Metrojet Flight 9268

Investigation

Ayman al-Muqaddam, the head of the central air traffic accident authority in Egypt, was appointed to investigate the cause of the crash. In a statement on 31 October, he indicated that the pilot had made contact with the civil aviation authorities and asked to land at the nearest airport. He suggested the aircraft may have been attempting an emergency landing at El Arish International Airport in northern Sinai. On the same day, Egyptian civil-aviation minister Hossam Kamel said that air-traffic control recordings did not reveal any distress calls or route-change requests issued by the pilots. Egyptian president Abdel Fattah el-Sisi said that an investigation would take months. On 31 October, the International Charter on Space and Major Disasters was activated, providing for the humanitarian retasking of satellite assets.

The Russian Ministry of Emergency Situations sent three of its aircraft to the crash site. The Investigative Committee of Russia also started a legal case against Kogalymavia under legislation regulating "violation of rules of flights and preparations". Kogalymavia's employees were also questioned, along with those of the Brisco tour agency that had chartered the flight. Egyptian foreign minister Sameh Shoukry promised to work closely with Russian officials and investigators. Investigators also viewed security-camera footage. Soon after the crash, Russia's regional transport prosecutors determined that the quality of fuel on the aircraft met required standards.

The aviation accident investigation agencies BEA (France), BFU (Germany) and AAIU (Ireland) participated in the investigation as representatives for the state of the aircraft's design, manufacture and registration respectively. The BEA sent two investigators, accompanied by six representatives from Airbus, to Egypt on 1 November. According to the BEA, they joined two investigators from the BFU and four investigators from the Interstate Aviation Committee, their Russian counterpart, representing the state of the aircraft's operator.

Both the flight data recorder and the cockpit voice recorder were recovered from the crash site on 1 November. Russian transport minister Maksim Sokolov and a team of specialist investigators arrived in Cairo to assist the Egyptian investigators. On 4 November, Egypt's civil-aviation ministry investigators reported that the cockpit voice recorder (CVR) was partially damaged and that much work was required to extract data from it. The CVR indicated that everything was normal until a sudden disastrous event. An explosion or other sudden loud noise was heard very shortly before the device stopped recording.

An unnamed official said that Flight 9268's tail section separated from the main body of the fuselage and was burning, which could indicate an explosion. According to a senior U.S. defence official, an American infrared satellite detected a heat flash at the time and place of the disaster, and the American intelligence community believed that it could have been an explosion. U.S. director of national intelligence James Clapper said that there was not yet any "direct evidence of terrorist involvement". Some UK news outlets reported that an ISIL bomb was the most likely explanation.

Within a week of the crash, authorities began to believe that the plane was destroyed intentionally. The UK government said that in the light of further British intelligence, the crash "may well have been caused by an explosive device". British aviation experts travelled to Egypt to assess airport security, and the government's Cobra emergency committee, chaired by the prime minister, considered their findings. The BBC reported that the British government thought that the incident was probably caused by a bomb in the hold based on intercepted transmissions between militants based in Sinai. Although the British did not exclude a technical fault, the BBC reported that was "increasingly unlikely".

The United Kingdom stopped flights from and to Sharm El Sheikh, causing a number of British tourists to be stranded. Prime minister David Cameron's spokesperson communicated that the government believed the aircraft was destroyed by a bomb. Security experts and investigators have said the aircraft is unlikely to have been struck from the outside and Sinai militants are not believed to have missiles capable of striking an airliner at 30,000 ft.

The cockpit voice recorder was sent to France, where its contents were downloaded by the BEA. The recording ends abruptly, consistent with an explosion on board. Reuters quoted an unnamed Egyptian investigation team member who was "90% sure" that the airliner was destroyed by a bomb, based on an initial analysis of the last second of the CVR recording. Lead investigator Ayman al-Muqaddam said that other causes, such as lithium batteries overheating, a fuel explosion or metal fatigue, had not yet been definitively excluded.

On 17 November 2015, Russian security service chief Alexander Bortnikov announced that explosives were found in the wreckage. Spectral analysis was employed to examine the substances. According to Russian officials, an improvised explosive device with power equivalent of as much as one kilogram of TNT destroyed the plane. Russia offered a US$50 million reward for further information. Reuters reported that two employees of Sharm El Sheikh airport had been detained for questioning, which Egyptian authorities denied.

On 18 November 2015, ISIL published pictures of what it claimed to be the type of bomb used in the explosion in its Dabiq online magazine, claiming to show the three IED components, including a Schweppes soda can containing the explosive charge, a military-grade detonator and switch. That same month, Russian defence minister Sergei Shoigu announced that the Sinai branch of ISIL was responsible.

On 14 December 2015, the Egyptian investigators issued a preliminary report. The leader of the committee said that it had found "no evidence that there is an act of terror or illegal intervention". In response to the statement by the investigating committee, Russian spokesman Dmitry Peskov reiterated that "our experts concluded this was a terrorist attack".

On 29 January 2016, Reuters reported that a mechanic was detained and suspected of planting the bomb, which he had been given by his cousin, a member of IS. Two policemen and a baggage handler suspected of helping the mechanic were also detained. None of the four had yet been prosecuted.

On 24 February 2016, Egyptian president Abdel Fattah el-Sisi acknowledged that terrorism caused the crash, saying, "Has terrorism ended? No... Whoever downed that plane, what did he want? Just to hit tourism? No. To hit relations. To hit relations with Russia."

Abu Osama al-Masri, leader of the Islamic State branch in the Sinai Peninsula, known as Wilayat Sinai, became a person of interest but was killed in June 2018 in an airstrike on an IS location.