The investigation into flydubai flight FZ1073 now reaches well beyond the cockpit, but the story still begins with what happened there on 30 September. The Boeing 737 MAX 8 was flying from Dubai to Tel Aviv when, according to UAE prosecutors, the first officer attacked captain Smit Machchhar with the cockpit crash axe and tried to seize control of the aircraft. The jet then entered a violent descent before control was recovered and the flight diverted to Tabuk in Saudi Arabia. All passengers later left Saudi Arabia safely.
The inquiry has since expanded into a wider examination of crew vetting, previous employment history and the international sharing of security information. According to Reuters, citing two Israeli officials briefed on the UAE investigation, the first officer allegedly told investigators that he had begun planning the act before joining flydubai and had looked for airlines serving Tel Aviv before applying to the Dubai-based carrier. A third source briefed on the inquiry said the intended target was Ben Gurion Airport and that he had considered a similar act on an earlier Tel Aviv rotation before deciding not to proceed.
Those claims are highly significant, but they remain attributed reporting. Reuters’ sources spoke anonymously, UAE authorities have not yet published the allegations as final findings, and no public evidence currently establishes accomplices, an outside organisation or an external handler. The central question has therefore widened: investigators are not only trying to reconstruct the assault itself, but also to determine whether actionable warning signs existed before the first officer was hired and, if so, why they did not prevent his access to the flight deck.
What happened in the cockpit
On 30 September, FZ1073 departed Dubai for Tel Aviv. UAE prosecutors say the first officer assaulted the captain with the cockpit crash axe, emergency equipment normally carried on the flight deck, and attempted to take control of the aircraft. The captain was injured.
During the most violent part of the event, the Boeing lost more than 16,000 feet, nearly 4,900 metres, in just over 30 seconds, according to flight data analysed by Reuters. Publicly available information does not yet allow a second-by-second reconstruction of every control input, but reporting on the captain’s account provides a clearer sequence of events.
Despite his injuries, the captain reportedly managed to open the cockpit door during the confrontation, allowing intervention from the cabin. Reuters reported that passengers helped restrain the first officer. One passenger was also reported to have briefly helped stabilise the aircraft before two pilots travelling on board took over the controls and guided the aircraft toward an emergency landing. Those details remain attributed to witness accounts and investigative sources and must ultimately be tested against flight data, cockpit evidence and official findings.
The transponder sequence also helps explain how the emergency developed. Public flight data show the aircraft first transmitting 7700, the general emergency code, then 7500, used to indicate unlawful interference or a hijacking-related event, before returning to 7700. It is not yet publicly known who selected each code in the cockpit. The sequence nevertheless shows that both an operational emergency and a security threat were communicated to air traffic control.
A simulator recreation produced for Reuters helps illustrate the violence of the descent and the physical loads that such a profile could impose on the aircraft, passengers and crew. It does not show who was manipulating the controls at each moment and cannot replace the analysis of flight recorders, cockpit evidence and witness testimony.
Tabuk airport’s operator said air traffic control received an emergency landing request at 08:44 local time and the aircraft landed at 09:45. Both pilots were taken to hospital. Passengers were cared for in the terminal and later left Saudi Arabia on a replacement aircraft at about 17:40.
The diversion itself was unusual. FZ1073 had been bound for Israel, while Saudi Arabia and Israel do not maintain formal diplomatic relations. Saudi authorities nevertheless handled the emergency, medical response and the first stages of the investigation before the criminal inquiry shifted to the UAE.
On 2 October, after the condition of both pilots improved, Saudi authorities transferred the first officer to the United Arab Emirates. The captain also returned to the UAE for further medical care. Investigators still need to establish the exact role of everyone who was in the cockpit or intervened from the cabin, using flight data, witness statements and physical evidence.
On 3 October, the UAE Attorney General said investigators had established that the first officer had begun carrying out a “terrorist act”, attacked the captain with the cockpit crash axe and attempted to seize the flight controls. A crash axe is safety equipment normally kept on the flight deck; its presence aboard the aircraft was not unusual. The alleged use of it in the assault is what matters to the investigation.
That statement is currently the strongest official finding in the case. It still does not establish the detailed motive, the existence of accomplices, a sponsoring organisation or outside direction, nor does it settle what digital or physical evidence ultimately supports the prosecution’s case.
The first officer’s earlier career is now part of the case
Attention then turned to the first officer’s employment history. The Wall Street Journal and Associated Press reported that Oman Air had previously removed him from flying duties after security concerns emerged and reassigned him to an administrative role. The Wall Street Journal also reported an interest in extremist websites.
These remain attributed media reports rather than a detailed public finding from Oman Air or the Omani authorities. They nevertheless raise a crucial question: did actionable security information exist before the first officer joined flydubai, could it legally have been shared across employers or borders, and did flydubai know about it? There is currently no public evidence showing that flydubai was aware of the reported Oman concerns when it hired him.
Royal Air Maroc confirmed to Associated Press that the first officer underwent about three months of theoretical training in Morocco in 2025 as part of a pre-employment process, but was not ultimately hired. The airline did not disclose the reason, and there is no public evidence that he operated commercial flights for Royal Air Maroc.
Australia has also entered the inquiry. Reuters reported that Victoria’s Joint Counter Terrorism Team, involving the Australian Federal Police, Victoria Police and ASIO, is examining the first officer’s Australian connections. Separate reporting has referred to a period of study in Melbourne and possible intelligence holdings, but Reuters has said that it could not independently verify several of those claims.
A rejected application, a reassignment or a period of study does not by itself prove radicalisation or criminal intent. The key issue is whether concrete security information existed, when it existed, how reliable it was and whether it could lawfully have been shared with another employer or foreign authority.
Israel is examining how information moved through its system
Prime Minister Benjamin Netanyahu ordered a review of security arrangements for foreign civilian flights serving Israel. Associated Press reported that the UAE had sent Israeli authorities the passenger and crew manifest before departure, including names and nationalities, as part of normal aviation procedures.
That does not establish that Israeli authorities had a specific warning about the first officer. Nationality is not a security indicator by itself. The issue is whether additional information existed elsewhere, whether it was known to an employer or public authority and whether it could reach the right decision-maker before the flight.
Israel’s Tax Authority, which houses the traveller-screening centre created under a 2023 law, said it had received flydubai’s list. The Transportation Ministry said its security division did not receive the crew list and did not have access to flight lists, while also stating that flydubai had certified that required crew checks had been completed.
Earlier concerns about the division of security responsibilities have also returned to the foreground. A 2024 State Comptroller report had already criticised unclear responsibilities for oversight of foreign airlines. Internal National Security Council material reported by Israeli Army Radio also suggested that officials had previously questioned whether the Transportation Ministry had sufficient capability to perform the task in full.
These points do not yet prove fault by a specific agency. They show why FZ1073 has become more than a cockpit case: investigators are now looking at the entire chain, from recruitment to the movement of security information across airlines, regulators and national systems.
Why the case matters beyond one flight
Flydubai temporarily suspended services to and from Israel after the incident. Israeli carriers El Al, Israir and Arkia later prepared a progressive return to Dubai, subject to security approvals. The disruption was therefore airline-specific rather than a uniform closure of UAE-Israel air links.
The longer-term issue is regulatory. The case raises questions about pilot background checks, the portability of security information between employers and jurisdictions, the limits created by employment law and data-protection rules, and how an airline can assess a concern that has not resulted in a criminal conviction or a formal aviation ban.
Investigators will need to determine whether useful information existed before the first officer joined flydubai, whether it was shared, whether it could legally be shared, and whether any reasonable screening process could have identified the risk.
Three broad scenarios remain possible: actionable information existed but was not transmitted; it was transmitted but not properly used; or the threat could not reasonably have been detected by existing vetting systems. Each would lead to very different lessons for recruitment, security screening and international information-sharing.
What is established and what remains unresolved
Officially established: UAE prosecutors say the first officer assaulted the captain with the cockpit crash axe and attempted to seize the flight controls in what they describe as the beginning of a terrorist act. The aircraft suffered an extremely rapid loss of altitude, diverted to Tabuk and both pilots were injured. The passengers later left Saudi Arabia safely.
Reported by credible sources but not fully confirmed in public official findings: the earlier Oman Air concerns, the Royal Air Maroc training, the Australian links and Reuters’ reporting that planning may have begun before the first officer joined flydubai.
Still unresolved publicly: the detailed motive, whether accomplices or an external organisation were involved, exactly what former employers and authorities knew, what evidence supports each allegation and what information could legally have been shared before the flight.
The next decisive developments will come from the UAE prosecution’s final findings, any clarification from Oman or Oman Air, the Australian and Israeli reviews and any resulting changes to crew screening or international security-information sharing.
For an international aviation audience, that is now the central issue: FZ1073 is not only a story about an assault in one cockpit, but a test of whether modern recruitment, vetting and cross-border information-sharing systems can identify a serious security risk before a pilot reaches the flight deck.
Sources
UAE Attorney General and GCAA via WAM; Saudi authorities and Tabuk airport operator; Reuters, 30 September to 5 October 2026; Associated Press; Wall Street Journal; Royal Air Maroc statements.
