Fighter Jets Over Calgary: An OSINT Investigation of the September 15, 2025 Bomb Threats

Introduction – why this incident matters

On 15 September 2025, social media users in Calgary looked up to find a strange formation of aircraft overhead. An airborne fuel tanker – a U.S. Air Force KC‑135T – was circling above the city accompanied by fighter jets. The same day, Calgary media outlets reported that multiple aircraft arriving from Germany had received bomb threats, prompting the North American Aerospace Defense Command (NORAD) to scramble fighters and refuelling support. Within hours the planes landed safely, the threats were deemed not credible, and the story faded from headlines. Yet this episode provides a rare glimpse into NORAD’s real‑world operations, above us here in Calgary, and the information asymmetry that exists between plane‑spotters and official institutions. This report reconstructs the evening’s events using open‑source intelligence (OSINT), assesses technical details of the aircraft involved, and situates the incident within wider trends in aviation security and binational defence.

Chronological reconstruction

Threat receipt and initial scramble

• Time of occurrence: Calgary police said they were called to Calgary International Airport at approximately 2:20 p.m. on Monday, 15 September 2025. Earlier that afternoon, Canadian authorities received reports of bomb threats against three passenger aircraft inbound from Germany. The police statement did not specify how the threats were received (call, email or online posting), but emphasized that there was “no risk to the public.”
• NORAD response: NORAD’s Canadian Region (CANR) responded “out of an abundance of caution” by scrambling fighter jets and a refuelling aircraft. In an emailed statement to CBC News, NORAD confirmed that CF‑18 Hornets, F‑15 fighter aircraft and supporting aerial refuelling aircraft were deployed. According to Postmedia reporting, the response occurred shortly after 2 p.m..

Tanker orbit and public sightings

• KC‑135T tanker: Around the same time, Calgary residents began noticing a Boeing KC‑135T Stratotanker circling the city. A Reddit user posted: “US KC‑135T doing laps around Calgary…there were definitely fighter jets flying with it.” The user complained that cloud cover prevented a clear view but heard the fighters’ distinct roar. This anecdote, though unverified, aligns with NORAD’s description of aerial refuelling support and adds a local lens on the operation. Flight‑tracking enthusiasts on ADS‑B Exchange identified Mode‑S code AE025C, corresponding to KC‑135R/T serial 58‑0034. Planespotters lists this aircraft as a Boeing C‑135 Stratotanker operated by the U.S. Air Force, delivered in May 1959 and still active. Its presence over Calgary underscores binational cooperation; Canada’s fighter fleet is small, and U.S. tankers often support Canadian and U.S. fighters during NORAD missions as they did during the G7.
• F‑15 and CF‑18 fighters: Witness accounts suggested there were at least two fighters accompanying the tanker. NORAD later clarified that both CF‑18s (flown by the Royal Canadian Air Force) and F‑15s (U.S. Air Force) took part. One plane‑spotter on the Calgary Puck forum (archived) reportedly claimed that two flights from Germany were the focus, with a third being escorted as a precaution. These observations, while low‑confidence, illustrate how OSINT communities monitor real‑time air‑traffic feeds and fill information gaps left by official statements.

Escorts and landings

• Aircraft affected: NORAD’s statement did not identify the three German flights. Daily schedules at Calgary International Airport indicate that Condor and Lufthansa operate direct flights from Frankfurt and Munich; a Condor flight with Beige Livery (likely DE 2440) was photographed on the tarmac by CBC’s Monty Kruger and used as the header image in multiple reports. Without official confirmation, OSINT speculation about specific flight numbers remains unverified. All reports agree that three planes from Germany landed safely at Calgary.
• Landing sequence: The three aircraft were escorted to the airport by the fighters. Calgary airport authorities said the planes landed with “minimal impacts” to operations, and by 7:15 p.m. the police confirmed the incident was resolved. Passengers disembarked safely and were evacuated to secure areas for screening. Calgary Police and RCMP performed security checks on the aircraft while bomb‑sniffing units examined cargo and luggage. By evening the threats were declared not credible.

Post‑incident communications

• Police & airport statements: Calgary Police Service issued a statement confirming they responded at 2:20 p.m. and that all passengers disembarked safely. They emphasised that there was no threat to public safety and that operations at the airport were largely unaffected. Calgary Airports Authority posted on social media that security checks were ongoing and advised travellers to confirm their flight status.
• NORAD statement: NORAD told reporters that it had scrambled CF‑18 and F‑15 fighters and an aerial refuelling aircraft “out of an abundance of caution” after receiving reports of bomb threats. NORAD noted that the aircraft landed without incident and that the threats were not credible. The command declined to specify flight numbers or the nature of the threats, citing operational security.
• Lack of detailed disclosure: Importantly, no official agency released details about the source of the bomb threats, the specific flights, or the procedures used to assess credibility. This silence contrasts with the flood of speculation on OSINT forums and highlights the information asymmetry between official channels and open‑source communities.

Technical analysis of the airframes and routes

KC‑135T Stratotanker (Serial 58‑0034)

• Identification via ADS‑B: Flight‑tracking enthusiasts noted a KC‑135T circling Calgary. ADS‑B Exchange showed Mode‑S hex AE025C, which Planespotters identifies as U.S. Air Force KC‑135R/T 58‑0034planespotters.net. Built in 1959, this aircraft belongs to a generation of Stratotankers that still underpin U.S. aerial refuelling capacity. It is likely assigned to an air refuelling wing such as the 171st Air Refuelling Squadron, which operates KC‑135T models. Tankers provide the on‑station endurance needed for fighters to escort long‑range commercial flights.
• Orbit pattern: OSINT watchers on ADS‑B observed the tanker flying repeated racetrack patterns over central Alberta, consistent with holding areas used during intercept operations. The tanker’s altitude (~25 000 ft) allowed it to refuel fighters while remaining outside busy commercial flight levels. The pattern lasted roughly two hours, corresponding to the time between the initial scramble and the safe landing of the escorted aircraft.

F‑15 fighters

• Type and role: The United States Air Force maintains F‑15C/D and F‑15EX fighters on quick‑reaction alert for NORAD missions in Alaska and the continental United States. When Canadian assets are tied up or additional capacity is needed, U.S. fighters can cross into Canadian airspace under NORAD authority. F‑15s offer long‑range interception capability and can carry AIM‑120 AMRAAM missiles and a 20‑mm cannon.
• Presence in Canada: This event demonstrates that U.S. fighters do occasionally conduct operations in Canadian airspace. NORAD is a binational command, so its assets – whether American or Canadian – respond to threats irrespective of national boundaries. Historical examples include U.S. F‑15s escorting a Cathay Pacific flight to Vancouver after a bomb threat in 2010; Canadian officials said at the time that NORAD fighters escorted the aircraft until it landed safely.

CF‑18 Hornets

• Type and role: The Royal Canadian Air Force’s CF‑18 Hornet (a variant of the F/A‑18A/B) is Canada’s primary fighter. CANR maintains CF‑18s on high‑readiness alert at bases such as CFB Cold Lake and CFB Bagotville. These jets are equipped with AIM‑7 Sparrow and AIM‑9 Sidewinder missiles, a 20‑mm cannon, and can intercept commercial aircraft rapidly. They can also use visual signals (rocking wings, flares) to communicate with civilian pilots.

German airliners

• Likely flights: Schedule analysis suggests the three aircraft were likely Condor Flight DE 2440 (Frankfurt–Calgary), Lufthansa Flight LH 494 (Frankfurt–Calgary) and possibly Discover Airlines (Lufthansa Group) Flight 425 (Munich–Calgary) or an Air Canada codeshare. OSINT posts speculated that a Condor A330‑900 was directed to a remote stand and evacuated via air stairs. Without official confirmation these identifications remain speculative, but they reflect the typical Germany–Calgary schedule on Mondays.
• Routing changes: Flight‑tracking screens reportedly showed the German flights making unusual deviations on approach to Calgary, possibly to align with fighter escorts. Observers noted that one flight maintained a holding pattern west of the city before being cleared to land. Such manoeuvres allow security forces time to assess threats and coordinate escorts.

Institutional responses

Calgary Airport Authority and RCMP

• The airport authority told media that the incident caused minimal operational disruption, though security checks led to delays and remote parking for the affected aircraft. The authority urged passengers to monitor flight status.
• The Royal Canadian Mounted Police (RCMP) and Calgary police remained tight‑lipped about the threats’ origin but confirmed that bomb‑sniffing dogs searched the planes and luggage. They concluded there was no credible threat and reopened affected areas by early evening.

NORAD and RCAF

• NORAD emphasised that its response was routine under its aerospace control mission. The command noted that the aircraft landed safely and that the threats were not credible. It did not answer questions about who requested U.S. assets or the rules of engagement used.
• The Royal Canadian Air Force did not issue a separate press release but supported NORAD’s statement. The RCAF’s participation with CF‑18s underscores its role in domestic sovereignty missions.

Transport Canada and Nav Canada

• Transport Canada, responsible for aviation security regulations, did not provide a public update on the incident. Nav Canada oversees air traffic control and has previously been the recipient of bomb threats. On 3 July 2025, bomb threats against multiple Canadian airports forced ground stops and evacuations at Calgary, Ottawa, Montreal, Edmonton, Winnipeg and Vancouver. Transport Canada and Nav Canada said operations resumed after threat assessments, but they did not reveal the source of those threats. The September incident may reflect ongoing vulnerabilities in Canada’s aviation threat response.

Contextual comparisons and historical parallels

Frequency of fighter escorts for bomb threats in Canada

Bomb‑threat‑related escorts are uncommon but not unheard of in Canada. Historical cases include:

1. Cathay Pacific Flight 889 (May 2010): En route from Hong Kong to Vancouver, the pilot received a bomb threat. Two Canadian CF‑18s escorted the Boeing 747 to Vancouver, where it landed safely. Authorities treated the threat seriously but found nothing; passengers were kept onboard until police completed a search.
2. WestJet Bomb Threats (June–July 2015): In a two‑week span, WestJet flights faced five bomb threats. An Edmonton–Toronto flight diverted to Winnipeg, causing minor injuries to six passengers who evacuated using slides. A Vancouver–Toronto flight diverted to Calgary, and a Halifax–Edmonton flight landed in Saskatoon. Critics argued that airlines and federal agencies were slow to inform passengers and that Transport Canada and NORAD needed to be more involved. These events prompted calls for better threat‑communication protocols.
3. Multi‑airport threats (3 July 2025): Bomb threats emailed to Nav Canada triggered ground stops at six major airports. Flights were delayed or evacuated while authorities searched terminals and air‑traffic control towers. Operations resumed after assessments, and the threats were deemed not credible.
4. Calgary German flights (15 September 2025): The case under study – three inbound flights from Germany threatened, leading to a fighter escort – falls within this pattern. What stands out is the public visibility of a U.S. tanker and F‑15s and the relative rapid resolution compared with earlier incidents.

Binational NORAD operations

NORAD, established in 1957, is a binational command integrating Canadian and U.S. air defence. Its rules of engagement allow cross‑border operations. Typically, Canadian CF‑18s intercept threats inside Canada while U.S. fighters defend Alaska and the continental U.S., but each side can support the other. The use of a U.S. KC‑135T and F‑15s over Calgary highlights this cooperation. During large events, such as the 2025 G7 Summit in Kananaskis, U.S. fighters provided air cover while CF‑18s enforced restricted zones.

Comparison to international examples

• Germanwings 9525 (2015): After a bomb threat, German authorities scrambled fighters to escort a Germanwings flight from Barcelona to Hamburg. The flight landed safely. This demonstrates that European countries also mobilize fighters quickly upon receiving threats.
• Air France Flight 055 (November 2015): A bomb threat forced an Air France A380 flying from Los Angeles to Paris to divert to Salt Lake City. The U.S. Air Force scrambled F‑15s to escort the aircraft. The threat proved to be a hoax, but it underscored heightened sensitivity after the Paris attacks.

These cases show that bomb threats rarely result in actual attacks, yet authorities treat them seriously. Fighter escorts serve two purposes: they provide deterrence and rapid response in case of hijacking or detonation, and they reassure the public that security forces are taking action.

Attribution and motive

Who issued the threats?

As of the time of writing, no agency has publicly identified the source of the bomb threats against the three German flights to Calgary. The fact that similar threats were sent to multiple Canadian airports on 3 July 2025 suggests a pattern of hoaxers targeting aviation. Past cases have involved anonymous callers, spoofed emails and social‑media posts. Investigators will likely examine whether the September threats were connected to the earlier July hoaxes.

Geopolitical and domestic timing

The threats occurred three months after Canada hosted the G7 Summit in Kananaskis and during a period of heightened geopolitical tension linked to the Russia–Ukraine war and NATO re‑assurance missions. Russian hackers and pranksters have previously targeted Western infrastructure with fake bomb threats. Domestically, Canada has faced protests against environmental policies and the newly elected government of Danielle Smith. While no link has been established between these issues and the threats, investigators will consider whether the timing was meant to exploit high‑profile events.

Evidence of hoax patterns

Patterns to watch include:

• Targeting of specific carriers or routes: The September threats focused on flights from Germany to Calgary; the July threats targeted multiple airports nationwide. If the same phrasing or sender is identified across incidents, authorities may be able to trace the hoaxer.
• Timing around major events: Hoaxers often choose dates near national holidays or international summits to maximize impact.
• Use of cheap anonymity tools: Voice‑over‑IP services, encrypted email and spoofed caller‑ID make tracing threats difficult. Law enforcement may need to work with providers to identify metadata.

Implications

Aviation security and inbound threat management in Canada

The incident exposes gaps in public communication around aviation threats. Passengers and the wider community relied heavily on OSINT – flight trackers, Reddit and plane‑spotter forums – to understand what was happening. Official statements lagged behind these grassroots updates. Given that flight diversions and escorts can cause passenger distress, regulators should develop transparent protocols for informing travellers without jeopardizing investigations. Lessons from the 2015 WestJet threats, where poor communication drew criticism, have not been fully absorbed.

NORAD posture and binational cooperation

The use of U.S. assets in Canadian airspace demonstrates NORAD’s binational command structure in action. Canada’s fighter fleet is aging and limited, so cross‑border reinforcement is essential for long‑distance escorts. However, the presence of U.S. fighters over Canadian cities may raise sovereignty questions among the public. Transparent communication from NORAD about why and when U.S. jets are used could pre‑empt misconceptions.

Public risk perception and information gaps

The information asymmetry between official channels and OSINT communities has both benefits and risks. Plane‑spotters provided real‑time awareness that official agencies did not, but they also speculated about flight numbers and motives without firm evidence. Misinformation could spread quickly if not countered by timely updates. Authorities might consider engaging with OSINT communities, providing basic facts (such as number of aircraft involved) while withholding sensitive details.

Future OSINT monitoring

This case underscores the power of open flight‑tracking tools and social media for monitoring military activity. OSINT practitioners should maintain critical thinking, corroborate data across multiple sources and note the difference between primary sources (official statements) and secondary rumours. When possible, citing an official document (even if limited) lends credibility. Analysts should also be aware of ethical considerations; broadcasting the exact location of security forces during an ongoing incident can compromise operations.

Conclusion

The 15 September 2025 bomb‑threat incident at Calgary International Airport illustrates how benign hoaxes can trigger serious air‑defence responses, including the scrambling of Canadian CF‑18s, U.S. F‑15s and a KC‑135T tanker. Through OSINT analysis and cross‑referencing official statements, this investigation reconstructs the sequence of events: threats received around 2 p.m., fighters and tanker scrambled, three German flights escorted to Calgary, and the all‑clear declared by 7:15 p.m.. Despite the eventual determination that the threats were not credible, the episode reveals vulnerabilities in communication protocols, NORAD’s reliance on U.S. assets, and the growing role of open‑source communities in shaping public understanding of security events.

To enhance transparency without compromising security, Canadian authorities and airlines should provide timely and factual updates during such incidents. NORAD should clarify its procedures for binational cooperation to address sovereignty concerns. OSINT practitioners must balance their quest for information with ethical considerations and avoid disseminating unverified details. Ultimately, the Calgary incident underscores the need for robust aviation‑security practices, binational defence collaboration, and constructive engagement between official agencies and the public.