Metrojet Crash: Why The Insider Threat to Airport Security Isn't Just Egypt's Problem

06_03_EgyptPlanes_04
Rescue workers investigate at the crash site of a Russian passenger airplane that crashed at the Hassana area in Arish, Egypt, on November 1, 2015. Ahmed Gomaa/Xinhua/Redux

At 5:50 on the morning of October 31, 2015, Metrojet Flight 9268 received takeoff clearance from Sharm el-Sheikh International Airport, the travel hub for Egypt's best-known Red Sea tourist destination. At the controls of the Russian plane was Valery Nemov, a pilot with more than 12,000 hours of flight time. He and his co-pilot, Sergei Trukachev, spooled the engines on the 18-year-old Airbus 321-200 nearly up to full power. It was two minutes before sunrise, but already a warm westerly breeze was blowing waves of heat off the sands of the Sinai Desert. Most of the 217 passengers were women and young children taking a break in the Egyptian sun. Others on the flight had apparently enjoyed a final evening of Sharm el-Sheikh's nightlife: Autopsy reports would later show signs of alcoholic intoxication in 20 of them, and three had traces of recreational drugs.

Fifteen-year-old Maria Ivleva, in window seat 31A, and 77-year-old Natalia Bashakova, in front of her in 30A, settled down for the more than four-hour flight back to their homes and families in St. Petersburg. Some 9 feet below where they sat, tucked between two suitcases in the hold, was a bomb. Russian investigators believe it was placed there during loading by a baggage handler who was loyal to an Egyptian offshoot of the Syria-based Islamic State militant group (ISIS).

At 6:12:56 a.m., the aircraft was 30,875 feet above the northern Sinai Desert when up to 2 pounds of high explosives detonated.

06_03_EgyptPlanes_01
Egyptian authorities comb though debris from a Russia bound downed aircraft a day after it crashed in Hassana, Egypt, on November 1. The Metrojet crashed 23 minutes after it took off from Egypt's Red Sea... AP

The subsequent breakup of the plane and its crash onto the desert below killed all 224 passengers and crew, making it the deadliest attack yet by ISIS outside its regular battlegrounds in Syria and Iraq. It was also the deadliest incident on Egyptian soil and in Russian aviation history. The Metrojet attack raises questions about not only Egyptian security but about a key vulnerability of all airports: the risk not from passengers but from airport staff. If investigators are right and militants did use sympathetic ground staff to smuggle the bomb on board Metrojet Flight 9268, then that might not be just a Egyptian or Sharm el-Sheikh problem; it could be a global problem.

"We are not screening people who work in restricted areas properly—that is definitely one of [aviation's] Achilles' heels," says Philip Baum, author of Violence in the Skies: A History of Aircraft Hijacking and Bombing. "All recent terror attacks have bypassed conventional passenger screening entirely."

The disappearance over the Mediterranean on May 19 of an EgyptAir airliner on its way from Paris to Cairo intensified concerns about this weak link in airport security. Investigators said smoke was detected in the front part of the cabin in the three-minute period before controllers lost contact with the plane, indicating that a sudden catastrophe—most likely a fire—caused the aircraft to plunge into the sea. It remained unclear as Newsweek went to print what happened to the plane; as Egypt dispatched a submarine to search for the black box containing the flight's data records, officials cautioned that all scenarios were being examined, including the possibility of a technical fault. Nevertheless, in the immediate aftermath of the crash, several Egyptian officials theorized that terrorism was to blame, and security analysts pointed out that on the same day, the plane had flown from Asmara, Eritrea, to Tunis and finally to Cairo before it made its way to Paris Charles de Gaulle Airport. If a bomb took down EgyptAir Flight MS804 as it flew over the Mediterranean, it's possible the device was placed aboard in Asmara, Tunis or Cairo rather than in Paris.

06_03_EgyptPlanes_02
The fact that the doomed Egypt-Air flight departed from de Gaulle Airport raised concerns about vulnerabilities at an airport at the heart of Europe, one that has been on high alert since the Paris attacks... Christophe Ena/AP

Aviation security experts point out that the insider threat is not limited to airports in regions with a history of poverty, radicalism and conflict. In 2007, four men were arrested for conspiring to blow up the fuel tanks and pipeline at New York's John F. Kennedy airport. One of the suspects was a former cargo worker at JFK. In 2010, British Airways staffer Rajib Karim was arrested in Newcastle, England, for plotting an aircraft bombing; he was sentenced to 30 years in prison in 2011. In 2013, a 58-year-old Muslim convert and avionics technician Terry Lee Loewen was nabbed in an FBI sting operation after attempting to explode a car bomb at the Wichita, Kansas, airport. And in 2014, Eugene Harvey, a baggage handler at Atlanta's Hartsfield-Jackson International Airport, was busted for helping an accomplice smuggle at least 125 guns by loading them onto flights between Atlanta and New York. All of those incidents took place at airports that employ some of the most sophisticated security technology and procedures in the world.

Just as the 9/11 hijackers showed the world that knives could be smuggled through old-style airport security, so the person or people who blew up the Metrojet flight have presented the world with a fresh form of threat: Deadly attacks don't have to be carried out by suicide bombers—or even by passengers.

"Security is only as good as the weakest link—and that weakest link may well be the airport staff member, who whilst passing all appropriate checks and screening is secretively becoming radicalized," says Mike Vivian, a veteran civil aviation pilot who is now a security consultant. That includes "all those who have access to aircraft, including caterers, refuelers, baggage loaders, cleaners, maintenance and operational staff, police and customs."

In the wake of the Metrojet bombing, airports around the world tightened up the security vetting for staff. There was a purge underway at Paris's Orly and Charles de Gaulle airports, where about 70 employees lost their clearance to work in the most secure zones, many of them over suspected extremist links. The full security implications of the insider threat are mind-boggling. London's Heathrow Airport employs 76,000 people. That is a lot of people to screen and trust. Every day, British Airways loads onto its planes 100,000 meals in the U.K. alone, and thousands of cans of soda. ISIS boasted that that the bomb that took down the Metrojet flight was hidden in a soda can. Screening each one would be impossible.

06_03_EgyptPlanes_05
ISIS boasted that the bomb that took down the Metrojet flight was hidden in a soda can, releasing a picture of what it said were the components used to build it, including a detonator and... Islamic State

Every generation of aircraft attackers exploits a new loophole that must be painstakingly plugged—usually at great expense—but few loopholes will be as difficult and expensive to close as that posed by determined insiders with intimate knowledge of how airports work and easy access to targets.

A single soda-can bomb smuggled onto a plane has terrifying destructive power—and not just for the doomed passengers on that flight. As the Metrojet bombing has shown, it can set friends against each other; it can devastate tourism-based economies; it can provoke a major power to unleash its most highly trained killers; it can cause airlines and airports around the world to tighten their already painfully tight security procedures; and it can scare anyone who plans to fly on a commercial airliner.

The events of the past few months pose a painful question: Have we lost this round of whack-a-mole with the attackers and entered a new era of bombs on planes?

Victory Upon Victory

Twenty minutes into Metrojet 9268's last flight, the aircraft had reached 30,000 feet. The autopilot had nearly retracted the flaps to level off into cruising altitude, and the pilots would likely have pushed back their seats and started sipping their usual post-takeoff coffee. In the all-coach-class plane, many passengers would be trying to snatch some sleep after their early start.

According to a painstaking analysis of the debris conducted by Russia's Emergency Situations Ministry (MChS), the detonation punched one large 15-centimeter-wide hole and several smaller ones in the plane's aluminum alloy skin. It also blew out a section of stringers, the lightweight strips that hold the ribs of the plane's fuselage together. Modern high explosives such as TNT typically expand a thousandfold as they explode. The resulting pressure spike in the cabin caused a vertical rip to spread around the fuselage, from keel to roof, in the vicinity of rows 30 and 31.

Raw flight tracker data from Flight 9268 published by Flightracker.com, an online resource used by the aviation industry, shows that in the six seconds between 6:12:56 a.m. and 6:13:02 a.m., the plane twice gained and lost nearly 4,000 feet in altitude. That wild diving and climbing was probably what ripped the plane's tail off, tipping the plane's center of gravity forward and sending it into a steep dive, spilling luggage and debris into the sky as it fell. The corpse of one child was found 5 miles from the main crash site.

06_03_EgyptPlanes_10
An undated photo from the Russian government shows Russian and Egyptian personnel with luggage and personal belongings from the wreckage of the Metrojet charter flight that was headed for St. Petersburg when it crashed on... Maxim Grigoryev/Russian Ministry for Emergency Situations/The New York Times/Redux

Twenty-six seconds after detonation, at 6:13:22 a.m., the plane had descended to 27,925 feet and the ground speed had plummeted from 400 knots to 62, meaning that the plane was in near-vertical free fall. At that point, the stricken plane stopped transmitting flight data, but according to an animated graphic produced using MChS's study of the debris field, at some point during the plunge the starboard engine detached from the wing and fell away, which put the aircraft into a left-handed spin, followed seconds later by the port engine being ripped away. The main section of the plane hit the ground and shattered.

Three hours later, an Egyptian jihadi group calling itself Islamic State-Wilayat Sinai tweeted a claim of responsibility. "The fighters of the Islamic State were able to down a Russian plane over Sinai province that was carrying over 220 Russian crusaders," said the statement. "They were all killed, thanks be to God."

Despite Wilayat Sinai's crowing, the first reaction of the Egyptian authorities was to deny that the incident had anything to do with terrorism. Ayman al-Muqaddam, head of Egypt's central air traffic accident authority, told reporters hours after the crash that the pilot had made contact, saying that due to a technical failure he would attempt an emergency landing at El Arish International Airport in northern Sinai. That was not true, but that statement was the first of many official denials that the attack was the result of terrorism, a pattern that has made Egyptian officials seem oddly detached from reality.

This was the second victory of the day for the bombers: making one of their enemies look foolish as well as weak. Soon they were to have a third—creating tension between allies.

Russia has a history of mixed relations with Egypt, but at the time of the Metrojet disaster, Cairo and Moscow were close. After the coup in Egypt that ousted democratically elected President Mohammed Morsi, a leader of the Muslim Brotherhood, the Russians warmed to the new president, former general Abdel-Fattah el-Sissi.

On the ground, the Egyptian army dispatched teams to search the desert for the missing plane. (The Sinai is one of the most heavily militarized parts of Egypt as a result of a five-year-old Islamist insurgency.) By noon, Egyptian media were disseminating the first reports of bodies and debris being discovered. At the same time, Russia's MChS scrambled three special Antonov jets equipped with crash experts and equipment to take off for Sharm el-Sheikh.

06_03_EgyptPlanes_08
Egyptian Prime Minister Sherif Ismail talks to reporters at Cairo International Airport on May 19. He said it was too early to say whether a technical problem or a terror attack caused the plane to... Selman Elotefy/AP

By then, Russia was already in mourning. In St. Petersburg's Pulkovo Airport, the intended destination of the plane, the families of the victims waited for news. Among them was import manager Aleksandr Voitenko, whose 37-year-old sister, Irina, and 14-year-old niece, Alisa, were on the flight. "It was the first ever trip on a plane for my niece," he says. "The first and the last." The families, and many other Russians, were demanding answers—and justice. Russian investigators got to work by midafternoon.

The central part of the Sinai Desert is not sand; it's a hard-baked, stony expanse of nothingness. Even in October the daytime temperature was over 86 degrees Fahrenheit. "It was the landscape of a fever dream, or a video game—kilometers of flat yellow rock," says a Russian television reporter who flew to the crash site a few days later. (He requested anonymity because his channel demands exclusivity on all reporting.) "The MChS teams were very professional. They formed lines and walked over kilometers of territory, searching for any pieces of evidence."

The Egyptian police, according to Igor Trunov, a lawyer who represents the victims' families, were less professional. "Before takeoff, many of the victims were photographed with jewelry, and many had expensive telephones with them, as well as valuables in their luggage," says Trunov. "But after the crash, where are they? I think that there are many questions for the Egyptian police to answer."

According to MChS team members interviewed by Russian reporters, swabs taken by the Egyptians of damaged pieces of the fuselage damage weren't properly done and evidence was destroyed, making it harder to determine the exact kind of explosive used. Speculation that the plane might have been brought down by a surface-to-air missile—fueled by a video posted on an ISIS-affiliated website apparently showing old footage of a fighter plane being shot down—was quickly scotched by evidence that an explosion had taken place inside the plane. MChS officers showed TV reporters two suitcases—one black plastic, one red nylon—that showed scorch marks and the clear signs of having been melted by fire.

By midday November 1, the Russian and Egyptian teams had found 163 bodies. A day later, coffins began arriving in St. Petersburg filled with many of those bodies—and many unidentified body parts. Voitenko recalls spending two hours with his mother filling out forms giving detailed physical descriptions of his dead sister and niece. "Five or six families visited the morgue at a time," he recalls. "They showed us bodies which were not too burned and could be identified easily." Officials also showed him photographs of some identifiable parts of bodies that might match his relatives. "It was impossible to recognize most of the bodies as human beings," he says. Some relatives insisted on burying their loved ones before DNA tests were complete—but when the results came out on December 11, three victims had to be exhumed and reburied after it was found that the corpses had been misidentified.

As Russians dealt with their grief and anger, the Egyptian government continued to deny that the Metrojet plane had been the target of an attack. Finally, on February 24, almost four months after the disaster, el-Sissi finally acknowledged that terrorists had brought down the flight.

06_03_EgyptPlanes_09
A relative of a passenger on the EgyptAir flight that went down on its flight from Paris. Egypt was already seeing a sharp reduction in visitors due to security concerns. Ala Ahmed/Anadolu Agency/Getty

By then, the bombers had provoked more actions that they would likely consider further victories. On November 6, Russian President Vladimir Putin announced a ban on all flights from Russia to Egypt. Sharm el-Sheikh was by then something of a ghost town, dealing a terrible blow to the country's tourism industry. A few days later, the Russian Federal Security Service, or FSB, announced that the cause was officially a bomb. The Kremlin then launched a massive worldwide hunt for the perpetrators. Russia offered a bounty of $50 million for information leading to the bombers. While those measures may ultimately lead to their capture or deaths, Islamist militants often consider it a victory when they provoke great powers into launching military or paramilitary missions against them—and they are likely to be flattered that the reward here is almost twice that offered by the U.S. government for Osama bin Laden.

"We will search for them everywhere, no matter where they are hiding," Putin told a televised meeting of Russia's Security Council on November 17. "We will find them in any place on the planet and will punish them." Putin also threatened any countries discovered to be sheltering the killers with dire consequences. "We will act in accordance with Article 51 of the United Nations Charter, the right to self-defense." Kremlin spokesman Dmitry Peskov elaborated: "This presidential order has no limits in time or geography."

With Putin's personal prestige invested in the result, it's certain the FSB has mounted a manhunt of unprecedented proportions. "We will find them, that's a certainty," says one retired KGB major-general who worked in Soviet foreign intelligence and who is not authorized to speak on the record. "We have many friends and colleagues all over the region—in Egypt, Syria, Iraq." The FSB has hunted down and killed many of Russia's enemies. One Chechen separatist leader was allegedly killed by a Russian-approved car bomb in Qatar in 2004; another was gunned down by a suspected Kremlin assassin in Istanbul last November—not to mention the FSB's alleged role in the polonium poisoning of KGB defector Alexander Litvinenko in London in 2006. "I promise you—among our colleagues we have many highly professional specialists in this area," says the general. "Our reach is long."

Prime Suspects

Russian and Western intelligence believe they have identified the likely culprit: a former clothing importer and graduate of Cairo's al-Azhar University who goes by the nom de guerre Abu Osama al-Masri and is believed to be either 42 or 43. In 2011, al-Masri was a senior leader in a small jihadi group based in the Sinai Peninsula named Ansar Bayt al-Maqdis—literally the "supporters of the holy house," meaning Jerusalem. When Hosni Mubarak stepped down as Egypt's president in the wake of the Egyptian revolution in 2011, his replacement, Morsi, released hundreds of jailed militants from Egyptian prisons, and many flocked to join ABM's jihad. In its early days, most of ABM's attacks were on Israeli targets, launching rockets across the border and blowing up gas pipelines. After the Egyptian army deposed Morsi in 2013, al-Masri gathered more small groups under his banner and began attacking Egyptian military targets instead. (Between 2012 and 2015, ABM and other groups in the Sinai mounted more than 400 attacks, including large-scale assaults on army bases and towns.) Al-Masri's ambitions continued to grow. In a video sermon posted on the internet on November 10, 2014, a spokesman for the group announced that ABM had pledged allegiance to the region's most violent jihadi force: ISIS.

After that pledge, ABM changed its name to Wilayat Sinai, meaning Sinai Province. "The relationship between Wilayat Sinai and ISIS in Iraq appears to be strong," says Sajjan Gohel, international security director of the Asia-Pacific Foundation, a London-based think tank. Despite the strong Egyptian roots of Al-Qaeda (which was co-founded by Egyptian Ayman al-Zawahiri), Gohel says, al-Masri preferred to strike up an alliance with ISIS because "Al-Qaeda was always clandestine, while ISIS overtly controls swaths of territory and takes action." The two also share a propensity for extreme violence. "People who associate themselves with the ISIS brand are very motivated by total brutality, especially against Muslims and apostates. Al-Qaeda never deliberately targeted Muslims, while ISIS goes out of their way to kill them."

Analysts believe the idea of planting a bomb on a plane at Sharm-el-Sheikh Airport originated with Wilayat Sinai, but the precise target and order to execute likely came from ISIS central command in Raqqa, Syria. "The Metrojet bombing was a distinctly Egyptian operation, although it was claimed by ISIS," says Allison McManus, research director at the Tahrir Institute for Middle East Policy, a Washington-based organization dedicated to raising awareness of events in the Middle East. The planning, she says, would have been carried out between North and South Sinai, requiring operatives with intimate understanding of the security procedures at Sharm el-Sheikh Airport. "While some strategic or technical expertise may have been gained from ISIS, the overall planning and execution would have been done domestically," McManus says.

"Certainly," says Gohel, the two are "not just in contact but share resources, exchange technical information via encrypted data. There is a separation between ISIS and its franchises, but they are known to have a network on the dark web that is operating actively, where terror activity is discussed in detail."

Nor is Wilayat Sinai simply an ISIS farm team; it is a well-organized and sophisticated group. "Sinai militants have traveled to Iraq, Syria and Libya, where they trained with counterparts there to develop strategic, tactical and technical knowledge," says McManus. "Wilayat Sinai may be a smaller organization [than ISIS, but] it is certainly no less knowledgeable or experienced. Egyptian and Sinai jihadists are some of the most dangerous in the world."

What seems clear is that preparations for the insider attack at Sharm el-Sheikh began well before the target was selected. A Russian security source quoted by the FSB-connected Life News tabloid claimed in February that the man who planted the bomb applied for the airport job some time before the attack and "asked specifically to be employed as a baggage loader." (The FSB officially denied that it was the source of the story.)

It's highly likely that Wilayat Sinai's agent—or agents—were already in place when Russia launched its surprise air campaign in support of the government of President Bashar al-Assad in Syria on September 30, 2015. In fact, ISIS's online magazine, Dabiq, claimed that the target was changed from a "Western" plane to a Russian one after the start of Putin's bombing. Whatever the case, when Abu Muhammad al-Adnani, emir of ISIS in Syria and the group's official spokesman, released an audio message on October 13 urging Islamic youth everywhere to "ignite jihad against the Russians and the Americans in their crusaders' war against Muslims," Wilayat Sinai was ready to answer the call.

06_03_EgyptPlanes_06
The attack on the plane carrying Russian tourists home from the Red Sea resort came soon after Moscow stepped up its military support for Syrian President Bashar al-Assad. Leonhard Foeger/The New York Times/Redux

Dabiq also published what it claimed was a photograph of the device that brought down the Metrojet—a rudimentary homemade-looking bomb consisting of a battered Schweppes can packed with explosives, a 2-inch-long detonator with a yellow wire and a thumb-sized electronic timer covered in insulating tape. Some security experts doubt that such a small device could deliver such a devastating blow. In the past, several aircraft have survived explosions of devices of up to 455 grams (1 pound). A bomb that exploded in the cabin of TWA Flight 840 over Greece in April 1986 blew a large hole in the fuselage and caused four passengers to be sucked out of the aircraft to their deaths, but the plane landed safely. And just this February a suicide bomber on a Daallo Airlines flight en route from Somalia to Djibouti carried a small device believed to be hidden in a laptop, ripping a 6-by-3-foot hole in the side of the plane. The suspected attacker—who is believed to have had links to the jihadi group Al-Shabaab—was the only victim, and the aircraft made an emergency landing at Mogadishu, Somali.

Where the device is placed is much more critical than its explosive power, says Vivian, the security consultant. On the Metrojet flight, the bomb "was adjacent to a pressure bulkhead, and this would have a devastating effect. Clearly, someone had to have some knowledge of air-side working and the inside of an Airbus and the relevant place where to put the device."

Local know-how and personnel, combined with expertise and a call to action from ISIS headquarters: That's a combination not unique to Egypt and the Sinai. As ISIS-affiliated franchises and groups grow in influence and number in the Middle East, Africa and elsewhere, experts say the pattern that apparently resulted in the murder of 224 people could be replicated almost anywhere.

06_03_EgyptPlanes_03
The Metrojet disaster highlighted security concerns about Egypt, but airport workers in the United States and Britain have been arrested for plotting attacks in recent years. Amr Abdallah Dalsh/Reuters

Devastating Success

For victims' relatives like Alexander Sologubov, who lost his 25-year-old daughter, Evgeniya, in the crash, the pain and anger lingers. "I would not shoot the terrorists," he told Russian television in November. "They should be kept alive and tortured for 224 days, and for every one of those days they would be praying for death. Dying for Allah is honorable for them. We need to do something different."

From the viewpoint of Wilayat Sinai and ISIS, the attack was a devastating success. "In selecting a Russian target, ISIS sent a message to its adversary about the consequences of its campaign on their territory in Iraq and Syria," says McManus. "Simultaneously, Wilayat Sinai struck at the Egyptian state, successfully crippling its tourism economy. In garnering global attention, Wilayat Sinai also gained respect and support from its international counterparts."

Most devastating has been the effect on Egypt's credibility—and stability. In the seven months since the attack—which have included a hijacking in April featuring a fake suicide vest smuggled through security at Alexandria's airport—Egypt's authorities have seemed more concerned with covering up their failures than telling the truth. They've also made no apparent progress in bringing the Metrojet suspects to justice—though in January, Reuters cited anonymous sources who claimed that an EgyptAir mechanic whose cousin joined ISIS in Syria in mid-2014, a baggage handler suspected of planting the bomb, and two police officers had been detained. Egypt's Interior Ministry says that no one is currently in custody in relation to the disaster.

We've seen this kind of stonewalling before. In 1999, EgyptAir Flight 990 crashed into the Atlantic en route from Los Angeles, via New York to Cairo, on October 31—clearly an unlucky date for Egyptian aviation. The Egyptian Civil Aviation Authority insisted that mechanical failure was to blame. But instrument and voice cockpit recordings strongly suggested that the cruise co-pilot, Gamil al-Batouti, put the plane into a deliberate dive in an apparent murder-suicide, quietly repeating "Tawakiltala Allah." which loosely means "I rely on God," 11 times during the final two minutes and 43 seconds of conversation that the cockpit voice recorder captured.

This culture of denial makes Egypt seem as if it can be badly thrown off course by terrorism—and that's exactly what ISIS wants. The reasons for the more recent EgyptAir crash are still not clear—in an audio message released on May 21, an ISIS spokesman urged sympathizers to launch attacks on civilians but made no mention of the EgyptAir plane. But given Egypt's track record, it will likely try to spin the disaster in a way that it considers most politically expedient.

That only undermines people's faith in the institutions charged with keeping them safe—and spreads more fear. With the Metrojet bombing, ISIS opened a terrifying new front. It's now up to the group's foes to face up to that threat—and find ways to close it down, fast.