The Ankara Decoy: How the Secret Service Flew Trump Out of Turkey While Air Force One Became Bait
RAGE Global · Intelligence · Analysis · Updated 2026-08-12 · 9 min read
How a catering truck, a C-32A and a live surface-to-air missile threat turned Air Force One into bait — and why the story only broke five weeks later.
ANKARA / WASHINGTON — 12 August 2026
On the evening of 8 July, President Donald Trump climbed the airstairs of the legacy VC-25A at Ankara's Esenboğa airport in full view of the television cameras, waved, and disappeared into the cabin. The traveling press filed aboard behind him. The aircraft took off as Air Force One, bound for RAF Mildenhall in Suffolk.
The president was not on it.
According to reporting first published by The Washington Post on 10 August and subsequently corroborated in whole or part by The New York Times, NBC News, ABC News and Reuters, Trump was removed from the aircraft within minutes of boarding, concealed inside an airport catering truck raised on hydraulics against a door on the opposite side of the fuselage, driven across the ramp, and loaded onto a US Air Force C-32A — a militarized Boeing 757-200 normally flown for the vice president. That aircraft carried him to Britain under a routine military identity while the 747 flew the Air Force One call sign with two Cabinet secretaries, senior White House staff and the press pool aboard, none of whom had been told the principal was gone.
The operation was driven by an Iranian assassination threat. Trump confirmed the substance of it on 11 August, telling reporters at Joint Base Andrews that the Secret Service and the military made the call and that he complied. Asked what prompted it, he said only that there was a threat out there and that he had not asked many questions about it.
The sequence
The Ankara movement was not an improvised scramble. It was a rehearsed deception with a public-facing cover story built days in advance.
Trump had flown into Turkey on 7 July aboard the Qatari-donated Boeing 747-8 — designated the VC-25B "Bridge Aircraft" by the administration — on its first international mission. Before departing, he announced publicly that he would take the older baby-blue VC-25A home instead, framing it as sentiment and saying the new jet was being sent ahead to Mildenhall so US personnel based in eastern England could look it over.
What actually happened, per the reporting:
- ~20:30 local, 8 July. Trump boards the VC-25A on camera. Within minutes he exits through a door on the far side of the aircraft into an elevated catering truck. CNN's frame-by-frame review of tarmac footage places the truck pulling away from the aircraft at 20:30.
- On the truck. The Washington Post reported on 12 August that the president was accompanied by Deputy Chief of Staff Dan Scavino, executive assistant Natalie Harp, and Director of Oval Office Operations Walt Nauta, plus a small number of lower-profile aides. No Cabinet officials were in the vehicle.
- The transfer. Trump boards the C-32A. Defense Secretary Pete Hegseth boards the same aircraft separately and publicly, by external stairs — a move that made him appear to be the senior-most official on a routine support flight and reinforced the cover.
- The decoy departs. The VC-25A launches as Air Force One. Reporters in the press cabin are instructed to keep window shades down for the entire flight; a Secret Service agent comes back to reinforce the order, and a photographer who lifts a shade is told to close it.
- ~22:20 UK time. The C-32A lands at RAF Mildenhall.
- The reassembly. Trump deplanes the C-32A out of camera view, reboards the VC-25A, and then walks across the tarmac in full view of photographers to the Qatari VC-25B for the transatlantic leg to Washington.
The public record for five weeks was that the president had flown the old Air Force One out of Turkey for nostalgic reasons. Every visible element of that sequence was staged to sustain that record.
The threat
The specific intelligence has not been released, but the outline is now reported from several directions and it is not vague.
The New York Times, citing two US officials, reported that intelligence agencies had multiple streams indicating a plan to fire a surface-to-air missile at Air Force One — meaning whichever aircraft was carrying the president — and that a person had been observed in the vicinity of the summit carrying a shoulder-fired missile. The same reporting indicates Iranian actors had localized Trump's position in Ankara with precision, down to the floor of the building he was staying in. The Wall Street Journal reported that Israeli intelligence briefed the administration on the shoulder-fired missile threat.
The timing is the part that matters operationally. Ankara is roughly 1,200 kilometres from the Iranian border, and Turkey borders Iran directly. The summit ran 7–8 July, in the middle of an active shooting war: Iranian forces struck three commercial vessels near the Strait of Hormuz on 7 July, the US answered with strikes on more than 80 targets and reimposed oil sanctions, and on 8 July — from the NATO stage in Ankara — Trump declared the June ceasefire memorandum dead and promised further strikes. CENTCOM launched another round that night. Iranian air-defence sirens were sounding in Bahrain and Kuwait within hours.
Tehran's public posture toward Trump personally has been explicit since the 2020 Soleimani strike, and calls for his death featured prominently in mourning observances for Ali Khamenei, killed in the opening phase of the war on 28 February. Threat streams of this kind are chronic. What made this one actionable, by the account of every official who has spoken, was specificity: a weapon type, a target designation, and a person on the ground.
A MANPADS shot against a departing wide-body on climb-out is the scenario that presidential airlift planners treat as the hard case. The window is short, the launcher is small and mobile, and no amount of ramp security controls the terrain under the departure path.
The aircraft problem
This is where the Ankara operation stops being a protective-detail story and becomes a procurement story.
Under normal convention, Air Force One is a call sign, not an airframe: it attaches to whatever US Air Force aircraft is carrying the president. On 8 July that convention was deliberately inverted. The call sign stayed with the 747 while the president flew elsewhere. The designation moved; the protection did not.
The VC-25A fleet — two heavily modified Boeing 747-200Bs in service since 1990 — is built to survive exactly the environment Ankara presented. Published descriptions include electromagnetic-pulse shielding, hardened airframe elements, secure command-and-control suites allowing the aircraft to function as a national command post, aerial refueling capability, and an onboard self-defence system whose details remain classified. Fighter escort is available when the threat picture warrants it.
The Qatari-donated VC-25B does not have all of it. The New York Times reported on 9 July that the aircraft lacks the advanced anti-missile countermeasures standard on the older presidential jets, including the infrared countermeasures designed to defeat heat-seeking missiles. Independent analysts have specifically flagged the absence of a directed-infrared countermeasure — the laser-based system that is close to standard issue on heavy transports flying heads of state.
The retrofit was executed by L3Harris in under ten months with roughly 400 personnel. Air Force Secretary Troy Meink told Congress in June that the conversion cost under $400 million. The Air Force's position is that the aircraft meets core presidential mission requirements and is safe and secure. That position and the operational decision to leave the jet on the ground in Ankara are difficult to reconcile, and the administration has not attempted to reconcile them publicly.
The C-32A Trump actually flew is not a command post. It is a 757 airframe with hardened communications, threat-warning systems that alert the crew to air and ground threats, and a design deliberately configured so that crew can observe around and beneath the aircraft. Its principal virtue on 8 July was that nobody was looking for it. That is a real capability — obscurity is a countermeasure — but it is not armour, and Trump himself has since said he believed his aircraft carried the greater risk because it was the one he assumed an adversary would go after. That reasoning does not survive contact with the fact that the decoy was the aircraft flying under the presidential call sign.
The VC-25B has since been pulled for what Trump described as being "maxed out" with additional upgrades. Press Secretary Karoline Leavitt said on 21 July the work would run roughly a month, in the autumn, with the president flying the legacy aircraft in the interim. Analysts expect flare and chaff dispensers, countermeasure integration, and software work.
Who was left on the decoy
The most durable political damage in this story is not the deception. It is the manifest.
Aboard the VC-25A when it launched from Ankara: Secretary of State Marco Rubio, Treasury Secretary Scott Bessent, Deputy Chief of Staff Stephen Miller, Communications Director Steven Cheung, Deputy National Security Adviser Michael Needham, Staff Secretary Will Scharf, and the White House travel pool.
Reporting on what those passengers knew is not yet consistent. ABC News reported that Rubio, Bessent and Hegseth were all aware the president had switched aircraft. The New York Times reported that Rubio and Bessent were not. Both accounts rest on unnamed officials, and neither has been resolved on the record. RAGE X treats the awareness question as open.
What is not in dispute is that the press pool was not told, was ordered to fly blacked out, and believed for the duration of the flight that it was travelling with the president. Asked at the time why the shades were down, Trump told reporters they were probably on a dangerous flight, and added: "But if I go, you go."
The critique writes itself and has been made by practitioners on both sides. Joe Lockhart, press secretary under Bill Clinton, told the Times the administration appeared to have given no thought to anyone but the president and the handful of people with him, and drew a direct contrast with Clinton-era practice of minimising the number of civilians left exposed. Joseph W. Hagin, a deputy chief of staff under George W. Bush, argued the opposite: that anyone travelling with a president accepts non-trivial risk, and that briefing the manifest would have destroyed the operation.
Both are correct, and that is the problem. The two propositions — protect the principal by making the threat aim at the wrong aircraft, and do not use uninformed civilians as the aimpoint — cannot both be satisfied by this plan. A third option existed on paper: move the press and non-essential staff by separate charter and fly the 747 empty or minimally crewed. Nobody in the administration has explained why it was not taken.
Former Secret Service agent Paul Eckloff, who supervised the Presidential Protective Division, characterised the movement as unusual but not unprecedented, and consistent either with actionable intelligence or with heightened caution in a volatile theatre. Another former agent, Bill Gage, told Fox News the passengers left behind probably did face elevated risk, and described the decision not to inform them as a calculated one taken at senior levels.
Precedent
Decoy movements are part of the protective repertoire, but the historical comparisons are instructive mainly for where they diverge.
In March 2000, Bill Clinton flew from Mumbai to Pakistan aboard an unmarked white aircraft while the marked presidential jet flew the route with Secret Service personnel aboard. The departure ceremony was broadcast live; the substitution was executed with the press largely aware something was happening. After 11 September 2001, the White House told reporters George W. Bush had been taken to an undisclosed location — a deliberate concealment, but an announced one. During the 2024 campaign, after intelligence indicated Iranian operatives with access to surface-to-air missiles were operating inside the United States, Trump's detail moved him on a decoy aircraft belonging to a private associate; staff who learned of it afterward objected to being potential collateral damage.
The Ankara operation differs on two counts. The president's location was concealed not only from adversaries but from the American public and from senior officials of his own government for a period of hours, and the White House affirmatively stated a false position rather than declining to state one. That distinction — omission versus assertion — is what has driven the reaction in Washington.
The political aftershock
The administration has not disputed the reporting. Communications Director Steven Cheung, who was himself on the decoy, responded to the Post with a statement noting that many enemies of America have the president in their sights and that every available tool is used to address those threats. The Air Force referred questions to the White House and reiterated that the new aircraft is safe, secure and appropriately equipped. The Secret Service declined comment. On 11 August Trump confirmed the switch himself, attributing the decision to the Secret Service and the military.
Senator Richard Blumenthal has called for a congressional briefing — some early accounts framed it as a call for an investigation; the Associated Press subsequently corrected that — describing the episode as unprecedented and surreal, and pressing specifically on what was done to protect the people left aboard the aircraft judged too dangerous for the president. A Democratic national security aide told CNN that the Gang of Eight was not briefed on the operation, while acknowledging that presidential movement is not ordinarily a congressional matter; the aide's position was that Congress should have been briefed on the threat even if not on the manoeuvre.
Running underneath all of it is the leak fight. After the Times published its July reporting on the VC-25B's missing countermeasures, the Justice Department served grand jury subpoenas on its reporters seeking testimony and phone records. On 23 July, under sustained questioning from Judge Arun Subramanian in the Southern District of New York — who pressed on why subpoenas were issued before other investigative steps and raised the prospect of sanctions over the application — the government withdrew them, conceding errors. DOJ has said the leak investigation continues and that the reporters are not its targets.
The practical effect is that the administration spent July trying to suppress reporting on the new aircraft's defensive gaps, and August confirming an operation that only makes sense if those gaps are real.
RAGE X Analysis
Three assessments.
One: the protective decision was defensible; the information architecture around it was not. Faced with a specific MANPADS threat, a localized principal and an aircraft with acknowledged countermeasure gaps, moving the president onto an unremarkable airframe was sound tradecraft. Concealment is the cheapest countermeasure available and it works. The failure is downstream — in launching a fully loaded decoy under the presidential call sign when the entire premise of the operation was that something might shoot at whatever wore that call sign.
Two: this is a procurement failure surfacing as a security incident. The VC-25A fleet is thirty-six years old. The VC-25B replacement programme is years late and has absorbed billions in overruns. The Qatari aircraft was a stopgap accepted to relieve pressure on an ageing fleet, retrofitted on a compressed schedule that experts warned would trade capability for calendar. Ankara is the first operational consequence to become visible. It will not be the last while the fleet gap persists.
Three: the credibility cost compounds. The White House made a specific public claim about the president's whereabouts that was false, sustained it for five weeks, pursued journalists who reported adjacent facts, and then confirmed the underlying operation once it could no longer be denied. In an environment where adversary information operations are actively working to erode confidence in US official statements, that sequence does adversary work for free.
Sourcing and confidence
| Claim | Status |
|---|---|
| Trump left Ankara on a C-32A, not the VC-25A | Confirmed — reported by Washington Post, corroborated by US officials to NBC/ABC; confirmed in substance by Trump on 11 Aug |
| Catering truck used for the transfer | Confirmed — WaPo reporting, tarmac footage aired by CNN, US official confirmation |
| Iranian surface-to-air missile threat against the presidential aircraft | High confidence — NYT (two US officials), WSJ (Israeli intelligence briefing), NBC (US official). Specific intelligence not released |
| Scavino, Harp, Nauta on the catering truck | Reported — WaPo, 12 Aug, single US official |
| Rubio and Bessent's awareness of the switch | Disputed — ABC and NYT accounts conflict. Unresolved |
| VC-25B lacks advanced anti-missile countermeasures | High confidence — NYT and AP reporting; Air Force disputes characterisation, has not detailed capability |
| C-32A call sign | Partially reported — flew under a non-presidential military identity; specific call sign reported by secondary outlets only |
What to watch next
The briefing. Whether the intelligence committees or the Gang of Eight receive a closed briefing on the Ankara threat stream, and whether it is limited to the threat or extends to the operational decision to launch a loaded decoy. Refusal will keep the story alive longer than disclosure would.
The VC-25B upgrade scope. The autumn work package is the tell. If it includes DIRCM installation and dispenser integration rather than software and comms work, that retroactively confirms what the aircraft was missing when it flew a head of state into a war zone adjacent to Iran.
The leak investigation. DOJ has said the probe continues after the subpoenas were withdrawn. A second attempt against reporters — or against the officials who spoke to the Post — would escalate this from a security story to a press-freedom fight.
Iranian messaging. Tehran has not commented on the alleged plot. Whether the IRGC claims, denies or ignores it will indicate how the regime intends to use the episode while Hormuz negotiations continue.
Fleet posture. Watch which airframe the president uses for the next foreign trip. The choice is now a public signal about the administration's own confidence in the Qatari aircraft, and it will be read that way by adversaries as well as by Congress.
RAGE X Analysis — RAGE Global. Reporting compiled from The Washington Post, The New York Times, The Wall Street Journal, NBC News, ABC News, CBS News, Reuters, the Associated Press and Axios, 10–12 August 2026. Details of the July 8 operation are reported rather than officially established; the US Air Force has released no account of the movement.