Abstract

On 30 September 2026, the first officer of flydubai flight FZ1073 (Dubai–Tel Aviv), Hamam al-Hammami, attempted to seize control of the aircraft after attacking the captain; according to the authorities of the United Arab Emirates, he planned to crash it at Ben Gurion Airport. This article examines the incident as a case study for a broader question: to what extent can technologies based on artificial intelligence (AI) and large language models (LLMs) support a shift from a security approach focused on detecting means (weapons, explosives) to one focused on detecting hostile intent. Four families of capabilities are reviewed: advertising-based intelligence (ADINT) collected without intrusion into devices, real-time support for hostage negotiation, large-scale automated profiling, and contactless tests for detecting hostile intent among aircrew. Alongside the operational potential, the article discusses the scientific limitations (low base rates, the limited validity of deception-detection methods, and the risk of false positives) and the legal and ethical framework, including the prohibitions set out in the European Union’s Artificial Intelligence Act. The central argument is that the operational lesson of the September 11 attacks – that malicious intent, rather than means, is the decisive risk variable – has not yet been fully internalized in aviation security, and that AI-based tools can narrow this gap, subject to empirical validation and appropriate legal oversight.

Keywords: artificial intelligence; aviation security; insider threat; hostile-intent detection; profiling; advertising intelligence (ADINT); privacy

1. Introduction

Since large language models entered widespread use, the full extent of AI’s influence on security and intelligence has yet to be defined. The notion of “preventing crime before it happens,” popularized by the film Minority Report [1], has found practical – if limited and contested – expression in predictive policing methods [2]. Intelligence organizations have used automated data analysis for decades; however, contemporary LLMs and AI systems substantially expand the volume of information that can be processed, the speed of processing, and the level of abstraction at which inferences can be drawn.

The incident aboard flydubai flight FZ1073 provides an extreme and timely illustration of the importance of such capabilities. According to reports, the first officer attacked the captain, Smit Machchhar, with the cockpit crash axe and attempted to take control of the aircraft; passengers and crew forced their way into the cockpit and overpowered him, and two relief pilots who were on board landed the aircraft safely in Tabuk, Saudi Arabia [3]. The UAE Attorney General stated that the first officer had planned to crash the aircraft at Ben Gurion Airport, admitted that he had been inspired by the September 11 attacks, and had chosen a career in civil aviation with the intention of carrying out a similar attack [4]. According to further reports, he intended to continue the flight as normal, obtain approach clearance to Ben Gurion, and crash the aircraft into a building or another aircraft [5]. This article asks whether, and to what extent, AI-based technologies could have disrupted this plan at an early stage.

2. Advertising Intelligence (ADINT): Tracking and Identifying Targets Without Device Intrusion

Spyware that penetrates and persists on computers and mobile phones – most notably tools developed by offensive cyber companies – has drawn severe public and legal criticism following revelations of its use against journalists and human rights activists [6, 7]. In 2021 the U.S. Department of Commerce added NSO Group to its Entity List [8]. Against this background, intelligence agencies have shown growing interest in collection tools that do not penetrate the device and leave no trace on it, yet still enable a degree of tracking of intelligence targets.

The principal answer to this need is advertising intelligence (ADINT): the use of digital advertising infrastructure, and the data collected and traded within it, for intelligence purposes. In the online advertising ecosystem, and particularly in real-time bidding (RTB), every ad impression is accompanied by a broadcast of data about the device and its user – the device’s advertising identifier, geolocation, IP address, the app in use and behavioral attributes – to numerous parties in the chain. These data are aggregated and sold by data brokers, and can be purchased or analyzed without any access to the device itself. A report submitted to the U.S. Director of National Intelligence concluded that commercially available information (CAI) of this kind now makes it possible, at unprecedented scale and granularity, to identify individuals, track their movements and infer their characteristics [9]. The academic study that coined the term ADINT demonstrated that an actor with a modest budget can exploit targeted-advertising systems to locate a specific individual and track their app usage without leaving any trace on their device [10]. Unlike intrusion tools, ADINT requires no exploitation of vulnerabilities, no code installation and no physical access, and is therefore not exposed to detection through forensic examination of the device.

Beyond location tracking, advertising data are also used for psychological characterization. A series of studies has shown that digital footprints – such as Facebook “likes” – allow accurate prediction of personality traits and sensitive attributes [11], at times with greater accuracy than judgments made by acquaintances [12], and that such information is used in practice to influence consumer behavior in a targeted manner [13]. It follows that the same capabilities advertisers use to characterize and track audiences could be used by states to track intelligence targets and identify potential threats – including early signs of radicalization – although their use raises weighty legal questions (see Section 7).

3. Support for Hostage Negotiation

Crisis and hostage negotiation relies on structured models of communication, such as the Behavioral Change Stairway Model (BCSM) [14], and on analysis of the dynamics of the conversation over time [15]. Commercial AI-based tools can now support this process in real time, including through: automatic speech transcription and translation (speech-to-text), which achieves high accuracy even in noisy conditions and across many languages [16]; profiling analysis of the parties; assessment of the speaker’s functional state; continuous monitoring of the state of the conversation, including alerts on escalation; and recommendations for strategic adjustment and alternative courses of action. Research in natural language processing has shown that learning systems can acquire negotiation strategies from dialogue [17]; it should be noted, however, that the research literature on the effectiveness of such tools against actual terrorists remains limited.

4. Automated Profiling and the Detection of “Lone Wolves”

Large language models make automated profiling of thousands or tens of thousands of individuals feasible. Recent research has shown that an LLM can infer the personality traits of social media users from the texts they have posted, without task-specific training, with accuracy comparable to that of dedicated machine-learning models [18]. Earlier studies identified linguistic markers associated with radical violence on social media [19], and research on lone-actor terrorists has shown that in many cases the attack was preceded by observable statements and behaviors – including leakage of intent to others [20]. These findings provide a theoretical basis for attempting to identify a potential “lone wolf” before he acts, and for constructing a “high-risk profile” even for tourists or individuals living in other countries.

Nevertheless, individual risk assessment for terrorism is methodologically constrained by the extremely low base rate of the phenomenon, which causes even fairly accurate classifiers to generate a large number of false alarms [21]. Privacy is, of course, a substantive concern; it may nonetheless be argued that those who publish information about themselves on social networks expose it, knowingly or not, not only to advertisers’ machine learning but also to intelligence agencies.

5. Detecting Intent Versus Detecting Means

One of the central lessons of the September 11 attacks is that a passenger with malicious intent does not need a significant weapon – such as a firearm or an improvised explosive device (IED) – to carry out a lethal attack: the hijackers used small knives and the aircraft themselves [22]. Even so, most airports and airlines continue to focus on screening baggage and passengers for means, rather than for intent. The FZ1073 incident reiterates this lesson in even sharper form: the attacker needed no smuggled item at all, but used the emergency equipment already in the cockpit [3, 4].

Moreover, the incident illustrates that aircrew, and pilots in particular, may pose a threat no less serious than passengers – and perhaps more so – because of their direct access to the aircraft’s controls. A review of suicide and murder-suicide involving aircraft documented dozens of cases in general and commercial aviation [23], including well-known commercial aviation events such as the crash of Germanwings flight 9525 in 2015 [24] and EgyptAir flight 990 in 1999 [25]. Some aircraft have disappeared without leaving significant trace, such as MH370; although pilot involvement has been hypothesized, the cause of that event has not been officially determined [26].

Beyond intelligence collection on aircrew, AI-based tests exist for detecting malicious intent among crew members prior to flight. Earlier systems for behavioral analysis and hostile-intent detection relied mostly on contact-based psychophysiological sensors, such as galvanic skin response (GSR) [27, 28]. In recent years, end users of insider-threat screening systems [29] have shown increasing interest in contactless tests, which draw on technologies such as remote photoplethysmography (rPPG) [30] and automated interviewing kiosks that integrate behavioral sensors [31]. Industry experience indicates that several requests for information (RFIs) on contactless intent detection have been issued in recent years; however, the main barrier is not technological, but relates to privacy and to concern that the public and aviation labor unions will perceive the screening as intrusive – even when it is contactless. It should be noted that after the Germanwings disaster the European Union required operators to introduce peer-support programmes and alcohol and drug testing for aircrew [32]; the field is therefore not unregulated, but existing regulation focuses on mental well-being rather than on detecting hostile intent.

6. Case Study: How the FZ1073 Attack Could Have Been Disrupted

The following conceptual model of combined AI capabilities makes it possible to examine whether the incident could have been prevented:

Intelligence collection and risk-profile construction

• Monitoring the global pilot population through ADINT – advertising data and commercially available information – and open sources, including social networks [9, 10].
• Building a personality profile and a dynamic risk profile for every aircrew member, including a risk rating relative to the reference threat [11, 18].
• Continuous, real-time updating of the profile.
• Detecting signs of radicalization, visits to hostile states, or anomalous rostering onto flights to Israel – all without intruding into the crew member’s mobile device.

Intent detection

• A pre-flight hostile-intent test delivered through a mobile application. A test of approximately three minutes produces a list of crew members who warrant additional background checks before being cleared to fly.

The likelihood that al-Hammami would have been flagged by a network of such systems appears high. According to reports, images with terrorist content were found on his social media accounts [33]; Omani authorities had previously barred him from flying over concerns about extremist views, and he had been removed from flight training for similar reasons [3]; according to the UAE Attorney General, he had been exposed to extremist material online since 2017 and had operated two earlier flights to Tel Aviv in order to familiarize himself with the route and the airport [4]. These findings indicate that warning signs existed but were not shared or integrated into a unified risk picture – precisely the gap that AI systems are designed to close. Furthermore, the mere knowledge that pilots and crew members are monitored by such systems may reduce the probability of attacks of this kind, consistent with the deterrence literature, which emphasizes the effect of the certainty of detection [34].

7. Limitations and Ethical and Legal Considerations

A balanced treatment of the subject requires addressing several limitations. First, the scientific validity of methods for detecting intent and deception cannot be taken for granted: a report by the U.S. Government Accountability Office (GAO) found that the TSA’s behavior detection program had not been shown to be effective and recommended limiting its funding [35]; the U.S. National Research Council identified substantial limitations in the validity of the polygraph [27]; and research reviews have shown that nonverbal cues are weak predictors of deception [36, 37]. Any AI-based system in this field therefore requires independent empirical validation, reporting of error rates, and the integration of human judgment. Second, as noted above, the low base rate of this threat means that even an accurate system will generate a large number of false positives [21], with the attendant occupational and personal consequences.

Third, the legal framework restricts some of the capabilities described. The European Union’s Artificial Intelligence Act prohibits, subject to exceptions, the use of emotion-recognition systems in the workplace, as well as assessing the risk of a person committing a criminal offence based solely on profiling [38]; and the General Data Protection Regulation (GDPR) restricts decisions based solely on automated processing that significantly affect individuals [39]. Deploying such tools with respect to aircrew would therefore require a dedicated legal basis, oversight mechanisms, and assurance that the final decision is made by a human being.

8. Conclusion

The FZ1073 incident highlights the gap between a security paradigm based on detecting means and the actual threat, which stems from intent. AI-based technologies – advertising intelligence (ADINT), automated profiling and contactless hostile-intent tests – offer tools for narrowing this gap, particularly with respect to aircrew, a population that has so far received relatively little attention in this context. At the same time, privacy concerns, the position of labor unions and legal constraints may prevent or delay the use of these tools, and their scientific validity requires empirical demonstration. This sharpens one of the central tensions of the present era: privacy and control over personal information versus security.

References

[1]     Spielberg, S. (Director). (2002). Minority Report [Film]. 20th Century Fox; DreamWorks Pictures. (Based on P. K. Dick, “The Minority Report,” 1956.)

[2]     Perry, W. L., McInnis, B., Price, C. C., Smith, S. C., & Hollywood, J. S. (2013). Predictive policing: The role of crime forecasting in law enforcement operations (RR-233). RAND Corporation.

[3]     Al Jazeera. (2026, October 3). Who is the mystery co-pilot behind the Flydubai attack? https://www.aljazeera.com/news/2026/10/3/who-is-the-mystery-co-pilot-behind-the-flydubai-attack

[4]     Israel National News. (2026, October 9). UAE: Flydubai co-pilot planned 9/11-style attack on Ben Gurion Airport. https://www.israelnationalnews.com/news/434369

[5]     Fox News. (2026, October 5). FlyDubai co-pilot allegedly planned to crash Israel-bound jet at Ben Gurion Airport. https://www.foxnews.com/world/flydubai-copilot-allegedly-planned-crash-israel-bound-jet-ben-gurion-airport

[6]     Marczak, B., Scott-Railton, J., McKune, S., Abdul Razzak, B., & Deibert, R. (2018). Hide and seek: Tracking NSO Group’s Pegasus spyware to operations in 45 countries (Citizen Lab Research Report No. 113). University of Toronto.

[7]     Amnesty International. (2021). Forensic methodology report: How to catch NSO Group’s Pegasus (DOC 10/4487/2021).

[8]     U.S. Department of Commerce, Bureau of Industry and Security. (2021, November 3). Addition of certain entities to the Entity List. Federal Register, 86, 60759.

[9]     Office of the Director of National Intelligence. (2022). Senior Advisory Group panel on commercially available information: Report to the Director of National Intelligence (declassified June 2023).

[10]    Vines, P., Roesner, F., & Kohno, T. (2017). Exploring ADINT: Using ad targeting for surveillance on a budget — or — how Alice can buy ads to track Bob. Proceedings of the 2017 Workshop on Privacy in the Electronic Society (WPES ’17), 153–164.

[11]    Kosinski, M., Stillwell, D., & Graepel, T. (2013). Private traits and attributes are predictable from digital records of human behavior. Proceedings of the National Academy of Sciences, 110(15), 5802–5805.

[12]    Youyou, W., Kosinski, M., & Stillwell, D. (2015). Computer-based personality judgments are more accurate than those made by humans. Proceedings of the National Academy of Sciences, 112(4), 1036–1040.

[13]    Matz, S. C., Kosinski, M., Nave, G., & Stillwell, D. J. (2017). Psychological targeting as an effective approach to digital mass persuasion. Proceedings of the National Academy of Sciences, 114(48), 12714–12719.

[14]    Vecchi, G. M., Van Hasselt, V. B., & Romano, S. J. (2005). Crisis (hostage) negotiation: Current strategies and issues in high-risk conflict resolution. Aggression and Violent Behavior, 10(5), 533–551.

[15]    Taylor, P. J. (2002). A cylindrical model of communication behavior in crisis negotiations. Human Communication Research, 28(1), 7–48.

[16]    Radford, A., Kim, J. W., Xu, T., Brockman, G., McLeavey, C., & Sutskever, I. (2023). Robust speech recognition via large-scale weak supervision. Proceedings of the 40th International Conference on Machine Learning (ICML), PMLR 202, 28492–28518.

[17]    Lewis, M., Yarats, D., Dauphin, Y. N., Parikh, D., & Batra, D. (2017). Deal or no deal? End-to-end learning for negotiation dialogues. Proceedings of EMNLP 2017, 2443–2453.

[18]    Peters, H., & Matz, S. C. (2024). Large language models can infer psychological dispositions of social media users. PNAS Nexus, 3(6), pgae231.

[19]    Cohen, K., Johansson, F., Kaati, L., & Mork, J. C. (2014). Detecting linguistic markers for radical violence in social media. Terrorism and Political Violence, 26(1), 246–256.

[20]    Gill, P., Horgan, J., & Deckert, P. (2014). Bombing alone: Tracing the motivations and antecedent behaviors of lone-actor terrorists. Journal of Forensic Sciences, 59(2), 425–435.

[21]    Monahan, J. (2012). The individual risk assessment of terrorism. Psychology, Public Policy, and Law, 18(2), 167–205.

[22]    National Commission on Terrorist Attacks upon the United States. (2004). The 9/11 Commission report. W. W. Norton.

[23]    Kenedi, C., Friedman, S. H., Watson, D., & Preitner, C. (2016). Suicide and murder-suicide involving aircraft. Aerospace Medicine and Human Performance, 87(4), 388–396.

[24]    Bureau d’Enquêtes et d’Analyses (BEA). (2016). Final report: Accident on 24 March 2015 at Prads-Haute-Bléone, Airbus A320-211, D-AIPX, operated by Germanwings.

[25]    National Transportation Safety Board. (2002). Aircraft accident brief: EgyptAir Flight 990, Boeing 767-366ER, SU-GAP (NTSB/AAB-02/01).

[26]    Australian Transport Safety Bureau. (2017). The operational search for MH370 (AE-2014-054).

[27]    National Research Council. (2003). The polygraph and lie detection. The National Academies Press.

[28]    Boucsein, W. (2012). Electrodermal activity (2nd ed.). Springer.

[29]    Cappelli, D. M., Moore, A. P., & Trzeciak, R. F. (2012). The CERT guide to insider threats. Addison-Wesley.

[30]    Verkruysse, W., Svaasand, L. O., & Nelson, J. S. (2008). Remote plethysmographic imaging using ambient light. Optics Express, 16(26), 21434–21445.

[31]    Nunamaker, J. F., Jr., Derrick, D. C., Elkins, A. C., Burgoon, J. K., & Patton, M. W. (2011). Embodied conversational agent-based kiosk for automated interviewing. Journal of Management Information Systems, 28(1), 17–48.

[32]    European Union. (2018). Commission Regulation (EU) 2018/1042 of 23 July 2018 amending Regulation (EU) No 965/2012 (support programmes, psychological assessment of flight crew, and testing for psychoactive substances). Official Journal of the European Union, L 188.

[33]    CNN. (2026, October 2). Terrorist images found on Flydubai suspect’s social media. https://www.cnn.com/2026/10/02/world/flydubai-attacker-pilot-intl

[34]    Nagin, D. S. (2013). Deterrence in the twenty-first century. Crime and Justice, 42(1), 199–263.

[35]    U.S. Government Accountability Office. (2013). Aviation security: TSA should limit future funding for behavior detection activities (GAO-14-159).

[36]    Vrij, A., Granhag, P. A., & Porter, S. (2010). Pitfalls and opportunities in nonverbal and verbal lie detection. Psychological Science in the Public Interest, 11(3), 89–121.

[37]    Denault, V., Plusquellec, P., Jupe, L. M., St-Yves, M., Dunbar, N. E., Hartwig, M., et al. (2020). The analysis of nonverbal communication: The dangers of pseudoscience in security and justice contexts. Anuario de Psicología Jurídica, 30, 1–12.

[38]    European Union. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 5(1)(d) and 5(1)(f). Official Journal of the European Union, L series.

[39]    European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Article 22. Official Journal of the European Union, L 119.