Who
Age of the perpetrators
Sex of the perpetrators
As in previous years, female perpetrators were involved in only one-fifth of the aviation security incidents reported during the year. In contrast, attacks, aircraft hijackings, and attempts to breach the flight deck were attempted or carried out exclusively by male perpetrators.
Motive
financial motive: In 30% of cases, financial motives were involved, which is in line with the previous year’s figure. Financial motives played a central role, particularly in crimes committed by insiders—such as smuggling, corruption, or theft.
personal problems / influence of substances: In 29% of all cases, mental illness, personal crises, and/or the influence of addictive substances were the primary factors leading to the offence, a figure consistent with the previous year. These individuals often acted impulsively, spontaneously, irrationally, and under strong situational influence.
state or state-affiliated: State actors or actors operating on behalf of a state were particularly active during the report year, accounting for 23% of incidents. This was evident primarily in missile and drone attacks on airports, as well as cyberattacks.
political - miscellaneous: A political motive was evident in 11% of the cases, though it could not be clearly classified into any of the other categories. These include, among others, actions by groups critical of the government, representatives of various professional groups, or indigenous communities. They drew attention to their concerns primarily through protests at airports.
political - ethno-nationalist: During the year covered by this report, there were approximately 40% fewer cases motivated by ethno-nationalist considerations compared to the previous year. The main reason for this was the lower number of attacks by Houthi rebels on Israeli targets compared to last year.
political – religious ideology: The number of acts committed by actors inspired by religious ideology has declined slightly compared to last year. These include attacks by jihadist groups on airports in Mali, Syria, and Somalia.
political - climate activists: In the year under review, the proportion of actions carried out by climate activists fell significantly for the first time to 1%. This can be explained by the fact that climate groups increasingly joined other political movements, such as pro-Palestinian groups.
political - left: During the period covered by this report, six incidents were motivated by left-wing extremism. Civil aviation is therefore not a primary target for left-wing extremists. Nevertheless, civil aviation facilities may become the target of actions that disrupt flight operations in connection with issues such as deportation flights, state repression, or the Kurdish question.
Side Note: Insider Threat
Insider threat poses one of the greatest security risks to civil aviation. It stems from individuals with legitimate access - employees, service providers, or partner companies - and can result from both intentional and negligent actions. While misconduct resulting from carelessness is relatively easy to control, malicious insiders and third parties are particularly dangerous in highly complex and interconnected aviation organizations.
Insider attacks are more difficult to detect than external threats
Insiders are familiar with processes, vulnerabilities, and controls. Attacks often involve a combination of technical actions (such as unauthorized access to data) and human and organizational factors, such as stress, conflicts, or financial hardship experienced by insiders.
Prevention using a multidimensional system
Effective insider risk management requires the integration of:
-
Behavioural analysis
-
Technical monitoring
-
Organizational transparency
-
Interdisciplinary collaboration between security, IT, HR, and legal departments
External partners as an underestimated risk factor
Suppliers, maintenance companies, IT service providers, and ground handling companies sometimes have extensive access rights. Unclear processes and inadequate security standards can significantly increase risks.
Security culture is crucial
Mitigating measures often fail not because of the technology, but rather due to a lack of awareness and buy-in from management. Clear reporting channels and a culture of accountability are more effective than mandatory annual training sessions.
Recognize and share early warning signs
Success stories from the aviation and transportation sectors show that early warning signs (such as irregular access or changes in behaviour) can prevent serious incidents. This requires an effective reporting system where employees feel safe to speak up without fear of repercussions.