A wave of fake bomb threats has exposed less about who is attacking Europe than about how its defences are built

On Thursday, around fifty European leaders will gather in Dublin for the European Political Community summit, followed the next day by an informal meeting of EU heads of state. Irish police are preparing what the Taoiseach has described as the largest security operation in the history of the State. In the days before the summit, however, Ireland has been dealing with a quieter kind of pressure. Hoax bomb threats emailed to airlines across Europe were followed on Friday by threats against Irish newsrooms, including the national broadcaster RTÉ, whose staff were evacuated. The Irish government has said the incidents are likely part of a coordinated campaign of disruption.

No explosives have been found in any of the incidents. That fact should not be read as reassurance. It is the most important thing about the campaign.

A campaign that does not need a bomb

The pattern has widened steadily. On Friday alone, French authorities reported four further threats against aircraft flying over France, while flights to and from Lisbon, Rome, Prague and Sofia were also targeted. Some of the messages were more specific than a typical hoax, and several were sent in the name of a self-described Russian extremist group, which reportedly denied involvement. The Russian Embassy in Dublin has dismissed suggestions of a link, while Irish security sources, according to the Irish Examiner, regard Russian intelligence involvement as credible. Attribution remains unproven, and any serious analysis should leave it there.

What can be analysed is how the campaign works. A hoax reverses the usual cost relationship between attacker and defender. The sender spends almost nothing: an email, an anonymous account, a plausible level of detail. The defender has to treat each message as potentially real, which means diverting aircraft, evacuating buildings, deploying bomb-disposal teams and absorbing the economic and reputational costs. Ireland’s own pre-summit threat assessment, completed before the newsroom incidents, rated the likelihood of disruptive incidents such as cyberattacks, drone incursions and bomb threats as “substantial”, while rating the likelihood of a terrorist attack as low. In other words, the Irish state expected disruption rather than violence. Disruption is the objective, and it does not require violence to succeed.

The campaign also functions as reconnaissance. Every hoax that triggers a diversion or an evacuation shows the sender how quickly authorities react, which agencies are involved, how information moves between airlines, police and governments, and where the response slows down. Irish security services are already preparing for a possible escalation as the summit approaches. Whether or not escalation comes, the data collected over the past week has value well beyond this one event. A low-cost probe that reveals how a state responds under pressure is useful to anyone planning something more serious.

Ireland’s Justice Minister has said the authorities cannot halt everything over threats police assess as not credible. That is the right position, but it also describes the trap. Each threat must be judged individually, and each judgement carries risk: overreact and the campaign achieves its aim; underreact once and the consequences could be severe. The campaign works by placing a constant tax on official judgement, and that tax rises as a high-profile event approaches.

Why Ireland

The choice of target is unlikely to be accidental. Ireland currently holds the rotating presidency of the Council of the EU and is hosting this week’s gathering of the European Political Community. It is also, arguably, the thinnest point in Europe’s security fabric. Ireland has the lowest level of defence spending in the EU and has been criticised for lacking the capability to monitor waters that its own maritime strategy describes as a nexus of transatlantic data cables and energy interconnectors. The 2021 Commission on the Defence Forces concluded that the Defence Forces could not defend the state. Dublin has since raised defence investment to €1.7 billion under its 2026–2030 plan, a substantial increase, but from a very low base.

Irish debate on these questions tends to reduce to a binary choice between neutrality and NATO membership. The hoax campaign suggests that framing misses the operative variable. Hybrid pressure does not distinguish between states by treaty status; it looks for weak capacity. Mark Mellett, former Chief of Staff of the Irish Defence Forces, has made the point directly: the country is militarily non-aligned, yet “absolutely involved in a hybrid war”. Neutrality defines Ireland’s legal relationship with alliances. It does not reduce its exposure to coercion below the threshold of armed conflict.

The maritime dimension shows how this weakness affects others. In February, Dublin published its first maritime security strategy, committing to strengthen radar and subsea surveillance and deepen cooperation with NATO neighbours, an implicit acknowledgement that it cannot monitor its own surrounding waters alone. The cables and interconnectors in those waters serve the wider European economy, not only Ireland. A gap in Irish capacity is therefore a gap in European capacity, located in Irish territory. The hoax campaign belongs to the same category of problem: it targets a national system, but what is ultimately being tested is a European one.

Hosting a summit also concentrates political value in one place. Disrupting the host sends a message that goes beyond Ireland: that Europe’s discussion of its own security, which an Irish MEP noted is the focus of this week’s summit, can be disrupted cheaply at whichever venue is least prepared.

A collective problem met with national responses

The response so far has been competent but mostly national. Irish police are working alongside military, cyber and aviation authorities and European counterparts. At EU level, Transport Commissioner Apostolos Tzitzikostas has activated aviation security information-sharing mechanisms while saying it is too early to determine whether the incidents are linked. Information-sharing is necessary, but it is not a response. The campaign has crossed multiple jurisdictions, targeting flights across several member states as well as media organisations, while the reaction remains organised incident by incident and state by state.

This mismatch reflects a deeper structural gap. Europe’s collective tools against hybrid activity, from diplomatic expulsions to sanctions, generally depend on a degree of attribution confidence that campaigns of this kind are designed to avoid. The threats are anonymous, deniable and individually minor. Each one falls below the level that would justify a collective political response, while the combined effect accumulates across the continent. A defence architecture made up of national systems linked by information-sharing allows an adversary to choose which link to test. Low-capacity states become points of entry not because they matter most in themselves, but because they host shared infrastructure, shared institutions and, this week, a shared summit.

There is an irony here. When the European Political Community was launched in 2022, a speech delivered on behalf of the EU’s foreign policy chief described part of its purpose as building a community of resilience against increasingly hybrid threats. Four years later, the forum is meeting under the very kind of pressure it was meant to help members resist collectively, and the response still largely depends on the capacity of the host state. European security is on the agenda in Dublin. The more useful discussion would be about the specific gap the past week has exposed.

What Dublin should take away

None of this is an argument that Ireland should abandon military non-alignment; that is a democratic choice for Irish voters. The case is narrower. Resilience against hybrid disruption is a collective good, and Europe currently provides it as though it were a national responsibility. Three adjustments would narrow the gap. First, transnational hoax and disruption campaigns need a standing joint assessment capacity able to establish patterns across borders within hours rather than weeks. Second, the security of EU-level events should be treated as a shared burden, with pooled resources directed to the host, rather than as a national task performed on behalf of everyone else. Third, Europe needs ways of imposing costs that do not depend on full public attribution, focused on the infrastructure that makes anonymous campaigns cheap to run.

If Thursday’s summit passes without incident, it will be presented as a success, and operationally it may be. But that is the wrong measure. The campaign does not need to disrupt the summit to succeed. It needs Europe to continue treating each hoax as a local policing matter and each vulnerable host as a national problem. On that measure, the outcome in Dublin is still undecided.

With information from Reuters.