UNCLASSIFIED

UK PROCEDURES
FOR DEALING WITH
AIRBORNE SECURITY EVENTS

NATS
MINISTRY OF DEFENCE
DEPARTMENT FOR TRANSPORT
METROPOLITAN POLICE SERVICE
ASSOCIATION OF CHIEF POLICE OFFICERS
BRITISH AIRLINE PILOTS ASSOCIATION

June 2011

UNCLASSIFIED
Page 1 of 12
 UNCLASSIFIED

UK PROCEDURES FOR DEALING WITH

AIRBORNE SECURITY EVENTS

CONTENTS

Key points for pilots, aircraft operators and threat assessors

i. Introduction

ii. Identification/Indication of Airborne Security Situations

iii. Aircraft Commander / Aircraft Operator Responsibilities

iv. Communications

v. UK Air Defence Authority Actions

vi. False Alarms

vii. Situation Containment

viii. Situation Recovery

Annex A. Loss of communications in flight: incident report form

UNCLASSIFIED
Page 2 of 12
 UNCLASSIFIED

UK PROCEDURES FOR DEALING WITH

AIRBORNE SECURITY EVENTS

KEY POINTS FOR PILOTS, AIRCRAFT OPERATORS & THREAT

ASSESSORS

To avoid an incident, please ensure that:

 communications with ATC are maintained at all times;
 Transec Threats Office has 24/7 contact details for your operations
centre; and
 a trained threat assessor is available at all times.

In order that any event is handled in the most appropriate manner:

 be aware of potential situations such as loss of two-way

communications or inadvertent A7500 selection that may indicate a
potential security alert to ATC and take all necessary precautions to
prevent that happening.

 communicate clearly to all parties when in your opinion there is an

actual or perceived security threat to your aircraft or to the UK.

 Threat Assessment - make contact with your company operations

centre at the earliest opportunity to ensure all pertinent information
is shared in a timely fashion – if necessary speaking with a trained
company threat assessor.

 Volunteer information regarding the integrity of the flightdeck and

the exact nature of the threat/concern to ATC and/or Transec in a
timely manner and be clear and concise.

 Use appropriate Radio Transmission Facility (RTF) phraseology and

special purpose Secondary Surveillance Radar (SSR) Mode A codes.

 Comply with government instructions whether given by radio or

through visual intercept signals.

 Ensure that where agencies have been alerted to a threat, once it is

‘coded’ Red, Amber or Green, the agencies involved in the incident
are informed immediately e.g. Transec Threats Office (office hours)
0207 944 2872 / 2870 or DfT Duty Office (out of hours) 020 7944 5999.

UNCLASSIFIED
Page 3 of 12
 UNCLASSIFIED

UK PROCEDURES FOR DEALING WITH

AIRBORNE SECURITY EVENTS
I. Introduction

1. The following guidance should assist the understanding of aircraft operators,

threat assessors and pilots of the procedures which will be followed by the
appropriate UK authorities when handling airborne security events. The overall
objective is to identify, contain and resolve an airborne security situation in an
appropriate way and as quickly and safely as possible.

2. In the interests of national security both Air Traffic Control (ATC) and Air Defence
(AD) agencies monitor UK airspace and its approaches for indications of
suspicious activity which may indicate a developing airborne security event, so
that suitable action can be taken to deal with the situation. An airborne security
event is one where an aircraft is either subject to an actual or perceived threat,
which may take the form of a hi-jack, bomb alert or other onboard disruption, or
that aircraft is perceived to pose a threat to the UK. In either case the
procedures used to determine the actuality, nature and extent of this threat will
be similar. The procedures used to deal with each type of threat, however, are
likely to be different.

3. If an airborne security event is believed to pose a threat to the UK it is likely that

the AD Authority ((ADA) vested in the National Air Operations Centre (NAOC)
RAF High Wycombe) may use Quick Reaction Alert (QRA) aircraft and other
assets to gain further information and take necessary action to resolve the
situation. The situation is likely to evolve rapidly and therefore timely passage of
information and compliance with instructions is key.

4. These procedures are owned by HM Government and contain actions for a

variety of agencies, principally the Ministry of Defence (MoD), NATS, the
Department for Transport (DfT) and the Metropolitan Police Service. These
procedures are regularly reviewed and are applicable whether the subject
aircraft, regardless of nationality, is inbound, outbound or overflying the UK, and
apply to the whole of UK airspace i.e. the London and Scottish Flight Information
regions (FIRs) and Upper Information Regions (UIRs) and the Shanwick Oceanic
Control Area.

II. Identification/Indication of Hijacks & Airborne Security Situations

5. Verified Hijack Status

Aircraft subject to hijacking should where possible be identified to Air Traffic

Control (ATC) staff by the flightcrew by the selection of the Mode A code 7500
on the aircraft’s transponder and/or declaration on the Radio Transmission
Facility (RTF) frequency.

UNCLASSIFIED
Page 4 of 12
 UNCLASSIFIED

6. Other Security Alert Indicators

There are a range of indicators of suspicious aircraft/pilot activity which could

highlight a potential security event to ATC and AD agencies and lead to the
initiation of intervention procedures. These indicators include but are not limited
to the following:

 no cleared flight profile, i.e. infringement of airspace;

 unauthorised deviation from cleared flight profile in the horizontal or
vertical plane;
 refusal or inability to comply with ATC instructions, including vectoring,
without good reason;
 loss of RTF contact, particularly associated with flight profile deviation;
 unauthorised Secondary Surveillance Radar (SSR) code changes or
extended use of IDENT;
 use of non-standard phraseology by the crew or other covert attempts to
highlight the situation (marked change in voice characteristics, etc.);
 notification of a threat or incident from official or non-official sources;
 open RTF transmission from the cockpit;
 non-ATC related RTF transmission (e.g. political statement); and
 specific / non-specific threat passed via third party e.g. Police / public.

The last three may mean that the identity of the aircraft is unknown until other
factors become apparent. Individual events may not, in themselves, constitute
suspicious aircraft / pilot activity. However, a combination of such events may be
considered as an unusual event and then the appropriate alerting action will be
undertaken by ATC.

III. Aircraft Commander/Aircraft Operator Responsibilities

7. Where information exists indicating an actual or perceived security threat to an

aircraft, this information should be communicated to the handling ATC unit
immediately by the aircraft commander or to the Threats Office in the DfT’s
Transport Security Strategy Division (“Transec”) by the aircraft operator as
appropriate. They should also instruct a trained airline threat assessor to
evaluate the threat who should inform cascading findings/codings to Transec as
soon as possible. Information regarding the integrity of the flightdeck should be
provided to ATC in a timely manner, together with the phrase ‘flightdeck secure’
when this can be assured. This will ensure that the situation is handled in the
most appropriate manner by the UK ADA.

8. Appropriate use of RTF phraseology and special purpose SSR Mode A codes is
essential. If there is an actual security threat, the aircraft commander should not
use either PAN or MAYDAY prefixed calls in isolation to communicate the threat
to ATC. Details of the security threat must be passed in the same transmission.
Where no security threat to the aircraft is perceived by the aircraft commander,
appropriate use of either PAN (Possible Assistance Needed - no imminent
danger to life) or MAYDAY (Distress call - imminent danger to life) should be

UNCLASSIFIED
Page 5 of 12
 UNCLASSIFIED

applied if the aircraft commander requires some form of priority ATC handling to
the destination or a diversion airfield.

9. Aircrews should be strongly advised to monitor 121.5 MHz (“Guard”) at all times.
Routine monitoring of 121.5 significantly increases chances of hearing
transmissions from ATC attempting to re-establish contact with the aircraft. In
addition military aircraft will also simulcast on 121.5 in addition to standard ATC
frequencies. Aircrew who for whatever reason find themselves without the correct
frequency are also advised to request assistance from ATC using 121.5 MHz.

10. The combination of correct RTF calls and use of Mode A codes will assist ATC to
take action appropriate to the situation.

IV. Communications

11. ATC: As soon as notification of an event is received, the handling ATC unit will
pass the details to the ATC operations supervisor at a parent Area Control
Centre (ACC) i.e. either Swanwick Centre or Prestwick Centre. It is then the
responsibility of that individual to notify the UK ADA, via the military ATC
organisation. The UK ADA will subsequently notify appropriate UK Government
agencies, specifically Transec's Threats Office staff and the Metropolitan Police.

12. The Police:

 contribute to the intelligence picture and assist in the bomb threat

assessment;
 act as a single point of contact (SPOC) for the passing of real time
information between the UK ADA and the police force responsible for the
receiving airport;
 deploy an effective and flexible police response that is commensurate with
the threat and/or incident; and
 investigate crime.

13. The Metropolitan Police Service Counter Terrorism Command’s (SO15) Reserve
room acts as their duty office, take calls and provide the UK ADA with any
intelligence that the police are aware of in respect of an airborne security
incident. This includes their ability to search databases in respect of bomb threat
codewords.

14. SO15 Reserve also acts as a SPOC for police forces receiving mobile phone
calls from passengers or crew aboard the renegade aircraft or ground based
relatives relaying such information. These calls, which may contain vital
intelligence or information, are then relayed to the UK ADA to assist in the
assessment of the developing incident.

15. As the event progresses, the civil ATC, military ATC and UK ADA will co-ordinate
their actions and, where and when the relevant authority makes decisions, will
implement any operational directives. The UK ADA will continue to liaise with
Transec and SO15, both of whom will continue to provide intelligence and
information as it becomes available, to aid the ADA's decision making process.

UNCLASSIFIED
Page 6 of 12
 UNCLASSIFIED

16. In the event of specific information being required or communicated, the Transec
Threats Office may contact aircraft operators’ operations centres and/or notified
key personnel (e.g. threat assessors). Such channels may be used in attempting
to establish the security and integrity of the flightdeck and/or the nature and
degree of the threat posed to or by an aircraft. This channel of communication is
vital in determining the nature and extent of the threat.

17. It is therefore essential that the aircraft operator provide Transec Threats Office
with a 24/7 contact number for their operations centre so that Transec staff can
communicate immediately with (i) the airline when seeking to advise of lost
communications and requesting associated actions and (ii) a trained threat
assessor who can assist Government agencies in responding proportionately and
in a timely fashion to the situation as it unfolds. The lack of a trained threat
assessor and/or operations centre point of contact severely limits an airlines
ability to participate in, and contribute to, what can be a dynamic and rapidly
changing decision making process. Aircraft operators should ensure updated
contact details for operations centres and threat assessors are sent to the
Transec Threats Office via email: [email protected]

18. The Transec Threats Office are contactable (office hours) on: 0207 944 2872 /
2870, and via the DfT Departmental Duty Office at all other times on: 0207 944
5999. These numbers should be held by Airline Operations Centres and Threat
Assessors who may be required to pass/receive timely information to assist in the
effective handling of a crisis situation.

V. UK Air Defence Authority (and associated agencies) Actions

19. When notified of a potential airborne incident or threat, the UK ADA determines
the initial actions to be taken to ensure the security of UK airspace. Prior to the
official declaration of a security incident, the UK ADA may elect to take certain
actions to prepare the AD forces. This may include ordering the QRA aircraft to
an increased state of readiness and/or launching the QRA aircraft to intercept the
aircraft of concern.

20. Once advised by the UK ADA, the Transec Threats Office will make every effort
to contact the airline operations centre and/or threat assessor. Transec will seek
to enlist the help of both parties to ensure any response by Government
agencies is timely, proportionate and effective. It is imperative that airline staff
understand that this is a key opportunity to influence and/or educate the
decision making process at this time e.g. by assisting ATC to regain
communications with the aircraft and/or assessing the threat (i.e. Red,
Amber, Green). Failure to be available and/or respond in a timely fashion may
limit the options available to Government when considering how best to respond
to a fast moving and dynamic situation.

21. If and when the UK ADA initiates the launch of the QRA aircraft, the Military
Supervisor at either London or Scottish ATC Centres(ATCCs) will telephone the
Metropolitan Police Central Command Complex (CCC) in London. CCC will then
initiate the police notification plan and link the Military Supervisor to the Force

UNCLASSIFIED
Page 7 of 12
 UNCLASSIFIED

Control Centre of the police force responsible for the airport where the aircraft will
land.

22. The provision of real time information in this way assists the police ground
response and permits continual re-assessment of the threat (in particular by the
airline threat assessor) to help the receiving force to deploy the most suitable and
proportionate police response. The aim of this response is to preserve life,
minimise injury, ensure an early return to normality and to preserve evidence.

23. If the interception of a civil aircraft is ordered by the UK ADA, QRA aircraft will
close on the left hand side of the aircraft while attempting to make contact with
the cockpit using VHF radio communications; the military aircraft will simulcast on
121.5 MHz in addition to standard ATC frequencies. Details of Visual
Interception Signals used by military aircraft are detailed in the CAA Safety
Sense Leaflet 11 – Interception Procedures1 and can be found at:
http://www.caa.co.uk/docs/33/20110217SSL11.pdf

24. Voice communications with the cockpit and compliance / non-compliance with
the interception signals assist the UK ADA in determining the intent of those in
control of the aircraft. The UK ADA’s conclusions will be communicated to the
Government who will determine what further action should be taken.

25. Such actions could result in the aircraft being diverted into an alternative airport
from that which was originally intended.

VI. False Alarms

26. False alarms continue to be generated on regular basis and are in the
overwhelming majority of cases caused by:

i) "civil aircraft operated as a controlled flight not maintaining a continuous

listening watch on the appropriate radio frequency of, and establishing two-
way communication as necessary with, the appropriate air traffic control unit"2
as they approach or enter UK airspace or

ii) less frequently, bomb threats made against aircraft in-flight where trained
airline threat assessors are uncontactable and unable to assist in
understanding and coding the nature and severity of the threat.

27. NATO colleagues or other ATC agencies will also alert the UK ADA or UK ATC
agencies if an aircraft, due to land in or overfly the UK, loses communications for
a significant period of time or is faced with a potential threat situation. This can
trigger the UK ADA actions described in section 5 above. Thus a loss of
communications combined with the aircraft deviating from its flight plan is likely to
trigger an immediate launch of the QRA aircraft which may result in the
interception and diversion of the aircraft.

1
This document is in accordance with the ICAO standards included in Schedule 11 of the Air Navigation Order
2
ICAO Radio Communication Failure Procedures document, Annex 2, Chapter 3 .

UNCLASSIFIED
Page 8 of 12
 UNCLASSIFIED

28. The UK ADA may ask to speak to the commander of any aircraft that triggers an
alert (regardless of the actions subsequently taken) once it has landed and
further action may be requested through the relevant national authorities if
negligence is suspected or no explanation for the loss of communications is
offered. Equally, an airline's inability to contribute to the UK Government's
understanding of the threat in a timely fashion e.g. by having a trained threat
assessor available, may result in Transec seeking clarification of an airlines
contingency planning capabilities.

29. It is accepted that some false alarms will continue to be generated because of
operator error and RTF/ground based communication failures. However, it should
be borne in mind that they are wasteful of both industry and Government
resources and have the potential to create danger for those on board and the UK
more generally.

30. Transec will ask for an explanation of false alarms, particularly for those which
result in the launch of QRA aircraft and may request a copy of the internal
investigation in to such an incident and details of remedial action taken to prevent
repetition. Working with BALPA, Transec has developed a self-reporting form
which pilots involved in comm loss incidents can complete and return to Transec
to aid with any subsequent investigation. A copy of this form can be found in
Annex A.

VII. Situation Containment

31. As part of the reaction to airborne security situations, decisions regarding

routeing, flight profile and destination (including possible airborne holding) may
be taken outside of normal aircraft operator / aircraft commander arrangements.
In the event that ATC or the UK ADA feel they have reason to question whether
the communication from the flight deck is being made under duress, the aircraft
may be instructed to perform specific manoeuvres. It is essential that any such
instructions are complied with whether passed by ATC or via standard ICAO
intercept procedure signals.

32. It should be noted that certain information may be withheld from the aircraft
commander during events of this nature, and that some requests by either the
aircraft operator or aircraft commander may not be approved by the appropriate
UK authorities.

33. As part of the response, ATC may be directed to effect airspace clearance
measures. These actions may affect other aircraft in the vicinity, including on the
ground, and the continuation of existing flight plans may not be permitted. ATC
may require diversion to alternate airfields or may withhold clearances. During
such times, the flight safety of all aircraft will remain paramount and, as such,
aircraft may be issued with non-standard ATC clearances.

34. The extent, sequence and priority of any actions to clear airspace will be at the
discretion of the Parent ACC Watch Supervisor, who will co-ordinate his actions
with the relevant Military ATC Supervisor. Priority shall be given to clearing traffic
away from all regulated airspace through which the subject aircraft is anticipated

UNCLASSIFIED
Page 9 of 12
 UNCLASSIFIED

to progress. The Parent ACC Watch Supervisor will act as overall co-ordinator for
the required airspace clearing process, and will use methods such as:

 cancelling all relevant ATC clearances into airspace likely to be affected

by the incident;
 applying Air Traffic Flow Management measures;
 co-ordinating with adjacent ATC Units, with particular consideration for the
effects on airport operations (e.g. cessation of airborne holding,
diversions, etc.) as well as the ability of these units to assist in the off-
loading of traffic for affected sectors;
 temporary re-routeing of aircraft to avoid the subject aircraft and progress
thereof; and
 cancelling or amending ATC co-ordination arrangements.

The DfT may order the closure of UK airspace if necessary and all aircraft will be
required to comply with the directions given by ATC to achieve this.

VIII. Situation Recovery

35. Normal ATC operations will not resume until authorised by the relevant authority.
Subsequent recovery measures required for the overall ATC system may be
managed by the NATS Air Traffic Incident Co-ordination & Communication Cell
(ATICCC).

--- END ---

UNCLASSIFIED
Page 10 of 12
 UNCLASSIFIED

ANNEX A

Loss of communications in flight: incident report form

Expected communications between ATC and an aircraft in flight is monitored constantly by

UK civil/military ATC. Communications loss is one potential example of suspicious behavior
which may indicate a possible in-flight security incident. This form enables aircrew to report
such an incident so that a) the correct information is recorded as to what exactly happened
and b) necessary steps can be taken to reduce the chance of repetition.

1/ Date

2/ Time UTC

3/ Operator (airline)

4/ Flight Number

5/ Aircraft Call sign (if different)

6/ Departure airport

Destination airport

7/ Squawk/SSR code

8/ Aircraft Type

9/ Registration/Tail Number

10/ Altitude (at time of incident) FL/feet

11/ Speed (at time of incident): Mach No/Kts

12/ Phase of Flight

13/ Location

14/ Routing

15/ Weather conditions

16/ Channel Frequency (MHz)

17/ Controlled by (ATC sector)

UNCLASSIFIED
Page 11 of 12
 UNCLASSIFIED

18/ Description of incident

19/ Cause(s): please tick or circle a) pilot error

b) ATC hand over error
c) technical issues
d) any other cause - please specify:

18/ Was A/C to A/C relay attempted by ATC

and result (if attempted)?

19/ Was Ground to A/C comms on 121.5

attempted?

20/ Were any other communication methods

attempted (ACARS, Satellite, Company
frequency etc)?

21/ Any other pertinent information

22/ Contact details (name, telephone or e-

mail address)

When complete please return to the Threats Office, Department for Transport at
[email protected]

UNCLASSIFIED
Page 12 of 12