‘Code red’: How a Ryanair flight with a dissident on board was diverted to Minsk

“We have information from special services that you have bomb on board,” was the chilling message to the pilots of a Ryanair plane flying from Athens to the Lithuanian capital.

“The bomb can be activated over Vilnius”.

With little information to act on beyond an assurance that it was the highest level of bomb threat, the pilots of FR4978 diverted to Minsk.

Yet when the plane arrived, there was no sense of urgency. An “emergency evacuation” of the plane took 50 minutes – despite the crew urging that all the passengers should disembark as quickly as possible.

The failure to get passengers and crew swiftly off an aircraft that was thought to have a bomb on board is one of many mysteries revealed in the official report on the incident.

On 23 May 2021, a Boeing 737 was on a routine Ryanair flight from Athens to Vilnius. One of the passengers on board was a Belarusian dissident, Roman Protasevich.

The flight path took the plane over Greek, Bulgarian, Romanian and Ukrainian airspace without incident.

Just 24 seconds after the aircraft entered Belarusian airspace, though, the pilots were warned by air-traffic controllers of a bomb threat.

A new report by the International Civil Aviation Organisation (ICAO) traces the sequence of events that led to the plane landing at Minsk airport – where Mr Protasevich was arrested, along with his girlfriend.

Bomb threats against civilian aircraft are far from rare, and are almost always false.

Email threat:

(ICAO)

As soon as the controller passed on the threat, the aircraft captain asked: “Where did it come from? Where did you have information about it from?”

The controller replied: “The airport security staff informed they received email.”

Captain: “Vilnius airport security staff or from Greece?

Controller: “This email was shared to several airports.”

The question of how controllers knew of the email’s existence is one of many that is left unanswered by the Belarusian authorities.

“It could not be established how the controller knew that emails had been shared with several airports,” the report says.

ICAO investigators obtained details of the email account that was used to make the threat.

According to the Department of Aviation of Belarus, within five minutes of the first email being sent, air-traffic controllers were aware of the threat having been sent to multiple airports in eastern Europe.

The Belarusian authorities claim Minsk airport received the first threatening email at 9.25am GMT. Investigators have detected no trace of it having been sent until 9.56am, by which stage the diversion was in progress.

Other emails were sent to airports in Vilnius, Athens, Sofia, Bucharest and Kiev. Those to the Greek and Ukrainian airports were never received, while the remainder were only located days later.

The email read: “We, Hamas soldiers, demand that Israel cease fire in the Gaza Strip. We demand that the European Union abandon its support for Israel in this war.

“We know that the participants of Delphi Economic Forum are returning home on 23 May via flight FR4978. A bomb was planted onto this aircraft.

“If you don’t meet our demands the bomb will explode on 23 May over Vilnius. Allahu Akbar.”

(ICAO)

The email account was created nine days before the incident, using an internet protocol (IP) address that The Independent has traced to a provider in Stockholm.

The Belarusian authorities have produced a screenshot of the email they say they received, but not the original. They have declined to say how the security services became aware of multiple emails having been sent to several airports, when those airports were unaware of them.

As the plane continued on its planned northbound course, the air-traffic controller recommended that the plane should divert to Minsk for “security reasons”, even though Vilnius – the intended destination – and other airports were closer.

The captain asked: “This recommendation to divert to Minsk – where did it come from? Company [ie Ryanair]? Did it come from departure airport authorities or arrival airport authorities?”

The controller replied: “This is our recommendation.”

Bomb threats against aircraft are colour coded according to their assessed credibility.

Green: “No credible threat exists. Diversion not required. Continue to destination as planned.”

Amber: “Credibility uncertain. The flight will continue to the planned destination or divert to a suitable alternate.”

Red: “There is a credible threat and the PIC [pilot in command] should land at the nearest suitable airport as directed by ATC [air-traffic control] or the national authorities.”

Normally, Ryanair’s operational control centre in Dublin would assess the credibility of the threat. But even though the phone number was included in the flight plan, Minsk air-traffic control did not alert the airline and the pilots were unable to make radio contact.

The obvious course of action was to continue the flight to the intended destination, Vilnius, just 60 miles north. But the pilots were urged to divert to Minsk – more than twice as far away.

“Ryanair one-tango-zulu, they say code is red,” the air-traffic controller said.

The report says: “Pertinent information included in the bomb threat email was not passed on to the flight crew such as that specific reference to the flight number FR4978 had been made, the time of receipt of the message, the identified organisation/sender, and the reasons for placement of a bomb on board that specific flight.”

A “post-mortem security threat risk assessment” carried out by Ryanair officials “determined that the threat colour code would not have been red”.

In the absence of any further information, though, the pilots agreed to divert to Minsk – even though the only declared alternate airport for the flight was Riga in Latvia. Flight FR4978 turned east to Minsk shortly before it reached the Lithuanian border.

The Belarus Civil Aviation Authority insists: “The pilot-in-command took his own decision to land at National Airport Minsk without any pressure from Belarusian side.”

The captain made a passengers’ announcement (PA) telling the passengers of the diversion to Minsk. On hearing the news, Mr Protasevich reacted with horror. The report says: “Immediately after the PA, one of the passengers, stood up and shouted to one of the cabin crew that he could not land in Minsk as ‘I’m wanted there, they’ll kill me’.

“The passenger was not considered unruly or disruptive.”

Fifty-four minutes after the incident began, the plane arrived at Minsk and parked at stand number 1. It was 10.24am GMT. No terrorist incident was declared.

The crew were keen for everyone to be evacuated as quickly as possible, given the high threat alert. But, says the report: “The Minsk Airport Control Dispatcher explained that airport procedures take precedence, and passengers will only be permitted to disembark in groups of five.” The dispatcher explained that passengers and their cabin baggage had to be screened by explosive detection dogs, which could only take place in small groups.

This individual later claimed that cabin crew had asked for this to happen.

Passengers started getting off at 10.38am and finished at 11.14am – 50 minutes after the aircraft had arrived.

International aviation rules state: “If an aircraft lands following receipt of a bomb threat that has been assessed as amber or red, provision should be made to disembark passengers and crew with a minimum of delay, with their cabin baggage when circumstances permit.”

The baggage hold was opened 36 minutes after arrival, with explosive detection dogs going in five minutes later.

The captain remained on board while a Ministry of Internal Affairs aircraft search specialist team searched the plane. He later reported: “The search team was not thorough and omitted areas that would be covered under normal procedures.”

Seven hours after the first message, the passengers were allowed to board.

The report says: “Once boarding of passengers was completed, cabin crew conduct a headcount of passengers and establish that five passengers are missing.

“No explanation was provided to the Ryanair crew by the Minsk airport ground staff.”

The ICAO report states the claims made by Belarus officials, that “five passengers wished to remain in Minsk” and “all five passengers crossed the border unescorted, on their own initiative”.

Two of the missing passengers were the dissident journalist, Roman Protasevich, and his girlfriend Sofia Sapega. They had been arrested by the authorities. CCTV footage of the disembarkation was not made available, with officials claiming the relevant parts had been overwritten.

A third passenger is believed to have been a Greek passenger whose final destination was Minsk and was simply taking advantage of the diversion.

Ryanair’s chief executive, Michael O’Leary, said he had no doubt about the identity of the other two: “It appears the intent of the authorities was to remove a journalist and his travelling companion. We believe there were some KGB agents offloaded at the airport as well.”

While the ICAO report says it is missing vital information from Belarus that would allow it to draw firm conclusions, Mr O’Leary said: “This was a case of state-sponsored hijacking, state-sponsored piracy.”

The Ryanair boss was backed by the International Federation of Air Line Pilots’ Associations and the European Cockpit Association.

They issued a joint statement saying: “This unprecedented act of unlawful interference will potentially upend all the assumptions about the safest response to bomb threats on flight and interceptions.”

Mr Protasevich, an implacable opponent of the Belarus president Alexander Lukashenko, is believed to be under house arrest, and his girlfriend Sofia Sapega faces six years’ imprisonment.