Adnkronos (Adnkronos) – What we've seen so far of the hybrid war against Europe risks being just a taste. Hostile actors (Russians, Iranians, Chinese, North Koreans, plus a host of other unspecified entities) possess the capabilities necessary to seriously undermine entire systems on which the functioning of our societies depends: healthcare, transportation, telecommunications, energy, logistics.
Speaking only on the Russian front, the attacks that have multiplied in recent years suggest that Moscow is constantly and progressively testing Western red lines, seeing how far it can go without provoking a significant response.
The problem is that Europe continues to think primarily in terms of resilience.
Protecting infrastructure, preparing for emergencies, reducing damage, continuing to function even under attack. All essential, of course. But insufficient. Learning to take hits better doesn't mean convincing your adversary to stop attacking.
According to a security expert with decades of experience, interviewed by Adnkronos, the attacks of recent weeks require a change in mentality, even before a change in strategy.
Stop viewing every possible countermeasure as a risk of escalation and recognize that escalation is already underway, even if Europe has done little to fuel it. A war can be fought by one side alone, if the other side wants to pretend it's not involved. But that doesn't protect it from the consequences.
The question is to move from the only
deterrence by denial
, that is, making the attacks less effective, to a credible
deterrence by punishment
: making the adversary understand that certain attacks will entail costs greater than the expected benefits. Without sacrificing prudence, proportionality, and respect for the law, but without turning the fear of escalation into a constraint that ultimately paralyzes any response.
And the tools are not lacking. From economic sanctions to asset freezes, from counterintelligence operations to identify and dismantle Russian and pro-Russian networks to military signaling measures. All the way to offensive cyber capabilities and covert operations, traditionally part of the arsenal of states, to be carried out within the limits established by law.
It's not a matter of responding indiscriminately to every provocation, but of building a credible scale of countermeasures. With a very concrete goal: to change the cost-benefit calculus of those who decide to attack Europe.
The real obstacle, according to those familiar with the matter, is the political will to use these tools—and convincing the adversary that they're ready to do so.
The events of recent days help us understand how vulnerable European societies are.
An email costs nothing; sending it to thousands of schools takes just a few minutes. The consequences, however, can be dire: students evacuated, parents forced to abandon work, bomb squads and law enforcement mobilized, classes interrupted, roads blocked, cities on high alert.
On the second day of this wave, despite over 3.700 emails being sent, only 77 schools allowed students to leave, and half resumed classes after police checks. The government's move to avoid "automatic" evacuations deprived the perpetrators of the threat much of the gain they were seeking. But it also demonstrates the limitations of a purely defensive approach: the system has learned to better manage the emergency, without necessarily reducing the ability or willingness of those who caused it to try again.
In recent weeks, Europe has experienced an almost surreal array of attacks and intimidation.
False bomb threats affected dozens of flights, some of them bound for Italy. On November 3, two Italian Air Force Eurofighters were scrambled to escort a Ryanair plane from Dublin. Two days later, another barrage of threats.
Then there are refrigerators. In France, a cyberattack manipulated the refrigeration systems of approximately 700 supermarkets, raising temperatures, spoiling food, and, in some cases, starting fires. It also affected blood storage equipment in hospitals. Similar attacks have occurred in several European countries, yet Italy was only marginally affected. This was partly due to better-protected systems and partly due to preventive measures by the National Cybersecurity Agency, which had already issued a technical alert to industry operators on October 13. Director General Andrea Quacivi confirmed to TG1 that the Agency had informed operators.
France attributed the October attacks to a cyber unit of the Iranian Revolutionary Guards, while responsibility for subsequent attacks has not yet been established. As for the emails that terrorized schools and airports, there is so far insufficient public evidence to link them to Russia. The signatures, often grotesque, and references to Russian or Islamist organizations prove nothing. And it cannot be ruled out that mythomaniacs and copycats are also contributing to the destabilization strategy.
Not everything is managed by the same mastermind. However, it's clear that different actors have discovered the same vulnerability: European societies are extraordinarily complex, interconnected, and therefore exposed to even the slightest disruption.
And if today it is possible to achieve these results with relatively simple means, it is legitimate to ask what the consequences would be of more sophisticated, coordinated and intentionally destructive operations.
On a broader level, the picture is ambiguous only for those who don't want to see it. For years, Russia has been waging a campaign of sabotage, interference, cyberattacks, and clandestine operations against European countries. This isn't the reconstruction entrusted to some particularly alarmist analyst: it's the European Union's official assessment.
A report by the International Institute for Strategic Studies, published in August 2025, traced the growth of Russian sabotage operations against European infrastructure since 2022. One recurring problem remains: Western states' difficulty coordinating responses capable of deterring further aggression.
It's a conflict waged below the threshold of conventional warfare, designed to wear down a society: to consume its resources, attention, and trust. To force institutions to continually respond to emergencies both large and small, each seemingly insufficient to justify a meaningful response.
There's also a cultural misunderstanding to overcome. In Europe, we're accustomed to thinking that a war begins with an official declaration, or at least when the first bombs are dropped. But the fact that one side doesn't consider itself at war doesn't prevent the other from conducting hostile operations.
And there's the risk of a second mistake: attributing the same categories to our adversary. Assuming, for example, that Moscow shares our reluctance to escalate or that it interprets Europe's caution as a sign of moderation to be reciprocated. This isn't necessarily the case. A systematically weak response can be interpreted as an invitation to push things a little further.
It is a problem that a part of the international strategic community is facing with growing concern.
In an analysis published by the European Policy Centre, Juraj Majcin and Jannik Hartmann argue that Europe must strengthen deterrence by imposing costs on Russia. A strategy focused almost exclusively on the ability to absorb attacks risks leaving Moscow the option of proceeding in small steps, accumulating advantages without ever crossing a threshold that would trigger a decisive response.
And in fact, European deterrence, based largely on resilience and regulatory tools, has not been enough to contain Russian hybrid operations.
The problem of attribution, often invoked as an insurmountable obstacle, is also real but not absolute. Before France and the Iranians, there was Germany, which accused Russia (one of the alleged perpetrators had an Italian tourist visa...) of placing explosive drones at Leipzig Airport, where cargo planes bound for Ukraine departed.
The need for solid evidence remains crucial. Mistaking the target, or adopting disproportionate countermeasures, would undermine the credibility of deterrence itself.
The issue is not new in Italy. On November 17, 2025, Guido Crosetto presented a document entitled "Countering Hybrid Warfare: An Active Strategy" to the Supreme Defense Council. Among the proposals were the definition of a cyberspace of national interest, the creation of a civilian and military cyber arm and a reserve of specialists, as well as coordination structures dedicated to countering hybrid threats.
A year later, the school bomb scares have demonstrated how complicated it still is to translate strategic awareness into uniform operating procedures. The measures adopted by Palazzo Chigi quickly corrected the initial response, but the broader problem remains.
Brussels also has no shortage of tools. The European Union has already introduced a specific sanctions regime for Russian hybrid activities and, in its strategy, explicitly includes both deterrence through resilience and deterrence through cost-based deterrence. It's not that Europe hasn't considered a response. Yet, despite these tools, hostile operations continue. And it's legitimate to question whether Europe's ability to deter its adversary is up to the threat.
The missing step isn't just legal or technological. It's political and strategic: deciding what behaviors cannot be tolerated, what consequences they must produce, and who is willing to take responsibility for enforcing them.
Finally, there's one aspect that makes this season particularly dangerous. When attacks become routine, they risk becoming normalized. We become accustomed to threatening emails, diverted flights, and disrupted services. We learn to live with them. This is precisely the terrain on which hybrid warfare can thrive: a succession of episodes that seem bearable when observed individually, but which, taken together, deplete a country's ability to respond.
With an additional risk. What is a false alarm today could become a full-blown sabotage tomorrow, perhaps against an infrastructure on which thousands of people depend. And the countermeasures prepared for the former aren't necessarily sufficient to address the latter. Europe can't afford to wait for something much more serious to happen before recognizing the nature of the threat. It must certainly become more resilient, but also more capable of deterrence. Because an adversary that doesn't fear consequences can be emboldened to strike again, and harder.
Italian schools have demonstrated that it's possible to learn not to be paralyzed by an email. This is significant progress. But deterrence begins a step further: when the person on the other end of the computer has to worry about the consequences.
policy
webinfo@adnkronos.com (Web Info)