The FAA threat levels are a four-tier classification used by U.S. air carriers to identify and respond to in-flight security incidents, running from Level 1 (disruptive or threatening behavior) through Level 2 (physical abuse), Level 3 (life-threatening behavior), and Level 4 (attempted or actual cockpit breach). The levels are not written into statute. They come from the Common Strategy, a shared protocol developed by the TSA, the FAA, air carriers, and crewmembers so that flight crews across the industry classify threats and coordinate responses the same way.1Federal Aviation Administration. Advisory Circular 90-103 – Reporting of Threats in Accordance with the Common Strategy The legal backdrop is the Aviation and Transportation Security Act of 2001, which created the TSA and directed the FAA to develop crew training for potential threat conditions.2Transportation Security Administration. Aviation and Transportation Security Act (Public Law 107-71)
The point of a shared classification is speed. When a flight attendant reports a Level 3 to the flight deck, the pilots know without a lengthy explanation that lives are at immediate risk and can pass that on to air traffic control in a few words.
Level 1: Disruptive or Threatening Behavior
Level 1 covers behavior that is suspicious or threatening but has not turned physical. The FAA’s advisory circular includes irrational behavior likely to escalate into physical conflict, verbal harassment, written threats, and severe intoxication.1Federal Aviation Administration. Advisory Circular 90-103 – Reporting of Threats in Accordance with the Common Strategy This is the level crews see most often.
Alcohol drives a large share of these incidents. Federal regulations bar passengers from drinking any alcohol on board unless the airline served it, and bar airlines from serving anyone who appears intoxicated.3eCFR. 14 CFR 121.575 – Alcoholic Beverages A passenger who slips mini bottles through security and drinks them at their seat is already violating federal law before the behavior becomes disruptive.
The crew response at this level focuses on verbal de-escalation, documentation, and a formal written warning card. Ignoring crew instructions is its own regulatory violation.4eCFR. 14 CFR 91.517 – Passenger Information A single unruly-passenger incident can generate several violations at once, and the FAA can propose civil penalties of up to $44,792 per violation under its inflation-adjusted schedule.5eCFR. 14 CFR Part 13 Subpart H – Civil Monetary Penalty Inflation Adjustment One bad flight can produce a five- or six-figure fine before any criminal charges enter the picture.
Level 2: Physically Abusive Behavior
Level 2 is the line between words and action. It covers physical abuse of a crewmember or another passenger, including hitting, pushing, kicking, grabbing, and inappropriate touching, when no weapon is used or displayed.1Federal Aviation Administration. Advisory Circular 90-103 – Reporting of Threats in Accordance with the Common Strategy The absence of a weapon is what keeps an incident here rather than at Level 3.
Once behavior turns physical, it becomes a federal crime. Assaulting or intimidating a crew member or flight attendant in a way that interferes with their duties carries up to 20 years in prison.6Office of the Law Revision Counsel. 49 USC 46504 – Interference With Flight Crew Members and Attendants The crew response shifts from de-escalation to preparing physical restraint and coordinating with the flight deck for a priority landing where law enforcement will meet the aircraft.
This is also where the FBI enters. The Bureau investigates assault and interference with flight crew as federal crimes committed aboard aircraft, and a referral from the airline or FAA can open a criminal case that runs independently of any civil penalty.7Federal Bureau of Investigation. Crimes Aboard Aircraft
Level 3: Life-Threatening Behavior
Level 3 covers conduct that puts lives in immediate danger. The Common Strategy lists specific examples: displaying or using a weapon, credible bomb threats, sabotage of aircraft systems, credible hijacking threats, and deadly hand-to-hand techniques such as choking or eye gouging.1Federal Aviation Administration. Advisory Circular 90-103 – Reporting of Threats in Accordance with the Common Strategy Any weapon, whether manufactured or improvised from something on board, moves an incident to this level.
Crews are expected to intervene immediately and forcefully, and to notify air traffic control right away so ground-based security and law enforcement can respond. For incidents involving weapons, the criminal exposure climbs steeply: assaulting or intimidating a crew member with a dangerous weapon is punishable by any term of years up to life.6Office of the Law Revision Counsel. 49 USC 46504 – Interference With Flight Crew Members and Attendants
Bomb threats and sabotage sit under a separate statute. Destroying, disabling, or placing a destructive device on an aircraft carries up to 20 years. Communicating a false threat of sabotage, when made under circumstances where it could reasonably be believed, carries up to five years.8Office of the Law Revision Counsel. 18 USC 32 – Destruction of Aircraft or Aircraft Facilities A bomb joke is not treated as a joke.
Level 4: Attempted or Actual Cockpit Breach
Level 4 is the highest classification, and it covers one scenario: an attempted or actual breach of the cockpit door.1Federal Aviation Administration. Advisory Circular 90-103 – Reporting of Threats in Accordance with the Common Strategy That includes hijacking and any attempt to reach the flight controls. Every protocol at this level is built around one objective: keeping the door closed and locked.
The door itself is the primary defense. After September 11, 2001, cockpit doors on commercial aircraft were required to be reinforced against forced entry from the cabin and to remain locked in flight.9Office of the Federal Register, National Archives and Records Administration. 49 USC 44903 – Air Transportation Security Pilots can silently alert air traffic control by setting the transponder to code 7500, which universally signals hijacking or unlawful interference and triggers a special emergency indicator at every radar facility that sees the aircraft.10Federal Aviation Administration. Aeronautical Information Manual – Section 3, Distress and Urgency Procedures That lets the crew alert the ground without a radio call an attacker in the cabin might overhear.
If federal air marshals are aboard, they are authorized to use tactical force to neutralize the threat. The TSA deploys marshals on flights it determines to present high security risks and requires airlines to seat them at no cost.11Office of the Law Revision Counsel. 49 USC 44917 – Deployment of Federal Air Marshals
Criminal Penalties Across the Four Levels
The civil fines at Level 1 are the FAA’s administrative tool. Criminal prosecution runs on a separate track, and the numbers climb quickly. The core federal statute covers anyone who assaults or intimidates a crew member and interferes with their duties: up to 20 years, a criminal fine, or both. When a dangerous weapon is involved, the sentence jumps to any term of years or life.6Office of the Law Revision Counsel. 49 USC 46504 – Interference With Flight Crew Members and Attendants
Sabotage sits under a separate statute carrying up to 20 years for damaging or disabling an aircraft, tampering with navigation equipment, or committing violence aboard in a way that endangers safety. A false threat of sabotage carries up to five.8Office of the Law Revision Counsel. 18 USC 32 – Destruction of Aircraft or Aircraft Facilities
The FBI lists assault, interference with flight crew, and sexual misconduct during flights among the violations it investigates aboard aircraft.7Federal Bureau of Investigation. Crimes Aboard Aircraft A passenger who assumes a shove will produce nothing worse than a fine and a warning can instead face a federal indictment.
Bans, PreCheck Loss, and the No Fly List
Passengers who avoid criminal charges still face travel consequences. Airlines maintain their own internal no-fly lists, and unruly behavior is the most common trigger. These bans can be permanent at the carrier’s discretion, and there is no standardized appeals process across airlines.
The TSA can suspend or permanently revoke PreCheck enrollment for passengers involved in security incidents. Disqualifying conduct includes threats, assaulting or intimidating flight crew, interfering with security operations, and bomb threats. A first offense can bring suspension for up to five years, and egregious or repeat incidents can lead to permanent disqualification.12Transportation Security Administration. Can I Be Disqualified or Suspended from TSA PreCheck
The federal No Fly List, maintained by the FBI’s Threat Screening Center, is more severe. Placement on it bars a person from flying commercially to, from, or over the United States, and it is generally reserved for individuals assessed to pose a terrorism-related threat to aviation. Threats made aboard aircraft that could be considered domestic terrorism can trigger inclusion. An airline ban keeps you off one carrier. The federal list keeps you off every flight.
How an Incident Moves From Cabin to Prosecution
The reporting chain tracks the severity. At Level 1, the crew documents the behavior and files a report with the airline after landing, and the airline may refer the case to the FAA for civil enforcement. At Level 2 and above, crews notify air traffic control during the flight so ground security and law enforcement can coordinate in real time.1Federal Aviation Administration. Advisory Circular 90-103 – Reporting of Threats in Accordance with the Common Strategy
For criminal cases, the FAA shares information with the FBI and the Department of Justice through a formal referral protocol. Meeting the aircraft at the gate with agents is standard for flights that have reported Level 2 or higher incidents.7Federal Bureau of Investigation. Crimes Aboard Aircraft Whether a case moves from investigation to prosecution depends on the severity of the conduct, the evidence, and whether the incident endangered the aircraft or the people aboard.