Why false alarms in the skies are part of a conflict against Europe

There is one adjective that acts as a sedative in Europe: ‘hybrid’. It sounds technical and reassuring, as if the real war were taking place elsewhere and we were merely experiencing a watered-down, low-calorie version of it here. Recent events suggest we should throw that sedative away. Between 2 and 5 November, twenty-eight European flights received bomb threats via email, some written in Italian. There were hijackings, precautionary landings, Air Force fighter jets escorting flights all the way to Fiumicino, and bomb disposal experts at Malpensa. They were all hoaxes. At the same time, supermarket freezers – which had already been tampered with in October at hundreds of French outlets – were set to temperatures of around 50 degrees in several countries, including Sicily. Then it was the turn of the cold stores holding plasma at the French blood transfusion service, which were remotely reprogrammed from minus thirty to plus one hundred and ten degrees. A technician on duty noticed this in time. 

To call this type of conflict ‘hybrid’ is a classic error of categorisation. Clausewitz defined war as an act of force to break the will of the adversary, and did not claim that violence necessarily entailed territorial invasions. But a remote command that destroys food supplies or forces dozens of aeroplanes to make emergency landings is no longer propaganda: it is already violence, delivered via the internet. Here, the will to be broken is that of European public opinion, and the means is fear administered in regular doses. NATO has recognised cyberspace as an operational domain since the 2016 Warsaw Summit: rather than a metaphor, therefore, it must be regarded in its own right as a military doctrine. Air superiority, moreover, is being undermined without missiles, using a more elegant and more insidious technique. Our own security procedures are being used against us. Every threat, even the most implausible, forces us to divert flights, carry out inspections and scramble interceptors. It is a sort of procedural jiu-jitsu: the opponent’s strength – that is, our own caution – becomes the lever used to bring us down.

The economics of this conflict are ruthlessly asymmetrical. An anonymous email costs nothing. A diverted flight costs fuel, lost slots, missed connections, compensation payments, and hours of police and military aircraft time. A compromised refrigerated display unit costs tonnes of goods to be discarded, insurance premiums to be renegotiated, and industrial controllers to be replaced. Yet the true cost does not appear in the balance sheets. Kenneth Arrow observed that almost every economic transaction contains an element of trust. These attacks are a tax on trust, levied without parliamentary approval and without a declared rate. Their impact is felt the moment a citizen wonders whether the state is still capable of guaranteeing the safety of a flight, a steak or a blood transfusion.

It is no mystery worthy of a crime novel who stands to gain from this outcome. The attacks on supermarkets have been claimed by already known pro-Russian groups, NoName057(16) and Z-Pentest. As for the plasma cells and the air raid alarms, formal attribution is still pending, and investigators are right to demand that it be rigorous. For a strategic assessment, however, there is no need to wait for the verdict. One need only ask oneself who stands to gain from a Europe that is rearming, supporting Kyiv and, at the same time, discovering that it is afraid of its own fridge.

It is more difficult to identify who the most vulnerable victims are. It is not the large retail groups, which have security departments and the financial cushion to absorb the blow. It is the long tail of the system. There is the independent supermarket with a security scanner installed fifteen years ago and a password that has never been changed. There is the maintenance provider that remotely manages hundreds of systems – a single point of vulnerability that the National Cybersecurity Agency has just highlighted. There is the low-cost airline on eastern routes, where every diversion erodes an already slim profit margin. There is also the medium-sized hospital, which purchases refrigerators as if they were household appliances and later discovers that it has acquired vulnerable computers. The risk propagates along the supply chain, as demonstrated by the case of the French organisation, which was compromised through a supplier of refrigerated containers.

It is even more difficult to identify the ‘fifth columns’, because the most effective ones are unintentional. One is the ‘lowest-bid’ tender, which favours connected devices lacking built-in security. Another is the ‘attention economy’, which turns every alarm into a social media trend and multiplies the impact of a short email: sabotage becomes a joint effort between those who launch it and those who amplify it. Then there are those, on both the right and the left, who dismiss it all as a bit of computer prank, or worse, draw the conclusion that all we need to do is stop helping Ukraine to be able to sleep soundly again. This is precisely the political dividend that the operation is seeking to capitalise on.

First and foremost, therefore, we need awareness: not panic, but a clear head. Resilience, as they say, is a public good and must be treated as such. We need specific regulations and swift incentives to replace end-of-life industrial control systems and isolate operational networks from the internet. We need a common, Europe-wide assessment of the credibility of cyber threats, so as not to force every airport to reinvent the wheel with every email. We need to rigorously apply the NIS2 Directive on cybersecurity throughout the maintenance supply chains as well. And we need public communication that informs without causing alarm, because fear is precisely the enemy’s ammunition. For once, it is best to keep the cold in the fridges. A cool head, on the other hand, should remain within the institutions.