Bomb Threats Disrupt 21 Flights Across Europe: How Hoaxes Paralyzed Airports?

The passengers on Aer Lingus Flight EI402 had booked Dublin to Rome. They ended up in a gymnasium at a French military base.

Their plane had been diverted to Évreux on Thursday, 5 November, after a bomb threat. French fighter jets escorted it in. Gendarmes checked the passengers and buses took them to the gym while the aircraft was searched. The regional prosecutor said no bomb was found.

Another plane headed for Rome that morning, Finnair Flight AY1761 from Helsinki, also got a fighter escort. It landed where it was supposed to. At Heathrow and Birmingham, the threats were judged not credible and operations continued. BBC News counted at least 21 aircraft and several airports targeted on Thursday, in the second wave of threats that week. No explosives had been found in the reported searches.

How can a threat empty one plane, put fighters beside another and leave a third airport running? It comes down to who gets the warning, what they can verify and where the aircraft is when the message arrives.

What happens when the threat comes in?

Someone has to decide how much weight to give it, sometimes while the plane is already in the air.

A warning can go to an airline, an airport or the authorities. It can come by phone or email. In Rome, the airport operator confirmed that the threats against the two inbound flights came by email. Prague airport also reported receiving an anonymous email. The people who received those messages had to get the warning to the teams responsible for assessing it.

The British Airline Pilots’ Association says airline security staff assess the information first. If they judge the threat credible, they alert the crew, who follow the airline’s emergency checklist. The captain then has to make decisions about the aircraft’s safety while controllers and authorities on the ground coordinate the response. Heathrow said several agencies took part in its assessment before the warning was judged not credible. That assessment is what allowed the airport to carry on.

Why did one Rome flight divert while the other carried on?

A diversion needs somewhere suitable to land. Think about the questions facing the crew and controllers. How far away is the airport? Can it take this aircraft? Can emergency teams meet it there? Where can passengers get off while specialists check the plane? A runway that happens to be close can be a poor choice if the airport cannot handle what follows.

The European rules of the air give the captain final authority over the aircraft’s disposition. They also provide for a landing at an airport designated by the competent authority in cases of unlawful interference, subject to conditions aboard the aircraft. The safety decision in the cockpit and the instructions from the ground can meet in a difficult moment.

Évreux shows how difficult. The French prime minister’s office said it ordered fighter jets to intercept and escort the Aer Lingus plane after the pilot did not cooperate as authorities expected. The regional prosecutor said the pilot had allegedly preferred to land at a civilian airport. Aer Lingus confirmed the diversion as a security precaution. The prosecutor’s account leaves open what the crew heard and why it preferred another landing site.

The Finnair flight continued to Rome under military escort and was checked after landing. The airline confirmed the threat was false. An escort and a diversion are two separate decisions. Aer Lingus received both. Finnair received an escort and kept its destination.

How does a threat to one flight shut an airport?

Look at what happened two days earlier. On 3 November, a LOT flight from London was due at Warsaw’s main Chopin Airport. It was sent to nearby Modlin instead. Modlin closed while the plane was searched, then reopened after no device was found. So a warning concerning one flight affected an airport that had never been on that flight’s itinerary.

A threat can also catch a plane before it moves. On Thursday, Air Europa said its Madrid-to-Paris flight was still on the ground when a warning came in. Passengers got off, the aircraft was checked, and they boarded again once it was cleared. In Prague, police met incoming easyJet flights from Newcastle and Glasgow. These responses disrupt different parts of the journey. A search can hold one aircraft. A closure can interrupt flights that have nothing to do with the original warning.

And reopening the runway is only one step. The aircraft may be in the wrong city for its next flight. A crew delayed for hours may run up against its duty limits. Passengers may have missed connections or need to be rebooked. The checks can be finished while the airline is still trying to get everyone, and its aircraft, where they were meant to be.

Who sent the threats?

The public evidence so far is a signature on some of the messages. It hasn’t established who was behind them.

An email concerning the Rome-bound flights used the name “Fighters of the Male State”, according to reporting confirmed by Rome’s airport operator. AFP saw threats sent to airports in Rome and Sofia that used the same name. That is a lead for investigators. A name typed at the bottom of an email is easy to copy. The sender’s identity, and whether the warnings sent to different airports came from the same people, remain open questions.

Investigators will want the original messages and their delivery records, as well as the sequence in which airports and airlines received them. The timing can help establish whether one message was sent to multiple places or whether separate threats followed. That matters because an operation coordinated across borders and a string of copycat threats can look much the same to passengers watching departures disappear from a board.

What would happen to a flight in India?

The Civil Aviation Ministry told Parliament that every Indian airport has a designated Bomb Threat Assessment Committee. Its job is to assess the warning and determine the response under the airport’s contingency plan. The ministry said it had set up virtual meetings to cut the time needed to assemble the committee to under five minutes. It recorded 999 hoax bomb threats from January to 14 November 2024. That counts messages and calls, so it cannot be read as a tally of grounded flights.

One Air India flight shows how far the disruption can travel. On 15 October 2024, Flight AI127 from Delhi to Chicago diverted to Iqaluit, in Canada’s Arctic, after a bomb threat. Local authorities had to handle the security response and care for stranded passengers while keeping scheduled airport operations moving. The Canadian Armed Forces flew passengers onward to Chicago. The diversion solved the immediate problem of getting the aircraft on the ground. Getting everyone to their destination became a separate operation.

What happens next?

There are two things to watch. The first is whether investigators can connect the messages sent to different airports to an identifiable sender. The second is what French investigators establish about Flight EI402, including what the crew was told and why it ended up at a military base.

Those answers matter for the next warning. Police need enough evidence to find the sender. The people responsible for an aircraft need enough information to decide where it can safely land. They may have only minutes to make that decision.