Who is behind the suspected ‘coordinated’ threats - and what if they keep coming?

IN THE MONTHS leading up to Ireland’s EU Presidency, security assessments warned of attempts to disrupt and unsettle planned events.

Previous hosts have experienced such security concerns before – notably Denmark, which held the six-month presidency for the second half of 2025. Copenhagen Airport was forced to shut down after sightings of suspected drones in the buildup to the city’s hosting of the European Political Community (EPC) summit in October last year. 

Dublin is set to play host to the next EPC summit next Thursday. There are concerns that similar disruptive actions are being taken to disrupt the high-profile event, which will see dozens of government leaders fly into Ireland. 

Sources said the security assessments received in the buildup to the presidency warned that a ‘grey zone’ strategy, aimed at undermining an enemy, could be employed. Actions undertaken as part of this strategy are designed as deliberate acts that are also deniable by whoever is behind them. 

Hybrid warfare arises out of the grey zone and can take the form of anything from disinformation campaigns and cyberattacks to more direct attacks.

Such operations across Europe are being blamed on Russian intelligence services, who are believed to be using disparate proxy groups to carry out sabotage, arson attacks and cyber incidents. Likewise, some of the hybrid activities are suspected to be part of a grey zone strategy by Iran and China. 

Gardaí at RTÉ’s Donnybrook campus as staff gather outside following an evacuation prompted by a bomb threat. Leah Farrell

Why Ireland?

Irish exceptionalists will tell you everyone loves Ireland, and no one would want to harm us. The reality is that Ireland is baked into the international order especially as world leaders prepare to attend the EPC event next week.

Sources here have repeatedly said, for at least the last year, that they paid particular attention to events in Denmark last autumn. Their key takeaway: what can be learned from those drone incursions and other incidents that happened in the lead up to the EPC summit?.

The current issues of hacked overheating fridges in European supermarkets and French blood banks, and the bomb threats to aircraft, are also suspected to be part of the broader grey zone strategy to unsettle Europe, as the impact of the war in Ukraine continues to escalate. 

While security sources are not definitively blaming Russia for events on Friday affecting Irish media organisations, including RTÉ, they also have not ruled it out. The reason is that the events match behaviours outlined in international intelligence assessments.

A government statement issued on Friday afternoon said the media threats “come on the heels of the ongoing disruption to aviation around Europe caused by similar threats, and it seems likely that this is a coordinated campaign of disruption”.

A government source said: “If you look at what is happening elsewhere, it can be deduced [that it is Russia].”

A security source said: “There are layers to this. You could have a disgruntled person with a laptop believing they are fighting some battle against whatever, and in the background they will be radicalised and provoked by their handler.”

Serious proxy incidents have happened in Britain and in Europe – criminals hired, for instance, to burn the home of former prime minister Keir Starmer or to attack warehouses storing aid to Ukraine. The proxies are recruited to carry out attacks to give Russia a chance at deniability.  

Some threats linked to the hacking of fridges and bomb hoaxes on flights spoke about a Russian ultra-far right group that focuses on anti-feminist motivations. 

Aggrieved person 

The alternative theory is that some of these actions, particularly the threats against the media, could have been staged by an aggrieved or disturbed person with a gripe and access to an email account.

Security sources, in the wake of Friday’s events, warned of the difficulty with copycats who have been excited by previous incidents.

It emerged, in our reporting on Friday’s threats, that there was a previous investigation at RTÉ after a threat was made against the broadcast tower. Garda enquiries established that it was not a credible threat at the time, and programming continued uninterrupted.

A French motorcycle police officer rides past an Aer Lingus flight grounded in an airbase following a bomb hoax. Alamy Stock Photo

What happens if the hoaxes keep coming?

The volume, seriousness of the threats and geographical spread is what is making these incidents different from the days of phoned-in code-worded bomb threats of the 1980s and 1990s. None of the aircraft that were named in the threats to airlines had bombs on them.

The capacity for a lone actor or standalone group, whether directly employed by a foreign power or merely inspired by them, to cause trouble is vast. 

Senior security sources have said that gardaí took the RTÉ threat seriously because of a number of reasons but mainly because of its classification as a “vital installation” – the Montrose complex is a national strategic asset. 

Gardaí swept through its offices and halls and searched for evidence of explosives – nothing was found. 

Evacuations are generally directed by the company or organisation that is impacted unless the gardaí have direct and credible information of a threat to life, in which case they will give advice to evacuate. 

It is notable that the Irish Defence Forces Explosive Ordnance Disposal team, or bomb squad, were not called out to any of the media locations on Friday. Neither were the fire or ambulance services.

The Special Detective Unit, which is the garda’s national security element, were there. They handle counter terror and counterespionage operations – with detectives photographed in the grounds of Montrose.

The question remains, however: what happens the next time an email threat is sent to the broadcaster or organisations? Will there be as big a response the next time? 

All sources said that it depends on the location, intelligence and the credibility of the threat. 

But if the threats keep coming, a dynamic risk assessment is completed and the decision will be made to lessen the response.

The investigation to find the perpetrator will analyse language and garda cyber experts will try to find the IP address to match the computer. 

There will be liaising with foreign intelligence agencies to see if there are similar cases elsewhere. Officers will then hopefully get enough to identify and arrest the perpetrator.

But if there are additional or similar threats to organisations here in the coming days, the Hobson’s Choice for the operational commander in the garda’s Command and Control system will be to decide if they warrant a full-scale response.

The issue is that garda resources cannot be indefinitely wasted on responding en masse to events that will likely be ultimately proven to be hoaxes.

The call will be made by weighing up the consistent outcomes to previous calls, the intelligence and then the threat level at the institution – but it is an incredibly difficult call to make.