“We have information from special services that you have a bomb on board,” was the chilling message to the pilots of a Ryanair plane flying from Athens to the Lithuanian capital.
“The bomb can be activated over Vilnius”.
With little information on which to act beyond assurance that this was the highest level of bomb threat, the pilots of FR4978 diverted to Minsk.
Yet when the plane arrived, there was no sense of urgency. An “emergency evacuation” of the plane lasted 50 minutes – although the crew asked all passengers to disembark as soon as possible.
The failure to quickly disembark passengers and crew from a plane thought to have a bomb on board is one of many mysteries revealed in the official report of the incident.
On May 23, 2021, a Boeing 737 was on a routine Ryanair flight from Athens to Vilnius. One of the passengers on board was a Belarusian dissident, Roman Protasevich.
The flight path took the aircraft over Greek, Bulgarian, Romanian and Ukrainian airspace without incident.
However, just 24 seconds after the plane entered Belarusian airspace, the pilots were warned by air traffic controllers of a bomb threat.
A new report from the International Civil Aviation Organization (ICAO) traces the sequence of events that led to the plane landing at Minsk airport – where Mr Protasevich was arrested, as well as his girlfriend.
Bomb threats against civilian aircraft are far from uncommon and are almost always false.
As soon as the controller passed on the threat, the captain asked, “Where did it come from?” Where did you get information about this? »
The controller replied: “Airport security informed that they had received an email.”
Captain: “Security personnel from Vilnius airport or from Greece?”
Controller: “This email has been shared with multiple airports.”
The question of how the controllers knew of the existence of the email is one of the many questions left unanswered by the Belarusian authorities.
“It could not be established how the controller knew that emails had been shared with multiple airports,” the report said.
ICAO investigators have obtained details of the email account used to make the threat.
According to the Belarusian Aviation Department, within five minutes of sending the first email, air traffic controllers were aware that the threat had been sent to several airports in Eastern Europe.
Belarusian authorities say Minsk airport received the first threatening email at 09:25 GMT. Investigators did not detect any trace of his shipment until 9:56 a.m., when the hijacking was underway.
Other emails were sent to airports in Vilnius, Athens, Sofia, Bucharest and Kiev. Those destined for Greek and Ukrainian airports were never received, while the others were only located a few days later.
The email read: “We Hamas soldiers demand that Israel cease fire in the Gaza Strip. We demand that the European Union renounce its support for Israel in this war.
“We know that the participants of the Delphi Economic Forum are returning home on May 23 via flight FR4978. A bomb was planted on this plane.
“If you do not meet our demands, the bomb will explode on May 23 over Vilnius. Allahu Akbar.”
The email account was created nine days before the incident, using an Internet Protocol (IP) address that The Independent traced to a supplier in Stockholm.
Belarusian authorities produced a screenshot of the email they say they received, but not the original. They declined to say how the security services became aware of the sending of several emails to several airports, when these airports had no knowledge of them.
As the plane continued on its planned route north, the air traffic controller recommended that the plane divert to Minsk for “safety reasons”, even though Vilnius – the planned destination – and other airports were closer .
The captain asked: “This recommendation to divert to Minsk – where did it come from? Society [ie Ryanair]? Was it from the departure airport authorities or the arrival airport authorities? »
The controller replied, “That’s our recommendation.”
Aircraft bomb threats are color coded according to their assessed credibility.
Green: “No credible threat exists. Deviation not required. Continue to the destination as planned.
Amber: “Uncertain credibility. The flight will continue to the intended destination or divert to a suitable alternative.
Red: “There is a credible threat and the PIC [pilot in command] should land at the nearest suitable airport as instructed by ATC [air-traffic control] or national authorities.
Normally, Ryanair’s operational control center in Dublin would assess the credibility of the threat. But even though the phone number was included in the flight plan, Minsk air traffic control did not alert the airline and the pilots were unable to establish radio contact.
The obvious course of action was to continue the flight to the intended destination, Vilnius, just 60 miles to the north. But the pilots were told to divert to Minsk – more than twice as far.
“Ryanair one-tango-zulu, they say the code is red,” the air traffic controller said.
The report states: “Relevant information included in the bomb threat email was not passed on to the flight crew, such as specific reference to flight number FR4978, time of receipt of the message, the organization/identified sender and the reasons for placing a bomb on that specific flight.
A “post-mortem security threat risk assessment” by Ryanair officials “determined that the threat color code would not have been red”.
In the absence of any other information, however, the pilots agreed to divert to Minsk – even though the only declared alternate airport for the flight was Riga in Latvia. Flight FR4978 turned east towards Minsk shortly before reaching the Lithuanian border.
The Belarusian Civil Aviation Authority insists: “The captain made his own decision to land at Minsk National Airport without any pressure from the Belarusian side.”
The captain made a passenger announcement (PA) informing passengers of the diversion to Minsk. Upon hearing the news, Mr. Protasevich reacted in horror. The report states: “Immediately after the AP, one of the passengers stood up and shouted to one of the cabin crew that he could not land in Minsk because ‘I am wanted there down, they’re going to kill me.
“The passenger was not considered unruly or disruptive.”
Fifty-four minutes after the incident began, the plane arrived in Minsk and parked at stand number 1. It was 10:24 GMT. No terrorist incident was declared.
The crew was keen to get everyone evacuated as quickly as possible, given the high threat alert. But, the report says: “The Minsk airport screening dispatcher explained that airport procedures prevail and passengers will only be allowed to disembark in groups of five.” The dispatcher explained that passengers and their carry-on baggage had to be checked by explosive detection dogs, which could only take place in small groups.
This individual later claimed that the cabin crew asked for this to happen.
Passengers began disembarking at 10:38 a.m. and finished at 11:14 a.m. – 50 minutes after the plane arrived.
International aviation rules state: “If an aircraft lands after receiving a bomb threat which has been assessed as orange or red, arrangements must be made to disembark passengers and crew with minimum delay, with their carry-on baggage when circumstances permit.”
The baggage compartment was opened 36 minutes after arrival, and explosive detection dogs entered five minutes later.
The captain remained on board while a team of Home Office aircraft search specialists searched the plane. He later reported, “The search team was not thorough and omitted areas that would be covered by normal procedures.
Seven hours after the first message, the passengers were allowed to board.
The report states: ‘Once passenger boarding is complete, the cabin crew conducts a passenger count and establishes that five passengers are missing.
“No explanation was provided to the Ryanair crew by ground staff at Minsk airport.”
The ICAO report points to Belarusian officials’ claims that “five passengers wanted to stay in Minsk” and “the five passengers crossed the border unescorted, on their own initiative.”
Two of the missing passengers were dissident journalist Roman Protasevich and his girlfriend Sofia Sapega. They had been arrested by the authorities. CCTV footage of the landing was not made available, with officials saying relevant parts were overwritten.
A third passenger was allegedly a Greek passenger whose final destination was Minsk and who was simply profiting from the diversion.
Ryanair chief executive Michael O’Leary said he had no doubts about the identity of the other two: “It appears the intention of the authorities was to deport a journalist and his travel companion. We believe KGB agents were also offloaded at the airport.
While the ICAO report says it lacks vital information about Belarus that would allow it to draw definitive conclusions, Mr O’Leary said: “This was a case of hijacking sponsored by the state, state-sponsored piracy.
The Ryanair boss was backed by the International Federation of Airline Pilots Associations and the European Cockpit Association.
They issued a joint statement saying, “This unprecedented act of unlawful interference will potentially upend all assumptions about the safest response to mid-air bomb threats and interceptions.”
Mr. Protasevich, an implacable opponent of Belarusian President Alexander Lukashenko, would be under house arrest, and his girlfriend Sofia Sapega faces six years in prison.
The Independent Gt