Aerial “Swatting”: Another Step Toward Hybrid Destabilization?

The surge in bomb threats targeting European air traffic since early November 2026 is eerily reminiscent of the “swatting” campaigns that have targeted schools in the U.S. and Europe in recent years. Added to this new wave of disruptions are the recent cyberattacks against the refrigeration systems of large retailers and healthcare facilities, while acts of sabotage against critical infrastructure and arson highlight other vulnerabilities in our hyperconnected societies.

While these incidents do not necessarily involve the same perpetrators or share the same intentions, they have in common the ability to cause disproportionate operational, economic, and psychological effects using limited resources. Beyond psychological warfare, it is now the very functioning and resilience of our societies that are being put to the test.

Air Defense Put to the Test by False Alerts

Since November 2, 2026, a wave of bomb threats has disrupted air traffic in many European countries. At least twenty-five commercial flights were targeted on November 5 alone, leading to diversions, grounded aircraft, passenger evacuations, and interventions by specialized teams.[1]

Aer Lingus, Finnair, Ryanair, Wizz Air, and LOT Polish Airlines are among the airlines affected. One of the most significant incidents was the diversion of an Aer Lingus Airbus A320 flying from Dublin to Rome to Évreux-Fauville Air Base in Normandy, after it had been escorted by two fighters of the French Air and Space Force. The 151 passengers and six crew members were evacuated so that the aircraft could be inspected.

On the same day, Italian Eurofighters escorted a Finnair flight bound for Rome, while Bulgaria deployed MiG-29s to accompany three Ryanair aircraft as part of NATO’s air policing procedures. The incidents continued on November 6. According to Le Figaro, four new alerts involved aircraft flying over France, three of which landed at Orly and one at Bordeaux. Eleven other flights departing from or arriving in Prague and Sofia were also targeted.[2]

The increasing number of these threats led the European Commission to activate an information-sharing mechanism on aviation security. The announced inspections did not reveal the presence of explosive devices, but the investigation is ongoing. On November 7, the Paris Public Prosecutor’s Office announced the opening of investigations aimed at identifying the authors of the threatening emails and determining their possible links to foreign powers.[3]

Some threats sent to the airports in Rome and Sofia were signed “Fighters of the Masculine State,” a name evoking a Russian ultranationalist movement. The leader of this movement has, however, reportedly denied any involvement. Neither the authenticity of these claims nor any potential link to a foreign state has been established at this stage, but the question remains a cause for concern: how can a few anonymous messages trigger, within a matter of hours, the simultaneous mobilization of civilian and military resources across several European countries?

“Swatting,” or the Manipulation of Security Procedures

As early as November 2023, in an article titled “From PsyOps to Psychosis: Bomb Threats as a Technique for Destabilization?”, we were already examining the rise in false terrorist alerts targeting, in particular, schools, museums, and transportation infrastructure.[4]

At the time, we drew a parallel with the American phenomenon of “swatting,” which involves triggering, based on a false report, the deployment of specialized police units—SWAT teams (Special Weapons and Tactics)—particularly in schools allegedly threatened by an active shooter.

What struck American investigators was not so much the existence of false alarms—a long-standing phenomenon—as the change in their scale: an increase in the number of calls, geographical and temporal concentration, precise knowledge of the targeted establishments, and the use of digital methods to mask the origin of the messages.

Three years later, the wave of incidents affecting European air travel appears to share several similarities: recurring incidents, geographic dispersion, temporal concentration, and the mobilization of security resources out of all proportion to those required to trigger an alert.

The parallel with “swatting” does not mean that the perpetrators or the technical methods are identical, but it clearly rests on a common operational logic: exploiting the protective obligations of the authorities to trigger a disproportionate mobilization of their resources, with the possible aim of causing disruption, or even of observing response procedures. While the threat may be fictitious, its consequences remain real in many respects.

Asymmetry Taken to the Extreme

One of the most concerning characteristics of this type of action lies in the disproportion between the cost of initiating it—which is often negligible—and the human, operational, and economic costs of the response it necessitates.

Sending a threatening email requires only limited technical resources. The response, on the other hand, involves an entire security chain: airlines, air traffic controllers, airport authorities, police forces, bomb disposal teams, and, in some cases, military air defense assets.

In the case of an aircraft in flight, the consequences extend far beyond the single aircraft involved, since a diversion can lead to the closure of runways, the reorganization of air traffic, the handling of passengers and crew, and a cascade of delays—or even, as was the case a few days ago, the deployment of military fighter jets.

This latter scenario adds a further dimension, since it draws on air defense resources that are also essential to our Permanent Air Security Posture (PPS-A), which is indispensable for the protection of national and allied airspace.[5]

This asymmetry is precisely one of the driving forces behind the strategies of harassment and destabilization characteristic of the hybrid warfare prevalent today: forcing the adversary to devote significant resources to incidents that are very inexpensive to trigger. It also poses a major dilemma for the authorities. How can the response be adapted to a threat whose credibility remains uncertain without compromising public safety?

The repetition of false alarms must not lead to the trivialization of risk, yet, paradoxically, the systems designed to protect the public can, through their repeated activation, become tools of disruption.

From Networks to Infrastructure: A Chain of Vulnerabilities

The rise in false bomb threats, however, is only one facet of a broader phenomenon.

On the night of October 11–12, more than a hundred French retail stores—including those belonging to the E.Leclerc, Intermarché, and Coopérative U chains—were hit by a cyberattack targeting their refrigeration systems. Hackers exploited vulnerabilities that allowed them to remotely alter cooling settings, resulting in the spoilage of food and significant economic damage.

The problem is therefore no longer just about data compromise, but about the possibility of remotely causing physical damage, particularly by exploiting vulnerabilities in a supplier shared by multiple operators.

This threat took on a particular public health dimension on November 2, with a new cyberattack targeting a refrigeration equipment provider shared by three sites of the Établissement français du sang (EFS), the French blood service. The temperature and defrost settings of cold storage rooms containing, in particular, plasma intended for transfusion or the manufacture of medicines were once again altered remotely.[6] The EFS confirmed that its monitoring systems had enabled it to quickly detect the anomalies and secure the affected products.

Although no health impacts or loss of blood products were observed, this incident is a particularly telling example of the importance of independent monitoring systems and business continuity procedures: a cyber intrusion was able to affect the operating parameters of sensitive equipment without compromising the medical resources it was protecting.

The perpetrators of these attacks remain unknown, and investigations have not established a link between the incidents targeting the EFS and those affecting retail chain refrigeration facilities. Nevertheless, their succession illustrates the expansion of digital attack surfaces to industrial equipment long considered peripheral to cybersecurity.

Fire as a Tool for Systemic Disruption

This vulnerability of critical functions is not limited to the digital realm. In an article to be published in our journal under the title “Fire, a Vector of Systemic Chaos: From Antiquity to Modern Resilience,” Lieutenant Julien Heckler analyzes the potential of arson to become a tool for disruption, particularly when it simultaneously targets multiple infrastructure sites or seeks to overwhelm emergency services.[7]

The arson attacks on the French rail network on the eve of the Paris Olympic Games in July 2024 illustrated this asymmetry: the disabling of just a few critical facilities was enough to cause disruptions affecting hundreds of thousands of travelers.

The repeated use of arson in forms of violent protest—sometimes involving improvised incendiary devices (IIDs), by analogy with improvised explosive devices (IEDs)—as well as attacks targeting emergency responders themselves, demonstrate the potential for disrupting public order and overwhelming emergency response resources.

During the riots of summer 2023, more than 12,000 vehicles were set on fire, and some 2,500 buildings were burned or damaged in more than 600 municipalities, at an estimated cost of nearly one billion euros.[8] On October 17, the national day of protest against the high cost of living led, according to the Ministry of the Interior, to more than 2,000 fire-related interventions, with Limoges City Hall notably being largely destroyed by the flames.[9]

Beyond the material damage, arson thus appears to be a low-cost means of simultaneously mobilizing law enforcement and emergency services.

On a completely different scale, and as a reminder, the Mumbai attacks of November 2008 had already marked a true turning point in the operational doctrines of security forces around the world, particularly in addressing the challenge of simultaneous attacks across multiple sites. For nearly three days, coordinated attacks against several sites in the Indian metropolis combined shootings, hostage-takings, explosions, and arson, and it was this simultaneity that helped disrupt the response of security forces and emergency responders.

In an interview granted to Opérationnels SLDS in 2011, Amaury de Hauteclocque, then commander of the National Police Intervention Force, reflected on the lessons of Mumbai for our domestic security forces and on the need to adapt intervention doctrines and protocols to complex and simultaneous attacks.[10]

Of course, the false air alerts of November 2026 cannot be equated with terrorist attacks of this magnitude, but the parallel nonetheless concerns a specific mechanism: the capacity of saturated protective systems to become, themselves, a factor of vulnerability.

The Long-Recognized Risk of Converging Forms of Violence

This analysis also aligns with the concerns expressed as early as 2018 by Major General Ivan Noailles, then deputy commander of the National Gendarmerie’s training schools.

In an interview titled “Strengthening National Cohesion,” published in Opérationnels SLDS in the spring of 2018, he had already highlighted the risk of a convergence of various forms of violence—jihadist terrorism, gang warfare, radical movements, and protest-related violence—as well as the challenges this trend posed to internal security forces. He stressed the need to adapt training programs, preserve the bond of trust between law enforcement and the public, and strengthen cooperation among agencies.[11]

Nearly a decade later, this analysis takes on particular significance, as physical violence is now compounded by digital and informational tactics capable of disrupting infrastructure and mobilizing—or even overwhelming—security systems without direct confrontation.

The problem, therefore, is not only one of the availability of response resources, but also of their coordination, the ability to maintain essential services, and, beyond that, national cohesion.

Resilience Put to the Test by “A Thousand Cuts”

False alarms, cyberattacks, acts of sabotage, and arson do not necessarily stem from the same strategy or the same sponsors, and it is, of course, essential to distinguish between a coherent, coordinated, and deliberate strategy and an accumulation of independent disruptions, which may amplify one another through a ripple effect or imitation. The effects can thus converge without any shared intentions or responsibilities, and this is what makes the task of attributing the source of the threat particularly complicated and sensitive.

Such vulnerability can lead to the dispersion and depletion of resources, the disruption of essential functions, rising economic costs, and the gradual erosion of confidence in the state’s ability to protect society. This dynamic is reminiscent of the so-called “thousand cuts” strategy, based on the accumulation of limited actions whose cumulative effects can weaken a system without any single one being sufficient, on its own, to paralyze it.

Under these conditions, so-called “hybrid” conflict is no longer merely an abstract concept. Its effects can be physical, health-related, economic, and psychological, even when the actions themselves remain difficult to attribute.

This realization is now being reflected in legislation. On November 9, the National Assembly begins floor debate on the bill concerning the resilience of critical infrastructure and the strengthening of cybersecurity.[12] The Senate had already adopted it in March 2025, and its consideration by the Assembly had been postponed several times. The bill transposes into French law three European texts adopted on the same day, December 14, 2022, which form a coherent whole.

• The NIS2 (“Network and Information Security 2”) Directive strengthens the security of the networks and information systems of essential and important entities in eighteen sectors, including energy, transportation, healthcare, and food. It imposes obligations on these entities regarding risk management and incident reporting, including for vulnerabilities in their suppliers and subcontractors.[13] This is precisely the type of vulnerability exploited in the attacks against refrigeration facilities.
• The directive on the resilience of critical entities, known as REC in French (CER in English), is less well known but more directly relevant to our discussion. It does not focus solely on cyberspace. It requires states to identify their critical entities, and requires those entities to assess and address all risks that could disrupt their essential services: natural disasters, health crises, terrorist attacks, or acts of sabotage.[14] In France, it has led to the modernization of the security framework for activities of vital importance (SAIV), inherited from the logic of defending sensitive sites. The focus thus shifts from protecting sites to ensuring the continuity of functions.
• Finally, the financial section transposes the directive accompanying the DORA (“Digital Operational Resilience Act”) regulation on digital operational resilience in the financial sector.[15]

According to some estimates, more than 15,000 French organizations across 18 sectors would thus be affected by the strengthened cybersecurity, incident reporting, and risk management requirements.[16]

Protecting critical infrastructure also requires a better understanding of the interdependencies among operators, effective management of risks associated with service providers, the ability to operate in degraded modes, and enhanced coordination between civilian and military authorities.

A country’s true strategic depth is no longer measured solely by the distance separating it from a threat or by the sheer volume of resources at its disposal to counter it, but also by its ability to function under pressure. This is perhaps the main lesson to be drawn from these cumulative events: modern societies can be disrupted without destroying their infrastructure, by systematically and repeatedly exploiting their interdependence and connectivity, as well as the technical and human measures designed to protect them.

Whether or not these are coordinated destabilization campaigns, such developments demonstrate—if demonstration were needed—just how much resilience has become a national security issue in its own right.

[1]https://www.aerotime.aero/articles/bomb-threats-europe-flights-fighter-escorts-diversions

[2]https://www.lefigaro.fr/conjoncture/une-nouvelle-fausse-alerte-a-la-bombe-vise-un-vol-ryanair-au-depart-de-lisbonne-20261106

[3]https://www.leparisien.fr/economie/alertes-a-la-bombe-visant-des-avions-enquete-ouverte-du-parquet-de-paris-sur-un-lien-eventuel-avec-des-puissances-etrangeres-07-11-2026-ZWWGYL25E5CHHDRT4H2QBVJBJQ.php

[4]https://operationnels.com/2023/11/20/des-psyops-a-la-psychose-les-alertes-a-la-bombe-comme-technique-de-destabilisation/

[5]See: https://www.defense.gouv.fr/air/nos-missions/proteger

[6]https://www.lemonde.fr/pixels/article/2026/11/04/des-frigos-de-l-etablissement-francais-du-sang-a-leur-tour-victimes-d-une-cyberattaque_6806228_4408996.html

[7]Lieutenant Julien Heckler, “Fire, a Vector of Systemic Chaos: From Antiquity to Modern Resilience,” Opérationnels SLDS, 2026 (Best OPS 2026, forthcoming).

[8]Senate, Report No. 521 (2023–2024) on the June–July 2023 riots, summary: https://www.senat.fr/rap/r23-521/r23-521-syn.pdf. Figures from the Ministry of the Interior (12,031 vehicles set on fire, 2,508 buildings set on fire or damaged) and cost estimate reported by Public Sénat, April 11, 2024: https://www.publicsenat.fr/actualites/parlementaire/emeutes-de-2023-un-cout-colossal-estime-a-un-milliard-deuros-selon-le-rapport-du-senat

[9]Ministry of the Interior figures (2,025 fire-related interventions on October 17, 75 on October 24), cited by Euronews, October 25, 2026: https://fr.euronews.com/2026/10/25/manifestations-en-france-1-314-interpellations-53-membres-des-forces-de-lordre-blesses-sam; Ministry press release: https://www.interieur.gouv.fr/actualites/communiques-de-presse/bilan-de-journee-de-mobilisation-nationale-du-24-octobre-2026

[10]Murielle Delaporte, “FIPN: Toward a New Esprit de Corps,” interview with Amaury de Hauteclocque, Commander of the National Police Intervention Force (FIPN), Soutien Logistique Défense No. 6, 4th quarter 2011, pp. 52–59 (https://operationnels.com/wp-content/uploads/2015/11/Les-lecons-de-Bombay-SLD6.pdf; online version: https://operationnels.com/2011/10/14/fipn-vers-un-nouvel-esprit-de-corps-1-2/).

[11]Murielle Delaporte, “Strengthening National Cohesion,” interview with Major General Ivan Noailles, Opérationnels SLDS, No. 40/41, Spring 2018, pp. 50–55: https://operationnels.com/wp-content/uploads/2026/11/40-41-Operationnels-double-Printemps-2018.pdf

[12]National Assembly, legislative dossier for Bill No. 1112 on the resilience of critical infrastructure and the strengthening of cybersecurity: https://www.assemblee-nationale.fr/dyn/docs/PRJLANR5L17B1112; text adopted by the special committee (No. 1779): https://www.assemblee-nationale.fr/dyn/17/textes/l17b1779_texte-adopte-commission.pdf; original text submitted to the Senate: https://www.senat.fr/leg/pjl24-033.html

[13]Directive (EU) 2022/2555 of the European Parliament and of the Council of December 14, 2022, on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), OJ L 333, December 27, 2022: https://eur-lex.europa.eu/eli/dir/2022/2555/oj?locale=fr

[14]Directive (EU) 2022/2557 of the European Parliament and of the Council of December 14, 2022, on the resilience of critical entities, OJ L 333, December 27, 2022: https://eur-lex.europa.eu/eli/dir/2022/2557/oj?locale=fr

[15]Regulation (EU) 2022/2554 of December 14, 2022, on digital operational resilience for the financial sector (DORA): https://eur-lex.europa.eu/eli/reg/2022/2554/oj?locale=fr; and the accompanying Directive (EU) 2022/2556 of the same date: https://eur-lex.europa.eu/eli/dir/2022/2556/oj?locale=fr

[16]https://www.lefigaro.fr/secteur/high-tech/la-france-renforce-enfin-son-arsenal-face-aux-cyberattaques-20261108

Originally published in French: operationnels.com