The Briefing — Issue No. 13

An axe in the cockpit of a Gulf airliner; MI5 warns universities about a Chinese spy front; Moscow names Europe's arms factories as targets

Monday 5 October 2026 · 6-minute read · Aviation Security · Counter-Intelligence · European Security

← All issues

This week's essentials

— A flydubai co-pilot allegedly attacks the captain with the crash axe at 33,000 feet; passengers and crew intervene and the aircraft lands in Saudi Arabia.

— MI5 issues a rare public alert naming a Chinese "research institute" as a front for the Ministry of State Security, after more than 100 UK-linked academics contributed to its projects.

— Moscow calls European factories producing arms for Ukraine "potential military targets", after Poland signals readiness to host Patriot interceptor production.

I.

A co-pilot, a crash axe and a dive from 33,000 feet

On 30 September, about two and a half hours after leaving Dubai for Tel Aviv, flydubai flight FZ1073 dropped from 33,000 to 17,000 feet in roughly a minute. In the cockpit, the co-pilot had allegedly attacked the captain with the crash axe, an emergency tool kept on board. Passengers and crew intervened and helped stabilise the aircraft, which made an emergency landing in Saudi Arabia, where the co-pilot was arrested. The Indian captain was treated in Abu Dhabi and is in stable condition.

The UAE has described the incident as an attempted terrorist act, although the investigation, involving four regional countries with Western support, has not concluded. According to sources cited by the Associated Press, the co-pilot is an Omani national who had been barred from flying in Oman over concerns about extremist views and moved to an administrative job, before being hired by flydubai. Standard checks reportedly focused on criminal convictions rather than signs of radicalisation. A Gulf diplomat said no links to militant groups had been found so far.

The case revives a question the aviation industry has faced since 2015, when a Germanwings co-pilot deliberately crashed his aircraft: how to detect a dangerous insider among people who are trusted, trained and alone at the controls. Background checks that stop at criminal records leave a gap, and information about a pilot's history does not always travel between airlines or countries.

Key terms — et leur équivalent français

co-pilot / first officer
copilote, officier pilote de ligne
captain
commandant de bord
crash axe
hache de secours (cockpit)
to divert ≠ to make an emergency landing
se dérouter ≠ atterrir en urgence
vetting ≠ background check
habilitation, enquête approfondie ≠ vérification d'antécédents
radicalisation
radicalisation
insider
personne de l'intérieur, initié
to bar (from flying)
interdire (de vol)

Source : ITV News, Associated Press, Khaleej Times

II.

MI5 tells British universities to cut ties with a Chinese "research institute"

On 30 September, MI5 issued a rare public espionage alert naming the China General Technology Research Institute (CGTRI) as a front for China's Ministry of State Security (MSS). According to the Security Service, the institute funded research by British academics in order to strengthen Chinese intelligence capabilities. More than 100 UK-linked academics have contributed to its projects, including work on artificial intelligence and cyber security that MI5 says directly benefited Chinese spies.

UK universities are "strongly advised to immediately review any ongoing or planned collaboration with CGTRI." Academics are urged to check the ultimate source of funding before entering partnerships with Chinese institutions, and to familiarise themselves with the National Security Act 2023, under which knowingly assisting a foreign intelligence service is a criminal offence. Security Minister Dan Jarvis wrote to every vice-chancellor, saying the alert "exposes attempts by Chinese intelligence to covertly benefit from the expertise and research of our academics."

The case illustrates a quieter form of espionage: no break-in and no stolen files, only legitimate-looking funding and open collaboration. Research security, long treated as an administrative matter in universities, is becoming a front line. In France, the equivalent framework is the protection of the scientific and technical potential of the nation (PPST), with its restricted-access zones (ZRR).

Key terms — et leur équivalent français

front (organisation)
structure écran, couverture
Ministry of State Security (MSS)
ministère de la Sécurité de l'État (renseignement chinois)
espionage alert
alerte d'espionnage
ultimate source of funding
origine réelle du financement
research security
sécurité de la recherche, protection du potentiel scientifique
vice-chancellor (UK)
président d'université
to covertly benefit from
tirer profit clandestinement de
due diligence
vérifications préalables, diligence raisonnable

Source : ITV News, MI5, Reuters

III.

Moscow calls Europe's arms factories "potential military targets"

Asked on 30 September about Poland's apparent readiness to host a factory producing Patriot interceptor missiles for Ukraine, Russian Foreign Ministry spokeswoman Maria Zakharova said that factories in Europe producing arms for Ukraine are "potential military targets for Russia." She added that "one should not assume that military factories outside Ukrainian territory" are safe, and that "anyone who thinks so is mistaken."

According to Zakharova, European countries that open arms factories and joint ventures for Ukraine are "fully involved" in the conflict. The statement does not announce any specific action, but it fits a pattern already described by European security services: Danish intelligence warned in early September that Russia was recruiting ordinary Danes through social media and gaming platforms to photograph defence sites, and German police have recorded more than 165 suspected acts of sabotage since January.

For defence manufacturers and their suppliers, the threat is less likely to take the form of missiles than of sabotage, arson, drones over sites, or the recruitment of insiders and local people for reconnaissance. Physical security, staff awareness and the vetting of contractors are now part of the defence-industrial effort.

Key terms — et leur équivalent français

interceptor missile
missile intercepteur
joint venture
coentreprise
legitimate target ≠ potential target
cible légitime ≠ cible potentielle
defence-industrial base
base industrielle et technologique de défense (BITD)
sabotage
sabotage
reconnaissance (of a site)
repérage, reconnaissance (d'un site)
arson
incendie criminel
contractor
sous-traitant, prestataire

Source : Reuters, Hromadske

Concept of the week

The insider threat

The insider threat is the risk posed by someone who already has legitimate access: an employee, a contractor, a researcher, a pilot. Insiders do not need to break in; they are already inside, trusted and often unsupervised. This week's three stories each show a version of it: a co-pilot alone with the captain, academics unknowingly working for an intelligence service, and local people paid to photograph the sites they live near. Technical controls help, but the decisive defences are human: vetting that looks beyond criminal records, colleagues trained to notice what does not fit, and a culture in which reporting a concern is normal. (Insider threat — menace interne.)

A new issue every Monday

The week's essentials in defence, security and intelligence, assessed from open sources: in English, with key terms translated into French.

Browse all issues