The threat posed by aviation insiders has long been a significant concern to the industry for a multitude of reasons. First, the access and knowledge with which employees are entrusted are vital to the smooth running of operations, yet that trust may be exploited in a variety of ways, with potential repercussions ranging from operational disruption, through financial and reputational impacts, to loss of life and assets. In addition, the difficulty of effectively detecting and addressing insider issues, particularly in larger, divisionally structured entities that depend on multiple third-party service providers – common in the aviation industry – contributes to the complexity of the issue.
Insider Motivations
Insiders may be employees, contractors, consultants, agency or temporary staff – essentially anyone with privileged access or knowledge. Such individuals may have a variety of motivations, the most common being financial gain. This means certain socioeconomic factors, such as high rates of inflation, may influence a worker's decision to participate in corrupt behaviour. More malicious motivations include revenge against an employer and political ideologies.
Types of Insider Activity
Insiders may exploit their position to smuggle restricted items, substances or people into secure areas, share sensitive data, including details of security procedures, or facilitate the infiltration of both physical and cyber spaces with malicious entities. The following sections summarise insider threats impacting the aviation industry and offer illustrative examples extracted from Osprey's global database of aviation security incidents from between January 2024 and May 2025.
Airport staff links to terrorist groups
In 2024 and the first half of 2025, multiple airport staff were dismissed from their positions due to allegations of links to violent non-state actor (VNSA) groups. For example, in May 2025, Osprey reported that "dozens" of aviation workers stationed at Beirut Rafic Hariri International Airport (OLBA/BEY), Lebanon, had been dismissed on suspicion of conspiring with Iranian-backed VNSA Hezbollah and facilitating the smuggling of resources, including gold and weapons, via the facility. Additionally, in October 2024, senior immigration and security officials at Mogadishu Aden Adde International Airport (HCMM/MGQ), Somalia, were dismissed from their positions amid allegations of connections to an irregular migration network and VNSA al-Shabab.
Trafficking of drugs, precious metals, weapons and other controlled items/substances
The smuggling of drugs, precious metals and other controlled items and substances by aviation insiders is a global and frequently reported issue. Various methods are employed by insiders in order to evade or assist others in evading controls. In an unusual incident in early November 2024, Pakistan's Federal Board of Revenue (FBR) launched an inquiry into seven customs officers stationed at Islamabad International Airport (OPIS/ISB) for facilitating the smuggling of military-grade thermal imaging and night vision equipment into Pakistan from the UAE and China. During 2024 and the first half of 2025, Osprey also recorded insider-facilitated narcotics trafficking at airports in multiple countries. These included France, Germany, Netherlands, Portugal and Spain in Europe; Argentina, Bolivia, Brazil, Colombia, French Guiana, Guyana, Paraguay and Peru in South America; Mexico and the US in North America; the Maldives and New Zealand in the Asia-Pacific region; Kuwait in the Middle East; and Ghana, Guinea-Bissau, Morocco and Nigeria in Africa. High levels of insider-facilitated gold smuggling have also been recorded at multiple airports in India, with such incidents also recorded in Lebanon, Libya, Morocco, Niger and Uganda.
Human trafficking/migrant smuggling
The facilitation by insiders of irregular migration, including human trafficking, is also a significant issue. Incidents have been identified involving immigration officials being bribed by criminal networks to allow migrants/human-trafficking victims to enter the country without checking their visas or stamping their passports. Others have been detected providing both genuine and fake travel documentation, such as residency permits and visas, and stamping migrants' passports in exchange for bribes without recording their entry into the country. Since the start of 2024, such activity has been tracked by Osprey in a range of countries, including Colombia, Haiti, India, Malaysia, Nepal, Pakistan, Peru, Somalia, the UK and Zimbabwe.
Passenger extortion
Osprey has also recorded multiple incidents involving airport workers extorting or soliciting bribes from passengers, particularly in West African countries as well as Latin America. Between the start of 2024 and May 2025, Osprey issued alerts on such incidents in multiple locations, including various airports in Mexico as well as in Madagascar, Nigeria and Colombia. In a notable incident in Israel in May 2025, a Population and Immigration Authority employee working as a border controller at Tel Aviv Ben Gurion International Airport (LLBG/TLV) was arrested on suspicion of demanding sexual favours from women in exchange for entry to Israel.
Theft
Theft from luggage, freight and cargo by ground handlers has been widely reported in 2024 and thus far in 2025. Luggage theft by insiders has been recorded by Osprey in locations including Algeria, Argentina, Bolivia, Colombia, India, Indonesia, Peru, Spain and Sri Lanka. Aviation workers have also been recorded stealing from their employers. For example, at Harare Robert Gabriel Mugabe International Airport (FVRG/HRE), Zimbabwe, in January 2025, an airline employee was accused of stealing fuel from a grounded aircraft undergoing maintenance, and in March 2024, an airline in Chile filed a criminal complaint for the alleged theft of "at least" 13 iPads from safes on aircraft.
Physical attacks
Insider access may be abused to conduct a physical attack against a facility, aircraft or people. Such an attack may be conducted or facilitated by a VNSA group member who has infiltrated the facility, by an employee who has been duped, bribed or otherwise coerced, or by a "lone wolf" with political or emotional motivations or who is suffering from mental health issues. While such incidents are rare, and none were publicly reported recently, they are a serious concern given the potential for a catastrophic incident. Such an attack could involve the insider introducing weapons or explosives into a security restricted area, as occurred in the 2016 attack on a Daallo Airlines flight from Mogadishu Airport. During this incident, a senior security official carried an improvised explosive device concealed in a laptop through security and handed it to a passenger, who detonated the device on board and was the only fatality; the attack was claimed by al-Shabab.
In a separate example highlighting the impact of financial hardship on aviation employees' decisions to engage in sabotage, in July 2019, an American Airlines employee glued a piece of foam inside a navigation system on an aircraft at Miami International Airport (KMIA/MIA), resulting in an error message being generated and the aircraft aborting its take-off. At the time of his arrest, he was reportedly upset and suffering financially due to stalled contract negotiations between the airline and unions. He claimed he did not intend to cause any harm, but rather to delay the flight to provide overtime work for himself – work he subsequently did. In March 2020, he was sentenced to three years' imprisonment after pleading guilty to sabotaging the aircraft. No evidence was found of any terrorist links after allegations of such connections had arisen in September 2019.
Cyber attacks
As the industry becomes ever more reliant on technology for every aspect of operations, exposure to cybersecurity incidents in aviation, including data theft and operational disruption, have also increased. From an insider threat perspective, concerns include the use of systems access to steal data – potentially including confidential or sensitive customer and employee documents – as well as the provision of access to third parties and the introduction of malware into a company's network via an external storage device such as a USB drive. Employees may be bribed or extorted in order to facilitate or conduct such an attack, and recently dismissed and disgruntled employees may use their network access before their credentials are revoked as part of the termination process. Osprey frequently highlights incidents in which aviation has been targeted by cyber criminals. While none in 2024 or the first half of 2025 were publicly reported to have involved insiders, such attacks have previously occurred. For example, in 2020, a 26-year-old former instructor of a flight training school in Florida, US, accessed the school's systems after her father was dismissed from the company and changed the status of aircraft that had been flagged due to maintenance issues, essentially clearing them for flight.
Conclusion
Conflict and political instability contribute to unstable economies and increased rates of inflation, which can drive corrupt behaviour, as well as increased levels of irregular migration, which can in turn provide opportunities for exploitation by corrupt airport workers. Amid increased political tensions in the Middle East, Europe and various locations in Africa as well as economic instability prompted by US sanctions, tariffs and withdrawal of international aid, Osprey recommends that airlines, airports, agencies and other companies that operate in the aviation environment ensure that appropriate procedures are established to manage the threat. ICAO has developed its Insider Threat Toolkit to assist aviation organisations in mitigating the threat. It includes information on implementing background checks and vetting procedures, training and awareness, and reporting mechanisms. Osprey also closely monitors the industry for insider incidents, providing up-to-date data via its system and in-depth analysis to clients via alerts.
