More than 25 flights across Europe have been targeted by hoax bomb threats in recent days, forcing diversions, scrambling fighter jets and delaying thousands of passengers, as the airline industry warns that some of the biggest threats to aviation security are now coming from well beyond the airport checkpoint.

From rogue drones and cyberattacks to satellite interference, Europe’s aviation network is facing an increasingly complex security challenge, prompting the International Air Transport Association (IATA) to demand closer cooperation between governments, airports and airlines.

Speaking at the Global Tourism Forum Annual Meeting 2026 in Brussels, IATA senior vice-president for operations, safety and security Nick Careen warned that traditional security checks, although essential, were no longer sufficient to protect passengers and the wider transport network.

For decades, aviation security has concentrated on screening passengers, baggage and cargo before they enter the secure airport environment. However, Careen warned that “some of the most serious threats aviation faces today will never walk through a security checkpoint”.

He pointed to a series of incidents that have exposed how vulnerable Europe’s aviation network remains to disruption.

In December 2018, reported drone sightings shut down London’s Gatwick Airport runway, affecting around 1,000 flights and more than 140,000 passengers.

In 2024, interference with global navigation satellite systems (GNSS) forced Finnair to suspend flights to Tartu in Estonia.

Then, in September 2025, a cyberattack targeting a check-in system provider disrupted several European airports, including Brussels.

The latest incidents involve more than 25 flights targeted by emailed hoax bomb threats, with aircraft diverted, fighter jets scrambled and thousands of passengers delayed.

For Careen, the incidents have one important feature in common. They demonstrate that protecting passengers now depends on far more than conventional airport security.

The problem is also one of communication. According to Careen, most of the recent hoax threats were not sent directly to airlines but to airports and ground service providers, meaning the organisations best placed to assess their credibility were often not the first to receive them.

He argued that governments and industry must establish permanent arrangements for sharing threat information, coordinating decisions and restoring services safely after disruption, stressing that “no single organization can protect the journey on its own”.

Airlines do not control airspace, he explained, while airports may detect a drone without having the authority to stop it.

The scale of the drone problem is becoming increasingly difficult to ignore.

According to figures presented by IATA, more than 200 drone incursions were reported within NATO airspace between January 2025 and October 2026, affecting at least 21 of NATO’s 30 European members.

The European Commission introduced an action plan in February 2026 to address drone threats affecting airports, ports and other critical infrastructure, a move welcomed by the association.

However, Careen stressed that the practical questions surrounding an airport closure remained unresolved, particularly who takes charge, who informs airlines and who decides when flights can safely resume.

Airlines, he pointed out, are left dealing with the financial consequences of diversions, cancellations and stranded passengers.

Although national security remains the responsibility of governments, IATA believes airlines must be involved in decisions affecting their operations, with the costs of disruption shared more fairly.

Careen made clear that the association was not seeking to assume the responsibilities of national authorities, explaining that “we are not asking for airlines to take over the job of the police or national security services”. Instead, he stressed that “we are asking that the people running the flights are part of the decisions that affect them”.

The same need for coordination extends to conflict zones, where sudden airspace closures can force airlines to alter routes with little warning.

Following the downing of Malaysia Airlines flight MH17, the EU established a framework bringing together governments, European institutions and the European Union Aviation Safety Agency to assess conflict-zone risks and issue warnings to airlines.

Careen acknowledged the value of that arrangement but stressed that warnings must reach operators quickly and clearly enough for them to respond.

Beyond information-sharing, IATA is calling for a more risk-based approach to aviation security, warning that adding further regulations after every incident does not necessarily make flying safer.

Careen argued that “threats are changing faster than the rulebook”, with multiplying security requirements potentially diverting attention and resources from the most serious risks.

The recent bomb hoaxes illustrate the problem.

Airlines already have established procedures for assessing whether threats are specific and credible, and for determining whether an aircraft search or another response is necessary.

However, when a threat reaches an organisation without an established assessment process, disruptive measures can be triggered before the airline has had an opportunity to evaluate the risk.

Careen warned that “a hoax takes little effort”, while the consequences could cost passengers, airlines and governments a great deal. He cautioned that “if every anonymous email triggers the maximum response, we risk giving those responsible the outcome they seek”.

IATA therefore wants governments and regulators to recognise airlines and airports that demonstrate effective risk-based security management, rather than concentrating solely on whether every regulatory requirement has been followed.

Security Management Systems, Careen explained, allow operators to identify threats and vulnerabilities, assign responsibilities and continually assess whether their protective measures are working.

He also called for industry consultation before new security requirements are introduced, particularly when measures could create unintended difficulties for passengers and airport staff.

Another concern is the duplication of security checks across Europe’s airports.

Under the EU’s One-Stop Security arrangements, screening carried out in certain countries, including the United States and Canada, is recognised as meeting equivalent standards.

This allows eligible connecting passengers and their baggage to avoid undergoing the same screening procedures again when transferring through European airports.

Careen argued that Europe should build on the arrangement, reduce unnecessary additional requirements imposed by individual member states and seek reciprocal recognition with trusted international partners.

He stressed that “different doesn’t mean less secure”, arguing that security should be judged by its effectiveness rather than whether every country follows identical procedures.

The debate also extends beyond airport checkpoints to Europe’s increasingly digital border systems, which IATA believes must be capable of handling large passenger volumes without creating further delays.

Careen raised particular concerns about the EU’s Entry/Exit System (EES), warning that persistent outages, inadequate infrastructure and lengthy processing times were still causing problems in several member states.

Although the system is designed to modernise border controls, he argued that it must function effectively when thousands of passengers arrive simultaneously, not simply during testing.

IATA wants authorities and the aviation industry to agree clear performance standards before the winter travel season, including acceptable and maximum waiting times.

Careen also called for flexibility to remain available until the system demonstrates consistent reliability and normal services have been restored.

Meanwhile, the forthcoming European Travel Information and Authorisation System (ETIAS) presents another challenge, as airlines will need reliable access to passenger authorisation information before allowing travellers to depart.

Digital identity could offer a way to simplify the journey, according to IATA, particularly by reducing the need for passengers to repeatedly present passports and boarding passes.

The association’s latest Global Passenger Survey found that 78 per cent of respondents were willing to use digital biometrics.

However, Careen warned that the EU’s proposed Digital Omnibus legislation could restrict their use, despite the benefits biometric technology could offer passengers, airports and airlines.

He stressed that passengers should retain the choice between using digital identification and conventional physical travel documents.

Done properly, he argued, digital identity would allow travellers to establish who they are once, rather than repeatedly throughout their journey.

The implications extend beyond aviation, with maritime transport and other critical infrastructure facing many of the same threats from cyberattacks, drones and disruptions that cross national boundaries.

Careen urged the different transport sectors to learn from one another rather than confront the same security problems separately.

His message to European governments centred on three priorities: stronger cooperation and information-sharing, a more risk-based approach to security and mutual recognition of measures that already meet equivalent standards.

For an industry whose success depends heavily on public confidence, the consequences of getting those decisions wrong could extend far beyond individual airports.

Careen finally warned that “Europe doesn’t lack security rules”, but that today’s threats move faster than regulations and cross established boundaries. His concluding message was equally clear, stressing that “the time to put these measures in place is before the next incident, not after”.