Investigators see no sign yet of hostile-state or terror-group orchestration
Hoax bomb threats disrupted at least 25 commercial flights across Europe on Thursday, with some forced to make emergency landings, after a similar wave on Tuesday in which seven planes were searched or diverted following malicious alerts. The actors behind the week of disruption — whether hostile states, criminal gangs or even enterprising teenagers — have yet to be identified, but the briefing judged it certain that they operate amid deepening global conflicts, a building national threat and a pervasive sense of vulnerability. Investigators said there is so far no suggestion that a hostile terror group or state actor orchestrated the flight threats, although investigations continue.
Dan Sabbagh, the Guardian’s defence and security editor, noted that airlines “receive bomb threats on a daily basis, at a rate that we would find extraordinary if we knew”. He said it is perfectly possible this week’s alerts could be the work of some lone disruptors. Still, aviation experts told the Guardian on Thursday that the carriers’ decision to treat the alerts as credible suggests a potential level of coordination. Attention to aviation security has sharpened since the flydubai incident, in which a pilot fought off his knife-wielding colleague in an apparent attempt to crash a full passenger flight bound for Tel Aviv.
The alerts came in a week already marked by cyber-disruption. Supermarket fridges and freezers in seven European countries malfunctioned earlier this week after their thermostats were remotely cranked up — in some cases to 50C — in what some fear indicates a new front in hacking tactics. The briefing listed supermarket refrigeration in Belgium, Sweden and the United Kingdom among the targets, and described the attacks on the cold storage facilities of France’s national blood service, which store blood products, as “a sinister but not immediate threat”. In Britain, the Guardian’s global technology editor, Dan Milmo, interviewed a fruit-and-vegetable wholesaler near Heathrow whose fridges failed on Monday.
Milmo said there are “only ever two likely candidates for a hack”: “criminal gangs or nation states” — plus an emerging third category of “troublesome teenagers”, such as Scattered Spider, the loose collective of English-speaking hackers two of whose members were jailed in July for their attack on Transport for London. One cybersecurity researcher who examined attacks on dummy Danfoss fridge controls — one of the software systems also targeted by the hackers in mainland Europe — told Milmo they carried “all the hallmarks” of operations linked to Russia.
The briefing places such activity in the “grey zone” — the ambiguous space between routine peace and conventional military conflict, where proxies duck state accountability and cyber-tactics are developing at an alarming rate. Beyond that “jittery background noise”, it argued, lies a significant step-change in the manner of threat. Twenty-five years after the inception of the War on Terror, Sabbagh said, Islamist terrorism has receded relative to hostile-state threats: “we’re living in a different world with familiar uncertainties, but attributed to different players.”
Conflicts in Ukraine and the Middle East are reverberating closer to home. Since 2022, acts of sabotage against European states believed to trace back to Russia have intensified, deliberately falling below the threshold for a military response — a so-called hybrid or “shadow war” aimed, the Guardian reported, at disrupting support for Ukraine. Two months ago, an alleged attack plot on RAF Fairford was organised by a handler police believe was working on behalf of Iran.
“Terrorism doesn’t have to be violent to terrorise,” Sabbagh said. “The purpose of terrorism is to scare.” The tech expert Azeem Azhar has warned recently that the internet is experiencing its own “Wuhan moment”, as artificial intelligence enables bad actors to hunt for system flaws and spread them, mirroring the early days of the Covid pandemic.
British security agencies have treated technological resilience as a key responsibility for several years, Sabbagh said. “There is a very real and intense cyberwar going on out there,” he said. The Turing Institute, for example, is examining ways to use AI to make critical infrastructure systems more secure. The police and security services are monitoring for threats all the time — MI5 currently has about 3,000 active subjects of interest, arranged in a hierarchy weighted toward the most serious cases, including threats to life. Lower-level activity that is not obviously threatening — from online behaviour to buying paint intended for racist graffiti — is harder to pick up, a constraint the briefing framed as a resourcing question.
Aisha Down, the Guardian’s global technology reporter, said many intrusions occur through “edge devices” — networked items connected to the internet that lack processing power and so are not the main focus of security upgrades by companies or households. In 2016, North Korea came within a few keystrokes of pulling off a billion-dollar heist by hacking the Bank of Bangladesh via an unsecured printer.
Down urged perspective on the risk. Every cyber-attack is opportunistic, she said: a hacker must first find a vulnerability and then discover a way to exploit it. “Just like a burglary, you might get into the room where all the jewellery is stored, but the damage you can do is not a given,” she said.
The threat is nonetheless escalating steadily. Down cited Finland, which watches cyber-tactics closely given its proximity to Russia: reports to its national cybersecurity centre rose from 18,000 last year, for a population of 6 million people, to 21,000 this year — an increase traced partly to a developing criminal hacking ecosystem, some of it loosely linked to the Russian state. She suggested balancing the likelihood of a cyber-attack against its potential scope. One European cybersecurity official told Down there is a vulnerability in every 1,500 lines of code, on average. The official’s assessment: “it’s going to happen. It’s going to be opportunistic. But, unlike bombing a power station in the dead of winter, you won’t be offline for months.”
A key element of a cyber-attack is its psychological impact, something the briefing noted can be hard to square with the UK government’s Be Ready initiative, which advises households to stockpile 72 hours’ worth of emergency supplies — including water, beans and, in Andy Burnham’s case, Twiglets — to offset threats of hybrid warfare and hostile-state sabotage. Governments across Europe are advising citizens to build up non-perishable stores. “If you’re a government wanting to spend £10bn more on defence by the end of the decade, it’s useful to have that message about keeping a few bottles of water at home,” Sabbagh said — while making clear he was not dismissing the stockpiling advice as purely cynical, given that the developing threats are real. “If the purpose of terrorism is to generate fear, the first thing you should do is not panic and keep calm,” he said.
The briefing’s other headlines: Russell Brand has been found guilty of raping a woman and sexually assaulting three others over the course of five years of his show-business career. Donald Trump signed a proclamation that he says will prevent future administrations from changing his design of the Oval Office and Cabinet Room, spaces he declared as national monuments that should be preserved. Andy Burnham said he wants to “recast” the UK’s deal to cede control of the Chagos Islands after resistance from Washington. Cancer diagnoses in England have hit record highs, with more than 1,000 people a day diagnosed, according to NHS figures. And the UN-recognised government of Yemen has shaken up its political and military leadership in an attempt to regain territory lost to the Houthis in September.
The Guardian’s front page on Friday carried “Brand faces ‘significant’ prison term for rape and sexual assault”. The Times went with “Brand found guilty of rape”, the Telegraph with “BBC ‘enabled’ rapist Brand”, the Sun with “Rapist”, the Mirror with “Justice”, the Mail with “Downfall of the swaggering sex predator fawned over by the Left” and Metro with “Rapist Brand caged”. Elsewhere, the i Paper led on “Godfather of AI warns humanity: it’s all hurtling out of control” and the FT on “Tech stocks plunge as investors worry blue wave will sink AI spending boom”.
On the briefing’s reparations item, Andy Burnham has asked countries affected by Britain’s role in slavery to help shape a formal apology through a “structured dialogue”. During the prime minister’s visit to the Commonwealth heads of government meeting in Antigua and Barbuda, Downing Street said affected countries would play an indispensable role in crafting an enduring message. The plans for talks were received positively, but the British government is still ruling out paying reparations — an idea campaigners have been calling for for decades.
In sport, Sunderland’s unbeaten run in the Europa League came to an end as they were beaten 2-0 by Dinamo Zagreb at the Stadium of Light, while Celtic got off the mark in a 3-2 victory over Besiktas. In rugby union, Tom Curry has emerged as a major doubt for England’s autumn opener against Australia on Sunday, handing Steve Borthwick a huge blow before a crucial November campaign. And in football, Cristiano Ronaldo has announced that he will not play for Portugal any more, ending an international career that spanned six World Cups and included a European title and the men’s all-time scoring record.
The briefing’s critics’ roundup also flagged Jonathan Jones’s five-star review of “Constantinople to Istanbul” at the Victoria and Albert Museum in London, an exhibition of tiled portraits and handmade robes showcasing the colours of the Ottoman and Byzantine empires; Peter Bradshaw’s four-star review of “I Play Rocky”, in cinemas now, in which Sylvester Stallone stars as himself; Rachel Aroesti’s four-star notice for the Netflix drama “Black Doves”, with Keira Knightley returning as Helen Webb, an undercover spy who is also a mother, wife to the prime minister and best friend to a hitman; and Keza MacDonald’s five-star review of “The Legend of Zelda: Ocarina of Time”, which returned to Nintendo screens this week in better definition and with fully voiced cutscenes.
Also inside the briefing’s reading picks: in AD43, the Roman emperor Claudius invaded Kent after being persuaded by a British “king” — a ruler an archaeologist now claims was in fact a queen, the subject of Nicola Davis’s article on the controversy.
In the Guardian’s Upside slot, the briefing highlighted 101-year-old Celia de Oliveira Soares, one of more than 1 million elderly people who voted in the runoff after missing the first round of the election. On 25 October, as Brazil held its presidential election, Soares left home for the first time in months to vote for the first time in nearly a decade, determined that Luiz Inácio Lula da Silva — who had lost in the first round — should beat Flávio Bolsonaro, the candidate the briefing described as far-right. Since Brazil’s return to democracy in the 1980s, no first-round loser has ever bounced back; but 3 million extra voters took part in the second round after skipping the first, and 1.4 million of them were over 70 years old. The victorious Lula, along with many others, is now hailing elderly voters as the election’s heroes. “It is possible to resist fascism — all you need to do is mobilise society,” the former minister Simone Tebet said. “Young people hit the streets and golden-agers saved our democracy.”