False Bomb Threats Disrupt European Air Travel as Attribution Fights Lag Behind
At least 21 flights and several airports across Europe were thrown into disruption after a wave of bomb threats on Thursday, with authorities treating many of the warnings as credible enough to force diversions, escorts, or emergency responses before the threats were exposed as false. In Italy, fighter jets were scrambled to shadow one of the affected aircraft. London’s Heathrow airport was a notable exception among the group of incidents that did not lead to the same level of escalation.
The operational damage was real even though the threats were not.
That is the central problem facing aviation security teams now: a hoax can paralyze an air network without a single explosive device ever being present. Every false alarm consumes time, reroutes aircraft, pulls police and military resources into motion, and leaves passengers stranded while investigators try to determine whether the next message will be another deception or a genuine attack.
Suspicion Points Toward Moscow, But Evidence Has Not Caught Up
The synchronized nature of the threats, combined with a broader run of suspicious incidents across Europe, has driven immediate suspicion toward Russia in some quarters. Recent events have fed that interpretation: cyber-attacks, unexplained drone activity near sensitive sites, the remote hacking of supermarket freezers and a blood bank, a suspicious incident on Poland’s border with Russia, and a drone attack on Germany’s Leipzig Halle airport in August that the interior minister publicly blamed on Moscow. Against that backdrop, the airline hoaxes fit neatly into the pattern many observers already describe as hybrid warfare or grey zone warfare — operations designed to harm infrastructure and unsettle societies while remaining anonymous, deniable and short of the threshold that would trigger NATO’s Article 5.
Moscow has a clear political motive to unsettle European states that support Ukraine. Russian bloggers have gone further, arguing that if Ukrainian drones can threaten Russian airports and Western sanctions can block Russian airlines from European airspace, then Western nations should feel similar pressure. The logic is crude, but it captures the kind of retaliatory thinking that often surrounds this sort of campaign.
Still, motive is not proof. As of Thursday evening, no hard evidence linked the airline hoaxes to Russia, Iran, or any proxy group controlled by either state. In a field crowded with propaganda, imitation, opportunism and deliberate misdirection, attribution can become a contest of narratives before it becomes a question of facts.
The Rome Email and the Problem of False Signatures
One of the more concrete details emerging from the day’s disruption was an email threat sent to airport authorities in Rome and signed in the name of “Fighters of the Male State.” The label appears to refer to Muzhskoi Legion, or “Male Legion,” an ultra-right Russian group that was banned by a Moscow court in 2021 yet continued to attract tens of thousands of followers on Telegram after the full-scale invasion of Ukraine the following year.
Even so, the name on the message may be little more than a costume.
Hoax threats frequently borrow the identities of extremist groups, criminal networks or political causes precisely because they muddy the trail. An email signature can be planted, recycled, stolen or fabricated by anyone with enough technical skill and an appetite for disruption. For police and airport security officials, the problem is not whether a threatening message sounds plausible. The problem is whether it leads anywhere useful: an internet protocol address, a payment trail, a compromised account, a linguistic fingerprint, or a consistent operational pattern that can survive legal scrutiny.
Aviation Security Now Depends on Attribution, Not Assumption
The immediate challenge for national police forces, airport authorities and transport ministries is practical. They need to know how to respond to the next wave of threats without either overreacting to every malicious message or underreacting to the one that is real. In aviation, both errors carry serious consequences. An excessive response can shut down traffic, pull aircraft out of service and spread panic across a continent. A timid response can expose passengers and crews to a catastrophic failure in security judgment.
That balance depends on cold, hard leads rather than politically convenient guesses. Intelligence services will be combing through digital traces, message timing, sender infrastructure and any overlap with previous incidents. Airport teams will also be reassessing how quickly a threat can force a diversion, how consistently airlines apply threat protocols across borders, and how much room exists for coordinated deception to exploit differences between national systems.
A hoax does not need explosives to achieve strategic effect. It only needs to force authorities to behave as if the threat might be real.
For now, the most important fact is also the least satisfying one: the latest bomb threats caused immediate disruption across Europe, but the responsible actor — and the purpose behind the campaign — remains unproven. Without hard attribution, suspicion will continue to outpace evidence, and every new warning will sharpen the pressure on investigators to produce more than a theory.