ICAO’s has been unable to obtain several crucial pieces of evidence – including emails, phone communications, and surveillance footage – during its investigation into last year’s Ryanair Sun Boeing 737-800 diversion to Belarus, while the Minsk air traffic controller assigned to the flight could not be traced.

The organisation’s factual probe into the 23 May incident, obtained by the political outlet Politico, has concluded that a bomb threat, which led the crew of the Athens-Vilnius flight to divert to Minsk, was “deliberately false”, but it has been unable to attribute the unlawful act to any individual or state.

Information provided from Swiss authorities, via Lithuanian authorities, detailed an emailed bomb threat sent from an account of a Swiss-based email provider.

Five emails were sent separately, from 09:25UTC to 09:34UTC, to airports in Lithuania, Athens, Sofia, Bucharest and Kiev. A sixth was sent to Minsk airport at 09:56UTC. All the airports were close to the 737’s route. Two of the emails, to Athens and Kiev, were not delivered, and no record exists of any other emails sent from the account.

But Belarusian authorities claimed to have received the email earlier, at 09:25UTC, as well as the identical second one sent to Minsk at 09:56UTC.

This claim of an earlier email is “crucial” to explaining the diversion incident, says ICAO’s inquiry, because the bomb threat was communicated by Minsk area control centre to the 737 crew shortly before 09:31UTC – just 6min after the early email was supposedly received, but 25min ahead of the second.

If this early email was received at Minsk, says the inquiry, the diversion of the flight could be considered a “tenable option”.

Ryanair SP-RSM-c-Andrzej Otrębski Creative Commons

Source: Andrzej Otrębski/Creative Commons

Ryanair Sun 737-800 SP-RSM was bound for Vilnius when it diverted to Minsk in May 2021

But the inquiry could not verify receipt of the early email, because the Belarusian authorities did not provide logs of the Minsk airport email server, or the email files in their original format, claiming erasure under data-retention policies.

“In the absence of the first email, it could be presumed that the information about the bomb threat would have been obtained by the authorities of Belarus by other means, which the [investigation team] could not establish,” states ICAO in its findings.

It says it “could not corroborate” information from Belarusian authorities that the content of the email was transmitted by phone from Minsk airport to the Minsk area control centre, enabling notification to the 737 crew.

“As cellular phone records of the personnel involved, documenting the time and duration of the calls and person or entity contacted, were not made available, those statements could not be supported by evidence,” says the inquiry.

The email and phone records were among several pieces of specific and critical information requested by the investigators but not made available.


Curiously the investigators were unable to meet with, or interview, the Minsk area controller who had been assigned to the flight.

“The authorities of Belarus informed the [investigators] that this individual did not report for duty after his summer leave and that they had no information on his whereabouts and no way to contact him,” says the inquiry.

Under ICAO standards, air traffic control services should immediately inform authorities of a suspected occurrence of unlawful interference, and exchange necessary information with the aircraft operator.

While this is also the case under Belarusian air navigation regulation, the inquiry says “no evidence” was provided by the Minsk area centre of any attempt to contact Ryanair Sun. There is, however, evidence that the Ryanair operational control centre tried multiple times to obtain information on the diverted aircraft, to “no avail”.

Although the carrier’s procedures required radio communication between the 737 crew and the operational control centre, this could not be achieved. The frequency of 131.750MHz belonged to a radio operated by Vilnius ground-handling firm Litcargus, but this had a range of only 20-30nm and could not be reached.

When the crew requested an alternative within range, the Minsk controller could only provide the Litcargus frequency.

If the crew had been able to make contact with the Ryanair or Ryanair Sun operational control centre, says the inquiry, a diversion to Minsk would have been “unlikely” because the control centres did not have access to the email threat at the time.


The aircraft’s cockpit-voice recorder circuit-breaker was not pulled after the jet arrived in Minsk at 10:15UTC – or 13:15 local time – and the crew’s full conversations prior to its final approach to the airport were not preserved.

Five of the 126 passengers did not reboard the aircraft before it departed Minsk. Among them was a person identified as being wanted by Belarusian authorities. According to the ministry of internal affairs, the presence of this person and his partner was detected when their mobile phones logged into the Belarus public network at 10:07 and 10:11, just before the flight landed. The person was subsequently detained.

While the inquiry identified surveillance cameras which would have helped corroborate the sequence of events regarding the processing of the disembarked passengers, it says investigators were “not given” the video footage requested, beyond “very small extracts”.

“The [investigators were] informed that these recordings were no longer available due to the length of time that had elapsed since the event,” says the inquiry.

“[Investigators were] not provided with a satisfactory rationale to explain why records had not been preserved, considering that criminal and other investigations in respect of the event had been initiated by the authorities of Belarus and had not been completed.”

ICAO’s inquiry says formal requests by some countries to others for information relating to the incident “could assist with establishing any missing facts”, and adds that those receiving such requests “should be encouraged to respond as appropriate”.