Two flights bound for Rome Fiumicino were named in a hoax bomb threat emailed on the morning of Thursday 5 November 2026 and signed by the "Fighters of the Male State"12. The name points to Muzhskoye Gosudarstvo, a Russian ultranationalist movement that is banned in Russia34. The flights were Finnair AY1761 from Helsinki and Aer Lingus EI402 from Dublin15. Italian Eurofighters escorted the Finnair aircraft to Fiumicino, while French fighter jets took the Aer Lingus aircraft to an air base at Évreux67. No explosives were found on either aircraft87. Rome's airport authorities told the BBC that the email came from a group called "Fighters of the Male State", and an airport spokesperson confirmed to CNN that the published screenshot of the email was authentic52. Italian investigators have not yet named the sender9.

What happened to AY1761 and EI402

The Finnair flight landed at Fiumicino at around 09:30, escorted by two Italian Air Force Eurofighters that had taken off from Grosseto106. Police bomb disposal experts then checked the aircraft under the standard security procedure10.

The Aer Lingus Airbus A320 had left Dublin at 06:24 local time with 151 passengers and six crew on board17. As a precaution, the French authorities decided not to let it overfly the Paris region7. A Mirage 2000-5 and a Rafale from Saint-Dizier escorted it to Air Base 105 at Évreux7. After security checks, passengers were taken to a gymnasium on the base and later collected by coach7. The Évreux prosecutor's office confirmed that no explosives were found on board7. Aer Lingus said the diversion to Normandy was a security precaution and that it would rebook passengers to their final destination as soon as possible1.

The email and the name behind it

Early in the morning the email reached Aeroporti di Roma (ADR), which runs Fiumicino and Ciampino, as well as other companies at Fiumicino48. It was written in Italian4. It claimed that explosive devices had been planted on AY1761 and on the Dublin flight, and that "the explosion will take place in 60 minutes"1. The senders attacked what they called a "feminist regime"16. According to Il Fatto Quotidiano, the sender used an address on a domain that guarantees anonymity, probably hosted abroad8.

The International Centre for Counter-Terrorism (ICCT), a think tank, says the Male State was created in Russia in 20162. A court in Nizhny Novgorod declared it extremist and banned it in October 20214. Rome's airport authorities say the email came from a group called Fighters of the Male State52. Whether its senders belong to the movement described by the ICCT or only use its name is not known4. Avvenire also raised the possibility of a false flag operation6. The Italian police have not yet named the sender9. Italy's airport police (Polaria) and the Polizia Postale are investigating, and their first reports go to the prosecutors' offices concerned9. The threat messages appear to have come from compromised addresses or anonymising services such as Proton Mail9.

What the crew do after a bomb threat

On Thursday the threats naming the Rome flights and several flights arriving at Milan Malpensa were received on the ground, by ADR in Rome and by an office at Malpensa84. At Malpensa, police informed the crews of three flights, and passengers left the aircraft at a secure location for the checks4. According to SKYbrary's guidance for controllers, a flight crew that receives a threat assesses the situation and, depending on the phase of flight and position, decides how to continue11. Controllers can expect an immediate request for a lower flight level and for details of suitable aerodromes, such as the runway in use, runway length and approach aids11.

Sri Lanka's civil aviation authority, implementing ICAO Annex 6, Part I, Chapter 13 on security, requires operators to carry a bomb search checklist on board in case of suspected sabotage12. It must be supported by guidance on what to do if a bomb or suspicious object is found and by information on the least-risk bomb location (LRBL) for that aircraft type12. Crew security training must cover aircraft search procedures and the LRBL where practicable12. According to the FAA, the ICAO Security Manual, a restricted document, provides information on the LRBL and guidance on what to do when a suspect item is found on board13. SKYbrary notes that the LRBL is usually next to an external door in the rear galley, and that the crew may decide to evacuate on the runway straight after landing11.

On the ATC side, SKYbrary describes the ASSIST principle as a recommended practice: acknowledge the threat, separate the aircraft and give it priority if needed, silence non-urgent calls, inform the units concerned, support the crew with the information they ask for and give them time11. After landing, SKYbrary advises tower controllers to arrange for the aircraft to be placed away from buildings and other aircraft11. For how this sounds on the frequency, see the Emirates 777 bomb threat at Warsaw.

Escorts, interception and the commander's authority

In 2016, The Aviationist reported that Grosseto was the Italian Air Force base on round-the-clock Quick Reaction Alert (QRA) for central and northern Italy14. On Tuesday 3 November, Italian Eurofighters had already escorted a Ryanair flight from Dublin to Fiumicino15.

Under the EU's Standardised European Rules of the Air (SERA), the pilot-in-command has final authority as to the disposition of the aircraft while in command (SERA.2015)16. EASA publishes these rules as Easy Access Rules17. When a civil aircraft is intercepted, SERA.11015 requires the pilot-in-command to follow the intercepting aircraft's instructions immediately, notify ATC if possible, try to call the interceptor on 121.5 MHz and select transponder code 7700 unless ATC instructs otherwise16.

The French prime minister's office said the EI402 captain had not cooperated as expected, after which the prime minister ordered fighter jets to intercept and escort the aircraft1. Évreux prosecutor Rémi Coutin said the captain had allegedly refused at first to land at a military airfield because he preferred a civilian airport118. France 3 reported that he mentioned Beauvais and Nantes7. Coutin has requested three separate investigations to clarify the captain's conduct7. The Irish captain is to be interviewed on a voluntary basis, without arrest, after which the prosecutor will decide whether to take him into custody7. Investigators also plan to interview the British first officer and to analyse the flight recorder data7. The prosecutor's office says the investigations are only at an early stage7.

Operational impact of this week's wave

Counts of Thursday's threats differ: CNN reported at least 14 aircraft affected, while Il Fatto Quotidiano counted more than 25 flights, including flights to Prague, Sofia, Bucharest, Vienna and Milan218. A LOT flight from Warsaw to Brussels, LO235, was among them182. ADR received a similar email signed by the Male State on Tuesday, IrishCentral reports1. On that day, at least seven flights across Europe were targeted by threats, according to Quotidiano Nazionale15. In February 2025, American Airlines AA292 from New York to New Delhi diverted to Fiumicino after an emailed threat and was escorted by two Italian fighters19.

Italy has activated international cooperation channels to trace the servers and IP addresses, and Europol says it is ready to support national authorities on request9. Italy's defence minister Guido Crosetto called Thursday's threats examples of "guerra sotto soglia", sub-threshold warfare, while EU transport commissioner Apostolos Tzitzikostas said it was "too early to draw conclusions on whether the reported incidents are linked"29. Denmark, Poland and Romania have accused Russia of hybrid attacks, and Russia denies waging hybrid warfare2. See also the Aer Lingus and Finnair airline profiles.