A wave of false bomb threats targeting commercial flights across Europe has raised fresh concerns about aviation security, with investigators examining whether the incidents form part of a wider campaign of disruption.
At least 21 flights and several airports were affected on Thursday, November 5, forcing aircraft to change course, undergo security inspections and, in some cases, receive military fighter-jet escorts.
Although no explosives were found, the scale and timing of the incidents have prompted questions about who is behind the threats and what they hope to achieve.
Russia has emerged as one possible line of investigation. However, European authorities have yet to establish evidence linking the Kremlin to the incidents.
The warnings affected flights involving airlines including Ryanair, Wizz Air, Aer Lingus, Finnair and LOT Polish Airlines. Several aircraft were diverted, while others were escorted by military jets as a precaution.
An Aer Lingus flight travelling from Dublin to Rome, carrying 151 passengers, was diverted to a French military airbase. Italian fighter jets also escorted a Finnair aircraft travelling from Helsinki to Rome.
The incidents followed another series of false bomb alerts earlier in the week, raising concerns that the latest warnings could be part of a coordinated effort rather than unrelated acts of mischief.
Why Russia is being considered
The suspicion surrounding Russia stems partly from a series of disruptive incidents across Europe in recent months.
These include cyber-attacks, unexplained drone sightings near sensitive installations and attacks on supermarket refrigeration systems and French blood bank infrastructure.
Some European governments have previously accused Moscow of engaging in so-called hybrid warfare. The strategy involves using cyber operations, sabotage, disinformation and other covert activities to weaken an adversary without triggering a conventional military confrontation.
Russia has repeatedly denied involvement in such operations.
Security experts say the latest aviation incidents could fit this pattern, although the evidence remains inconclusive.
Reuters quoted Eric Schouten, head of aviation security group Dyami, as saying it was difficult to establish whether a particular country was responsible for sabotage incidents.
He nevertheless noted that the threats shared characteristics associated with hybrid attacks.
The mysterious 'Male State' connection
One of the most significant clues emerged from an email sent to airport authorities in Rome.
The message claimed that explosives had been placed aboard flights arriving from Helsinki and Dublin. It was signed by individuals identifying themselves as the 'Fighters of the Male State'.
The name appears to reference Male State (Muzhskoye Gosudarstvo) , an ultra-nationalist and misogynistic movement founded by Russian blogger Vladislav Pozdnyakov in 2016.
The group was banned in Russia in 2021 because of its extremist views.
However, the appearance of its name in the threatening email does not establish that its members were responsible.
Pozdnyakov has denied any involvement. In a statement shared on Telegram, he said the movement no longer existed and suggested that anyone using its identity was acting independently.
Investigators are therefore examining whether the sender was genuinely connected to the movement or simply borrowed its name to mislead authorities.
Could the threats be part of a wider campaign?
The aviation incidents have occurred alongside other attacks on essential services, adding to concerns about the security of European infrastructure.
Hackers recently disrupted supermarket refrigeration systems in several European countries. French blood banks were also affected by cyber incidents.
Security specialists have suggested that the combined disruptions could be intended to test how quickly governments and businesses respond to emergencies.
Jacob Funk Kirkegaard, a senior fellow at Brussels-based think tank Bruegel, told the Associated Press that the threats could be testing the coordination of European governments and airport authorities.
He said the apparent objective could be to create uncertainty about the reliability of air travel while imposing financial and operational costs.
Aviation cybersecurity specialist Eliran Almog also warned that such incidents could disrupt essential services and weaken public confidence.
However, investigators have not established that the aviation threats and the other cyber incidents share a common source.
Airlines and passengers face growing disruption
Even when a bomb threat proves false, airlines must treat it seriously until security teams establish that there is no danger.
Aircraft may be diverted, passengers evacuated and luggage inspected. Bomb disposal specialists and police officers may also be deployed.
The consequences extend beyond the affected aircraft, often disrupting connecting flights and airport schedules.
Philip Baum, a visiting professor of aviation security at Coventry University, told the Associated Press that a single disrupted flight could cost an airline as much as $250,000.
The expenses can include replacement crews, missed connections, aircraft inspections and delays affecting subsequent services.
European authorities have activated an aviation-security information-sharing mechanism to improve coordination as investigations continue.
EU Transport Commissioner Apostolos Tzitzikostas cautioned against drawing conclusions before investigators establish whether the incidents are connected.
He said it was "too early to draw conclusions on whether the reported incidents are linked"
Who is ultimately responsible?
For now, investigators face three broad possibilities: individuals acting independently, copycat offenders inspired by earlier threats, or a coordinated operation involving a wider network.
A state-backed campaign remains one possibility, particularly given the broader security tensions between Russia and Western governments.
Iran and groups potentially acting on behalf of other states have also been mentioned in discussions about possible responsibility. However, no credible evidence has publicly established their involvement.
The Russian extremist group's name appearing in some of the emails is an investigative lead, not proof of responsibility.
The central challenge for European security agencies is to establish where the messages originated, who sent them and whether the different incidents share a common organiser.
Until that evidence emerges, attributing the threats to Russia or any other government would be premature.
For passengers, the immediate concern remains whether the next warning will also prove to be false.
