The investigation into Flydubai Flight FZ1073 is moving from the immediate question of how the aircraft was saved to a much broader examination of evidence, cockpit recordings, pilot histories, security screening, motive and aviation regulations. On October 3, the UAE attorney general said investigators had established that the co-pilot attacked the captain with the cockpit crash axe and attempted to take control of the aircraft, describing the incident as an attempted terrorist act. He also said the investigation was still examining the circumstances, motives, possible connections and physical and digital evidence.
That distinction matters. Authorities have now described the physical attack and its apparent objective, but important questions remain open: what prompted it, whether anyone else was involved, what the co-pilot’s previous employers and regulators knew, how his recruitment and security checks were conducted, and whether existing cockpit-security rules adequately address a threat originating inside the flight deck. The final answers are likely to come from several evidence streams rather than from any single recording or witness account.
What is already established about FZ1073
Flight FZ1073 departed Dubai for Tel Aviv on September 30, 2026. The Boeing 737 MAX 8 was carrying 174 passengers and eight crew members according to Saudi authorities, although some airline statements subsequently referred to 172 passengers and crew in total. The Saudi Interior Ministry said the aircraft landed safely at Tabuk after declaring an emergency.
The UAE’s investigation has since moved beyond describing the event simply as an altercation. According to the UAE attorney general, the co-pilot attacked the captain inside the flight deck with the aircraft’s emergency crash axe and attempted to seize the flight controls. Investigators are continuing technical examinations and analysis of physical and digital evidence.
The airline itself has continued to use more restrained language, describing the event as a security incident in the cockpit and saying that a full official investigation is underway. It has also temporarily suspended flights to Tel Aviv at the request of authorities.
That difference in terminology is worth preserving. An official prosecutor’s characterization is evidence of the direction of the criminal investigation; it is not the same thing as a completed judicial finding about every aspect of motive or responsibility.
The cockpit voice recorder may answer the most important unanswered questions
The cockpit voice recorder, or CVR, will be among the most consequential pieces of evidence if investigators can recover and authenticate the relevant recording.
Modern CVRs are designed to capture more than pilot conversations. ICAO standards specify recording of radio communications, the acoustic environment in the flight deck, crew communications through the aircraft’s interphone system and other relevant audio.
For investigators, that could establish a chronology that witness accounts cannot reliably provide. They will want to know what the pilots were saying immediately before the confrontation, whether there was an argument or unusual exchange, when the attack began, what happened to cockpit communications during the struggle, and what instructions were transmitted to air traffic control.
The recording could also help distinguish between competing accounts of the incident. Investigators can correlate cockpit audio with flight-data-recorder information, air-traffic-control communications, aircraft systems data, passenger videos, cabin-crew statements and physical evidence.
The exact recording capability on the aircraft involved will therefore matter. The United States has been moving to longer-duration cockpit recording requirements, with legislation requiring 25-hour CVRs for covered aircraft manufactured after May 16, 2025 and requiring covered aircraft to be retrofitted within six years of the 2024 law.
That does not by itself establish what FZ1073’s recorder contained or how long its relevant audio was retained. Those are matters for the investigators and aircraft records to establish.
The flight-data recorder provides the second timeline
The FDR should allow investigators to reconstruct the aircraft’s response to the cockpit struggle with considerably greater precision.
Relevant parameters can include altitude, airspeed, heading, vertical speed, flight-control inputs and other aircraft-system information. When synchronized with the CVR and air-traffic-control records, the data can show when the aircraft began its abnormal descent and how control was subsequently recovered.
The UAE’s General Civil Aviation Authority explicitly instructs operators involved in reportable occurrences to preserve CVR and FDR data and not reuse the recorders until cleared by investigators.
This preservation step is critical because flight-recorder information can be overwritten or otherwise compromised if investigators are not notified promptly. The purpose is not merely to determine what happened to the aircraft; it is also to establish the sequence of human actions and aircraft responses.
Investigators will reconstruct the event from multiple sources
The likely evidence picture is broader than the two flight recorders.
Evidence stream What investigators can establish Why it matters
Cockpit voice recorder Conversations, alarms, radio calls and cockpit sounds Reconstructs the interaction and sequence immediately before and during the attack
Flight data recorder Altitude, speed, flight path and aircraft-system parameters Establishes precisely how the aircraft responded to control inputs
ATC recordings and radar/ADS-B data Emergency calls, transponder changes, position and altitude Provides an independent external timeline
Physical evidence Crash axe, cockpit damage, injuries and biological evidence Helps reconstruct the mechanics of the confrontation
Crew and passenger testimony What people saw and heard, including the response in the cabin Fills gaps not captured by flight-deck systems
Digital evidence Devices, messages, accounts and stored material where lawfully obtained May clarify preparation, communications, motive or possible outside involvement
Employment and training records Previous employers, qualifications, assessments and reported concerns Tests whether relevant information was available before the flight
No single category should automatically be treated as decisive. Investigators normally gain confidence by finding consistent evidence across independent sources.
The co-pilot’s employment history is now central to the inquiry
One of the most consequential questions concerns the background of the accused co-pilot, identified in reporting as Omani national Hamam al-Hammami.
The Associated Press reported on October 3 that authorities said he had previously been barred from flying for Oman Air because of concerns about extremist views. That history has immediately raised questions about what information was available to subsequent employers and whether it was transmitted through appropriate aviation and security channels.
Those reports should still be treated as part of an evolving investigation. The existence, nature and documentation of any previous concerns will need to be established through employment records, regulatory files and other primary evidence.
Investigators will likely examine:
previous airline employment and reasons for departure or removal;
licensing and medical records;
training, proficiency and recurrent-check results;
disciplinary or workplace records;
security clearances and background checks;
references supplied during recruitment;
information available from previous regulators or employers;
travel and immigration records where legally relevant;
public digital activity and communications;
and any evidence indicating planning or contact with other people.
The objective is not simply to build a biography. It is to determine whether information existed before September 30 that could reasonably have altered the decision to employ, train, clear or roster the pilot.
The captain’s history matters for a different reason
The investigation will also examine Captain Smit Machchhar’s professional record, although the questions are different.
Reuters reported that Machchhar had spent more than a decade with SpiceJet before joining flydubai in 2022 and had accumulated approximately 9,750 flight hours. His previous work included senior-command and pilot-training responsibilities.
His experience is relevant to understanding the flight’s recovery, the captain’s actions during the confrontation and the qualifications of the crew involved. It does not, however, provide evidence about the co-pilot’s motives.
Investigators will also need to reconstruct the roles of the other pilots who were aboard the aircraft and helped regain control and land at Tabuk. Their qualifications, location during the incident and actions during the recovery form part of the operational timeline.
Security screening is not one single check
The most important regulatory question may be whether the system was designed to identify this particular type of threat.
Passenger security screening and flight-crew vetting are fundamentally different processes. A pilot can legitimately have access to areas and equipment that passengers cannot, possess extensive aviation privileges and undergo recurrent professional assessments while still presenting a difficult security-screening problem.
The investigation will therefore have to examine several layers separately.
Airline recruitment
Investigators can ask what Flydubai knew when it recruited the co-pilot, which records it requested and whether information from earlier employers was available.
A key question will be whether any previous concerns were formally documented in a way that should have triggered additional review.
Regulatory licensing
Pilot licensing involves professional qualifications and medical requirements, but those mechanisms should not automatically be assumed to detect ideological commitment, malicious intent or concealed criminal planning.
That distinction is particularly important because a pilot can be technically competent and still represent an insider-security risk.
Security and intelligence information
Some information relevant to security screening may sit outside ordinary airline personnel files. Investigators will therefore examine what government agencies knew, when they knew it and what information-sharing arrangements existed between countries and organizations involved.
The fact that the aircraft was UAE-registered also gives the UAE investigation a clear legal basis. The UAE attorney general said UAE judicial authorities have jurisdiction because the aircraft is registered in the country and operates under its flag.
Destination-country screening
The flight was bound for Israel, while the accused co-pilot was reported to be Omani. That has generated additional scrutiny because Oman and Israel do not have diplomatic relations.
But the relevant question is not simply why an Omani national was assigned to an Israel-bound flight. Investigators need to establish what the applicable rules actually required, which authority was responsible for each check, what information was exchanged and whether any restriction applied to this particular crew member.
That is a much more precise question than assuming that the pilot’s nationality itself constituted a security violation.
Motive remains a separate evidentiary question
The UAE attorney general has now said the investigation established an attempted terrorist act, but authorities are still examining the suspect’s motives and possible connections.
That leaves several possibilities for investigators to test rather than assume.
They will want to establish whether the attack was:
- independently planned by the co-pilot;
- motivated by an extremist ideology;
- connected to another individual or organization;
- influenced by personal circumstances;
- intended to seize the aircraft for a particular purpose; or
- part of a broader plan.
Public statements by political leaders and intelligence officials can provide investigative leads, but they are not substitutes for evidence. The final assessment will depend on documents, communications, financial or travel records where relevant, witness testimony, forensic findings and the aircraft’s own data.
The distinction is especially important because investigators are simultaneously examining motive and possible direction. The UAE attorney general specifically said the inquiry would establish the circumstances, motives and links associated with the incident.
Cockpit security presents an unusually difficult problem
Modern cockpit security was largely designed around keeping unauthorized people out of the flight deck.
After the September 11 attacks, reinforced cockpit doors and access-control procedures became central components of commercial aviation security. The system works exceptionally well against an attacker attempting to enter the cockpit from the cabin.
An attack by an authorized flight-crew member creates the opposite problem.
The person already inside possesses legitimate access, knows the aircraft and procedures, and may understand precisely how the cockpit security system works. Reinforcing the door further does little to prevent an insider attack.
The FZ1073 incident therefore raises a difficult design question: how can an airline preserve cockpit isolation from external attackers while ensuring that the remaining crew and cabin have an effective response to a violent person already inside?
That issue has precedents. Aviation regulators and investigators have previously examined the consequences of pilots becoming incapacitated or deliberately preventing another pilot from entering the cockpit. The post-9/11 security architecture was optimized around one class of threat; the current incident highlights another.
What regulators may review after the investigation
A regulatory review would not necessarily mean that existing cockpit rules were fundamentally wrong. It could instead focus on whether specific procedures should be strengthened for insider threats.
Potential areas include:
Continuous rather than one-time vetting
Traditional background checks can become outdated. A pilot’s circumstances, affiliations or conduct can change after hiring.
The question for regulators is whether more continuous monitoring can be implemented without turning routine aviation employment into an intrusive surveillance system.
Information-sharing between airlines
If a pilot leaves one carrier following a security-related concern, regulators may need to examine what information can and should legally follow that pilot to another employer.
This involves a difficult balance between aviation security, employment rights, privacy and due process.
Mental-health and medical screening
The industry has long debated how effectively medical assessments can identify rare risks such as deliberate self-harm or violence. The challenge is particularly acute because excessive or poorly designed screening can discourage pilots from reporting genuine health problems.
The investigation should therefore distinguish medical fitness from malicious intent. One cannot automatically be inferred from the other.
Emergency cockpit access
Investigators will closely examine how the cockpit door was opened during FZ1073 and whether the existing emergency-access procedure performed as intended.
The fact that the injured captain was able to facilitate access from inside the flight deck will be particularly important to the reconstruction. Investigators can assess whether this was a normal operation of the system, an exceptional action or a consequence of the specific circumstances.
Cabin response to cockpit threats
The incident also demonstrated the importance of coordination between flight crew, cabin crew and passengers. Regulators may examine whether existing training sufficiently addresses a violent insider threat without encouraging passengers or cabin crew to undertake dangerous interventions.
Any resulting change would need to account for the fact that an uncontrolled struggle inside a cockpit can itself create major risks to aircraft control.
The physical evidence could resolve competing accounts
The crash axe, cockpit damage, injuries and other physical evidence should help investigators establish exactly how the confrontation unfolded.
Forensic analysis can potentially determine the sequence of injuries, locations of impact and whether accounts from witnesses are consistent with the physical scene.
Digital evidence could be equally important. Investigators may examine phones, computers, messaging accounts or other devices where legally authorized, looking for evidence of preparation, communications, ideological motivation or instructions.
But investigators will have to distinguish between material that is genuinely connected to the attack and material that is merely disturbing, controversial or unrelated. Finding extremist content on a device, for example, would not by itself prove operational direction by an extremist organization.
That is why the UAE prosecutor’s reference to both physical and digital evidence is significant: the investigation is evidently not being limited to the cockpit itself.
The international investigation matters as much as the airline inquiry
FZ1073 crossed several jurisdictions and involved multiple national interests. The aircraft was UAE-registered, departed from Dubai, was heading to Israel and diverted to Saudi Arabia. The crew and passengers also came from multiple countries.
The UAE has established a prosecution-led investigation working with its General Civil Aviation Authority and other relevant authorities.
The UAE’s aviation-investigation framework also provides for participation in investigations conducted by other states when a UAE-registered aircraft is involved. Its stated purpose is to determine causes and contributing factors and issue safety recommendations to prevent recurrence.
This creates two related but distinct investigative tracks: the criminal/security inquiry, which seeks to establish responsibility, motive and possible terrorist connections, and the aviation-safety inquiry, which seeks to understand the operational chain and identify measures that could prevent a recurrence.
Keeping those purposes separate is important. A safety investigation is not simply a criminal investigation with different terminology.
What investigators still need to establish
As of October 4, several questions remain materially unresolved.
First, the complete motive has not been publicly established. The UAE has characterized the conduct as an attempted terrorist act, but the investigation is still examining motive and connections.
Second, the extent of any advance planning remains under investigation. The attorney general said the co-pilot began executing a plan during the flight, but the broader question of when, why and with whom any plan was developed remains open.
Third, the effectiveness of previous vetting has not yet been publicly demonstrated. Reports of earlier concerns about the co-pilot’s suitability for flying make the question important, but investigators still need to establish what was formally recorded, who had access to it and what Flydubai or relevant authorities knew.
Fourth, the precise cockpit sequence has yet to be independently reconstructed. Witness accounts, video, flight-tracking information and official statements provide pieces of the story, but the recorder data and forensic evidence should be central to the final reconstruction.
The regulatory question is bigger than one airline
The most consequential outcome of the FZ1073 investigation may not be a new cockpit door or a new passenger-screening rule. It may be a reassessment of how aviation treats the insider threat.
Commercial aviation has developed exceptionally sophisticated systems for preventing unauthorized people from entering secure areas. The harder problem is a person who already has authorization, training and access.
That does not mean every pilot should be treated as a security suspect. Aviation depends on trust, professional autonomy and rapid decision-making. A system that responds to an extremely rare insider threat by undermining those fundamentals could introduce different risks.
The more useful regulatory question is therefore narrower: can airlines and governments identify credible warning signs earlier, share relevant information lawfully, and give crews an effective response when a threat originates inside the cockpit?
The answer will depend on evidence from FZ1073 rather than assumptions drawn from the headlines. The cockpit recordings, flight data, personnel records, security files, digital evidence and forensic reconstruction should show whether this was primarily a failure of individual screening, information-sharing, cockpit procedures, or some combination of factors.
That is the finding worth watching when the investigation moves from the extraordinary events of September 30 to its final technical and regulatory conclusions.