The Threat Inside the Circle

We all know that access matters. It's why we check credentials, challenge unfamiliar faces and put controls around the people we protect. Yet some of the greatest access comes with a job title, and once someone has been accepted into that role, we tend to assume the difficult questions have already been asked.

Last week's attack aboard a Flydubai flight puts that assumption in doubt. The co-pilot had previously been taken off flying duties over concerns about extremist views, but later returned to the flight deck with another airline. The warning existed. What remains unclear is who else knew about it.

This is not a reason to distrust every pilot, driver or colleague. It is a reason to understand what our trust rests on. This week, On the Circuit, we look at the gap between clearing someone for a role and knowing enough about them to make that clearance meaningful.

The co-pilot who attacked his captain on Flydubai flight FZ1073 had been grounded once before. Hamam al-Hammami, an Omani national born in the UAE, flew for Oman Air for seven years until the airline stopped him flying over concerns that he held extremist views and moved him to an administrative job, the Associated Press reported. He left Oman Air in February 2025, according to Al Jazeera.

Royal Air Maroc put him through three months of theory training in 2025 and did not select him. Flydubai did. A Gulf diplomat told Al Jazeera he went through standard security checks before he was hired, but it is still unclear what Oman's concerns were, or whether Oman passed them to any other country or airline.

Two Israeli officials told Reuters that al-Hammami told UAE interrogators he had planned the attack before Flydubai hired him. A third source said he had searched for airlines flying to Tel Aviv, meant to crash the jet into Ben Gurion Airport, and had flown an earlier Tel Aviv route this year intending to do the same before deciding against it. The UAE has not confirmed those accounts, and no charges have been announced.

On September 30, over Jordan, with 174 people aboard, he struck Captain Smit Machchhar repeatedly with the cockpit's crash axe. The Boeing 737 Max dropped from about 33,000 feet to 17,000 feet in roughly a minute. Machchhar got the cockpit door open twice while his attacker tried to seal it, and passengers and crew pinned the co-pilot down and tied him with a headphone cord, Khaleej Times reported. A reserve pilot landed the jet in Tabuk, Saudi Arabia. On October 3, the UAE Attorney General said the co-pilot had attempted a terrorist act.

Israel had his name before takeoff. The UAE sent the crew and passenger list, with names and nationalities, as it does for every flight, AP reported, and Al Jazeera says it arrived 48 hours before departure. Israel's Transport Ministry says it relies on security checks carried out abroad and cannot vet every crew member itself. A classified 2024 State Comptroller report had warned that the agencies involved were not sharing information and that an existing database of aircrew was going unused, and none of its recommendations were implemented, according to the Israeli newspaper Maariv. Netanyahu has now ordered his National Security Council to review the security of every foreign airline flying into Israel.

The most troubling part of this case is that the warning was already there. Oman Air had concerns serious enough to take al-Hammami off the flight deck. That did not prevent him from moving on and eventually being hired by Flydubai, where he reportedly passed standard security checks. We still do not know whether those checks had access to the information that led Oman Air to ground him.

That matters because this was not simply a dangerous person slipping through a check unnoticed. One employer had identified a concern, but the next employer's clearance did not resolve it.

If the Israeli accounts are accurate, he deliberately sought work with an airline flying to Tel Aviv. That would make his recruitment part of the preparation for the attack. The captain, crew and passengers prevented a catastrophe, but the earlier opportunity lay in connecting the warning to the person before he was trusted to fly again.

25 of the best surveillance and counter-surveillance articles in one 180-page training volume. Written by a retired CIA security officer, former special forces soldiers, government surveillance operators, investigators and close protection specialists.

Get it for $9.99 (normally $18.99)

🇪🇹 Ethiopia. Three blasts hit Addis Ababa on October 1, hours after a drone ban over the capital, and Ethiopia expelled 10 Eritrean diplomats. Government forces are 40 kilometers from Mekelle.

🇺🇦 Ukraine. Russian drones struck the Kyiv headquarters of Kyivstar, the country's largest mobile carrier, its third hit in September, as Moscow targets telecom and data centers.

🇫🇷 France. About 5,000 people have been arrested in a week of school protests, 24 schools were burned or ransacked, and a national day of protest is set for Tuesday.

🇭🇹 Haiti. The UN renewed its anti-gang force until March 31, 2027, though it runs at under 30% of authorized strength. Gangs killed at least 11 people hours before the vote.

Most of us would question an old route plan before using it again. Country assessments deserve the same attention, particularly after a summer in which missiles, abductions and attacks on transport infrastructure have changed the operating picture. Our latest review moved seven of the ten risk scores we published in August, with no environment becoming safer.

This week's Premium piece updates all ten for Q4, explaining the changes and what needs checking before you send a team. You'll get maps, an executive summary you can read in five minutes and a refreshed planning workbook. Whether you're preparing a deployment or reviewing advice already given to a client, it will help you identify where the assessment you're relying on needs updating.

Upgrade for subscriber-only tactical analysis and every future briefing →

DATA BREACH. Intruders spent nine months inside a Pentagon personnel system run by the Defense Manpower Data Center, from October 2025 to July 2026, before anyone noticed. They reached Social Security numbers and job records for 2.76 million living people and 294,000 who have died. No one has been blamed. A Social Security number cannot be changed, so the exposure follows those people for years.

STATE THREAT. Two Iranian men were charged in London on October 3 with preparing an attack on Manchester's Jewish community around Yom Kippur, allegedly buying bomb parts and scouting targets while in contact with someone possibly in Iran. Police say it is unrelated to RAF Fairford, where the Pentagon has now withdrawn all US bombers after last week's arrests.

Q: Your site becomes linked to an active, high-profile and politically divisive situation. What's your primary concern?

🟩🟩🟩⬜️⬜️ Protests or crowds turning up at the site (38%)
🟨🟨⬜️⬜️⬜️ Someone local being paid or inspired to act (25%)
🟨🟨⬜️⬜️⬜️ Staff being identified, followed or harassed (25%)
🟧⬜️⬜️⬜️⬜️ Something else. Let us know → (13%)