E170/175, ATP/CFI/CFII, Civic Type R
Stated identity matches the résuméKey judgments
A pilot with a terroristic-threats case is posting antisemitic content under an aviation identity
On the night of October 8, 2026, the Instagram account @flyguy_sky1212 posted a 9/11 blood-libel meme, an antisemitic caricature, an "I want you to die for Israel" image and a Mossad false-flag line on an aviation news page. The account's bio advertises the Embraer 170/175 and airline transport pilot credentials. The public record ties it to Ricardo Roman-Flores of Absecon, New Jersey, a Republic Airways first officer by his own profile, who was arrested with his twin brother by Homeland Security Investigations on December 9, 2025 over threats to shoot ICE officers on sight and hang a DHS official.
The conduct is documented
The memes were captured while live and the thread was re-examined the next day. By October 9 the images were deleted, the replies were left as empty shells, and the account was set to private.
The attribution is strong
The account's stated credentials match his LinkedIn line for line. His LinkedIn slug, two email addresses and his gaming and fishing handles carry the same four-digit signature. His brother's own Facebook names @flyguy_sky1212 as a separate person. Confidence: high.
Access is the open question
His profile ends the Republic Airways job in December 2025. His own comments in July and August 2026 describe go-home legs and a captain in the cockpit. Which airline, if any, is scheduling him today is unconfirmed.
SGI assessment: the combination of a resolved terroristic-threats case, an active First Class medical, antisemitic posting under a pilot identity and evidence of continued airline flying warrants verification of current employment and access by any carrier that employs him. The record does not establish an attack plan. It establishes a pattern of conduct that a background check at hiring could not have caught and that airlines must evaluate when it surfaces.
Full analysis and evidence
01 · The posts
Four antisemitic images in one thread, then a deletion sweep
Aero Crew News, an aviation industry page, posted on October 8 that United Airlines had again pulled Captain Ibrahim Mossallam from service over his October 7 posts. The comment section filled with pilots. In it, @flyguy_sky1212 posted, in sequence: a Nike swoosh reworked into the Twin Towers with an aircraft and the caption "JEWS DID IT."; a Scooby-Doo unmasking panel captioned "EVERY FREAKING TIME" revealing an antisemitic caricature; an Uncle Sam Trump image reading "I WANT YOU TO DIE FOR ISRAEL"; and, to a commenter who asked why he had deleted his memes, "mossad might use this for their next false flag gotta be careful you know."
What each image is
The swoosh image is a 9/11 blood libel: the claim that Jews carried out the September 11 attacks. The Scooby-Doo panel uses a hooked-nose caricature that the International Holocaust Remembrance Alliance's working definition lists among classic antisemitic tropes. "Die for Israel" asserts that American foreign policy serves Jewish interests at American expense. The Mossad false-flag line extends the same frame to current events. These are not ambiguous political statements; they are recognizable antisemitic tropes posted in a professional aviation forum.
The venue matters
This was not a private group or an anonymous forum. It was a public thread on an aviation industry page, under a story about a pilot being removed from service for his posts. The account chose that audience and that context.
Deleted within a day, then locked
When I reached the thread on October 9, the images were gone. The reply shells remained, each showing the handle, the timestamp and the like count with no content. The profile had been set to private. The deletions and the privacy change followed public pushback in the thread the previous night.
Reading limit: the October 8 images were captured by a member of the public and supplied to me. I verified the thread, the handle, the empty reply shells and the private status directly on October 9. I did not observe the images live myself. The captures are consistent with the live thread in every checkable detail: handle, avatar, host post, reply positions and timestamps.
02 · Attribution
The account's credentials match one man's résumé
The @flyguy_sky1212 bio reads: 25' FL5 Type R, 24' XSR 900, E170/175, ATP/CFI/CFII. That is a 2025 Honda Civic Type R, a 2024 Yamaha motorcycle, the Embraer 170/175 type rating, and airline transport pilot, certified flight instructor and instrument instructor certificates. The avatar is a blue Civic Type R.
Ricardo "Rico" Roman-Flores's public LinkedIn profile, at the slug ricardo-roman-flores1212, describes an airline pilot in Absecon, New Jersey, with ATP and CFII certificates, an Averett University aviation degree, and employment as a First Officer at Republic Airways from October 2024 to December 2025 on the E170/175. It lists a 2024 King Air captain job at Dynamic Aviation in Virginia and two years as a flight instructor at Averett.
Instagram @flyguy_sky1212E170/175 · ATP/CFI/CFIILinkedIn ricardo-roman-flores1212Republic Airways · E170/175FAA airman recordFirst Class medical 9/2025Ricardo Roman-Flores
The four-digit signature
The "1212" suffix appears on his LinkedIn slug, on two email addresses associated with him in public records and breach data, and on gaming and fishing-app usernames registered to those addresses over a decade. It also appears on his brother Emilio's Facebook handle and on a third brother's Instagram handle, so the digits are a family habit rather than a unique identifier. What separates the accounts is content: Emilio's Facebook page describes a 2023 Honda Shadow with "Owner: @flyguy_sky1212, Rider: @angel_roman1212," naming the account in the third person as a different member of the household.
The twin problem, addressed
Ricardo and Emilio are identical twins who share an address, and the December affidavit describes an X account that one brother created and the other used. Shared use of @flyguy_sky1212 cannot be excluded on the public record. Three facts weigh against it: the credentials in the bio belong to Ricardo and not to Emilio, who is a Rowan University scientist with no FAA record; the account's comment history is that of a working airline pilot; and Emilio refers to the account as someone else's. I rate the attribution of the account to Ricardo as high confidence, and the attribution of each individual post to his hand as probable.
The FAA record
The FAA Airmen Inquiry lists Ricardo A. Roman-Flores in Absecon with a First Class medical dated September 2025, the class an airline pilot must hold. No airman named Emilio Roman-Flores appears. The certificates field on his record displays "None." I have not established what that reflects; it can indicate a certificate action, a data lag, or an opt-out, and it should be resolved through the FAA directly before any conclusion is drawn.
Attribution insight: the strongest link is not the username. It is that the account describes a specific set of credentials, a specific aircraft type and a specific motorcycle, and one public résumé in one New Jersey household matches all of them.
The digital footprint, explained
Five identifiers that confirm each other
Open-source intelligence connects public clues into an evidence trail. Here the Instagram account, the LinkedIn profile, the FAA record, a suspended X account and a Google reviewer profile each tie back to the same person through different kinds of evidence: stated credentials, a licensing database, breach records and a shared email address. Selectors are redacted below.
RICARDO ROMAN-FLORESPublic aviation identity · @flyguy_sky1212
Republic Airways First Officer, Oct 2024 to Dec 2025
Explicit professional recordFirst Class medical, September 2025
Licensing database@Rroman_12Roman, created 2013, now suspended
Linked through breach recordsReviewer profile under his name, Absecon, 2025 to 2026
Same email, public reviews25 breaches, 2016 to 2025, including stealer logs
Internal record, not publishedThe suspended X account
A 2021 breach of X user data ties the handle @Rroman_12Roman, created in August 2013, to his email address. The handle returns "Account suspended" today. No archive of it exists. Public reporting says Ricardo created the X account from which the December threats were posted, but no report names that handle. The suspension is consistent with it being the threats account; I have not confirmed that it is.
03 · The December case
"Shoot ICE on sight"
On December 8, 2025, an X account replied to DHS Assistant Secretary for Public Affairs Tricia McLaughlin. According to the posts as quoted by Fox News:
"[The Second] Amendment is in place for moments like this. Shoot ICE on sight."
"We Americans should find you, tar you, feather you, and hang you as we did to anyone serving tyrants."
The probable cause affidavit, as reported by BreakingAC, counted 16 posts threatening law enforcement, federal officials and Jewish people. The account, per the affidavit, was created by Ricardo while he was in Virginia; Emilio was given full access and wrote the posts. Emilio told investigators his brother created the email for "a non-attributional account to make threats from so no one would know it was him."
The raid
Homeland Security Investigations agents and Absecon police SWAT executed search and arrest warrants at the twins' home on Spruce Street. Jail records cited by BreakingAC show both booked into the Atlantic County Justice Facility late on December 8. Seized: an assault rifle, three high-capacity magazines, seven phones, two desktop computers, an iPad and a laptop.
Charges and status
| Dimension | Evidence in this record | Analytical implication |
|---|---|---|
| Charges | Conspiracy to make terroristic threats (DHS). A second filing lists bias intimidation and unlawful possession of an assault firearm (BreakingAC, from the affidavit). | The threats count is the one DHS announced; the weapons and bias counts come from a second complaint reported by the local outlet. |
| Plea | Plea to accusation, February 12, 2026, Atlantic County case 25005533 (public court data). | A plea to an accusation waives indictment; it does not by itself specify which counts survived. |
| Disposition | Admitted to Pre-Trial Intervention, May 14, 2026 (public court data). | PTI is supervised diversion. Complete it and the charges can be dismissed. It is neither a conviction nor an acquittal. |
| Custody | Booked December 8, 2025. No detention order located after the PTI admission. | Not in custody, inferred from the PTI admission and his summer 2026 activity. Not confirmed through an official custody lookup. |
| Brother | Emilio: 11 counts including unlawful possession of an assault weapon, terroristic threats, criminal coercion, bias intimidation and cyber harassment; plea February 12 and PTI May 26, 2026. | Both brothers received diversion. The family's fundraiser launched the day of the pleas. |
The accusation's count list, the PTI term and conditions, and whether the firearm count was dismissed or downgraded are not in any public source I reached. New Jersey's court records portal blocks access from outside the United States; an in-state search of case 25005533 or a request to the Atlantic County Criminal Division would close those gaps.
04 · Access
His profile ends the job in December. His comments say otherwise.
LinkedIn dates the Republic Airways position from October 2024 to December 2025. Republic operates as American Eagle, Delta Connection and United Express, so a Republic first officer flies under all three brands. Whether Republic terminated him, placed him on leave or took him back after the PTI admission is not stated anywhere public, and Republic has not been asked for this report.
His own public comments suggest he kept flying. On a July 19, 2026 post about a Delta captain loading bags, @flyguy_sky1212 wrote: "Will go above and beyond to make sure I can get home on my go home leg." A go-home leg is airline crew language for the last flight of a trip. On an August 7, 2026 air traffic control explainer he wrote that a captain had remarked on his hold-entry radio calls and that he "only did because I heard the delta guy do it." Both are present-tense cockpit accounts from after his May 14 PTI admission.
A search of the handle across indexed Instagram comments returned 28 results. None contained hate speech or threats; the October 8 posts were deleted before indexing. Twelve were aviation comments consistent with a working regional pilot: New York airspace escape plans, reserve scheduling ("they say no and then I wait and don't get called"), hold-entry procedure, a San Diego runway incident. The rest were motorcycle and car comments matching the bio.
A First Class medical and cannabis dispensary reviews
A Google Maps reviewer profile under the name Ricardo Roman, tied to his email address, left five-star reviews at two Absecon cannabis dispensaries in March 2026 and at a vape shop in October 2025. The dispensary reviews fall between his plea and his PTI admission.
Why it matters for a pilot
Marijuana remains a federally controlled substance. The FAA does not permit its use by airmen in any form, medical card or not, and Part 121 pilots are subject to DOT drug testing. A review is not proof of use. For a pilot holding a First Class medical, it is a question an employer would have to ask.
05 · Public presentation
"Defend free speech"
On February 12, 2026, the day of the pleas, a brother launched a GoFundMe titled "Justice for Emilio & Ricardo: Defend Free Speech." It describes the twins as "an airline pilot for Republic Airways and a scientist," calls the arrest "a misunderstanding involving their First Amendment rights," and says the content "did not even violate social media platform guidelines." It had raised $2,077 of a $10,000 goal from 26 donations when captured. The affidavit, as reported, counted 16 threatening posts. The page's photo gallery includes the cockpit photograph used on this report's cover.
Context in sequence
From threats to diversion to blood libel in ten months
Posts threatening ICE officers and a DHS official. Both brothers booked into the Atlantic County Justice Facility.
DHS announces the arrests. LinkedIn later dates the end of the Republic Airways job to this month.
Pleas to accusation. The "Defend Free Speech" fundraiser goes live the same day.
Ricardo admitted to Pre-Trial Intervention; Emilio on May 26.
Comments describe go-home legs and captain interactions in the cockpit.
Flydubai FZ1073 cockpit attack. Insider risk becomes the aviation-security frame.
Blood-libel memes and Mossad false-flag line posted on the Aero Crew News thread.
Images deleted, account private. This review captures the remaining record.
06 · Threat indicators
Separate the conduct, the capability and the intent
| Dimension | Evidence in this record | Analytical implication |
|---|---|---|
| Hostile ideology | Four antisemitic images in one thread, including a 9/11 blood libel, under an aviation identity. | Documented bias expression; relevant to a carrier's conduct standards and to insider-threat baselines. |
| Prior threat conduct | Arrested over posts threatening to shoot federal officers and hang an official; weapons seized; diversion granted. | A resolved case, not a conviction, but the only known instance in this series of a pilot with a terroristic-threats arrest. |
| Capability and access | E170/175 type rating, First Class medical, Republic Airways employment through December 2025, comments consistent with flying through August 2026. | Verify current employer, status and duty assignment through authorized channels. Social evidence cannot substitute for personnel records. |
| Intent and preparation | No post in this record names an aircraft, route, target or plan. | Do not describe an attack as planned or imminent on this evidence. |
| Concealment behavior | Deleted the images within a day of pushback; set the account private; the December account was, per the affidavit, built to be non-attributional. | A repeated pattern of posting and erasing, which argues for preservation and prompt review rather than waiting for the next instance. |
| Fitness signals | Cannabis dispensary reviews from an account tied to his email while holding a First Class medical. | A question for the employer and the FAA, not a finding of use. |
Would raise concern: a direct threat, aircraft- or route-specific language, verified current airline employment coupled with continued hostile posting, or a positive drug-testing history.
Would reduce concern: authoritative confirmation that he holds no current airline position or cockpit access, or evidence that the October 8 account was operated by someone else.
07 · Why the context matters
Four pilots, four airlines, three weeks
Since September 30, four airline pilots have surfaced in public threat or extremism contexts: the flydubai FZ1073 co-pilot accused of attacking his captain with a crash axe; United captain Ibrahim Mossallam, withheld from service again over October 7 posts; EgyptAir's Osama Mansour, whose El Al video carried "violence for violence" audio; and now a Republic Airways first officer with a terroristic-threats case posting blood libel. I assessed the Mansour case in a separate report.
The cases share a context, not a connection. No operational link among them has been identified, and none should be implied. What they share is a gap: airline hiring screens for medicals, hours, training records and a criminal background check at the point of hire. None of that catches conduct that begins after hiring, or conduct that resolves through diversion rather than conviction. The Roman-Flores case is the clearest example in the series: a December arrest, a May diversion, and summer comments from the cockpit.
08 · Decision support
What a proportionate review should resolve
- Verify current employment and access. Republic Airways, and any carrier that has hired him since, should confirm whether he holds a current position and duty assignment. That is the single fact that determines how urgent this is.
- Preserve the record. The October 8 images were deleted within a day. The retained captures, the empty reply shells and the private-profile notice should be preserved with integrity records before further deletions.
- Resolve the FAA certificate display. The registry shows a current First Class medical and no certificates. The FAA can state whether that reflects a certificate action.
- Obtain the court record. The accusation and the PTI order on case 25005533 will list the surviving counts and conditions, including any weapons restriction.
- Keep the standard consistent. United removed a captain for posts praising an attack. A first officer with a terroristic-threats case posting blood libel on an industry page should be evaluated by the same standard, whichever carrier employs him.
09 · Evidence and reading limits
The evidence behind this assessment
The assessment draws on public-profile captures, the supplied October 8 screenshots, live captures of the Instagram thread and profiles on October 9, the DHS release, local and national reporting on the arrests, the FAA Airmen Inquiry, a public-records report with court data, the family fundraiser, and a search of indexed public comments by the handle. Breach and account-association records were used to confirm the email-to-handle links and are retained internally; selectors are not published. Screenshots establish what the interface displayed; they do not independently authenticate every biographical claim. This is a focused threat assessment, not a complete account history or an employer investigation.
- Aero Crew News post and thread; Instagram @flyguy_sky1212.
- LinkedIn profile; FAA Airmen Inquiry.
- DHS release, December 9, 2025; BreakingAC on the affidavit, jail records and the second filing; Fox News with the quoted posts; Philadelphia Inquirer.
- The family fundraiser.
- July 2026 comment; August 2026 comment.
- SGI, "Another airline pilot raises threat concerns," October 9, 2026, for the EgyptAir, flydubai and United context.
A commenter targeted in the thread is redacted throughout. The member of the public who supplied the October 8 captures is not identified. Home address, phone numbers and email addresses are withheld. Assessment cutoff: October 10, 2026.
A background check could not have caught this. The record now can.
The strongest finding is a pilot-identified account posting recognizable antisemitic tropes on an industry page, erased within a day. The strongest attribution is a set of stated credentials that match one public résumé. The most consequential fact is a terroristic-threats arrest that resolved through diversion while, on his own account, he kept flying. The open question is whether any airline currently has him in a cockpit. Resolving that question, and holding the answer to the same standard applied to other pilots this month, is what turns an online controversy into a security decision.
For documented digital investigations and case support for counsel, law enforcement and employers, discuss your matter with ShadowGraph Intelligence. Follow Travis Hawley on X and Instagram.