'Credible' that Russian intelligence behind airline hoax bomb threats

Cork Airport reported it received an anonymous phone threat about a specific flight and adopted a security response in conjunction with gardaí, leading to a 90-minute delay. Picture: Larry Cummins

Security services assess as “credible” that Russian intelligence was behind airline hoax bomb threats and supermarket cyberattacks that caused chaos across Europe, the Irish Examiner understands.

The assessment is understood to estimate that there is a roughly 80% likelihood of Russia’s involvement, with the other 20% that it could be the work of hackers or a group doing it for fun.

But sources stress that without actual evidence, such hybrid attacks provide perpetrators with “plausible deniability”.

Irish security services are keeping a close watch on developments as they update their threat assessment for next week’s major political events in Dublin.

The European Political Community summit is being held on Thursday, with 55 heads of state visiting Ireland, including, it is expected, Ukraine president Volodymyr Zelenskyy.

The next day, the EU heads of state will hold meetings — the last of Ireland’s high-level events in its presidency of the European Council.

The threat assessment prior to this week’s events had rated the likelihood of an incident, such as a cyberattack, drone incursion, bomb threats or disruptive protests as “substantial” — the third of five security levels.

At least 20 bomb threats were made against flights in Europe on Thursday, following at least seven on Tuesday — all of them appearing to be hoaxes. 

But they caused significant disruption for airports, airlines, and air traffic, as well as passengers, and resulted in the dispatch of military jets in many countries, such as France, Italy, Bulgaria, and Austria, to escort planes to military airports.

Cork Airport reported it received an anonymous phone threat about a specific flight and adopted a security response in conjunction with gardaí, leading to a 90-minute delay.

An Aer Lingus flight from Dublin to Rome was also diverted by French military jets to an airbase in northern France after a bomb alert.

There are unconfirmed reports the pilot was questioned on landing over apparently preferring to land at a civilian airport rather than being diverted to a remote military base.

On Tuesday, two Ryanair flights departing Dublin also received a bomb alert.

The Irish Examiner understands that security services assess the likelihood that Russian intelligence is behind these incidents as “credible” — with the caveat that investigations by European police and cyber agencies will take time.

Extensive contact is taking place among European intelligence and cyber agencies to share and analyse information.

It is understood that assessments put at around 80% the likelihood that Russian intelligence is involved, either directly or through a range of actors linked to it.

Sources said hybrid campaigns aim to cause disruption and sow unrest and undermine people’s confidence in daily systems and services.

Commenting, Eleanor Leah Williams, assistant professor in security at Dublin City University said: “Whilst the tactics used this week, such as hoax threats and exploiting the IoT controllers [cyber-attack on refrigerators], could have been done by hacktivists, criminal proxies or opportunists, the targeting of daily European infrastructure — in this case aviation and food supply — aligns with broad state-sponsored destabilisation campaigns.

“The key challenge for intelligence services is that plausible deniability is interwoven into the design of these attacks.”

Eoin McNamara, postdoctoral fellow at the Finnish Institute of International Affairs, said: “If supermarket cyber breaches or airline bomb hoaxes are the result of continued hybrid interference, it might be interpreted as Russian or Iranian signalling that they retain low-cost means to create insecurity that can gradually overwhelm a united European response to security competition involving Russia, Iran, and possibly China.”

Cyber expert Brian Honan of BH Consulting said that until someone steps forward and claims responsibility for the cyber refrigeration attacks, and with proof to support their claims, “we may actually never know who caused this disruption”.