European officials weigh hybrid warfare risks amid flight and school disruptions
A series of bomb threats and cyberattacks across Europe has sparked debate over state-sponsored hybrid warfare, with analysts cautioning that evidence for a unified campaign remains inconclusive.
By Amit Ricci ·
A recent surge in security incidents across Europe, including bomb threats against commercial flights and cyberattacks on supermarket refrigeration systems, has intensified concerns about the continent's vulnerability to destabilization. While suspicions have centered on Russia and Iran, experts note that the available evidence does not yet confirm a single coordinated campaign or a specific geopolitical strategy behind the disruptions.
The latest incident occurred on November 11, when more than 300 schools in Italy were evacuated following an anonymous email warning of explosive devices. This message was distributed to approximately 6,300 educational institutions. Similar threats reached hundreds of schools in Scotland, Northern Ireland, and the Republic of Ireland, prompting authorities to conduct precautionary checks. Italian Prime Minister Giorgia Meloni stated that preliminary security assessments found no concrete danger, though the scale of the warnings caused significant disruption to classrooms and families.
This event follows a pattern of earlier threats. On October 19 and November 2, approximately 280 Italian schools received similar messages. Between November 3 and 5, multiple European flights were diverted or escorted by military aircraft after anonymous bomb warnings. By the end of November 5, nearly 30 flights had been affected, including an Aer Lingus service from Dublin to Rome that was diverted to a French military airbase. Italian fighter jets also escorted a Finnair aircraft traveling from Helsinki to Rome. Authorities reported no confirmed explosive devices in these incidents.
Daniele Garofalo, an intelligence expert, cautioned that the large-scale distribution of messages indicates coordination but does not prove state involvement. He emphasized that determining a hybrid warfare campaign requires converging indicators, such as similarities in message wording, recurrence over time, and links between digital infrastructures. The central question remains whether these incidents demonstrate operational coordination among the senders or strategic direction from a broader actor with political objectives.
Nima Baheli, an Iranian-Italian political analyst, questioned whether the simple nature of the attacks necessarily points to sophisticated state intelligence. He argued that such methods could be executed by small entities or individuals seeking to create widespread disruption. Baheli suggested that internal political factors in countries like Italy, France, or Germany could also play a role, noting that the limited technical sophistication of the threats allows for alternative explanations beyond foreign governments.
Cyberattacks on commercial refrigeration systems have added another dimension to these concerns. On October 11 and 12, attacks disrupted temperature controls at hundreds of French supermarkets, forcing retailers to discard perishable goods. On November 9, French Foreign Minister Jean-Noel Barrot attributed these attacks to Iran's Islamic Revolutionary Guard Corps. Paris subsequently summoned the Iranian ambassador and warned of potential sanctions. Tehran rejected the accusations, describing them as baseless.
France's Cyber Crisis Coordination Center published a report identifying an IRGC-linked cyber unit as responsible, presenting technical findings to support the attribution. However, Baheli noted that the public evidence, such as Persian scripts in the code, might be easily mimicked by actors using virtual private networks to divert suspicion. He questioned whether Iran would benefit from opening a new confrontation with Europe given the current geopolitical landscape.
Russia has also been implicated in discussions due to the Russian-sounding signature on the school threats. The email was signed by a purported leader of a group called Vilayat of Misoginistan. Garofalo stated that while the signature provides narrative clues, it does not constitute evidence of a connection to the Russian state. He added that credible attribution would require analysis of email infrastructure, financing, and indicators of state control.
Italy's Interior Minister Matteo Piantedosi warned on November 11 that it was premature to conclude the incidents were directed by a common organization. He identified copycat behavior as a possible explanation, leaving the final determination to investigators. The uncertainty is unfolding against a backdrop of potential renewed military confrontation between Iran, Israel, and the United States, adding another layer of complexity to the European security environment.
Experts highlight the practical difficulties of responding to threats that are technically simple but operationally disruptive. Garofalo argued that the real test for national preparedness is the ability to verify reports and communicate consistently without fueling panic. For the European Union and NATO, the challenge lies in coordinating responses and determining if such hybrid actions meet the threshold for collective defense mechanisms, a decision that is made on a case-by-case basis.
