Experts Warn Bulgaria and Europe of Aviation Security Threats from Bomb Hoaxes

False bomb threats targeting aircraft across Europe are part of hybrid operations designed to exhaust state resources, spread panic and test security services, cybersecurity expert Lyubomir Tulev and national security and counterterrorism expert Col. Asen Peychev said on NOVA NEWS.

A wave of bomb alerts affected 27 flights across Europe on Thursday. Three of the aircraft were heading to Bulgaria, with two landing at Sofia Airport and the third at Plovdiv Airport. The threats prompted the scrambling of MiG-29 fighter jets from Graf Ignatievo Air Base.

Tulev stressed that the incidents should not be viewed as conventional cybersecurity attacks, but as terrorist threats delivered through emails. He said similar cases had been reported in other European countries over the previous several weeks, indicating that the incidents were not isolated.

He described the operations as asymmetric because sending threatening messages costs almost nothing, while the response requires substantial resources and coordination between multiple institutions. Tulev argued that countering the threats requires a coordinated European approach rather than action by Bulgaria alone. He also proposed a detailed examination of the emails to identify common patterns.

Peychev pointed to the 1971 Montreal Convention as the legal basis for prosecuting those responsible for such crimes. He said hybrid operations were placing considerable pressure on national security systems throughout Europe.

“The goal is to exhaust resources and create panic and alarm,” Peychev said.

He described the consequences as a form of “aviation terrorism,” explaining that even false alerts can trigger serious disruptions. These include aircraft diversions, fighter jet deployments and security inspections by specialized units, as well as considerable anxiety among passengers and their families.

Peychev also discussed claims of responsibility by a group calling itself "Fighters of the Male State." He said the group had been known since 2021-2022 and had links to Russia.

The expert suggested that countries seeking to destabilize Europe, particularly Russia and Iran, could be behind such hybrid operations. However, he emphasized that identifying those responsible with certainty would require concrete evidence.

The two experts also warned that repeated false alarms could cause security personnel to become desensitized to alerts, a phenomenon known as "false-positive fatigue." This could result in an actual threat being overlooked because staff have become accustomed to receiving warnings.