What Flydubai FZ1073 Means for Every Passenger

 On 30 September 2026, the most dangerous person aboard Flydubai flight FZ1073 was not in the cabin. He was in the right-hand seat. Two and a half weeks later, UAE prosecutors described it as an attempted terrorist act, not the breakdown of a troubled pilot. That shift matters to everyone who buys an airline ticket.

When I first wrote about this incident, the working assumption was that a mentally disturbed pilot was acting alone. The evidence has since shifted, and so has my concern. This piece sets out what is verified, what remains speculation, and what it means for the travelling public.

What happened on FZ1073

The flight was a Boeing 737 MAX 8 from Dubai to Tel Aviv, carrying roughly 180 people. As it approached Israel, the co-pilot attacked the captain, and the aircraft descended by thousands of feet. The captain, Indian national Smit Machchhar, was badly wounded but managed to open the flight deck door. Passengers and off-duty Flydubai crew on board then restrained the attacker. The pilots diverted and landed safely at Tabuk, Saudi Arabia. A replacement Flydubai aircraft took the passengers on to Tel Aviv the same day.

Israeli Prime Minister Benjamin Netanyahu said the captain had "managed to prevent a 9/11 disaster". On the evidence released so far, that is not an exaggeration.

What we know, and what we don't

The evidence supports a premeditated terrorist act by an insider. It does not yet support a state-directed or organised campaign. These are two distinct stories, and readers deserve to know which one is proven.

What officials have stated on the record:

· UAE Attorney General Hamad Saif Al Shamsi says the co-pilot attempted a terrorist act. He says the co-pilot attacked the captain with the flight deck crash axe and tried to seize the flight controls. The UAE leads the investigation because the aircraft is UAE-registered.

· A Middle East official told NBC News that the co-pilot planned to fly the aircraft into Ben Gurion Airport.

· Reuters and AP, citing people familiar with the case, identify him as Hamam al-Hammami., an Omani national born in the UAE. He has not been officially identified.

What remains unproven:

1. Iranian involvement. US President Donald Trump said the attacker could be linked to Iran but provided no evidence. A senior US official briefed on the Israeli investigation told NBC there were no indications that Iran directed or took part in the attack.

2. An organised network. Multiple US officials and a former Israeli security official told NBC that early indications point to a lone actor. Israel's UN ambassador said Israel could not yet link the attack to any state or group.

3. The radicalisation pathway. Netanyahu says the co-pilot underwent radical Islamist indoctrination. He has not said what evidence supports this.

The most defensible reading today is of a radicalised lone insider, with the question of who radicalised him still open. That is not reassuring. A lone actor leaves no network to intercept and no communications to monitor. He simply has to show up for work.

One caution for readers following the coverage: political statements have repeatedly outpaced the investigators. Treat any claim not attributed to the UAE investigation with care until the final findings are published.

Israel's response: screening by passport

Israel moved within 24 hours, but the measure is narrower than many headlines suggest. On 1 October, the Ministry of Transport told foreign airlines that pilots and cabin crew flying into Israeli airspace must not hold the nationality or dual nationality of any state without diplomatic relations with Israel. The list reportedly covers 31 countries, including Iran, Oman, Saudi Arabia and Pakistan. Air France and United Airlines have reportedly adjusted crew rosters to comply.

Crew from those states were already barred. The practical change is that dual nationals are now included.

Having audited airline security programmes, I see three problems with relying on this.

1. The existing control was already leaking. Under the earlier directive, foreign airlines checked their own crews against the restricted list. Reports suggest that more than 1,200 crew members from barred countries still entered Israel. A rule on paper is not a control in practice.

2. Nationality is a poor proxy for intent. A radicalised holder of a "friendly" passport passes straight through. The Germanwings co-pilot was German. An Israeli security expert quoted by the Jerusalem Post made the same point: the problem is not only pilots from hostile countries.

3. The friction is real. An Ethiopian Airlines cargo flight was reportedly turned back because of an Indonesian pilot's nationality. Lawyers have warned that carriers applying the rule in Europe may face discrimination claims.

Israel's action is understandable as an immediate containment measure. As a long-term defence, it treats the symptom and leaves the vulnerability unaddressed.

Why more passenger screening will not fix this

The post-9/11 security model was built to stop an outsider carrying a weapon onto an aircraft and forcing a way forward. FZ1073 defeated none of that, because none of it was relevant. The weapon was already mounted in the flight deck. The attacker was legitimately at the controls.

That is my central concern for the travelling public. The instinctive political response to an aviation attack is to add friction at the checkpoint. Longer queues, more pat-downs and tighter liquid rules do nothing to stop a qualified pilot already behind a locked door. Passengers would pay for security theatre aimed at the wrong people.

The reinforced flight deck door is an uncomfortable paradox. Introduced after 9/11, it protects the flight deck from the cabin, not from itself. On Germanwings 9525, it locked the captain out while the co-pilot flew the aircraft into the Alps. On FZ1073, the outcome was averted only because the wounded captain reached the door and opened it.

Pilot-initiated events are not new. What has changed is the motive. Previous cases were largely linked to personal or psychological factors; FZ1073 is alleged to be ideological.

Date	Flight	Outcome	Finding
30 Sep 2026	Flydubai FZ1073	No fatalities; diverted to Tabuk	Alleged terrorist act by co-pilot (UAE investigation ongoing)
24 Mar 2015	Germanwings 9525	150 killed	Deliberate act by co-pilot (BEA)
29 Nov 2013	LAM 470	33 killed	Deliberate act by captain (Mozambique and Namibia investigators)
31 Oct 1999	EgyptAir 990	217 killed	Deliberate inputs by relief first officer (NTSB; disputed by Egypt)
19 Dec 1997	SilkAir 185	104 killed	Deliberate pilot action (NTSB; Indonesian report inconclusive)

Findings as stated in the published accident reports. MH370 (2014) is excluded because its cause remains undetermined.

What the industry should do instead

The burden of the response lies with the crew side of the operation, not the passenger queue. After Germanwings, Europe introduced psychological assessments before line flying and required pilot peer-support programmes. These measures target mental-health decline. FZ1073 shows we now need the equivalent for radicalisation.

Based on my years in flight operations, safety management and IOSA auditing, I would prioritise the following measures:

a) Continuous vetting, not one-off vetting. Most background checks occur at hiring and are refreshed infrequently. Radicalisation can occur years into a career. Periodic re-checks and information-sharing between states and airlines need to close that gap.

b) Insider-threat programmes built into the SMS. Airlines already run just-culture reporting for safety concerns. Crews need a confidential, trusted route to report behavioural red flags about a colleague, handled by trained security staff.

c) A fresh look at two-persons-on-the-flight-deck policies. Europe recommended the rule after Germanwings, then relaxed it to a risk-based approach. Operators flying into contested regions should revisit that risk assessment now.

d) Flight deck equipment as a threat. The crash axe exists for fire and emergency access. Manufacturers and regulators should review its stowage and accessibility.

e) Rapid door-access and incapacitation drills. FZ1073 ended well because the captain reached the door. Cabin crew procedures for a hostile or incapacitated pilot should be trained, not improvised.

f) Intelligence-led risk assessment over nationality lists. Passports are easy to screen and easy to defend politically. Behaviour, associations and access patterns are harder to assess and far more predictive.

None of these measures would add a single minute to a passenger's journey.

For the travelling public: perspective and practical steps

The risk to any individual passenger remains extremely small. Pilot-initiated events number a handful across decades and hundreds of millions of flights. Commercial aviation remains among the safest ways to travel. What has been damaged is confidence, not the statistics.

That loss of confidence is real, and I understand it. For years, we told passengers the threat came from a stranger in seat 23C. Now it can come from the person we trust most on board. Travel that once felt like a pleasure is starting to feel, for some, like an exercise in anxiety..

You cannot vet your pilots. You can still travel sensibly:

1. Keep your seatbelt fastened whenever you are seated. FZ1073 lost thousands of feet in moments. Loose passengers are injured in any sudden manoeuvre, whatever the cause.

2. Know that your crew are trained for emergencies and follow their instructions. In a crisis, the fastest safe outcome comes from crew-directed action, not individual heroics.

3. If the crew ask for help, help. On FZ1073, passengers and off-duty crew acted together under the captain's lead. That cooperation saved the aircraft.

4. Report anything that genuinely concerns you to a crew member rather than discussing it in the cabin or online.

5. Expect disruption on some routes. Crew nationality rules may change schedules on flights to Israel. Check your airline's advisories and your insurance cover before you fly.

6. Judge the response, not just the incident. Ask whether airlines and regulators are strengthening crew vetting or merely lengthening the security queue.

Closing thoughts

FZ1073 did not end in tragedy thanks to a wounded captain, alert passengers, and off-duty crew who happened to be on board. As on United 93, ordinary people became the last line of defence. Who sits in the cabin is not a security system.

The industry now faces a choice. It can respond with visible measures that inconvenience millions of passengers and do little to deter an insider. Or it can do the harder, quieter work of securing the flight deck from within. The travelling public should expect, and demand, the second.

The investigation is ongoing, and I will update this piece as the UAE's findings are published.

Author: GR Mohan

Eighteen Seconds at 168 Knots: What the VN34 Munich Interim Report Tells Us

 

A Take-off that used 4,000 metres of runway, and then some

On 15 August 2026, a Vietnam Airlines Boeing 787-9 departed from Munich for Hanoi and became airborne from grass beyond the end of runway 26L. Runway 26L is 4,000 metres long, and the afternoon was clear with light, variable winds.

The tail struck the ground; the main gear and tail took out 20 approach lights, and the crew returned two hours later with damaged tyres. All 287 people walked away. The aircraft did not walk away as cleanly; the BFU classifies it as an accident with substantial damage.

The German BFU published its interim report on 28 September. It names no cause yet, and neither will I. But the recorder data already tells a story every airline pilot, training captain, and safety manager should read closely. Here is my take, as someone who has spent a career on both sides of the check-ride table.

What the interim report says

The setup was hot and heavy, but nothing exotic. Munich sits at 1,487 ft. The temperature was 33°C, and the take-off mass was 240,857 kg, against a maximum of 247,207 kg. The crew calculated V1 at 169 kt, Vr at 175 kt and V2 at 180 kt.

On board were 271 passengers, 12 cabin crew and four pilots. The captain on take-off was 64, with 27,182 hours, including 7,795 as a 787 captain. The pilot monitoring had 12,375 hours. The operator's nominated pilot in command sat in the left jump seat.

The key moments from the flight recorders, in local time:

Time	What the recorders show
13:56:12	Take-off mode engaged
13:56:15	Both left-seat brake pedals move; brake command 15% left, 6% right
13:57:03	Airspeed stalls near 168 kt and stays there for about 18 seconds
13:57:12	Brake command peaks at about 27% left, 17% right
13:57:14

THE MALICIOUS INSIDER IN THE FLIGHT DECK

 Lessons from flydubai FZ1073 and Earlier Cases of Deliberate or Suspected Crew Action

A Low-Probability, Catastrophic-Risk Threat

The 30 September 2026 incident aboard flydubai flight FZ1073 from Dubai to Tel Aviv has reopened one of commercial aviation's most uncomfortable security questions: what happens when the threat is not outside the cockpit, but is a trained, credentialed and trusted person already inside it? UAE authorities have stated that the co-pilot attacked the captain with a crash axe and attempted to seize the flight controls, describing the act as an attempted terrorist attack. The aircraft was eventually brought under control and safely diverted to Tabuk, Saudi Arabia. The investigation into motive, prior planning, possible associates and failures in personnel vetting remains open.

The event should not be used to stigmatised professional pilots. Deliberate hostile acts by flight crew remain extraordinarily rare. However, their potential consequences are catastrophic, and they expose a vulnerability that ordinary hijack-prevention measures cannot address. Reinforced cockpit doors, access codes and passenger screening are designed primarily to keep an unauthorised attacker out. They offer little protection when the attacker already has legitimate flight-deck access.

The Historical Record: Not One Phenomenon, but Several

FZ1073 is not without precedent, although earlier events fall into different evidential and motivational categories. FedEx Flight 705 in 1994 remains one of the clearest insider-threat cases. An off-duty FedEx flight engineer, travelling in the cockpit jump seat, attacked the operating crew to seize the DC-10. Despite severe injuries, the crew fought back and landed safely. The significance is fundamental: the attacker was not an outsider breaching aviation security. He was an authorised employee with technical knowledge and trusted access.

EgyptAir Flight 990, a Boeing 767 that crashed into the Atlantic in 1999, falls into a more complex category. The NTSB concluded that the aircraft's departure from normal cruise and impact resulted from the relief first officer's flight-control inputs, while explicitly stating that the reason for those actions could not be determined. The CVR included repeated religious expressions, but those words cannot be responsibly treated as proof of religious motivation or terrorism. The case demonstrates the need to separate three questions: who manipulated the aircraft, whether the manipulation was deliberate, and why it occurred.

SilkAir Flight 185 is similarly disputed. The Indonesian investigation did not determine a cause, whereas the US NTSB concluded that the evidence was most consistent with deliberate control inputs. It is therefore relevant as a suspected case, but not as an established example of pilot suicide.

LAM Mozambique Flight 470 and Germanwings Flight 9525 are far less ambiguous. Investigators concluded in both cases that a pilot deliberately caused the aircraft to descend while alone in effective control of the flight deck. Germanwings prompted major changes in European policy on pilot psychological assessment, support programmes and substance testing.

Malaysia Airlines MH370 again belongs in a separate evidential category. The loss of normal communications, major route deviation and continued flight for many hours inevitably generated hypotheses involving deliberate human action. Yet the main wreckage, CVR and FDR have not been recovered, and the official investigation could not determine the cause. MH370 therefore illustrates the consequences of the loss of assured control, tracking and communications, but should not be presented as a proven pilot-suicide event.

The Common Vulnerability: Trusted Access

These cases differ in motive and certainty, yet they expose a common structural weakness: aviation systems are built on the assumption that authorised personnel will support the safe completion of the flight. A pilot, engineer, instructor, check pilot or other authorised crewmember can bypass layers of security precisely because the system is designed to trust that individual.

This is why the term “rogue pilot” is too narrow. The more useful concept is the malicious insider threat to the flight deck. It includes operating pilots, deadheading crew, engineers and other employees with privileged access. The risk may arise from terrorism, personal grievance, deliberate self-destruction, coercion or acute behavioural breakdown. These pathways are not interchangeable, nor are their countermeasures.

FZ1073 also raises a specific concern about cross-border personnel information. Modern pilots may train in one country, hold a licence issued by another, and work successively for several international operators. If one State or employer has imposed a serious security-related restriction, that information must not simply disappear when the individual crosses a jurisdictional boundary.

Where Current Defences Remain Weak

ICAO's Insider Threat Toolkit already recognises that background checks should be recurrent and that continuous vetting should be encouraged, including cooperation with authorities in other States. Importantly, ICAO notes that some insiders develop malicious intent only after employment. Pre-employment screening is therefore necessary but insufficient.

The United States Pilot Records Database offers another useful model. It requires covered operators to review available training, qualification, disciplinary and separation records before employing a pilot. It is not a global security database, but it shows that structured, regulated sharing of employment history can be achieved without compromising due process.

The post-Germanwings European response introduced psychological assessment before line flying, pilot support programmes and enhanced drug and alcohol testing. These are valuable aeromedical barriers, but psychological screening must not be confused with security vetting. A terrorist insider, a suicidal pilot and a pilot with a treatable mental-health condition are distinct problems. Treating them as one can both miss genuine threats and discourage pilots from seeking medical help.

A Layered Preventive Strategy

The priority should be an internationally compatible system for recurrent personnel security vetting. National authorities should be able to flag serious aviation security restrictions to one another via secure regulator-to-regulator channels. Airlines need not receive intelligence details; they do need to know when an applicant or serving crew member requires further security review before granting unrestricted cockpit access.

Second, airlines must verify previous employment directly rather than infer it from a CV. Relevant records should include serious disciplinary action, separation from employment, unresolved security restrictions and documented safety-significant behaviour. A non-response from a previous employer should trigger further review, not automatic clearance.

Third, airlines need robust, confidential reporting and peer-support systems. Colleagues often notice significant behavioural changes before management does. Reporting mechanisms should enable instructors, pilots and cabin crew to raise genuine concerns while protecting employees from arbitrary accusations based on nationality, religion, political opinion or routine mental-health treatment. Security assessments must be intelligence-led and behaviour-based, not discriminatory.

Fourth, operators should review cockpit procedures to address malicious interference. CRM traditionally assumes that both pilots ultimately share the objective of safe flight. A hostile crew member violates that premise. Training should therefore address deliberate interference with controls, assault or incapacitation of one pilot, rapid cabin-crew intervention, emergency cockpit access, and communication with ATC. This is not an argument for turning pilots into security officers; it is an argument for recognising an extreme but credible contingency.

Fifth, FZ1073 justifies a technical review of emergency equipment, such as the crash axe. Removing it automatically may create a new hazard, as crews may need it during a fire, structural damage or evacuation. However, its location, retention, accessibility and tamper indication should be assessed against the insider-threat scenario.

Finally, insider threat belongs at the intersection of the airline's Safety Management System (SMS) and Security Management System (SeMS). Safety departments traditionally analyse errors, equipment failures and procedural breakdowns, while security departments focus on hostile acts. FZ1073 shows why these domains must intersect. A malicious insider may exploit normal operational authority to create a safety catastrophe in seconds.

Conclusion

Aviation has spent the past quarter-century making the cockpit extraordinarily difficult for an outsider to penetrate. The next challenge is to ensure that trusted access does not itself become the vulnerability. FedEx 705, EgyptAir 990, SilkAir 185, LAM 470, Germanwings 9525, the unresolved disappearance of MH370, and now FZ1073 show that the issue cannot be reduced to a single motive or medical diagnosis.

The probability of deliberate hostile action by authorised aviation personnel remains very low. However, the consequences could be catastrophic. The correct response is neither suspicion of the pilot profession nor intrusive surveillance of every crew member. It is a layered security architecture: verified international employment histories, recurrent and continuous vetting, regulator-to-regulator information sharing, effective peer-support systems, carefully governed reporting, route-sensitive risk assessment, and explicit insider-threat planning within both SMS and SeMS.

The most important question arising from FZ1073 may therefore be broader than the alleged act itself: if relevant warning information existed before the flight, why did the aviation system fail to turn that information into an effective barrier? The answer will determine whether FZ1073 becomes merely another extraordinary incident - or the catalyst for a more mature global approach to flight-deck insider risk.

Author: GR Mohan

Miami Runway Excursion: A Failure of Barriers Before the Runway End

 The 21 Air Boeing 767 accident in Miami on 6 September 2026 is disturbing not merely because an aircraft overran a runway with fatal consequences. It is disturbing because preliminary evidence suggests that several established safety barriers may have been progressively breached before the aircraft even left the paved surface.

The NTSB investigation remains ongoing, and it has not yet determined a probable cause. Yet within three days of the accident, the Board released verified information from the Cockpit Voice Recorder and Flight Data Recorder. That preliminary sequence already raises serious questions about stabilised-approach discipline, Crew Resource Management, cockpit authority gradient, training and organisational safety culture.

The emerging picture is stark.

Configuration for landing was delayed. Flaps 5 was called less than three minutes before the end of the CVR recording, followed by landing gear, Flaps 15 and Flaps 20. When Flaps 20 was called, the other pilot cautioned that the aircraft was too fast. The NTSB states that this pilot made further comments about excessive speed throughout the remainder of the recording, and the pilot flying did not consistently respond.

The autopilot was subsequently disengaged. The automated 1,000-foot call was followed by a “sink rate” warning. Another “sink rate” warning occurred below 500 feet. Around minimums, repeated “too low terrain” alerts were issued. Flaps 30 were not called until approximately 41 seconds before the recording ended, immediately before the final radio-altitude callouts and touchdown.

This is precisely the type of sequence that the stabilised-approach criteria are designed to prevent.

A stabilised approach is not an aspirational description of a good approach. It is a procedural safety barrier against continuation bias, deteriorating energy states, and last-minute improvisation.

At the designated stabilisation gate, the aircraft should be on the correct flightpath, properly configured, within prescribed speed and descent-rate limits, and the crew should be ready to land. If those criteria are not met, the required response should be unequivocal:

GO AROUND.

The precise company criteria applicable to this flight must be established by the investigation. However, irrespective of the individual numerical limits, the sequence raises a fundamental question:

Why did accumulating deviations and repeated warnings not produce decisive intervention?

CRM is intervention—not commentary

That question extends well beyond the pilot flying.

a) The pilot monitoring is not a spectator.

b) There is an important difference between:

“Too fast.”

and

“UNSTABLE—GO AROUND.”

The first describes a condition.

The second triggers a safety defence. Effective CRM requires monitoring, challenging, responding and, where necessary, escalation. If the aircraft continues through a mandatory stability gate outside limits, repeatedly describing the deviation cannot, by itself, constitute an effective defence.

The investigation therefore needs to establish whether stabilised-approach calls were clearly defined, whether a go-around became mandatory once specified criteria were exceeded, and whether the pilot monitoring was explicitly authorised to insist on it.

But another important human-factors question should also be examined:

Was there a cockpit authority gradient?

A steep cockpit gradient can significantly reduce the monitoring pilot's effectiveness.

If one pilot is substantially more senior, more experienced, holds a training or checking position, or otherwise has greater organisational authority, the other pilot may be reluctant to challenge decisions forcefully. The PM may recognise that an approach is deteriorating and may even repeatedly verbalise concern, yet stop short of the decisive intervention that CRM requires.

Nothing currently released by the NTSB establishes that such a gradient existed on Flight 7598. It would therefore be incorrect to assert that it did.

But the recorder’s summary makes the question legitimate.

One pilot repeatedly expressed concern about excessive speed. The approach nevertheless continued, and the NTSB specifically notes the lack of a consistent verbal response.

Investigators should therefore examine the pilots' respective qualifications, seniority, flying experience, company roles, and previous professional relationship.

a) Was the PM hesitant to challenge the PF?

b) Was an excessive authority gradient present?

c) Was there deference arising from rank, experience or training status?

d) Did the airline's CRM programme specifically teach pilots how to handle such gradients?

e) Most importantly, were pilots trained that once a defined safety limit had been crossed, procedural authority superseded cockpit hierarchy?

In a mature CRM environment, rank should become irrelevant if a mandatory safety criterion is violated.

The correct call from the more junior pilot must carry exactly the same operational weight as one from the captain.

From an approach problem to a runway emergency

The touchdown sequence shows how quickly options disappeared.

The FDR recorded the nose and right main gear touching down at 158 knots. Braking began around 146 knots, and the left main gear did not register touchdown until approximately 134 knots. These values cannot be conclusively interpreted without weight, VREF, wind, touchdown position and runway conditions, but the sequence clearly warrants detailed examination.

What happened next is particularly significant.

At approximately 120 knots, the brakes were released, and the thrust was increased to a value consistent with go-around thrust. The CVR also recorded a go-around call.

Four seconds later, the throttles were returned to idle, and the brakes were reapplied at approximately 117 knots. The aircraft subsequently departed the paved surface. The FDR also showed no indication that either speed brakes or thrust reversers had been deployed before recording ended.

The investigation must establish why the go-around was initiated after touchdown and then abandoned, and why the principal additional deceleration systems were apparently not deployed.

But operationally, the broader lesson is clear.

A relatively straightforward decision available hundreds of feet earlier had become far more difficult:

Continue stopping—or attempt to fly again?

That is exactly the predicament that stabilised-approach gates are intended to prevent.

The investigation must move beyond the cockpit

Nevertheless, it would be inadequate to treat Miami as simply an error by two pilots.

The more important investigation may lie upstream.

What was the operational culture at 21 Air?

How rigorously were the stabilised-approach and mandatory go-around policies enforced?

Were pilots genuinely encouraged to go around without concern for schedule disruption, additional fuel consumption or criticism?

Did recurrent simulator training realistically expose crews to continuation bias, high-energy approaches, late configuration, rejected landings and assertive PM intervention?

Did CRM scenarios deliberately place junior pilots opposite dominant or highly experienced captains and require them to escalate from advisory language to a mandatory go-around call?

That last point matters greatly.

CRM training is incomplete if crews practise cooperation only when both pilots agree. Its true test is whether the less authoritative cockpit member can intervene effectively when the more authoritative one persists with an unsafe course of action.

The investigation should also examine line checks, recurrent simulator reports, Flight Data Monitoring, and internal safety reports.

a) Were there any previous high-energy or unstable approaches?

b) Was late configuration occurring during the operation?

c) Were crews continuing below stabilisation gates?

d) Had FDM identified such trends?

e) If so, what corrective action was taken?

A mature Safety Management System should identify these precursors before they culminate in an accident.

Safety culture is therefore not demonstrated merely by having a stabilised-approach policy in the operations manual.

It is demonstrated when a junior first officer believes, without hesitation, that calling “GO AROUND” to a senior captain will be supported by the organisation.

Transparency is another safety barrier

Miami also offers a second important lesson.

The NTSB did not wait for the final report before communicating established facts. It held public briefings and released preliminary recorder data, while clearly stating that the data were preliminary and subject to change. The investigation remains ongoing.

That distinction is crucial.

Transparency is not premature judgement.

Verified facts can be disclosed without assigning blame or stating probable cause.

The contrast with recent Indian investigations inevitably raises questions about whether more frequent disclosure of established safety-relevant facts could reduce the information vacuum between formal reports.

Information vacuums do not eliminate speculation. They often fuel it.

Responsible disclosure strengthens confidence, allows operators to review their own procedures, and enables safety lessons to circulate before a final report is completed.

The wider lesson

The central question arising from Miami may ultimately not be simply:

Why did the pilot flying continue?

It may be:

Why did the system surrounding that pilot fail to stop the continuation?

That encompasses the PF, the PM, possible cockpit gradient, SOPs, recurrent training, checking, FDM, SMS and management culture.

What is concerning is a mechanism by which a PM can recognise the hazard and repeatedly voice concern yet still fail to escalate to an effective intervention.

Accidents rarely result from a single defence failing. They occur when successive barriers fail, are bypassed, or become ineffective.

Miami offers an opportunity to examine precisely such a progression.

The NTSB is also demonstrating another principle equally important to aviation safety:

An investigation can be rigorous without being silent and transparent without being premature.

Author: GR Mohan

Potomac Mid-Air Collision: A Failure to Convert Warning Signs into Safety Action

 The most important lesson from the January 2025 mid-air collision near Washington National Airport is not that a single crew or controller made an isolated mistake. Rather, multiple agencies had warning signs of an emerging collision risk, yet the system failed to translate those warnings into effective preventive action.

The NTSB investigation found that the hazard was neither unknown nor unforeseeable. The airspace around DCA had a documented history of close encounters between helicopters and commercial aircraft. Pilots and controllers had raised concerns. Safety databases recorded relevant events. Local working groups had discussed the geometry of Helicopter Route 4 and its proximity to the Runway 33 approach.

Over the three years preceding the accident, FAA/ASIAS analysis identified 15,214 encounters between commercial aeroplanes and helicopters in which lateral separation was less than 1 nautical mile and vertical separation was less than 400 ft. This averages roughly 390 proximity events per month. On the northern segment of Route 4—the accident area—analysis of the preceding 12 months showed that 49% of helicopter flights exceeded the published route altitude at least once, and 17% of all recorded track points on that segment were above the altitude limit.

Yet meaningful mitigation did not occur before the fatal accident. This was fundamentally a failure of the Safety Management System across organisational boundaries.

A Known Hazard

Helicopter Route 4 passed close beneath the Runway 33 approach path. Under certain conditions, the theoretical vertical separation between a helicopter operating at the published route altitude and an arriving airliner could be as little as 75 ft.

Such a margin depended heavily on precise altitude compliance, correct altimeter indications, controller situational awareness, successful visual acquisition, and timely intervention.

This was therefore not a robustly separated traffic system. It relied on several safety barriers functioning correctly every time.

Repeated close-proximity events should have prompted progressively stronger risk assessment. Instead, individual occurrences appear to have been treated largely as separate incidents rather than as evidence of a recurring systemic hazard.

Data Existed, but Risk Was Not Integrated

The FAA, controllers, airline crews and military helicopter operators each possessed parts of the safety picture.

Pilot and controller reporting systems recorded reports. Surveillance and proximity data were available. TCAS events had occurred. Operational concerns had been raised locally.

But an SMS is not effective merely because data are collected. Its purpose is to connect the sequence:

hazard identification → risk assessment → mitigation → safety assurance.

At DCA, that loop was not closed effectively.

The problem was fragmentation. FAA route planners saw one aspect of the risk. Controllers saw another. Airlines and their crews experienced yet another. The Army held its own operational and training information. No single organisation appears to have assembled these inputs into a shared conclusion that the collision risk had become unacceptable.

That is a major systemic failure.

FAA and ATC Failures

The FAA bears significant responsibility because it controlled both the airspace design and the wider safety framework.

The NTSB found that helicopter routes were not reviewed and reassessed with sufficient rigour, despite accumulating safety information and prior recommendations. The Route 4 geometry should have prompted reconsideration well before the accident.

At tower level, high workload and combined controller positions further reduced resilience. The controller had to manage helicopter and fixed-wing traffic in a complex night-time environment. This affected situational awareness, traffic advisories and the ability to recognise the developing conflict.

The deeper issue is not simply a controller error. It is whether ATC management had allowed a demanding operating configuration to become routine without a sufficiently robust real-time risk-assessment process.

When controllers are repeatedly required to “make the system work” under high workload and tight margins, that is itself a safety warning.

Overreliance on Visual Separation

The system also relied heavily on pilot-applied visual separation.

That is particularly vulnerable at night, when distance, closure rate and aircraft identity are harder to judge. Night-vision goggles restrict the field of view and can complicate visual acquisition.

In such circumstances, “traffic in sight” should not serve as the primary defence against inadequate route separation.

Visual separation should supplement safe airspace design, not compensate for poor geometry.

Army Safety-Management Failures

The Army also had significant responsibilities.

Helicopter altitude compliance was critical because even small deviations could materially reduce the already limited vertical separation.

The investigation identified shortcomings in understanding altimeter tolerances and in the Army’s broader safety-management processes. A stronger SMS, supported by flight-data monitoring and systematic analysis of altitude exceedances, should have determined whether Route 4 operations were routinely eroding the intended safety margin.

Without that feedback mechanism, potentially important trends were not translated into operational change.

Technology Was an Incomplete Defence

Collision-avoidance technology could not be relied on as a final safeguard.

TCAS protection is limited close to the ground, and helicopter surveillance and ADS-B capabilities were not always equivalent to those of commercial aircraft.

This reinforces a basic principle: collision-avoidance systems should be the last line of defence, not the primary solution to poor traffic geometry.

The system should have prevented the aircraft from coming so close in the first place.

A Failure Across Agencies

The strongest conclusion is that responsibility was shared.

The FAA was responsible for airspace design, route review and ATC safety oversight.

a) ATC management was responsible for staffing, workload, position combining and operational risk controls.

b) The Army was responsible for helicopter operations, altitude discipline, training and its own SMS.

c) Airline and controller reports provided further warning data.

d) Yet the overall system failed to integrate these inputs into a unified risk picture.

This is precisely where inter-agency safety management becomes critical. When several organisations share the same airspace, no agency can assess safety solely within its own organisational boundaries. The risk belongs to the system as a whole.

The NTSB’s Recommendations

The NTSB consequently recommended wide-ranging measures, including:

1) redesign and regular review of helicopter routes;

2) stronger vertical and lateral separation criteria;

3) improved analysis and sharing of close-proximity data;

4) better ATC workload and position-combining controls;

5) improved real-time operational risk assessment;

6) stronger controller training in visual separation and threat management;

7) improvements to conflict-alert systems and frequency management;

8) broader ADS-B In and collision-avoidance capability; and

9) stronger Army SMS, flight-data monitoring and altitude-awareness training.

These recommendations are important because they address the system that allowed the risk to persist, not merely the actions of those operating when the final barriers failed.

The Larger Lesson

The Potomac collision should therefore be seen as a classic example of the difference between having safety-management processes and operating an effective SMS.

a) Reports existed.

b) Close calls occurred.

c) Data were available.

d) Concerns had been raised.

e) Yet the risk remained substantially unmitigated.

A near miss is not evidence that the system worked. It is evidence that some barriers failed, while others narrowly prevented an accident. Repeated near misses are even more serious. They indicate that the system may be repeatedly approaching its safety boundary.

The tragedy at DCA was therefore not simply the result of one night's errors. It was the culmination of known hazards, recurring precursor events, fragmented safety information, weak inter-agency risk management, inadequate route design, excessive reliance on visual separation, and delayed corrective action.

The central safety lesson is hard to ignore:

When multiple agencies possess warning signs of a foreseeable hazard but fail to integrate and act on them, the failure is systemic long before the accident occurs.

Author: GR Mohan