Digital Audit: Ryanair

Enterprise Technology Stack & Vendor Relationships

Ryanair’s primary cloud and infrastructure vendor is Amazon Web Services (AWS), a US company, not an Israeli-origin provider ¹²³⁴⁵⁶. Ryanair has been an AWS customer since 2017 and has been migrating away from owned data centres onto AWS services including S3 data lake storage, Kinesis analytics, the Aurora database, Storage Gateway, Amazon SageMaker for customer-care machine learning, and Amazon Bedrock generative AI underpinning the internal “Ryanair Connect” cabin-crew employee app ¹²³⁴⁵⁶. No public evidence identified of a verified relationship between Ryanair and Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty, or Palo Alto Networks. Ryanair’s own corporate cybersecurity disclosure page and its published Information Security Policy (December 2021) reference NIST Framework alignment and unnamed “independent third-party” annual security audits, but name no specific vendor ⁷⁸. A November 2025 report noted claims of Ryanair-related data appearing on hacker forums, though no vendor or system responsible for any exposure was identified in that reporting ⁹.

Ryanair’s identity-verification vendor for its “Express Verification” facial/selfie biometric check on bookings made via online travel agents is GetID, a company headquartered in Tallinn, Estonia, which was acquired in 2021 by Checkin.com Group AB, headquartered in Stockholm, Sweden - i.e., not an Israeli-origin vendor ¹⁰¹¹.

Ryanair’s confirmed aviation-security-services vendor with Israeli origins is the ICTS International group, founded in 1982 by former Israeli Shin Bet and El Al Israel Airlines security professionals and remaining majority-controlled by the Atzmon family, headquartered in the Netherlands and trading OTCQB as ICTSF ¹². Confirmed operating-subsidiary engagements include: ICTS France supplying enhanced security services at check-in, the gate, and aircraft protection for Ryanair flights from Marseille Airport to Tel Aviv since October 2019 ¹³; and ICTS France beginning security services for Ryanair’s bi-weekly Paris-Beauvais–Eilat-Ramon (Israel) route from 19 December 2022 ¹³¹⁴. ICTS Ireland has been Dublin Airport’s security partner since 2003 - Dublin is Ryanair’s home base and largest hub, but this is an airport-authority contract rather than a confirmed direct Ryanair-ICTS agreement, and is presented here as indirect/contextual exposure only ¹⁵. No public evidence identified of a named systems integrator or digital-transformation consultancy mandating or recommending Israeli-origin technology for Ryanair.

Surveillance, Biometrics & Retail Technology

Ryanair’s facial-recognition identity-verification function is supplied by GetID (Estonian/Swedish ownership, detailed above), applied to Express Verification of online-travel-agent bookings at a stated fee of €/£0.59 per verification, and is not an Israeli-origin biometric system ¹⁰. No public evidence identified of Ryanair use of Trigo, BriefCam, AnyVision/Oosto, Trax, or comparable Israeli-origin biometric or video-analytics vendors for retail, loss-prevention, or airport-operations purposes. No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools in use at Ryanair. No public evidence identified that Israeli-origin biometric or surveillance technology reaches Ryanair indirectly via a platform provider or managed-security bundle.

The (non-Israeli) biometric verification system itself has drawn regulatory scrutiny: the Irish Data Protection Commission opened a statutory inquiry on 4 October 2024 under section 110 of the Data Protection Act 2018 into Ryanair’s Customer Verification Process, examining the GDPR lawfulness and transparency of the facial-recognition-based check ¹⁶¹⁷. noyb (European Center for Digital Rights) filed complaints with the Spanish and Italian data protection authorities in December 2024 alleging Ryanair “unlawfully nudges its users towards the processing of their highly sensitive biometric data” ¹⁸¹⁹. A separate lawsuit over facial-recognition use was also reported in 2023 ²⁰.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that Ryanair operates, leases, or co-locates data-centre infrastructure within Israel. No public evidence identified that Ryanair participates in Project Nimbus or any Israeli government cloud initiative. As vendor-level context rather than a Ryanair-specific action, Ryanair’s cloud provider AWS separately operates the AWS Israel (Tel Aviv) Region (il-central-1), opened August 2023 and developed in significant part through AWS’s participation, alongside Google, in the Israeli government’s Project Nimbus tender awarded in April 2021, with AWS’s Israel infrastructure investment reported at approximately $7.2 billion through 2037 ²¹²²²³. No public evidence identified that Ryanair’s own workloads are hosted in, or routed through, the il-central-1 region specifically; Ryanair’s publicly available AWS case studies reference no Israel-region deployment ¹²³⁴⁵⁶. No public evidence identified that Ryanair provides - as opposed to consumes - any data-sovereignty, data-residency, or infrastructure-resilience service to Israeli state institutions or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

Ryanair’s confirmed commercial relationship with an Israeli-founded security company is with the ICTS International group for physical/aviation-security services directly tied to Ryanair’s own Israel-bound flights, including the Marseille–Tel Aviv route from October 2019 and the Beauvais–Eilat-Ramon route from December 2022 ¹³¹⁴. ICTS’s founding personnel background in Shin Bet and El Al security, and its continued Atzmon-family Israeli-linked control, are documented ¹². This is characterized as a security-services relationship rather than a software or cyber-technology relationship; no specific technology system was identified as deployed for Ryanair despite ICTS’s own marketing referencing “technology solutions” among its broader offerings. No public evidence identified of any direct contract, partnership, or service agreement between Ryanair and the Israeli Ministry of Defence, IDF, Israeli intelligence agencies, or other Israeli state security bodies. No public evidence identified of Ryanair’s own technology being deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories. No public evidence identified of Ryanair developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day tools, or digital weapons systems.

AI, Algorithmic & Autonomous Systems

Ryanair’s artificial-intelligence and machine-learning use consists of Amazon SageMaker for customer-care workload management and in-flight-catering demand forecasting, and Amazon Bedrock generative AI powering the internal “Ryanair Connect” cabin-crew employee app; these deployments are internal, commercial-operations-facing, delivered via AWS, and not provided to any Israeli state, military, or security body ⁴⁵⁶. No public evidence identified of Ryanair AI/ML models being trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the OPT. No public evidence identified of Ryanair providing autonomous target-generation, automated threat-detection, or autonomous-tracking systems to any military or security force.

Technology Ecosystem & R&D Footprint

Ryanair’s software engineering arm, Ryanair Labs, operates hubs in Dublin (established 2014), Wrocław (Poland), Madrid (Spain), and Portugal, employing more than 600 people ²⁴²⁵. No Israeli R&D facility, engineering office, or innovation lab was identified. No public evidence identified of any acquisition by Ryanair of an Israeli-origin technology company, or of strategic investment by Ryanair in an Israeli startup or venture fund. No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between Ryanair and Technion, Hebrew University, the Weizmann Institute, or any other Israeli-domiciled research institution.

Civil Society Scrutiny & Regulatory History

No public evidence identified of an NGO or academic report specifically addressing Ryanair’s technology relationships with the Israeli state or operations in the OPT, across searches of Who Profits, the American Friends Service Committee’s investigate.afsc.org, BDS Movement lists, and Don’t Buy Into Occupation. Ryanair, Ryanair Holdings plc, Ryanair DAC, and named principals were not identified in the search-indexed summaries of the OHCHR’s September 2025 update to its settlement-business database of 158 listed enterprises; this absence from available summaries is treated as unconfirmed rather than a confirmed clearance ²⁶.

Identified boycott- or campaign-adjacent activity relates to route operations and staff conduct rather than technology provision. In June 2023, a Ryanair cabin-crew member’s in-flight announcement described a landing in Tel Aviv as arriving in “occupied Palestine,” prompting an apology from then-Ryanair DAC CEO Eddie Wilson, who told the Israeli ambassador to Ireland that Israel was “an important partner” for Ryanair and that the airline planned to invest in Israel to grow traffic and connectivity ²⁷²⁸. In February 2026, Ryanair apologised and opened an internal investigation after a staff member wore a pro-Palestine badge in a dispute at Stansted Airport ²⁹. These are labour-conduct and public-relations episodes rather than organized boycott or divestment campaigns targeting Ryanair’s technology provision.

Regulatory and legal actions identified - the Irish DPC’s statutory inquiry opened October 2024 and the noyb GDPR complaints filed in Spain and Italy in December 2024, alongside a 2023 facial-recognition lawsuit - concern Ryanair’s facial-recognition verification process generally, with no Israeli-technology or Israeli-jurisdiction nexus identified in any of the complaint materials reviewed ^1617181920. No public evidence identified of export-control, sanctions, or defense-technology-sales investigations involving Ryanair and Israeli state entities.

As operational, non-technology context relevant to assessing whether the ICTS security-services relationship remains active: Ryanair suspended Israel flights after 7 October 2023, briefly resumed and re-suspended service multiple times through 2024–2025 citing security incidents including a Houthi missile strike near Ben Gurion Airport and a fee/slot dispute with the Israel Airports Authority, and in November 2025 removed Tel Aviv entirely from its route map, with CEO Michael O’Leary stating in May 2025 that Ryanair was “running out of patience with Israel” over Ben Gurion Airport’s refusal to confirm 2026 summer slots ^3031323334. As of the most recent reporting reviewed, Ryanair does not operate any Israel routes, leaving the current operational status of the ICTS-Ryanair security-services relationship unresolved.

End Notes