Cyberattacks and bomb threats: sowing chaos without declaring a conventional war

LondonSupermarkets with sabotaged refrigeration systems, a blood bank victim of a cyberattack, commercial airplanes threatened with bombs –and now also some media outlets–, banking and personal data of thousands of Moldovan citizens exposed, multibillion-dollar cryptocurrency thefts... Europe has recently been chained by a series of incidents of a very diverse nature that proclaim the same concern: to what extent can a society be destabilized without declaring war on it? Are we European citizens aware of our vulnerabilities, largely derived from the interconnection of our lives?

Three weeks ago, in his annual public lecture, Ken McCallum, head of MI5, the United Kingdom's domestic intelligence service, spoke of the "sustained chaos" that some foreign agents wanted to bring to the streets of the British Isles and other countries on the continent. And he identified them, Russia and Iran, but said they would act indirectly through sabotage networks recruited by their intelligence services.

Just one day before McCallum's intervention, on the night of October 11 to 12, the first major wave of cyberattacks against the refrigeration systems of French supermarkets began. Hundreds of establishments were affected and tons of food were spoiled. Between November 1 and 6, new unusual episodes have added fuel to the fire.

On November 1, cyberattacks against commercial refrigeration systems affected supermarkets in other countries on the continent: Belgium, Sweden, Ireland, the Netherlands, Finland, and Estonia. And the next day, a cyber assault was also detected on the refrigeration systems of three facilities of the French Blood Establishment. On this occasion, however, the disaster was averted.

And the icing on the cake has been the planes. On Monday, November 2nd, the first bomb threat against a Wizz Air flight between London and Sofia took place. Finally, the aircraft ended up being diverted to Budapest, in an emergency landing, while being escorted by a Hungarian Air Force fighter jet. The search proved that there were no explosives on board.

A pattern that, fortunately, has been repeated in some fifty threatened flights between Tuesday and Friday on planes covering routes in many different European countries, from France, Denmark, Portugal, the Netherlands, the Czech Republic, or Spain.

Bomb alerts are common in the airline industry, says Philip Baum, from the company Green Light and a visiting professor at Coventry University in this subject. "Every day of the year there are planes that have to be diverted." What is different this time is the number of threats concentrated in the same geographical area and in the same period of time. A circumstance that can lead to a contagion effect. "It is concerning that this could encourage other perpetrators to imitate it once they realize how easy it is to carry out these types of disruptive actions," he says.

The threats have been sent by email and it is "almost impossible to do anything about it," argues Baum. "It is a very easy, very cheap, and simple way, practically free, not to paralyze civil aviation but to cause a very significant disruption. Airlines cannot do much about it.

In Brussels, both community institutions and NATO have long put the concept of hybrid warfare on the table: a way to wear down the adversary without reaching direct military confrontation, exploiting their vulnerabilities, and fueling mistrust in their institutions.

British analyst and historian Mark Galeotti asserted this Friday, in an extensive commentary on X, that it would be a mistake to automatically attribute the campaign of threats against civil aviation to Moscow. He added that there is no evidence linking it to Russia, but that perhaps it would not even be necessary for it to be involved for it to serve the Kremlin's interests: "It would be enough to generate friction, convey the feeling that European governments are incompetent, and fuel populist movements". Movements that are often skeptical of support for Ukraine.

"Calm and carry on!"

Galeotti points out that "the fragility of modern societies is, in itself, a strategic vulnerability" that any adversary can exploit. Interconnected systems, often outsourced infrastructure, and supply chains that operate with minimal stocks – the just-in-time model – can turn a relatively simple attack into a widespread disruption. There is no need to destroy infrastructure or leave a country in the dark; sometimes it is enough to interfere with its daily functioning to cause economic costs, uncertainty, and distrust.

This Friday, at Heathrow airport, the motto that seemed to prevail among travelers was the famous British World War II slogan, keep calm and carry on! [Keep calm and carry on!], the quintessence of pragmatism even in the most adverse circumstances. The departures hall of Terminal 4 offered a quite usual appearance for this time of year: long queues at the check-in counters and Christmas decorations and a mix of cloying perfumes after the security checkpoint. None of the dozen or so people I spoke to had the aforementioned alerts on their minds. The four who had heard of them were not at all worried.

The statistics prove them right. If one takes the Eurocontrol data, what has happened this week is irrelevant. Between November 2nd and 8th, there were just over 195,100 flights scheduled over European airspace and, as of this Saturday, only about fifty had been threatened. All in all, 0.026%. You have to be unlucky to draw the short straw. And yet, the vulnerability of air transport is evident. You don't need to be a highly qualified hacker to unleash chaos: an email sent from a hard-to-trace IP address is enough to put the industry on the ropes.

Who is behind it? Russia, Iran, North Korea, the CIA, the Mossad, a real Spectre and not the one from James Bond fiction? Perhaps the harsh reality is offered again by Mark Galeotti: "The modern world, with all its wonders, is dangerously fragile. This is a systemic problem that Russia exploits, not a Russian problem that will disappear if Moscow corrects its course."