Hoax Bomb Threats Hit Two Dozen Flights; IATA Demands Security Overhaul

More than two dozen flights across Europe were disrupted by hoax bomb threats this month alone, forcing emergency diversions, airport evacuations, security sweeps and the scrambling of military fighter jets. That figure anchored IATA's call, delivered in Brussels on Nov. 9-10, for a structural reset in how governments and regulators handle aviation security.

Nick Careen, IATA Senior Vice President for Operations, Safety and Security, told the Global Tourism Forum Annual Meeting at the Royal Museum of Fine Arts of Belgium that threats are "changing faster than the rulebook." His audience included former UK Prime Minister Tony Blair, former French President François Hollande and former European Commission President José Manuel Barroso.

The hoaxes expose a specific structural flaw. Most of the fake threats went to airports and ground service providers — not to the airlines operating the flights. Careen argued the airlines hold the most expertise to assess a threat, yet they were often the last to know. Information still does not reach the people best placed to judge it.

What does IATA actually want?

Careen set out three asks to governments and regulators:

• One team. Build permanent, reliable channels for governments and operators to share threat information, decide jointly where it makes sense, and restore services safely.
• A risk-based approach. Recognise operators with mature, risk-based security management and consult industry before imposing new measures.
• Recognise, don't repeat. Where security already meets the same standard — within Europe and with trusted partners — accept it rather than duplicate it.

None of these asks carries a deadline, a funding figure or an implementing body. That is the gap. IATA has named the problem precisely but left the mechanics to regulators who have moved slowly before.

How broad is the threat picture?

The bomb hoaxes sit within a wider pattern Careen catalogued. Each example is dated and specific:

• Gatwick closed its runway in December 2018 after reported drone sightings.
• Finnair suspended flights to Tartu, Estonia, in 2024 after interference with global navigation satellite systems.
• Several European airports suffered disruption in September 2025 when a cyberattack hit a check-in provider.

Three different vectors — drones, GNSS jamming, cyber — inside seven years. Each incident forced operational decisions on airlines with no unified European mechanism to coordinate them.

IATA did credit what works. It welcomed the EU Action Plan on Drone and Counter-Drone Security, adopted Feb. 11, 2026. It praised the EU Conflict Zone Alerting System, created after the shootdown of MH17, which brings governments, EU institutions and the European Union Aviation Safety Agency together to assess conflict-zone risks and warn airlines. The message was that the machinery exists; the speed and reach do not.

Is more regulation the answer?

Careen's sharpest warning cut against reflexive rulemaking. "When a new threat appears, the instinct is to add another rule. But piling rule on rule doesn't always make people safer," he said. "It can spread effort thinly and leave less attention for the risks that matter most."

He named a live case: the Entry/Exit System (EES). The EU border system caused considerable disruption to services this summer. Outages are still causing problems now, a year after rollout. When individual countries bolt on their own measures like EES, Careen warned, Europe risks a patchwork instead of one common system.

What does this change for airlines and airports operating in Europe? For now, nothing binding. IATA has issued asks, not demands, and no regulator has committed publicly to the three-point framework. The diversion costs, evacuation delays and fighter-jet scrambles from this month's hoaxes fall on operators regardless.

The test will come at the next incident. If threat information still routes to ground handlers before the airline flying the aircraft, the 'one team' ask will have failed its first audit — and the rulebook will lag the threat once more.