There are three leading theories regarding the loss of Metrojet 9268 on Oct. 31, 2015: 1) a missile fired from the ground, 2) mechanical malfunction which resulted in catastrophic damage, and 3) an explosion from inside the aircraft.

To recap the tragic flight, Metrojet 9268 took off from Sharm el-Sheikh International Airport headed for St. Petersburg at 5:51am local time (03:51UTC). At 6:14am, 23 minutes later, the aircraft disappeared from radar screens.

An analysis of the flight parameters shows that at 04:12:58 UTC, just after passing 31,000 feet, the vertical speed changes from the steady climb of just under 600fpm to a negative 320 fpm in the next second.

A study of the ADS-B data from Flightradar24.com surrounding the time of the incident informs the likelihood of each theory.

The data conflicts for a few seconds showing the plane’s altitude increasing as the rate of descent accelerates. This momentary aberration may have been caused by the violent forces the sensors were experiencing. Two seconds later the plane begins falling at a rate between 4000 and 8000 fpm. The ground speed decreases at a rate consistent with a ballistic trajectory as the flight path of the debris curves towards the ground until 04:13:12, 14 seconds after the initial anomaly, the horizontal speed becomes minimal and the vertical rate of descent stabilizes. 10 seconds later the data transmission was discontinued.

Of the three theories, the first, a missile fired from the ground by ISIS, can be reasonably discounted. The aircraft broke up nearing its cruise altitude of 32,000 feet. Shoulder-launched MANPADS are only a threat to targets below 20,000 feet. A much more sophisticated Surface to Air missile system, including search and fire-control radars, as well as the missile battery itself, would be required to bring a target down at that altitude. ISIS is not known to be in possession of such a system.

The second theory of a mechanical or structural failure resulting in catastrophic damage is certainly plausible. There were initial reports from the First Officer’s wife on Russian TV where she stated he had complained about the general condition of the plane. She quoted him saying “The technical condition of the aircraft left much to be desired.” This is an open ended statement that leaves a wide swath subject to interpretation. The conditions he spoke of may have ranged from an inoperable lavatory to a critical component of the aircraft that the pilots were working around in order to complete the mission.

Another possibility is an ignition of fuel vapors in an empty fuel cell such as the TWA 800 mishap in 1996. An improperly maintained fuel pump may have short circuited in an empty fuel cell, sparking the remaining vapors and creating a devastating explosion. A further possibility is a faulty or improperly latched cargo door such as the one which brought down Turkish Airlines 981 in 1974. In that case, the faulty door was improperly secured and failed at altitude causing an explosive decompression and disabling the flight controls. Any of these scenarios should be quickly and easily discerned by accident investigators.

The third scenario of an explosive device detonating from inside the aircraft has recently become much more likely. It was reported a US infrared satellite detected a heat flash over the Sinai Peninsula at the location where the plane came apart.  NBC News cited an “unnamed defense official” stating that the flash could have been from an explosion inside the plane. The Russian news station RT reported that forensic experts in Russia, upon initial examinations of the bodies, described that a number of the victim’s bodies had burn marks and that many, specifically in the tail section, had perished from blast injuries.

Furthermore, the Russian news agency Interfax, reported that investigators listening to the cockpit voice recorders heard what they described as “sounds uncharacteristic of a standard flight preceding the moment of the airliner’s disappearance from radar screens.” Interfax further reported their source saying, “The recordings suggest that an emergency situation occurred on board unexpectedly, took the crew by surprise, and the pilots had no time to send out a distress signal.”

Even today, the Intelligence communities in the United States and United Kingdom state evidence is leaning more and more in the direction of foul play aboard the aircraft. The AP is reporting the presence of “intercepts” of message traffic between ISIS operatives in the Sinai, suggesting premeditation for the attack. Those reports are yet uncomfirmed, but certainly support the prevailing theory. Along with those statements are new assertions from ISIS itself, via well-known social media streams not known for providing false information, that it is responsible for the downing of the aircraft.

Despite the management of Metrojet insisting that the incident was caused by “an external impact,” it seems increasingly possible that Flight 9268 could have been brought down by a bomb smuggled on board similar to Pan Am 103 over Lockerbie in 1988. Perhaps coincidentally, both Metrojet 9268 and Pan Am 103 broke up at the same altitude–31,000 feet. Despite declarations by Egyptian security forces, security screening at Sharm el-Sheikh International Airport remains suspect. It would take very little imagination to conceive of the Sinai Province of the Islamic State, the Egyptian arm of ISIS, wanting to retaliate against Russia for its actions in Syria.

One extra bag passed through the fence and loaded during boarding is all that would be required. What remains to be seen is how Vladimir Putin will react if this is proven to be an act of terrorism. It is unlikely he will be easily deterred from military operations in support of the Assad government. In what may well prove to be a serious miscalculation by ISIS, Putin may consider, however, focusing more military might against ISIS proper instead of against the Syrian rebels fighting the Assad regime.