FZ1073: A Grey Rhino, Not a Black Swan

The flydubai FZ1073 incident was a Grey Rhino, not a Black Swan.

These two animals come from two of the most influential books on risk written this century. If you have not read them, they are worth knowing.

The Black Swan

The idea comes from Nassim Nicholas Taleb, a Lebanese-American writer, former options trader and scholar of risk, in his book The Black Swan: The Impact of the Highly Improbable (2007). For centuries Europeans used “black swan” to mean something impossible, because every swan anyone had seen was white. Then, in 1697, Dutch explorers in Western Australia found black swans, and a belief built on millions of sightings collapsed overnight. Taleb’s book, a worldwide bestseller, uses the term for an event that lies outside all past experience, has an extreme impact, and is explained away with hindsight as if it had been predictable. A true Black Swan gives no warning. Afterwards everyone says “no one could have foreseen this”, and for a true Black Swan that is correct.

The Grey Rhino

The answer to Taleb comes from Michele Wucker, an American policy analyst, who first presented the idea at the World Economic Forum in Davos in 2013 and set it out in her book The Gray Rhino: How to Recognize and Act on the Obvious Dangers We Ignore (2016). It has since been widely adopted by policymakers and risk managers. A Grey Rhino is the opposite of a Black Swan: two tonnes of animal charging straight at you. You can hear it coming. You can feel the ground shake. You can see it long before it arrives. It is not hidden. The danger, Wucker argues, is that we look away, argue about it, hope it turns aside, and do not move.

FZ1073 was a rhino on all three counts:

• It could be heard. Since Germanwings in 2015, investigators, regulators and safety advocates have warned that the most dangerous threat to an airliner can sit in the cockpit itself.
• It could be felt. ICAO wrote insider-threat measures into Annex 17 in 2019 and published a whole Insider Threat Toolkit. The risk was formally recognised by the world’s aviation body.
• It could be seen. According to officials, Oman Air identified this first officer as a security risk in 2024 and removed him from flying. The rhino was not just in the region; it had been looked in the eye.

And still nobody moved. The finding apparently stayed in Oman, and the same man reached another airline’s cockpit.

On the morning of 30 September, flydubai flight FZ1073, a Boeing 737 MAX 8, left Dubai for Tel Aviv with 174 passengers on board, 27 of them children. About two and a half hours later, at 34,000 feet, the first officer turned on his captain. UAE officials say he used the cockpit crash axe. The aircraft dropped some 17,000 feet in about two minutes. It was saved by a badly wounded captain who reached the door release, by off-duty colleagues and passengers who forced their way in, and by a diversion to Tabuk in Saudi Arabia. Everyone on board survived.

The UAE has called it an attempted terrorist operation. Israel’s Shin Bet has joined the interrogation. The investigation is less than a week old, and much is still unconfirmed.

This article sets out what is known, what is still alleged, and what the industry must now do. In line with standard practice while an investigation is open, it refers to the suspect as “the first officer” and does not name him.

What happened on board

The sequence below is pieced together from flight-tracking data, the captain’s own account, passenger interviews and official statements. Times are GMT. Several details still conflict between sources, and the official investigation has not yet reported.

The captain, Smit Machchhar, is an Indian national with about 10,000 flying hours who joined flydubai in 2022 after 11 years at SpiceJet (AirlineRatings). Of his decision to drag himself to the door, he told Gulf News: “I couldn’t let everybody else die.”

What is confirmed, and what is not

Sources: Ynet; ABC News; ThePrint; NPR.

The warning signs

The most troubling part of FZ1073 is not what happened in the cockpit. It is what was reportedly known beforehand.

The first officer, an Omani national in his late twenties, spent about seven years at Oman Air. According to officials cited by ABC News and Al Jazeera, Oman Air found him in possession of extremist material in 2024. It removed him from flying duties and moved him to an administrative role. He left Oman Air in February 2025, joined Royal Air Maroc in June 2025, left in January 2026, and was then hired by flydubai, where he had worked for less than a year (ABC News; Al Jazeera).

Three airlines in three countries employed him in less than two years. A Gulf diplomat told the Associated Press that he went through “standard security checks” before flydubai hired him. Israel says it received the crew list 48 hours before the flight (Al Jazeera). None of these checks surfaced the concern Oman Air had acted on.

The open questions are the ones that matter most:

• Did Oman Air or Omani authorities tell anyone? There is no public statement that the concern was shared with other States, airlines or licensing authorities.
• What did “standard security checks” cover? A criminal-record check and a licence verification would not reveal an internal security finding at a previous employer.
• Was he on any watchlist? There is no confirmation that he was.
• What did the previous employer’s reference say? In most jurisdictions, a former employer has no obligation to disclose a security concern, and may face legal risk for doing so.

If the reports are confirmed, the system did not fail to see this rhino. One part of it saw it clearly and acted. Then the information stayed where it was, and the rhino walked into another airline’s cockpit.

Where the defences failed, and where they held

It will be tempting, once the headlines fade, to file FZ1073 under “unforeseeable”. The record says otherwise:

• It was foreseen in general. Germanwings 9525 in 2015 showed what one person on the flight deck can do. ICAO wrote recurrent background checks into Annex 17 in 2019 and published a whole Insider Threat Toolkit.
• It was foreseen in particular. If officials are right, one airline had already identified this individual as a security risk and grounded him.
• The gap was known. There is no global standard for sharing pilot security findings across borders. That gap has been discussed for years, and left open.

Aviation safety is built on layers. Every layer has holes; an accident happens when the holes line up. On FZ1073, the layers designed to keep this person out of a cockpit failed one after another. The last layers, made up of people, held.

Read the table from top to bottom and the pattern is clear. Every institutional layer failed. Every human layer held. That is luck, not design.

There is a second lesson, the one the cockpit-door rules taught us after 2001. Locking the door against outside threats also locks a pilot in with an inside one. The industry accepted that trade-off on the assumption that the people inside the cockpit had been properly vetted and monitored. FZ1073 shows how fragile that assumption is.

What must change

The investigation will establish exactly where the system broke. The direction of the fix is already clear, and none of it requires new science. It requires decisions.

For ICAO

1. Make security findings on flight crew travel. Create a mechanism, at least among States that choose to join, for a licensing authority to record that a pilot has been removed from flying on security grounds, and for any future employer or State to query that record.
2. Turn the Insider Threat Toolkit into Standards. Recurrent, event-driven vetting and an organisational insider-risk programme should be audited obligations, not guidance.
3. Review cockpit equipment and procedures for the insider case. The crash axe, door-release procedures and the minimum number of people on the flight deck were designed for outside threats and medical incapacitation. They now need to be reviewed against an attack from the other seat.

For States, including India

1. Require previous-employer security disclosure for safety-sensitive aviation roles, with legal protection for employers who disclose in good faith.
2. Re-vet foreign-trained and recently moved crew on the same basis as domestic hires, including a check with the previous licensing State.
3. Treat crew lists as a security tool, not a formality, with intelligence screening for flights on high-threat routes.

For airlines

1. Ask the hard questions at hiring: why a pilot left each previous employer, and whether they were ever removed from flying. Verify the answers directly.
2. Watch for change after hiring. Peer support, confidential reporting and supervisor training make it more likely that a colleague’s concern reaches someone who can act.
3. Train crews for the insider scenario. Cabin crew and pilots should rehearse what to do when the threat is on the flight deck, including emergency entry procedures and recovering control.
4. Recognise the people of FZ1073. The captain, the off-duty pilots, the cabin crew and the passengers did what the system could not. Their accounts are the best training material the industry will ever get.

None of this is aimed at pilots as a profession. Pilots are the first to want the person in the other seat properly vetted. The overwhelming majority are the reason FZ1073 ended at Tabuk and not in a crater.

The question that remains

Everyone on board FZ1073 walked off at Tabuk because a wounded captain crawled to a door and a cabin full of strangers refused to let the aircraft fall. That is a story of extraordinary courage. It is not a safety system.

If the reports are confirmed, someone in the aviation system knew this man should not fly, and acted on that knowledge. The system around them simply had no way to pass it on. The next accident report should not have to explain why that gap was still open. It has now been seen, at 34,000 feet, by everyone on board.

That is what a Grey Rhino looks like up close.

Capt. Amit Singh FRAeS is the founder of Safety Matters Foundation. Read the Foundation’s white paper, Closing the Insider Gap. This article reflects public reporting as of 6 October 2026; the investigation is ongoing and nothing here is a finding of fact or guilt.

Further reading

• Nassim Nicholas Taleb, The Black Swan: The Impact of the Highly Improbable (Random House, 2007; expanded second edition 2010). The classic account of rare, unforeseeable events and why we explain them away afterwards.
• Michele Wucker, The Gray Rhino: How to Recognize and Act on the Obvious Dangers We Ignore (St. Martin’s Press, 2016). A practical guide to obvious threats that organisations see coming and still fail to act on.

Sources

• AirlineRatings, What happened on flydubai flight FZ1073?
• Al Jazeera, 12 minutes of madness: how Flydubai pilot, passengers saved plane midfall
• Al Jazeera, How was Flydubai co-pilot cleared despite being deemed a security risk?
• Al Jazeera, What are the five questions being asked regarding the Flydubai attack?
• Gulf News, Captain Smit Machchhar recalls battling for lives in cockpit
• ABC News, Suspect in FlyDubai incident was previously identified as security risk
• Ynet, Shin Bet joins UAE probe of flydubai co-pilot accused of crash plot
• ThePrint, Flydubai co-pilot was planning a similar attack in July
• NPR, FlyDubai attacker intended to crash plane into Tel Aviv airport, investigation finds
• CNN, Flydubai hijacking attempt exposes worrying gaps in aviation security
• ICAO, Insider Threat Toolkit