There was a game on Puzzle Week which only required a pencil and a little patience. A page littered with numbered points, apparently without any relation to each other. It was enough to connect them in the right order and, little by little, a figure appeared. You could make a mistake in two ways: by stopping too soon or by convincing yourself that you had recognized the drawing when half the connections were still missing. In the latter case we ended up adding some lines on our own initiative, with results that were not always appreciable. For some time the European news seems to be offering us a similar exercise. With a complication: in reality recognizing a figure does not necessarily mean having identified who held the pencil. So let’s see what dots we’re talking about.
First. In November 2025 two sabotages hit the Warsaw-Lublin railway line, in Poland. An explosion damages the tracks, another intervention compromises a section of the infrastructure. The Polish government attributes the operations to people who acted on behalf of Russian services. Here we are far from the virtual world: the damage is material and the risks for passengers are absolutely real. However, the case has the interesting feature of jeopardizing a rail network without destroying it. It may be enough to intervene on a relatively small segment, perhaps in a particularly delicate point, and the rest is done by the system’s interdependencies. After all, a train can be perfectly functional and not go anywhere.
Second. Interference with satellite signals is multiplying in the Baltic and other European areas. During 2025, the episodes of jamming And spoofing which, for those who are not familiar with these terms, refer in the first case to someone disturbing the signal and in the second falsifying it, making the system believe it is receiving correct information. In March 2026 EASA and EUROCONTROL publish a joint plan to address the problem. This issue deserves attention because it introduces a particularly insidious variant of sabotage. You don’t necessarily need to hit an airplane or damage its instruments. It may be enough to compromise the reliability of the information on which part of your browsing is based. The machine continues to work, but it has to deal with data it can no longer trust.
Third. Social tensions have a second life on the Internet. In June 2026, after violent riots in Belfast, the British authority Ofcom warned digital platforms about the risk that content spread online would fuel further violence. In September, videos generated by artificial intelligence circulated in several European countries showing demonstrations that never happened. In October, France and Italy witnessed demonstrations that turned into looting and chats appeared on social media making appointments. Different situations, but which suggest a common consideration: to fuel a fire it is not necessary to start it because sometimes it is enough to blow on the flames. With new technologies we can even do something better: not only exploit the first spark, but also show images of a fire that never existed. The advantage is that while some are struggling to verify whether it is true, others have already begun to worry about the consequences.
Fourth. Between October and November 2026, someone manages to access the control systems of refrigerated systems and changes their temperatures. The result is rather prosaic: food to be thrown away, economic damage and supermarkets in difficulty. The episodes affect France, Italy and numerous other European countries. The Pentagon is investigating similar incidents that occurred in August in supermarkets on some American bases, without a connection being proven. Again the interesting detail is the relationship between the medium and the effect: the refrigerator is not destroyed, it does not catch fire (maybe just a little) and it does not necessarily stop working. Just keep following orders, too bad they come from the wrong person. It is a form of sabotage that has very little that is spectacular, but it is so out of our common sense that it scares us quite a bit.
Fifth. In the first days of November, a barrage of emails containing bomb threats led to diversions, checks and military interventions on numerous European flights and the intimidation also reached some television stations. Here we encounter an even different phenomenon: it is not necessary to hack a computer system, sabotage an infrastructure or falsify a satellite signal, but it is sufficient to send a message credible enough to force someone to activate the security procedures and mind you, those procedures must work. A threat cannot be ignored just because it might be false. Here’s the paradox: the message may be false, but the consequences are absolutely true. The cost of sending an email is negligible; that of a plane forced to change route, of extraordinary checks and of mobilized personnel is decidedly less so.
Now let’s try to connect the dots. Have we identified a single strategy, perhaps attributable to a common direction? We don’t know and it would be a mistake to say so simply because not every social disorder is an organized provocation, not every sabotage is an intelligence operation and not every threat constitutes an act of hybrid warfare. Furthermore, it would be equally incorrect to label everything a cyber attack. In the cases we have examined, information manipulation, physical sabotage, radio interference and intrusions into digital systems coexist. The differences are substantial, as is the question of attribution of responsibility. On this point, prudence is not a form of timidity, but a necessity.
However, if we give up for a moment on looking for a common hand, we can observe something equally interesting: the way in which our societies can be challenged through limited interventions on systems on which much larger activities depend. We have built a world in which physical infrastructures, digital technologies and organizations are linked by an increasing amount of relationships that produce efficiency, but also distribute fragility. A relatively small problem can spread far beyond where it occurs, and I promise that’s nothing new to security people, but it becomes a different matter when someone decides to deliberately exploit this feature.
Then there is a second element, perhaps even more insidious. Some of the actions described do not attempt to prevent defense systems from functioning. On the contrary, they rely precisely on their correct functioning. A bomb threat must be evaluated, an unreliable navigation signal requires precautions, a credible threat activates procedures that involve people, resources, time and money. In other words, you don’t necessarily need to overcome your defenses when you can get them to work continuously. If episodes repeat themselves, organizations end up consuming increasing resources in managing emergencies that often do not materialize. At this point the most difficult problem arises: by dint of receiving alarms, human beings risk getting used to them. After ten false reports, the eleventh could be greeted with a certain intolerance, unfortunately it could be the authentic one. This creates a trap: responding to everything means risking attrition, stopping responding means exposing yourself to potentially worse consequences.
This is one of the dynamics I describe in my book Widespread wars. Destabilization can affect the daily life of formally at peace societies, without it being necessary to identify an immediately recognizable front, army or even aggressor. The point is not necessarily to destroy something, but to compromise its functioning, alter its information or force organizations to continuously commit their resources to deal with emergency situations. From this perspective, the result does not necessarily have to be a collapse; a progressive deterioration of efficiency, accompanied by ever-increasing costs and growing uncertainty, may be enough. A form of attrition which, unlike others, has an advantage for those who wish to practice it: the victims cannot simply decide to stop defending themselves.
All this brings us to the real problem, which is less about technologies than one might imagine. We are used to thinking of security as the ability to prevent something unwanted from happening. It is an understandable vision, but it is now insufficient because we also have to worry about how to continue to function when something goes wrong, when information is unreliable or when emergency procedures are continually called upon. It means designing systems capable of operating even in degraded conditions, foreseeing truly independent alternatives and building organizations that are able to distinguish priorities without losing the ability to react. Technology can help, but not replace decisions. Indeed, the idea that adding some automation is enough to solve the problem risks giving us new alarms to manage.
Finally, there remains an issue that crosses all five points: trust. The one in the news we read, in the systems that guide us, in the machines that preserve our food, in the infrastructures we use and in the alarms designed to protect us. A complex society works because millions of people, every day, take for granted that an enormous amount of things do what they are supposed to do. When this belief is lost, the damage can go far beyond that caused by a single incident because trust, unlike software, does not have a particularly rapid recovery procedure.
Let’s go back to our page then Puzzle Week. In the game we could afford to wait until the last number to discover the figure. In reality we cannot afford this luxury, but neither can we add lines where they do not exist. It would be a mistake to confuse a similarity with evidence, just as it would be imprudent to ignore what the episodes have in common just because we don’t know if they are connected. We may not know who is holding the pencil, but we already have enough elements to understand which sheet of paper he is drawing on. Connecting the dots doesn’t mean inventing an enemy, but taking note of our fragilities before someone decides to turn them into a weapon.
