Inside the control room of Belarus’ hijacked Ryanair flight

Sometime between 9:50 a.m. and 10 a.m. on May 23, 2021, two men walked into the Minsk air traffic control center. 

They were there to deliver a message: There’s a bomb on Ryanair flight 4978 from Athens to Vilnius, which would soon be flying through Belarusian airspace.

Except, it was a lie.

The bomb threat prompted the pilots to follow mandatory safety protocols and land the Boeing 737-800 in Minsk. Once on the ground, two of its passengers — opposition journalist Roman Protasevich and his Russian girlfriend, Sofia Sapega — were arrested.

The incident sparked international outrage and saw Belarus hit with EU sanctions. European Commission President Ursula von der Leyen called it “outrageous and illegal behavior,” while Polish Prime Minister Mateusz Morawiecki called the incident “an unprecedented act of state terrorism” that could not go unpunished.

The U.N. aviation agency, the International Civil Aviation Organization (ICAO), responded by launching an investigation, finding in January of this year that the bomb threat was “deliberately false.” It then extended the probe in light of some “missing facts” and to examine new information.

Among that new information was testimony from the Minsk-based air traffic controller who guided the Ryanair pilot through the diversion to the Belarusian capital, and a recording he made on his phone of his conversation with the pilot.

The follow-up report, obtained by POLITICO, describes in minute detail what happened that day, implicating Belarusian officials.

In his interview with the U.N. agency, the controller, who remains anonymous in the report, recalls that two men entered Minsk’s control center about half an hour after he started his shift on that fateful Sunday. 

He identified one of them as Leonid Churo, the director general of Belaeronavigatsia, the country’s air navigation service provider. The other, he suspected, worked for Belarusian security services, still called the KGB.

The two men approached the duty supervisor, who then informed the controller and another colleague about a Ryanair passenger plane that was about to enter Belarusian airspace from Ukraine. 

The supervisor mentioned an alleged bomb threat against the flight, and that the plane should be diverted, but dissuaded the controller from informing Lviv control center in neighboring Ukraine.

Meanwhile, a flurry of emails were being sent to European airports, from Sofia to Bucharest, Athens and Minsk. Each bore the same message, claiming to be from “Hamas soldiers” and warning of a bomb that would go off above Vilnius if demands weren’t met. Hamas, a terrorist group, has denied involvement.

The play by play

The air traffic controller pulled out his phone to record his call with the Ryanair pilot, he said, because he feared that usual air traffic control messages might be destroyed.

The recording captures not just his conversation with the pilot, but the continuous input of the supervisor and suspected member of Belarusian security services as they coached him on what to say for the duration of the 39-minute conversation with the plane.

The transcript, shared with POLITICO, shows that the controller practiced the message he’d have to deliver to the pilots aboard Flight 4978 — a sign that what he was saying wasn’t spontaneous.

“We have information from special services that you have bomb on board. That bomb can be activated over Vilnius,” he told the Ryanair pilot.

But an aside captured by the phone recording underlined that what the controller was saying was stage-managed: “Say ‘for security reasons,’” the supervisor told the controller before he contacted the pilots.

The pilot was suspicious of what the controller told him, and asked for more information. “The bomb … threat message, where did it come from? Where did you find the information about it from?”

The suspected KGB officer and supervisor then fed lines to the controller. After a convoluted back-and-forth between the three men in the control tower, the controller was told to tell Ryanair that the threat came from the email, forwarded to the control room by the airport. The true origin of the emails is unclear. The ICAO report says the email to Minsk wasn’t sent until the plane had already started its descent to the airport.

The Ryanair pilot dug for more information about the email, before asking how he should divert the plane.

That led to yet another scramble to figure out how to respond in the control tower. “So tell me, what to say?” the controller asked the two men.

Eventually, the pilot asked: “I need to ask you a question, what is the code of the threat … is it green, yellow or amber or red”

“He’s asking, the code of the message is yellow or red?” the controller asked the two men.

An unidentified man says: “Well, let it be red, the red one.”

While the Ryanair pilot weighed up his next move, the transcript shows more frantic discussions in the control center as the plane was about to cross the border out of Belarus and enter Lithuanian air space.

The suspected security officer said: “Yes, [name withheld]. He hasn’t made a [decision] yet, there is a couple of minutes before exiting our zone … near the state border. Well yes, the pilot is asking what is the color yellow or red, well [the color], of the danger. The controller is saying red. Pilot is making a decision so far … well … well … well possibly they [the Ryanair crew] is playing for time deliberately, who knows.”

But in the end the pilot bought what the control tower in Minsk was saying and declared: “MAYDAY, MAYDAY, MAYDAY … our intentions would be to divert to Minsk airport.”

The Ryanair flight landed at the Minsk airport.

What happened next

Once on the ground, it was clear this was no normal diversion.

Ryanair called Minsk authorities 12 times in a two-hour window before and after the plane landed to try to get more information about the threat, including asking for a copy of the email (which wasn’t provided).

Eventually, the authorities allowed the crew and passengers back aboard their airplane to continue the flight. But not everyone made it. Before takeoff, cabin crew conducted a headcount of passengers and found five were missing. But no explanation was provided to the Ryanair crew by the Minsk Airport ground staff, and the airplane took off leaving those five passengers behind. Among them were Belarusian journalist Protasevich and his Russian girlfriend.

The report doesn’t identify the other three passengers — other than to say that of the five, three were Belarusian, one was Russian and one was Greek — but Ryanair boss Michael O’Leary said in the immediate aftermath that he believed agents of the Belarusian KGB were traveling on the plane and were offloaded at the airport.

If Belarus’ authoritarian leader Alexander Lukashenko thought the world would quickly forget the incident, he was wrong — it cemented his regime’s outlaw status.

After stolen elections in 2020, when Lukashenko cheated his way back into power, he faced international sanctions and isolation. The Ryanair incident, characterized as a hijacking by EU officials, forced yet more measures against Belarus. State carrier Belavia was banned from European airspace and U.S. prosecutors charged four Belarusian government officials with aircraft piracy.

As part of the probes, ICAO didn’t get much help from Belarusian authorities.

Very little footage was given to investigators of the passengers getting off the flight, or in the airport. Belarusian authorities said that’s because the video archive is only stored for 30 days.

But video recordings made by passengers show a man present on the ramp while passengers disembarked. The air traffic controller identified him as the suspected KGB officer.

What information the international investigators received was also dubious.

A second transcript, included within the ICAO report obtained by POLITICO, captured a conversation between the deputy general director of Belaeronavigatsia, the duty supervisor and the controller, a week after the forced landing. Within it, the authority’s deputy chief encourages the pair to make some “adjustments” in their incident reports.

ICAO ultimately found that Belarus’ diversion was “an act of unlawful interference,” was deliberately false and endangered the safety of the Ryanair flight.

Belarusian officials dismissed the report, saying it “does not stand up to scrutiny.” Officials from Belarus and Russia — an ally of Minsk — also expressed doubts that the account shared by the air traffic controller is genuine.

The report has been passed on to the U.N. for consideration. Several countries, including the United States, Poland, Lithuania, Latvia and Belarus have opened their own investigations.

Protasevich was placed under house arrest awaiting trial. His current situation is unclear. In January, he uncharacteristically spoke to pro-government media, saying that he was no longer under house arrest.

Sapega, who was sentenced to six years in prison, asked for a pardon in a letter in late June, calling on Lukashenko for leniency.