|
|
Last Update: Wednesday, Apr 24th 2024 19:09Z
30336 Articles available
Events from Mar 23rd 1994 to Apr 24th 2024 |
|
|
|
|
| |
|
|
Incident: Ryanair Sun B738 near Minsk on May 23rd 2021, Greece calls diversion states hijack
By Simon Hradecky, created Sunday, May 23rd 2021 20:33Z, last updated Thursday, Jun 3rd 2021 03:19Z
A Ryanair Sun Boeing 737-800, registration SP-RSM performing flight FR-4978 from Athens (Greece) to Vilnius (Lithuania) with 126 passengers and 6 crew, was enroute a FL390 about 45nm south of Vilnius still in Belarus Airspace, when the aircraft diverted to Minsk (Belarus), located about 90nm east of their present position, where the aircraft landed safely about 25 minutes later.
The aircraft remained on the ground in Minsk for about 7 hours, then continued the flight with 5 passengers less than had arrived in Minsk, climbed to FL090 enroute and reached Vilnus with a delay of 8.5 hours.
The circumstances of the diversion are entirely unclear. No official confirmation is available so far, also not from Ryanair, how many passengers boarded the aircraft in Athens and how many disembarked in Vilnius (and whether there had been any passenger left behind in Minsk and how many).
There are claims that Mig29 fighter aircraft may have been dispatched to intercept and force the Boeing to Minsk.
Belarus Opposition claims one of their activitists and his fiancee have been detained in Minsk, in addition four Russians did not continue their journey to Vilnius.
Sources in Belarus claim all passengers continued on to Vilnius.
Other sources in Belarus and Russia claim, the opposition activist has been detained in Minsk.
Greece's foreign Minister rated the occurrence a states hijack, the aircraft has been hijacked by Belarus. According to the Greek Foreign Ministry 171 passengers departed Athens. The Greek Foreign Ministry stated further: "We condemn the illegal arrest of the Belarusian activist Roman Protasevich, who is threatened with the death penalty. Mr Protasevich was part of a delegation led by Belarussian opposition leader Sviatlana Tsikhanouskaya, who recently attended the Delphi Forum."
Lithuania's Prime Minister said: "What happened today is an attack not only on Lithuania. This is the act of state terrorism directed against the security of citizens of the EU and other countries."
ICAO voiced concern about the "forced landing" stating that this might be in contravention of the Chicago convention.
Political leaders around the EU and its members voice concern about this "forced landing" and call for action.
The president of the European Commission said: "It is utterly unacceptable to force Ryanair flight from Athens to Vilnius to land in Minsk. ALL passengers must be able to continue their travel to Vilnius immediately and their safety ensured. Any violation of international air transport rules must bear consequences." Later she added: "The outrageous and illegal behaviour of the regime in Belarus will have consequences. Those responsible for the Ryanair hijacking must be sanctioned. Journalist Roman Protasevich must be released immediately."
On May 24th 2021 The Aviation Herald received first concrete information, that Roman Protasevich (26, Belarus Citizen) and his girl friend/fiancee (Russian Citizen) were detained in Minsk and could not continue their journey. In addition three Russian citizens did not continue the journey to Vilnius.
On May 24th 2021 Lithuania's Authorities reported that 126 passengers and 6 crew were on board of the aircraft, when it departed Athens, but 121 passengers and 6 crew were on board when the aircraft arrived in Vilnius.
On May 25th 2021 Eurocontrol's Network Operations Center Brussels released following statement (also following measures taken by EU):
In the wake of the alleged "bomb threat" on a Ryanair commercial passenger flight FR4978, which made an emergency landing at Minsk National Airport on May 23rd,� 2021, the European Union Aviation Safety Agency (EASA) initiated a safety and security assessment of the Belarusian airspace.
Hoaxes, bomb threats and security alerts affecting the aviation sector in general are credible concerns - Though bomb threats rarely translate into actual attacks, they remain likely to cause disruption through heightened aviation security measures in the near term at Belarusian airports.
In the light of these, EASA would like to raise concerns with regards to the risk to commercial aviation and as a precautionary measure, the Agency recommends the European air carriers to exercise caution when operating within or over FIR Minsk (UMMV).
Due to this non-commonly security occurrence, EASA would invite you to share this information with your airlines so that they take it into account in their own risk assessments, alongside any available guidance or directions from their national authorities as appropriate.
The Agency continues to monitor the situation to assess whether there is an increase or de-escalation of the risk for EU aircraft operators as a result of the evolution of the situation.
NMOC Brussels
On May 25th 2021 IFALPA and ECA (Pilot Associations) released a joint statement:
The International Federation of Air Line Pilots� Associations (IFALPA) and the European Cockpit Association (ECA) fully share the concerns expressed by the International Civil Aviation Organization (ICAO) regarding the forced landing of Ryanair Flight 4978 in Minsk, Belarus, on 23 May. Pilots are concerned that the intervention of the Belarussian Air Force was enacted for political reasons, in contravention of the Chicago Convention, and amounts to an act of unlawful interference, bearing all the hallmarks of state-sponsored hijacking.
We are calling for an independent enquiry into this occurrence and appropriate immediate response by safety and security authorities. This unprecedented act of unlawful interference will potentially upend all the assumptions about the safest response to bomb threats on flight and interceptions. Without trust and reliable information from States and Air Navigation Service Providers, handling both types of events becomes much riskier to manage.
IFALPA and ECA stress that the pilot-in-command always has the best overview of the actual situation on board and must be able to react according to the level of risk, regardless of external circumstances. Any measures taken by States to address a specific threat should enhance the crew's ability to assess the situation thoroughly.
Any military intervention against a civilian aircraft constitutes a wilful hazard to the safety of passengers and crew. IFALPA and ECA urge States and the International Aviation Community to investigate and take swift measures against similar occurrences. We also call upon the airline to provide full support to the pilots and cabin crew on board, both during the future investigation and regarding their physical and mental well-being after such a challenging and stressful event.
On May 26th 2021 Poland's Accident Investigation Board released their statement saying:
Statement of the State Commission on Aircraft Accidents Investigation related to the flight FR4978
After analyzing the available information on flight FR4978, the State Commission on Aircraft Accidents Investigation has concluded that the occurrence involving the landing of the Boeing 737-800, SP-RSM, on UMMS airport on May 23, 2021 does not meet the criteria for an accident or incident as defined in Annex 13 to the Convention on International Civil Aviation as well as European Union and national regulations, therefore the occurrence will not be investigated by the Commission.
The occurrence shows characteristics of an unlawful interference and, in accordance with Annex 17 to the above-mentioned Convention, European Union regulations and the Act - Aviation Law, it is processed by the Civil Aviation Authority and the judicial authorities of the Republic of Poland.
On May 25th 2021 the CAA Belarus had released a statement which portrayed to quote the email containing the bomb hoax and being sent by Hamas via Proton Mail (which was instantly denied by Hamas - the conflict in Israel had already stopped in a cease fire at that time) and a supposed transcript of the ATC communication (editorial note: which is at least incomplete and not logical at all).
On May 27th 2021 Proton Mail stated, that the email sent to Belarus was transmitted only 24 minutes after the crew had been warned and a few minutes after the crew had already initiated the diversion to Minsk.
On Jun 2nd 2021 EASA issued their Safety Directive 2021-03 requiring following actions from all Aircraft operators involved in air operations in accordance with Commission Regulation (EU) 965/2012 in respect of which EASA has issued an Air Operator�s Certificate (AOC) and acts as the Competent Authority:
Pending the finalisation of an international investigation into the incident that occurred on 23 May 2021 initiated by the ICAO Council on 27 May 2021, or until further notice:
Aircraft Operators to whom this SD applies, shall:
(1) Not conduct operations in FIR Minsk (UMMV), unless the use of that airspace is deemed necessary to ensure safe operation in case of unforeseen circumstances.
(2) Take measures to implement the above-specified corrective action within maximum 2 days from the effective date of this SD and inform EASA of those measures.
EASA reasons:
On 23 May 2021, Ryanair flight FR4978, while overflying Belarus en-route to its final destination, Vilnius, was made to divert by Belarusian authorities and land in Minsk. The aeroplane ultimately departed and arrived in Vilnius with considerable delay after several passengers were forcibly disembarked in Minsk. The circumstances surrounding this action cast serious doubts on the respect shown by Belarus for international civil aviation rules and is indicative of an abuse of air navigation procedures by the Belarusian authorities. As such, it is a breach of the principles underlying the mutual trust that are at the cornerstone of international civil aviation.
Until an international investigation clarifies the circumstances, EASA has reservations whether the Belarusian airspace can still be considered as safe for civilian flights by the international community, as there is no full confidence in the ability of the current Belarusian authorities to manage the Belarusian airspace in accordance with international agreements.
On 25 May 2021, EASA issued Safety Information Bulletin (SIB) 2021-10 advising aircraft operators, having their principal place of business in one of the EASA Member States, to avoid operations in FIR Minsk (UMMV), unless the use of that airspace is deemed necessary to ensure safe operation in case of unforeseen circumstances.
On 27 May 2021, the ICAO Council decided to undertake a fact-finding investigation of this event, and in this connection requested the ICAO Secretariat to prepare an interim report to the Council for a subsequent meeting of the current session, presenting the available facts and relevant legal instruments.
Information from air traffic management indicates that there are still operators having their principal place of business in EASA Member States that continue to operate in the FIR Minsk (UMMV). Accordingly, and after consulting with the EASA Member States and the European Commission, EASA decided to issue SD 2021-02 determining safety objectives to be achieved and recommending corrective measures to be taken by the EASA Member States� NCAs to ensure safety of aircraft operations.
Consequently, EASA, acting as Competent Authority (CA) responsible for the certification and oversight of aircraft operators involved in air operations in accordance with Commission Regulation (EU) 965/2012 has determined corrective actions to be taken by air operators holding an Air Operator Certificate (AOC) issued by EASA in accordance with that regulation.
EASA will monitor the developments in relation with this case and will adjust, as needed, the corrective actions accordingly. Such reviews will be done whenever the circumstances will require it and in any case at intervals not exceeding one month.
|
By Simon Hradecky, created Wednesday, Jul 20th 2022 12:54Z, last updated Wednesday, Jul 20th 2022 12:54Z
On Jul 20th 2022 ICAO released their final fact finding report essentially reporting, that according to Swiss Authorities, who investigated the account on protonmail based in Switzerland, that sent the e-mails, 6 mails were sent from that account in total, between 09:25Z and 09:34Z 5 e-mails were sent to Vilnius, Athens, Sofia, Bucharest and Kiev Airports, however no e-mail and no information had gone out of Belarus, Belarus received their first e-mail only at 09:56Z after the aircraft had already been informed about the bomb threat and had already initiated the descent towards Minsk. None of the e-mails to Vilnius, Athens, Sofia, Bucharest or Kiev was accessed/read until the next day. Belarus Authorities provided a screenshot - without the mail headers - of that mail claimed to have been received by Minsk Airport at 09:25Z, which is identical to the screenshot of the later mail received at 09:56Z, the latter screenshot however also showing the mail header. The report thus points out that the authenticity of the screenshot of the Screenshot of the Mail claimed to have been received by Minsk Airport at 09:25Z can not be established.
The report concludes (and points out missing information):
5.1. As stated in paragraph 3.1 e) of its Terms of Reference, the FFIT was expected to �identify pieces of information potentially missing and that would be necessary to complete the investigation�. As indicated in paragraph 1.5 above, some specific information, including critical information indicated in the Analysis section of this report as highlighted below, was requested but not made available to the Team. Considering the above, the Team�s conclusions below are based exclusively on the information availed to it as of the time of this report.
5.2. According to the authorities of Belarus, a first email was received at 09:25 UTC (12:25 local) followed by a second email at 09:56:45 UTC (12:56:45 local), both containing identical information about the bomb threat. On the other hand, information obtained from Switzerland through the authorities of Lithuania shows that only the second email was sent to Minsk Airport at 09:56:45 UTC (12:56:45 local). The FFIT was not able to verify that the first email was effectively received at 09:25 UTC (12:25 local) as the authorities of Belarus did not provide logs of the email server airport.by nor the email files containing the threat messages saved in their original format including their metadata, citing their erasure in accordance with their data retention policy. The receipt of the first email is crucial to explain the basis for the communication of the bomb threat by Minsk ACC to the flight crew, which occurred at 09:30:49 UTC (12:30:49 local). In the absence of the first email, it could be presumed that the information about the bomb threat would have been obtained by the authorities of Belarus by other means, which the FFIT could not establish. If the first email was in fact received at Minsk Airport, the diversion of the flight to Minsk Airport could be considered to be a tenable option in view of the circumstances.
5.3. The FFIT could not corroborate the information provided by the authorities of Belarus regarding the transmission by phone of the contents of the threat email from airport personnel to Minsk ACC personnel leading to the notification of the threat to RYR 1TZ. As cellular phone records of the personnel involved documenting the time and duration of the calls and person or entity contacted were not made available, those statements could not be supported by evidence.
5.4. As neither a bomb nor evidence of its existence was found during pre-departure screening in Athens Greece and after various searches of the aircraft in Belarus and Lithuania, it is considered that the bomb threat was deliberately false. Knowingly communicating false information which endangers the safety of an aircraft in flight is an offence under Article 1 (1) (e) of the Montr�al Convention.
5.5. Prior to the issuance of the report in January 2022, the FFIT was neither able to meet with, nor interview the Minsk ACC controller who was assigned to the RYR 1TZ flight. The authorities of Belarus informed the Team that this individual did not report for duty after his summer leave and that they had no information on his whereabouts and no way to contact him. Subsequently, with the assistance of the authorities of the United States, the FFIT gained access to interview the controller whose testimony materially contradicts the information and materials provided by the authorities of Belarus about the events of 23 May 2021 including with regard to the email as the origin of the bomb threat information, and reflects the involvement of an unidentified individual who had been given access to the Minsk ACC.
5.6. The authorities of Belarus did not provide the FFIT information demonstrating that attempts were made to contact the Operator (RYR or RYS) for the purposes of meeting the obligations contained in Annex 11, 2.24.3 and Belarus ATM Aviation Regulations, 15.12.9. to exchange information with the operator or its designated representative.
5.7. Communications were not established between the flight crew and the OCC during the flight when such communications would have been necessary in line with the operator's procedures. Had such communications between the flight crew and the OCC been established it would have impacted the course of events.
5.8. Video recordings from cameras located adjacent to aircraft parking stand 1 and inside the terminal which could have shown certain significant activities regarding the processing of passengers from the point of disembarkation and in the terminal building were not provided to the FFIT. Although short extracts of the said video recordings had been used in a documentary type video that was shared with the Team, the authorities of Belarus explained that not all recordings were available due to the length of time that had elapsed since the event. The FFIT was not provided with a satisfactory rationale to explain why records had not been preserved considering that criminal and other investigations in respect of the event had been initiated by the authorities of Belarus and had not been completed.
5.9. Inter flight-crew coordination conversations that led to their decision to divert to Minsk Airport could not be fully confirmed since the CVR circuit breaker was not pulled after landing in Minsk. As a result, the full flight-crew conversations, prior to the period when the aircraft was on short final to Minsk Airport, were not preserved.
5.10. From the evidence provided by Belarus, no escort or intercept occurred between the MIG-29 and RYR 1TZ and no communications by the MIG-29 was recorded on the radio channels used by RYR 1TZ. According to information provided by the flight crew and cabin crew, there was no communication, interaction, visual sighting or other knowledge of military aircraft involvement with the flight.
5.11. Some of the States connected to the event have issued formal requests to other States for information and assistance in connection with criminal and other investigations into the event. Such investigations could assist in establishing any missing facts relating to the event. In this regard, States and entities that have received such formal requests should be encouraged to respond as appropriate.
With respect to the receipt of the e-mail containing the bomb threat the ICAO writes:
2.2.1. According to the Department of Aviation of Belarus, on the 23 May 2021 at 09:25:16 (12:25:16 local) an email was received in the generic mailbox info@airport.by, a screenshot of which is reproduced in Appendix H.
2.2.2. The email contained the following text: �We, Hamas soldiers, demand that Israel cease fire in the Gaza Strip. We demand that the European Union abandon its support for Israel in this war. We know that the participants of Delphi Economic Forum are returning home on May 23 via flight FR4978. A bomb was planted onto this aircraft. If you don�t meet our demands the bomb will explode on May 23 over Vilnius. Allahu Akbar.�
2.2.3. The SearchInform Data Loss Prevention (DLP) Software used at Minsk Airport detected and flagged the email as containing text communicating a potential threat to civil aviation. The automated detection is based on a pre-established list of keywords in several languages, including English, and triggers alerts on the computers of the Cybersecurity and Information Technology Division, in charge of the administration and oversight of the IT network of the Minsk Airport. The threat email written in English included words which are in the pre-established list of keywords.
2.2.4. Interviews revealed that emails received in the generic mailbox info@airport.by are processed by the secretarial staff in the Airport General Manager�s office during working hours on weekdays. IT Security Officers do not review the content of the emails received on the 150 email addresses (personnel and generic) in service at the airport, unless an alert is triggered by the SearchInform DLP Software, such as the alert in question. The head of the systems administration group of the Cybersecurity Unit stated that he was remotely logged into the server on his computer while on duty at home and discovered in real time the popup alert regarding this email, received on the mailbox info@airport.by. His shift started at 06:00 UTC (09:00 local). The FFIT was informed that the head of the system administration group of the Cybersecurity Unit does not speak English but can understand it.
2.2.5. The bomb threat email indicated it was sent by �Hamas soldiers�. The text refers to the Israeli operation in the Gaza Strip following the outbreak of violence that commenced on 10 May 2021 and demanded a ceasefire and that the European Union abandon its support for Israel in the war. The May 23 flight FR4978 to Vilnius is specifically identified as carrying participants of the 2021 Delphi Economic Forum, as well as a bomb to be detonated over Vilnius if the demands are not met. Media reports indicate that the ceasefire between Israel and Hamas came into effect on 21 May 2021, two days prior to the event. The Delphi Economic Forum took place in Athens from 10 to 15 May 2021. It is reported that at least one of the passengers participated in the Forum.
2.2.6. According to the Deputy General Director for Security, Discipline and Personnel, he was contacted by telephone at 09:27 (12:27 local) by the head of the system administration group of the Cybersecurity Unit and informed about the bomb threat email. Subsequently, the Deputy General Director for Security, Discipline and Personnel passed the information at 09:28 (12:28 local) by telephone to the Minsk Air Traffic Control Centre, as an aircraft was involved. The Deputy General Director for Security, Discipline and Personnel stated that the information he relayed to the Minsk Air Traffic Control Centre was limited to the threat itself, namely that there was an explosive device on board the aircraft on flight FR4978, on the route Athens-Vilnius, which would be detonated over Vilnius.
2.2.7. According to the Department of Aviation of Belarus, the SearchInform DLP Software detected an identical email at 09:56 (12:56 local) in the generic mailbox info@airport.by, as Ryanair Flight FR4978 had already started its descent to Minsk. A screenshot of the email is reproduced in Appendix H.
2.2.8. At about 12:00 (15:00 local) the same day, the head of the system administration group of the Cybersecurity Unit sent a copy of the threat email to the mailbox of the air navigation services provider, Belaeronavigatsia, as instructed by the Head of the Cybersecurity Unit, his immediate supervisor. The statements of the different stakeholders do not indicate that the email had been shared with any other entities before 12:00 UTC (15:00 local).
2.2.9. The Ministry of Transport and Communications of Lithuania informed the FFIT that an email was delivered at 9:25:16 UTC (12:25:16 local) on 23 May 2021 to the generic email address info@ltou.lt of the State Enterprise Lithuanian Airports as shown in the screenshot in Appendix H. This threat email was only discovered the next morning, Monday 24 May 2021, during business hours, and was forwarded to the Lithuanian Police for investigation.
2.2.10. With respect to the account from which the bomb threat email was sent, the Lithuanian authorities provided to ICAO information obtained from the Switzerland authorities, Switzerland being the State where the headquarters of the email service provider are established, through a mutual legal assistance mechanism between both States, showing that:
a) the account was created on 14 May 2021 at 15:32:01 UTC from Internet Protocol (IP) address 193.189.100.195; (Editorial note: This IP address belongs to a Swedish ISP)
b) the account was last accessed on 25 May 2021 at 8:39:42 UTC;
c) the authentication logs for the account were not activated;
d) no physical address or identity information was registered or linked to the account;
e) the account is free, therefore no payment information was recorded;
f) the content of the emails and the mailbox are fully encrypted, thus they cannot be viewed;
g) the contacts, notes and images are also fully encrypted, thus they cannot be viewed; and
h) no instant messaging information was recorded.
2.2.11. The information provided by the Lithuanian authorities also indicated that a total of six emails were sent separately from the account, respectively at 9:25 UTC (12:25 local) to Lithuanian Airports, at 09:26 UTC (12:26 local) to Athens Airport, 09:27 UTC (12:27 local) to Sofia International Airport, 09:28 UTC (12:28 local) to Bucharest International Airport, 09:34 UTC (12:34 local) to Kiev Airport and finally 09:56 UTC (12:56 local) to Minsk International Airport. All six airports are located on or near the planned route of the flight FR4978. Two of the six emails were not delivered, namely to the addresses respectively of Athens and Kiev Airports. Apart from the six emails, no record exists of any other email having been sent from this account.
2.2.12. Four emails were sent separately to Vilnius, Athens, Sofia, and Bucharest airports in a period of less than three minutes, while FR4978 was flying over the airspace of Ukraine and immediately prior to entering the airspace of Belarus. The first of these emails was sent at 09:25:12, about two hours after the take-off from Athens, five minutes before crossing the common L�viv/Minsk FIR boundary into Belarus. The fifth email was sent to Kiev Airport at 09:34:32, 4 minutes and 30 seconds after FR4978 had left the airspace of Ukraine. The last email was sent 22 minutes later, at 09:56:45 (12:56:45 local) to Minsk Airport at which point FR4978 had already initiated its descent to that airport. An illustration of the relative timings is at Appendix H.
2.2.13. Both the Directorate General Civil Aviation Administration (DGCAA) of the Republic of Bulgaria and the Romanian Civil Aeronautical Authority (RCAA) confirmed to the FFIT that bomb threat emails against Flight FR4978 sent from the same email account were received by their respective airports on 23 May 2021.
2.2.14. In the case of Bulgaria, the email was read on 25 May at 09:30 local by the Public Relations and Corporate Communications Department of SOF Connect AD, the operator of Sofia International Airport, which administers the email address: comment@sof-connect.com. The mailbox, used for alerts, complaints, recommendations, comments and questions from the public, is only checked on working days. According to the time stamp on the printout provided by the Bulgaria DGCAA, the email was received on 23 May 2021 at 12:27 local (09:27 UTC).
2.2.15. On 26 May 2021, following an information request from the Polish Civil Aviation Security Directorate, the RCAA requested all civil airports and the air navigation services provider Romatsa to report if any threat regarding flight FR4978 had been received by their services. On 8 June 2021, Bucharest Airports National Company informed RCAA that additional checks related to the flight FR4978 established that on 23 May 2021 at 12:28 local (9:28 UTC) a message sent from the same email account was received at the email address: contact@bucharestairports.ro.
2.2.16. The screenshots of the emails, available at Appendix H, received in Sofia International Airport and Bucharest Airports National Company reveal that the text of the emails is identical to the messages delivered at Vilnius and Minsk airports. The time stamps of these two emails are consistent with the information obtained from Switzerland through the Lithuanian authorities.
2.2.17. The nature and content of the emails respectively sent to Athens and Kyiv Airports have not been confirmed as these were not delivered.
|
By Simon Hradecky, created Tuesday, Jan 18th 2022 20:59Z, last updated Tuesday, Jan 18th 2022 20:59Z
On Jan 18th 2022 ICAO released their fact finding report to its member states, however, the report was not published. The Aviation Herald was able to obtain a copy and produces a short summary:
When FR-4978 was enroute in Ukrainian Airspace about 5 minutes before crossing into Belarus Airspace, e-mails were received by Minsk Airport at 09:25Z (?, see analysis below!) with the text: "We, Hamas soldiers, demand that Israel cease fire in the Gaza Strip. We demand that the European Union abandon its support for Israel in this war. We know that the participants of Delphi Economic Forum are returning home on May 23 via flight FR4978. A bomb was planted onto this aircraft. If you don�t meet our demands the bomb will explode on May 23 over Vilnius. Allahu Akbar.", however, the report does not show or quote the entire header of the mail. Seconds later an e-mail with the same text was received by the Airport operator of Lithuania. A minute later Athens Airport and another minute later Sofia Airport received mails with the same text. Lithuanian Authorities obtained details about the sending account from Switzerland, which identified a total of 6 mails were sent from that account however two were not delivered (no other activity from creation of the account on May 14th 2021 until it was no longer accessed after May 25th 2021, no personal data were provided, no payment was needed or done, the registering IP address was noted).
After receiving the mail Belarus Authorities reacted, the information was handed up the chain until Minsk Airtraffic Control Center was informed at 09:28Z.
Minsk instructed Lviv ATC to hand Ryanair over to them at frequency 120.575 (a frequency which is only used for radio performance tests, the reason for this request was not determined). After the aircraft contacted Minsk the controller identified the aircraft and stated to the aircraft: "... we have information from special services that you have bomb on board. The bomb can be activated over Vilnius." and added: "... for security reasons, we recommend you land at Uniform Mike Mike Sierra".
The report states:
RYR 1TZ requests clarification on where the bomb threat message came from. The controller advised RYR 1TZ that �airport security staff... informed they received email� and when further queried by the flight crew whether this was Vilnius airport security staff or from Greece, the controller responds with �...this email was shared to �several airports�.
It could not be established how the controller knew that emails had been shared with several airports.
The crew requests to contact their operations via radio frequency. The crew had already attempted to contact their operations provider to Vilnius airport to no avail. 5 Minutes later the crew queries whether there is any information from their operations. The controller asks the crew to standby, he's still waiting for information.
The crew queries where the recommendation to divert to Minsk came from, the controller responded it was their recommendation.
The crew requested the code of the threat, the controller states: "they advise the code was red", in response the crew decided to hold at the present position, which was approved by the controller.
15 minutes after being informed of the threat by Minsk ATC at 09:57Z the crew decided to divert to Minsk, declared emergency and selected their transponder to emergency code.
The report states:
In the period between 10:01 and 12:17 there were at least 12 calls made by the RYS and RYR OCCs trying to establish communication with the authorities in Minsk to get more detailed information on the security threat that led to RYR 1TZ diverting to the Minsk Airport. For example, a copy of the threat email was requested on numerous calls and it was not provided.
At 10:04 the crew queries again whether their company has been informed, the controller responds: "we will try to pass information to your company during 5 minutes".
The report states further:
10:10 According to Litcargus Ramp Shift Leader, Litcargus (the ground handling service provider at Vilnius Airport) tries to contact Minsk ATC by telephone (3 attempts until 10:13).
The report continues:
10:17:51 After being instructed to follow the �Follow Me� vehicle, RYR 1TZ requests confirmation that Ryanair Operations has been informed about the incident. The Ground controller responds, �Yes, affirmative�, at which point RYR 1TZ asks �Did you have a message from them to us? The controller replies that they �did still not have additional message�.
There is no evidence that RYR was informed about the event or either of the emergency phases, at this time.
10:25 Litcargus Ramp shift Leader contacts Minsk Airport dispatch service by telephone, however, no information could be made available.
10:26:24 RYR 1TZ requests again from the Ground controller if any message has been received from its company. Minsk Ground Control advises that they had not.
10:29:18 RYR 1TZ again raises the issue of communications with the company, and the Ground controller responds with �If you ask me about your company representative, I don�t have any information about him.�
The report states describing events in the cabin:
The PIC made a Passengers Announcement (PA) informing the passengers of a diversion to Minsk due to security issues. As the crew was preparing the cabin for landing, immediately after the PA, one of the passengers, stood up and shouted to one of the cabin crew that he could not land in Minsk as �I'm wanted there, they'll kill me�. The CSS, informed about the incident by the cabin crew, attempted to reassure the panic-stricken passenger. The CSS then reported the situation to the flight deck; it was about 10 minutes before landing. There is a convergence in the statements of the crew that the passenger was not considered unruly or disruptive.
A MIG-29 was dispatched however was still 55km away from the Ryanair Aircraft when the Boeing landed. The MIG aborted the mission and returned to base.
Hold and carry on luggage of both crew and passengers were screened at the airport, the aircraft was refueled and the passenger re-embarked. The report annotates:
Once boarding of passengers was completed, cabin crew conduct a headcount of passengers and establish that five passengers are missing. No explanation was provided to the Ryanair crew by the Minsk Airport ground staff.
The report analyses:
The bomb threat emails were received by four airports. Information obtained from Switzerland through the Lithuanian authorities shows that only one email was sent to Minsk Airport (info@airport.by) at 09:56:45 (12:56:45 local). Although Belarus showed the FFIT a copy of an email received at 09:25 UTC (12:25 local) in the Minsk Airport (info@airport.by) mailbox, the information obtained from Switzerland through the Lithuanian authorities did not show that such an email had been sent to the Minsk Airport (info@airport.by) mailbox.
The FFIT was not provided with saved electronic copies of the emails received at info@airport.by in their original format, as, according to the Department of Cybersecurity and Information Technology of Minsk National Airport, messages on the said email address are only stored for seven days, after which they are automatically overwritten. The FFIT was provided an image (screenshot) of an email, thus the metadata was not reviewable.
The report further analyses amongst other:
- in the contexts of the totality of the information available in the bomb threat email and the need to attend to the anticipated needs of the aircraft, including the provision of relevant details, information provided to the flight crew was incomplete, of varying degrees of clarity and only volunteered over an extended period of transmissions and numerous pilot inquiries. That the bomb threat had been communicated via email was only provided subsequent to the recommendation for diversion to Minsk Airport. Pertinent information included in the bomb threat email was not passed on to the flight crew such as that specific reference to the flight number FR4978 had been made, the time of receipt of the message, the identified organization/sender, and the reasons for placement of a bomb on board that specific flight. This, together with the use of phrases lacking in specificity, such as �security services� and �security reasons� added to the challenge brought upon the flight crew to determine the appropriate course of action in an efficient and effective manner;
- the flight crew was informed that the bomb threat message was received via email, however, the relative times of email arrival and its discovery were not provided to the crew;
- while the rationale for recommending diversion to Minsk Airport was exclusively stated to be �security reasons�, the reasons were not volunteered nor was the specific entity who had made this recommendation identified. The flight crew was not informed that the bomb threat was assessed as credible nor the basis for this assessment; and according to interviews during the investigation, that the assessment was made singularly by the Minsk ACC Duty Supervisor, after consultation with senior air traffic control staff only, and that no external consultation had been carried out;
- both the flight crew and subsequently Vilnius ACC were advised by Minsk ACC that the bomb threat email was sent to several airports. The fact that emails were sent to different airports was found to be correct. However, the FFIT could not establish how the information about the sharing of the email with other airports came to the knowledge of the area surveillance controller or Minsk ACC Duty Supervisor;
- although at several times, the flight crew requested information from various controllers on whether the company had been informed of the situation and if any message had been received from them, only limited information was provided to the flight crew on efforts and progress to contact the company. At 10:17 UTC, in response to another request of the flight crew to the ground controller for confirmation that the company had been informed about the incident, the controller responded, �Yes, affirmative�. There was no confirmation availed to the FFIT that the company had been informed of the event by the Belarus authorities. RYR provided the transcripts of calls made by the RYS and RYR OCCs in the period between 10:01 UTC and 12:17 UTC trying to establish communication with the authorities in Minsk to get more detailed information on the security threat that led to RYR 1TZ diverting to Minsk Airport. A copy of the threat email was requested on numerous calls and it was not provided;
The report states the Ryanair crew remained within their standard operating procedures and requirements at all times.
The CVR recordings of the incident flight were lost as continuation of the flight with the circuit breaker pulled was prohibited and the CVR had not been secured/read out at Minsk.
The report states:
When an occurrence of unlawful interference with an aircraft takes place or is suspected, ATS units shall, in accordance with locally agreed procedures, immediately inform the appropriate authority designated by the State and exchange necessary information with the operator or its designated representative (Annex 11, 2.24.3). In this context, and in accordance with Annex 12, 4.1.1, each RCC shall have readily available at all times, up-to-date information concerning addresses and telephone numbers of all operators, or their designated representatives, engaged in operations in its search and rescue region.
- Belarus ATM Aviation Regulations require that the operator or the operator�s authorized representative, be informed by the air traffic control authority upon receiving information from other sources about the threat of an explosive device being placed on board an aircraft.
- No evidence was provided by the Minsk ACC or Belarus RCC of any attempt to contact the Operator. The flight plan contained a telephone number for direct contact with the RYR OCC, albeit its inclusion was not based on any ICAO provision. However, there is evidence in telephone recordings and transcripts that the RYR OCC tried, on multiple occasions, to get information on the diverted aircraft to no avail until hours after the aircraft landed at Minsk Airport.
The report states: "As neither a bomb nor evidence of its existence was found during pre-departure screening in Athens, Greece and after various searches of the aircraft in Belarus and Lithuania it is considered that the bomb threat was deliberately false."
The report concludes (quoted in its entirety):
5.1. As stated in paragraph 3.1 e) of its Terms of Reference, the FFIT was expected to �identify pieces of information potentially missing and that would be necessary to complete the investigation�. As indicated in paragraph 1.5 above, some specific information, including critical information indicated in the Analysis section of this report as highlighted below, was requested but not made available to the Team. Considering the above, the Team�s conclusions below are based exclusively on the information availed to it as of the time of this report.
5.2. According to the authorities of Belarus, a first email was received at 09:25 UTC (12:25 local) followed by a second email at 09:56:45 UTC (12:56:45 local), both containing identical information about the bomb threat. On the other hand, information obtained from Switzerland through the authorities of Lithuania shows that only the second email was sent to Minsk Airport at 09:56:45 UTC (12:56:45 local). The FFIT was not able to verify that the first email was effectively received at 09:25 UTC (12:25 local) as the authorities of Belarus did not provide logs of the email server airport.by nor the email files containing the threat messages saved in their original format including their metadata, citing their erasure in accordance with their data retention policy. The receipt of the first email is crucial to explain the basis for the communication of the bomb threat by Minsk ACC to the flight crew, which occurred at 09:30:49 UTC (12:30:49 local). In the absence of the first email, it could be presumed that the information about the bomb threat would have been obtained by the authorities of Belarus by other means, which the FFIT could not establish. If the first email was in fact received at Minsk Airport, the diversion of the flight to Minsk Airport could be considered to be a tenable option in view of the circumstances.
5.3. The FFIT could not corroborate the information provided by the authorities of Belarus regarding the transmission by phone of the contents of the threat email from airport personnel to Minsk ACC personnel leading to the notification of the threat to RYR 1TZ. As cellular phone records of the personnel involved documenting the time and duration of the calls and person or entity contacted were not made available, those statements could not be supported by evidence.
5.4. As neither a bomb nor evidence of its existence was found during pre-departure screening in Athens Greece and after various searches of the aircraft in Belarus and Lithuania, it is considered that the bomb threat was deliberately false. Knowingly communicating false information which endangers the safety of an aircraft in flight is an offence under Article 1 (1) (e) of the Montr�al Convention. The Team was unable to attribute the commission of this act of unlawful interference to any individual or State.
5.5. The FFIT was neither able to meet with, nor interview the Minsk ACC controller who was assigned to the RYR 1TZ flight. The authorities of Belarus informed the Team that this individual did not report for duty after his summer leave and that they had no information on his whereabouts and no way to contact him.
5.6. The authorities of Belarus did not provide the FFIT information demonstrating that attempts were made to contact the Operator (RYR or RYS) for the purposes of meeting the obligations contained in Annex 11, 2.24.3 and Belarus ATM Aviation Regulations, 15.12.9. to exchange information with the operator or its designated representative.
5.7. Communications could not be established between the flight crew and the OCC during the flight when such communications would have been necessary in line with the operator's procedures. Had such communications between the flight crew and the OCC been established it would have impacted the course of events.
5.8. Video recordings from cameras located adjacent to aircraft parking stand 1 and inside the terminal which could have shown certain significant activities regarding the processing of passengers from the point of disembarkation and in the terminal building were not provided to the FFIT. Although short extracts of the said video recordings had been used in a documentary type video that was shared with the Team, the authorities of Belarus explained that not all recordings were available due to the length of time that had elapsed since the event. The FFIT was not provided with a satisfactory rationale to explain why records had not been preserved considering that criminal and other investigations in respect of the event had been initiated by the authorities of Belarus and had not been completed.
5.9. Inter flight-crew coordination conversations that led to their decision to divert to Minsk Airport could not be fully confirmed since the CVR circuit breaker was not pulled after landing in Minsk. As a result, the full flight-crew conversations, prior to the period when the aircraft was on short final to Minsk Airport, were not preserved.
5.10. From the evidence provided by Belarus, no escort or intercept occurred between the MIG-29 and RYR 1TZ and no communications by the MIG-29 was recorded on the radio channels used by RYR 1TZ. According to information provided by the flight crew and cabin crew, there was no communication, interaction, visual sighting or other knowledge of military aircraft involvement with the flight.
5.11. Some of the States connected to the event have issued formal requests to other States for information and assistance in connection with criminal and other investigations into the event. Such investigations could assist in establishing any missing facts relating to the event. In this regard, States and entities that have received such formal requests should be encouraged to respond as appropriate.
|
By (anonymous) on Sunday, Jul 24th 2022 15:26Z
By Hugh on Thursday, Jul 21st 2022 16:29Z
By Curious on Friday, Feb 4th 2022 08:43Z
By Kostas on Tuesday, Feb 1st 2022 07:46Z
By Ferenc Koncz on Thursday, Jan 27th 2022 19:14Z
By Ferenc Koncz on Thursday, Jan 27th 2022 18:58Z
By Black Ace on Sunday, Jan 23rd 2022 23:40Z
By (anonymous) on Sunday, Jan 23rd 2022 10:45Z
By (anonymous) on Friday, Jan 21st 2022 19:13Z
By (anonymous) on Friday, Jan 21st 2022 08:44Z
By B738 capt on Friday, Jan 21st 2022 06:57Z
By (anonymous) on Friday, Jan 21st 2022 04:59Z
By (anonymous) on Thursday, Jan 20th 2022 12:55Z
By WhiskeyCobra on Wednesday, Jan 19th 2022 16:42Z
By WhiskeyCobra on Wednesday, Jan 19th 2022 16:35Z
By (anonymous) on Wednesday, Jan 19th 2022 13:10Z
By Kalle on Tuesday, Jan 18th 2022 23:48Z
By Ian on Wednesday, Jun 9th 2021 21:24Z
By PJ737 on Wednesday, Jun 9th 2021 07:38Z
By WhiskeyCobra on Thursday, Jun 3rd 2021 20:40Z
By (anonymous) on Thursday, Jun 3rd 2021 18:50Z
By The Legacy on Thursday, Jun 3rd 2021 12:53Z
By LF on Thursday, Jun 3rd 2021 12:51Z
By ADS on Thursday, Jun 3rd 2021 10:13Z
By Chris Martin on Thursday, Jun 3rd 2021 07:24Z
By (anonymous) on Thursday, Jun 3rd 2021 06:54Z
By edward on Thursday, Jun 3rd 2021 06:49Z
By Tee on Monday, May 31st 2021 18:29Z
By Chris 777 on Sunday, May 30th 2021 18:59Z
By SYN on Sunday, May 30th 2021 13:52Z
|
The Aviation Herald Apps
Android and iOS
Support The Aviation Herald
Euro
US$
Interview:
|
|
