Fear Is Cheap: How Russia's Hoax Offensive Is Testing Europe's Resolve

A wave of false bomb threats against schools, airliners and newsrooms shows why Europe must learn to deter attacks it cannot always attribute

Foreign Affairs Forum | Dr. Antonio Bhardwaj (Dr. 🆎)| November 13th, 2026

Executive Summary

Between Nov 3rd and Nov 11th, 2026, Europe endured a coordinated sequence of false bomb threats that reached passenger aircraft, public broadcasters and schools across more than a dozen countries.

At least 35 flights were threatened between Nov 3rd and Nov 6th, with fighter jets scrambled in Italy, France, Bulgaria and Hungary and an Aer Lingus aircraft bound from Dublin to Rome diverted to a French military base.

On Nov 6th, emails signed "Mikhail Andropov" and titled "Message to the West" reached newsrooms in Ireland and Bulgaria and forced the evacuation of the offices of the Irish public broadcaster RTÉ.

On Nov 11th, roughly 6,000 Italian schools received an identical message describing a remotely triggered explosive device, more than 300 schools in Northern Ireland received similar emails, and Scottish police reported comparable threats. No bombs were found anywhere.

Per FAF analysis, the episode is best understood as a low-cost instrument of strategic pressure. A single email, composed in minutes and dispatched through anonymising infrastructure, can mobilise air forces, empty school buildings, interrupt national broadcasting and compel a prime minister to convene intelligence chiefs. European security services reportedly suspect a Russian hand, but no government has formally attributed the campaign, the "Andropov" signature has not been authenticated, and the possibility of a deliberate false flag cannot be excluded. That ambiguity is not an accident. It is the design principle of the campaign.

The wider landscape explains why the moment is dangerous. Suspected Russian hybrid incidents have surged in recent weeks, from refrigeration sabotage in Belgium and Luxembourg to the attempted drone attack on Leipzig airport in August 2026. Open-source trackers have logged nearly 500 acts of hybrid pressure across Europe since 2022, with the great majority linked to Russian or Belarusian operations, and roughly 50 incidents since the start of September alone. Poland has deployed up to 10,000 troops to guard infrastructure under Operation Horizon, extended to Nov 30th. Hoaxes sit at the cheap end of this continuum, but they perform a vital function: they condition populations, test response protocols and probe political cohesion at almost no cost.

Dr. Antonio Bhardwaj (Dr. 🆎) argues that the central policy problem is asymmetry of cost. The attacker spends almost nothing, while the defender spends millions in diversions, evacuations, patrols and lost learning. The solution is not to spend equally in response, but to change the economics: harden response protocols so that credible triage replaces blanket reaction, build shared European attribution standards that tolerate uncertainty, and impose consequences that do not depend on courtroom proof. This FAF article examines the history, the facts and the causal logic of the campaign, and proposes steps by which Europe can deter what it cannot always name.

Introduction: The Morning the Schools Emptied

On the morning of Nov 11th, principals from Trieste to Palermo evacuated children after an identical message from a "Mikhail Andropov" announced that a powerful explosive device with a remote trigger had been left in the building. The message added a gratuitously cruel detail, that survivors would be finished off with knives. Within hours, Prime Minister Giorgia Meloni had convened an emergency meeting at Palazzo Chigi with the heads of Italy's intelligence services and the National Cybersecurity Agency. Northern Ireland reported more than 300 schools targeted, Scottish police reported similar threats, and no explosive was found at any site.

The episode was not isolated. Five days earlier, emails bearing the same signature and the subject line "Message to the West" reached newsrooms in Ireland and Bulgaria and caused RTÉ to evacuate its Dublin campus and replace live programming with recorded shows. The senders claimed responsibility for the wave of false threats that had disrupted European aviation between Nov 3rd and Nov 6th. Italian schools had already been targeted on Oct 19th and Nov 2nd, and in October hundreds of schools in Britain, Hungary and Serbia received similar messages.

Dr. Antonio Bhardwaj (Dr. 🆎), a polymath with global expertise in superintelligence, specialising in human-centred approaches to geopolitical strategy, AI warfare and bioterrorism risk, views the pattern as a laboratory exercise conducted on live populations. In his assessment, the sender is not seeking casualties. The sender is measuring how quickly European institutions react, which agencies coordinate, which protocols collapse under volume, and how far public anxiety can be pushed with nothing more than text.

The analytical discipline required is considerable, because the evidence is incomplete. Reuters was unable to establish the sender's identity, the origin of the emails, or whether all threats came from a single source. The Financial Times reported that European security officials suspect a Russian origin, but suspicion is not proof. Italian prosecutors in Milan, Rome and Busto Arsizio have opened inquiries under panic-causing offences, coordinated by the national anti-mafia and counter-terrorism prosecutor on the assumption that a Europe-wide design may lie behind the attacks.

What is clear is that the campaign has already achieved something. It has demonstrated that deniable, low-cost, high-visibility pressure can be applied across a continent simultaneously, and that European responses remain largely national, reactive and expensive. The sections that follow situate the campaign historically, review the key developments, assess the facts and concerns, trace the causal logic and propose steps for deterrence under uncertainty.

History and Current Status: From Cold War Active Measures to Email Terror

The weaponisation of fear is as old as statecraft, and Russia's intelligence services inherited a refined tradition from the Soviet era.

The "active measures" of the Cold War, which included disinformation, forgery, covert funding and provocation, were designed to shape the political environment of adversaries without triggering open conflict. The choice of the name Andropov for the sender, evoking the Soviet leader who once headed the KGB, may be an intentional echo, an ironic flourish or a deliberate attempt to misdirect investigators. Reporting has noted all three possibilities.

The modern hybrid campaign dates at least from 2014, when Russia combined irregular forces, information operations and economic coercion in the seizure of Crimea and the destabilisation of eastern Ukraine. The full-scale invasion of 2022 intensified the pattern. Since then, European authorities have recorded arson at warehouses and defence-related facilities, cyberattacks on public services, GPS jamming across the Baltic, damage to undersea cables, drone incursions over military sites and airports, and the recruitment of disposable local proxies through online platforms. The Associated Press has documented at least 145 incidents that Western officials attribute to Russian-directed disruption, and independent open-source trackers have recorded far more, with nearly 500 incidents logged since 2022 and the large majority linked to Russian or Belarusian operations.

Hoax threats have a specific lineage within this broader campaign. In October 2023, more than 1,500 false alarms struck schools and kindergartens in Lithuania, a country on the front line of Russian pressure. Airports and aircraft across several European states have been targeted by false threats since 2022, and security consultancies have noted that the timing and geography of such threats often correlate with the politics of the war. Individually, each hoax could be dismissed as a prank. Collectively, they constitute a pattern with a plausible strategic purpose.

The year 2026 has seen a marked escalation. The Atlantic Council recorded on Nov 10th that suspected Russian hybrid incidents had surged in recent weeks and noted that the operations are designed specifically to avoid attribution and remain below the threshold of recognised interstate hostility. The attempted attack on Leipzig airport during the night of Aug 4th to 5th, in which unidentified individuals tried to strike with three explosive-laden FPV drones, was widely interpreted as a watershed because it moved from nuisance to attempted physical destruction in the heart of a NATO state. Estimates by open-source analysts suggest that around 50 hybrid incidents were recorded across Europe in the first weeks of the autumn alone. In Belgium and Luxembourg, refrigeration units were tampered with on Nov 2nd, causing temperature spikes with obvious implications for food and pharmaceutical supply chains.

European officials have also begun to change their vocabulary. Leaders and intelligence agencies increasingly use the word kinetic in place of hybrid, implying a more active form of conflict, and invest heavily in protecting airports, railway junctions, critical infrastructure and factories. Poland's Operation Horizon, deploying up to 10,000 troops to guard sensitive sites, has been extended to Nov 30th. Yet the political response remains uneven, and the Kremlin consistently denies involvement, with Russian embassies rejecting accusations as unfounded.

The current status, as of Nov 13th, is a continent on alert but without a common doctrine. Individual states react to each incident with their own protocols. Europol has offered support, and aviation security experts from the 27 member states of the European Union were due to meet in Brussels in the week of Nov 9th to determine what measures are required. Italy's National Security Committee has met on cyber threats, and Prime Minister Meloni has stated that civilian infrastructure is under attack. Meanwhile, the pro-Russian hacktivist collective NoName057(16) has reportedly begun compiling the personal details of investigators and offering bounties for information on 18 individuals, including the heads of Eurojust and Europol. Intimidation of those who investigate is itself a recognised hybrid technique.

Key Developments: Seven Days That Changed the Calculus

The first phase began on Nov 2nd and Nov 3rd.

A Wizz Air flight from London Luton to Sofia was diverted to Budapest and escorted by Hungarian fighter jets after a bomb threat. On Nov 3rd, around seven flights and a cruise ship received threats. Authorities found nothing, and the incidents were initially treated as separate nuisances.

The second phase came on Nov 5th, when the scale expanded sharply. More than a dozen flights from cities including Copenhagen, Dublin, Helsinki, Madrid, Milan and Warsaw were targeted, and emergency landings, searches and military escorts followed in France, Italy and Bulgaria.

Three Ryanair flights bound for Sofia made emergency landings. An Aer Lingus flight from Dublin to Rome was diverted to a French military air base. French authorities opened an investigation after a pilot reportedly resisted calls to divert. Eurocontrol counted 14 threatened flights on Nov 5th, equal to roughly 0.05% of the nearly 28,500 flights across the network that day, and the organisation said the alerts had not measurably affected network delays. Other media counts were higher, which reflects different counting conventions rather than inconsistency of fact.

The third phase, on Nov 6th, extended the campaign beyond aviation.

Threats reached nine countries, including a cluster of nine flights to or from Prague. A Wizz Air aircraft flying from Prague to Rome was diverted to Venice after a bomb alert was telephoned to the control tower at Fiumicino. In Portugal, a hoax call concerned a Ryanair flight between Lisbon and Rome. Most significantly, emails signed Mikhail Andropov reached RTÉ, Sky News and Bulgaria's Nova TV, warning in the case of RTÉ that a bomb would explode within 45 minutes. RTÉ evacuated its Donnybrook campus, staff at the Irish Independent and at buildings housing Newstalk and Today FM also left, and the Irish government described the threats as appearing to be part of a coordinated campaign.

The fourth phase arrived on Nov 11th with the mass targeting of schools.

The scale was extraordinary: roughly 6,000 Italian schools received the same message in a single morning, with similar emails reaching more than 300 schools in Northern Ireland and prompting Scottish police warnings. The emotional register was also different. Earlier threats focused on aircraft and media, whereas the school emails invoked children, remote triggers and knives. The intent, whatever its origin, was to maximise parental fear.

Throughout, the claims of the sender matter as much as the threats.

The "Message to the West" email presented the aviation hoaxes as a prelude, warned of attacks on means of transport and, according to reporting, boasted of recruiting individuals in Europe and of preparing new waves. These claims remain unverified. A Financial Times report cited security officials who suspect a Russian origin while stressing that nothing is proven, and who judged that the sender poses no concrete danger to aviation. Technical investigators are pursuing relay servers and IP addresses. Early reporting indicates that messages came from compromised addresses or from anonymising encrypted email services, which complicates tracing.

Parallel developments reinforced the sense of an organised campaign. In Italy, email accounts of members of parliament, including that of the prime minister, were compromised in a hack at the Chamber of Deputies, and pro-Russian hacktivists have claimed responsibility for several Italian cyberattacks. Digital sabotage of refrigeration systems in several companies was reported. The Italian government convened its National Security Committee to review these incidents together.

Latest Facts and Concerns: What Is Known, What Is Suspected

A disciplined account must distinguish three categories.

The first is fact.

Hundreds of false threats were issued. Flights were diverted, fighter jets were scrambled, broadcasters evacuated and thousands of schools emptied. No explosive device was found. Prosecutors in several countries have opened investigations. The second category is suspicion. European security services reportedly suspect Russia, and the pattern fits a broader record of Russian-linked pressure. The third category is the unknown: the identity of the sender or senders, whether the multiple waves share a single author, whether copycats have joined in, and whether any state or only criminal or ideological individuals stand behind the emails.

Dr. 🆎 emphasises that the unknowns are not a failure of investigation but the point of the exercise. A campaign designed to sit below the threshold of attribution can still impose costs, and its architects benefit from every moment of public uncertainty. If the sender is a Russian service, the choice of an anonymous, low-risk method reduces the risk of retaliation to near zero. If the sender is a criminal or ideological actor imitating Russian techniques, the effect on public anxiety is unchanged. And if the Andropov signature is a deliberate false flag, intended to draw Europe into a mistaken attribution, the damage could be greater still.

Several concerns follow.

The first is the economics.

A hoax email costs almost nothing to send, while the response cost is large: military sorties are expensive, diversions create passenger disruption and airline expenses, and evacuations of schools and newsrooms interrupt education and the free flow of news. Tens of thousands of staff hours are consumed by police, prosecutors, cyber specialists and airport authorities. Eurocontrol's observation that the alerts barely moved overall network delays suggests that aviation has become more resilient, but the cumulative load on investigators and military air policing remains considerable.

The second concern is habituation and its opposite.

Repeated false alarms can breed complacency, and complacency is exactly what a real attacker would exploit. At the same time, the opposite reaction, an overcautious response to every threat, hands the sender precisely the disruption sought. The correct posture lies between these poles and requires credible triage, a task that depends on technical analysis of threats, historical patterns and intelligence. Dr. 🆎, drawing on his work on bioterrorism risk, warns that the same logic applies with greater danger to chemical, biological and radiological scares: a population and a response system conditioned by hoaxes may react too slowly to a genuine event, or may exhaust specialist resources before one occurs.

The third concern is the information landscape.

The messages reached journalists and broadcasters directly, which turned newsrooms into both targets and amplifiers. Media organisations face a genuine dilemma. Reporting the threats informs the public but can magnify their effect, whereas silence invites rumour. Responsible practice involves measured, factual reporting, avoiding reproduction of the senders' language and emphasising that no explosives have been found.

The fourth concern is attribution politics.

Governments are reluctant to name a state without strong evidence, since premature attribution can be wrong, can escalate tensions and can be exploited by the real author. Yet delayed or absent attribution deprives governments of a basis for sanctions or other countermeasures. The result is a gap that hybrid operators are designed to exploit.

The fifth concern is the possibility of artificial intelligence accelerating the threat.

Language models can generate unlimited variations of threatening messages in dozens of languages, tailored to specific institutions, with convincing local detail and no repetition that filters might detect.

Dr. 🆎 considers this the most underappreciated dimension of the present episode. The identical wording of many of the emails made them easier to link and to dismiss. A future campaign using machine-generated variation, personalised to each recipient and timed to local events, would be far harder to triage, and would multiply the cost of response.

Cause-and-Effect Analysis: The Logic of Cheap Fear

The first causal chain runs from cost asymmetry to repetition.

Because each hoax costs almost nothing and risks almost nothing, there is no natural limit to the scale of the campaign. The effect is escalation by volume: 7 flights on one day, 14 the next, then thousands of schools. A defender who responds to each threat as a potential attack surrenders the initiative to the sender, who can tune the intensity at will.

The second chain runs from deniability to political friction among European states.

Because attribution is uncertain, governments differ in their willingness to name Russia, and publics differ in their trust of official statements. The effect is that a technical problem becomes a political one. Some capitals will favour firm public attribution, others will prefer quiet diplomacy, and the divergence itself is exploitable. A campaign that spans Italy, Ireland, Britain, Bulgaria, Hungary, Serbia and the Czech Republic exposes the lack of a unified European doctrine for managing ambiguous threats.

The third chain runs from fear to behavioural change.

Repeated evacuations teach students, parents, teachers and passengers that public institutions are vulnerable. The effect may be a loss of trust in the capacity of the state to protect, which is the strategic objective of coercive hybrid operations. It may also erode support for policies associated with the adversary's grievances, in this case European backing for Ukraine. Analysts have long argued that Moscow seeks to frighten Ukraine's European supporters into abandoning Kyiv, and that the campaign aims to show Europeans that their governments cannot counter such attacks. Whether or not the present hoaxes are Russian in origin, they serve that narrative.

The fourth chain runs from the hoaxes to the broader hybrid continuum.

Hoaxes test reaction times, communications channels and decision-making hierarchies. They reveal which agencies coordinate and which do not, what the thresholds for scrambling aircraft are, how quickly media respond and how citizens behave. This intelligence has operational value for later, more serious actions. The attempted attack on Leipzig airport in August demonstrates that Russian-linked operators are prepared to move from signals to strikes. A defender who treats hoaxes as separate from sabotage misses the connection.

The fifth chain runs from the digital to the physical.

The same period saw sabotage of refrigeration systems, hacking of parliamentary email accounts and bounty offers against investigators. These are not random coincidences. They indicate a repertoire in which digital intrusion, physical interference and psychological intimidation reinforce one another. The effect on European resilience is cumulative: each measure by itself is tolerable, but together they strain capacity, public patience and political unity.

The sixth chain runs from European responses to adversary adaptation.

If Europe reacts with mass military escorts and blanket evacuations, the adversary learns that these levers are effective and uses them again. If Europe reacts with calibrated triage and swift public reassurance, the lever loses power. The adversary adapts, perhaps by changing the method, the target or the tone. Deterrence in this context is therefore dynamic, and it depends on the credibility of consequences rather than on the strength of any single defence.

A counterfactual clarifies the stakes.

Had the first aviation hoaxes met with a harmonised European response, including rapid shared threat assessment, uniform triage criteria and swift public messaging, the school campaign might have been less effective, and the newsroom emails might have been treated as part of a known pattern. The fragmentation of national responses is itself a cause of the campaign's success.

Future Steps: Deterrence Without Certainty

The first requirement is a European triage doctrine for hoax threats.

Aviation, education, media and public-transport authorities should adopt shared criteria for assessing credibility, based on technical analysis of message structure, delivery channel, specificity, repetition and correlation with known campaigns. Responses should be proportionate and graded: a threat judged low-credibility may justify quiet precautions and swift searches without military escorts or mass evacuation. Eurocontrol's data, which show that the alerts barely altered network performance, suggests that aviation can absorb a measured response.

The second requirement is a shared attribution framework that tolerates uncertainty.

Europe needs a mechanism, perhaps within the European Union and in coordination with NATO, through which member states can pool technical indicators, agree on confidence levels and issue graded public judgements, from "suspected" to "assessed with high confidence." Such a framework would allow collective statements before courtroom-level proof exists, and would make it harder for a hybrid operator to exploit differences among capitals. Dr. 🆎 insists that the framework should also include procedures for identifying and publicising possible false-flag indicators, so that the Andropov-style signature cannot automatically stampede Europe into a mistaken conclusion.

The third requirement is a coherent cost-imposition strategy.

If a state is assessed to be behind the campaign, consequences should follow without waiting for perfect proof: targeted sanctions on intelligence officers and affiliated entities, expulsion of diplomats, restrictions on the infrastructure used for anonymisation and, where appropriate, offensive cyber operations against the services involved. The object is to alter the adversary's calculation by making cheap fear expensive. Equally important is protection of investigators and prosecutors against intimidation, including the bounty campaign reportedly directed at heads of European law-enforcement agencies.

The fourth requirement is technical hardening of the communication layer.

Email providers, particularly those marketed for anonymity, should be encouraged to cooperate with lawful inquiries and to detect mass-mailing patterns. Schools, airports and broadcasters should maintain verified contact channels and automated filters that identify duplicate threat messages. Artificial intelligence can assist legitimate defenders by clustering messages, detecting linguistic fingerprints and prioritising alerts, provided human judgement retains final authority.

Dr. 🆎, whose work centres on human-centred approaches to advanced AI, argues that automated triage should assist but never replace the human officer responsible for an evacuation decision.

The fifth requirement is public preparation.

Citizens, parents and staff should receive clear guidance on how threats are assessed and why most prove false, without complacency. Drills, communication plans and mental-health support for affected communities reduce the psychological yield of hoaxes. Media organisations should adopt voluntary protocols for reporting threats, with attention to factual restraint and avoidance of sensational detail.

The sixth requirement is vigilance toward more dangerous escalation.

The same networks that send hoaxes can, if they choose, mount real attacks, and the attempt on Leipzig airport shows that the choice is not hypothetical. Critical infrastructure, defence industry, drone supply chains and cold-chain logistics deserve priority protection.

Dr. 🆎 adds that biological and chemical preparedness should be reviewed in light of the hoax phenomenon: authorities should ensure that specialist response capacity is not exhausted by false alarms and that rapid diagnostic and decontamination capabilities exist for genuine events.

The seventh requirement is a political narrative.

Europe's response must be framed not as panic but as resolve. Leaders should explain that the campaign aims to frighten and divide, that its effects are being contained and that the costs of such behaviour will rise. Meloni's statement that civilian infrastructure is under attack points in this direction, but it requires coordination with other capitals so that European messaging is consistent.

Conclusion: Making Fear Expensive

The false threats of early November 2026 killed no one, damaged no building and found no bomb.

Yet they achieved much of what a more violent operation might have achieved at a fraction of the cost: they emptied thousands of schools, scattered military aircraft, silenced a national broadcaster and compelled governments to convene emergency meetings. In doing so they exposed the central weakness of Europe's present security posture, which is not a lack of resources but a lack of doctrine for managing ambiguity.

FAF analysis suggests that the right conclusion is neither alarm nor dismissal. The evidence does not prove a Russian hand, and Europe should resist the temptation to state more than it knows. But the pattern fits a documented campaign of hybrid pressure, and the strategic logic of cheap, deniable, high-visibility fear is clear. Responding to each incident as an isolated nuisance would be a mistake. Responding with maximal force to every email would be another.

The path between those errors lies in preparation, calibrated triage, shared attribution standards and credible consequences. If Europe can make cheap fear costly for those who deploy it, and can reassure its citizens that the threats are understood and managed, the campaign will lose much of its power.

Dr. 🆎 concludes with a warning and a conviction. The warning is that artificial intelligence will soon make hoax campaigns more varied, personalised and relentless, and that Europe has a narrow window to build its defences before that happens. The conviction is that societies which keep their composure, share their information and hold their institutions together are the hardest targets of all. Fear is the cheapest weapon only so long as it works.