On 30 September 2026 the co-pilot of Flydubai flight FZ1073, from Dubai to Tel Aviv, attacked the captain in the cockpit and tried to take the controls. We asked one question: was there public information online, before he was hired, that a background check would have found, and did it carry warning signs?
We fixed the list of indicators before searching. We tested two dates: his hiring by Flydubai in February 2026, according to the Wall Street Journal, and the day of the attack. We ran 28 Google searches limited to pages dated before the hiring date, to see what a check run at the time would have returned. The search covered English and Arabic, including archives of deleted content.
What was online before he was hired
We found none of the pre-set indicators of violent radicalization. The violent material appeared about nine hours after the attack.
But the Internet Archive preserved about 3,000 tweets from a deleted X account of his, from 2021 and 2022. Under ProfCheck's method, they carry four negative behavioural indicators:
• Demeaning women.
• Hostility to foreigners.
• Imposing religious norms on others, with support for violent punishment.
• Deliberate deception with fake identities.
How a check gets there
Sixteen name searches, in English and in Arabic, surfaced none of his pages from before the hiring date. A search by his username surfaced his accounts in the first results.
The username appears on a mirror page that carries his name in Arabic, and on his LinkedIn page. An analyst who reads Arabic and checks every result gets there. An automated name screen does not.
Reading in the language matters in the other direction too. The word "حماس" appears in his tweets twice, and both times it means "enthusiasm". A keyword filter would flag it as a finding. A reader who sees the context would not.
Where the strongest warning signs were
According to what has been reported so far, the strongest warning signs were not online:
• According to the Wall Street Journal, ABC and CNN, Oman removed him from flight duties over extremist views or extremist material.
• Royal Air Maroc said he completed theoretical training as part of a pre-employment process, and his application was not selected. His LinkedIn profile presented it as about seven months of employment.
• According to a Gulf diplomat, the checks before he was hired focused on criminal convictions, not on signs of radicalization.
• According to the Wall Street Journal, no one asked Oman about him.
But in my view, this is the central lesson of the case: a criminal-record check is not a background check. A contradiction between a candidate's profile and a former employer's answer is a standard employment verification finding, and here it was within reach.
Our conclusion: under ProfCheck's method, the archived tweets alone carry four negative indicators. Together with the offline facts, a ProfCheck report on the hiring date would have given the employer clear grounds not to hire him as a pilot. The report does not recommend or disqualify; the decision stays with the employer.
What this means for employers
In practice, this means, among other things:
• Search in the candidate's language and by username, not only by the name in English.
• Include archives in the check. Deleted content is not necessarily gone.
• Have every result read in context by someone who reads the language.
• Verify employment with former employers, including changes of role and the reason for leaving, and compare the answers with the CV and the profile.
• Treat conduct as a finding, and keep association out. Family, nationality, religious practice and political opinion are not indicators.
• Check again after hiring, in roles with access to aircraft, sites or systems.
It is important to note: the person this case discusses is a suspect. As of 4 October 2026 he had not been charged in court or convicted, and no authority had officially confirmed his identity. The review used public sources only.
Another case study using the same method, on the recording device in OpenAI's executive boardroom: https://profcheck.co/knowledge/case-study-openai-recording-device/