A wave of bomb threats, school disruptions and airport alerts has exposed how easily digital channels can spread fear. Cybersecurity expert Heli Tiirmaa-Klaar says Europe must strengthen its defenses and determine who is behind the attacks before responding

The greatest vulnerability in Europe’s emerging security crisis may not lie in its airports, power grids or government networks, but in the everyday devices connected to the internet — including supermarket refrigerators. As a wave of bomb threats, digital disruptions and false alarms unsettles public institutions across the continent, cybersecurity expert Heli Tiirmaa-Klaar sees a broader pattern taking shape: Europe is entering an era of what she calls a “shadow war.”

The recent disruption of around 6,000 schools in Italy, along with alerts that have unsettled major airports in France, the United Kingdom and Italy, illustrates how easily digital messages can generate widespread alarm. But the incidents also raise a more consequential question: are they isolated acts of mischief, criminal activity or part of a coordinated campaign directed by a foreign state?

In an interview with Adnkronos, Tiirmaa-Klaar, a technology and security expert at the German Marshall Fund, a Washington-based think tank focused on transatlantic cooperation, said identifying those responsible must come before any political or diplomatic response.

“First of all, the authorities have to establish who is behind these threats,” she said. “If it were a state actor, that would be really concerning. It would be an important component of this shadow war. But if it were a criminal group, or perhaps just a prank, that would be a completely different story.”

The distinction is critical. The thousands of Italian schools targeted by spam emails, which were later traced to an account in Taiwan, show how little effort may be required to disrupt ordinary life. Yet the origin of a message alone does not establish who organized an operation or what its purpose was.

Tiirmaa-Klaar pointed to previous cyberattacks against French supermarkets and other businesses that were attributed to Iran as an example of why attribution matters. Without reliable evidence, she argued, governments cannot determine the appropriate response.

“We cannot make assumptions before we know who did it,” she said. Whatever the origin of the latest threats, she added, Europeans need to become more resilient.

The difference between Europe and the United States

Recent disruption in the United States offered a contrasting example. Chaos at American airports on Friday initially raised fears of a large-scale cyberattack. The cause, however, was a technical problem linked to a technology upgrade involving the replacement of copper cables with fiber-optic connections.

For Tiirmaa-Klaar, the episode does not point to a broader weakness in American cybersecurity. She considers the United States relatively well equipped to protect critical infrastructure, particularly in transportation and aviation, where organizations use advanced technologies and cybersecurity companies have substantial capabilities.

“I am not particularly worried about cyberattacks on critical infrastructure in the United States, because cybersecurity experts know what to do and how to build resilience,” she said.

That confidence comes with a qualification: no system is completely secure. A highly skilled attacker can still exploit complex vulnerabilities and cause widespread disruption, even in environments with sophisticated defenses.

Europe’s weakest links may be outside its critical systems

Europe has made significant progress in establishing common cybersecurity requirements. The EU’s Network and Information Security directive, known as the NIS Directive, has been transposed into national law across all member states, providing baseline protection standards for essential and important entities.

But legislation cannot eliminate every vulnerability. The more difficult challenge may be ensuring that security extends beyond the major systems formally classified as critical infrastructure.

Tiirmaa-Klaar highlighted connected devices in commercial settings as a potential weak point. Refrigeration equipment in supermarkets, for example, may not qualify as critical infrastructure, but it can still be connected to the internet and protected by inadequate security measures.

“What we have seen with supermarket refrigerators in Europe could be an example of one of those weak links that have been attacked,” she said. “Refrigerators are not part of critical infrastructure, but they are equipment connected to the internet and are not very secure.”

The concern is that attackers do not necessarily need to breach a major control system to create disruption. Less protected devices and peripheral networks can offer alternative entry points, exposing weaknesses that broader cybersecurity rules may fail to address in practice.

For Europe, the task is therefore not simply to adopt more legislation. Governments must enforce the rules already in place and ensure that private companies meet meaningful security requirements. The protection of essential services, Tiirmaa-Klaar argued, depends on how consistently individual countries implement those standards across their economies.

Staying calm is part of the response

The succession of threats has also exposed a less technical vulnerability: the public response to uncertainty. School disruptions, airport alerts and alarming headlines can generate fear even when no physical attack takes place.

Tiirmaa-Klaar urged people not to let that reaction turn into panic.

“The best advice is to stay calm and carry on, because the threats have remained threats: nothing has happened, right?” she said. “It is still very, very concerning that they were made.”

Her message is not that the incidents should be dismissed. Rather, Europe must respond with stronger cybersecurity, better enforcement and a clear understanding of who is responsible, while avoiding assumptions that could lead to an inappropriate response.

“We already have legislation,” she said. “Now it is up to individual European countries to make sure they implement it and impose standards and requirements on the private sector as well, so that all organizations take care of cybersecurity.”

(Photo: © AndKronos)