That asymmetry is the point of hybrid action, and it is why the Italian description of civilian infrastructure as under attack carries weight even when no one has been hurt.
Bomb threats this week forced flights to be grounded and put airports across Europe on high alert, according to Al Jazeera. No explosives were found, and the threats appear to have been false. The disruption did not stop at aviation: hackers also targeted supermarket freezers in several countries, raising temperatures and spoiling food. Italy says civilian infrastructure in Europe is “under attack”.
The two kinds of incident sit awkwardly together. A hoax bomb call costs an airport hours of chaos and a great deal of money, but it requires little more than a telephone and a credible-sounding voice. Tampering with refrigeration systems in shops is a different order of act, suggesting access to operational technology and some knowledge of how it is configured. Whether the same hand, or the same sponsor, lies behind both is precisely what is not yet established. Al Jazeera's panel discussion, which brought together the security analyst Eric Schouten, the cyber researcher Dennis-Kenji Kipker and the defence specialist Patrick Bury, framed the question rather than answering it.
That caution is warranted. False bomb threats are a familiar nuisance in many countries, and the motives behind any single wave can be criminal, attention-seeking or political. Cyber intrusions into retail cooling systems may be opportunistic, or they may be probing runs that test defences for something larger. Attribution in hybrid warfare is slow, forensic and frequently inconclusive, and governments are often reluctant to name a perpetrator before they can show their evidence. The material available so far does not identify who is responsible, nor confirm that the aviation and refrigeration incidents form part of a single campaign.
What the incidents do demonstrate is the breadth of the target surface. Airports and food retailers are civilian infrastructure, lightly defended in places and deeply embedded in daily life. An attack that spoils stock or cancels flights does not need to kill anyone to generate fear, headlines and demands for a response. The economic cost falls on businesses and insurers; the political cost falls on governments seen to be failing to protect ordinary routines. That asymmetry is the point of hybrid action, and it is why the Italian description of civilian infrastructure as under attack carries weight even when no one has been hurt.
The harder question is collective response. European states hold different legal powers, different intelligence relationships and different thresholds for naming a hostile actor. A false threat in one country and a hacked freezer in another may be treated as unrelated local crimes unless information is shared quickly and consistently. The panel's framing, asking whether European nations can come together to counter these acts, points to the practical gap: coordination exists, but the political will to attribute and retaliate is uneven.
For now, the honest position is that the pattern is suggestive and the evidence is thin. It is not known who made the threats, whether the cyber intrusions are connected, or what, if anything, lies behind them. What is clear is that the cost of such incidents is borne by the public long before any attribution is made.
