hoaxes affecting passenger flights across Europe has raised questions about how airlines distinguish credible security warnings from malicious hoaxes.

Around 30 flights were affected by bomb threats on 5 November, with seven more security alerts today (6 November). Aircraft were diverted, airports activated security procedures and military jets were scrambled in several countries. No explosives were found.

A bomb threat against an aircraft presents a difficult decision for airline operations teams who are juggling safety priorities with the commercial pressure to minimise disruption.

Here’s how they assess potentially serious warnings when information is limited and decisions need to be made quickly.

How are bomb threats typically made to airlines?

Although many bomb threats prove to be hoaxes, each must be assessed on the information available at the time, with the safety of the aircraft, passengers and crew always taking priority.

A bomb threat against a passenger aircraft can be made through telephone calls, emails, social media, written messages left on an aircraft or via third parties. This makes the preservation of the original communication and its associated information important. 

For notes left on an aircraft, it is vital to preserve any fingerprints or other identifying information for police when the investigation begins. 

Information is often incomplete or deliberately vague, and the assessment of whether it is credible or not involves several parties, including the airline’s security department, its operations control centre (OCC), flight crew, airport authorities, air traffic control and police or security agencies. 

UK police guidance notes that most bomb threats are hoaxes, often intended to generate fear and disrupt operations. Still, each threat should be reported and assessed.

What makes an airline bomb threat “credible”?

A central part of the process is establishing how specific the warning is.

FBI documentation says this involves determining whether a threat identifies details such as its intended target, timing, location or method, as well as assessing the source and viability of what is being alleged.

On the part of the airline, this means establishing whether a message refers to a particular flight, aircraft, airport or individual, and whether it contains information that could indicate knowledge of the operation. This is useful in determining how genuine the threat is. 

Security specialists will also consider the circumstances in which the threat was received, whether similar messages have been reported elsewhere and whether intelligence agencies or police hold relevant information.

Assessors also consider the wider security context, including the departure and destination locations, any ongoing security concerns and relevant intelligence reporting.

The UK’s ProtectUK guidance emphasises the importance of considering the wider circumstances rather than relying on the wording of a message alone.

Who decides whether an airline bomb threat is genuine?

Assessing a threat can involve several organisations.

Joji Waites, BALPA’s Director of Flight Safety, Policy and Regulation, explains that the airline industry has “well proved mechanisms” for dealing with bomb threats.

“When a threat to an aircraft has been notified to the airline the threat is passed to a team of assessors. These assessors use standard processes to grade the threat and decide whether the threat is Red (credible), Amber (partially credible) or Green (not credible). Amber is not considered an appropriate assessment if the plane is airborne.

“If the threat is assessed as not credible staff on the plane will not be informed of it. However, when a threat is assessed as credible (red or amber) the flight crew will be informed immediately and they will carry out company procedures for a credible bomb threat.”

What did the Ryanair FR4978 bomb threat reveal about aviation security?

The importance of clear communication was highlighted by the 2021 diversion of Ryanair flight FR4978 from Athens to Vilnius to Minsk, following a bomb threat email. 

The Boeing 737 was flying from Athens to Vilnius with 122 passengers when Belarusian authorities received an email claiming that an explosive device had been planted on board and would detonate over Vilnius.

An International Civil Aviation Organization investigation subsequently found that the threat was deliberately false. Its report also identified significant shortcomings in the transmission of information to the crew and the coordination between the airline and Belarusian authorities.

Although Minsk Airport received the email, the information passed to air traffic control was limited to the claim that a bomb was on board and would explode over Vilnius. 

The investigation found that the threat had not been properly shared with other relevant air traffic control units or the airline in a timely manner.