Aviation law, conflict and the limits of government accountability
By Sagar Singamsetty | European Defence Insights
Civil aviation has always depended on an assumption that is easy to state and difficult to protect that ‘the skies above us can remain a space for peaceful movement, even when the world below is divided by conflict’. In recent weeks, that assumption has been tested in three very different ways. A flydubai co-pilot is alleged by Israeli officials to have tried to crash an aircraft bound for Tel Aviv. EASA has told European airlines not to fly through part of Saudi airspace after repeated missile and drone attacks. And in Germany, an explosive-laden drone struck a parked freighter at Leipzig/Halle Airport, while unidentified drones keep closing airports from Berlin to Luxembourg.
These are not isolated stories about aviation safety. Taken together, they expose a deeper question that governments, regulators, airlines, airport operators and defence planners can no longer avoid. When a threat to civil aviation is known, or should reasonably have been known, what responsibility do public authorities have to act? And when they fail to act, or act too late, who is accountable?
As someone who works across aviation law and policy, I find the most troubling part of these incidents is not the immediate danger they created. Emergencies are, by definition, difficult. What concerns me more is the recurring gap between the legal framework that exists on paper and the institutional response that unfolds in practice. International aviation law is not silent on these risks. The question is whether it is being applied with the urgency they now demand.
The defence dimension is equally clear. Civil aviation is no longer separate from Europe’s security architecture. Airports, air navigation systems, airline operations and the airspace around them have become part of a broader contested space where hybrid pressure, critical infrastructure protection, air defence and civil-military coordination intersect. A drone over an airport may be a criminal act. It may also be reconnaissance, a test of response times or a deliberate attempt to create uncertainty. In August, at Leipzig, it was an attack. In each case, the security response cannot be left to aviation authorities alone.
The law is clearer than its application
The legal foundations are well established. Under Article 1 of the Chicago Convention, every State exercises complete and exclusive sovereignty over the airspace above its territory. Article 28 requires States to provide airports, air traffic services and other facilities in line with international standards. Annex 17 requires each State to maintain a national civil aviation security programme to safeguard civil aviation against acts of unlawful interference. Article 3 bis restricts the use of weapons against civil aircraft in flight, even where an aircraft enters another State’s airspace without authorisation.
In other words, the international system already recognises that civil aircraft should not become collateral damage in a conflict, and that States carry responsibilities for the airspace and infrastructure they control. ICAO has also repeatedly emphasised that conflict zones create risks for civil aviation, including missiles, drones, satellite navigation interference, military air defence systems and the danger of misidentification.
Two cautions are needed. First, the governing standard is due diligence, not guarantee. A State is not required to eliminate every risk. The legal question is whether, once a risk was known or reasonably foreseeable, it took proportionate steps, communicated what it knew and can explain its decisions. Second, the framework has edges. Article 3 bis concerns aircraft in flight, so it says little about a drone striking an aircraft parked on an apron. That case falls to the conventions on unlawful acts against civil aviation and to general international law, which is a very different legal conversation.
Yet legal principles do not protect aircraft. Institutions do. A State may have sovereignty over its airspace, but sovereignty is meaningful only if it is accompanied by timely risk assessment, credible intelligence sharing and the willingness to restrict operations when the security environment deteriorates.
This is where the debate should move. The issue is not whether governments can guarantee completely safe skies. They cannot, and no serious aviation lawyer or regulator would suggest otherwise. The issue is whether, when a threat is foreseeable, governments identify it, communicate it, act proportionately and remain accountable for the decisions within their control.
Saudi Arabia: when the conflict zone moves closer
Saudi Arabia has become the latest reminder that airports are not simply transport facilities. They are critical infrastructure. They connect people, economies, humanitarian operations and supply chains. When missiles or drones threaten an airport, the consequences extend well beyond the immediate target to approaching and departing aircraft, ground staff, passengers and the wider air traffic network.
EASA’s Conflict Zone Information Bulletin CZIB-2026-09, issued on 30 September and valid until 16 November, reflects this reality. It tells EU operators not to operate within a defined portion of the Jeddah Flight Information Region, and to exercise caution, keep risk assessments current and maintain contingency plans in the rest of it. The agency’s concern is specific. As a consequence of the military conflict between the United States and Iran, the Houthis have significantly increased the frequency and geographic reach of their attacks in September, and aviation-related infrastructure across Saudi Arabia has been repeatedly targeted by missiles and drones. EASA warns of misidentification of civil aircraft, interception activity and falling debris.
One detail deserves attention. The bulletin names Tabuk among the areas deeper inside Saudi territory that the Houthis have shown the ability and intent to strike. The flydubai aircraft that came under attack in its own cockpit on the same day made its emergency landing at Tabuk. The two events are unrelated, but together they show how thin the margin can be when an aircraft in distress has few places to go.
The bulletin is necessary, and EASA is fair to note that Saudi Arabia has shown it can manage its airspace effectively, including through tactical deconfliction and emergency security control measures. But it also illustrates an uncomfortable question. How early did the aviation system recognise that the threat was expanding, and how quickly did that recognition turn into guidance for the airlines that needed it? An advisory is only as valuable as its timing.
For defence planners, the Saudi case carries a wider lesson. In a militarised airspace environment, civil air traffic management and military air defence cannot operate as separate worlds. Civil aircraft need timely warning of missile activity, drone threats, interception risks and air defence deployments. Military authorities, in turn, need a clear understanding of civilian traffic patterns and the consequences of any action taken in shared airspace.
Closing airspace is costly. Airlines lose routes, passengers lose time and economies feel the disruption. But keeping airspace open cannot become the default position simply because closure is inconvenient. When credible intelligence points to missiles, drones or air defence activity near civilian traffic, governments must be able to explain why they considered the risk acceptable.
Commercial continuity is not a safety case. It never has been.
Drones: Europe’s low-cost security crisis
Europe’s drone problem may appear less dramatic than a missile attack, but in strategic terms it may be more revealing. A drone does not need to strike an aircraft to shut down an airport. It only needs to appear.
Luxembourg discovered this in September, when unauthorised drone sightings forced the suspension of operations at the country’s only international airport. Nineteen flights were diverted and more than 1,800 passengers were affected. Three days later, the airport closed again for roughly 52 minutes, and the government introduced a temporary nationwide drone ban and an expanded restricted zone. No operator has been identified, and the prime minister has cautioned that attributing the activity to any state actor would be speculation.
Luxembourg is not an outlier. Air traffic controllers at Berlin Brandenburg logged 28 drones in the first half of 2026, more than at any other German airport, and had to suspend arrivals and departures on seven occasions. Another sighting briefly halted operations on 23 September. For comparison, controllers recorded eight in all of 2025.
Then came Leipzig. On the night of 4 August, a small drone carrying an explosive charge flew at a parked Ukrainian Antonov An-124 at Leipzig/Halle Airport and struck its wing. The device did not detonate. A second drone with explosive traces was found in the cargo area, where a DHL cargo aircraft collided with an unidentified object over the airport the same night and diverted to Hanover with minor damage. On 1 September the German government formally attributed the attempted attack to Russia, which denies responsibility. Attribution of this kind is rare, and it changes the character of the question. A drone incident that was a matter for airport operators and the police becomes a matter of State responsibility, defence policy and diplomacy.
For defence planners, the more important question is not whether each drone was hostile. In most cases, authorities may never establish that. The question is what these incidents reveal about Europe’s ability to detect, identify, attribute and respond to unauthorised activity in sensitive airspace.
A drone incursion can serve several purposes without ever causing physical damage. It can test detection systems. It can expose gaps in command arrangements. It can force the closure of critical infrastructure. It can consume police, intelligence and military resources. And it can create uncertainty among airlines, passengers and governments. In hybrid conflict, uncertainty is not a byproduct. It can be the objective. Leipzig shows that it can also be a prelude.
This is why airports can no longer be treated only as civilian transport hubs. They are critical infrastructure, and they sit within a wider airspace security architecture that includes civil aviation authorities, police, intelligence services, border agencies and national air defence forces. When a drone appears near a major airport, the response cannot rest with air traffic control alone.
The European Commission’s February 2026 Action Plan to counter drone threats recognises this shift. It proposes a Counter-Drone Centre of Excellence, a certification scheme for counter-drone systems, an EU drone incident platform, and a yearly large-scale counter-drone exercise to stress-test cross-border and civil-military cooperation. It also says the European Commission will look into creating rapid counter-drone emergency response teams.
That direction is right, but two points deserve emphasis. The plan itself states that Member States remain primarily responsible for responding to drone threats, and that it focuses on the civilian internal security dimension. In other words, accountability for what happens at the airport fence stays national. And capability on paper is not the same as capability at the fence. Europe needs clear rules on who may act, tested procedures for civil-military coordination, better sensor coverage and the ability to distinguish a hobbyist drone from a hostile platform in real time.
Europe does not need another debate about whether the drone threat is serious. It needs to decide who acts, how quickly, and with what authority.
Flydubai: the threat inside the aircraft
The flydubai incident presents a different dimension of the same challenge. According to Israeli officials, a co-pilot stabbed the captain and tried to crash the aircraft during flight FZ1073 from Dubai to Tel Aviv on 30 September. Passengers and crew intervened, and the aircraft landed at Tabuk in Saudi Arabia. Flydubai has said the motives remain subject to formal investigation, and it has suspended its flights to and from Israel in the meantime. These remain allegations, and the investigation will determine what happened, who knew what, and whether warnings were missed.
It would be wrong to assign legal responsibility before those findings are complete. But the case already reveals an uncomfortable structural reality.
An airline may be registered in one country. Its crew may come from several. Its passengers may hold dozens of nationalities. Its route may cross politically sensitive airspace. And the security information relevant to one individual may sit with an authority in another jurisdiction altogether. The legal roles are just as divided. The State of landing, here Saudi Arabia, holds custodial and prosecutorial responsibilities under the aviation security conventions. The State of the operator, the State of destination and the States of nationality of crew and passengers each hold a different part of the picture.
Aviation security is only as strong as the weakest link in that chain.
Nationality is not a security assessment. Formal screening is not the same as effective screening. And compliance with procedure does not answer the harder question: did the system have information that should have prevented this person from sitting in a cockpit? Aviation has asked this before, after Germanwings in 2015, when regulators looked at psychological evaluation, peer support and the two-person cockpit rule. The flydubai investigation may reopen that discussion.
The legal distinction will matter. Was this an unforeseeable act by an individual? A failure by the airline? A failure by a State authority to share or act on information? Or a systemic breakdown across several institutions? The answers will shape criminal cases, regulatory action, civil claims and public trust. They should also shape reform.
From incident response to prevention
The common failure across these cases is fragmentation.
Civil aviation authorities see operational risk. Intelligence agencies see threats. Police see crime. Militaries see defence. Airlines see commercial exposure. Everyone holds part of the picture, but too often no one holds all of it.
Governments should stop treating aviation security as a series of post-incident investigations and start treating it as a preventive system. That requires aviation-relevant intelligence to move through secure and established channels, with clear thresholds for urgent warnings and operational restrictions. It requires conflict zone assessments to be dynamic, because a route that was safe last week is not automatically safe today. It requires airports to have integrated counter-drone arrangements, including detection, attribution, decision-making authority and lawful mitigation capabilities. And it requires investigations to produce accountability, not simply reports.
When a failure is identified, the public should know what went wrong, what has changed and who is responsible for ensuring that it does not happen again. Transparency has limits in security matters. But secrecy cannot become the default answer to institutional failure.
The test of government responsibility
No government can promise completely safe skies. Aviation is inherently international, complex and exposed. But governments can be judged on something more basic: did they see the risk, communicate it, act on it and explain their decisions?
The defence question is no longer whether civilian aviation can be attacked. It has been. The question is whether Europe can detect, understand and respond to threats in its own airspace before they become a crisis. Airports are part of that answer. So are intelligence services, police forces, air navigation providers, militaries and the industries that build the sensors, command systems and counter-drone capabilities required to protect them.
When a missile threatens an airport, a drone closes a runway or a crew member turns on the cockpit, the immediate response is operational. The real test comes earlier, in the intelligence that was shared, the risk assessment that was updated, the capability that was deployed and the decision that was taken before anyone had to be rescued.
The credibility of aviation security will not be measured only by how governments respond after an incident. It will be measured by what they did when they still had the chance to prevent one.
