The central facts of the Flydubai FZ1073 attack are now considerably clearer than they were immediately after the September 30 emergency landing. UAE authorities say the co-pilot attacked Captain Smit Machchhar inside the cockpit with a crash axe and attempted to take control of the aircraft. The captain managed to unlock the cockpit door, allowing others to intervene, while two additional pilots aboard the aircraft helped regain control before the Boeing 737 MAX 8 landed safely in Tabuk, Saudi Arabia.
But the most consequential questions remain open. Investigators are still establishing the co-pilot’s motive, whether anyone else knew about or encouraged the plan, what information was available about his background before he joined Flydubai, exactly how the cockpit struggle unfolded, and whether existing aviation-security systems failed to identify a credible insider threat. The UAE attorney general has specifically said investigators are examining the circumstances, motives, possible links, and physical and digital evidence.
What is confirmed — and what is not
The investigation has developed in stages, which makes it important not to treat every statement made during the first hours of the incident as equally authoritative.
Saudi authorities initially described an altercation in which the co-pilot assaulted the captain. The UAE subsequently provided a more specific account, saying the co-pilot used a crash axe and attempted to take control of the aircraft. That is now the clearest official account of the physical attack.
The aircraft landed safely after the confrontation. Passengers and crew intervened, and additional pilots travelling aboard the aircraft helped stabilize it. The captain was seriously injured but survived.
What remains different is the evidentiary status of claims about why the attack occurred.
The UAE attorney general has characterized the incident as an attempted terrorist act, but his statement also makes clear that investigators are still determining the full circumstances, motives and connections. In other words, the official classification of the conduct has advanced further than the public explanation of the underlying motive.
That distinction should remain at the center of coverage.
1. Why did the co-pilot attack the captain?
This is probably the most important unresolved question.
Authorities have established the nature of the physical confrontation, but publicly available evidence does not yet provide a complete explanation of the co-pilot’s thinking or objectives.
Some political figures have described the incident as an extremist or jihadist attack. Other reports have cited alleged concerns about the co-pilot’s previous employment history. Those reports are potentially important investigative leads, but they should not be treated as a completed finding about motive.
The UAE investigation itself says motive remains under examination.
That means investigators will need to distinguish among several possibilities:
- an ideologically motivated attack;
- a deliberately planned attempt to crash or seize the aircraft;
- an attack connected to another person or organization;
- a personal grievance or crisis;
- or another motive that has not yet emerged publicly.
The evidence could come from communications, digital devices, employment records, interviews, financial or travel information, and the suspect’s own statements.
Until those sources are assessed together, assigning a definitive motive would go beyond the available evidence.
2. Was there a wider conspiracy?
The question of whether the co-pilot acted alone is separate from the question of motive.
The UAE attorney general has explicitly said investigators are examining possible links associated with the incident.
That wording matters because investigators will be looking for evidence of advance planning and outside assistance rather than simply assuming that an attack committed by one person necessarily involved a wider network.
Potential evidence could include communications before the flight, contact with other individuals, financial transactions, travel patterns, online activity and information stored on electronic devices.
But the existence of an ideological connection, acquaintance or online interaction would not automatically establish operational involvement by another person or organization.
The relevant question is whether investigators can establish a meaningful connection to the planning or execution of the attack.
3. What exactly happened inside the cockpit?
The broad sequence is known, but the detailed timeline remains important.
Captain Machchhar has described being attacked and subsequently managing to unlock the cockpit door despite his injuries. Other accounts describe passengers and crew entering the flight deck and helping subdue the attacker, while additional pilots took control of the aircraft.
Investigators still need to reconstruct the sequence with technical evidence.
The cockpit voice recorder should be particularly important. Investigators can compare recorded cockpit audio with flight-data information, air-traffic-control communications and witness accounts.
They will want to establish:
- when the confrontation began;
- what was said immediately beforehand;
- when control of the aircraft was compromised;
- how long the struggle lasted;
- when the cockpit door was opened;
- who entered the flight deck and when;
- and how control was ultimately restored.
That reconstruction matters because a few seconds can make a major difference during an in-flight cockpit emergency.
4. What does the flight data reveal?
Reports indicate that the aircraft underwent a severe loss of altitude during the incident. But the exact sequence of control inputs and aircraft responses is more important than simply describing the descent as a “dive.”
Flight-data records can help investigators determine whether the aircraft’s unusual flight path resulted from deliberate control inputs, an uncontrolled struggle, damage to flight controls, or some combination of factors.
The aircraft reportedly sustained damage, including to its rudder, according to reporting from passengers and investigators.
The final technical reconstruction should therefore distinguish between what the pilots intended to do and what the aircraft physically did while the cockpit was being contested.
That distinction could also influence any future safety recommendations.
5. How did the attack get past cockpit security?
This is one of the most consequential questions for aviation regulators.
Cockpit security is principally designed to prevent unauthorized people from entering the flight deck. FZ1073 involved a different threat: an individual who was already authorized to be there.
That creates a fundamentally different security problem.
The investigation will need to determine whether existing procedures provided any realistic opportunity to identify or interrupt the threat before the physical attack began.
It will also examine how the emergency cockpit-door procedure functioned during the attack. The captain’s ability to unlock the door appears to have been crucial to the rescue, but investigators will need to reconstruct precisely how that occurred and whether the system operated as intended.
The question is not simply whether the cockpit was “secure.” It is whether the security architecture remains effective when the threat originates from someone legitimately inside it.
6. What did Flydubai know about the co-pilot before the flight?
This may become the most important personnel-security question.
Several reports have said the co-pilot had previously worked for Oman Air and had been removed from flying duties because of concerns about extremist views. The Guardian, citing people familiar with the matter, reported that he had subsequently worked in an administrative role before joining Flydubai.
Those claims are significant, but they need to be tested against primary records.
Investigators will need to establish:
- what his previous employer formally recorded;
- why he was removed from flying duties, if that occurred;
- whether any security or disciplinary finding was made;
- what information was transferred to subsequent employers;
- what Flydubai requested during recruitment;
- what background checks were completed;
- and whether any authority had information that should have affected his ability to fly.
The critical question is therefore not simply “Was there a warning?”
It is “Was there a documented warning, who possessed it, who was legally entitled to receive it, and did the relevant organization have a duty or practical ability to act on it?”
Those are very different questions.
7. Was the co-pilot legally permitted to operate the flight?
Reports about the co-pilot’s nationality and previous employment have also raised questions about why he was assigned to a flight bound for Israel.
That issue needs careful treatment.
Israel and Oman do not have diplomatic relations, and reporting has raised questions about arrangements concerning pilots from countries without formal diplomatic ties to Israel.
But nationality alone does not establish that a pilot was prohibited from operating the flight.
Investigators will need to establish what restrictions actually existed, which agreements applied to Flydubai, what information was provided to the relevant authorities, and whether the crew assignment complied with those rules.
That is a regulatory question, not evidence of motive.
8. What will the cockpit recordings tell investigators?
The recordings may provide the closest thing investigators have to a contemporaneous witness inside the flight deck.
But even a cockpit voice recording will not necessarily answer every question.
It can potentially establish conversations, sounds, alarms, radio communications and the timing of events. It may help identify whether there was an unusual exchange before the assault or whether the attack began without an obvious warning.
It cannot, by itself, establish what the co-pilot was thinking.
That is why investigators will need to combine recordings with flight data, forensic evidence, witness testimony and digital evidence.
A recording can tell investigators what happened without necessarily explaining why it happened.
9. What does the co-pilot’s digital evidence show?
The UAE prosecutor has specifically said physical and digital evidence is being examined.
That potentially includes phones, computers, messaging accounts and other digital material obtained through the investigation.
The important distinction will be between evidence of an individual’s beliefs and evidence of operational planning.
For example, extremist material found on a device could be relevant to understanding ideology. It would not automatically prove that the person planned an attack with a particular organization.
Investigators will therefore need to establish chronology and causation: what was accessed, when, by whom, and whether it was connected to the events on FZ1073.
10. Were there warning signs that nobody connected?
This may ultimately be the most significant institutional question.
An investigation can discover that warning information existed without proving that an airline or regulator acted negligently.
Information can be:
- unavailable;
- legally restricted;
- held by another country;
- considered unreliable;
- too old to trigger action;
- recorded under a different system;
- or never communicated between organizations.
The investigation therefore needs to reconstruct the information chain, not merely the co-pilot’s personal history.
If authorities find that multiple organizations independently possessed credible information but failed to connect it, that would raise a very different regulatory issue from discovering that no reliable warning existed.
11. Could the attack have been detected before takeoff?
This is related to screening but should not be confused with hindsight.
After an attack occurs, previously obscure facts can appear obviously significant. Investigators must instead ask what a reasonable screening system could have identified before the flight.
That requires examining what information was available at the time, what screening procedures were actually required and what threshold would have justified intervention.
A system cannot realistically prevent every future act of violence by identifying every unusual behavior. The more useful finding would be whether a specific, credible signal existed that the existing system was designed to detect but failed to act upon.
12. What did passengers and other crew members actually see?
Passenger accounts are important, but they are not necessarily precise enough to reconstruct every moment inside a cockpit.
People experiencing a sudden aircraft emergency may see only fragments of an event. Some may have been injured, disoriented or unable to observe the flight deck directly.
Investigators can nevertheless compare multiple accounts to identify consistent details.
Particular attention will likely be given to the passengers and crew members who physically entered the cockpit, the two additional pilots who took control and anyone who observed the aircraft’s descent from the cabin.
Their testimony can help bridge gaps between the technical recordings and the human sequence of events.
13. What happened to the cockpit and aircraft systems during the struggle?
A physical examination of the aircraft should help determine whether the confrontation caused or contributed to damage.
Investigators will need to distinguish intentional actions from damage caused during the struggle and from consequences of the aircraft’s abnormal flight path.
That matters for future training.
If investigators conclude that the aircraft’s systems remained operational but human access to the controls was compromised, the lesson will be different from one involving significant mechanical or flight-control damage.
The same applies to the cockpit door, control columns, switches and other equipment.
14. What should regulators change?
It is too early to conclude that a particular rule caused the incident.
The more useful regulatory review will ask whether existing aviation-security arrangements adequately address insider threats.
Possible areas include:
- recurring personnel-security screening;
- information-sharing between airlines and regulators;
- procedures for reporting security-related concerns when pilots change employers;
- cockpit access protocols;
- crew training for violent insider events;
- emergency response procedures;
- and international standards for aviation personnel vetting.
Any changes will have to balance security against privacy, employment rights, due process and the practical need for pilots to operate independently.
That balance is especially important because an aviation system built around treating every employee as a potential attacker could create its own operational and safety problems.
The facts investigators should establish next
The most useful way to follow the FZ1073 investigation is not by counting new allegations but by watching which unanswered questions become supported by primary evidence.
The next meaningful developments should establish more about the cockpit timeline, the aircraft’s flight-data and recording evidence, the co-pilot’s documented employment history, the security information available to Flydubai and relevant authorities, and the evidence supporting or rejecting a wider connection.
The UAE attorney general has already indicated that the investigation is not finished and that its final results will follow the completion of the necessary procedures.
That leaves an important distinction for readers to maintain: the attack itself is no longer the principal mystery. The unresolved issue is how the system allowed a person inside a commercial cockpit to become the source of the threat—and whether anything in the available evidence could have prevented it.
That answer will require more than a biography of the accused co-pilot or a reconstruction of the dramatic moments over Saudi Arabia. It will require investigators to connect the cockpit recordings, flight data, forensic evidence, personnel records and security information into one independently supported chronology. Until that happens, the most responsible account of FZ1073 is one that clearly labels what authorities have established, what investigators are testing and what remains unknown.