Red Hot Cyber

Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search

Was there terror on Ursula von der Leyen’s flight? Let’s clear things up!

Giovanni Pollola : 2 September 2025 17:47

On August 31, 2025, flight AAB53G, operated by a Dassault Falcon 900LX registered OO-GPE and carrying European Commission President Ursula von der Leyen, took off from Warsaw and landed safely at Plovdiv Airport (Bulgaria).

The Financial Times, in an article by Henry Foy, spoke of an alleged targeted GPS jamming that “blinded” the aircraft, forcing the pilots to land manually with paper maps after an hour of waiting. An evocative reconstruction, but technically untenable.

FT.com

Weather and track conditions: everything normal

In Plovdiv, on August 31, conditions were favorable: temperatures between 12°C and 28°C, moderate winds from the West-Northwest and visibility greater than 10 km. METAR confirms:

LBPD 311400Z AUTO 28006KT 240V010 9999 FEW059/// 28/13 Q1009 NOSIG
LBPD 311430Z AUTO 30016KT 9999 FEW059/// BKN110/// 26/12 Q1009 NOSIG

No significant weather phenomena, no significant changes (NOSIG).
Runway 30 also has ILS CAT I, operational and not Reported as unavailable.

Onboard instruments and ground aids: GPS is only a support

The Dassault Falcon 900LX, with EASy II Flight avionics Deck based on the Honeywell Primus Epic System, features numerous advanced systems for navigation, approach, and landing assistance, to ensure safety and precision… including:

  • IRS (Inertial Reference System): navigation independent of external signals.
  • VOR/ILS Receiver: Allows navigation based on traditional radio aids and instrument approaches.
  • ILS (Instrument Landing System): For precision landings in instrument conditions, operational on Runway 30.
  • DME (Distance Measuring Equipment): Measures the distance from the radio station, useful for approaches and route management.
  • FMS (Flight Management System): Manages routes, performance, and flight optimization.
  • ADF (Automatic Direction Finder): Receives NDB signals for complementary navigation.
  • Integrated Autothrottle and Autopilot: Optimize speed and trajectory, supporting critical phases such as approach and landing.
  • RNP/AR (Required Navigation Performance/Authorization Required): Enables precision procedures with tight margins, useful in complex airports or in conditions of reduced visibility.
  • GPS: Navigation support, not essential for the System operation.

These systems work together, ensuring the aircraft can operate with high reliability in complex scenarios, minimizing risks related to adverse weather conditions or external interference.

Dassault Falcon 900LX – Flight Deck

The runway at Plovdiv Airport also provides a complete set of navigation aids, all active:

  • ILS CAT I on runway 30
    • Localizer (IPD) 109.9 MHz
    • Glideslope 333.8 MHz (3rd)
    • Marker MM/OM 75 MHz
  • DME PDV (ch. 96x) co-located with DVOR 114.9 MHz
  • Locator Middle PD 537 KHz

These systems, operational and without NOTAM unavailability, guaranteed a safe approach even in the event of GPS interference. As for the “paper maps” cited by the FT: today, pilots use EFB (Electronic Flight Bag) and digital charts on tablets or integrated avionics. Talking about analog physical charts is pure dramatization.

Altitude and trajectory: no “holding hour”

ADS-B and FlightAware data show that the Falcon 900LX presented itself on first approach at about 2,000 m above runway level, about 1,700 m higher than normal. ILS path followed with the final approach.
Instead of attempting an impossible landing, the aircraft continued overflying, making a pass of approximately 4 minutes (14:18-14:22 UTC) over the airport area. It subsequently realigned on the same course 11 minutes later, but at the correct altitude, completing the landing at 14:35 UTC.
The alleged “one-hour turnaround” cited by the FT is contradicted by objective data: the overall delay did not exceed 15 minutes, entirely compatible with a planned overflight or a standard operating procedure.

source: FlightAware

GPS jamming: widespread, untargeted phenomenon

Cyclic GPS signal disturbances have been recorded in the Black Sea region for some time, with peaks at varying times and days, precisely because of the area’s well-known geopolitical landscape. Other air traffic has also reported similar anomalies, regardless of the type of aircraft or the nature of the flight—civilian, VIP, or military.

Distinguishing a widespread disturbance from a targeted attack requires advanced electronic equipment, typical of military electronic warfare assets, which a civilian Falcon typically lacks, nor is there evidence or communication of.

EW assets present in the area, especially if flying nearby, could have precisely identified the event and its source or sources. However, communicating evidence of a targeted attack, whether Russian or by any other actor, without concrete, localizable, and correlated technical evidence is extremely problematic, and even less feasible for a journalist.

STARKOM – Example of Electronic Warfare Weapon Systems

Real data versus the viral news narrative

  • No one-hour delay: landing on runway 30 would have been possible just 15 minutes earlier, not 60.
  • No “al” landing dark”: ILS and IRS were available and operational, the weather was excellent.
  • No paper maps: EFBs and digital charts are used today.
  • No total position tracking blackout: ADS-B tracks are continuous and complete.
  • GPS jamming? Possible widespread phenomenon, but no evidence of a targeted attack.

Evidence and reflections

The landing of the flight carrying Ursula von der Leyen from Warsaw to Plovdiv, according to publicly available data, took place with reasonable certainty in total safety, in optimal weather conditions and with fully operational navigation aids.

The Financial Times article appears to have completely ignored publicly available technical data, but it transforms a normal operational overflight, in a notoriously complicated border area, into an alleged and deliberate hostile act.
It is an example of sensationalism that, in the field of aviation and cyber security, risks undermining the trust of citizens and airline passengers and further fueling tensions. geopolitical.

In this case, the suppositions and rumors can be debunked by public data, which speak clearly: no in-flight emergency, no targeted electronic warfare, and, at most, a widespread effect of electronic interference in that geographic area. Unfortunately, once again, distorted reporting clouds the situation, preventing the true scenario from emerging.

A detail that might seem fussy, insignificant, or trivial, but in reality isn’t at all: it risks becoming the central point in constructing a “paper puppet” useful for justifying, instrumentally, an alleged attack to cover up an abnormal delay in landing. For this reason, it has been left at the bottom, for the more attentive and interested readers.

Takeoff from Warsaw was in fact scheduled for 11:01 UTC, but it did not take place until 12:37 UTC, with a delay of about an hour and a half. Consequently, the landing in Plovdiv, scheduled for 12:58 UTC, could only have been delayed by the same amount, occurring at 14:35 UTC.
In other words, the arrival delay is perfectly consistent and predictable compared to the delay accumulated at departure.

And would it really be too malicious to hypothesize that a normal operational delay could be transformed, communicatively and artfully, into evidence of an alleged targeted attack, specifically on that flight, and above all on that person?

Giovanni Pollola
His academic career in Mechanical Engineering failed to keep him away from the world of IT, which he abandoned by choice after a few immature experiences. His awareness, passion for all things technological and hacking, and understanding of their implications in the real world brought him back to IT. Raising awareness among ordinary people of the potential of IT is his main motivation for research and dissemination.

Lista degli articoli