Early on Wednesday morning, a passenger jet carrying 174 people, most of them Israeli, plunged thousands of feet in a matter of minutes after Flydubai flight FZ1073, bound for Tel Aviv, sent out an emergency signal. In the cockpit, one pilot had reportedly been stabbed, prompting Israeli fighter jets to scramble. The aircraft eventually landed safely in Saudi Arabia – an outcome that, by most accounts, owed much to the injured captain, the passengers who intervened and the off-duty pilots who helped bring it down.
It is too early to know exactly what happened or why. One detail, however, already demands attention: the alleged attacker was not a passenger, but one of the pilots.
The facts are still emerging. Whether the incident involved terrorism, a hostile state or a personal crisis is a matter for the security services and police in several countries. Israel's prime minister has said it is too early to know whether Iran played any part, while the airline has urged against speculation. What is already clear is that a pilot allegedly turned on his captain – and the implications for air safety do not depend on the motive.
To understand why that matters, consider the logic behind modern cockpit security. It was forged by the events of a single morning. On September 11, 2001, hijackers armed with knives and box cutters forced their way into cockpits protected by little more than flimsy doors. Within a few years, aviation authorities around the world required reinforced doors designed to resist forced entry and even gunfire. Procedures changed as well: cockpit doors now remain locked in flight, and pilots are trained not to open them, whatever may be happening in the cabin.
Those measures worked and hijackings of that kind have all but disappeared. Yet the system rests on a hidden assumption; that everyone inside the cockpit is a defender, while everyone outside is a potential threat.
The danger of that assumption was evident long before this week. In November 2013, the captain of a Mozambique Airlines flight from Maputo to Luanda was left alone on the flight deck when his first officer went to the lavatory. Investigators concluded that he deliberately used the autopilot to send the aircraft into the ground in Namibia, killing all 33 people on board.
Two years later, a second case drew worldwide attention. In March 2015, Germanwings co-pilot Andreas Lubitz waited until the captain left the flight deck, locked himself in and flew Flight 9525 into a French mountainside, killing all 150 people on board. The captain could not regain entry. A feature designed to protect the aircraft had been turned against it.
Such cases are mercifully rare: tens of millions of flights land safely each year. But the consequences are catastrophic, and the best-established examples expose the same vulnerability – a locked door with one person behind it.
After Germanwings, many airlines adopted a rule requiring two crew members to remain in the cockpit at all times, though some later abandoned it. That safeguard would not have helped here: both pilots were already present, and the rescue instead came from outside the cockpit.
Whatever the investigation ultimately finds, lessons from this incident, and from those before it are already clear. Four things should change.
First, crew should be vetted and screened as rigorously as passengers. Israel's prime minister's office says it will establish the identity of every pilot flying into the country, whether on an Israeli or foreign carrier, and carry out security checks. Other countries should ask whether their own arrangements would withstand the same scrutiny. A background check at the point of hiring is only a snapshot; sensitive routes require continuing assessment and careful rostering.
Second, scrutiny must continue after hiring. Airlines should take colleagues' concerns seriously, protect those who raise them and act before a problem becomes a crisis.
Third, mental health must form part of the response, but it must be handled with care. Nothing so far suggests that it played a part here, and most pilots who struggle pose no danger to anyone. Germanwings did, however, demonstrate the risks when a pilot conceals a problem from an employer. Airlines should provide confidential peer support, clear routes to treatment that do not automatically end a career, and checks that extend beyond a medical certificate.
Fourth, airlines need a plan for an attack from within the cockpit. On this flight, witnesses say the wounded captain managed to open the door, passengers fought the attacker, and off-duty pilots landed the aircraft. That combination of courage and luck cannot itself be the plan. Crews need clear procedures – and a way for the right people to gain access to the cockpit without making it easier for the wrong people to do so.
Twenty-five years ago, the industry learned to secure the cockpit against a threat from the cabin. It must now recognise that the person inside matters just as much and build a safety system that relies neither on luck nor on the bravery of a wounded captain.
Roger Macmillan is a counter-terrorism and security specialist and former director of security at Iran International TV
To get more from opinion, click here to sign up for our free Editor's Picks newsletter.