An unprecedented wave of bomb threats across Europe has left the bloc struggling to respond, as it remains unclear who is behind the incidents.
The threats, which are mainly understood to have been sent via emails and have so far all proven false, have impacted multiple media broadcasters, more than 50 flights, thousands of schools and at least one cruise ship across the continent, posing an increasingly urgent security challenge for European authorities.
Analysts say the hoaxes have exposed the vulnerability of Europe’s public infrastructure to anonymous and hard-to-trace messages and highlight the bloc’s need for a more coordinated response.
The bomb threats targeting European flights were taken seriously by authorities and elicited strong action, which varied between countries. While some authorities diverted flights to other airports, others – such as Hungary and France – scrambled fighter jets to escort the affected passenger planes.
Some are calling for European countries to replace fragmented, nation-by-nation reactions with a bloc-wide security framework. The chief executive of budget Hungarian airline Wizz Air, József Váradi, spoke Thursday of the need for more harmonized security procedures and alluded to the possible creation of a central body to manage such hoaxes.
He revealed that he had recently held a meeting with European Commission officials to push for a coordinated response. “But this is a very hot potato because of the sovereign nation state concept, and no country wants to concede on this matter, ” Váradi said in a post-earnings call Thursday.
A threat targeting an airline operating across several countries could involve several law enforcement agencies, meaning that greater information-sharing between countries could prove key to identifying patterns and determining the origin and validity of the threat.
Grégoire Roos, director of the Europe, Russia and Eurasia programs at the London-based Chatham House think tank, said that while the initial security responses had been strong, coordination between European countries remains insufficient.
At present, each country is responding with “its own toolbox and standards,” due to the threats being a relatively new phenomenon, he told CNN.
A first step for improvement, he believes, would be to establish a Europe-wide threat assessment standard. “For instance, emergency measures should depend on corroborating intelligence and the circumstances of each incident at continental level.”
He also believes that whoever is behind the attacks is exploiting differences in national procedures. “Europol, national police, in some cases even regional police forces, aviation authorities, all need to compare technical evidence.
“So, you have in a way a scrambled response and within that scrambled response you have sub-levels. So, it increases the response time, and it therefore gives more space for anxiety to grow.”
The threats also expose that while it is cheap to launch such hoaxes, it is vastly more expensive to counter them. A single email can force a mass security deployment, divert flights or prompt the evacuation of public buildings. Such methods weigh heavily on public resources, cause disruption to daily life and sow public unease.
One response has been to try to carry on as normal. When thousands of schools in Italy received a threat this week, Prime Minister Giorgia Meloni’s overarching message to concerned parents was to remain calm and keep disruption to a minimum.
Bomb threats were sent via email to around 6,300 Italian schools on Wednesday and around 3,778 on Thursday. While hundreds of schools were evacuated, many also chose to remain open. Meloni proposed new evacuation protocols in the wake of the threats, stipulating that schools should not be evacuated based solely on a mass email and without concrete evidence.
Schools in Scotland, Northern Ireland and the Republic of Ireland also received threatening emails Wednesday. Police warned these were likely hoaxes and education facilities were not evacuated.
Meanwhile some UK airports made the decision to remain open despite receiving threats.
“As far as the UK is concerned, we’ve seen the airports of Heathrow and Birmingham that managed to continue operating after they received threats, because those were assessed as not credible. So, I think this is something others across Europe could do, rather than saying ‘OK there’s a minor alert, we’ll close everything,’” Roos said.
He added, “It matters more than you think, because the moment you evacuate it increases the level of anxiety.”
The digital nature of the alerts – the vast majority of them were sent via email – makes it difficult for investigators to track down their origin. While some of them were signed off by certain entities, such as the “Male State,” a Russian ultra-nationalist group, authorities suspect these could be false attributions.
Cybersecurity firms Proofpoint and Abnormal Security found a large portion of the threats were sent from legitimate webmail accounts that had been hijacked. Such practices make it difficult for law enforcement to track down those responsible and can keep authorities stuck in a reactive posture.
There are strong suspicions that the incidents could be part of a wider campaign of so-called hybrid warfare, in which hostile actors seek to undermine public confidence and destabilize countries without resorting to conventional military force.
European officials have increasingly warned about the threat posed by such tactics, with Russia frequently accused of using cyberattacks, sabotage and disinformation to undermine Western countries. Moscow has repeatedly denied involvement in such activities.
But French President Emmanuel Macron cautioned against jumping to conclusions over the wave of bomb threats, saying Thursday that there was not yet the evidence to attribute them to foreign powers.
“As I speak, we do not have sufficient elements to be able to make an attribution,” Macron told reporters during a meeting of European leaders in Dublin.
Roos warned against automatically pointing the finger at Moscow without concrete evidence, saying that this could embolden potential other actors. “We run the risk of empowering, for lack of a better word, many other perpetrators, both state- and non-state actors, if each time there is a threat we immediately attribute it to Moscow without even looking into it,” he said.
It also remains unclear whether the threats spanning schools, airlines, broadcasters and other institutions are connected, or whether they originate from a single individual, group or state-backed operation.
For now, the challenge is striking the balance between taking every potential threat seriously and ensuring that the anonymous emails do not repeatedly bring essential services to a standstill.
As the incidents continue to go beyond national borders, pressure is likely to grow on European governments to establish a more coordinated approach — one that can distinguish credible security threats from attempts to exploit the very precautions designed to protect the public.
