On September 30, 2026, a flydubai flight carrying 174 passengers from Dubai to Israel narrowly avoided disaster after an attempted hijacking and attack by an Omani pilot. The incident raised urgent questions about how Israel screens foreign flight crews and which government agencies are responsible for identifying potential security threats.

Transportation minister, Miri Regev, quickly distanced her ministry from responsibility. “We are not an intelligence body,” she said in an October 3 television interview, adding that the flight crew list had not been passed on to her ministry. The director of the Civil Aviation Authority (CAA), Shmuel Zakai, also disclaimed all responsibility for security matters. “As the Civil Aviation Authority, we have no responsibility for or connection to security matters,” he told reporters after the incident. “Our responsibility is only for safety, for ensuring that pilots have proper licenses and that the planes are as they should be. All security matters are the responsibility of other bodies.”

However, two official government documents reviewed by Shomrim paint a more complicated picture. A Transportation Ministry tender obtained by Shomrim reveals that the ministry operates an aviation security unit specifically tasked with reducing the risk of terror attacks involving incoming flights. A separate document places responsibility for assessing certain risks to civil aviation with the head of Israel’s Civil Aviation Authority. 

The documents do not establish which agency was responsible for screening the flydubai crew. They do, however, raise questions about how security responsibilities are divided and whether information was shared among the relevant authorities.

An operations center meant to prevent attacks on flights

In May this year the Ministry of Transportation issued an updated tender for the operation of the Operational Aviation Security Array (known by its Hebrew acronym, Mamlat). The tender seeks a private company contractor to run an “operational array for the security handling of requests to enter Israeli airspace.” The Mamlat array operates under the ministry’s Security, Emergency and Cyber Division.

Section 1.3 of the tender documents defines its main purpose: “The main purpose of the Mamlat’s work is to carry out a preliminary security assessment of flights entering Israeli airspace and to reduce the possibility that this route will be used to carry out an attack against the State of Israel.”

The previous tender for operating the array, published in December 2020, also spelled out the security threat: “Terrorist elements may exploit foreign flights arriving in Israel to carry out hostile activity against the State of Israel.” The Mamlat’s role was then defined as “security handling of requests to enter Israeli airspace.”

Despite the explicit definition of the Mamlat’s purpose, the tender documents do not detail the methods of security assessment or the information on which decisions are based. They do reveal, however, that one of the deputy director’s duties is to brief pilots and maintain ongoing contact with security officials at airlines and airports around the world. The deputy director is also responsible for training and professional drills for the center’s staff and serves as acting Mamlat director in the director’s absence. 

T&M Saar Security, a large private security firm that works with various government ministries, has operated the Mamlat since 2021. 

A week before the attempted attack: ‘Responsibility rests on the shoulders of the CAA director’

Alongside the Transportation Ministry tender for the operation of the Malmat, a separate document reviewed by Shomrim sheds light on the Civil Aviation Authority’s role in analyzing risks to aviation. On September 22, about a week before the attempted attack on the flydubai flight, the authority published a tender-exemption document meant to allow it to extend its contract with the security company Rafael for another year. The contract is for consulting services related to analyzing risks to civilian aircraft during military conflicts.

According to the document, Rafael experts continue to advise the authority on risks to civilian aircraft during a military conflict. It also emerges that a Rafael consultant serves as part of a team for managing aviation crises in real time, during military operations and conflicts that carry a potential risk to civil aviation. It is not known whether such a team was active during the flydubai incident.

The document also points to Israel’s international obligations as a member of the International Civil Aviation Organization (ICAO), which sets standards and rules for international civil aviation. Annex 17 to the organization’s convention, which deals with safeguarding civil aviation against acts of unlawful interference, requires states to continually assess the level and nature of the threat in their territory and airspace, on the basis of security risk assessments. The annex explicitly addresses insider threats as well, and the need for background checks on people with unescorted access to security-restricted areas. A background check is defined as “a check of a person’s identity and previous experience, including criminal history and any other security-related information relevant to assessing the person’s suitability.” The annex also states that “persons found unsuitable in any background check shall immediately [...] have their unescorted access to security-restricted areas revoked.”

The document, signed by Moti Shmueli, head of the Aviation Infrastructure Division at the Civil Aviation Authority, states: “Responsibility for analyzing risks to civil aviation and for decisions on maintaining a generally accepted minimum level of safety rests on the shoulders of the CAA director.” The document refers to responsibility for risk analysis and for maintaining an acceptable level of safety in the context of civilian flights during military conflicts.

Who received the flight crew’s details?

The two documents raise questions about the handling of flydubai Flight FZ1073 from Dubai to Israel. At the heart of the matter is who received the flight crew list, who was supposed to receive it and what checks, if any, were conducted based on that information.

It should be noted that since 2023, a government database has held details of passengers and aircrew entering Israel. The database was established under the Law on Authorities for the Collection and Analysis of Data on Passengers Entering Israel and operates under the Tax Authority. The law allows four bodies – the Tax Authority, the Population and Immigration Authority, the Health Ministry and the Transportation Ministry – to access the database and request an assessment or query based on the information in it. In addition, the law authorizes the Shin Bet security service, the Mossad and the police to set up branches of the database, to be run by those bodies. Among the purposes the law sets for using the database are “identifying, preventing, foiling, investigating or prosecuting terrorist activity,” as well as “aviation security, including protecting the safety of passengers.”

The private company that operates the security array

According to data from the Budget Key website, run by the nonprofit Public Knowledge Workshop, T&M Saar Security, which has operated the Mamlat since 2021, has received more than half a billion shekels ($166M) from government contracts over the past decade. The largest sums came from the Justice Ministry, about 271 million shekels ($90M), for, among other things, securing facilities and protecting threatened individuals; and from the Construction and Housing Ministry, about 147 million shekels ($49), among other things for managing security in Jerusalem’s Old City. As for operating the Mamlat, Budget Key data show that the company received about 2.5 million shekels ($850,000) between May 2021 and May 2022. That sum may reflect the annual scale of the contract for running the array.

T&M Saar Security is a subsidiary of the publicly traded T&M Israel, which according to its website employs about 15,000 people. The parent company went public on the Tel Aviv Stock Exchange in June, and its value at the time of writing was about 854 million shekels ($285M). According to the exchange’s data, the company is engaged in “providing security and protection services, cleaning and maintenance, technology services and building management and upkeep.” Its shareholders include Israeli institutional investors, among them Mor, Phoenix, Menora and Clal Insurance, as well as the American fund Pegasus. The 5ÿcompany’s chairman is the American businessman Robert Tucker, and its CEO is Shimon Tal-Mor. The two, together with the Pegasus fund, are the company’s controlling shareholders.

According to the documents for the new Mamlat tender, the deadline for submitting bids was initially set for April 12, then postponed to May 4, and was apparently postponed again, to an unknown date. According to the government’s tender-exemption notices website, the company continues to operate the array in the meantime, and its contract has been extended through the end of January 2027, on the grounds that the new tender has yet to be completed. If a winner is chosen earlier, it could take over before the end of the period. The previous tender for operating the Mamlat was published in December 2020, and the company has run the array since 2021.

The central questions that remain open are whether the flight crew’s details reached Israeli systems; whether they were passed on to the Mamlat or to another security body; whether any background check was carried out; and who was supposed to sound the alarm if suspicious information was found. According to what Regev said after the incident, the crew list was not passed on to the Transportation Ministry. But the documents now revealed show that the ministry operates an array whose declared purpose is to reduce the possibility of exploiting incoming flights to carry out an attack, and that it is among the bodies authorized to access the database of passengers and crew.

‍

Responses

No response was received from the Transportation Ministry or from T&M Saar Security by the time of publication.