OPEN-SOURCE ANALYTICAL ASSESSMENT
As of: 6 November 2026
Intelligence discipline: All-source OSINT | Structured Analytic Techniques | Analysis of Competing Hypotheses (ACH) | Strategic Warning and Resilience Assessment
Assessment status: Open-source intelligence product — no classified information used
Strategic horizon: 2026–2031
A Cross-Domain Intelligence Assessment of European Defence-Response Observation, Hybrid Operations, Cognitive Warfare and Strategic Readiness Under Escalation
Scope: This assessment examines documented bomb threats against commercial aviation, airports and related critical infrastructure from 1 January 2025 through 6 November 2026, placing the European security environment at the centre of the investigation while incorporating relevant international incidents and established precedents of state-linked sabotage. Particular attention is devoted to Italy, France, Germany, the United Kingdom, Poland, Romania, Estonia, Latvia and Lithuania, alongside NATO’s integrated air-defence architecture and the strategic environments of the Baltic Sea, North Sea, North Atlantic, Mediterranean and Black Sea. The investigation extends beyond aviation to maritime and terrestrial transport, energy infrastructure, industrial refrigeration, food distribution, medical cold chains, government facilities and other civilian systems essential to national resilience and military support during crisis or conflict.
The central intelligence question is whether repeated threats and disruptions, irrespective of their original perpetrators’ intentions, are creating an observable record of European security responses that hostile intelligence services could subsequently collect, interpret and incorporate into broader strategic assessments. The report distinguishes deliberate reconnaissance from the incidental intelligence value of legitimate emergency responses, examining how recurrent incidents can contribute to cognitive pressure, reveal aspects of institutional coordination and impose cumulative demands on civilian and military security organizations. It evaluates these possibilities against documented operational outcomes, official intelligence findings, competing explanations and evidence of defensive adaptation, without presuming that the incidents belong to a single coordinated campaign.
Executive Summary — Bottom Line Up Front
Europe may be facing a security phenomenon whose strategic significance extends beyond the authenticity of individual bomb threats: every emergency response produces observable information about how states organize, coordinate and sustain their protective systems. A false warning may contain no explosive device and originate from an individual with no intelligence affiliation, yet the resulting military escort, aircraft diversion, airport inspection, security mobilization or official communication can become part of the information available to external observers. This does not establish that the warning was deliberately engineered for reconnaissance. It establishes a different and more consequential proposition: hostile actors may derive intelligence value from defensive reactions to incidents they did not necessarily organize. The resulting information is incomplete and cannot reliably reveal wartime military capability, but its existence introduces an intelligence dimension into an already significant environment of operational disruption and psychological uncertainty.
The most concentrated aviation evidence concerns 3–6 November 2026. According to figures provided by EUROCONTROL, bomb warnings affected seven flights on 3 November and fourteen flights on 5 November, equivalent respectively to approximately 0.026% of 26,278 flights and 0.049% of 28,488 flights operating across the European air traffic network on those dates. Wider reporting described additional incidents, but differences in reporting scope prevent the construction of a single verified total. The warnings triggered aircraft diversions, military escorts, security inspections and temporary interruptions at individual airports. Importantly, EUROCONTROL reported no measurable effect on delays across the European aviation network, establishing a distinction between significant localized security consequences and demonstrated continent-wide operational degradation. No explosive device was confirmed in the reviewed November aviation cases, and the identity and coordination of the warning originators remained unresolved. EUROCONTROL Figures and Operational Assessment — Reported by ANSA — November 2026.
The strategic importance of these events lies in the interaction between civilian safety obligations and national military-security arrangements. Protecting an aircraft can require coordination among airlines, air-navigation authorities, airport operators, national police, military aviation and NATO air-defence structures. Maritime and terrestrial incidents engage different authorities but raise comparable questions concerning continuity, public protection and institutional coordination. A response to a civilian emergency is not a valid measurement of wartime combat readiness: peacetime legal authorities, threat characteristics and operational conditions differ substantially from those of armed conflict. Nevertheless, publicly documented responses can reveal limited aspects of institutional behaviour and provide material for subsequent analysis. This distinction is central to the assessment of cognitive warfare, indirect intelligence acquisition and the strategic exploitation of uncertainty, without converting observable activity into proof of an organized defence-testing campaign.
The concern is reinforced by independently established European intelligence and judicial findings. On 6 March 2026, Eurojust reported that a multinational investigation had identified 22 suspects in Lithuania and Poland in connection with incendiary parcels transported through European logistics networks. Investigators suspected that the operation was conducted on behalf of Russian military intelligence and identified additional parcels believed to have been used for preparatory testing. These were separate incidents dating from 2024, not evidence of responsibility for the November 2026 aviation warnings. Their significance is that preparatory testing and the use of intermediaries have appeared in a documented European sabotage investigation, providing a concrete precedent for examining—but not presuming—similar strategic objectives in subsequent events. Joint Investigation Team Disrupts Group Using Self-Igniting Parcels for Terrorist Attacks — Eurojust — March 2026.
The aviation warnings also coincide with a separately documented wave of attacks against European refrigeration and temperature-monitoring infrastructure. In October 2026, France’s CERT-FR confirmed numerous compromises involving remotely managed refrigeration controllers. On 5 November 2026, the FBI, CISA and the US Departments of Health and Human Services, Agriculture and Transportation issued a joint warning concerning malicious activity against industrial refrigeration and cold-chain systems. The FBI additionally confirmed attempted interference with refrigeration at three French national blood-service sites, where functioning alarms and staff intervention prevented the loss of blood products. These incidents demonstrate that malicious interference with civilian infrastructure can create genuine physical and economic risks while also revealing the importance of detection and recovery. However, no verified forensic connection establishes that the refrigeration attacks and aircraft bomb warnings share a perpetrator or strategic command. Refrigeration Controller Security Alert — CERT-FR/ANSSI — October 2026; Industrial Refrigeration and Cold-Chain Security Warning — FBI — November 2026.
The broader European record demonstrates that institutional pressure and institutional weakness must be evaluated separately. Poland’s Supreme Audit Office reported in August 2026 that cybersecurity arrangements were inadequate at all eight essential-service operators examined in its audit, with six systematically failing to act on critical security-monitoring alerts. These are serious, documented deficiencies within a defined civilian-infrastructure sample, not evidence that Polish military air defence has been compromised or that bomb threats caused response fatigue. Conversely, ENISA’s 2026 assessment identified improvements in the cybersecurity maturity of several European critical sectors, including aviation, while identifying continuing maturity gaps in healthcare, rail, maritime transport and public administration. The evidence therefore supports neither an assumption of uniformly declining European readiness nor a claim that current protection is universally sufficient. Critical-Infrastructure Cybersecurity Audit — Polish Supreme Audit Office — August 2026; NIS360: Maturity and Criticality of European Critical Sectors — ENISA — May 2026.
The issue has direct implications for NATO’s wider security architecture. Its September 2026 Resilience Baseline Requirements explicitly recognize that effective collective defence depends on the continuity of government, energy supply, food and water, healthcare, communications and civilian transport, including the ability to sustain civilian services while supporting military operations during crisis and conflict. These seven requirements establish that European defence cannot be measured exclusively through combat aircraft, air-defence systems or naval forces. It also depends on civilian institutions and infrastructure capable of continuing their essential functions during periods of sustained disruption. The intersection of military protection, public confidence and civilian resilience is consequently a legitimate subject of strategic intelligence assessment, although the available evidence does not show that the November warnings were intended to expose NATO’s operational limits. 2026 Resilience Baseline Requirements — NATO — September 2026.
Principal judgment — Moderate confidence: The present evidence is best explained by a mixed environment of disruptive activity, unresolved coordination, possible opportunistic amplification and independently documented hostile operations against European infrastructure. A coordinated campaign intended to observe or test European security responses remains a credible competing hypothesis, but it has not been established through authenticated evidence of common origin, state direction or an organized intelligence-collection objective.
Strategic judgment — High confidence: Repeated security incidents produce information about institutional responses, even where the incidents are unrelated. Such information can be observed and potentially exploited by hostile actors; however, it does not provide a reliable or complete assessment of European military capability under wartime conditions. The distinction between the existence of an intelligence opportunity and proof of an intelligence operation is fundamental.
Decisive uncertainty: The public record does not establish whether the aviation warnings share an operator, whether any identified operator was acting under state direction, whether the refrigeration and aviation incidents were operationally connected, or whether any party systematically collected and used information arising from the responses.
Strategic implication: The central challenge for European governments is not merely to identify the perpetrators of individual warnings, but to preserve effective civil-military security coordination, protect sensitive operational information, maintain credible public communication and ensure the continuity of essential services under sustained uncertainty. The decisive measure of resilience is not the absence of threats, nor the frequency of visible military responses, but the demonstrated ability of European institutions to protect populations, maintain essential functions and sustain national and collective defence responsibilities without measurable deterioration.
Are Europe’s Bomb Threats Also Measuring Its Defences?
Europe need not prove that November’s bomb threats were ordered by a foreign intelligence service to confront their strategic consequence. A passenger-aircraft bomb warning can trigger a diversion, inspection or military escort, each partly observable. It may disclose something about institutional coordination, even if it says little about combat readiness. Governments must act on uncertain warnings; hostile observers can study the results without having caused the incident. Carriers, airports and public authorities pay immediately; the intelligence value remains uncertain. The evidence from 2025–2026 supports a hypothesis of indirect response observation, not a finding that a single network is rehearsing an attack on NATO.
Twenty-one affected flights did not paralyse Europe—but each demanded a decision
EUROCONTROL recorded bomb threats affecting seven flights on 3 November 2026, out of 26,278 flights that day, and fourteen on 5 November, out of 28,488. The respective shares, approximately 0.026% and 0.049%, put the phenomenon in proportion: the agency reported no measurable effect on Europe-wide flight delays, notwithstanding diversions, inspections and military escorts in individual cases. Wider press counts cannot be added without reconciling definitions. A functioning network can still impose costs on particular operators. Treating each diversion as a defensive failure would misread a precaution as weakness. EUROCONTROL figures — ANSA — November 2026.
A fighter escort exposes a response, not the limits of air defence
On 23 February 2025, two Italian Air Force Eurofighters escorted a New York–Delhi passenger aircraft to Rome Fiumicino after a bomb warning; the Italian Air Force identified NATO’s Combined Air Operations Centre at Torrejón in the response. The escort does not reveal the resources or authorities governing an actual attack. NATO’s integrated architecture monitors up to 30,000 air movements daily and operates through regional command functions, but an observable escort is not a test of that entire system. An escort measures a procedure, not combat capability. Italian Air Force — February 2025; NATO Air Defence — 2026.
That qualification does not make indirect intelligence collection irrelevant. The Bundeswehr’s May 2026 account of Baltic air policing explicitly recognized that Russian military-aircraft activity can probe Allied response procedures. But its evidence concerned military flights, not anonymous warnings against airliners. Poland’s 10 September 2025 encounter with 19 reported Russian drone airspace violations likewise produced a multinational response involving Polish and Allied aircraft and other defences, under circumstances fundamentally different from escorting a cooperative civilian jet. The two cannot be combined into a credible measure of readiness. Bundeswehr — May 2026.
The sabotage precedent is real; the attribution leap is not
The strongest evidence that testing can precede hostile action does not come from the November warnings. On 6 March 2026, Eurojust described an investigation involving 22 suspects in Lithuania and Poland and incendiary parcels that ignited in European logistics networks during 2024. Investigators suspected a connection to Russian military intelligence and identified additional parcels believed to have been preparatory tests. The precedent concerns aviation-linked logistics, not attribution of the 2026 passenger-aircraft threats. Lithuania’s 2026 National Threat Assessment separately described Russian intelligence interest in Allied military activity and recruitment of intermediaries. These records establish a plausible operating model, not common authorship. Eurojust — March 2026; Lithuanian National Threat Assessment — March 2026.
Four explanations remain: state direction, autonomous state-aligned groups, unrelated offenders, or an initial campaign amplified by copycats. The UK National Cyber Security Centre’s January 2026 warning about Russian-aligned hacktivists operating outside direct state control shows why political alignment cannot be collapsed into command. Similar threats might share an organizer—or copied wording. Without authenticated origins and evidence of response collection, systematic measurement remains a hypothesis. UK NCSC — January 2026.
Cold-chain intrusions reveal an industrial cost that warnings alone cannot measure
The refrigeration incidents operate through a different economic mechanism. France’s CERT-FR confirmed numerous compromises of remote refrigeration controllers in October 2026. On 5 November, CISA, the FBI and three other US federal departments warned about malicious activity affecting industrial refrigeration and temperature monitoring. The FBI reported attempted interference at three French blood-service sites; alarms and staff intervention prevented any blood loss. A warning can immobilize a flight; compromised refrigeration can destroy temperature-sensitive inventory. Coincidence is not attribution: no verified operational link joins these incidents. CERT-FR — October 2026; US multiagency cold-chain advisory — November 2026.
Audits reveal failure—and adaptation—in the same security system
The sharpest warning about institutional response does not require speculation about fighter scramble times. On 27 August 2026, Poland’s Supreme Audit Office reported inadequate cybersecurity arrangements at all eight essential-service operators audited; six had systematically ignored critical monitoring alerts during the 2021–2025 review period. That establishes civilian oversight failures, not degraded NATO air defence or bomb-threat-induced fatigue. Poland also reported containing cyberattacks against energy infrastructure on 29–30 December 2025 without a blackout. Weak controls and successful intervention coexist. Polish Supreme Audit Office — August 2026; Polish Prime Minister’s Chancellery — January 2026.
Italy supplies the same warning against crude incident arithmetic. ACN recorded 2,729 cyber events in 2025, up from 1,979 in 2024, but confirmed-impact incidents rose only from 573 to 615. The agency also reported a declining proportion of DDoS attacks causing measurable effects—from about 15% in 2024 to less than 11% in 2025. More detected activity is not synonymous with less effective protection. In France, ANSSI reported 3,586 security events in 2025, an 18% fall influenced by exceptional reporting around the 2024 Paris Olympics. Different national definitions preclude a readiness league table. ACN annual report — May 2026; ANSSI 2025 threat overview — March 2026.
NATO has widened the definition of defence; national implementation will decide its value
NATO’s 15 September 2026 Resilience Baseline Requirements link collective defence to seven civilian functions: government continuity, energy, population movement, food and water, healthcare, communications and transport. Collective defence depends on civilian suppliers and services remaining operational. The EU’s NIS2 Directive and Critical Entities Resilience Directive place distinct cybersecurity and physical-resilience duties on essential operators; Germany’s KRITIS-Dachgesetz, in force from 17 March 2026, reinforces this approach nationally. Legislation creates obligations; audits and continuity outcomes establish whether they work. NATO requirements — September 2026; German federal government — 2026.
The geography resists a single prescription. After the November 2025 railway sabotage, Poland announced 10,000 military personnel for infrastructure protection Polish Interior Ministry — November 2025; Estonia, Latvia and Lithuania operate within NATO’s Baltic defence arrangements, reinforced by Baltic Sentry launched in January 2025 NATO — January 2025; the United Kingdom reported 25% more maritime monitoring activity in the first seven months of 2026 than in the corresponding 2025 period. France has set national supply and blackout-exercise priorities, while Italy’s cybersecurity figures show improved containment in some categories. ENISA’s May 2026 NIS360 assessment identified maturity gaps in railway, maritime and healthcare sectors even as aviation moved into a higher maturity category. NATO command, EU law and national budgets address overlapping dependencies under different mandates. UK Ministry of Defence — August 2026; ENISA NIS360 — May 2026.
The next 12–24 months will charge operators for uncertainty, not prove a conspiracy
From November 2026 through November 2028, the most defensible outlook is continued expenditure on identification, recovery, audits and cross-border coordination—not a quantified prediction of an attack or a claim that Europe’s defences have been mapped. Airlines and airports absorb immediate disruption; retailers and medical-logistics providers fund continuity; essential-service operators face implementation costs under NIS2, CER and national legislation; governments and taxpayers sustain police, civilian protection and military readiness. No audited aggregate cost of the aviation-warning wave has been established. Nor is there evidence that its organizers acquired a reliable estimate of NATO’s wartime limits. Inaction leaves deficiencies such as those identified by Poland’s Supreme Audit Office in August 2026 uncorrected, exposing essential services to avoidable harm.
Navigational Index
| Thematic pillar | Sections | Analytical purpose |
|---|---|---|
| Pillar I — Threat environment and operational effects | 1. Key Judgments; 2. Situation Overview; 3. Pattern Analysis | Establish the verified incident baseline, operational tempo, geographic dispersion and consequences. |
| Pillar II — Actors, objectives and competing explanations | 4. Actor Assessment; 5. Strategic Objectives; 6. Analysis of Competing Hypotheses; 7. Desensitization and Response Fatigue | Assess attribution, motivation, coordination and institutional effects without conflating correlation with causation. |
| Pillar III — Forward warning and intelligence requirements | 8. Future Targets and Indicators & Warnings; 9. Gaps and Collection Recommendations; 10. Source Evaluation Appendix | Identify prospective risks, discriminating evidence and source limitations. |
Master Abstract
The security significance of the European incidents lies not solely in the number of threatened aircraft, but in the asymmetry between the effort required to issue a threat and the institutional resources required to investigate it. A false warning can trigger procedures involving an airline, multiple air-navigation authorities, airport police, explosives specialists, military air defence and diplomatic or cross-border coordination. These procedures are necessary precisely because the consequence of dismissing a genuine warning could be catastrophic. The attacker therefore does not need an explosive device to impose a cost.
The second significant development is the demonstrated vulnerability of digitally managed refrigeration to malicious interference. In this domain, the evidence goes beyond intimidation: national cybersecurity authorities have documented compromised equipment, while affected retailers have reported food losses. The attempted disruption of French blood-service refrigeration illustrates a potentially more consequential pathway, even though intervention prevented loss of blood products in the documented case.
These developments justify examining hybrid activity as a hypothesis. They do not establish a unified hybrid operation. European security institutions have independently documented Russian-linked sabotage investigations and Russian-aligned hacktivist activity during 2026. Those findings substantiate the broader threat environment, not attribution of the November aviation warnings or refrigeration incidents. The central analytical requirement is to determine whether the observed similarities arise from common direction, a permissive network of aligned actors, independent imitation, or a combination of these mechanisms.
1. Key Judgments
1. High confidence: Europe experienced a concentrated wave of bomb threats against passenger aircraft during 3–6 November 2026, with EUROCONTROL recording seven threatened flights on 3 November and 14 on 5 November.
2. High confidence: The threats caused localized diversions, aircraft inspections, fighter escorts and temporary interruptions, but available official reporting does not demonstrate a network-wide aviation disruption.
3. High confidence: Malicious interference with refrigeration and cold-chain systems is a documented operational threat, independently confirmed by French and US cybersecurity authorities.
4. Moderate confidence: The most defensible provisional explanation is a mixed threat environment in which concentrated malicious activity may be amplified by other actors or copycats, although the existence of a common initiating operator remains unproven.
5. Low confidence: Direct Russian state coordination of the current aviation bomb-threat wave is possible but not established by the publicly available evidence, notwithstanding documented Russian-linked activity in separate European sabotage investigations.
6. Moderate confidence: Economic disruption, institutional distraction and psychological pressure are plausible objectives because threats can impose real security costs without requiring actual explosives.
7. Low confidence: Deliberate desensitization of airline crews, passengers and security authorities is an analytically credible hypothesis, but there is no verified measurement demonstrating that response effectiveness has deteriorated.
8. Moderate confidence: Further threats against aviation and additional attempts to interfere with refrigerated commercial or medical logistics represent the most credible near-term continuations, while expansion into energy, rail and ports remains conditional rather than established.
2. Situation Overview
The documented baseline: isolated events, national threat volumes and the November European concentration
Bomb threats against commercial aviation are not new, and the current European cluster should not be interpreted without reference to earlier national experiences. Importantly, however, no authoritative public dataset identified in this review reconciles every reported passenger-aircraft, airport and infrastructure threat globally for the entire 2025–2026 period.
The evidence therefore supports a documented incident chronology, not an exhaustive worldwide census. Threats received by airlines, individual aircraft, airports, media organizations and critical-infrastructure operators are distinct units of observation; adding them together would manufacture an unreliable total.
Chronology of material incidents and official findings
| Date or period | Geography and target | Documented event or finding | Operational significance | Source |
|---|---|---|---|---|
| 23 February 2025 | New York–New Delhi flight; diversion to Rome | American Airlines Flight 292 diverted after a security concern associated with a reported bomb threat; the airline subsequently characterized the concern as noncredible. | International diversion, inspection and overnight interruption. | American Airlines Says Its Flight Diverted to Rome After Security Concern — Reuters — Feb 2025 |
| 1 January–25 March 2025 | India; airline operators | India’s Bureau of Civil Aviation Security recorded 24 hoax bomb threats received by airline operators during the period; the comparable full-year 2024 figure was 728. | Demonstrates the existence of high-volume threat environments, but the two periods are not directly comparable as annual rates. | Lok Sabha Debates, Question 5428, pp. 845–846 — Ministry of Civil Aviation — Apr 2025 |
| 1 October 2025 | Brussels Airport; Brussels–Berlin flight | A reported bomb threat prompted evacuation and inspection of an aircraft, temporary runway disruption and diversions of other flights. | Illustrates the wider airport-system effects of a threat directed at one flight. | Bomb Threat Causes Brief Disruption at Brussels Airport — Belga News Agency — Oct 2025 |
| 23 August–11 September 2026 | Czech Republic; schools and public places | Czech police described an investigation involving a suspect who sent dozens of threatening emails, including threats that prompted substantial evacuations. | Establishes that an individual actor can produce repeated, multi-target disruption without demonstrated state control. | Muž rozesílal desítky výhrůžných e-mailů. Soud ho poslal do vazby — Police of the Czech Republic — 2026 |
| Late August–September 2026 | US military commissaries; separate facilities in Germany and the UK | Refrigeration outages affected several US military commissaries; the cause of the US incidents was still under investigation. The Defense Commissary Agency attributed separate outages at four facilities in Germany and England to equipment failures and replacement-part delays. | Critical counterexample to automatic cyberattack attribution. | Pentagon Still Investigating Commissary Freezer Outages — Stars and Stripes, citing defense officials — Nov 2026 |
| 12–16 October 2026 | France; remotely managed refrigeration | CERT-FR issued and updated an alert reporting numerous compromises of remote refrigeration controllers. | First-order confirmation of industrial-control compromise. | Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération — CERT-FR/ANSSI — Oct 2026 |
| 18 October 2026 | Tel Aviv–Vienna flight; diversion to Sofia | Bulgarian authorities confirmed that Austrian Airlines Flight OS82 diverted after a bomb threat, carrying 51 passengers and six crew, and received a fighter escort. | Demonstrates cross-border civil-military response before the November cluster. | Tel Aviv – Vienna Flight Lands in Sofia Following Bomb Threat — Bulgarian Ministry of Transport — Oct 2026 |
| 2–3 November 2026 | European supermarkets | Retailers in Belgium, Luxembourg and Sweden, among other locations, reported refrigeration-related cyber incidents and food losses. | Physical commercial losses arising from interference with temperature-dependent operations. | New Cyberattack on Supermarket Fridges Sweeps Across Europe — Reuters, citing retailers and national authorities — Nov 2026 |
| 3 November 2026 | European aviation and Greek maritime transport | EUROCONTROL identified seven threatened flights. A separate bomb warning prompted searches of the cruise vessel Crown Iris at Syros before a planned voyage to Haifa. | Contemporaneous civil-transport threats across different modes, without an established common source. | European Air Traffic Targeted by New Threats — AP, citing EUROCONTROL — Nov 2026; Bomb Threat Prompts Checks on Israel-Bound Cruise Ship — Reuters, citing Greek authorities — Nov 2026 |
| Early November 2026 | France; national blood-service refrigeration | The FBI confirmed attempts to disrupt refrigeration at three French national blood-service sites; alarms activated, personnel intervened and no blood was lost. | Potentially high-consequence medical-logistics interference, with successful protective intervention. | FBI and Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems — FBI — Nov 2026 |
| 5 November 2026 | European aviation network | EUROCONTROL identified threats against 14 flights; incidents included diversions, fighter escorts and aircraft searches in several countries. | Concentrated cross-border workload, although the confirmed threatened flights represented approximately 0.05% of daily network activity. | European Air Traffic Targeted by New Threats — AP, citing EUROCONTROL — Nov 2026 |
| 5 November 2026 | Global cold-chain systems | CISA, FBI, HHS, USDA and the US Department of Transportation issued a joint advisory describing malicious activity against electronic refrigeration controls and temperature-monitoring systems. | Official recognition of a cross-sector threat extending beyond retail. | US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems — CISA and Federal Partners — Nov 2026 |
| 6 November 2026 | European airlines, airports and broadcasters | Threats continued against flights; RTÉ in Ireland evacuated its premises and broadcasters in Bulgaria and the UK received security threats. Reuters reported messages claiming responsibility but could not verify their sender or connection to the aviation cases. | Possible expansion into information and public-communications infrastructure; attribution unresolved. | Newsroom Bomb Threats Follow Escalating European Flight Hoaxes — Reuters — Nov 2026 |
Volume: what can and cannot be counted
The most defensible comparable European figures are the EUROCONTROL observations for the individual days 3 and 5 November 2026. Their values are not a complete week-long total, and the difference between seven and fourteen should not be represented as a reliable daily growth rate because the intervening day and subsequent reporting are not captured in the same series.
Reuters and Associated Press additionally described threats against more than two dozen flights during the concentrated November period. These broader descriptions reflect developing incident reports and potentially different counting rules. An aircraft subject to more than one warning, an airport receiving a general message affecting several flights, and a diverted aircraft recorded by several national authorities can produce overlapping entries.
For the reported 5 November EUROCONTROL figure, approximately 0.05% of flights across the European network were identified as threatened. This indicates a limited aggregate share, even as selected airports and airlines faced materially greater local operational consequences. European Air Traffic Targeted by New Threats — Associated Press, citing EUROCONTROL — Nov 2026
The Indian record supplies a contrasting scale. Its 24 hoax threats through 25 March 2025 followed 728 reported threats during 2024; those figures relate specifically to India’s airline operators and cannot be extrapolated into a European or global incidence rate. The Indian Ministry of Civil Aviation also reported that its airport-level Bomb Threat Assessment Committees and contingency procedures were designed to assess threats and limit disruption. Lok Sabha Debates, Question 5428 — Ministry of Civil Aviation — Apr 2025
Methods of delivery
Documented warning channels include anonymous electronic messages to airport or aviation authorities, threats communicated to airlines, and emailed warnings received by media organizations. Reuters reported that messages sent to RTÉ and Bulgarian broadcaster Nova TV invoked the name “Mikhail Andropov” and purported to announce broader attacks against transport. Reuters could not verify the sender’s identity, the technical origin of the messages or whether they belonged to the same operation as the aviation hoaxes.
Other threats contained language purporting to represent an anti-feminist organization. Such claims are self-descriptions embedded in threats, not validated attribution evidence. They could reflect authentic affiliation, impersonation, misdirection or imitation. Newsroom Bomb Threats Follow Escalating European Flight Hoaxes — Reuters — Nov 2026; European Air Traffic Targeted by New Threats — Associated Press — Nov 2026
3. Pattern Analysis
Tempo and clustering
Assessment — Moderate confidence: The November aviation incidents constitute an identifiable temporal cluster rather than merely an unremarkable selection of isolated background threats.
The supporting observations are their concentration over several days, their extension across multiple European jurisdictions and the appearance of similar threatening messages against separate recipients. These are genuine coordination indicators. They are not, however, sufficient indicators of common command. A widely publicized threat can be replicated quickly by unrelated individuals; media coverage, online circulation or deliberate impersonation can produce synchronized behavior without a central organizer.
By contrast, the refrigeration incidents demonstrate an operationally distinct pattern. CERT-FR’s October advisory described actual compromises affecting remote controllers; reporting in early November documented fresh commercial impacts in multiple European countries. The interval between those events raises the possibility of recurrence, continued exploitation of a common technology environment or multiple operators exploiting similar weaknesses. It does not establish a single campaign owner. CERT-FR Refrigeration Security Alert — ANSSI — Oct 2026; European Retail Refrigeration Incidents — Reuters — Nov 2026
Target selection and the operational mechanism
Aviation threats have a specific operational characteristic: their credibility cannot always be resolved before precautionary action becomes necessary. Decisions about diversion, escort, landing, evacuation and inspection often involve several organizations whose actions must be coordinated within a narrow operational window.
A warning directed at one aircraft can consequently generate an effect broader than the aircraft itself. It can interrupt airspace planning, require a diversion airport to receive an unscheduled flight, immobilize an aircraft during inspection and affect subsequent rotations. The 18 October Sofia diversion illustrates this response chain through the recorded involvement of Bulgarian military aviation and airport authorities. Tel Aviv – Vienna Flight Lands in Sofia Following Bomb Threat — Bulgarian Ministry of Transport — Oct 2026
Refrigeration systems offer another form of leverage: disruption of a relatively small technical control function can affect much larger inventories dependent on stable temperature conditions. The economic consequence can emerge before equipment is permanently damaged because food or medical material may become unusable when required storage conditions are lost.
The US joint advisory explicitly recognizes the potential for temperature manipulation, loss of monitoring visibility, inventory damage and safety hazards. These are documented categories of risk, not evidence that every possible consequence occurred in the incidents examined. US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems — CISA et al. — Nov 2026
Geographic distribution and national exposure
Italy. Italian airspace and airports have been affected by international flight diversions and November warnings involving routes to Rome and other destinations. Italy’s significance is primarily as a major trans-European aviation and logistics junction: disruptions can involve traffic originating abroad, so national incident counts should not be confused with the nationality of the operating airline or attacker. A Prague–Rome flight diverted to Venice on 6 November. Newsroom Bomb Threats Follow Escalating European Flight Hoaxes — Reuters — Nov 2026
France. France is a central intersection of the two observed threat domains. Aviation responses included the diversion of a Dublin–Rome flight to Évreux on 5 November and fresh threats against aircraft over French territory on 6 November. Separately, CERT-FR documented compromised refrigeration controls, and the FBI described attempted interference with three French blood-service sites. These events merit integrated national-level risk assessment without presuming a single perpetrator. Bomb Threats Target More Than a Dozen Flights in Europe — Associated Press — Nov 2026; FBI Cold-Chain Statement — Nov 2026
Germany. German exposure must be divided between the current bomb-threat environment and separate state-linked sabotage findings. On 2 September 2026, Germany’s Federal Foreign Office publicly stated that the German government attributed an earlier hybrid attack at Leipzig/Halle Airport on 4 August 2026 to Russia. That official attribution relates to a different event. It does not attribute the November commercial-aircraft bomb threats or refrigeration incidents to Russia. German Federal Foreign Office Press Briefing — Sep 2026
United Kingdom. The UK appears in the aviation network through flights originating from or transiting its airports, and Sky received a security threat during the November episode. Its National Cyber Security Centre had separately warned in January 2026 that Russian state-aligned hacktivist groups were disrupting UK organizations, especially through denial-of-service activity, while operating outside direct state control. This informs the range of plausible actors but provides no specific link to the aircraft threats. NCSC Warning on Hacktivist Disruption — Jan 2026
European Union. The relevant EU-level concern is the transnational nature of the response rather than a single centrally operated aviation-security system. National authorities remain essential to threat assessment and physical intervention, while EU aviation-security rules provide a common framework. During the November incidents, the European Commission’s transport commissioner indicated that it was premature to determine whether the threats were linked, and security information-sharing mechanisms were activated. Aviation Security — European Commission; European Flight Bomb Threats — Associated Press — Nov 2026
Operational effects and public response
The verified effects comprise precautionary diversions, aircraft and premises searches, fighter escorts, temporary runway or operational interruption, evacuation of a public broadcaster, and reported food losses associated with compromised refrigeration. The evidence does not demonstrate a general collapse of European air transport, nor does it establish mass public panic.
Assessment — High confidence: The attacks have imposed localized operational costs, while the European aviation network has continued to function.
Assessment — Moderate confidence: Continued incidents against widely recognizable civilian services could create disproportionate perceptions of insecurity even where the measured share of affected flights remains small.
4. Actor Assessment
State and state-linked actors
Russian intelligence and associated proxy activity warrant examination because separate official European investigations establish a relevant operational precedent.
In March 2026, Eurojust described a cross-border investigation concerning self-igniting parcels used in earlier European attacks. Authorities identified 22 suspects and stated that the acts were suspected of having been carried out on behalf of the Russian Federation’s military intelligence service. The investigation concerns an identifiable sabotage network and relevant transport-related cases, not the November 2026 passenger-aircraft bomb threats. Joint Investigation Team Disrupts Group Using Self-Igniting Parcels for Terrorist Attacks — Eurojust — Mar 2026
The German government’s September attribution concerning Leipzig/Halle Airport strengthens the general conclusion that state-directed hybrid activity is a real European security concern. It does not supply the missing forensic connection to current aviation warnings.
No inspected public evidence justifies assigning these warnings to the GRU, FSB, SVR or any other named Russian service. Likewise, no comparable evidence identifies China’s MSS, Iran’s intelligence services or another foreign intelligence organization as the operator of the present incidents. Naming such services in an attribution finding would therefore exceed the record.
Assessment — Moderate confidence: State or state-linked actors possess plausible strategic incentives to generate recurrent disruption and institutional distraction within Europe.
Attribution judgment — Low confidence: The November bomb threats were directed by a particular state or intelligence service.
State-aligned groups operating without direct state control
The UK’s NCSC explicitly described Russian-aligned hacktivists motivated by perceived Western support for Ukraine and operating outside direct Russian state control. This establishes a meaningful distinction between alignment, tolerance, inspiration and command.
Such actors could conceivably issue threats for ideological visibility or disruptive effect without formal tasking. However, the NCSC’s verified findings concern its reported hacktivist threat activity; they cannot be transferred automatically to aviation incidents merely because the motives might overlap. NCSC Warning on Hacktivist Disruption — Jan 2026
Non-state ideological groups
The threatening messages received by broadcasters and airport recipients contain purported ideological and geopolitical language. Their authorship remains uncertain.
The reference to an anti-feminist movement in some messages is analytically relevant as claim content, not as confirmed group membership. Equally, warnings invoking hostility toward Western states could represent genuine political motivation or deliberate manipulation of investigators’ expectations.
Assessment — Low confidence: An identifiable ideological organization is responsible for the broader November wave.
Individuals, criminal actors and copycats
Individual action has a documented evidentiary basis. Czech police investigated an individual suspected of sending dozens of threatening messages to public places during August–September 2026. The case demonstrates the ability of one person to generate repeated security responses, while also illustrating why numerous threats cannot independently prove a sophisticated coordinating organization. Czech Police Investigation into Repeated Threatening Emails — 2026
Copycat activity becomes more plausible when a wave receives substantial international publicity, provided later warnings can be traced to different origins or contain content derived from publicly known earlier messages. The crucial distinction is between technically linked messages and visually or linguistically similar messages. Only the former can materially strengthen a common-operator judgment.
Assessment — Moderate confidence: Independent individuals or imitators are a credible component of the overall incident environment, although their share of the November aviation warnings is presently unknown.
5. Strategic Objectives
Economic and operational disruption
This is the best-supported objective at the level of observable effect. Even a false bomb warning can impose aircraft inspection, rerouting, emergency staffing and scheduling costs. Malicious interference with refrigeration can impose inventory losses and recovery expenses.
The actual costs of the November flight incidents have not been established through an audited aggregate record. Estimates derived from illustrative diversion costs should not be multiplied by unverified flight totals and presented as campaign damage.
Assessment — Moderate confidence: Imposing disproportionate operational costs is a plausible central objective because the observed incidents repeatedly trigger expensive precautionary responses.
Psychological pressure and political messaging
The messages sent to broadcasters on 6 November used claims of responsibility and warnings about further transport attacks. Their exact provenance remains unverified, but their communicative design is consistent with intimidation directed beyond any individual flight.
Irish Prime Minister Micheál Martin publicly characterized these unconventional activities as capable of undermining the normal operation of society by generating fear and anxiety. Spain’s foreign minister, José Manuel Albares, raised the possibility of hybrid aggression and psychological warfare. These statements reflect the governments’ assessments and concerns; they are not forensic identifications of the perpetrators. European Air Traffic Targeted by New Threats — Associated Press — Nov 2026; Newsroom Bomb Threats Follow Escalating European Flight Hoaxes — Reuters — Nov 2026
Assessment — Moderate confidence: Public intimidation and institutional reputational pressure are plausible motivations where threatening communications explicitly seek attention beyond the immediate target.
Testing response systems
A sequence of threats can reveal information to its issuer about the visible consequences of warnings: whether an aircraft diverts, which authorities intervene and whether operations continue. Yet such information is available to the public after major incidents and is therefore not diagnostic of intelligence collection.
Assessment — Low confidence: The campaign is deliberately designed to map civil-aviation and emergency-response procedures.
Evidence supporting this proposition would require a connection between an operator’s activities and a demonstrable effort to collect, compare or use response observations.
Preparation for physical operations
European authorities have documented genuine sabotage activity, notably in the Eurojust parcel investigation. But no established evidentiary sequence connects that earlier investigation to current bomb threats or establishes an actual explosive device hidden behind the November warnings.
Assessment — Low confidence: The bomb-threat wave is preparatory activity for imminent physical attacks.
The consequence of this low-confidence judgment is not that threats should be dismissed. Operational authorities must continue assessing every credible warning independently.
6. Analysis of Competing Hypotheses — ACH
Hypothesis definitions
The matrix compares four distinct mechanisms for the observed incidents. They are not fully mutually exclusive: particularly, state-tolerated activity and copycat amplification can coexist. The current standing reflects the extent to which available evidence differentiates hypotheses rather than a numerical probability.
| Hypothesis | Diagnostic evidence supporting it | Evidence against / evidentiary weakness | Indicators that would discriminate | Current standing |
|---|---|---|---|---|
| H1 — Coordinated hybrid operation directed by a state actor | Cross-border clustering; operational disruption of civilian transport; documented European precedent for Russian-directed sabotage; threats with geopolitical messaging. | No public technical evidence connects the current warning messages to a state service; no common-command proof; separate refrigeration incidents have no established attribution to the aviation actor. | Authenticated intelligence-service tasking, linked operational accounts, payments, common infrastructure or court-supported state attribution. | Possible; low confidence in direct attribution. |
| H2 — State-tolerated or state-inspired non-state groups | Official NCSC evidence that state-aligned hacktivists exist and may act outside direct state control; ideological messaging may be compatible with such actors. | No confirmed group identity or affiliation in current aviation cases; slogans and claimed identities can be fabricated. | Verified group communications, independently authenticated membership, corroborated operational links or evidence of encouragement without direct tasking. | Plausible; low confidence as a case-specific explanation. |
| H3 — Uncoordinated individuals and copycats | Demonstrated individual mass-threat cases; simple delivery methods; publicity facilitates imitation; messages can be issued without sophisticated resources. | Geographic and temporal clustering may be difficult to explain if messages prove technically linked; some warnings show apparent thematic repetition. | Distinct senders, unrelated technical origins, inconsistent message artifacts, separate arrests and independently established motives. | Credible; moderate confidence as part of the threat environment. |
| H4 — Mixed campaign: initial concentration followed by opportunistic amplification | Consistent with a concentrated wave followed by threats to additional target classes; accommodates common message themes and divergent senders. | The identity, existence and boundaries of an initiating operation are not established; apparent amplification may itself be a reporting artifact. | Evidence of an early linked cluster followed by separately sourced derivative messages; changes in delivery patterns, language or targeting following publicity. | Best-fitting provisional model; moderate confidence, not established fact. |
ACH interpretation
The analysis assigns particular weight to disconfirming evidence, not merely evidence compatible with each hypothesis. The existence of Russian-linked sabotage elsewhere in Europe supports the background plausibility of H1 but has weak discriminatory value for these specific warnings: the same background condition can coexist with H2, H3 and H4.
The absence of publicly disclosed forensic links is similarly not proof that such links do not exist. It does, however, prevent high-confidence attribution.
H3 has the advantage of a demonstrated mechanism requiring no undisclosed command network. Its weakness is that it may not account for a technically coherent cluster if subsequent investigations establish common message origins.
H4 currently offers the broadest explanation of an environment in which some events may be connected while others are demonstrably independent. That breadth is also its weakness: a hypothesis capable of accommodating almost any incident is less useful unless investigators establish specific boundaries between the initiating cluster and later imitation.
Net ACH judgment — Moderate confidence: The current record does not justify selecting a single coordinated state operation over mixed and non-state explanations. H4 is the provisional working model; H3 remains a substantial alternative. H1 and H2 require stronger case-specific evidence.
High-value contradiction: military commissary refrigeration
The military commissary cases show why correlation is not enough. Outages at several US commissaries in late August remained under investigation, but the Defense Commissary Agency attributed four separate September outages in Germany and England to equipment failures and difficulties obtaining spare parts.
Treating all these outages as cyberattacks would erase a documented alternative cause and artificially strengthen a common-campaign hypothesis. Pentagon Still Investigating Commissary Freezer Outages — Stars and Stripes, citing Defense Commissary Agency — Nov 2026
7. Desensitization and Response Fatigue
Is repeated exposure causing measurable degradation?
The central distinction is between response burden, which is demonstrated, and response degradation, which has not been established.
The November events required police deployments, aircraft searches, fighter escorts, airport coordination and emergency procedures. These activities consume resources even when no explosive device is found. But the current public record does not contain a validated time series showing that aviation or security personnel became less responsive, that response times materially deteriorated, or that an actual dangerous warning was missed because of repeated false alarms.
EUROCONTROL’s observation that the threats involved approximately 0.05% of the European aviation network on 5 November indicates that the proportion of total flights affected remained small. It does not measure the overtime, specialist availability, financial loss or procedural burden imposed on the particular airports and authorities involved. European Air Traffic Targeted by New Threats — Associated Press, citing EUROCONTROL — Nov 2026
The European Cockpit Association’s vice president, Paul Reuter, described pilots as trained to handle these situations and capable of preparing for diversions and contingency procedures. This is evidence of continued operational preparedness, although not a formal performance audit. European Air Traffic Targeted by New Threats — Associated Press — Nov 2026
Distinguishing two possible fatigue mechanisms
Institutional fatigue would arise if repeated alerts placed sustained demands on limited police, aviation-security, explosives-disposal or airport-management resources. It could appear as longer response times, increased staffing pressure, reduced training availability or growing delays in routine operations.
Public desensitization would arise if passengers or employees progressively perceived warnings as implausible and became less willing to comply with instructions. This could be especially consequential if a genuine threat later occurred amid a history of hoaxes.
Both mechanisms are plausible. Neither is currently demonstrated through a reliable outcome dataset.
The refrigeration incidents provide a partial counterexample to inevitable desensitization. In the French blood-service cases, the FBI reported that alarms reached responsible personnel, staff intervened and no blood was lost. The observed outcome reflects functioning detection and response in those particular facilities, not degraded vigilance. FBI Cold-Chain Statement — Nov 2026
What would establish a deliberate fatigue operation?
A deliberate fatigue strategy requires evidence of intent, not simply repeated warnings. Investigators would need to establish that actors deliberately varied message timing or volume to burden response organizations, monitored the consequences, or directed participants to exploit observed changes in security behavior.
Measurement would also be necessary. Relevant variables include threat-to-assessment time, alert-to-deployment time, evacuation compliance, staff overtime, aircraft turnaround delays, and the proportion of warnings requiring escalation, each adjusted for ordinary traffic and staffing conditions.
Assessment — Moderate confidence: Sustained false warnings create a credible risk of cumulative resource strain.
Assessment — Low confidence: The present wave was designed specifically to desensitize the public or degrade emergency response.
Assessment — High confidence: No verified public evidence currently demonstrates measurable deterioration in aviation-security response effectiveness caused by this wave.
8. Future Targets and Indicators & Warnings
Forecast horizon and qualitative ranking
The immediate warning horizon is 7 November 2026–5 February 2027, with a longer structural outlook through 2031. These are risk-priority judgments, not numerical probabilities. They are based on demonstrated target recurrence, the consequences already observed and the absence of confirmed campaign attribution.
| Target set | Near-term concern | Evidentiary basis | Indicators raising concern | Indicators reducing concern |
|---|---|---|---|---|
| Commercial aviation and airports | Elevated | Repeated threats in early November, confirmed diversions and international responses. | New verified warning clusters; common technical origins across jurisdictions; repeated targeting of the same operating networks. | Separate perpetrators identified; declining incident volume with consistent reporting; absence of linked communications. |
| Retail refrigeration and food logistics | Elevated | CERT-FR-confirmed compromises and documented European retailer disruption. | Independently confirmed new compromises in additional operators or countries; common forensic signatures across victims. | Verified remediation, fewer unauthorized changes, documented unrelated causes for suspected cases. |
| Medical cold chain, blood services and temperature-sensitive pharmaceuticals | Elevated consequence; moderate incident-likelihood concern | FBI-confirmed attempted refrigeration disruption at three French blood-service sites; no blood lost. | Further confirmed attempts against healthcare temperature-control systems; independently verified inventory losses or service interruptions. | Successful alarms, preserved products, audited isolation of affected systems and no recurrence. |
| Rail and maritime transport, including ports | Moderate | A separate cruise-ship warning occurred during the European aviation cluster; cross-modal attribution remains open. | Authenticated threats across separate transport operators with shared origins; repeated operational disruption. | Incidents traced to unrelated individuals or resolved as local, isolated cases. |
| Energy and utilities | Conditional; moderate consequence concern | Wider European hybrid-threat context, but no verified operational connection to this particular aviation wave. | Officially documented threats or interference with energy operations linked by forensic evidence to the current incidents. | Routine failures independently established; no corroborated cross-domain links. |
| Government offices and public broadcasters | Elevated for threat messaging | RTÉ evacuation and additional broadcaster threats on 6 November. | Verified repeat targeting of institutional communications; authenticated common-origin messages. | Independent message origins identified; threats cease without operational effect. |
| Military-related civilian logistics | Conditional | Commissary refrigeration events under investigation, with some European outages attributed to equipment failures. | Confirmed malicious interference and independent evidence tying incidents together. | Maintenance records and technical investigation establish nonmalicious causes. |
Priority warning indicators
The highest-value warning signals are not dramatic claims of responsibility but verifiable changes in evidence.
| Indicator | Why it matters | Analytical consequence |
|---|---|---|
| Cross-border forensic linkage between threatening communications | Establishes whether apparently separate incidents share technical origins or operational accounts. | Raises confidence in a coordinated aviation campaign. |
| Evidence of command, financing or tasking from a state-linked network | Distinguishes state direction from ideological sympathy or independent action. | Materially strengthens H1 or H2. |
| Verified independent perpetrators using publicly copied language | Establishes imitation rather than central coordination. | Strengthens H3 and the amplification element of H4. |
| Common forensic indicators connecting aviation threats and refrigeration intrusions | Tests the proposed relationship between two different attack methods. | Would materially change the cross-domain judgment. |
| Escalation from false warnings to confirmed physical devices or injuries | Changes the threat from primarily disruptive to potentially destructive. | Requires immediate revision of capability and intent assessments. |
| Documented deterioration in security-response measures | Supplies the missing evidence for operational fatigue. | Raises concern regarding institutional degradation. |
| Documented unrelated mechanical or administrative failures | Prevents ordinary outages from being misclassified as hostile activity. | Weakens claims of a unified infrastructure campaign. |
Outlook
Assessment — Moderate confidence: Additional malicious aviation warnings are a credible near-term possibility because the recent wave has demonstrated that such threats can attract substantial attention and trigger real security action.
Assessment — Moderate confidence: Further refrigeration incidents are also credible where operators have not completed the mitigation measures recommended by national cybersecurity authorities.
Assessment — Low confidence: The incidents will escalate into a coordinated campaign against energy infrastructure, railway signaling or port operations.
The longer-term strategic concern is the combination of digitally dependent civilian infrastructure and low-cost methods of inducing emergency responses. This vulnerability persists independently of whether the November warnings are ultimately attributed to a state service, a criminal group or several unrelated actors.
9. Gaps and Collection Recommendations
The principal intelligence gaps
Gap 1 — Missing common incident registry. No sufficiently reconciled public record establishes the exact number of unique aviation bomb-threat events globally during 2025–2026. Airline reports, airport reports, national police records and EUROCONTROL observations employ different units and reporting periods.
Collection requirement: National aviation-security authorities and EUROCONTROL should reconcile unique flight identifiers, event timestamps, threat-recipient categories and disposition outcomes, while maintaining protected fields for sensitive operational data.
Gap 2 — Unknown technical origin of warning messages. Public descriptions of email wording do not authenticate the origin or identify a sender.
Collection requirement: Authorized national investigators should compare retained message artifacts, authenticated sender information, relevant provider records and legally obtained communications evidence across the affected countries. Mere similarity in slogans should not be treated as proof of identity.
Gap 3 — No established cross-domain attribution. The refrigeration compromises and aviation hoaxes are contemporaneous but technically different activities, and no verified common operator has been publicly identified.
Collection requirement: Competent cyber incident-response authorities and criminal investigators should compare independently established forensic indicators, suspect networks, infrastructure records and evidentiary timelines without assuming linkage in advance.
Gap 4 — Incomplete refrigeration loss assessment. Public reporting confirms real commercial effects, but there is no standardized audited estimate of the affected inventory, recovery expenditure or duration of interruption across the observed incidents.
Collection requirement: National computer emergency response teams, food-safety authorities and affected operators should record confirmed losses, equipment status and restoration outcomes using consistent definitions.
Gap 5 — Insufficient evidence on military commissary outages. Several US cases remained under investigation, while separate European cases had identified mechanical causes.
Collection requirement: Obtain the competent Defense Commissary Agency and investigative authorities’ final public findings, preserving the distinction between confirmed malicious interference and ordinary equipment failure.
Gap 6 — No measurement of response fatigue. Existing operational reports record interventions but do not establish a deterioration trend.
Collection requirement: Compare standardized incident-response measures with a pre-wave baseline, adjusting for traffic, alert severity, staffing and differences in national procedures.
Gap 7 — Unresolved strategic intent. Claims of responsibility and political statements cannot establish the actual objective of an unknown operator.
Collection requirement: Prioritize authenticated case evidence, prosecutorial findings and official joint attributions capable of identifying motive, direction and operational relationships.
Decision implications
The proportionate institutional response is to preserve rigorous threat assessment while improving evidence exchange, resilience and measurement. Automated or centralized procedures must not convert a high frequency of false warnings into a presumption that subsequent threats are harmless.
For the cold chain, the official technical guidance is more immediate and concrete: authorities recommend restricting unnecessary internet exposure, strengthening authentication, updating affected systems and maintaining reliable alarms and temperature-monitoring arrangements. These protective actions address a verified vulnerability regardless of ultimate actor attribution. CERT-FR Refrigeration Security Alert — ANSSI — Oct 2026; US Government Cold-Chain Advisory — CISA, FBI, HHS, USDA and DoT — Nov 2026
10. Source Evaluation Appendix
Evaluation standard
Source reliability concerns provenance, institutional competence, direct access to the facts and susceptibility to reporting error. Information credibility concerns the extent to which a specific proposition is established, independently corroborated and consistent with known limitations.
A high-reliability authority may accurately report that an investigation is ongoing while being unable to establish who committed the act. An official statement attributing one incident also cannot automatically support attribution of another.
| Source | Reliability | Information credibility | Strongest evidentiary contribution | Principal limitation |
|---|---|---|---|---|
| Bureau of Civil Aviation Security figures, submitted to India’s Lok Sabha — Apr 2025 | High | High for reported national counts | Officially recorded airline threat volumes and response arrangements. | India-specific coverage; partial-year 2025 figure. |
| Bulgarian Ministry of Transport — Oct 2026 | High | High for the diversion and immediate response | Direct governmental account of the Sofia flight incident. | Initial event account does not identify perpetrator. |
| CERT-FR/ANSSI — Oct 2026 | High | High for observed controller compromises | Competent national cybersecurity authority confirming refrigeration incidents and issuing mitigation guidance. | Does not establish an aviation connection or a named perpetrator. |
| CISA, FBI, HHS, USDA and DoT Joint Advisory — Nov 2026 | High | High for the official threat characterization | Multi-agency confirmation of malicious activity affecting industrial refrigeration and cold chains. | Broad global warning, not a complete incident-by-incident registry or attribution finding. |
| FBI Cyber Statement — Nov 2026 | High | High for the reported three-site blood-service incident | Explicit official account of attacks, alarm activation, intervention and absence of blood loss. | Does not identify the actor or establish broader health-sector damage. |
| Eurojust Investigation — Mar 2026 | High | High for investigation status; moderate for ultimate responsibility pending judicial findings | Evidence of a genuine cross-border investigation into suspected Russian military-intelligence-linked sabotage. | Concerns separate parcel cases, not the current passenger-flight threats. |
| German Federal Foreign Office — Sep 2026 | High | High that the German government made the stated attribution | Explicit governmental attribution concerning Leipzig/Halle. | Public statement does not disclose the complete underlying intelligence and relates to another incident. |
| UK National Cyber Security Centre — Jan 2026 | High | High for the agency’s observed broader threat environment | Official distinction between Russian-aligned hacktivists and direct state control. | No demonstrated link to November aviation messages. |
| Czech Police — 2026 | High | High for recorded investigation and procedural action | Primary example of repeated threats attributed to an individual suspect. | Individual case does not explain the European aviation cluster. |
| Associated Press European Aviation Reporting — Nov 2026 | High as professional reporting | High for directly attributed official statements; moderate for evolving composite tallies | Contemporary aviation incidents and EUROCONTROL-confirmed flight counts. | Secondary record; numbers may evolve and reporting scopes differ. |
| Reuters European Aviation Reporting — Nov 2026 | High as professional reporting | High for named-source observations; low for unauthenticated claims of responsibility | Cross-border chronology, official reactions and reporting on threatening communications. | Cannot independently validate threat senders or state affiliation. |
| Reuters European Refrigeration Reporting — Nov 2026 | High as professional reporting | High for directly reported retailer effects; moderate for campaign-wide scope | Commercial disruption, geographical spread and retailer statements. | Individual retailer reports cannot by themselves establish one common attacker. |
| Stars and Stripes, citing Defense Commissary Agency — Nov 2026 | Moderate–high | High for explicitly attributed agency explanations; undetermined for uncompleted investigations | Separates investigated US commissary outages from European mechanical failures. | Does not establish malicious causation for unresolved cases. |
Consolidated assessment of confidence
The strongest documentary foundation concerns the existence of the threats, the security responses, the refrigeration compromises and certain specific operational consequences. Those conclusions are supported by official records or identifiable first-party statements.
The weaker foundation concerns campaign boundaries, individual perpetrators, state direction, strategic intent and deterioration of emergency response. These conclusions cannot be elevated merely through the accumulation of similar incidents or by citing geopolitical precedent.
Final Intelligence Assessment
Europe’s current aviation bomb-threat wave and the refrigeration cyber incidents constitute a serious, observable pattern of disruption against civilian systems whose uninterrupted operation depends on public confidence, standardized safety procedures and reliable technical controls.
Yet the case for a single integrated state-directed hybrid campaign remains incomplete. The public record establishes that state-linked sabotage networks have operated elsewhere in Europe, that state-aligned hacktivists can act without direct command, that individual offenders can generate repeated threats, and that refrigeration systems have been maliciously compromised. It does not establish that these propositions describe the same actor or operation.
Overall judgment — Moderate confidence: The most appropriate working assessment is a mixed disruption environment, with an unusual concentration of aviation warnings and a separately documented refrigeration threat that may involve different actors and motives.
Highest-consequence uncertainty — Low confidence: Whether some threats constitute deliberate reconnaissance or preparation for more destructive activity cannot presently be determined from open sources.
Priority for decision-makers: Preserve full threat-response credibility, strengthen protection of digitally managed cold-chain operations, and direct cross-border intelligence cooperation toward the small set of forensic observations capable of distinguishing coordinated state activity from independent actors and opportunistic imitation.
The next decisive development will not be another anonymous claim of responsibility. It will be a verified operational connection, a competent investigative finding, or a documented change in the severity and effects of the incidents.
PILLAR I — Threat Environment and Operational Effects
Bomb Threats as Potential Defence-Response Probes: European Air, Maritime and Land Security Under Hybrid Pressure
Reference period: 1 January 2025 – 6 November 2026
Geographic coverage: NATO Europe, with priority assessment of Italy, France, Germany, the United Kingdom, Poland, Romania, Estonia, Latvia and Lithuania; additional coverage of the Baltic Sea, North Sea, North Atlantic, Mediterranean and Black Sea security environments.
Primary intelligence question: Whether repeated threats against civilian aircraft and transport infrastructure are being used to observe, measure or test European civil-military security responses, potentially informing hostile contingency planning during a subsequent military or hybrid escalation.
Analytical status: Open-source assessment. Documented events, institutional statements and intelligence judgments are distinguished. Confidence refers to the strength of the available evidence, not the seriousness of the possible consequences.
1. Key Judgments
1. High confidence — Repeated threats against civilian aircraft can expose observable elements of European civil-military security procedures, but the fact that a response is observable does not establish that the incident was deliberately organized to collect intelligence.
2. High confidence — NATO’s air-defence architecture is a multinational command-and-control system integrating national armed forces, military surveillance, civilian air traffic services and regional operational headquarters, making an individual aviation-security incident relevant to several institutional authorities rather than to a single national air force.
3. High confidence — Official European military documentation explicitly recognizes that certain Russian military-aircraft activities near NATO territory can be intended to examine Allied response procedures and readiness, establishing a genuine precedent for defence-response probing without demonstrating that the November 2026 civilian bomb threats have the same origin.
4. High confidence — Actual Russian drone incursions into Polish airspace in September 2025 activated Polish and Allied combat aircraft, surveillance assets and ground-based air defence, demonstrating that European air-defence responses can involve multiple nations and military capabilities simultaneously.
5. High confidence — Military response capacity cannot be assessed reliably through fighter-launch times alone because threat identification, legal authorization, air traffic coordination, interception, public protection and recovery are distinct functions with different operational objectives and decision authorities.
6. Moderate confidence — The Baltic Sea, Poland, Romania and the Black Sea constitute particularly important environments for examining response readiness because documented aircraft incursions, repeated interceptions, critical-infrastructure threats and Allied defensive deployments have created sustained operational demands.
7. Moderate confidence — Maritime and land-transport threats could produce comparable intelligence opportunities for a hostile observer, particularly concerning interagency coordination and continuity of essential services, although no public evidence establishes a unified programme of aviation, naval and terrestrial response testing behind the current warning campaign.
8. Moderate confidence — Europe’s principal strategic challenge is maintaining credible, repeatable and legally controlled responses across several security domains during prolonged periods of uncertainty, while ensuring that routine protective operations do not undermine the capacity to address genuinely dangerous incidents.
Principal intelligence finding: the distinction between a false warning and a genuine reconnaissance operation
The hypothesis under examination has a credible military-intelligence foundation, but its different propositions must be separated. An anonymous bomb threat against a passenger aircraft may be false in its immediate content while still producing genuine military activity. If the warning is judged sufficiently consequential, civilian aviation authorities may coordinate with national security agencies and military air-defence organizations, resulting in fighter deployments, flight diversions, airport restrictions, aircraft inspections and emergency responses. Many of these consequences become publicly observable through flight operations, official statements, airport notices and subsequent investigative reporting. Consequently, a hostile actor could obtain information about certain visible aspects of the defence response without conducting an overt military incursion. However, a visible response is only a partial representation of military readiness; it reveals neither the complete surveillance picture nor the classified decision processes, reserve capabilities, contingency plans and wartime arrangements that determine performance during armed conflict. The established conclusion is that bomb threats can generate observable security activity; the unresolved proposition is whether the current incidents were deliberately organized to obtain that information.
This distinction is particularly important because there is already direct official evidence of military response probing in the Baltic environment. In its 20 May 2026 explanation of German and NATO air policing, the Bundeswehr expressly recognized that Russian military aircraft operating close to Allied airspace can test the response times, procedures and resilience of NATO air forces. The document describes these activities in the context of aircraft operating near NATO territory, including flights without ordinary civil-aviation identification or communication arrangements. It does not describe anonymous passenger-aircraft bomb threats. Nevertheless, it establishes that the underlying intelligence mechanism is recognized by an Allied military authority rather than being merely speculative. Security in Baltic Airspace: Law, Rules and Luftwaffe Procedures — Bundeswehr — May 2026.
The broader strategic relevance is reinforced by events in Poland on 10 September 2025, when Russian drones violated Polish airspace and NATO reported the involvement of Polish F-16 fighters, Dutch F-35 fighters, Italian airborne surveillance, NATO multinational tanker support and German Patriot air-defence assets. NATO’s account demonstrates that a serious airspace incident is not necessarily handled through a single interception sortie: it may require a coordinated Allied response involving air surveillance, command-and-control, combat aviation and supporting systems. That example is particularly valuable because it concerns a real airspace violation rather than an anonymous threat; it also demonstrates the limits of extrapolating from peacetime civilian-aircraft escorts to the much more complex requirements of defending against hostile aircraft, missiles or drones. Statement by the NATO Secretary General Following the Airspace Violations in Poland — NATO — September 2025.
The principal assessment is therefore neither that every bomb alert is a military intelligence operation nor that repeated alerts are strategically insignificant. The defensible position is that the hypothesis deserves formal investigation because the underlying reconnaissance mechanism is recognized in European military practice, while the attribution and purpose of the present civilian warning campaign remain unverified.
2. Situation Overview — The European Defence and Security Environment
The transformation from national air policing to integrated multi-domain defence
The European security environment of 2025–2026 differs materially from the traditional model in which national air forces maintained interceptors primarily to identify unknown aircraft, assist civilian flights in difficulty and protect national air sovereignty. NATO’s Integrated Air and Missile Defence Policy, endorsed by Allied defence ministers on 13 February 2025, formally describes an operational environment in which threats may originate from multiple strategic directions and involve conventional aircraft, uncrewed aerial systems, cruise missiles, ballistic missiles and other capabilities. The policy explicitly identifies the integration of surveillance, command, control, communications and national military assets as essential to Allied defence. Throughout 2026, NATO expanded its traditional Air Policing arrangements into a broader Air Defence posture incorporating additional defensive capabilities across the air, land, maritime, space and cyber domains. This institutional transformation matters directly to the assessment of potential reconnaissance through civilian alarms: the response to an abnormal aircraft movement cannot be equated with the response to a hostile military attack, because the latter operates within a wider defensive system with different capabilities, authorities and operational objectives. NATO Integrated Air and Missile Defence Policy — NATO — February 2025; NATO Air Defence — NATO — 2026.
According to NATO’s 2026 description of its Air Defence architecture, Supreme Allied Commander Europe retains overall responsibility, while Allied Air Command at Ramstein supervises the permanent operational structure. Three Combined Air Operations Centres provide regional command-and-control coverage: Torrejón in Spain, Uedem in Germany and Bodø in Norway. Their geographical responsibilities include overlapping areas, giving NATO additional command-and-control continuity rather than dividing European airspace into completely independent national compartments. NATO states that the system monitors up to 30,000 air movements each day across European Allied airspace. These are air movements monitored by the operational architecture, not hostile contacts, aircraft available for interception or security incidents. The figure illustrates the extraordinary volume of legitimate civil and military activity within which anomalous movements must be identified and assessed. The difference between monitoring an air movement and determining that it constitutes a hostile threat is central to understanding both the protective function of the system and the difficulty of evaluating its military performance from publicly observed interceptions. NATO Air Defence: Command Structure — NATO — 2026.
The air-defence architecture is only one element of European transport security. An airline receiving a bomb warning remains responsible for decisions concerning its aircraft within the applicable safety and security framework, while civilian air traffic services coordinate the movement of aircraft and national authorities assess the threat, enforce the law and conduct searches. Military aircraft can contribute identification, escort or other authorized protective functions, but the decision to investigate a potential explosive device is not itself evidence that NATO has activated a collective military-defence response. Maritime security similarly involves ship operators, port authorities, coast guards, national police and naval forces, while terrestrial infrastructure protection brings railway operators, transport police, emergency services, intelligence organizations and, under particular circumstances, armed forces into the same operational environment. The strategic concern is therefore not simply whether a fighter aircraft takes off. It is whether hostile activity is imposing recurrent decision-making demands across interconnected but legally distinct security systems.
The forces actually involved: a functional command-and-response architecture
The following matrix distinguishes the principal institutions and defensive functions that can become relevant during different types of alert. It is a public institutional architecture, not a reconstruction of classified alert protocols, internal authorization thresholds or operational deployment plans.
| Response function | Principal responsible institutions | Publicly documented capabilities or roles | Applicable threat category | Critical analytical distinction |
|---|---|---|---|---|
| Civil aviation safety and traffic coordination | National air-navigation service providers, air traffic control, airlines and airport operators | Flight monitoring, communication, route management, diversions, airport coordination and operational continuity | Aircraft bomb threats, loss of communication, diversions | A safety response does not necessarily imply an air-defence activation. |
| NATO air-defence command | SACEUR, Allied Air Command, regional CAOCs and national air forces | Continuous surveillance, identification, control and coordination of interception assets | Suspicious aircraft, incursions and applicable air-defence missions | NATO command coordinates designated military responsibilities; national law and civil authority remain relevant. |
| National air-defence execution | Air forces, national command centres and assigned Allied detachments | Fighter identification and escort, airborne surveillance and additional defensive measures | Air policing and actual airspace threats | Peacetime air policing is not a complete representation of wartime air and missile defence. |
| Integrated air and missile defence | NATO and national air forces, ground-based air-defence units and supporting commands | Air and missile surveillance, ground-based defensive systems and coordination of protective capabilities | Aircraft, drones and missile threats | Different threat classes require different capabilities and authorization arrangements. |
| Airport security and explosive-threat response | Airport police, national police, gendarmerie where applicable, specialist explosive-ordnance personnel and airport authorities | Security searches, controlled access, evacuation and investigation | Bomb threats against aircraft and airports | Absence of an explosive device does not make the precautionary response unnecessary. |
| Maritime security | National navies, coast guards, maritime authorities, port security and NATO maritime commands | Maritime surveillance, vessel monitoring, maritime patrol aviation and protection of maritime infrastructure | Vessel threats, port incidents and suspected sabotage | A port-security response is not equivalent to naval combat readiness. |
| Land transport and infrastructure protection | Rail operators, transport police, national law enforcement, internal security agencies and civil protection | Traffic suspension, infrastructure inspection, public protection, evidence collection and continuity management | Rail threats, attacks on transport infrastructure and public facilities | The immediate objective is often preservation of civilian life and service continuity. |
| Counterintelligence and attribution | Competent national security and intelligence agencies, police investigators, prosecutors and international judicial-cooperation bodies | Investigation of organized hostile activity, evidentiary coordination and prosecution | Suspected terrorism, sabotage, espionage and organized hybrid activity | Tactical response and perpetrator identification are separate processes. |
| Cyber and industrial-control security | National cybersecurity authorities, sector regulators, operators and incident-response teams | Detection of compromises, restoration, cyber incident coordination and technical advice | Refrigeration, energy, medical logistics and industrial systems | A cyber intrusion may generate physical consequences without a military deployment. |
Sources: NATO Air Defence — NATO — 2026; NATO Integrated Air and Missile Defence Policy — NATO — February 2025; Emergency Response Planning — International Civil Aviation Organization; Operation Sea Guardian — NATO.
Chronology of defensive activity and institutional changes, 2025–2026
A meaningful assessment of possible defence testing must distinguish an anonymous threat, a military interception, a confirmed hostile penetration, a physical sabotage operation and an official defensive adaptation. These observations belong to different evidentiary categories, even when all concern the resilience of European transport and security infrastructure.
| Date or period | Country or theatre | Verified event | Military or security response | Evidence relevant to defence-readiness assessment |
|---|---|---|---|---|
| 14 January 2025 | Baltic Sea | NATO launched Baltic Sentry following incidents affecting critical undersea infrastructure. | Enhanced maritime presence, including naval vessels, maritime patrol aviation and uncrewed systems. | Demonstrates an institutional shift toward persistent maritime infrastructure protection. |
| 23 February 2025 | Italy / Mediterranean aviation | A New York–Delhi American Airlines flight diverted toward Rome after a reported bomb threat. | Two Italian Eurofighters intercepted and escorted the aircraft to Fiumicino under NATO-coordinated procedures. | Direct evidence that a civilian bomb alert activated military air-policing capabilities. |
| 24 May–5 June 2025 | Poland / Baltic Sea | RAF Typhoons intercepted Russian aircraft operating near NATO airspace, including repeated reconnaissance-aircraft activity. | NATO-directed RAF fighter deployments from the Polish theatre. | Demonstrates repeated real-world air-policing demands in the Baltic environment. |
| 10 September 2025 | Poland | Poland reported 19 Russian drone airspace violations during the night. | Polish and Allied aircraft, surveillance and supporting defensive capabilities were activated; Poland requested NATO Article 4 consultations. | Demonstrates actual multinational response to hostile airspace penetration. |
| 12 September 2025 | NATO eastern flank | NATO announced Eastern Sentry following the Polish drone incursions. | Expanded Allied defensive activity incorporating conventional military assets and new counter-drone capabilities. | Evidence of a deliberate institutional adaptation to changing air threats. |
| 19 September 2025 | Estonia / Baltic Sea | Three Russian MiG-31 fighters entered Estonian airspace without permission. | Italian F-35 aircraft participating in NATO Baltic Air Policing responded. | Demonstrates direct Italian involvement in Baltic airspace defence. |
| 15–19 November 2025 | Poland / railway infrastructure | Polish authorities investigated two sabotage incidents affecting the Warsaw–Lublin railway route and identified suspects allegedly acting for Russian intelligence. | Police, prosecutors, counterintelligence and military authorities became involved; reinforced railway protection followed. | Demonstrates an officially investigated hostile infrastructure operation in the land-transport domain. |
| 31 March 2026 | Romania / Black Sea | Germany completed an eight-month enhanced Air Policing mission involving 35 alert launches. | German Eurofighters handed responsibilities to an RAF detachment operating with Romania. | Provides a verified deployment-level indicator of sustained readiness activity. |
| 6–26 April 2026 | Lithuania / Baltic Sea | Lithuanian defence authorities reported five NATO air-policing activations during each of two separately documented weeks. | Allied fighters identified or escorted Russian military aircraft in international airspace. | Demonstrates repeated operational demand, without proving an abnormal annual trend. |
| 20 May 2026 | Germany / Baltic theatre | Bundeswehr published its explanation of NATO air-policing procedures and identified Russian probing of response characteristics as a recognized concern. | Established national and NATO air-policing arrangements remained active. | Direct institutional recognition of response probing as a military phenomenon. |
| 31 July 2026 | Romania | RAF completed its four-month Operation Biloxi 2026 deployment and handed responsibility to Spain. | Continued Allied QRA coverage alongside Romanian forces. | Demonstrates succession and interoperability of multinational defensive deployments. |
| 12 August 2026 | Poland and Romania | NATO’s North Atlantic Council discussed new airspace violations and drone incidents. | NATO and national authorities reinforced their defensive posture. | Confirms that airspace incidents remained a live Allied security issue in 2026. |
| August 2026 | Romania / Black Sea | Romania documented actual airspace incidents and a separate maritime-drone incident near offshore infrastructure. | Romanian fighters, military command, civilian emergency authorities and maritime security personnel were involved as appropriate. | Demonstrates overlapping air and maritime security responsibilities in one national theatre. |
| 17 October 2026 | Romania | Romanian authorities reported that two drones entered Romanian airspace and were engaged by Romanian F-16 aircraft. | National air-policing forces acted against identified aerial targets. | Demonstrates a qualitatively different response from precautionary civilian-aircraft escort. |
| 18 October 2026 | Bulgaria | A Tel Aviv–Vienna passenger aircraft reported a bomb threat while transiting Bulgarian airspace. | Bulgarian MiG-29 aircraft were activated under NATO-coordinated air-policing arrangements; the passenger aircraft diverted to Sofia. | Direct example of military involvement in a civilian bomb-threat response. |
| 3–6 November 2026 | Multiple European aviation jurisdictions | Concentrated bomb warnings affected passenger aircraft and airport operations; separate warnings reached broadcasters. | Fighter escorts, diversions, searches and national security measures were reported. | Provides the current multi-country cluster requiring forensic examination for common origin and possible deliberate observation. |
Principal official records: Baltic Sentry Launch — NATO — January 2025; American Airlines Bomb-Threat Interception — Italian Air Force — February 2025; Polish Airspace Violation — Polish Prime Minister’s Chancellery — September 2025; Eastern Sentry Launch — NATO — September 2025; Russian Aircraft Violation — Estonian Defence Forces — September 2025; Railway Sabotage Proceedings — Polish National Prosecutor’s Office — November 2025; German Enhanced Air Policing Handover — Bundeswehr — April 2026; RAF Handover in Romania — Royal Air Force — July 2026; Romanian Air Defence Incident — Ministry of National Defence — October 2026; Bulgarian Air Policing Response — Ministry of Defence — October 2026; European Commission Aviation Security Briefing — November 2026.
Italy — National air sovereignty, Mediterranean access and NATO integration
Italy occupies a particularly important position because its national airspace connects the western and eastern Mediterranean with major European aviation corridors, while Italian forces contribute to NATO operations well beyond Italian territory. This makes the Italian case analytically different from that of a state whose air force is concerned almost exclusively with national airspace. The Italian Air Force participates in national air sovereignty, NATO integrated air defence and Allied air-policing deployments, while the Italian Navy and other competent national authorities contribute to maritime surveillance and infrastructure protection. Within this architecture, a warning against a commercial aircraft approaching Italy may generate operational responsibilities involving Italian aviation authorities and military air-defence assets, but the incident’s origin, aircraft registration, airline nationality and military response jurisdiction need not coincide. The resulting operational chain cannot be understood simply by counting how many aircraft were diverted to an Italian airport. The relevant questions concern which authority initiated a particular protective response, whether the military engagement resulted from the threat itself or an additional aircraft-security concern, and what evidence establishes the final disposition of the incident.
The clearest official case is the 23 February 2025 American Airlines incident. According to the Italian Air Force, an aircraft operating from New York toward Delhi diverted after a reported explosive-device warning. Two Eurofighter aircraft from the 4th Wing were activated, identified the civilian aircraft and escorted it to a safe landing at Rome Fiumicino. The Italian Air Force identified NATO’s Combined Air Operations Centre at Torrejón as the authority issuing the scramble order and described the involvement of Italy’s integrated air-defence command structure at Poggio Renatico. This is a particularly important case because it conclusively demonstrates that a bomb threat can lead to a real fighter deployment within the NATO-coordinated peacetime air-defence system. It does not establish that the original warning was designed to produce that deployment, nor does it reveal the complete detection, verification and authorization sequence that preceded it. American Airlines Bomb-Threat Interception — Aeronautica Militare — February 2025.
A second Italian Air Force case from June 2026 provides a useful control observation. Two Eurofighters were dispatched to identify a civilian aircraft that had lost contact with air traffic control; communications were subsequently restored, and the fighters returned. Another documented Italian interception in July 2026 concerned a civilian aircraft experiencing a communication interruption during transit over national territory. These cases demonstrate that an aircraft interception is not a unique marker of terrorism, hostile reconnaissance or even an explosive threat. The same broad military response architecture may be activated for ordinary aviation irregularities, including communications failures. Any retrospective effort to identify anomalous military-response patterns must therefore distinguish the normal background rate of legitimate air-policing interventions from exceptional security operations. Otherwise, routine safety activity risks being misinterpreted as evidence of hostile targeting. Civilian Aircraft Identification Mission — Aeronautica Militare — June 2026; Civilian Aircraft Identification Mission — Aeronautica Militare — July 2026.
Italy’s importance also extends to the Baltic and Black Sea theatres. On 19 September 2025, Estonia’s Defence Forces reported that three Russian MiG-31 fighters entered Estonian airspace without permission and that Italian F-35 aircraft operating within the NATO Baltic Air Policing mission responded. The official Estonian statement recorded the incident as the fourth Russian airspace violation of Estonia during 2025. In a separate 2025 Romanian deployment, Italian Eurofighters operating with Romanian F-16s conducted enhanced Air Policing activity associated with Russian drone operations near Ukraine’s border. These cases substantiate the operational reality of Italy’s participation in geographically distant Allied air-defence tasks. They do not demonstrate that any one Italian deployment had impaired the country’s domestic defensive readiness, because actual fleet availability, reserve assignments and operational planning are not established by the public statements. Russian Aircraft Violation of Estonian Airspace — Estonian Defence Forces — September 2025; Italian Eurofighter Air Policing over the Black Sea — Aeronautica Militare — 2025.
The Mediterranean adds a naval dimension that cannot be assessed by aircraft-interception data. Italy operates within a maritime environment involving commercial shipping, passenger ferries, cruise vessels, offshore installations, subsea communications infrastructure and major ports. NATO’s Operation Sea Guardian, conducted under Allied Maritime Command, supports maritime situational awareness and counterterrorism and may contribute to critical-infrastructure protection within its mandate. Italy’s maritime geography makes coordination among civilian port authorities, coast guard functions, naval surveillance and national law enforcement a strategic necessity. A warning against a passenger vessel would principally require a maritime safety and security response; it would not automatically constitute evidence of naval combat alert. This legal and functional separation is significant because it limits what an external observer can infer about military readiness from publicly visible protective action. Operation Sea Guardian — NATO.
Italy-specific judgment — High confidence: Italy provides documented examples of NATO-coordinated fighter activity triggered by civilian aviation concerns and of Italian military participation in both Baltic and Black Sea air defence; moderate confidence: the strategic value of observing such activities would lie primarily in understanding multinational coordination and public operational behaviour, not in obtaining an accurate measure of Italy’s wartime defensive capacity.
France — A quantitatively documented permanent air-security architecture
France offers one of the strongest publicly documented national baselines for measuring routine air-security activity. Its Posture permanente de sûreté aérienne (PPS-A) is a standing national air-security function under the French military command structure, involving approximately 450 air-force personnel, a network of around 70 civil and military radars and three principal detection-and-control centres. The framework includes the Commandement de la défense aérienne et des opérations aériennes, with the Centre air de planification et de conduite des opérations et de défense aérienne supporting coordination of air-defence activity. French institutional documents describe a permanent system designed to detect, identify and assess aircraft, while also supporting response to abnormal flight behaviour, communication failures and potential threats. Critically, the French national arrangement includes a national political and legal decision-making structure for serious coercive air-security measures. It therefore illustrates why NATO air-policing coordination cannot be treated as a substitute for every national legal authority. French Air-Force Readiness and Employment — Assemblée nationale, Defence Committee Report — October 2024; Permanent Air Security Posture — French Ministry of the Armed Forces — June 2026.
The Ministry of the Armed Forces reported 452 real air-security interventions during 2025, undertaken by fighter aircraft and helicopters. The ministry’s retrospective classified those interventions as encompassing several different types of aviation-security event, including loss of communication, aircraft assistance, identification and other irregularities. The figure is substantial, but its meaning must be preserved: it is not a tally of hostile interceptions, terrorism alerts or bomb threats. A separate parliamentary record described 883 air-security alert departures during 2024, using terminology that is not necessarily equivalent to the 2025 measure of real interventions. These numbers cannot be used to assert that French defence activity halved or that the country’s response burden declined without first reconciling definitions. Their strongest value is to establish that France already conducts a considerable volume of air-security operations during ordinary peacetime conditions. This makes the French case especially useful for comparing an unusual alert cluster against a documented institutional baseline rather than against an assumed absence of routine operational demand. French Air-Security Activity, 2025 — Ministry of the Armed Forces, 2026 Retrospective; French Air-Force Readiness and Employment — Assemblée nationale — October 2024.
The French model also shows the difference between conventional fighter interception and other security tasks. The permanent posture incorporates fighter aircraft and helicopters, while special protective arrangements can reinforce the ordinary system during major public events. Such arrangements may involve additional surveillance and counter-drone capabilities, but their defensive purpose and legal authorization differ from those of ordinary civil-aviation security. During the November 2026 wave, an Aer Lingus flight from Dublin to Rome was diverted to a French military installation after a reported bomb threat, according to the airline and French authorities cited in contemporaneous reporting. The incident demonstrates the availability of alternative landing and security coordination arrangements, but it should not be treated as a measurable test of the entire French air-defence system. Its observable outcome was the aircraft’s safe landing and subsequent security procedures, not a demonstration of readiness against a hostile military strike. Permanent Air Security Posture — French Ministry of the Armed Forces — June 2026; European Commission Press Briefing on Aviation Bomb Threats — November 2026.
France has an additional advantage for cross-domain analysis because its national security framework covers air, maritime and terrestrial protection through separate but coordinated institutional arrangements. The Ministry of the Armed Forces’ September 2026 operational summary explicitly identified both the permanent air-security posture and the Posture permanente de sauvegarde maritime, which contributes to surveillance and protection of French maritime approaches. It also identified the continuing role of Operation Sentinelle in domestic security. These capabilities belong to different operational missions, yet they demonstrate an established framework for addressing threats to national territory and civilian infrastructure across domains. An analytical exercise that measures only Rafale or Mirage activity would miss the separate demands placed on maritime patrol, coast guard, police, gendarmerie and land-security capabilities. French Armed Forces Operational Situation Report, 10–17 September 2026 — Ministry of the Armed Forces.
France-specific judgment — High confidence: The French public record provides a substantial peacetime baseline for air-security activity and demonstrates the coexistence of permanent air and maritime protective responsibilities; low confidence: the November aviation warnings reveal a measurable deterioration or exploitable limitation in France’s defence posture.
Germany — Civil-military coordination and sustained Allied deployments
Germany presents an unusually clear illustration of the distinction between civilian security responsibility and NATO military command. The Bundeswehr’s May 2026 explanation of German Air Policing identifies three ministries as relevant to national airspace security: transport, interior and defence. Their respective responsibilities concern civilian air traffic control, domestic danger prevention and military aircraft operations. Germany’s Nationales Lage- und Führungszentrum Sicherheit im Luftraum in Uedem brings together the relevant national functions, including the Luftwaffe, civilian air-navigation services and federal police. Its existence is an important institutional fact because it demonstrates that suspicious aviation activity is not managed exclusively through fighter-pilot readiness. Germany’s defensive response involves recognizing an incident, reconciling civilian and military information, identifying the competent authority and selecting an appropriate response within national and Alliance responsibilities. Air Policing: Security in German Airspace — Bundeswehr — May 2026.
Germany also provides substantial evidence of the sustained workload associated with multinational air policing. During its enhanced Air Policing mission in Romania, which concluded on 31 March 2026, the Luftwaffe reported approximately 170 deployed personnel, 35 alert launches and more than 650 flight hours over an eight-month mission period. These figures establish that continuous international air-policing commitments involve considerably more than the fighters visible during an interception. Maintenance personnel, logistical support, security forces, operational controllers and other specialists are essential to maintaining the deployment. The reported flight hours include the mission’s recorded flying activity and should not be presented as 650 hours of interception alone. Likewise, 35 alert launches are events, not a measure of the number of hostile aircraft encountered. The figures show sustained activity and institutional resource commitment, but they are insufficient to calculate remaining German air-defence capacity or readiness under simultaneous national and Allied emergencies. German Enhanced Air Policing Mission in Romania — Bundeswehr — April 2026.
Germany’s Baltic role is equally significant. The Bundeswehr reports that Estonia, Latvia and Lithuania have relied on rotating NATO fighter detachments for Baltic Air Policing since 2004 because they do not maintain national fighter forces for the same mission. German aircraft have periodically contributed to this system. The Baltic theatre is exceptional because a high density of Russian and Allied military aviation activity occurs close to civil air routes and national airspace boundaries. The Bundeswehr explicitly notes that Russian aircraft can operate in international airspace without necessarily violating international law, while still creating operational or political concern. An interception of such an aircraft therefore cannot automatically be classified as a response to unlawful penetration. This legal distinction is fundamental to a serious analysis of response testing: a military aircraft can generate observation opportunities near NATO territory without crossing a national border, but the resulting NATO response does not prove hostile intent in every case. Security in Baltic Airspace: Law, Rules and Luftwaffe Procedures — Bundeswehr — May 2026.
Germany-specific judgment — High confidence: German national security arrangements and expeditionary air-policing activity demonstrate a mature system of civil-military and multinational coordination; moderate confidence: the analytical value of repeated observations would be greatest for comparing public response consistency, although the public record cannot establish the system’s wartime limits.
United Kingdom — Air sovereignty, North Sea surveillance and North Atlantic maritime activity
The United Kingdom’s principal air-security instrument is the Royal Air Force’s continuous Quick Reaction Alert posture, maintained using Typhoon aircraft for national airspace protection. The RAF publicly identifies the mission as operating continuously and describes the capacity to respond to abnormal aircraft activity, including loss of civil-aircraft communication and approaches by military aircraft requiring identification. The United Kingdom also contributes fighter aircraft to NATO air-defence missions abroad, meaning that domestic air-security capability and deployed Allied commitments must be treated as related but separate operational responsibilities. The existence of a permanent QRA mission is evidence of readiness arrangements; it is not, by itself, evidence of the number of aircraft available during a wider conflict or the capacity to sustain a prolonged high-intensity operation. Guardians of the Sky: Air Policing — Royal Air Force — 2026; Royal Air Force Global Operations — RAF.
The RAF’s 2025 Polish deployment offers direct evidence of sustained NATO interception activity. On 5 June 2025, the RAF reported that NATO had activated its Typhoon detachment in Poland four times in seven days to intercept or identify Russian aircraft operating near Allied airspace. The documented aircraft included Russian reconnaissance platforms and fighter aircraft. These were military aviation events associated with Baltic security rather than anonymous bomb-threat responses. They matter because they provide a documented baseline of repeated defensive activations in an area where Russian military activity is already being monitored by NATO. The relevant analytical issue is whether the operational circumstances indicate ordinary recurring military interaction, deliberate intelligence collection, or a more consequential hostile pattern. The repeated activations alone do not determine which explanation is correct. NATO Scrambles RAF Typhoons Four Times in Seven Days — Royal Air Force — June 2025.
The United Kingdom’s naval record contributes another important dimension. On 8 August 2026, the Ministry of Defence reported that Royal Navy vessels and helicopters had spent 21 days during July monitoring Russian maritime activity in UK waters and the North Atlantic. The ministry described an increase of approximately 25% in maritime monitoring operations during the first seven months of 2026 compared with the equivalent period a year earlier, and reported the employment of four warships alongside naval helicopters. This is important because it demonstrates a measurable increase in British maritime-security activity independent of the November aviation warnings. The observation is not that UK naval forces have been rendered ineffective or overwhelmed; the official evidence establishes increased monitoring activity and operational commitment, not a failure of protective capacity. The British case therefore supports an assessment of sustained multi-domain security pressure but does not justify the conclusion that the aviation warnings and Russian maritime movements are coordinated. UK Armed Forces Step Up Monitoring of Russian Activity in UK Waters — Ministry of Defence — August 2026.
United Kingdom-specific judgment — High confidence: British authorities document continuous air-policing arrangements, repeated Allied interceptions and increased maritime monitoring activity; low confidence: the current bomb-threat campaign has been shown to influence British naval readiness or reveal usable wartime defence-response characteristics.
Poland — The clearest case of actual hostile airspace penetration and confirmed railway sabotage
Poland deserves particular analytical attention because the 2025 record includes two qualitatively different security events: a substantial violation of national airspace by Russian drones and an officially investigated sabotage operation against railway infrastructure. Unlike an anonymous bomb warning, these incidents involved physical intrusion or damage, the activation of national security measures and identifiable investigative consequences. Together, they demonstrate that Poland has already confronted security incidents requiring both military and internal-security responses. They do not prove that the perpetrators of the November 2026 aviation threats were involved in either operation.
The 10 September 2025 drone incident provides the strongest documented multinational air-defence case in the reviewed period. Polish Foreign Minister Radosław Sikorski stated that Russian-manufactured drones violated Polish airspace 19 times and that Polish and NATO military assessments regarded the movements as deliberate rather than accidental. NATO separately reported the involvement of Polish F-16 aircraft, Dutch F-35 aircraft, Italian airborne surveillance, German Patriot systems and Allied refuelling support. Poland invoked consultations under Article 4 of the North Atlantic Treaty, reflecting the political significance of the event. The airspace response was accompanied by national police, border guard and fire-service activity associated with locating and securing drone debris. By the evening of 10 September, Poland’s Ministry of the Interior reported the recovery of debris associated with 16 drones. These figures must be kept distinct: 19 reported airspace violations is not equivalent to 19 successfully intercepted drones, and 16 recovered drone sites or pieces of debris cannot automatically be converted into a defensive engagement-success rate. Statement on the Violation of Polish Airspace — Polish Ministry of Foreign Affairs — September 2025; NATO Secretary General’s Statement — September 2025; Polish Ministry of the Interior Situation Summary — September 2025.
The second Polish case concerns physical attacks against railway infrastructure in November 2025. The Polish National Prosecutor’s Office opened an investigation into sabotage affecting the Warsaw–Lublin railway corridor, including damage to railway infrastructure. On 19 November, prosecutors announced allegations against two Ukrainian nationals suspected of carrying out sabotage on behalf of Russian intelligence. These are formal investigative allegations and must not be represented as final criminal convictions. The Polish government reported that the events prompted stronger security arrangements, including the CHARLIE alert level for designated railway infrastructure. The Ministry of the Interior subsequently announced Operation Horyzont, involving 10,000 military personnel assigned to reinforce the protection of critical infrastructure, and reported that the sabotage sites were secured and suspects identified within 48 hours. The latter period describes the authorities’ stated investigative and protective response, not a universal time required to protect every railway incident. National Prosecutor’s Office: Charges in Railway Sabotage Case — Poland — November 2025; Prime Minister’s Parliamentary Statement on Railway Sabotage — Poland — November 2025; Government Response to Railway Sabotage — Polish Ministry of the Interior — November 2025.
The Polish cases establish a broader principle. An actual drone intrusion and a confirmed physical railway-sabotage investigation can both require substantial national mobilization, but they engage different security authorities, legal frameworks and operational responsibilities. A civilian-aircraft bomb threat may create a third category of response. Evaluating these incidents as if they were interchangeable military readiness tests would produce unreliable results. The important common factor is the ability of security incidents to require coordination between defence, policing, intelligence, civilian infrastructure operators and political authorities. Whether a hostile actor deliberately sought to measure that coordination is a separate attribution question. Poland-specific judgment — High confidence: Poland provides documented examples of simultaneous Allied air-defence involvement and major internal-security mobilization in response to real security events; low confidence: the public evidence demonstrates that the subsequent commercial-aircraft bomb warnings were conducted by the same network.
Romania — Black Sea defence, population protection and civil-military coordination
Romania is particularly relevant because the Black Sea environment has produced repeated real-world air-defence alerts and because Romanian authorities publish relatively detailed official incident accounts. Its armed forces operate national F-16 aircraft within the Allied air-defence structure, while NATO partners have maintained rotating enhanced Air Policing deployments. The Romanian Ministry of National Defence’s published accounts distinguish military aviation activity from public-warning responsibilities carried out through civilian emergency institutions. This creates a useful official record for understanding the coexistence of aircraft monitoring, national security decisions and protection of populations without assuming that every detected object presents the same threat.
On 13 August 2026, Romania’s Ministry of National Defence described an incident involving several aerial targets detected near the Ukrainian border, a Romanian F-16 response and a public warning issued through the RO-ALERT system. The ministry reported that one target entered Romanian airspace before subsequently leaving and that national military command informed civilian emergency authorities. In a separate incident on 17 October 2026, the ministry reported that two aerial targets entered Romanian airspace and were destroyed by Romanian F-16 aircraft over national territorial waters. These events demonstrate actual national military responses to aerial objects rather than purely precautionary escorts of cooperative civilian airliners. They also show why the existence of a fighter response cannot be treated as evidence that the entire air-defence network had been placed on a wartime footing. Romanian Airspace Incident — Ministry of National Defence — August 2026; Romanian Air Defence Engagement — Ministry of National Defence — October 2026.
The maritime dimension is equally significant. On 20 August 2026, Romania’s Ministry of National Defence reported an incident involving an uncrewed maritime object near offshore infrastructure within Romania’s exclusive economic zone. Romanian military aviation responded, while a coast guard vessel and naval explosive-ordnance specialists were dispatched for further assessment. This case is relevant because it demonstrates how a maritime security problem may involve military aviation, naval specialists and civilian maritime reporting within the same event. It does not demonstrate that a warning against a cruise ship or passenger ferry would necessarily produce the same configuration of forces. The response to a confirmed uncrewed object near offshore infrastructure has a different factual and legal basis from the response to an anonymous explosive warning against a passenger vessel. Maritime-Drone Incident near Romanian Offshore Infrastructure — Romanian Ministry of National Defence — August 2026.
Romania’s Allied air-defence posture is also shaped by successive foreign deployments. Germany maintained enhanced Air Policing until March 2026; the Royal Air Force then performed a four-month mission, formally transferring responsibility to Spain on 31 July 2026. The RAF reported that its Typhoon personnel operated alongside Romanian forces under NATO command arrangements. The significance is institutional continuity across different national contingents and the established practice of integrating Allied pilots, aircraft and supporting personnel with Romania’s own national air-defence arrangements. It would nevertheless be incorrect to equate rotation schedules with evidence of weakened coverage, because an official changeover may represent planned continuity rather than a reduction in capability. RAF Assumes Enhanced Air Policing in Romania — Royal Air Force — March 2026; RAF Concludes Operation Biloxi 2026 — Royal Air Force — July 2026.
Romania-specific judgment — High confidence: Romania’s 2026 record documents recurring air-defence activity, civilian warning functions and at least one incident involving maritime security authorities; moderate confidence: the Black Sea constitutes an important environment for assessing whether European protective institutions can sustain coordinated responses to recurrent security incidents.
Estonia, Latvia and Lithuania — The Baltic air-defence environment
The Baltic States must be examined as three sovereign countries operating within a closely integrated Allied defensive environment, not as a single national defence authority. Estonia, Latvia and Lithuania each exercise national sovereignty, maintain national defence and internal-security institutions and participate in NATO collective defence, while the Alliance provides rotating fighter detachments for the Baltic air-defence mission. NATO’s 2026 description identifies the long-established use of air facilities in Lithuania and Estonia and the additional capacity for Latvia to host Allied air-defence aircraft. Since the transformation of the traditional Baltic Air Policing mission into the broader Air Defence posture during 2026, the rotating multinational arrangement has continued within an expanded framework. This institutional structure is strategically relevant because it combines national sovereignty with multinational provision of certain air-defence capabilities. It does not imply that the Baltic States lack defensive forces or that their security depends solely on fighter aircraft stationed in the region. NATO Air Defence in the Baltics — NATO — 2026.
Estonia provides an especially clear example of an actual airspace violation. On 19 September 2025, the Estonian Defence Forces reported that three Russian MiG-31 fighter aircraft entered national airspace without authorization and that Italian F-35 aircraft responded under NATO’s Baltic Air Policing arrangements. The Estonian statement identified the incident as the fourth Russian military-aircraft violation of national airspace during 2025. This is evidence of an actual sovereignty violation, unlike an interception conducted solely in international airspace. The distinction matters legally and analytically: the operational response to a violation can be influenced by the aircraft’s location, identified behaviour and national defensive responsibilities, while interception in international airspace may be conducted for identification, monitoring or aviation safety without constituting evidence of an attack. Russian Federation Aircraft Violated Estonian Airspace — Estonian Defence Forces — September 2025.
Lithuania provides unusually consistent public reporting on NATO interceptions. The Ministry of National Defence recorded five Baltic air-policing activations during 6–12 April 2026 and a further five during 20–26 April 2026. The incidents involved Russian military aircraft, including surveillance and combat platforms, operating in the wider Baltic aviation environment. Many were recorded as operating in international airspace without the ordinary combination of active transponder signals, submitted flight plans and radio contact with civilian air traffic services. The reports do not establish an annual interception rate, because two selected reporting weeks cannot be treated as representative of the entire year. Their value lies in documenting actual mission activity and the recurring requirement for identification and monitoring. A serious tempo analysis must obtain the full chronological sequence of comparable weekly reports before asserting a sustained acceleration or attempting to associate individual activations with unrelated civilian bomb-threat incidents. Baltic Air Policing Interceptions, 6–12 April 2026 — Lithuanian Ministry of National Defence; Baltic Air Policing Interceptions, 20–26 April 2026 — Lithuanian Ministry of National Defence.
Latvia forms part of the same Allied air-defence environment but must not be represented as having identical national force structures, infrastructure arrangements or incident volumes. NATO identifies Latvia as capable of hosting Allied air-defence aircraft, while the broader Baltic defensive posture integrates the sovereign responsibilities of each participating state. The available material reviewed here is stronger for Estonia’s specific airspace violations and Lithuania’s published interception records than for a directly comparable Latvian national incident series. Consequently, any country-by-country ranking based solely on the documented cases would reflect differences in source availability as well as genuine operational activity. NATO Air Defence — NATO — 2026.
The regional maritime context is decisive. Eight of the nine Baltic Sea littoral countries are now NATO members, following Finland’s accession in 2023 and Sweden’s accession in 2024; Russia remains the other littoral state. This configuration does not eliminate military risk, because Russian and Allied aircraft and vessels continue to operate within a restricted, heavily used geographical environment combining national waters, international maritime routes, commercial aviation and critical undersea infrastructure. NATO launched Baltic Sentry in January 2025 specifically to strengthen the protection of critical undersea infrastructure after a series of damaging incidents. The activity combines maritime surveillance, Allied naval assets and cooperation with industry. The presence of persistent protective activity means that future suspicious maritime events would not occur against an institutional baseline of inactivity. Baltic Sea Security Assessment — Bundeswehr — May 2026; Baltic Sentry Launch — NATO — January 2025.
Baltic-specific judgment — High confidence: The Baltic region provides a substantial documented record of repeated NATO air-policing operations, an actual Estonian sovereignty violation and sustained Allied maritime infrastructure protection; moderate confidence: these characteristics make the theatre particularly relevant to the study of hostile observation of defensive procedures, although the evidence does not connect those military activities to the November 2026 civilian bomb threats.
North Sea, North Atlantic, Mediterranean and Black Sea — Different defensive environments, different institutional responsibilities
| Maritime theatre | Principal security characteristics | Relevant national and Allied forces | Verified 2025–2026 activity | Implication for the assessment |
|---|---|---|---|---|
| Baltic Sea | Dense commercial and military activity, Allied littoral states, Russian military presence and critical undersea infrastructure | Baltic national authorities, Allied navies, maritime patrol aviation and NATO commands | Baltic Sentry launched in January 2025; multinational maritime-technology cooperation developed during 2025–2026 | Strong evidence of persistent protective operations, but not of a link to aircraft bomb threats. |
| North Sea | Commercial shipping, maritime energy infrastructure, offshore facilities and access to major European ports | UK, German, Dutch, Belgian, Danish and other relevant national maritime authorities; NATO forces | UK reported increased monitoring of Russian maritime activity during the first seven months of 2026 | Demonstrates continuing maritime security demands independent of the aviation-warning cluster. |
| North Atlantic and Norwegian approaches | Transatlantic communications and maritime traffic, northern air approaches and Allied reinforcement routes | UK and Norwegian forces, NATO maritime and air commands, relevant Allied partners | NATO’s 2026 air-defence architecture includes the Nordic and Arctic regional command function; the UK reported sustained North Atlantic monitoring | Requires separate treatment from ordinary continental airport-security operations. |
| Western and Central Mediterranean | Major civilian aviation corridors, passenger and commercial maritime transport, energy and communications infrastructure | Italian, French, Spanish and other national services; NATO maritime forces | Ongoing NATO Operation Sea Guardian; documented Italian civilian-aircraft interception in February 2025 | Demonstrates established civil-military and maritime coordination arrangements. |
| Eastern Mediterranean and Aegean | International aviation, passenger maritime connections, military operations and overlapping national security responsibilities | Relevant national air forces and navies, coast guards and NATO maritime arrangements | Civilian aircraft and vessel threats were reported during 2026, including the Bulgarian diversion of a Tel Aviv–Vienna flight and an investigation concerning a cruise vessel in Greece | Maritime and aviation incidents must be separated until technical or investigative evidence establishes common origin. |
| Black Sea and Romanian approaches | Proximity to the war in Ukraine, recurrent aerial incursions, commercial ports and offshore infrastructure | Romanian and Bulgarian national forces, Allied air-policing detachments, coast guards and naval personnel | Repeated Romanian air-defence incidents in 2026 and a documented maritime-drone response | The strongest reviewed environment for contemporaneous air and maritime protective activity arising from actual physical incidents. |
Sources: NATO Maritime Activities; Operation Sea Guardian — NATO; NATO Baltic Sentry — January 2025; UK Maritime Monitoring Operations — Ministry of Defence — August 2026; Romanian Maritime-Drone Incident — Ministry of National Defence — August 2026; NATO Air Defence — 2026.
The regional comparison reveals an important distinction between the observable tempo of security activity and the actual burden imposed on military readiness. The Baltic Sea and Black Sea are characterized by continuing military encounters and real airspace incidents. The North Sea and North Atlantic involve sustained maritime surveillance and protection of national approaches, while the Mediterranean incorporates extensive civilian passenger traffic alongside naval and maritime-security responsibilities. It would be analytically unsound to infer that all four environments are responding to one coordinated hostile campaign, because the incidents differ in location, legal status, delivery mechanism, operational effect and evidentiary attribution. Equally, treating each theatre as entirely independent would overlook the multinational character of NATO command, the ability of Allied forces to participate in deployments outside their home countries and the common requirement to maintain credible public security procedures. The strategic issue is therefore the resilience of the institutional system as a whole, not the identification of one geographical location as the decisive point of failure.
Verified quantitative baseline — What the published figures actually measure
| Indicator | Verified value | Period and geographical scope | Correct interpretation | Source |
|---|---|---|---|---|
| Air movements monitored by NATO’s European air-defence architecture | Up to 30,000 daily | NATO European airspace, 2026 description | Overall monitored air movements, not security alerts or hostile aircraft. | NATO Air Defence — 2026 |
| NATO Combined Air Operations Centres | 3 | NATO regional command architecture, 2026 | Permanent regional command-and-control functions with overlapping responsibilities. | NATO Air Defence — 2026 |
| French PPS-A personnel | Approximately 450 | France, permanent national posture | Personnel contributing to the standing air-security mission, not fighter pilots alone. | Assemblée nationale Defence Report — 2024 |
| French detection-and-control centres | 3 | France, permanent posture | National military air-surveillance and control infrastructure. | French Armed Forces Media Guide — 2026 |
| French civil and military radar network | Approximately 70 | France, nationally published baseline | Radar network contributing to national air surveillance, not a count of independent weapon systems. | Assemblée nationale Defence Report — 2024 |
| French real air-security interventions | 452 | Calendar year 2025 | Interventions involving fighters and helicopters across different aviation-security circumstances. | French Air Force Retrospective — 2025 |
| German enhanced Air Policing alert launches | 35 | Romania, approximately eight months ending March 2026 | Alert launches by the German deployed contingent, not confirmed hostile engagements. | Bundeswehr Mission Summary — April 2026 |
| German contingent flight hours | More than 650 | Same Romanian deployment | Total reported flying activity during the mission, not time spent intercepting hostile aircraft. | Bundeswehr Mission Summary — April 2026 |
| German deployed personnel | Approximately 170 | Same Romanian deployment | Personnel supporting the expeditionary mission in multiple functions. | Bundeswehr Mission Handover — April 2026 |
| Polish drone airspace violations | 19 | Night of 9–10 September 2025 | Officially reported violations, not number of successful interceptions. | Polish Foreign Ministry Statement — September 2025 |
| Polish drone debris reported recovered | 16 | As reported on 10 September 2025 | Recovery count at the stated reporting time; different measure from airspace violations. | Polish Ministry of the Interior — September 2025 |
| Baltic NATO air-policing activations | 5 in each of two documented weeks | Lithuania’s reports for 6–12 and 20–26 April 2026 | Selected weekly observations, not a complete monthly or annual trend. | Lithuanian Ministry of National Defence — April 2026 |
| British maritime-monitoring change | Approximately +25% | First seven months of 2026 versus comparable 2025 period | UK Ministry of Defence’s reported change in maritime monitoring activity. | UK Ministry of Defence — August 2026 |
| UK warships employed during reported July monitoring activity | 4 | July 2026 | Ships identified in a particular maritime-monitoring operation, not total Royal Navy operational availability. | UK Ministry of Defence — August 2026 |
| UK maritime monitoring duration | 21 days | July 2026 | Reported duration of monitoring operations during the period, not a fleet-wide readiness threshold. | UK Ministry of Defence — August 2026 |
| Polish military reinforcement announced for infrastructure protection | 10,000 personnel | November 2025 | Government-announced reinforcement following railway sabotage, not an enduring national deployment count. | Polish Ministry of the Interior — November 2025 |
| Uncrewed systems tested under Task Force X-Baltic | 70 air and maritime drones | March–October 2025 | NATO-reported technology deployment and testing, not an inventory of operationally available systems. | NATO Baltic Maritime Innovation Cooperation — February 2026 |
The quantitative record is substantial, but the measures are heterogeneous. It would be erroneous to compare 452 French interventions with 35 German alert launches in Romania and conclude that France experiences a particular multiple of German military stress. The French figure covers an entire national air-security system and a complete year; the German figure refers to a deployed contingent and a shorter period. The British maritime figures concern vessel monitoring rather than air-security responses. The Polish drone figures concern actual incursions and debris recovery, not warnings. These differences are not a technical inconvenience that can be eliminated by assigning arbitrary weights. They define what the data are capable of proving. The appropriate comparison is institutional and functional unless common definitions, time periods and operational denominators become available.
3. Pattern Analysis — Operational Tempo, Response Observation, Civil-Military Coordination and Strategic Resilience
The critical analytical question: what can repeated alerts actually reveal?
A programme of deliberate defence-response testing would not necessarily need to cause physical destruction to generate useful observations. Its theoretical value would arise from the repeated occurrence of events that cause institutions to perform observable protective functions. When a civilian aircraft is judged to require military assistance, the resulting activities may include changes in flight routing, military escort, airport reception arrangements and subsequent public communication. When a maritime threat arises, the visible response may involve port restrictions, vessel inspections or deployment of maritime authorities. When a railway-security incident occurs, infrastructure operators may suspend services while police and technical specialists assess the situation. Each event produces information about the public-facing behaviour of security institutions. The intelligence question is whether such information is being collected incidentally by observers, deliberately gathered by an organized actor, or systematically used to support future operational planning. These are different propositions, and only the first is inherently supported by the visibility of the responses themselves.
There is a material difference between knowing that a state deploys fighters in response to certain emergencies and possessing a dependable understanding of its military ability to defend against an attack. A civilian-aircraft incident may involve a cooperative airliner travelling at a known speed and altitude, with information supplied by civilian controllers, airline operations and the crew. A hostile military operation can involve entirely different requirements for detection, classification, command authority, coordination and defensive engagement. Even the same military organization may employ different resources, procedures and decision-making structures depending on the threat category and legal circumstances. NATO’s 2025 IAMD policy recognizes this by distinguishing the continuous air-defence mission from the broader range of threats that could arise during crisis and conflict. Its 2026 Air Defence framework explicitly incorporates ground- and sea-based air-defence capabilities and counter-uncrewed-aircraft systems alongside conventional fighter aircraft. Consequently, the response to a bomb warning is not an operationally valid substitute for observing wartime air and missile defence, although it may reveal certain general characteristics of institutional coordination and readiness culture. NATO Integrated Air and Missile Defence Policy — February 2025; NATO Air Defence — 2026.
Temporal concentration: an abnormal warning cluster does not establish a coordinated intelligence operation
The November 2026 aviation incidents exhibit a genuine temporal concentration. EUROCONTROL figures communicated through Associated Press reporting identified threats against seven flights on 3 November and fourteen on 5 November. The same reporting placed the 5 November figure at approximately 0.05% of the nearly 26,300 flights operating within the European network that day. These observations are important because they demonstrate two conditions simultaneously: a noticeable increase in reported security warnings affecting particular airlines and airports, and a limited proportion of total continental aviation activity affected. Wider reporting described additional threats on 6 November, but the daily counts cannot be treated as a complete, reconciled series of unique incidents without a common reporting methodology. The numerical pattern does not, by itself, establish a centrally organized campaign, nor can the consequences for individual airports be accurately derived from the percentage of flights affected across Europe. European Air Traffic Targeted by New Threats After a Week of Hoaxes — Associated Press, reporting EUROCONTROL figures — November 2026.
From an intelligence perspective, the difficulty is that several mechanisms can produce a concentrated warning period. A common operator could issue repeated threats against separate flights; a loose group could share a common objective without a centralized command; unrelated individuals could imitate publicized earlier warnings; or multiple overlapping mechanisms could create a concentration that appears more coordinated than it is. A statistical cluster becomes evidence of a common operation only when the observation is supported by additional diagnostic information. The fact that several governments employed similar protective procedures is not sufficient, because the procedures are intended to provide standardized security responses. Similar outcomes are therefore partly a predictable consequence of established aviation-security systems. The first analytical task is to separate the observed event pattern from the explanation assigned to it.
Response tempo — what the public record establishes and what it does not
Determining whether European defence organizations are experiencing deterioration requires more than measuring how quickly a fighter aircraft becomes airborne. A complete response may involve several separate intervals: recognition of a concern, initial assessment, allocation of competent authority, operational intervention, civilian protection, inspection, restoration of normal services and subsequent investigation. These activities can overlap, and not all are necessary in every incident. Moreover, the moment at which an airline receives a warning is not necessarily the moment at which military authorities receive information requiring action. The point at which a fighter is launched is different from the point at which it reaches an aircraft, while the arrival of military aircraft is different from the safe completion of a diversion. Treating all of these as one response-time variable would create a false appearance of analytical precision.
Official military reports establish that European QRA systems operate continuously and that selected deployments can be initiated on a short-notice basis. They also record completed interceptions, escorts and defensive engagements. They do not provide a consistent public dataset containing all internal decision timestamps and operational conditions. For that reason, the available record supports a comparison of response completion, continuity and observable outcomes, but not a reliable calculation of the tactical response limits of individual military units. Detailed operational windows and estimates of how concurrent hostile activity might exploit them are not necessary to establish whether institutional readiness is deteriorating and would provide an inappropriate tactical targeting model. The defensible approach is to measure system performance through official aggregate and outcome-based indicators. Air Policing: Security in German Airspace — Bundeswehr — May 2026; Guardians of the Sky: Air Policing — Royal Air Force — 2026; Emergency Response Planning — ICAO.
| Documented response case | What the official record establishes | What cannot validly be calculated | Assessment |
|---|---|---|---|
| Italy, February 2025 — American Airlines bomb warning | Italian Eurofighters were activated under NATO coordination and escorted the diverted passenger aircraft to a safe landing. | Exact end-to-end threat-assessment duration, generalized interception performance or residual defensive capacity. | High confidence: military response was successfully completed. |
| Italy, June 2026 — civilian radio-contact interruption | Fighters were dispatched for identification and the incident was resolved after communication was restored. | Whether the event involved the same authorization, safety considerations or operational burden as an explosive warning. | High confidence: the response system handled a non-terrorist aviation irregularity. |
| Germany, Romanian deployment ending March 2026 | The deployed contingent completed 35 alert launches during approximately eight months and accumulated more than 650 flying hours. | Tactical response distribution, availability of national reserves or endurance during a broader conflict. | High confidence: a sustained multinational readiness commitment was maintained. |
| Poland, September 2025 — Russian drone incursions | Polish and Allied forces activated multiple defensive capabilities; Polish authorities reported 19 airspace violations. | A valid engagement-success percentage from the number of violations or subsequently recovered debris. | High confidence: a real multinational military response occurred. |
| Romania, October 2026 — aerial targets | The Romanian Ministry of National Defence reported F-16 engagement and destruction of two drones. | Generalized national engagement times, performance against other target classes or national defensive endurance. | High confidence: the reported incident involved actual defensive engagements. |
| France, calendar year 2025 | The Ministry of the Armed Forces recorded 452 real air-security interventions. | The response-time distribution, the number attributable to explosive threats or the system’s maximum sustainable workload. | High confidence: a substantial routine national air-security workload is documented. |
| United Kingdom, July 2026 — maritime monitoring | The Ministry of Defence reported 21 days of naval monitoring operations involving several ships and supporting aviation. | Wartime naval response times, reserve availability or the performance of other maritime security missions. | High confidence: sustained maritime-monitoring activity was carried out. |
| Poland, November 2025 — railway sabotage | Authorities reported strengthened infrastructure protection and identification of suspects within 48 hours. | The detection time of an attack in a different railway environment or the ability to prevent every future sabotage incident. | High confidence: substantial internal-security and investigative measures followed. |
Sources: Aeronautica Militare — February 2025; Aeronautica Militare — June 2026; Bundeswehr — April 2026; NATO — September 2025; Romanian Ministry of National Defence — October 2026; French Ministry of the Armed Forces — 2025 Retrospective; UK Ministry of Defence — August 2026; Polish Ministry of the Interior — November 2025.
Three levels of observation: why apparently similar alerts have different military significance
An analytically rigorous investigation should distinguish three different levels of observable security activity. The first is a precautionary civilian-security response, exemplified by a bomb warning received by an airline or airport. The principal objective is protecting passengers and infrastructure while assessing whether an explosive threat exists. Military aviation may assist in particular circumstances, but the central event remains a civilian security and safety problem. The second is a national or NATO air-policing response, such as identification of an aircraft operating without expected communications or approaching Allied airspace in circumstances requiring verification. The relevant authorities seek to establish identity, maintain safety and preserve air sovereignty without automatically treating the aircraft as a hostile military target. The third is an actual defensive response to a detected military threat or airspace incursion, such as the Russian drone violations in Poland in September 2025 or the Romanian drone engagements in October 2026. This category can involve a wider set of military capabilities and a different assessment of threat and permissible defensive action.
These distinctions are not semantic. The Polish September 2025 case involved actual aerial objects entering national airspace, a documented multinational defensive response and political consultations under NATO’s founding treaty. By contrast, the February 2025 Italian bomb-threat case involved the safe escort of a civilian aircraft that had diverted following a warning. An observer might see fighter aircraft in both incidents, but the identical visible presence of fighters would not establish comparable military requirements or reveal comparable information about defence effectiveness. The correct analytical comparison would preserve the incident class, outcome, competent authority and available supporting evidence. Without that classification, an attacker-testing hypothesis could appear supported simply because many security events share superficially similar military responses. NATO Secretary General’s Statement on Polish Airspace Violations — September 2025; Italian Air Force Bomb-Threat Response — February 2025.
Pattern indicators: what would support deliberate response probing?
The strongest diagnostic evidence for deliberate response probing would be an authenticated connection between the originator of a warning and a subsequent effort to observe, record, compare or use the consequences. This could arise through lawfully obtained communications, a competent criminal investigation, a documented operational instruction or a credible official attribution. Similar timing, repeated vocabulary and geographical concentration are weaker evidence because they can also arise from imitation and publicity. Conversely, independently identified senders, incompatible technical evidence or verified unrelated causes would weaken a common-operation explanation.
The following matrix evaluates evidentiary significance, not operational opportunities for conducting an attack.
| Observed characteristic | Consistent with deliberate probing? | Alternative explanation | Evidence required for stronger judgment |
|---|---|---|---|
| Repeated aviation warnings across national borders | Yes, but not diagnostic by itself | Copycat threats, one offender acting independently, publicity-driven imitation | Authenticated common-origin evidence and associated operational activity |
| Similar threatening language in messages to different recipients | Potentially | Shared public templates, copied media reports, impersonation | Verified provenance and evidence of a common author or organizer |
| Recurrent deployment of military aircraft | Potentially observable to a hostile actor | Normal QRA activity, loss of civilian communication, real incursions | Evidence connecting a particular warning originator to deliberate observation |
| Additional warnings against broadcasters or other public facilities | Potentially consistent with wider psychological disruption | Independent hoaxes or unrelated criminal incidents | A demonstrated operational connection between messages or perpetrators |
| Maritime and railway-security incidents during the same period | Possible cross-domain significance | Separate wars, crimes, infrastructure failures or independent hostile operations | Corroborated common direction, financing, technical origin or legally established relationships |
| An increase in reported alerts after media coverage | Compatible with amplification | Ordinary imitation following publicity | A time-ordered, deduplicated incident series and identified sender relationships |
| Increased public knowledge of security procedures | Possible unintended intelligence exposure | Routine transparency, official public communication | Evidence of deliberate hostile collection and subsequent operational use |
| Continued effective responses despite repeated warnings | Weakens claims of successful degradation | Normal resilience and institutional adaptation | Comparable response-performance records over time |
The principal analytical implication is that the presence of several compatible indicators does not transform weak evidence into strong attribution unless those indicators are independent and genuinely diagnostic. A cluster of similar emails, for example, may appear to provide several separate arguments for coordination: common language, similar targets and geographical dispersion. Yet if all three characteristics arise from one publicly available message template, they are not independent observations. A disciplined assessment must therefore avoid double-counting the same underlying fact.
Operational stress during escalation — the resilience question
The wider strategic concern is not whether a single false warning can force an individual aircraft to divert. It is whether European institutions can preserve the quality of decisions and essential public services during prolonged periods that include a mixture of genuine emergencies, uncertain warnings, cyber incidents and military-security events. This is fundamentally a question of institutional resilience under sustained operational demand. Relevant dimensions include the availability of qualified personnel, continuity of communications, consistency of threat assessment, coordination among civilian and military authorities, ability to restore essential services and preservation of public trust. These dimensions can be evaluated through government audits, after-action reports, incident registers, exercises and documented service outcomes without reconstructing attack sequences or identifying tactical vulnerabilities for exploitation.
NATO’s February 2025 Integrated Air and Missile Defence Policy provides the appropriate strategic framework. It emphasizes the need for coherent, resilient and adaptable defensive arrangements across peacetime, crisis and conflict. The policy recognizes that adversaries possess increasingly diverse air and missile capabilities and that defensive responses require integration across multiple military domains. This is directly relevant to the present analysis, because an anonymous aviation warning and an actual hostile air attack present different military problems but may coexist within a broader crisis environment. The existence of both threat categories does not mean they should be handled identically. Instead, institutional resilience depends on maintaining the ability to classify events correctly, assign competent authorities and protect civilian activity without weakening the response to genuine danger. NATO Integrated Air and Missile Defence Policy — February 2025.
The Polish cases illustrate why this distinction matters. In September 2025, actual Russian drone incursions involved Allied military forces and political consultations. In November 2025, railway sabotage required criminal investigation, infrastructure inspection and reinforced public protection, including a major announced military contribution to domestic infrastructure security. Both episodes imposed significant responsibilities on the Polish state, but the authorities, threat characteristics and operational tasks differed. Their coexistence within a relatively short period establishes that different categories of security challenge can require substantial national attention. It does not establish that either response failed, that Poland approached an identifiable military capacity limit, or that the same hostile command directed both events. The evidence supports a concern about sustained multi-domain preparedness, not a calculation of how an adversary could overwhelm a particular defence configuration. Polish Airspace Violation and Article 4 Consultation — Prime Minister’s Chancellery — September 2025; Polish Government Response to Railway Sabotage — November 2025.
The maritime dimension: persistent surveillance is not equivalent to immediate naval combat response
The maritime environment introduces a different category of resilience problem. Air policing is supported by a permanent command-and-control architecture oriented toward monitoring and responding to unusual aircraft activity. Maritime security involves continuous vessel traffic, national maritime law, commercial shipping operations, search-and-rescue responsibilities, port-security procedures and naval defence. A threat against a civilian vessel may require law-enforcement or maritime-safety measures without producing a warship deployment, while a confirmed suspicious maritime object or military vessel may warrant a different response. It follows that maritime response performance cannot be assessed using the same indicators as fighter-alert activity. The relevant measures may include the continuity of port services, the successful completion of vessel inspections, the protection of passengers, incident resolution and the restoration of maritime operations.
NATO’s response to Baltic Sea infrastructure incidents illustrates the institutional scale of the problem. Baltic Sentry, launched in January 2025, was designed to strengthen maritime surveillance and protection of undersea infrastructure. NATO reported that Task Force X-Baltic supported the deployment and testing of 70 air and maritime uncrewed systems between March and October 2025, with eight Allied countries subsequently agreeing in February 2026 to accelerate cooperation on technology-enabled maritime capabilities. The significance is not that NATO possesses 70 permanently deployed systems at any particular location; the figure concerns a programme of testing and operational experimentation. The substantive finding is that Allied institutions have recognized the need for additional maritime situational awareness and have undertaken practical capability development. This represents an adaptation to the security environment rather than evidence of an inability to protect the Baltic Sea. NATO Allies Agree to Expedite Innovation for Baltic Sea Security — February 2026.
The North Sea and North Atlantic provide a contrasting case through the United Kingdom’s published maritime-monitoring figures. The Ministry of Defence reported a 25% increase in monitoring activity during the first seven months of 2026 and identified substantial Royal Navy activity during July. Those observations establish a higher reported level of surveillance effort. They do not establish that the maritime forces were operating beyond sustainable capacity, nor do they prove that Russian maritime activity was coordinated with civilian bomb warnings. The principal decision question is whether monitoring and protection can continue without unacceptable deterioration in other authorized missions. That question can be addressed through aggregated readiness and service-continuity reporting, but the present public evidence does not provide sufficient comparable data for a definitive answer. UK Armed Forces Step Up Monitoring of Increased Russian Activity — Ministry of Defence — August 2026.
Land transport: from anonymous warnings to confirmed physical sabotage
The Polish railway cases demonstrate why land transport should not be treated as merely another potential recipient of anonymous warnings. Physical interference with railway infrastructure can create direct safety consequences and require a major security investigation. In November 2025, Polish prosecutors described sabotage affecting railway infrastructure and subsequently announced charges connected to suspected Russian intelligence involvement. The Polish authorities’ response combined law enforcement, counterintelligence, infrastructure protection and military reinforcement. This is qualitatively different from an unverified warning that prompts a precautionary evacuation but results in no discovery of a dangerous device. National Prosecutor’s Office: Railway Sabotage Investigation — Poland — November 2025; Charges in Railway Sabotage Case — Polish National Prosecutor’s Office — November 2025.
For strategic assessment, the Polish experience establishes the relevance of actual hostile action against transport infrastructure and the resulting need for national mobilization. It does not justify inferring that railway systems in other European states have identical exposure, response arrangements or legal thresholds. Italy, France, Germany and the United Kingdom operate different combinations of railway infrastructure management, transport policing and national-security responsibility. An institutional comparison therefore requires evidence concerning the competent authorities, prior incident volumes, service-disruption outcomes and official exercises rather than assuming that every government responds to railway threats through the same mechanism.
Cross-domain evidence and the importance of disconfirming cases
The refrigeration incidents investigated by European and US authorities provide a further reason to avoid collapsing all infrastructure events into one category. France’s CERT-FR reported numerous compromises affecting remotely managed refrigeration-control equipment in October 2026, while US federal authorities issued a multiagency advisory in November concerning malicious activity against industrial refrigeration and cold-chain monitoring systems. These are documented cyber incidents involving control technology and possible physical consequences. They differ fundamentally from an anonymous bomb-warning email, which may produce operational disruption without any compromise of the targeted system itself. The fact that both can impose economic or security costs does not establish common technical capability, direction or motive. Security Incident Targeting Remote Refrigeration Controllers — CERT-FR/ANSSI — October 2026; US Government Partners Urge Hardening of Industrial Refrigeration and Cold-Chain Monitoring Systems — FBI and Federal Partners — November 2026.
A credible cross-domain investigation must also preserve evidence that contradicts the expectation of hostile action. Not every refrigeration outage is a cyberattack; not every civilian-aircraft interception is a security emergency; not every naval patrol reflects an immediate threat; and not every Russian military flight in international airspace violates national sovereignty. The German military’s explanation of Baltic air policing explicitly distinguishes lawful military flights in international airspace from actual national-airspace violations. This is especially important in a period of elevated geopolitical tension, because the analytical tendency to classify every abnormal observation as hostile can create a misleading picture of a unified campaign. The proper objective is to determine which events share a supported operational relationship, not to enlarge a suspected campaign until it includes every contemporaneous irregularity. Bundeswehr: Baltic Airspace Security, Law and Procedures — May 2026.
Evaluating resilience without inventing operational limits
The relevant evidence is best assessed through a comparative resilience framework. Such a framework should measure whether institutions are preserving their intended protective functions during periods of recurrent alerts, rather than attempting to reconstruct classified force availability, defensive coverage or tactical engagement limits from scattered public events.
| Resilience dimension | Publicly supportable evidence | What would establish deterioration | Current assessment |
|---|---|---|---|
| Continuity of air-defence command | NATO’s permanent Air Defence architecture and documented operational activity | Officially reported failures of command continuity or validated interruption of assigned protective functions | No general degradation established. |
| Civil aviation security response | Safe completion of documented diversions and searches; ongoing traffic operations | Comparable evidence of worsening incident-handling outcomes or repeated inability to complete protective procedures | Operational burden confirmed; deterioration not demonstrated. |
| Allied interoperability | Multinational Polish response in 2025; rotating Allied air-policing missions in Romania | Official findings of repeated coordination failures or unsuccessful transitions | Operational cooperation demonstrated in the reviewed cases. |
| Maritime monitoring continuity | British maritime activity and NATO Baltic Sentry operations | Documented inability to maintain required maritime-security functions or significant unresolved service interruption | Increased activity documented; capacity failure not established. |
| Protection of railway infrastructure | Polish investigation and subsequent protection measures after 2025 sabotage | Recurrent incidents accompanied by verified failures of protective and recovery arrangements | A serious physical threat established; system-wide deterioration not demonstrated. |
| Industrial-control security | CERT-FR-confirmed refrigeration compromises and official US advisory | Repeated confirmed compromises with substantial unrecovered operational losses | Actual technical compromise established; aggregate resilience remains insufficiently measured. |
| Public warning and protection | Romanian RO-ALERT activation and national security communications | Verified failures to warn populations or protect affected communities in comparable incidents | Functioning warning responses documented in selected cases. |
| Strategic attribution and intelligence coordination | Official national investigations and NATO consultation mechanisms | Prolonged inability to reconcile linked incidents despite sufficient admissible evidence | Attribution gaps remain substantial; institutional failure cannot be inferred. |
The distinction between pressure and failure is decisive. A state can expend additional resources while successfully performing its protective mission. Indeed, increased operational activity may reflect improved surveillance, a more serious threat environment, enhanced reporting or additional deployed capabilities. Without a consistent denominator and a measurable adverse outcome, the presence of more alerts cannot establish that the defensive system is becoming ineffective. Conversely, the absence of publicly reported failures does not prove that no capacity constraints exist. A sound intelligence assessment must preserve both propositions.
Intelligence implications of the European geographical pattern
The geographical distribution of documented incidents creates different evidentiary strengths across Europe. Poland and Romania provide strong evidence of actual defensive responses to physical aerial threats. Estonia provides an official example of a Russian military-aircraft violation of national airspace, while Lithuania publishes repeated interception reports concerning the Baltic operational environment. Germany, France, Italy and the United Kingdom provide institutional descriptions of sustained national and Allied air-security arrangements, with varying levels of quantitative detail. The Baltic Sea and North Sea add established maritime-security operations, while Poland supplies a separate record of physical railway sabotage and significant internal-security reinforcement. Together, these observations establish that Europe’s security institutions are operating within an environment of sustained and diverse protective responsibilities. They do not, by themselves, establish one coordinated hostile effort to measure all those responsibilities.
For the hypothesis that civilian bomb threats are being used to test European defensive reactions, the geographical pattern offers plausibility but limited diagnostic proof. It is plausible because a warning can produce observable military or civil-security consequences, and official military sources recognize deliberate response probing in other contexts. It is insufficient because the public record has not established the technical origins of the November warnings, their relationship to existing hostile networks or any demonstrated collection of the resulting responses. An actual intelligence-testing campaign should leave some corroborating trace beyond the mere existence of institutional activity: an authenticated operational connection, a documented intent to observe responses, or independently established evidence of subsequent use. In the absence of such evidence, assigning the entire pattern to a single foreign intelligence operation would exceed the record.
Net assessment — Pillar I
The evidence establishes a serious European multi-domain security environment in which national and Allied forces are conducting persistent air, maritime and infrastructure-protection operations, and in which civilian warnings can produce real military and emergency responses. The most important supporting observations are NATO’s permanent integrated air-defence architecture, the recognized phenomenon of Russian military response probing near Baltic airspace, the multinational defensive response to Russian drone incursions in Poland, the German and British operational records from Allied deployments, the French national air-security activity figures, the Romanian air and maritime incidents, and Poland’s officially investigated railway sabotage cases.
The proposition that bomb warnings are deliberately being issued to study European defensive systems is analytically credible and merits sustained investigation. Nevertheless, no verified public evidence currently demonstrates that the November 2026 passenger-aircraft warning wave was organized specifically for military reconnaissance, nor does the record establish that European air, naval or terrestrial protection systems have suffered measurable degradation as a consequence. The distinction between these two judgments must be maintained: a plausible hostile intelligence opportunity is not a confirmed hostile intelligence operation, and visible security activity is not a reliable measure of wartime defensive capacity.
The decisive question for the next analytical stage is therefore not how an adversary could exploit particular tactical response intervals, but whether the documented warnings can be connected through admissible evidence to an organized actor, a specific strategic objective and a demonstrable pattern of deliberate observation. Until such evidence exists, the most defensible institutional approach is to preserve effective responses to individual threats, strengthen the resilience of the affected security systems and avoid drawing operational conclusions from data that measure different events, authorities and outcomes.
Pillar I assessment confidence: High for the documented institutional architecture, military responses and infrastructure incidents; moderate for the general intelligence value of observing security responses; low for attribution of the current bomb-threat campaign to a deliberate European defence-testing operation.
PILLAR II — Actors, Strategic Objectives, Competing Explanations and Institutional Response Fatigue
Testing Europe’s Defences: Intelligence Collection, Proxy Sabotage, Psychological Operations and the Strategic Preparation Hypothesis
Assessment date: 6 November 2026
Reference period: 1 January 2025 – 6 November 2026
Geographic scope: European Union, NATO Europe, United Kingdom, Italy, France, Germany, Poland, Romania, Estonia, Latvia and Lithuania, with additional consideration of the Baltic Sea, North Sea, North Atlantic, Mediterranean and Black Sea security environments.
Central intelligence judgment — Moderate confidence: There is substantial official evidence that hostile intelligence services conduct reconnaissance, sabotage, recruitment and psychological-disruption operations against European states. There is also documented evidence that such activity can include preparatory tests before more consequential operations. However, publicly available evidence has not established that the November 2026 passenger-aircraft bomb warnings form part of a coordinated programme designed to measure European military-defence performance.
The distinction is strategically consequential. The existence of deliberate testing as an established hostile-intelligence practice strengthens the plausibility of the hypothesis under examination, but identifying a general method is not equivalent to proving its employment in a particular incident. A rigorous assessment must reconstruct the evidence linking an operation’s sponsor, intermediary, immediate perpetrator, target, observable effect and intended intelligence product. Without that chain, the coincidence of several security incidents can generate an apparently persuasive but analytically unsupported theory of centralized direction.
4. Actor Assessment — From Documented Intelligence Operations to the Unresolved Aviation Campaign
4.1 The most consequential evidence: European authorities have established that hostile operations can include preparatory testing
The most important documentary development for this assessment is the 6 March 2026 Eurojust announcement concerning a multinational investigation into incendiary parcels transported through European logistics networks. Unlike a generic intelligence warning about hypothetical sabotage, the announcement describes an actual criminal investigation conducted by authorities from Germany, Lithuania, the Netherlands, Poland and the United Kingdom, with coordination from Eurojust and operational assistance from Europol. The investigation concerned incidents involving parcels that ignited during transportation in 2024, including one at Leipzig/Halle Airport before loading onto an aircraft, another in a United Kingdom warehouse and another aboard a truck in Poland. Authorities reported identifying 22 suspects in Lithuania and Poland, with criminal proceedings initiated in both countries. Eurojust stated that the suspects were believed to have acted on behalf of the Russian Federation’s military intelligence service, while emphasizing the continuing status of the judicial proceedings. Joint Investigation Team Disrupts Group Using Self-Igniting Parcels for Terrorist Attacks — Eurojust — March 2026.
A particularly significant finding is that the investigators also identified parcels suspected of being preparatory tests. Eurojust reported two such consignments sent to the United States and Canada and two additional parcels found in Amsterdam that were intended for the same destinations. The agency stated that these consignments were suspected of being test packages. This provides a concrete, official example of the suspected use of limited preliminary actions within a wider hostile operation affecting aviation-connected logistics. The case demonstrates that the concept of preparatory testing is not confined to theoretical intelligence literature. However, its evidentiary significance must be carefully defined: the documented testing concerned parcels and transport logistics, not anonymous bomb warnings designed to measure the performance of NATO fighter aircraft. Nothing in the Eurojust release establishes that the November 2026 warning messages originated from the same network. Eurojust Joint Investigation Team Findings — March 2026.
The investigation also provides evidence concerning the organizational character of modern proxy operations. Eurojust reported that alleged participants were recruited from several countries, including Russia, Latvia, Estonia, Lithuania and Ukraine, and that the organization divided activities among individuals who received instructions through an online messaging service. Payments were frequently made in cryptocurrencies. These findings describe a network in which the person carrying out an individual task did not necessarily possess full knowledge of the operation, its wider objectives or the identity of its ultimate sponsor. The distinction is essential for current aviation-threat attribution: an arrest involving the individual who sent a threatening message would not necessarily establish whether the action was self-initiated, directed by another civilian actor or commissioned through an intelligence-linked intermediary. Conversely, the nationality or political sympathies of the immediate perpetrator cannot establish the nationality of the sponsor. Eurojust Cross-Border Sabotage Investigation — March 2026.
The Polish judicial record strengthens this evidentiary foundation. On 16 January 2026, Poland’s National Prosecutor’s Office announced that five defendants had been indicted in a separate but related investigation into sabotage for Russian intelligence involving incendiary parcels distributed through commercial courier networks. According to the prosecutorial account, the investigation began in August 2024 following information supplied by Poland’s Internal Security Agency, and the January indictments concerned acts allegedly committed from June to August 2024. The prosecution included allegations involving a risk of catastrophe in aviation and described the use of concealed incendiary equipment. These remain criminal allegations subject to judicial determination, not automatically established convictions. Their significance is the existence of a detailed national prosecution supported by investigative material rather than a generalized geopolitical accusation. Indictment Concerning Sabotage Activities for Russian Intelligence — Polish National Prosecutor’s Office — January 2026.
This distinction between actual preparatory activity, demonstrated physical sabotage and unverified anonymous warnings produces three findings. First, high confidence: European investigators have identified suspected preparatory tests within a cross-border operation linked by those authorities to Russian military intelligence. Second, high confidence: the implicated security environment included aviation-connected cargo transport and international logistics, establishing that the transport sector has been a documented object of hostile operations. Third, low confidence: the same organizational apparatus is responsible for the current passenger-aircraft bomb threats. The first two conclusions provide a strong reason to investigate the third; they do not prove it.
4.2 Russian military intelligence: documented capabilities, strategic intent and attribution limits
The 2026 National Threat Assessment issued jointly by Lithuania’s State Security Department and Defence Intelligence and Security Service is exceptionally important because it provides a consolidated public intelligence assessment rather than a general political statement. The report, prepared using intelligence available before 6 February 2026, states that Russian military intelligence continues to plan and coordinate sabotage operations in Western countries despite the prevention of numerous hostile acts during preceding years. Its assessment is that the GRU has been adapting the way it conducts such operations, including its reliance on intermediaries, and seeking to reduce operational failures associated with poorly controlled proxy activity. It identifies civilian public places, transportation infrastructure, facilities associated with assistance to Ukraine and other politically consequential targets among the sectors of concern. National Threat Assessment 2026, pp. 24–27 — Lithuanian State Security Department and Defence Intelligence and Security Service — March 2026.
The Lithuanian assessment supplies a particularly relevant statement concerning strategic objectives. It argues that Russia is using comparatively limited resources to produce psychological effects, encourage distrust of public institutions and increase pressure on European governments supporting Ukraine. This is an attributed intelligence judgment by Lithuania’s competent national services, not an independent judicial determination covering every suspected operation. Nevertheless, the analysis provides a documented institutional explanation of why hostile activity against civilian services could serve broader political purposes without delivering immediate military gains. The relevant strategic effect may be public insecurity, institutional distraction, political controversy or a perception that governments cannot guarantee ordinary services. None of these effects requires the perpetrator to possess sophisticated military equipment or to penetrate a classified defence system. National Threat Assessment 2026, pp. 24–26 — Lithuanian Intelligence Services.
The 18 July 2025 European Union declaration condemning Russian hybrid activities independently provides the EU’s official political attribution framework. The declaration identifies persistent hostile activities involving sabotage, infrastructure disruption, cyberoperations and information interference, specifically referring to Russia’s military intelligence service. On 8 October 2026, the Council of the EU extended its sanctions regime against persons and organizations responsible for destabilizing Russian activities until October 2027; at that date the regime covered 80 individuals and 20 entities. These figures concern persons and entities sanctioned under the relevant EU framework. They do not represent the number of sabotage incidents, espionage operations or individuals involved in the November aviation warnings. They nevertheless establish that the EU treats Russian hybrid activity as a persistent institutional security problem and has developed a legal response intended to constrain implicated networks. Statement Condemning Russia’s Persistent Hybrid Campaigns — Council of the European Union — July 2025; Russia’s Hybrid Activities: Council Prolongs Restrictive Measures Until October 2027 — Council of the EU — October 2026.
A critical distinction must be preserved among the Russian intelligence services. The Lithuanian report describes the GRU as connected with planning and coordinating kinetic sabotage, while its examination of the FSB emphasizes recruitment and intelligence collection, including attempts to obtain information about Allied military activity through individuals travelling between Lithuania and Russia. The report identifies the movement of NATO forces, military equipment and relevant personnel among the intelligence subjects sought by Russian services. These findings establish that the collection of information about European military activity is a documented intelligence interest. They do not establish that any particular passenger-aircraft warning was authorized by the GRU, FSB or another agency. Nor is there a basis for assigning a specific covert campaign to the SVR merely because Russia’s civilian foreign intelligence service operates internationally. National Threat Assessment 2026, pp. 26–29 — Lithuanian Intelligence Services.
Actor judgment — High confidence: Russian intelligence services have demonstrated operational interest in European transport infrastructure, military-related intelligence and politically consequential disruption.
Campaign-specific judgment — Low confidence: The November 2026 passenger-aircraft bomb threats were directed by the GRU or another specific Russian intelligence service.
4.3 The critical connection between intelligence services and extremist intermediaries
One of the most important findings for the current investigation concerns the potential relationship between state intelligence organizations and extremist networks. The Lithuanian intelligence services’ 2026 assessment states that Russian military intelligence personnel have attempted to recruit European right-wing extremists for hostile operations. The report identifies a GRU operative, Yuri Sizov, as having used Russian-speaking extremist online communities while seeking individuals with contacts among extremists living in EU countries. It also assesses that during 2025 Russian or Belarusian services highly likely attempted to recruit extremists residing in Lithuania, offering financial compensation for criminal activity and intelligence gathering. The Lithuanian services explicitly identify overlap between the objectives of hostile intelligence organizations and certain extremist movements seeking to generate public fear and erode trust in democratic institutions. National Threat Assessment 2026, pp. 83–85 — Lithuanian Intelligence Services.
This is particularly relevant because some November 2026 bomb-warning messages claimed association with a movement described in contemporaneous reporting as “Male State”, a Russian-origin ultranationalist and misogynistic movement. Reuters and AFP reported that messages containing this self-description were received by several aviation-related recipients, while aviation-security specialists and investigators emphasized that the authenticity of the claimed identity was unknown. A claim embedded in a hostile message is not proof of organizational membership or state sponsorship. It can represent an actual ideological statement, a false identity, an attempt to shift suspicion toward another actor or language copied from an earlier message. New Hoax Bomb Threats Hit European Flights — AFP — November 2026; New Wave of Bomb Hoaxes Hits Dozens of Flights Across Europe — Reuters — November 2026.
The analytical consequence is significant but limited. The Lithuanian report establishes a documented mechanism by which hostile intelligence services may seek contact with extremist individuals. The aviation warnings establish that certain senders invoked an extremist identity. What is missing is a demonstrated connection between the persons who sent the warnings, the actual movement whose name was used, any intelligence-linked intermediary and a particular state sponsor. The fact that a Russian-origin ideological label appears in a threat is insufficient to complete this chain. It would be equally unjustified to dismiss the label as necessarily fabricated before the communications have been investigated.
The distinction between ideological alignment, operational recruitment, financial sponsorship, state tolerance and direct command must remain central to the assessment. An extremist may independently support a state’s geopolitical objectives; an intelligence service may encourage a movement without controlling every activity; a criminal intermediary may receive payment without knowledge of the ultimate sponsor; and a sender may simply impersonate an existing movement. These arrangements have different implications for attribution, diplomatic responsibility and the reliability of any intelligence supposedly collected through the operation.
Assessment — Moderate confidence: Extremist and criminal intermediaries are credible participants in Europe’s broader hostile-activity environment.
Assessment — Low confidence: The extremist identity invoked in the current aviation warnings reflects an authenticated connection to a state intelligence service.
4.4 The British intelligence assessment: a measurable shift toward state threats and proxy activity
The United Kingdom provides unusually direct public intelligence evidence concerning the scale and evolution of hostile state activity. In his 13 October 2026 annual threat update, MI5 Director General Sir Ken McCallum stated that the Security Service was devoting more resources to countering state threats than during the Cold War and that its state-threat caseload had quadrupled over the preceding decade. He described Russia as a principal hostile actor, discussed criminal intermediaries and characterized current hostile activity as operating below the threshold of conventional armed confrontation. He also identified the expansion of MI5’s protective-security mission as an institutional response to threats against infrastructure, businesses and the wider public. MI5 Director General’s Annual Threat Update — Security Service — October 2026.
These statements must be interpreted with their correct denominator. A fourfold increase in MI5’s caseload is not a fourfold increase in Russian sabotage incidents, and the allocation of more intelligence resources is not proof that the United Kingdom is experiencing an equivalent deterioration in national security. Changes in caseload may reflect evolving threats, expanded legal authority, better detection, institutional priorities and changes in how investigations are categorized. The data nonetheless provide substantial evidence that the competent British security service assesses hostile state activity as a major and growing operational requirement.
The same speech distinguished the activities of Russia and Iran rather than treating all proxy operations as one geopolitical phenomenon. MI5 reported that its Iran-related operations had produced more than 50 arrests in the preceding twelve months, and described a series of incidents claimed by the Islamic Movement of the Companions of the Right, which British authorities linked to Iran’s Islamic Revolutionary Guard Corps. The United Kingdom’s 2026 legal framework also provides for the designation of organizations involved in foreign state-threat activity, creating new offences concerning support to designated bodies. These developments demonstrate why a comprehensive European actor assessment cannot restrict itself to Russian intelligence. State-linked proxy violence and disruptive operations can originate from different geopolitical sponsors, even where certain operational characteristics appear similar. However, MI5’s attribution of specific attacks to Iranian networks does not establish an Iranian connection to the European aviation bomb-threat wave. MI5 Annual Threat Update — October 2026; National Security (State Threats) Act 2026: Factsheet — UK Home Office — October 2026.
The British record therefore supports a broader conclusion: the use of proxies is an established feature of the contemporary European threat environment, but proxy involvement cannot be inferred from the anonymity of an individual threat. Anonymous communication, ideological slogans and geographically dispersed incidents are compatible with proxy activity, yet also with independent actors and imitation.
4.5 Actor evidence by jurisdiction: what can actually be attributed?
| Jurisdiction | Competent public authority or evidence | Established actor-related finding | Relevance to an intelligence-testing hypothesis | Confidence regarding the current aviation warnings |
|---|---|---|---|---|
| Italy | Italian Air Force; national investigators; EU and NATO records | Documented air-security interventions and participation in Allied missions; no verified attribution of the November warnings to a specific foreign intelligence network in the examined record. | Italian aviation responses demonstrate observable protective activity, not proof of hostile intelligence collection. | Low |
| France | ANSSI/CERT-FR; French security and judicial authorities | Confirmed industrial refrigeration compromises; separate national responses to aviation warnings. | Real cyber compromise demonstrates technical interference with civilian infrastructure, but not a common operator with the aviation hoaxes. | Low |
| Germany | Federal authorities; Eurojust; European Union | Official German attribution of a separate Leipzig/Halle incident to Russia; participation in investigations of cross-border incendiary parcels. | Strong evidence of actual hostile activity involving transport infrastructure, but no demonstrated connection to the new aviation warnings. | Low |
| United Kingdom | MI5; Home Office; police and prosecution authorities | Documented Russian and Iranian proxy threats, state-threat investigations and protective-security adaptation. | Establishes credible state-linked nontraditional activity and a developed counterintelligence response. | Low |
| Poland | National Prosecutor’s Office; Internal Security Agency; Eurojust | Formal proceedings concerning suspected Russian-directed parcel sabotage and railway attacks. | Particularly strong evidence of actual hostile activity against transport infrastructure and aviation-connected logistics. | Low |
| Romania | National intelligence, defence and aviation-security authorities | Real airspace incidents and civilian flight-threat responses; no confirmed common sponsor of the November hoaxes. | Demonstrates the difference between physical military threats and anonymous aviation warnings. | Low |
| Lithuania | State Security Department; Defence Intelligence and Security Service | Detailed official assessment of GRU sabotage, FSB intelligence collection and attempted recruitment of extremists. | Strong evidentiary support for the general mechanism of hostile intelligence collection and use of intermediaries. | Low |
| Estonia | Defence Forces; national internal-security and intelligence institutions; Eurojust | Documented Russian military-aircraft incursions and alleged recruitment of regional participants in separate sabotage investigations. | Provides a relevant operational environment and judicial precedent, not direct case attribution. | Low |
| Latvia | National security services; Eurojust investigation records | Latvian nationals appeared among groups from which suspected participants in the parcel cases were recruited. | Establishes transnational recruitment geography, not Latvian state responsibility or participation in current warnings. | Low |
| European Union | Council of the EU; European Commission; Eurojust; Europol | Official Russian hybrid-threat policy, sanctions and cross-border investigative cooperation. | Provides the institutional basis for connecting authenticated cases across national borders. | No EU-wide attribution established |
Primary documentary sources: Eurojust Investigation — March 2026; Lithuanian National Threat Assessment — March 2026; MI5 Annual Threat Update — October 2026; EU Statement on the Leipzig/Halle Incident — September 2026; Polish Railway Sabotage Charges — November 2025.
4.6 Net actor assessment
The strongest actor-related evidence establishes Russian military-intelligence-linked sabotage investigations, Russian and Belarusian recruitment activity described by Lithuanian intelligence, and separate state-linked proxy operations involving Iran documented by the United Kingdom. These cases demonstrate that hostile operations against European civilian targets can be commissioned, organized across borders and executed by intermediaries who do not formally belong to a national intelligence service. The Eurojust parcel investigation is especially relevant because it includes alleged preparatory testing and activity affecting aviation-connected cargo logistics. The Lithuanian intelligence assessment is particularly consequential because it identifies the recruitment of extremists as a real concern rather than a theoretical possibility.
None of these findings establishes the sponsor of the November 2026 aircraft threats. There is no publicly established technical linkage demonstrating that the messages were sent by the same network, no verified common financial sponsor and no competent public attribution identifying the persons who directed the broader campaign. Russian state involvement is therefore a serious investigative hypothesis, but not an established conclusion. Alternative explanations involving state-tolerated groups, ideologically motivated individuals, criminal actors and copycat amplification remain viable.
Final actor judgment — High confidence: The operational mechanisms required for deniable state-linked disruption already exist in Europe and have been documented through official intelligence and judicial records.
Final campaign-attribution judgment — Low confidence: The available evidence identifies the ultimate organizer of the November 2026 aviation bomb-threat wave.
5. Strategic Objectives — What a Campaign Designed to Test European Defences Would Seek to Achieve
5.1 The fundamental distinction between operational disruption and strategic reconnaissance
A campaign involving repeated false warnings could serve several different objectives, and it would be a serious analytical error to assume that all these objectives must be present simultaneously. The most immediately demonstrable effect of an aviation bomb warning is the requirement for protective action. Airlines, airports, public authorities and, in selected circumstances, military organizations must assess a potentially catastrophic event whose probability and authenticity may initially be uncertain. The warning can therefore impose a real operational cost even when it is subsequently determined to be false. But the objective of the actor issuing the warning could range from individual malicious gratification to political intimidation, publicity, institutional disruption or organized intelligence collection. Establishing the operational effect does not establish the intention behind it.
The distinction becomes particularly important when considering the proposed objective of testing Europe’s defences before a possible future confrontation. A genuine reconnaissance operation would need to generate or acquire information that has value beyond the immediate disturbance. Yet publicly observable activities frequently offer only an incomplete picture of the institutions involved. An aircraft diversion demonstrates that a protective procedure was executed; it does not reveal all available military capabilities. A military escort demonstrates that forces responded; it does not determine the performance of those forces against a hostile military threat. A temporary interruption of an airport or railway service demonstrates the existence of precautionary procedures; it does not prove that the national transport system is incapable of maintaining essential operations during a crisis. The intelligence value of any observation therefore depends on its relationship to an identifiable collection requirement and on whether the resulting information can support a valid conclusion. The current aviation warnings have not been linked publicly to such a collection requirement.
The precedent established by the Eurojust parcel investigation is important precisely because it supplies evidence of preparatory testing within a real alleged sabotage operation. The suspected test parcels were connected by investigators to a wider criminal network and a documented series of physical incidents. That evidentiary relationship is missing from the aviation warnings. The strongest conclusion is that preoperational testing is an established phenomenon in European hostile-activity investigations, while the specific proposition that false passenger-aircraft bomb alerts constitute such testing remains unproven. Joint Investigation Team Disrupts Group Using Self-Igniting Parcels — Eurojust — March 2026.
5.2 Strategic reconnaissance and uncertainty reduction
In intelligence terms, deliberate reconnaissance would seek to reduce uncertainty about the behavior, organization or performance of a target institution. It may involve the collection of publicly available information, human intelligence, technical intelligence or observations arising from actual events. The fact that intelligence services seek information about military organizations is well established. Lithuania’s 2026 national assessment specifically identifies Russian intelligence interest in Allied military activity and describes attempts to recruit individuals capable of supplying information not otherwise available publicly. This provides strong documentary support for a general intelligence-collection motive. It does not demonstrate that an anonymous bomb warning is an effective or actually employed means of obtaining the same information. National Threat Assessment 2026, pp. 27–29 — Lithuanian Intelligence Services.
The central limitation of the defence-testing hypothesis is the difference between observable administrative behavior and actual military operational capability. An external observer may learn that a government follows a particular public security protocol, but the available information may not reveal the reserves, classified contingency arrangements, alternative communications or military decision processes that would operate under different circumstances. Moreover, normal peacetime activity is influenced by legal and safety obligations that may not apply in the same form during armed conflict. It follows that observations arising from civilian bomb warnings could have limited intelligence relevance without becoming reliable measurements of wartime defence effectiveness.
The most important analytical question is consequently whether the alleged actor sought to collect responses as an intelligence product or merely intended to create disruption. The distinction would be supported by authenticated investigative evidence linking warning activity to organized collection, analysis or reporting. Repeated warnings alone are insufficient, because the same pattern can arise from psychological intimidation or imitation.
Assessment — Moderate confidence: Observation of institutional responses is a plausible secondary benefit to an organized hostile actor.
Assessment — Low confidence: Intelligence collection was the principal purpose of the November 2026 aviation warnings.
5.3 Economic coercion and the strategic cost of precautionary security
The economic objective is more directly supported by observed effects. Modern aviation is organized around interconnected aircraft rotations, crews, passengers, airport infrastructure and scheduling commitments. A flight diverted or detained for inspection may generate consequences for the individual airline and for subsequent operations. Similarly, a vessel inspection, railway-security interruption or industrial refrigeration incident can impose direct expenditure and disrupt normal commercial activity. The effects do not require the underlying warning to be genuine. Their strategic significance arises from the requirement that responsible operators take plausible threats seriously, especially where human lives are involved.
The available evidence does not support a reliable estimate of aggregate financial losses from the November aviation warnings. There is no audited Europe-wide total covering direct airline expenditure, airport personnel, fuel, aircraft rotations, public security services and passenger-related costs. Published estimates for an individual diversion would not resolve this problem because different incidents produced different operational consequences. A threat received before departure, a threat assessed during flight and a threat resolved after landing cannot be assigned a common cost without detailed operator records. Converting the number of reported warnings into a precise financial figure would therefore manufacture a result rather than measure one.
The wider cyber evidence offers a useful quantitative comparison, provided it is not confused with bomb-threat data. The European Union Agency for Cybersecurity’s September 2026 Threat Landscape, covering incidents observed during calendar year 2025, found that 51% of recorded cases involved distributed denial-of-service attacks, while 57% of incidents were assessed as primarily ideology-driven and almost 30% as financially motivated. ENISA separately reported 4,709 hacktivist claims against EU Member States, of which more than 89% involved DDoS attacks. These are figures describing cyber incidents and hacktivist claims within ENISA’s methodology, not aviation hoaxes or verified sabotage operations. Their significance is that substantial volumes of disruptive activity can arise from actors with different motivations and can require defensive attention without necessarily causing severe physical damage. Exploring the Evolution of the Cyber Threat Landscape: How Dependencies Weaken Digital Resilience — ENISA — September 2026.
The same ENISA assessment identified public administration as the most frequently targeted sector, representing 32% of the recorded incidents, while transport accounted for 8%, business services another 8%, manufacturing 7% and finance/banking 6%. These proportions establish the relative distribution of observed cyber activity within ENISA’s dataset. They do not establish that 8% of European transport operators were attacked, that 8% of transport incidents involved aviation, or that the November bomb threats belong to the same campaigns. Nevertheless, the figures substantiate the importance of including public services and transport infrastructure in any government-level assessment of recurrent low-cost disruption. ENISA Threat Landscape 2026 — September 2026.
Assessment — High confidence: Individual threats and infrastructure intrusions can impose genuine economic and operational costs even where there is no confirmed explosive device or military attack.
Assessment — Moderate confidence: Economic disruption is a plausible objective of an organized campaign, although the available record does not establish the campaign’s intended or realized aggregate cost.
5.4 Psychological warfare and political pressure on European governments
The psychological objective is particularly relevant because it can produce political effects disproportionate to the direct operational disruption. Repeated warnings against aircraft, broadcasters or civilian facilities may generate uncertainty about whether public authorities can maintain safety and normal services. Even if the warnings ultimately prove false, the public may become aware of repeated emergency interventions, and political debate may focus on whether the government understands the threat or possesses adequate resources to respond. In a hostile information environment, such uncertainty may be amplified through misleading reporting, unsupported attribution or deliberate efforts to portray defensive action as evidence of governmental weakness.
The Lithuanian intelligence services explicitly assess that Russia uses hostile activity to undermine confidence in Western decision-making and increase public perceptions of insecurity. The European Union’s July 2025 declaration similarly identifies information interference and the disruption of public institutions within the wider Russian hybrid-threat environment. These institutional assessments provide support for the general plausibility of psychological disruption as a strategic objective. They do not establish that the current aviation warnings were directed by Moscow. National Threat Assessment 2026, pp. 24–26 — Lithuanian Intelligence Services; EU Statement Condemning Russia’s Persistent Hybrid Campaigns — Council of the EU — July 2025.
The European Commission’s 6 October 2026 report on crisis communication and democratic resilience provides an especially relevant institutional observation. Reporting on an exercise held in Brussels on 22–23 September, the Commission emphasized that contemporary hybrid threats can involve interactions among political, informational, technological and societal factors that make causation and attribution difficult to establish. The exercise addressed the risk of imposing a premature explanation on a developing crisis and the need for institutions to make sound decisions despite incomplete information. This is directly relevant to the aviation-warning wave because the political consequences of uncertainty can arise even before a perpetrator is identified. An aggressive but unsupported attribution may itself become part of the information environment being exploited. Crisis Communications Exercise: Hybrid Threats and Strengthening Democratic Resilience — European Commission — October 2026.
Assessment — Moderate confidence: Psychological intimidation and pressure on public confidence are plausible objectives of repeated threats against visible civilian services.
Assessment — High confidence: Public attribution uncertainty creates an additional information-management challenge for governments, independently of whether the original warnings constitute state-directed psychological warfare.
5.5 Strategic pressure below the threshold of armed conflict
The broader European security record supports the existence of hostile operations that states assess as falling below the threshold of conventional war while still threatening civilian safety, political stability and critical infrastructure. Russia’s military-intelligence-linked sabotage investigations, the United Kingdom’s documented concerns regarding foreign state proxies and the European Union’s hybrid-threat sanctions framework all support this conclusion. Such operations may be used to impose costs, communicate hostility or influence political decisions without overtly committing regular armed forces to a military attack.
On 13 October 2026, the MI5 Director General stated that Russian military and intelligence activity was increasingly employing hybrid methods intended to remain below the threshold that would trigger NATO’s collective-defence response. This is the British intelligence service’s attributed assessment of Russian behaviour; it is not a legal determination concerning every incident or an attribution of the November warnings. It illustrates the wider strategic context in which anonymous disruptions deserve examination. MI5 Director General’s Annual Threat Update — October 2026.
The relevant legal and military distinction is that Article 4 consultations, Article 5 collective defence, national security emergencies and civilian security responses are not interchangeable categories. A disruptive event may justify national investigation or Allied consultation without meeting the legal and political conditions for collective military action. The fact that an incident does not trigger Article 5 cannot be treated as proof that the perpetrator deliberately tested the Article 5 threshold. The actual intent requires separate evidence.
5.6 Preparation for a future crisis or conflict
The most consequential form of the proposed hypothesis is that present disruptions are intended to contribute to a future military or hybrid operation. This proposition is important because it would imply that the immediate disturbance is not the final objective. The available European intelligence record establishes that certain hostile operations have involved preparation, reconnaissance and proxy recruitment. The Eurojust parcel case contains suspected preparatory tests. Lithuania’s intelligence services describe Russian information collection relevant to Allied military activity. MI5’s public reporting describes deliberate hostile targeting of infrastructure, including attempts involving proxy personnel.
Those facts support the general possibility of preoperational activity. They do not establish a forthcoming attack, identify a planned operation or demonstrate that the November bomb-warning campaign is an element of such a plan. It would be inappropriate to derive a timetable for military escalation from the frequency of false warnings alone. The more defensible analytic approach is to distinguish preparation for an identifiable operation, which requires corroborating evidence, from general disruption that could be useful to an adversary under many circumstances.
Assessment — Low confidence: The current aircraft bomb threats constitute preparation for a specific future military operation.
Assessment — Moderate confidence: Persistent hostile activities against transport and infrastructure may contribute to a broader environment of strategic uncertainty and pressure on European security institutions.
5.7 Comparative assessment of strategic objectives
| Potential objective | Verified supporting evidence | Principal competing interpretation | Confidence in relevance to the current warnings | Evidence that would materially strengthen the judgment |
|---|---|---|---|---|
| Disruption of civilian transport | Confirmed diversions, aircraft inspections and temporary interruptions. | Publicity-seeking or malicious individual behavior can produce the same result. | High for effect; moderate for intent | Authenticated perpetrator communications establishing an intended disruptive outcome. |
| Economic coercion | Actual airline-security expenditure is unavoidable; separate refrigeration incidents produced reported commercial losses. | Economic costs may be incidental rather than an intended objective. | Moderate | Evidence that the actor selected operations specifically to impose financial losses. |
| Psychological intimidation | Threatening language, public evacuations and documented government concern. | Individual hoaxes may also seek attention or provoke anxiety. | Moderate | Verified coordinated messaging intended to influence public perception. |
| Observation of security responses | Military escorts and emergency procedures are publicly observable; intelligence services seek information on Allied activity. | Public visibility does not demonstrate intentional collection. | Low–moderate | Evidence of an organized collection requirement associated with the warnings. |
| Testing institutional resilience | Repeated events place demands on multiple security authorities. | Similarity may arise from normal response protocols or independent offenders. | Low | Authenticated evidence that the perpetrators evaluated the consequences of earlier incidents. |
| Erosion of confidence in government | Official European intelligence assessments identify this as a strategic objective of certain hostile actors. | Public anxiety may arise unintentionally from ordinary media coverage. | Moderate | Evidence linking the messages to a broader coordinated information campaign. |
| Political pressure concerning Ukraine | EU, Lithuanian and British authorities document Russian-linked activities intended to pressure Ukraine’s supporters. | Current perpetrators may be unrelated to Russia or the war. | Low for this campaign | Direct attribution and evidence connecting the activity to a geopolitical instruction. |
| Preparation for more destructive operations | Separate European sabotage cases have involved suspected preparatory tests. | No physical attack plan has been linked to the present warnings. | Low | Competent investigative findings establishing a specific preparatory relationship. |
| Copycat amplification or reputational attention | Publicity, similar warning language and a continuing sequence of threats. | Similarity could also reflect centralized direction. | Moderate | Identification of unrelated senders whose messages derive from previously publicized threats. |
Strategic net assessment
The highest-confidence conclusion concerns the operational burden imposed by the warnings. The most plausible strategic interpretations are disruption, intimidation and possible opportunistic amplification. Deliberate reconnaissance of European defensive procedures is a credible but less substantiated explanation, while preparation for a specific future military attack remains an especially consequential but weakly evidenced proposition.
No single motive should be assigned to the entire incident environment without establishing that the events themselves belong to one operation. A state-directed sabotage investigation, a politically motivated cyber campaign, an anonymous aircraft warning and a criminal hoax can coexist in the same period while being operationally independent. The purpose of the next analytical stage is to establish which explanation best accounts for the available evidence and which observations would force a revision of that judgment.
6. Analysis of Competing Hypotheses — Can the European Warning Campaign Be Attributed to a Deliberate Defence-Testing Operation?
6.1 The analytical problem: a known hostile method is not proof of a common operation
The investigation has reached a critical distinction. The public record establishes that Russian military intelligence has been implicated in European sabotage investigations, that preparatory tests have formed part of an alleged hostile parcel operation, that intelligence services collect information about Allied military activity, and that extremist or criminal intermediaries can be used in politically motivated operations. At the same time, the November aviation-warning cluster produced a range of outcomes consistent with a malicious warning campaign, while authorities had not publicly identified a common sponsor as of 6 November 2026. These facts support the investigation of possible coordinated reconnaissance. They also support competing explanations that do not require a central intelligence sponsor.
Analysis of Competing Hypotheses (ACH) should therefore emphasize evidence that discriminates among explanations, especially observations that would be difficult to reconcile with a particular hypothesis. General consistency is insufficient. Russian interest in European infrastructure is compatible with a Russian-directed campaign, but it is equally compatible with an unrelated individual issuing warnings during a period of heightened geopolitical tension. Similarly, a sender’s use of a Russian-origin extremist label is compatible with genuine ideological involvement, state-directed impersonation or deliberate copying. If one piece of evidence supports all explanations, it possesses little diagnostic value even where its political implications are substantial.
A second methodological limitation concerns the relationship among the hypotheses. State direction, ideological activity and individual imitation are not always mutually exclusive. A campaign could begin with a single organized actor, attract copycats and subsequently be amplified by unrelated networks. The purpose of ACH is not to force every event into a single explanatory category but to identify which observations are best explained by which mechanism. The present analysis therefore treats the hypotheses as competing explanations of the dominant organizing mechanism, while recognizing that particular events may have different perpetrators.
6.2 Four principal hypotheses
H1 — Coordinated state-directed hybrid operation. A foreign intelligence service or state-controlled network is responsible for a substantial portion of the aviation warnings and intends to impose disruption, generate psychological pressure or obtain information about European security responses.
H2 — State-aligned, tolerated or inspired non-state activity. Politically motivated groups operate in support of, or sympathy with, a foreign state’s objectives without necessarily receiving direct operational instructions for the individual warnings.
H3 — Independent individuals and uncoordinated copycats. The warnings originate predominantly from unrelated persons, small groups or criminal actors motivated by ideology, publicity, malice or imitation, with no overarching command structure.
H4 — Mixed campaign involving organized activity and opportunistic amplification. At least part of the initial concentration has a common origin, while additional warnings are generated by independent individuals or groups responding to publicity or exploiting the resulting atmosphere of uncertainty.
6.3 Full ACH matrix
| Evidence or observation | H1: State-directed operation | H2: State-aligned non-state actors | H3: Independent copycats | H4: Mixed campaign |
|---|---|---|---|---|
| E1. Concentrated aviation warnings across several European jurisdictions | Compatible with centralized organization, but not diagnostic. | Compatible with a shared ideological campaign. | Compatible with rapid imitation after publicity. | Compatible with an initial organized cluster and subsequent amplification. |
| E2. Similar warning language and claimed ideological identities | Could reflect coordinated messaging or impersonation. | Compatible with authentic ideological motivation. | Publicly available wording can be copied. | Different actors may repeat an initial message. |
| E3. No confirmed explosive devices in the reviewed November flight cases | Compatible with an operation intended to disrupt without causing physical destruction. | Compatible with symbolic intimidation. | Strongly compatible with malicious hoaxes. | Compatible with both organized hoaxes and imitation. |
| E4. Documented Russian-linked transport sabotage investigations | Establishes precedent and capability, but not common responsibility. | Could be consistent with a wider state-aligned environment. | Does not exclude independent offenders. | Provides contextual plausibility but no direct linkage. |
| E5. Eurojust identified suspected preparatory test parcels in a separate sabotage investigation | Establishes that testing has appeared in an alleged state-linked operation. | Does not establish direct relevance to independently acting ideological groups. | Does not exclude unrelated aviation hoaxes. | Compatible with organized preparation, but not evidence that this wave followed the same mechanism. |
| E6. Lithuanian intelligence reported attempted recruitment of European extremists | Supports the feasibility of state-directed use of intermediaries. | Supports the existence of an environment in which ideology and state objectives may overlap. | Does not demonstrate that present senders were recruited. | Supports a possible mixture, without identifying its components. |
| E7. Threats also reached public broadcasters | Compatible with a broader disruption objective. | Compatible with ideologically motivated intimidation. | Compatible with copying or unrelated threats. | Potential amplification indicator if messages are independently linked. |
| E8. No public forensic connection between aviation warnings and refrigeration compromises | Weakens an assertion that the two activities form one operational programme. | Does not exclude separate aligned groups. | Consistent with independent perpetrators. | Consistent with several unrelated or partially connected campaigns. |
| E9. Commercial aviation continued without measurable Europe-wide delay deterioration in the reviewed reporting period | Weakens claims that the campaign had already achieved network-wide disruption. | Does not exclude a symbolic objective. | Compatible with limited local hoaxes. | Compatible with a geographically dispersed but operationally contained wave. |
| E10. Authorities had not publicly identified a common perpetrator by 6 November | Leaves the central attribution requirement unsatisfied. | Leaves group identity and sponsorship unverified. | Compatible with multiple unrelated senders. | Leaves the initial-campaign component unverified. |
| E11. Official evidence of independent state-aligned hacktivists operating outside direct state control | Shows that state direction is not the only mechanism of geopolitical disruption. | Strong contextual support for the model. | Compatible with independently motivated action. | Supports coexistence of aligned and independent activity. |
| E12. Evidence of actual organized collection of aviation-response information by the warning originators | Not publicly established; would be highly diagnostic if authenticated. | Not publicly established. | An authenticated organized collection requirement would weaken a purely independent explanation. | Could establish an initiating campaign if combined with independent imitation evidence. |
Evidence base: Eurojust Joint Investigation Team — March 2026; Lithuanian National Threat Assessment 2026; NCSC Warning on State-Aligned Hacktivists — January 2026; EU Sanctions Decision — October 2026; European Aviation Bomb-Threat Reporting — Associated Press — November 2026; EU Cyber Threat Landscape — ENISA — September 2026.
6.4 Diagnostic evidence versus contextual evidence
The distinction between contextual and diagnostic evidence is particularly important for avoiding circular attribution. The Eurojust parcel investigation establishes a genuine intelligence-relevant precedent, but it does not identify the sender of an aviation warning in November 2026. The Lithuanian intelligence report establishes that hostile services seek information about military organizations and recruit intermediaries, but it does not establish that any individual warning was intended for military reconnaissance. The EU’s sanctions framework establishes a recognized Russian hybrid-threat environment, but its list of sanctioned persons and entities is not a register of perpetrators involved in the current incidents.
Conversely, a verified technical relationship among the aviation messages would have substantially greater diagnostic value. A legally established association with a known intelligence-linked intermediary would be more consequential still. Such evidence would not necessarily prove the strategic intention of testing military defences, because the same actor might instead have intended economic disruption or psychological intimidation. Attribution of the sender and determination of strategic purpose are separate analytical problems. A complete intelligence judgment would require evidence supporting both.
The same principle applies to claims of responsibility. An ideological group may claim an attack that it did not organize. A perpetrator may deliberately use another organization’s name. Genuine group membership may exist without state direction. The present record therefore does not justify treating the “Male State” references as authenticated proof of the identity, nationality or sponsor of the warning originators. New Hoax Bomb Threats Hit European Flights — AFP — November 2026.
6.5 The strongest competing explanation: state-aligned activity without direct state command
The 19 January 2026 National Cyber Security Centre warning offers especially important evidence because it explicitly distinguishes Russian-aligned hacktivism from operations conducted under direct Russian state control. The NCSC assessed that ideologically motivated groups continued targeting British public institutions and critical infrastructure with disruptive online activity, particularly denial-of-service attacks, while operating outside direct state command. The distinction means that an operation can advance a foreign state’s political interests without necessarily being ordered, financed or managed by that state. NCSC Issues Warning over Hacktivist Groups Disrupting UK Organisations — January 2026.
This model is analytically significant because geopolitical timing alone is often insufficient to establish sponsorship. An ideologically motivated group may select a target because of an event involving Ukraine, NATO or a European government, yet remain organizationally independent. A state may benefit politically from the activity without knowing its details in advance. A state-controlled information network may amplify an incident that was not originally state-directed. These mechanisms produce different forms of political alignment and cannot be collapsed into a single category of intelligence control.
The current European aviation-warning campaign could include such activity, but the evidence required to establish it is not yet available. In particular, there is no authenticated connection between the senders and the known hacktivist organizations discussed by the NCSC. Because the NCSC’s warning principally concerns cyber disruption, it cannot be treated as evidence that those groups sent physical bomb threats.
H2 assessment — Low confidence as an explanation of the current aviation warnings; high confidence that the broader operational model exists.
6.6 The individual-actor explanation: can one person produce the appearance of a multinational campaign?
The independent-actor hypothesis requires serious attention because the delivery of a false warning does not necessarily demand sophisticated resources. A person can send threats to multiple organizations, while publicity can induce others to imitate the message. The apparent geographical distribution of the affected aircraft may therefore be much wider than the geographical distribution of the perpetrators.
A warning concerning an international flight can have consequences in several countries even if it originates from one location. The aircraft may depart from one jurisdiction, cross others and land in another. The airline’s country of registration, the recipient of the warning and the military authority responding may all be different. Counting these countries as independent locations of hostile activity can exaggerate the apparent extent of an organization. The reported targeting of numerous international routes is therefore not, by itself, evidence that the perpetrators possess operational resources distributed throughout Europe.
Similarly, the existence of several warning messages does not necessarily establish several perpetrators. One sender could transmit multiple threats. Conversely, several people could copy a message after media coverage. The current evidence does not allow these possibilities to be reliably separated.
H3 assessment — Moderate confidence that independent or copycat activity is a credible component of the overall threat environment; low confidence that it accounts for every incident in the November cluster.
6.7 The mixed-campaign hypothesis: the most defensible provisional explanation
H4 currently offers the broadest fit to the available observations because it allows a common-origin cluster to coexist with later independent activity. It can explain why certain warnings appear thematically connected while others may involve different circumstances or delivery mechanisms. It is also compatible with the possibility that unrelated cyber incidents have been interpreted as part of the same wave because of their close timing.
However, the explanatory flexibility of H4 is also its central weakness. Without a verified initiating campaign, it risks becoming an unfalsifiable description of a complicated security environment. To deserve the status of a strong intelligence judgment, investigators would need to establish that at least some of the incidents were genuinely coordinated and that others originated independently. Until those relationships are identified, H4 should remain a provisional analytical model, not a definitive finding about the organization of the campaign.
6.8 Hypothesis falsification and decision consequences
| Hypothesis | Most consequential supporting development | Development that would substantially weaken it | Decision consequence |
|---|---|---|---|
| H1 — State-directed operation | Competent investigators establish a connection between the warning originators and a foreign intelligence-service tasking or command structure. | Confirmed independent origins for the principal warning cluster, without common direction. | Strengthens the basis for coordinated counterintelligence, legal and diplomatic action. |
| H2 — State-aligned non-state actors | Authenticated affiliation and operational communications establish ideological organization without direct state instructions. | Evidence of direct state control or independently acting individuals without organizational involvement. | Supports disruption of identified networks while preserving the distinction between alignment and state responsibility. |
| H3 — Independent copycats | Separate national investigations identify unrelated senders whose messages derive from publicity. | Authenticated common infrastructure and command evidence linking the main incidents. | Supports criminal enforcement and proportionate public communication without unsupported geopolitical escalation. |
| H4 — Mixed campaign | A demonstrably linked initiating cluster is followed by separately established imitation incidents. | All incidents are traced either to one organization or to wholly unrelated origins. | Requires differentiated responses to the organizing network and secondary offenders. |
6.9 ACH net judgment
Most defensible current explanation: H4, with moderate confidence as a working model. H3 remains a strong alternative for at least part of the warning environment. H1 and H2 remain plausible but insufficiently substantiated for specific attribution.
The hypothesis that an actor is deliberately testing European military responses belongs principally within H1, although it could also arise under H2 or H4. It is not a separate demonstrated fact and should not be treated as established merely because military aircraft were visibly activated.
The highest-value missing evidence concerns the authenticated origin of the messages and whether the sender or organizer had an identifiable intelligence-collection objective. Evidence about the number of fighters involved or the exact duration of an individual military response would not, by itself, resolve either question.
7. Desensitization and Response Fatigue — Is Europe Becoming Less Effective Under Recurrent Hybrid Pressure?
7.1 The distinction between producing fatigue and attempting to produce fatigue
The most consequential question in the investigation is whether repeated threats are causing protective institutions to become less effective over time. This requires distinguishing three separate propositions: the warnings impose additional work; that additional work measurably degrades protective performance; and the perpetrator intended to produce that degradation. The first proposition is supported by documented diversions, aircraft inspections, emergency responses and other operational interruptions. The second requires evidence of deteriorating outcomes under comparable conditions. The third requires evidence of perpetrator intention. They cannot be inferred automatically from one another.
An organization can experience increased workload while continuing to perform its responsibilities effectively. It may increase staffing, reallocate personnel, improve procedures or coordinate more closely with partner agencies. Such adaptations may impose economic costs but preserve or even improve response quality. Conversely, an organization can experience operational degradation without disclosing it publicly. The absence of a reported failure therefore does not prove the absence of internal strain. The correct analytical position is to measure performance independently of both the number of warnings and the presumed intentions of their originators.
The current aviation evidence provides an important initial test of the fatigue hypothesis. On 6 November 2026, Deutsche Presse-Agentur reported that EUROCONTROL had informed it that the bomb threats had not produced a measurable effect on delays across the European air traffic network. According to the same report, EUROCONTROL was aware of threats against seven flights on Tuesday, 3 November, within a network total of 26,278 flights, and fourteen flights on Thursday, 5 November, within a network total of 28,488 flights. The corresponding affected shares were approximately 0.03% and 0.05%, respectively. These figures describe EUROCONTROL’s known affected flights on those dates. They do not include every warning reported by the media, and they should not be interpreted as the total number of security communications received across Europe. Bomb Threats Had No Effect on European Flight Delays — dpa-AFX, Reporting EUROCONTROL’s Statement — November 2026.
This finding materially constrains the strongest version of the response-fatigue hypothesis. There is no demonstrated Europe-wide aviation delay deterioration arising from the measured warning activity through the period covered by EUROCONTROL’s statement. This is not equivalent to an absence of localized disruption, because individual aircraft were diverted, inspections were conducted and Warsaw-Modlin Airport experienced a temporary closure. It is also not evidence that personnel faced no additional demands. However, it directly challenges the proposition that the warnings had already imposed a measurable network-wide breakdown in normal aviation operations.
Assessment — High confidence: Individual security responses created localized operational burdens.
Assessment — Moderate confidence: The available record supports increased demands on affected organizations but does not establish a sustained degradation of their performance.
Assessment — High confidence: No public evidence reviewed establishes that the aviation warning campaign had produced a measurable Europe-wide deterioration in air traffic delays by 6 November 2026.
7.2 Three different forms of response fatigue
A serious government-level assessment should distinguish organizational fatigue, decision-quality degradation and societal desensitization. Each has different causes, measurements and consequences. Organizational fatigue concerns sustained personnel and resource demands. Decision-quality degradation concerns the accuracy and consistency of institutional judgments. Societal desensitization concerns public attitudes and compliance. A campaign could affect one without affecting the others, and evidence of additional expenditure is not sufficient to establish all three.
Organizational fatigue could manifest through greater staffing demands, additional specialist deployments, interruptions to routine work or reduced recovery time between operations. These effects should be measured using lawful, aggregate institutional records rather than inferred from public observations of military movement. The fact that France recorded hundreds of routine air-security interventions during 2025, for example, illustrates that security institutions already maintain substantial peacetime activity. It does not establish that they have insufficient capacity to handle additional warnings, because the number of interventions alone does not disclose personnel utilization, reserves, mission duration or operational outcomes.
Decision-quality degradation would be more consequential. It would involve a measurable decline in the ability to classify incidents accurately or carry out protective responsibilities consistently. Yet the present record contains no comparable official European dataset establishing that repeated aviation warnings have produced such a decline. A serious evaluation would require outcome-based performance records, independently reviewed deviations from established procedures, evidence of adverse safety consequences and suitable historical comparisons. Public descriptions of fighter escorts and emergency landings are not adequate substitutes.
Societal desensitization would require evidence that repeated warnings caused passengers, employees or communities to discount future alerts or become less willing to follow legitimate protective instructions. The public record does not contain a validated multinational survey or comparable behavioral series demonstrating such a development during the November aviation incidents. Assertions that the public must be becoming indifferent because many warnings proved false would therefore be speculative.
7.3 Comparative fatigue and resilience assessment
| Dimension | Current documented evidence | Evidence necessary to establish fatigue | Countervailing evidence or limitation | Present judgment |
|---|---|---|---|---|
| Airline operations | Diversions, aircraft inspections and temporary interruption of some services. | Consistent deterioration in operational outcomes attributable to recurring warnings. | EUROCONTROL reported no measurable network-wide delay effect during the assessed period. | Burden established; degradation unproven. |
| Airport security | Individual airports undertook searches and precautionary security procedures. | Repeated inability to complete required protective measures or maintain safe operations. | Public reports describe completed inspections and restoration of normal activity. | No demonstrated systemic failure. |
| Military air policing | Fighter escorts occurred in selected aviation-warning cases. | Official readiness or safety findings establishing deterioration caused by recurrent false alerts. | No comparative military-performance dataset is publicly available for these cases. | No defensible fatigue measurement. |
| Police and explosive-threat response | Specialist inspections and public-security measures were repeatedly required. | Comparable evidence of deteriorating response outcomes or sustained inability to meet legal obligations. | Local interventions were completed in the reviewed cases. | Additional workload plausible; degradation not established. |
| Maritime security | Persistent Allied monitoring and national maritime-security activity are documented. | Officially identified failures of required maritime-protection functions attributable to operational strain. | Increased monitoring activity can also demonstrate adaptation and preparedness. | No measurable relationship to aviation-warning fatigue. |
| Railway and infrastructure security | Poland reinforced security following actual sabotage in 2025. | Repeated unresolved incidents or verified deterioration in continuity and protection measures. | Real physical sabotage cannot be treated as equivalent to a false warning. | Serious threat established; fatigue not demonstrated. |
| Industrial refrigeration and medical logistics | Confirmed compromises and attempted interference with medical cold storage. | Recurrent service failures, loss of protected inventories or unsuccessful recovery attributable to compromised systems. | In the documented French blood-service case, alarms and staff intervention prevented blood loss. | Technical threat demonstrated; some protective measures proved effective. |
| Public confidence and compliance | Publicized warnings, government statements and media attention. | Comparable surveys or behavioral evidence establishing declining trust or alert compliance. | No validated European measurement identified for the incident wave. | Desensitization remains unproven. |
7.4 A decisive resilience counterexample: the French blood-service incident
The refrigeration case involving France’s national blood service illustrates why actual operational outcomes are more informative than the mere existence of an attack. On 5 November 2026, the FBI publicly stated that attackers had attempted to interfere with refrigeration at three French national blood-service facilities. According to the FBI’s statement, alarm systems reached the responsible personnel, staff intervened and no blood was lost. This is a documented hostile action producing a real protective response but not the potentially severe medical-logistics consequence that might have followed from unsuccessful detection or intervention. The FBI and Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems — FBI — November 2026.
The result is analytically important for two reasons. First, it establishes that attackers can interfere with a system supporting a socially critical service without necessarily achieving the intended physical consequence. Second, it demonstrates that functioning alarms, responsible personnel and established intervention arrangements can preserve the protected service despite malicious interference. The case therefore supports the importance of resilience and recovery rather than an assumption that every successful intrusion necessarily produces operational failure.
The joint advisory issued by CISA, the FBI, the US Departments of Health and Human Services, Agriculture and Transportation identified the refrigeration threat as relevant to healthcare, food, chemical operations and refrigerated transportation. The agencies recommended measures concerning access control, maintenance, system monitoring and protective configuration. Those recommendations address an independently documented technical problem. They do not establish that the attacks were organized to test military responses, nor do they identify a common operator with the aircraft warnings. US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems — CISA, FBI, HHS, USDA and DoT — November 2026.
Assessment — High confidence: The French blood-service incident demonstrates that effective detection and staff intervention can prevent serious downstream harm despite a malicious attempt to interfere with critical infrastructure.
7.5 The European Commission’s aviation-security record: monitoring compliance is not measuring combat readiness
The European Commission’s 2024 Annual Report on the Implementation of Regulation (EC) No 300/2008, published in May 2026 and transmitted to the Council in June, provides a valuable institutional baseline. It explicitly identifies hybrid threats and unlawful interference with air cargo among the security challenges facing European aviation. The Commission reported that the compliance rate identified through its aviation-security inspections had remained around 80% since 2010, while emphasizing that implementation of certain protective requirements continued to require improvement. This measure concerns compliance with inspected aviation-security standards, not the percentage of airports able to defeat an attack, not military readiness and not the success rate of bomb-threat investigations. 2024 Annual Report on the Implementation of Regulation (EC) No 300/2008 — European Commission, COM(2026) 229 final — May 2026, transmitted to the Council June 2026.
The same document reported that the European Union aviation supply-chain security database contained approximately 37,000 records at the end of 2024 and maintained 99.99% availability during that year. This is a useful example of a documented service-continuity indicator: the Commission identified a defined information system, its reference period and a measurable availability outcome. The figure does not establish the reliability of every aviation-security process, but it illustrates the type of evidence required for a meaningful operational assessment. By contrast, there is no equivalent publicly verified cross-national measurement establishing a decline in aircraft bomb-threat response performance during November 2026. European Commission Aviation Security Annual Report, Section 4.2 — May 2026.
The report further stated that more than 8,500 cyberattacks affecting aviation stakeholders worldwide were reported during 2024, citing the EUROCONTROL/EATM-CERT reporting framework. The geographical coverage and event definition must be preserved: these are worldwide aviation-sector cyber incidents, not European bomb threats, successful aviation system compromises or military air-defence events. The figure establishes the scale of a separate category of continuing digital-security pressure, while also illustrating why cyber incidents, false security warnings and actual military threats must not be combined into one operational total. European Commission Aviation Security Annual Report, Section 2.3 — May 2026.
7.6 The limits of the deliberate-desensitization hypothesis
The hypothesis that hostile actors may deliberately seek to exhaust attention or weaken public compliance has a plausible psychological mechanism. Recurrent warnings could produce habituation among individuals who repeatedly experience harmless outcomes. Additional work could also place demands on institutions whose specialist functions require training and sustained attention. Nevertheless, these possibilities do not establish that the present events have achieved such effects.
A convincing attribution of deliberate desensitization would require evidence of intent and evidence of measurable consequences. Investigators would need to establish that the perpetrator intended to change institutional or public behavior, not merely cause immediate disruption. They would also need to demonstrate that the relevant behavior actually changed. This is a substantially more demanding evidentiary requirement than proving that several anonymous warnings were sent. Neither component has been established in the available public record.
It is equally important to recognize that protective institutions can adapt to recurrent threats. A period of increased alerts may result in improved coordination, clearer responsibility, faster evidence sharing, better communications and stronger continuity planning. The relationship between alert frequency and institutional effectiveness is therefore not necessarily a monotonic decline. More warnings do not automatically produce less readiness.
7.7 Europe’s institutional response: adaptation rather than demonstrated exhaustion
The European Union has already undertaken specific institutional activities designed to improve crisis preparedness. On 19 October 2026, the Council announced EU Integrated Resolve 2026, a crisis-management exercise scheduled from 19 October through 20 November. The exercise addresses complex hybrid scenarios affecting the Union internally and externally and is intended to strengthen crisis-response coordination among EU institutions and partners. At the 6 November assessment cutoff, the exercise was ongoing. Its existence does not demonstrate that the Union has mastered every hybrid threat, but it does establish that hybrid-crisis preparedness is being addressed through an organized institutional process rather than left solely to individual national responses. EU Integrated Resolve 2026 Exercise: Enhancing EU Crisis Response Coordination — Council of the European Union — October 2026.
The Commission’s September 2026 crisis-communications exercise addressed a complementary problem: how institutions should operate when information is incomplete, attribution remains uncertain and public pressure encourages premature conclusions. This is particularly relevant to the present campaign because conflicting claims of responsibility could generate political confusion independently of the direct operational consequences. The ability to maintain a consistent, evidence-based public explanation is therefore part of strategic resilience. It reduces the risk that an institution’s response to a real incident becomes the source of additional misunderstanding or loss of trust. Crisis Communications Exercise: Hybrid Threats and Strengthening Democratic Resilience — European Commission — October 2026.
The 2026 ENISA Threat Landscape provides another structural finding: the agency assessed that several highly important sectors, including health, railway and maritime services, public administration and selected digital services, exhibited security-maturity levels below their assessed criticality. This is not a measure of the effects of November bomb threats, nor does it identify specific military vulnerabilities. Rather, it establishes that important civilian sectors require continued security improvement even without a common hostile campaign. The practical implication is that long-term resilience should be measured and strengthened on the basis of independently established sector needs, rather than waiting for definitive attribution of every individual disruptive incident. ENISA Threat Landscape 2026 — September 2026.
7.8 Forward assessment: the most plausible developments through February 2027
The immediate forecast horizon is 7 November 2026 to 5 February 2027. Given the absence of a reconciled incident series, authenticated attribution and a validated base rate for the current campaign, numerical probabilities would be unjustified. The following judgments are qualitative and conditional.
| Scenario | Forecast judgment | Supporting mechanism | Development that would change the assessment |
|---|---|---|---|
| Further isolated aviation bomb warnings | Credible near-term continuation — Moderate confidence | Recent publicity and repeated incidents establish an environment in which further malicious or imitative warnings are plausible. | Identification and disruption of principal senders, or a sustained decline in confirmed warnings. |
| Continued operationally contained responses | Reasonable working expectation — Moderate confidence | Existing procedures have allowed affected aircraft to land safely, while EUROCONTROL reported no measurable network-wide delay deterioration during the assessed period. | Official evidence of materially worse safety outcomes or sustained network disruption. |
| Additional independent copycat activity | Plausible — Moderate confidence | Repeated publicity and accessible warning channels can produce imitation without central command. | Forensic evidence showing that the majority of incidents share one controlled origin. |
| State attribution of some incidents | Possible — Low confidence | Separate European investigations demonstrate the existence of state-linked proxy networks. | Competent official attribution supported by authenticated investigative evidence. |
| Expanded intimidation against public institutions | Possible — Moderate confidence | Broadcaster threats and established European hacktivist patterns provide a plausible basis. | Confirmation that subsequent messages originate from the same organization and pursue a common objective. |
| Further refrigeration compromises | Credible — Moderate confidence | CERT-FR reported multiple compromises, and US authorities warned of ongoing global malicious activity. | Verified remediation and a sustained reduction in new confirmed incidents. |
| A demonstrated decline in European aviation-security effectiveness | Not established as a forecast consequence — Low confidence | Recurrent workload creates a theoretical risk but not proof of deterioration. | Comparable official performance data demonstrating worsening safety or operational outcomes. |
| Preparation for a specific coordinated military attack | Unsubstantiated — Low confidence | Separate sabotage operations demonstrate preparatory activity as a real phenomenon, but the present warnings lack a demonstrated operational connection. | Investigative evidence establishing a specific plan and relationship to the warning originators. |
7.9 Medium-term outlook: 2027–2031
Over the longer term, the most defensible forecast concerns the persistence of hybrid-security pressure and institutional adaptation, not an assumed progression from bomb threats to open warfare. European intelligence services have documented sustained hostile activity, the EU has developed sanctions and resilience initiatives, and national authorities have undertaken cross-border investigations. These observations support the assessment that European governments will continue to confront threats involving different combinations of cyber activity, criminal intermediaries, intimidation and infrastructure interference. The precise timing, organizational structure and intensity of such activity remain uncertain.
The principal issue for European governments is whether their protective institutions can improve the quality of coordination, sustain public confidence and preserve essential services while hostile actors alter their methods. Italy, France, Germany, the United Kingdom, Poland, Romania and the Baltic States will not face identical operational circumstances, because their national legal responsibilities, infrastructure exposure, military commitments and internal-security arrangements differ. Yet the central institutional requirement is shared: reliable identification of incidents, competent attribution, continuity of essential functions and proportionate responses based on verified threat characteristics.
The longer-term concern regarding strategic reconnaissance is that hostile services may continue seeking information about European military and civilian security institutions. This is supported by national intelligence assessments, particularly Lithuania’s 2026 report. It does not justify predicting that a specific military attack will follow the November aviation warnings or that the operational behavior observed during those warnings can reliably determine wartime outcomes. National Threat Assessment 2026 — Lithuanian Intelligence Services; MI5 Director General’s Annual Threat Update — October 2026; EU Hybrid-Threat Restrictive Measures — Council of the EU — October 2026.
7.10 Final intelligence assessment — Pillar II
The central conclusion is that a genuine hostile-intelligence infrastructure exists in Europe, but its connection to the current bomb-threat wave has not been established. Official European investigations have identified suspected Russian military-intelligence-linked sabotage networks, including activities involving preparatory test consignments. Lithuanian intelligence has documented Russian and Belarusian interest in recruiting extremists and collecting information concerning Allied military activity. British authorities have identified substantial state-threat activity and an increasing reliance on proxy organizations. European cybersecurity authorities have separately documented persistent ideologically motivated disruption and genuine compromises affecting critical infrastructure. These findings establish a serious and complex threat environment.
They do not establish one centrally organized operation connecting every aircraft bomb warning, refrigeration compromise, railway incident and maritime-security activity. Nor does the current public record demonstrate that the November 2026 aviation warnings were specifically intended to measure NATO or national military readiness. The distinction is essential because a generalized hostile operating environment can contain both coordinated attacks and unrelated incidents, while an organized adversary can exploit the political consequences of events that it did not initiate.
The decisive finding concerning response fatigue is that the warning wave has generated documented local operational burdens without demonstrated Europe-wide deterioration in aviation performance. EUROCONTROL’s reported absence of a measurable network-delay effect is significant counterevidence against claims of an already successful broad disruption of European air transport. It does not eliminate the possibility of local economic costs, specialist workload or future institutional strain.
For senior national-security decision-makers, the appropriate strategic interpretation is therefore one of credible risk, serious attribution uncertainty and a continuing requirement for evidence-based resilience. Deliberate reconnaissance of European defensive responses remains a plausible investigative hypothesis. Transforming it into a high-confidence intelligence judgment requires authenticated evidence of common origin, state-linked direction or organized collection activity. Until that evidence is available, the distinction between demonstrable operational effects and inferred hostile strategic intentions must remain explicit.
Final Pillar II confidence assessment
| Principal judgment | Confidence |
|---|---|
| European investigations have documented state-linked sabotage and suspected preparatory testing. | High |
| Hostile intelligence services have demonstrated interest in European military-related information and civilian infrastructure. | High |
| Deniable proxy activity is a documented feature of the European security environment. | High |
| Some current warnings may be connected or amplified through imitation. | Moderate |
| A foreign intelligence service directed the November aviation-warning cluster. | Low |
| The primary objective was to test European military-defence procedures. | Low |
| The threats produced localized operational and security costs. | High |
| The campaign has already caused measurable Europe-wide aviation-security degradation. | Not established |
| Further isolated threats and additional critical-infrastructure security incidents remain credible near-term possibilities. | Moderate |
| The present warnings are preparation for a specific imminent military attack. | Low |
PILLAR III — Forward Warning, Intelligence Requirements and European Strategic Resilience
Cognitive Warfare, Involuntary Defence-Response Observation and the Security of European Critical Infrastructure, 2026–2031
Assessment date: 6 November 2026
Immediate warning horizon: 7 November 2026 – 5 February 2027
Strategic horizon: 2027–2031
Geographic coverage: NATO Europe and the European Union, with individual assessments of Italy, France, Germany, the United Kingdom, Poland, Romania, Estonia, Latvia and Lithuania, together with the Baltic Sea, North Sea, North Atlantic, Mediterranean and Black Sea.
Principal intelligence judgment — High confidence: Every publicly observable emergency response creates information about how institutions function. A hostile observer may benefit from that information whether or not the original incident was deliberately organized for intelligence collection. However, such observations do not reveal the full operational capability of European military defences, and the present record does not establish that the November aviation warnings form part of a single state-directed reconnaissance programme.
Strategic consequence — Moderate confidence: Recurrent security incidents can create an intelligence externality: protective measures undertaken for legitimate safety reasons may generate information that an adversary subsequently interprets, combines with other observations or uses to refine strategic expectations. The appropriate defensive response is therefore not to reduce legitimate protective activity, but to strengthen institutional resilience, evidence handling and the governance of sensitive operational information.
8. Future Threat Environment, Indicators and Strategic Warning
8.1 The central strategic problem: security incidents can generate intelligence even without an intelligence mission
The proposition requiring the closest examination is not that every bomb threat was deliberately organized to test NATO. It is that security institutions inevitably reveal some aspects of their behavior when they respond to an incident, and that information can subsequently become relevant to hostile intelligence assessments. This is a more defensible and analytically important proposition because it does not depend on proving a common perpetrator or a shared intention among unrelated events. A warning against a commercial aircraft may have originated from an individual seeking publicity; the resulting response may nevertheless become visible to foreign observers. A disruption of refrigerated logistics may have been motivated by criminal opportunity; the affected organization’s recovery procedures and public communications may still provide information about resilience. A military aircraft operating close to Allied airspace may prompt a legitimate identification mission whose existence becomes publicly known. These are fundamentally different incidents, yet they share the characteristic that protective responses can produce observable consequences.
The effect can be described as involuntary information generation. A security institution performs a necessary action, while an external observer obtains information as a secondary consequence. This is distinct from an organized intelligence collection operation, where an actor intentionally creates or exploits circumstances to answer specific collection requirements. The distinction matters because it permits a serious assessment of the intelligence implications of the present incidents without claiming that their originators were necessarily coordinating military reconnaissance. In intelligence terms, the observable response is a potential source of information, but its reliability depends on context, the completeness of the observation and the extent to which the conditions resemble those about which an analyst seeks to draw conclusions.
The limits are considerable. Peacetime security procedures, civilian safety obligations, national legal authorities and wartime military-defence requirements are not interchangeable. A military escort of a cooperative commercial aircraft reveals that an escort occurred; it does not reveal the full capabilities, contingency arrangements or operational endurance of the defence architecture. An emergency evacuation shows that an institution applied precautionary procedures; it does not prove that its crisis-management system would fail during conflict. Similarly, repeated military activity near NATO territory can provide public evidence of continuing readiness without establishing an adversary’s ability to predict or overcome that readiness. The intelligence value of a public observation must never be confused with its ability to support a valid conclusion about military combat performance.
This distinction has direct support in NATO’s public doctrine. The 13 February 2025 Integrated Air and Missile Defence Policy explicitly identifies information sharing, situational awareness, resilient command-and-control, active defence, passive defence and civil-military coordination as essential components of Allied air and missile defence. It further recognizes that the system must function during peacetime, crisis and conflict, including under cyber and electronic-warfare pressure. The policy emphasizes adaptation, redundancy and the integration of different defensive functions. These provisions substantiate the complexity of the defensive system and explain why an individual peacetime response cannot be treated as a complete measurement of wartime capacity. NATO Integrated Air and Missile Defence Policy — NATO — February 2025.
The institutional environment has evolved further. On 15 September 2026, NATO published revised Resilience Baseline Requirements that address the simultaneous preservation of essential civilian services, government continuity and support to military operations. Unlike conventional discussions focused narrowly on weapons systems, these requirements explicitly recognize that military effectiveness depends upon civilian transport, energy, communications, medical services, food supplies and other infrastructure. The document also identifies cascading effects, hybrid threats, cyberattacks and the management of concurrent crises as fundamental planning considerations. This is particularly consequential for the present assessment: the strategic relevance of repeated civilian disruptions lies not exclusively in what can be observed about military forces, but in what they reveal about the resilience of the wider state and society. 2026 Resilience Baseline Requirements — NATO — September 2026.
8.2 Cognitive warfare: separating information collection, psychological influence and actual operational degradation
The term cognitive warfare is analytically useful only if its constituent effects are identified. In the present assessment, three processes require differentiation. The first is information acquisition, through which observers collect publicly available accounts of how institutions respond. The second is cognitive influence, through which threatening messages, uncertainty and competing narratives may affect perceptions of security, governmental competence or the credibility of institutions. The third is operational degradation, which would require evidence that the actual performance of security organizations has deteriorated. These processes can coexist, but they are not equivalent. An operation can produce media anxiety while failing to disrupt essential services. It can generate public observations while revealing little about military readiness. It can impose additional expenditure while the protective system continues to function correctly.
The most important strategic distinction concerns the credibility of the information itself. A hostile observer seeking to understand European readiness could misinterpret a legitimate diversion as evidence of military vulnerability, assign an erroneous significance to a routine fighter escort or mistake changes in public communications for changes in actual operational capability. In such circumstances, the information obtained is not necessarily useful intelligence: it may be incomplete, misleading or specific to circumstances unlikely to recur during a genuine confrontation. The public record is therefore insufficient to conclude that the recent warnings have given any adversary an accurate understanding of the limits of Europe’s air, maritime or terrestrial defences.
The cognitive consequences are nevertheless real at the institutional level. Governments must communicate threats responsibly without overstating attribution, while the public must distinguish precautionary interventions from confirmed attacks. Political actors may interpret repeated alerts as evidence of governmental weakness, even when safety procedures are working. Media circulation can cause unrelated incidents to be grouped together, increasing the apparent scale of a suspected campaign. A state or non-state propagandist may then exploit that interpretation without having organized the original events. This is opportunistic exploitation of the information environment, which is a credible mechanism even without a unified operational sponsor.
The European Union’s ProtectEU Internal Security Strategy, introduced on 1 April 2025, adopts a whole-of-society approach to terrorism, organized crime, cybercrime, hybrid threats and attacks against critical infrastructure, emphasizing stronger intelligence sharing and law-enforcement cooperation. Its significance for this assessment is that the Union formally recognizes the interaction of security, information and institutional resilience, rather than treating each disruption as an exclusively technical event. Commission Presents a European Internal Security Strategy — European Commission — April 2025.
8.3 A critical new finding: the 2026 NATO resilience requirements already address the problem of concurrent crises
The September 2026 NATO requirements provide the strongest available institutional framework for examining the possibility of multiple disruptive events during a wider security crisis. The Alliance defines resilience as the ability to prepare for, resist, respond to and recover from shocks while preserving national and collective defence functions. It distinguishes three essential responsibilities: continuity of government, continuity of essential services for the population and civilian support for military operations. It then organizes these responsibilities into seven baseline requirements. This framework moves the analysis beyond the narrower question of how individual fighters or security teams respond to alerts. It recognizes that military defence depends on the sustained functioning of an extensive civilian support environment. 2026 Resilience Baseline Requirements — NATO — September 2026.
| NATO 2026 baseline requirement | Documented institutional objective | Relevant observable security outcomes | Strategic interpretation |
|---|---|---|---|
| 1. Continuity of government | Preserve sovereign decision-making, essential governmental functions and alternative arrangements during crises. | Continuity of public administration, government communications and legally authorized decisions. | The ability to maintain legitimate authority matters independently of the number of individual security incidents. |
| 2. Resilient energy supply | Maintain energy provision, repair arrangements and cross-sector coordination during disruption. | Sustained essential services, verified restoration and effective contingency arrangements. | Energy resilience is a civil and defence requirement, not solely an industrial cybersecurity matter. |
| 3. Population movement | Manage controlled and uncontrolled movements while protecting civilians and maintaining lawful public order. | Public warning, evacuation support, continuity of basic services and humanitarian coordination. | Civilian protection must remain effective even when security conditions deteriorate. |
| 4. Food and water resources | Ensure continuity of essential supplies, including during prolonged crises. | Food safety, service continuity, preservation of critical inventories and effective recovery. | Refrigeration incidents are relevant to essential-service resilience, even without a military connection. |
| 5. Health and medical readiness | Maintain healthcare, medical supplies, pharmaceuticals, blood products and civil-military medical coordination. | Preservation of medical services, inventory integrity and response to genuine healthcare emergencies. | Medical cold-chain security has direct consequences for civilian protection and national preparedness. |
| 6. Civil communications | Maintain secure and reliable communications, public-warning systems and contingency arrangements. | Availability of public warnings, communications continuity and incident information quality. | Institutional credibility depends partly on effective communication during uncertainty. |
| 7. Civil transport systems | Preserve necessary transport services and support national and Allied requirements during crises. | Safe transport operations, continuity, restoration and cross-border coordination. | Aviation, rail and maritime security form part of a broader strategic-resilience obligation. |
Primary source: 2026 Resilience Baseline Requirements — NATO — 15 September 2026.
One of the most important implications is that a future European crisis cannot be assessed through military response indicators alone. A state may maintain a functioning air-defence command structure while experiencing serious difficulties in civilian communications, healthcare or transport. Equally, civilian services may withstand repeated disruption while the military security environment deteriorates. These situations require different evidence and different policy responses. The NATO framework therefore provides a disciplined way to examine the consequences of concurrent events without assuming that all incidents share a sponsor or that every disruption constitutes evidence of military weakness.
The September document is also significant because it recognizes the risk of cascading effects across essential services. This does not mean that every sector is equally vulnerable or that a specific disruption will necessarily spread. It means that resilience planning must account for dependencies among services that support the population and national defence. From an intelligence-assessment standpoint, cascading effects should be evaluated through documented service outcomes and authorized institutional risk assessments, not through speculative reconstruction of exploitable weak points.
8.4 Prospective threat categories: recurrence, consequence and uncertainty
The target categories requiring continuing attention are those for which the public record demonstrates actual hostile activity, recurring warnings, recognized sector-wide security concerns or officially documented preparedness requirements. This does not imply that the categories are equally likely to experience attacks, nor does it constitute a ranking of exploitable targets. Observed incident frequency, societal consequence and attribution confidence are three independent dimensions. A sector may have a high potential consequence but few verified incidents, while another may experience many low-impact warnings. Combining the dimensions into a single numerical risk score without defensible weights would create false precision.
The most probable near-term continuation, based on the present evidence, is further warning and intimidation activity against visible civilian institutions. This judgment is supported by the recent aviation cluster and the possibility of imitation, although it does not identify the original perpetrator. Separately, industrial refrigeration and related monitoring systems require continued defensive attention because CERT-FR established numerous compromises in October 2026. Railway and maritime digital services warrant a longer-term resilience focus because ENISA’s May 2026 NIS360 assessment identified a gap between sectoral criticality and cybersecurity maturity. Public administration also merits sustained attention because ENISA’s September 2026 Threat Landscape identified it as the largest category of targeted organizations in its 2025 dataset. These findings describe different bodies of evidence and should not be added into one campaign total. CERT-FR Refrigeration Controller Security Alert — ANSSI — October 2026; NIS360: Maturity and Criticality of European Critical Sectors — ENISA — May 2026; ENISA Threat Landscape 2026 — ENISA — September 2026.
| Sector or public-service category | Established evidence | Near-term warning assessment | Defensible indicators | Principal evidence limitation |
|---|---|---|---|---|
| Commercial aviation and airport security | November 2026 warnings, diversions and inspections. | Further isolated or imitative warnings are credible; moderate confidence. | Verified unique incident counts, authenticated sender relationships, safe completion of protective procedures and reported service effects. | No complete reconciled transnational warning registry or established common sponsor. |
| Maritime transport and port services | NATO maritime-security initiatives and ENISA’s documented sectoral cyber-resilience concerns. | Continued protective activity and cyber-security demands are credible; moderate confidence. | Confirmed incidents, operational continuity and authorized cross-border incident-sharing outcomes. | Maritime surveillance activity is not equivalent to a confirmed attack. |
| Rail transport | Official Polish sabotage investigations and ENISA’s sectoral maturity findings. | Persistent security concern; moderate confidence. | Verified criminal incidents, service restoration, audit findings and remedial progress. | National experiences cannot be generalized across all European railway operators. |
| Energy supply and utilities | Confirmed Polish energy-sector cyberattacks in December 2025 and subsequent government reporting. | Continuing cyber-resilience concern; moderate confidence. | Confirmed malicious activity, successful continuity measures and independently verified recovery. | No demonstrated operational link to November aviation warnings. |
| Medical logistics and refrigerated supplies | Official refrigeration security alerts and reported attempts to interfere with blood-service cold storage. | Continued defensive concern; moderate confidence. | Confirmed incidents, functioning alarms, preservation of medical inventories and restoration outcomes. | Attack attempts and successful service damage must be distinguished. |
| Food distribution and refrigeration | CERT-FR-confirmed compromises and reported retailer disruption. | Further incidents are plausible; moderate confidence. | Confirmed technical compromises, product-safety outcomes and completion of verified protective measures. | Actual losses are not captured in a comparable Europe-wide financial series. |
| Government institutions and public communications | ENISA’s finding that public administration accounted for 32% of targeted organizations in its 2025 cyber dataset. | Persistent cyber and intimidation pressure; moderate confidence. | Authenticated threats, continuity of public services and quality of crisis communication. | Cyber incident proportions cannot predict bomb-threat frequency. |
| Telecommunications and digital services | Recognized importance under NATO resilience requirements and EU cyber legislation. | Structural preparedness concern; moderate confidence. | Service continuity, verified incident reporting and independently audited resilience improvements. | No evidence that the present bomb warnings are linked to telecommunications attacks. |
| Government and military-support logistics | NATO’s revised resilience requirements identify civilian support to military operations as an essential function. | Persistent strategic preparedness requirement; high confidence. | Aggregate, non-sensitive evidence of continuity planning, cross-border cooperation and successful exercises. | Public observations cannot establish classified operational capability or readiness thresholds. |
The table deliberately distinguishes an established security requirement from a prediction of hostile action. A sector appearing in NATO’s preparedness framework is not necessarily the most likely target of an adversary. Similarly, a sector identified by ENISA as having a maturity gap is not necessarily experiencing the largest number of successful compromises. The proper intelligence function is to examine verified risk information while protecting the distinction between what has happened, what could happen and what is merely conceivable.
8.5 ENISA provides a more nuanced risk picture than a simple vulnerability ranking
A particularly important update comes from the 28 May 2026 ENISA NIS360 assessment. ENISA identifies a group of critical sectors in which maturity remains comparatively low relative to their criticality, including healthcare, railway, maritime transport, public administration, space, ICT management services, drinking water and wastewater. The agency also reports that the maturity of several sectors has improved, with aviation, trust services and financial-market infrastructure moving into the high-maturity category. This finding directly challenges the assumption that Europe’s aviation sector is becoming progressively less capable simply because it is receiving repeated warnings. The underlying NIS360 assessment concerns cybersecurity maturity rather than physical bomb-threat response, but it provides independently documented evidence of institutional improvement in a closely related security domain. NIS360: The Bigger Picture on Maturity and Criticality — ENISA — 28 May 2026.
The distinction matters because criticality and maturity measure different characteristics. High criticality means that the disruption of a service could have important societal or economic consequences. Lower maturity means that the sector’s assessed cybersecurity governance and protective arrangements have not reached the same comparative level. Neither condition independently establishes that a particular hostile group can compromise the sector. ENISA’s methodology evaluates legislation, institutional capability, company preparedness and sectoral coordination across an entire ecosystem. These are broader and more credible indicators than assumptions derived from one public incident.
In the same 2026 assessment, ENISA reported that the railway sector’s assessed criticality had increased partly because of its importance to military logistics. This is a significant institutional recognition of the relationship between civilian transport and collective defence. However, it is not evidence that the European railway system has already been compromised as part of a single campaign. The appropriate strategic conclusion is that transportation resilience must be considered in both civilian and defence planning, with the relevant assessments performed by competent public authorities and operators. ENISA NIS360 Sectoral Assessment — May 2026.
8.6 The most credible warning indicators are changes in consequences, not simply increases in threat messages
A warning system should distinguish frequency indicators, severity indicators, attribution indicators and resilience indicators. Frequency measures how many relevant events occur. Severity measures what those events actually cause. Attribution measures whether investigators can connect incidents to identifiable actors or organizations. Resilience measures whether institutions preserve their required functions despite disruption. These variables can change in opposite directions. An increase in observed threats accompanied by declining incident severity may indicate improving detection and prevention. A decline in reported threats accompanied by more severe consequences may indicate a worsening operational environment. Treating all four variables as one measure would obscure precisely the developments decision-makers need to understand.
| Indicator class | Observation raising strategic concern | Observation reducing concern | Required evidentiary standard |
|---|---|---|---|
| Incident recurrence | An independently verified, comparable increase in unique threats over a defined period. | A sustained decline measured with unchanged reporting definitions. | Reconciled national and sector incident registers. |
| Operational consequence | Verified deterioration in safety outcomes or continuity of essential services. | Continued safe outcomes and documented restoration despite recurrent threats. | Competent operator or regulator reports. |
| Forensic coordination | Authenticated links among perpetrators, communications or operational networks. | Independent investigations establishing unrelated origins. | Criminal investigative findings and technically validated evidence. |
| State involvement | Competent official attribution supported by evidence of sponsorship or direction. | Credible investigations excluding the alleged connection. | Judicial, intelligence or governmental attribution with a clear scope. |
| Information manipulation | Verified coordinated efforts to exploit incidents through deceptive claims. | Independent reporting and timely correction of false narratives. | Authenticated information-operation evidence. |
| Institutional fatigue | Measurable worsening of comparable protective outcomes associated with recurring workload. | Stable or improving outcomes despite increased alerts. | Longitudinal safety and operational-performance records. |
| Infrastructure resilience | Recurrent confirmed service failures and unresolved adverse audit findings. | Completed corrective measures and demonstrated continuity. | Regulatory audits, operator records and competent authority validation. |
| Cross-border cooperation | Officially documented failures of necessary incident coordination. | Successful exercises, evidence exchange and coordinated recovery. | EU, NATO and national after-action assessments. |
The most consequential warning indicator for the central intelligence hypothesis remains authenticated evidence of organized collection connected to the warning originators. Without that relationship, the observation that European institutions are responding to repeated threats remains insufficient to prove a deliberate reconnaissance campaign. Conversely, the presence of such evidence would justify a substantial revision even if the operational consequences of the warnings remained limited.
8.7 Italy — A measurable distinction between rising hostile activity and improving containment
Italy provides a particularly valuable counterpoint to the assumption that increasing hostile activity necessarily produces greater institutional degradation. The 2025 Annual Report of the Agenzia per la Cybersicurezza Nazionale (ACN), transmitted to the Italian Parliament on 19 May 2026, records 2,729 cyber events handled by CSIRT Italia during 2025, compared with 1,979 in 2024, representing an increase of approximately 38%. Yet the number of events classified as incidents with confirmed impact rose from 573 to 615, an increase of approximately 7%. The distinction is fundamental: the greater volume of observed malicious activity was not accompanied by a proportional increase in verified harmful outcomes. ACN attributes part of that divergence to preventive warning and mitigation measures. The report therefore supplies an official example of a security institution reporting increased threat exposure while documenting a more limited increase in confirmed operational consequences. Relazione sull’attività svolta dall’Agenzia per la Cybersicurezza Nazionale, 2025, pp. 22–24 — Camera dei Deputati — May 2026.
The Italian figures become more significant when examined at the level of institutional activity. ACN reported 3,907 victim records, of which 1,901 concerned unique victims, 661 incident notifications, 55 direct support interventions, 46,867 targeted warning communications, and the sharing of more than 800,000 indicators of compromise during 2025. It also reported monitoring 126 ransomware actors, 191 hacktivist actors and 25 advanced persistent threat campaigns. These figures measure separate operational categories. The 3,907 victim records do not mean 3,907 distinct organizations suffered confirmed incidents; the 1,901 unique victims are organizations or subjects affected by at least one cyber event handled by CSIRT Italia. Warning communications do not represent confirmed successful attacks, and monitored threat actors cannot be interpreted as individuals arrested or formally attributed to foreign intelligence services. Their collective relevance is that Italy has developed an extensive mechanism for identifying, classifying, communicating and mitigating cyber threats, with publicly available quantitative indicators. Relazione annuale ACN 2025, p. 22 — Camera dei Deputati — May 2026.
The most directly relevant Italian finding concerns denial-of-service campaigns associated with pro-Russian hacktivism. ACN reported that these activities repeatedly affected public administration, telecommunications and transport organizations, often with a cyclical and coordinated character. Nevertheless, the agency recorded a decline in the proportion of DDoS attacks producing measurable effects, from approximately 15% in 2024 to less than 11% in 2025. This is a particularly important result for the broader argument about cognitive and operational warfare. A large number of hostile actions may create the appearance of escalating pressure, while the proportion causing measurable effects declines. The two developments are compatible: attackers may intensify their activity while defenders improve containment. Accordingly, the mere growth of a warning campaign cannot establish that European security institutions are losing effectiveness. Relazione annuale ACN 2025, p. 29 — Camera dei Deputati — May 2026.
ACN also reported that 60 of the 82 measures in Italy’s National Cybersecurity Strategy implementation plan had been completed by the end of 2025, while 22 remained in progress. This is a reported implementation status, not evidence that Italy has completed 73% of every cybersecurity capability required for national defence. Some measures may differ substantially in scope, cost, effectiveness or operational importance. The figure is nevertheless valuable as an auditable policy implementation indicator. It shows how a serious resilience assessment can compare government commitments with recorded progress rather than deriving capability judgments from individual security incidents. Relazione annuale ACN 2025, Section 8, p. 112 — Camera dei Deputati — May 2026.
Italy — Strategic warning judgment: High confidence that the country faces recurring cyber disruption and has recorded improved containment of certain threat categories; moderate confidence that continued integration of public-sector security, transport resilience and national crisis management will be important through 2031; low confidence that current aviation bomb threats establish a measurable deterioration in Italian military readiness.
8.8 France — Evidence of persistent threats, attribution ambiguity and a more explicit national resilience doctrine
France provides unusually detailed evidence of how cyber incidents can increase institutional uncertainty without necessarily producing confirmed damage in every case. ANSSI’s Panorama de la cybermenace 2025, published on 11 March 2026, reported that the agency handled 3,586 security events during 2025, an 18% decline compared with 2024. The agency explained that the preceding year had included an exceptional level of reporting associated with the Paris Olympic and Paralympic Games. Consequently, the year-on-year decrease does not demonstrate that the underlying threat had diminished proportionally. ANSSI explicitly warned against that interpretation and emphasized that both state and criminal actors continued targeting a broad range of French organizations. Panorama de la cybermenace 2025 — ANSSI — March 2026.
ANSSI’s assessment is particularly relevant to attribution. The agency observed that distinctions between state-linked cyber activity and ordinary cybercrime were becoming less reliable because actors increasingly shared tools, adopted similar techniques and specialized in particular stages of malicious operations. This finding weakens simplistic attribution methods based on the presence of a familiar technical tool, apparent sophistication or claimed ideological identity. It also supports a broader interpretation of cognitive conflict: an attacker need not create a successful military operation to complicate the defensive institution’s understanding of the threat environment. However, the fact that attribution is difficult does not establish that a particular actor is deliberately creating ambiguity. The ambiguity may be a natural consequence of overlapping criminal and state-linked methods. CERT-FR Cyber Threat Overview 2025 — ANSSI — March 2026.
France’s policy response has become increasingly explicit. The 2025 National Strategic Review, published by the Secretariat-General for Defence and National Security on 14 July 2025, addressed the deteriorating international security environment and the need to strengthen national defence and resilience. On 13 July 2026, the SGDSN published decisions arising from the July interministerial national resilience meeting, including priorities for securing supplies of vital goods and planning a major electricity-blackout exercise. These measures concern the continuity of national life under serious disruption; their existence does not establish that France has experienced a successful national blackout attack. They provide evidence of government recognition that resilience must extend beyond conventional military protection to include civilian supplies, infrastructure and emergency coordination. Revue nationale stratégique 2025 — SGDSN — July 2025; Renforcer la résilience du pays face à l’amplification des risques et des menaces — SGDSN — July 2026.
France — Strategic warning judgment: High confidence that French authorities recognize persistent cyber, hybrid and critical-infrastructure risks; moderate confidence that continuity planning and industrial-control protection will remain major preparedness priorities; low confidence that repeated bomb threats have yielded an adversary reliable information about France’s wartime military-defence capability.
8.9 Germany — Physical critical-infrastructure resilience and the importance of regulatory implementation
Germany’s principal new development is the KRITIS-Dachgesetz, which the federal government states entered into force on 17 March 2026. The law provides a national framework for the resilience of critical infrastructure, including essential services in energy, transport, healthcare, water and other sectors. It establishes sector-spanning requirements and provisions concerning the identification of critical infrastructure, protection, risk assessment and incident reporting. The German government emphasizes that the purpose is to maintain essential services even when incidents occur. This is relevant because security against hostile disruption cannot be evaluated solely through the number of interceptors, police personnel or emergency vehicles deployed: it also depends upon whether civilian operators preserve the services for which they are responsible. Stärkerer Schutz kritischer Infrastrukturen: KRITIS-Dachgesetz — German Federal Government — September 2026.
The distinction between enactment and implementation is particularly important. A legislative requirement creates obligations and supervisory authority; it does not demonstrate that every affected operator has already implemented an effective resilience programme. The federal government reported that certain detailed regulatory provisions remained under development during September 2026, while discussions concerning possible additional arrangements for counter-drone protection were continuing. These are examples of policy processes whose completion cannot be inferred from public announcements. A credible German resilience assessment through 2031 should therefore examine whether implementation, supervision and independent performance evaluation are producing measurable improvements, rather than treating the passage of legislation as synonymous with operational success. Federal Government Press Conference, 7 September 2026 — Bundesregierung.
Germany’s significance extends to European coordination because its infrastructure services operate within transnational transport, industrial, communications and energy systems. A serious disruption in one member state may have effects in another without constituting a military attack against both. The EU Critical Infrastructure Blueprint, discussed below, provides an institutional framework for addressing such cross-border consequences. For Germany, the relevant strategic requirement is not merely maintaining individual facility protection but establishing reliable cooperation among federal authorities, Länder, private operators and European partners.
Germany — Strategic warning judgment: High confidence that the country has established a more comprehensive statutory framework for critical-infrastructure resilience; moderate confidence that effective implementation and cross-border coordination will be decisive to the framework’s operational value; low confidence that the present aviation warnings demonstrate a failure of German defence arrangements.
8.10 United Kingdom — A dynamic national-risk framework rather than a static threat inventory
The United Kingdom published its National Risk Register 2026 on 14 July 2026, replacing the earlier 2025 edition. The Cabinet Office describes the register as the public version of the National Security Risk Assessment, incorporating a more dynamic approach under which risks are reassessed more regularly. Its intended audience includes government, businesses and resilience practitioners. This is important because a rapidly evolving hybrid-threat environment cannot be evaluated solely by annual counts of incidents or a fixed list of possible hazards. A credible warning architecture must be able to incorporate new evidence, revise assumptions and distinguish a change in actual risk from a change in reporting or institutional awareness. National Risk Register 2026 — UK Cabinet Office — July 2026, updated August 2026.
The United Kingdom’s relevance to the present assessment is also institutional. As a NATO member outside the European Union, it participates in Allied defence and bilateral intelligence cooperation but is not automatically subject to the same EU legislative and regulatory framework as EU Member States. This matters for the exchange of cyber incidents, transport-security information and critical-infrastructure resilience assessments. Cross-border cooperation may be strong without every institution relying on the same legal reporting duties. Accordingly, a European resilience assessment that treats the United Kingdom as if it were bound by all EU critical-infrastructure directives would misstate the underlying governance arrangements. The correct approach is to identify the applicable national legal authority and relevant cooperation mechanisms separately.
United Kingdom — Strategic warning judgment: High confidence that the UK has adopted a public framework for dynamically reassessing major national risks; moderate confidence that sustained cooperation with NATO and European partners will remain central to multi-domain crisis management; low confidence that the November aircraft warnings reveal an identifiable British wartime defensive limitation.
8.11 Poland — The strongest newly verified evidence of actual institutional deficiencies
Poland provides the most significant newly verified evidence of deficiencies in the reviewed period, and it must be distinguished carefully from the broader hypothesis concerning bomb threats. On 27 August 2026, Poland’s Supreme Audit Office, Najwyższa Izba Kontroli (NIK), published findings from an audit of eight essential-service operators active in power supply, drinking water, rail transport and water transport. The audited activities covered the 2021–2025 period. NIK found that the measures taken by all eight operators were inadequate for the contemporary threat environment and criticized the supervisory activity of the relevant ministries. Most importantly, the authority reported that six of the eight operators had systematically ignored critical alerts generated by security-monitoring systems, while some lacked adequate monitoring altogether. These are competent official audit findings, not speculative judgments based on external observations. Transport, Energy, and Drinking Water Supplies Are Inadequately Protected against Cyberattacks — Polish Supreme Audit Office — August 2026.
The finding has considerable analytical significance, but its exact scope must be preserved. The result does not establish that six out of every eight Polish critical-infrastructure operators ignore alerts, because the audit examined a defined sample, not the entire national population. It does not establish that the ignored alerts resulted from the November 2026 bomb-warning campaign, because the audited period ended in 2025. Nor does it demonstrate that Polish air-defence personnel were desensitized. It does, however, establish a documented failure to act consistently on critical alerts within the audited civilian infrastructure organizations, which is directly relevant to the broader institutional question of how recurring security signals are handled. It is a stronger evidentiary basis for discussing response-management deficiencies than an unsupported inference from the volume of anonymous threats.
NIK additionally reported that Polish national-level incident-response teams handled nearly 273,000 cybersecurity incidents during 2025, an increase of 144.4% compared with the previous year. The reported category includes a broad range of cybersecurity events and incidents under the Polish reporting framework; it does not measure successful attacks against critical infrastructure alone. It would therefore be improper to infer that 273,000 serious infrastructure compromises occurred, or to compare the national total directly with the narrower categories recorded by Italian or French cybersecurity authorities. Nevertheless, NIK’s findings demonstrate that the monitoring and supervisory burden is substantial and that the effectiveness of institutional procedures must be evaluated independently of incident volume. Polish Supreme Audit Office Cybersecurity Audit — August 2026.
Poland also provides evidence of successful prevention of serious consequences. According to a 15 January 2026 statement from the Prime Minister’s Chancellery, cyberattacks occurred on 29–30 December 2025 against energy infrastructure, including two combined heat-and-power plants and systems associated with the management of renewable electricity production. The government stated that the attacks had been contained and had not caused a blackout or other negative consequences. The account is an official governmental description of a real event; it must not be interpreted as proof that the entire Polish energy system possesses uniform resilience, especially given the subsequent NIK audit findings. Together, the two records demonstrate that specific hostile incidents can be successfully contained even while independent regulatory oversight identifies significant deficiencies elsewhere. Poland Stops Cyberattacks on Energy Infrastructure — Chancellery of the Prime Minister — January 2026.
Poland responded legislatively and strategically during 2026. On 10 March, the Council of Ministers adopted a new Cybersecurity Strategy for 2026–2029, emphasizing the national cybersecurity system, incident-response capability, public-private cooperation and stronger protection of public and private information systems. The decision subsequently entered into force on 24 March 2026, according to the Polish legal register. This provides a specific future implementation period against which official progress can be evaluated. Cybersecurity Strategy of the Republic of Poland 2026–2029 — Polish Ministry of Digital Affairs — March 2026; Resolution No. 92 of the Council of Ministers — Polish Official Legal Register — March 2026.
Poland — Strategic warning judgment: High confidence that serious cybersecurity governance deficiencies existed in the eight audited essential-service operators during 2021–2025; high confidence that separate energy-sector cyberattacks were contained without the blackout feared by authorities; moderate confidence that implementation and enforcement of the 2026–2029 strategy will be consequential for future resilience; low confidence that the bomb-threat campaign was designed to exploit the documented audit deficiencies.
8.12 Romania — A model for separating military air defence from national infrastructure protection
Romania’s strategic relevance lies in its dual responsibilities: national and Allied military defence in the Black Sea environment, and the protection of civilian infrastructure and public services through competent national authorities. A national warning concerning an aerial object can involve military surveillance and civilian emergency communications, while a cyber incident against an infrastructure operator can require an entirely different technical and legal response. The existence of these parallel responsibilities creates a genuine need for coordination, but it does not mean that the same organization commands every aspect of national security.
The Romanian Ministry of Internal Affairs identifies the National Coordination Centre for Critical Infrastructure Protection as the coordinating authority for critical-infrastructure protection and the resilience of critical entities. Its published framework refers to Law No. 294/2024, which transposes the EU Critical Entities Resilience Directive into Romanian law. This is a concrete legal basis for examining the country’s civilian resilience arrangements separately from military air-policing activity. The appropriate evidence concerns implementation of the relevant legal duties, continuity planning and protection of essential services, rather than extrapolating from individual fighter responses to the performance of all national infrastructure. National Coordination Centre for Critical Infrastructure Protection — Romanian Ministry of Internal Affairs.
Romania’s maritime and air security also intersects with broader EU preparedness requirements. The Black Sea environment includes civilian shipping and commercial services whose protection may require cooperation among military and civil authorities. Yet the evidence reviewed does not establish that suspicious aerial objects, civilian bomb threats and cyber incidents are parts of one intelligence collection programme. Romania — Strategic warning judgment: High confidence that the national legal and institutional framework recognizes critical-entity resilience as a separate function from military air defence; moderate confidence that cross-domain coordination will remain strategically important; low confidence that current civilian warnings establish an adversary’s knowledge of Romanian wartime defensive capacity.
8.13 Estonia, Latvia and Lithuania — Baltic resilience as a whole-of-society and multinational requirement
The Baltic States provide a distinctive strategic context because their national institutions must combine domestic service continuity with regional cooperation and NATO collective-defence responsibilities. However, each country’s legal and technological arrangements differ. The most useful evidence for the present pillar concerns measurable resilience outcomes, cyber incident reporting and the implementation of national security frameworks, rather than repeating the earlier air-interception chronology.
Estonia provides valuable evidence of public-sector digital dependency. On 4 February 2026, the Estonian Information System Authority, RIA, reported that 10,185 cyber incidents had been registered during 2025, with fraud, phishing and malicious redirects accounting for much of the total. The agency’s annual review also describes digital service interruptions and the importance of reliable public infrastructure. These are official national cybersecurity records, not evidence of 10,185 successful foreign intelligence operations or military attacks. Their relevance lies in demonstrating that an advanced digital public-service environment requires continuous cyber incident management across a substantial range of threat and failure categories. Cyber Security in Estonia: New Records, Old Mistakes — Estonian Information System Authority — February 2026; Cyber Security in Estonia 2026 — RIA.
Estonia’s published assessment is particularly useful because it also identifies significant service interruptions caused by maintenance or technical faults. Such cases are an important analytical control: the interruption of a digitally dependent public service is not automatically evidence of malicious action. A credible intelligence system must distinguish hostile interference from accidental failures, administrative error and routine maintenance incidents. Without that distinction, a national security assessment may systematically overestimate the activity of hostile actors while failing to identify genuine reliability problems. The fact that a failure can generate the same visible public consequence as an attack makes forensic causation essential. Cyber Security in Estonia 2026 — Estonian Information System Authority.
Latvia has established a national cybersecurity framework that integrates government policy, critical information infrastructure and wider societal resilience. Its National Cyber Security Law, in force since 1 September 2024, implements requirements associated with the EU NIS2 framework. The Latvian Ministry of Defence identifies the National Cyber Security Centre, operating with CERT.LV, as a central element of the national governance system, while the Constitutional Protection Bureau has specific responsibilities relating to critical ICT infrastructure. Public and private organizations covered by the law are subject to registration, cybersecurity governance and risk-management obligations. The law required covered organizations to register by 1 April 2025 and appoint cybersecurity managers and submit initial self-assessments by 1 October 2025. These are statutory obligations, not evidence that every organization fulfilled them. Cybersecurity Governance and National Cyber Security Law — Latvian Ministry of Defence.
Lithuania provides a more intelligence-oriented evidence base. The country’s published 2026 National Threat Assessment identifies ongoing Russian military-intelligence interest in sabotage and information collection, including activity involving military and civilian infrastructure. Its relevance to the present pillar is the documented need for counterintelligence and critical-infrastructure resilience within a region of sustained security tension. However, an intelligence service’s assessment of hostile intent and operational interest must not be converted into an assertion that every unexplained infrastructure incident has the same sponsor. The strategic warning function is to identify corroborating evidence of actual hostile activity while maintaining alternative explanations for individual events. National Threat Assessment 2026 — Lithuanian State Security Department and Defence Intelligence and Security Service — March 2026.
The three Baltic countries consequently illustrate complementary requirements. Estonia provides a relatively transparent public account of digital service incidents and cyber risk; Latvia provides a legally defined national cybersecurity-governance system; Lithuania supplies a detailed public intelligence assessment of hostile state activity. These sources are not directly comparable numerical datasets, and they should not be used to rank national defensive effectiveness without a common methodology.
Baltic regional judgment — High confidence: All three countries possess formal security and resilience institutions operating in a consequential Allied environment; moderate confidence that regional cooperation and continued regulatory implementation will be central to future resilience; low confidence that the current bomb-warning cluster provides reliable evidence of weaknesses in Baltic wartime defence.
8.14 Europe’s emerging strategic response: exercise results, not hypothetical capacity
One of the strongest examples of European preparation for concurrent disruptions occurred on 10–11 June 2026, when ENISA conducted Cyber Europe 2026, a two-day exercise focused on the resilience of railway and maritime transport. ENISA reported collaboration with more than 100 cybersecurity experts and participation by more than 5,000 individuals from public and private organizations. The exercise simulated a large-scale crisis affecting interconnected European transportation systems and required cooperation across technical, operational and political levels. These were simulated incidents, not actual attacks. Their relevance is that European authorities are already examining the institutional problems associated with concurrent transport disruption and fragmented information, rather than assuming that a single organization’s cybersecurity procedures are sufficient. Cyber Europe 2026: All Eyes on the EU’s Collective Response and Resilience — ENISA — June 2026.
The exercise also provides a relevant methodological distinction. A controlled simulation is capable of examining assumptions and coordination arrangements without exposing the public to genuine danger. A real malicious warning, by contrast, produces an uncontrolled situation in which the authorities must prioritize safety while investigators determine the warning’s authenticity. The two can generate information about institutions, but the evidence has different provenance and validity. Government exercises can establish whether planned procedures operate as intended within a defined scenario; a real-world incident establishes what happened under its particular circumstances. Neither necessarily provides a complete forecast of institutional performance in armed conflict.
At the EU political level, EU Integrated Resolve 2026 began on 19 October 2026 and was scheduled to continue until 20 November 2026. As of the assessment cutoff, the exercise was in progress. The Council of the EU describes its purpose as strengthening response coordination under complex hybrid-crisis scenarios involving developments inside and outside the Union. The exercise therefore cannot yet be described as having demonstrated successful performance or generated completed findings. Its existence nevertheless provides concrete evidence that the EU is treating multi-domain crises as a current institutional preparedness requirement. EU Integrated Resolve 2026: Enhancing EU Crisis Response Coordination — Council of the European Union — October 2026.
These developments materially qualify a purely pessimistic assessment of European preparedness. The available official record contains evidence of identified deficiencies, but also evidence of regulatory reform, operational exercises, multinational coordination and improved protective outcomes. The future security environment should therefore be assessed as a contest between evolving threats and adaptive institutions, not as an inevitable progression toward systemic exhaustion.
8.15 Scenarios for 2027–2031: qualitative forecasting without unsupported probabilities
The longer-term outlook must account for the uncertainty surrounding the origin of the November warnings, the documented existence of other hostile operations and the capacity of European governments to improve their protective systems. Numerical probabilities cannot be justified because no validated base rate establishes how often anonymous aviation warnings become elements of larger coordinated military or intelligence operations. The scenarios below are therefore conditional pathways, not mutually exclusive predictions or forecasts derived from fabricated statistical models.
| Scenario | Strategic development | Evidentiary basis | Implications for Europe | Indicators changing the judgment |
|---|---|---|---|---|
| A — Persistent disruption with improving resilience | European institutions continue facing cyber incidents, hoaxes and localized interference but progressively improve protection and recovery. | Italian ACN containment figures, ENISA maturity improvements and EU/NATO resilience initiatives. | More expenditure on security and continuity, potentially accompanied by lower realized impact per comparable incident. | Officially documented reductions in verified harm and improvements in continuity measures. |
| B — Chronic psychological pressure without major physical escalation | Recurrent threats and hostile claims continue to create uncertainty, while essential services generally remain operational. | The warning environment, established hacktivist activity and official concern about information manipulation. | Continuing political communication challenges, security workload and reputational pressure. | Authenticated repeat campaigns, public-confidence measurements and incident outcome records. |
| C — Increased physical sabotage and infrastructure interference | A larger share of documented incidents involves actual physical damage or malicious system compromise. | Separate European sabotage investigations and confirmed industrial-control incidents. | Greater requirements for physical protection, recovery and cross-border coordination. | Competent authorities verify additional malicious incidents and establish their consequences. |
| D — Greater integration of organized hostile operations | Investigators establish that apparently separate incidents are linked through common direction or operational organization. | Existing European precedents for proxy recruitment and cross-border sabotage. | More significant counterintelligence, judicial, diplomatic and collective-security consequences. | Authenticated command relationships, formal prosecutions and official attributions. |
| E — Institutional resilience fails to keep pace with changing risks | Independent audits identify persistent implementation deficiencies and measurable degradation in essential-service outcomes. | Poland’s NIK findings and ENISA’s documented sectoral maturity gaps. | Higher long-term economic and societal exposure, requiring corrective public-sector investment. | Repeated adverse audits, verified service failures and inadequate implementation of mandatory measures. |
Supporting official evidence: 2026 Resilience Baseline Requirements — NATO — September 2026; NIS360 — ENISA — May 2026; Relazione annuale ACN 2025 — Camera dei Deputati — May 2026; Polish Critical-Infrastructure Cybersecurity Audit — NIK — August 2026.
Net forecast — Moderate confidence: Europe will continue facing an environment in which low-cost disruption, cyber threats, information manipulation and physical security concerns coexist. The available evidence does not establish that the present aviation bomb threats are a precursor to a specific military conflict.
Consequential uncertainty — High confidence that the gap is material: The relationship between the warning originators, any organized intelligence collection and the strategic intentions of a possible sponsor remains unresolved.
9. Intelligence Gaps, Collection Requirements and Institutional Countermeasures
9.1 The most important missing evidence is not a military response time: it is proof of the relationship between incidents
The most significant analytical gap concerns the absence of a reconciled, authenticated record establishing whether the November aviation warnings share a perpetrator, command structure, sponsor or identifiable intelligence objective. This is more important for attribution than counting the number of military aircraft involved in individual escorts. If the warning originators are unrelated individuals, the interpretation of a coordinated defence-testing campaign would be materially weakened. If competent investigators establish that the same organization issued warnings, collected information about the resulting protective responses and reported those observations to a state-linked intermediary, the assessment would change substantially. These are different evidentiary outcomes with different strategic and legal consequences.
The required collection process must preserve the distinction between criminal investigation, cybersecurity analysis, aviation-security oversight and intelligence assessment. National police and prosecutors possess legal authority to investigate threatening communications within their jurisdictions. Aviation authorities and operators possess records concerning the operational effects of those threats. National security agencies may assess foreign sponsorship and hostile intent under their statutory mandates. European institutions can assist with coordination and information exchange, but they do not replace the national legal authorities responsible for the underlying incidents. The objective should be to reconcile independently obtained evidence, preserve provenance and avoid circulating unsupported conclusions as though repeated reporting constituted corroboration.
A common incident record is essential. It should distinguish the unique threatened flight or facility, the entity receiving the warning, the country responsible for the response, the operational consequence, the final investigative disposition and the quality of available attribution evidence. Sensitive operational details should remain under the control of the competent authorities. Public reporting should provide sufficient information for accountability and risk assessment without disclosing protected military readiness information or detailed security procedures.
9.2 The intelligence collection matrix
The following collection requirements are organized around decision relevance, not around opportunities to identify exploitable defensive weaknesses. Their purpose is to distinguish hostile coordination from coincidental activity, measure actual harm and support legally authorized resilience improvements.
| Priority | Intelligence question | Competent evidence owner or source | Required observation | Decision consequence |
|---|---|---|---|---|
| Critical | Do the November aviation warnings share a verified origin? | National police, prosecutors, authorized communications investigators and relevant aviation-security authorities. | Authenticated common-origin evidence or independently established unrelated senders. | Determines whether the events should be treated as a coordinated criminal campaign. |
| Critical | Is there evidence of state direction or sponsorship? | National counterintelligence agencies, judicial authorities and competent government attribution processes. | Documented direction, sponsorship or organizational relationship. | Determines whether counterintelligence and diplomatic responses are justified. |
| Critical | Was observation of security responses an intended objective? | Competent criminal and intelligence investigators. | Authenticated evidence that the originators organized, collected or used observations of responses. | Determines whether the defence-testing hypothesis moves beyond plausibility. |
| High | What is the actual unique incident volume? | EUROCONTROL, national aviation authorities, airlines and airport operators. | Reconciled, deduplicated incident records with consistent definitions. | Establishes a defensible temporal and geographical baseline. |
| High | Did recurring warnings measurably worsen aviation outcomes? | Aviation regulators, operators and air-navigation authorities. | Comparable safety and service-continuity outcomes over time. | Confirms or weakens the institutional fatigue hypothesis. |
| High | Are cold-chain incidents technically or organizationally connected? | National CSIRTs, ANSSI, competent law-enforcement bodies and affected operators. | Independent forensic linkage or evidence of unrelated incidents. | Determines whether a cross-domain campaign exists. |
| High | Are actual infrastructure consequences increasing? | Sector regulators, operators, national auditors and competent ministries. | Verified losses, service interruptions, restoration outcomes and incident classifications. | Distinguishes increasing malicious activity from increasing realized harm. |
| High | Are national critical-entity resilience obligations being implemented? | National regulators and supervisory authorities operating under applicable law. | Completed compliance reviews, independent audits and corrective-action outcomes. | Determines whether legislative measures are producing operational benefits. |
| High | Are European warning and crisis-coordination mechanisms functioning effectively? | EU institutions, NATO where competent, national crisis-management authorities and exercise organizers. | Formal exercise findings, lessons learned and documented corrective measures. | Identifies institutional improvements without requiring disclosure of classified operations. |
| High | Are public narratives being manipulated through coordinated deception? | Competent information-integrity authorities and investigators. | Authenticated links among deceptive communications and identifiable amplifying networks. | Supports accurate public communications and proportionate countermeasures. |
| Medium | Are independent copycats contributing to the apparent incident wave? | Criminal investigators and national judicial authorities. | Separate suspects, unrelated technical origins and verified imitation. | Prevents unjustified attribution of unrelated events to a foreign state. |
| Medium | Do national differences reflect actual resilience differences or incompatible reporting? | ENISA, national regulators, official statistical bodies and audit institutions. | Harmonized definitions, comparable periods and consistent measurement practices. | Prevents misleading cross-country rankings. |
| Medium | Are sectoral preparedness programmes progressing? | National ministries, national auditors, European Commission and NATO resilience mechanisms. | Published implementation milestones and independent verification. | Supports decisions on regulatory priorities and future public expenditure. |
9.3 The European legal framework already provides mechanisms for improving the evidence base
Two European legal instruments are particularly relevant: Directive (EU) 2022/2557 on the Resilience of Critical Entities (CER) and Directive (EU) 2022/2555 on Measures for a High Common Level of Cybersecurity (NIS2). They address distinct but complementary aspects of resilience. CER establishes requirements concerning critical entities, risk assessment, resilience measures and incident notification across essential sectors. NIS2 addresses cybersecurity risk management, governance, supervision and the reporting of significant cybersecurity incidents. Neither directive establishes a unified European military-defence command, and neither should be interpreted as transferring all national security responsibilities to the European Commission. Their strategic importance is the creation of more systematic obligations for civilian operators and competent authorities to identify and manage risks that can have consequences across national borders. Critical Infrastructure Blueprint and CER Framework — Council of the European Union — June 2024; Hybrid Threats and Critical-Infrastructure Resilience — Council of the European Union.
The EU Critical Infrastructure Blueprint, adopted by the Council on 25 June 2024 through Recommendation C/2024/4371, provides an additional coordination framework for incidents with significant cross-border consequences. It addresses information sharing, common situational awareness and coordination of public communications. The recommendation identifies circumstances in which a serious incident may warrant an EU-level response, including disruption affecting essential services in multiple member states. It is particularly relevant to the problem of dispersed security incidents because the consequences may cross borders even where the initial event is confined to one jurisdiction. However, the blueprint does not mean that every aircraft bomb warning or individual cyber incident automatically activates an EU-wide crisis response. Council Recommendation C/2024/4371 on a Blueprint for Cross-Border Critical-Infrastructure Disruptions — Council of the European Union — June 2024.
The analytical opportunity is to use these frameworks to improve the comparability of incident records and resilience outcomes. The strategic danger is to confuse a growing volume of reports with a growing volume of successful attacks. Mandatory notification can increase the number of recorded incidents even when underlying protective capabilities improve. Italy’s ACN figures demonstrate why this distinction matters: the increase in observed events substantially exceeded the increase in confirmed harmful incidents. A European intelligence assessment must therefore preserve the definitions and reporting incentives that influence national datasets.
9.4 A measured European resilience scorecard: what is established and what is missing
A useful strategic scorecard should preserve exact figures while refusing to force incompatible national measurements into a single ranking. The following table distinguishes national or institutional observations and indicates how they can inform resilience assessment without providing a misleading comparison of military effectiveness.
| Country or authority | Verified baseline | Reporting period | Analytical interpretation | Principal limitation |
|---|---|---|---|---|
| Italy — ACN / CSIRT Italia | 2,729 cyber events; 615 incidents with confirmed impact; 3,907 victim records, including 1,901 unique victims. | 2025 | Growing observed activity with a more limited increase in confirmed harmful incidents. | National cybersecurity reporting definitions; not a measure of aviation-security events. |
| Italy — ACN | 46,867 warning communications; more than 800,000 indicators of compromise shared. | 2025 | Demonstrates preventive information-sharing activity. | Output volume does not independently measure resulting protective effectiveness. |
| Italy — ACN | 60 of 82 national strategy measures completed. | End of 2025 | Official implementation-progress measure. | Measures differ in scope and importance; not a military readiness percentage. |
| France — ANSSI | 3,586 security events handled; 18% below 2024. | 2025 | Demonstrates continued substantial activity and the importance of historical reporting context. | Previous year’s Olympic-related reporting affects comparability. |
| Poland — National CSIRTs | Nearly 273,000 cybersecurity incidents handled; 144.4% above the previous year. | 2025 | Indicates substantial recorded national cyber incident-response demand. | Broad definition; not directly comparable with Italy or France. |
| Poland — NIK | Eight essential-service operators audited; deficiencies found at all eight; six systematically ignored critical monitoring alerts. | Audited activity from 2021–2025; findings published 2026 | Direct official evidence of governance and monitoring shortcomings in the audited sample. | Does not establish national prevalence or a connection to aviation warnings. |
| Poland — Energy sector | Cyberattacks reported against two combined heat-and-power plants and renewable-generation management systems; government stated no blackout occurred. | 29–30 December 2025 | Demonstrates an actual malicious incident with reported prevention of severe consequences. | Governmental outcome statement; does not establish uniform sector-wide resilience. |
| Estonia — RIA | 10,185 registered cyber incidents. | 2025 | Demonstrates the scale of the national digital-security reporting environment. | Many concern fraud and related activity rather than critical-infrastructure compromise. |
| European Union — ENISA | 73% of targeted organizations in its 2025 dataset were essential or important entities under NIS2; public administration accounted for 32%. | January–December 2025 | Establishes sectoral distribution within the agency’s collected incident dataset. | Does not represent the percentage of all European organizations attacked. |
| European Union — ENISA | More than 5,000 participants and more than 100 experts involved in Cyber Europe 2026. | June 2026 | Demonstrates the scale of an organized cross-border transport cybersecurity exercise. | Participation is not proof of successful performance under real attack. |
| NATO — Resilience Baseline Requirements | Seven civilian-resilience baseline requirements. | Revised September 2026 | Establishes a strategic framework for government, services and civilian support to military operations. | Not an operational inventory or comparable numerical country score. |
| United Kingdom — Cabinet Office | National Risk Register 2026 published and updated. | July–August 2026 | Provides a national framework for reassessing major risks. | Does not itself prove the effectiveness of protective arrangements. |
| Germany — Federal Government | KRITIS-Dachgesetz in force. | March 2026 | Establishes statutory critical-infrastructure resilience requirements. | Implementation and performance must be evaluated separately. |
Official records: Italian ACN Annual Report 2025 — Camera dei Deputati; French Cyber Threat Overview — ANSSI; Polish Critical-Infrastructure Audit — NIK; Polish Government Energy-Sector Incident Statement; Estonian Cybersecurity Annual Report — RIA; ENISA Threat Landscape 2026; Cyber Europe 2026 — ENISA; NATO Resilience Requirements 2026; UK National Risk Register 2026; German Critical-Infrastructure Protection Law — Federal Government.
9.5 Strategic collection should prioritize evidence quality over incident accumulation
The most significant methodological risk is the construction of a large incident database in which different events are treated as equivalent merely because they occur during the same geopolitical period. A sound collection architecture must retain the unit of observation and the source’s definition of that unit. A threatening email, a threatened flight, a diverted aircraft, an airport closure, a cyber event, a confirmed cyber incident, a physical act of sabotage and a military interception are separate categories. A single occurrence can generate records in several of them. Consequently, the sum of their reported volumes is not the number of hostile operations.
For the aviation-warning question, the preferred analytical product is a deduplicated incident series with authenticated provenance and verified outcomes. For cybersecurity, the relevant series should distinguish detected malicious activity from incidents with confirmed operational effects. For physical infrastructure, the record should establish whether the disturbance was malicious, accidental or unresolved. For military security, the record should distinguish lawful monitoring, unauthorized airspace penetration, civilian assistance and actual defensive engagement. These categories are essential for avoiding false correlations and for identifying the rare developments that materially change the strategic assessment.
The same principle applies to information collection about the perpetrators. Several reports repeating one police statement do not constitute several independent confirmations. Likewise, a claim of responsibility published by an anonymous account does not become more credible because numerous media outlets reproduce it. A state-sponsored operation cannot be inferred from the presence of geopolitical language alone. The strongest evidence comes from competent criminal proceedings, technically validated forensic connections, corroborated intelligence findings and official attributions with clearly stated scope.
9.6 Policy choices for senior government decision-makers
The following options prioritize protective outcomes, authorized information exchange and institutional preparedness. They do not require the public disclosure of classified force readiness, operational response windows or the detailed arrangement of defensive assets.
| Course of action | Competent authority | Expected effect | Implementation burden | Time to observable effect | Reversibility | Principal downside |
|---|---|---|---|---|---|---|
| Standardize multinational incident definitions and reporting | National aviation/security authorities, relevant EU bodies and international partners. | Better detection of genuine incident clusters and reduced double-counting. | Moderate; requires legal and technical coordination. | Initial reporting improvements within months; stronger comparability over multiple reporting periods. | High | Administrative burden and inconsistent national adoption. |
| Establish protected forensic coordination arrangements | National police, prosecutors and authorized intelligence services. | Stronger identification of common perpetrators and reduction of unsupported attribution. | Moderate to high, depending on legal frameworks. | Case-dependent; no reliable universal timetable. | Moderate | Data-protection, evidentiary and jurisdictional complications. |
| Improve independent auditing of critical-service resilience | National regulators, audit institutions and infrastructure ministries. | Identification of persistent implementation deficiencies and verified corrective measures. | Moderate to high. | Audit findings may emerge within a year; remediation can require longer. | Moderate | Resource demands and possible disclosure of sensitive findings. |
| Expand controlled multi-sector resilience exercises | National civil-protection authorities, ENISA, EU institutions and NATO where competent. | Better coordination and service-continuity planning. | Moderate to high. | Exercise findings within months; institutional improvements over subsequent cycles. | High | Simulated performance may not transfer fully to real events. |
| Improve public crisis communication and attribution discipline | National governments, public-security authorities and competent EU institutions. | Reduced speculation and clearer distinction between warnings and confirmed attacks. | Low to moderate. | Potentially immediate once procedures are adopted. | High | Excessive information restriction could undermine public confidence. |
| Accelerate implementation of applicable resilience legislation | EU Member States, national supervisory bodies and regulated operators. | More consistent protection and recovery arrangements for essential services. | High for some operators. | Multiple years, depending on existing maturity and investment needs. | Low to moderate | Cost and compliance burdens, especially for smaller organizations. |
| Maintain classified military readiness evaluation through authorized channels | National defence ministries, armed forces and NATO. | Reliable assessment of military preparedness without publishing operationally sensitive conclusions. | High and recurring. | Continuous institutional process. | Low for established security obligations | Resource demands and difficulties integrating civilian findings. |
The choice among these options should be guided by the evidence. A government confronting a verified forensic coordination problem may prioritize criminal and intelligence cooperation. A government facing deficiencies in essential-service oversight may need stronger auditing and enforcement. A multinational institution facing inconsistent public communication may benefit from clearer protocols. More forceful responses do not automatically provide better protection, and a response disproportionate to the evidence may itself generate political consequences.
9.7 The essential institutional safeguard: separate the public resilience picture from sensitive military operational information
A serious European warning system needs information sufficient to assess whether public services are protected and whether institutions are performing their responsibilities. It does not need to publish operationally sensitive details about individual military deployments, classified alert procedures, readiness thresholds or contingency plans. NATO’s resilience requirements explicitly connect civilian and military preparedness while recognizing the importance of national responsibilities and coordinated planning. The appropriate public product should therefore emphasize documented safety outcomes, continuity of essential services, regulatory compliance, verified incident consequences and independent audit results.
This separation is particularly important for the central hypothesis concerning involuntary intelligence generation. Public transparency supports accountability and trust, but not every operational detail should be disclosed. Governments can explain that protective procedures were applied and that a flight landed safely without publishing a complete reconstruction of military decision-making. They can publish aggregate data on security incidents without disclosing the exact deployment configuration of defensive systems. They can report deficiencies identified by auditors while protecting information whose release would materially increase the risk of exploitation.
The objective is not secrecy for its own sake. It is an evidence-based balance between public accountability, institutional learning and the protection of information whose operational value extends beyond the incident being reported.
10. Source Evaluation Appendix — Reliability, Credibility and Decision Relevance
10.1 Evaluation principles
The reliability of a source depends on its competence, provenance, access to the underlying events and institutional responsibility. The credibility of a particular claim depends on whether it is directly established, independently corroborated and expressed at the correct level of certainty. These are different dimensions. A national government may be highly reliable as evidence of the decisions it made, but its public statement may not disclose the underlying intelligence supporting an attribution. A cybersecurity agency may reliably record an incident without establishing the ultimate perpetrator. An audit authority may identify deficiencies within its sample without proving that the same problems exist throughout an entire country.
The following assessment gives priority to primary official records. It distinguishes direct operational evidence, regulatory and statistical reports, government assessments and intelligence judgments. It also identifies where a source’s information is unsuitable for drawing conclusions about the current aviation warnings.
10.2 Major source evaluations
| Source | Reliability | Credibility of the relevant information | Principal evidentiary value | Limitation |
|---|---|---|---|---|
| 2026 Resilience Baseline Requirements — NATO — September 2026 | High | High for official Alliance policy and stated requirements | Establishes the seven national resilience requirements and the relationship between civilian continuity and military support. | A policy framework does not establish implementation performance in individual countries. |
| Integrated Air and Missile Defence Policy — NATO — February 2025 | High | High for doctrine and institutional design | Defines NATO’s strategic air and missile defence framework and the relevance of civil-military coordination. | Does not disclose operational readiness data or establish the origin of civilian bomb warnings. |
| Relazione annuale ACN 2025 — Camera dei Deputati — May 2026 | High | High for reported national cybersecurity activities and outcomes | Supplies exact Italian event, incident, warning and implementation figures. | National cyber reporting does not measure aviation security or wartime military readiness. |
| Panorama de la cybermenace 2025 — ANSSI — March 2026 | High | High for ANSSI’s operational records and observed threat trends | Documents French cybersecurity activity, incident reporting and attribution difficulties. | Historical comparison affected by extraordinary 2024 reporting circumstances. |
| Polish Critical-Infrastructure Cybersecurity Audit — NIK — August 2026 | High | High for findings concerning the audited entities | Direct evidence of deficiencies in cybersecurity management and supervisory arrangements. | Eight-operator sample; findings cannot be generalized to all Polish infrastructure. |
| Poland Stops Cyberattacks on Energy Infrastructure — Prime Minister’s Chancellery — January 2026 | High | High that the government reported the events and outcomes; moderate regarding undisclosed technical details | Documents a real energy-sector security incident and the government’s account of successful containment. | Public statement does not disclose complete forensic findings. |
| NIS360 Sector Maturity Assessment — ENISA — May 2026 | High | High for the agency’s sector-level assessment under its methodology | Identifies relative criticality, maturity and changes among essential sectors. | Sectoral maturity is not equivalent to the exploitability of a specific operator or facility. |
| ENISA Threat Landscape 2026 — ENISA — September 2026 | High | High for reported dataset properties and methodological findings | Provides cross-sector cybersecurity observations from 2025. | Mixed-source dataset; not a complete population of all EU cyber incidents. |
| Cyber Europe 2026 — ENISA — June 2026 | High | High for the exercise’s occurrence, design and participation | Establishes practical European preparation for concurrent railway and maritime cyber crises. | Exercise participation and simulated outcomes do not prove real-world readiness. |
| EU Integrated Resolve 2026 — Council of the EU — October 2026 | High | High for exercise scope and announced schedule | Establishes ongoing EU hybrid-crisis coordination activity at the cutoff date. | Exercise was still underway; no completed performance evaluation available. |
| Critical Infrastructure Blueprint — Council of the EU — June 2024 | High | High for official coordination arrangements | Establishes the EU framework for addressing significant cross-border infrastructure disruption. | Does not imply that every incident triggers the mechanism. |
| EU Preparedness Union Strategy — European Commission — 2025 | High | High for published policy objectives | Establishes the Union’s whole-of-government and whole-of-society preparedness approach. | Announced objectives cannot be treated as completed capabilities. |
| KRITIS-Dachgesetz — German Federal Government — September 2026 | High | High for the government’s description of the legal framework | Documents German infrastructure-resilience legislation and its scope. | Implementation effectiveness must be independently measured. |
| National Risk Register 2026 — UK Cabinet Office — July 2026 | High | High for the government’s published risk-assessment framework | Establishes the UK’s updated approach to national risk assessment. | Public risk categories do not reveal every classified planning assumption. |
| Cyber Security in Estonia 2026 — RIA | High | High for national incident reporting and documented service events | Provides a national record of cybersecurity incidents and operational lessons. | Broad incident definitions; includes criminal fraud and technical failures. |
| Cybersecurity Governance — Latvian Ministry of Defence | High | High for national legal duties and institutional responsibilities | Establishes cybersecurity governance and NIS2-related obligations. | Compliance cannot be inferred from legal requirements alone. |
| Romanian National Coordination Centre for Critical Infrastructure Protection | High | High for institutional mandate and national legal references | Identifies Romania’s coordinating authority for critical-infrastructure resilience. | Does not supply a comprehensive quantified national performance assessment. |
| National Threat Assessment 2026 — Lithuanian Intelligence Services | High | High as evidence of the services’ published assessment; confidence in individual attributions depends on disclosed corroboration | Provides official intelligence judgments concerning hostile state activity and regional risks. | Not a forensic attribution of the November aircraft warnings. |
| Revue nationale stratégique 2025 — SGDSN — July 2025 | High | High for French strategic-policy positions | Establishes national preparedness priorities in a deteriorating security environment. | Strategic objectives do not prove realized operational capacity. |
| France’s National Resilience Priorities — SGDSN — July 2026 | High | High for government decisions and priorities | Documents concrete initiatives concerning supplies, exercises and national resilience. | Some measures were prospective at the assessment cutoff. |
| CERT-FR Refrigeration Security Alert — ANSSI — October 2026 | High | High for the agency’s knowledge of numerous compromises | Establishes actual malicious activity affecting refrigeration control systems. | Does not identify a common actor with the aviation warnings. |
10.3 Evidentiary conflicts and methodological corrections
The reviewed sources contain several important differences that must not be hidden through editorial synthesis.
National cybersecurity event totals are not directly comparable. Italy’s ACN reports cyber events and incidents with confirmed impact according to CSIRT Italia’s definitions. France’s ANSSI reports events handled under its own operational categories. Poland’s national cybersecurity figure includes a much broader group of incidents handled through its national system. Estonia’s RIA records many incidents associated with fraud and other cyber threats. Those totals should not be combined into one European incident series, nor can their relative values establish which country has the least effective protection.
High incident volume does not necessarily imply high impact. Italy recorded a significant increase in observed events alongside a smaller increase in confirmed harmful incidents. France’s year-on-year decline in events was influenced by an unusually elevated 2024 reporting baseline. Poland’s audit established significant problems in particular organizations, while a separate governmental account reported successful prevention of severe consequences in an actual energy-sector attack. These examples demonstrate that incident frequency, threat exposure, institutional maturity and realized consequences must be measured separately.
Audited deficiencies do not establish hostile exploitation. Poland’s NIK findings provide strong evidence that the eight audited entities did not meet the expected cybersecurity standard. They do not establish that a foreign intelligence service identified or used those deficiencies, and they do not attribute the deficiencies to warning fatigue. Similarly, ENISA’s maturity assessments identify sector-level improvement needs without demonstrating that particular systems can be compromised.
Military doctrine is not an operational performance report. NATO’s published policies and resilience requirements establish the functions, principles and intended capabilities of Allied security arrangements. They do not supply the classified information necessary to measure every operational capability under wartime conditions. A national air-policing response, a maritime-security intervention and a public warning exercise should not be treated as interchangeable measurements of combat readiness.
Cognitive effects require independent evidence. Repeated warnings can attract attention, generate public uncertainty and impose security workload. A claim that they have actually reduced public confidence or degraded institutional decision-making requires suitable empirical evidence. The existence of the warnings alone is insufficient.
10.4 Final intelligence synthesis — the actual significance of involuntary defence-response observation
The essential strategic insight is that a hostile actor does not necessarily need to have organized an incident to derive information from its consequences. European security institutions operate in a highly visible environment. Airlines report diversions, governments issue statements, cybersecurity authorities publish advisories, regulators investigate disruptions and military organizations release selected information about legitimate protective activity. Each disclosure has a public-interest function. Together, such information can also provide an external observer with a partial understanding of how institutions communicate, coordinate and recover from disruptions.
That observation does not justify the stronger conclusion that Europe has thereby disclosed the true limits of its military defences. The publicly observed response to a civilian emergency is shaped by its particular circumstances and by legal obligations that may differ substantially from the requirements of armed conflict. Classified contingency planning, force readiness, alternate command arrangements and military adaptation remain outside the evidentiary reach of most public incident reports. Consequently, the information available to an observer may be strategically interesting without being operationally sufficient to predict wartime performance.
The newly verified official record also demonstrates that Europe is not a passive system undergoing inevitable deterioration. Italy’s cybersecurity statistics show that increased malicious activity can coexist with improved containment. ENISA identifies advances in cybersecurity maturity across several critical sectors. The EU has conducted large-scale crisis exercises, while NATO’s 2026 resilience requirements explicitly address simultaneous civilian and military obligations. Poland’s Supreme Audit Office has identified serious implementation deficiencies, and national governments have responded with legislative, regulatory and operational initiatives. These observations support a more demanding assessment than either institutional complacency or generalized alarmism.
The most consequential unresolved question is whether the present warning activity is being connected to an organized intelligence effort through authenticated evidence of common origin, sponsorship or collection purpose. Until that relationship is demonstrated, a claim of deliberate military reconnaissance remains a hypothesis. The indirect intelligence value of observing legitimate protective responses is nevertheless a real consideration for European strategic communications and information governance.
Final Net Assessment — European Strategic Resilience Under Hybrid Pressure
High confidence: Europe faces persistent security demands across civilian aviation, digital infrastructure, energy, transportation, healthcare and public administration. Official records establish genuine hostile operations, significant protective activity, and both successful responses and documented regulatory shortcomings.
High confidence: NATO’s September 2026 resilience framework formally recognizes that national defence depends on the preservation of essential civilian functions and the capacity to manage complex, concurrent disruptions.
Moderate confidence: Repeated threats and incidents can contribute to a cognitively contested security environment in which the public interpretation of events and the information generated by defensive responses become strategically relevant.
Moderate confidence: The European institutional response will continue to depend on stronger cross-border evidence exchange, consistent national regulatory implementation, independent resilience audits and exercises that test the continuity of essential services.
Low confidence: The November 2026 aviation bomb-threat campaign was centrally directed to measure European air, naval and terrestrial military-defence performance.
Low confidence: The observed warnings provide an adversary with reliable knowledge of how European military forces would perform during a future armed conflict.
The strategic objective for Europe is therefore to maintain a distinction between observability and vulnerability, operational activity and operational effectiveness, intelligence opportunity and proven intelligence intent. The existence of recurring security incidents justifies heightened attention and sustained preparedness. Their interpretation as a deliberately coordinated programme of wartime reconnaissance requires evidence that has not yet been publicly established.
Final judgment: The most defensible European security assessment is not that an adversary has already measured and mastered the limits of NATO’s defences, but that modern security incidents create overlapping operational, informational and psychological consequences that European institutions must manage simultaneously. The strength of the defensive system will ultimately be demonstrated not by the absence of warnings, but by verified continuity of essential services, effective protection of civilian populations, lawful and accurate attribution, and the capacity to preserve national and collective defence responsibilities under sustained uncertainty.
