No bomb, and that’s no coincidence: there isn’t meant to be one.
Schools on October 19 and November 2, planes on the 3rd, 5th and 6th, newsrooms in Dublin on Friday.
Whoever is sending these fake alerts isn’t trying to terrorize us: they’re doing to Europe what, in cybersecurity, is called a penetration test. Knocking on one door at a time to see who answers, how long it takes, and who gets notified.
The clues are in the details. On November 2, the emails reached hundreds of schools, many of which were closed for All Souls’ Day: whoever is writing doesn’t care who reads them, only that people start talking.
The signatures change with each wave, from Sharia to a misogynistic movement that Russia itself has outlawed.
A real group wants its name in the papers; whoever is running a test does not. And according to early reconstructions, some of the messages were sent from compromised email accounts.
Somewhere, perhaps, there’s a company, a law firm or an office that sent a bomb threat to an airport and doesn’t even know it yet.
What are they measuring?
How quickly we react: every fighter jet that scrambles reveals bases, response times, chains of command.
How well we talk to each other: every hour that passes before one country realizes the same email landed in another goes straight into the notebook. And how scared we get: every live broadcast listing flights and diversions becomes the test report, delivered for free. The danger isn’t the bomb that doesn’t exist — it’s the map of our reflexes ending up in someone else’s hands.
And the latest email has already pointed to the next target: trains and subways.
Asking who’s behind it serves little purpose, because the operation is designed precisely so that no answer ever arrives.
When one does arrive, as happened with the Czech and Slovak schools in 2024, it leads to an alleged perpetrator who, according to Prague’s intelligence services, was in all likelihood paid by Russia.
If you can’t punish the attacker, you have to make the attack pointless. That means assessing threats in minutes instead of evacuating on reflex, as Heathrow and Birmingham did when they judged the threats not credible and stayed open.
It means pooling the evidence, because the same email landing in three hundred inboxes is just noise. And it means reporting the news without turning it into a scoreboard.
Then there’s the golden rule of every stress test: start where it costs the least.
An airport has bomb squads, protocols and fighter jets ready within ten minutes. A company with ten employees has an info@ address and someone who opens everything.
For the attacker, these are just two lines on the same spreadsheet: the first is the target, the second is the means of reaching it.
The same logic applies to countries.
San Marino sits outside the European coordination network, which brings together EU member states, yet it has schools, public offices and a broadcaster with addresses published online just like anyone else.
On the other hand, it’s small enough to decide things in ten minutes: a single number to call, a single assessment, a single voice speaking. All it needs is a direct line to those in Italy who are seeing the same emails at the same moment, and a bit of discipline — because here, a rumor can spread across Facebook groups before anyone has even opened their inbox.
There are two ways to be small: someone else’s testing ground, or the place where the test fails. Better to decide which one before they come knocking.
Osservatorio Strategic
