“There is a war out there, my friend. A world war. And it does not matter in the slightest who has more bullets; what matters is who controls information. What we see, what we hear, how we work, what we think — it is all based on information!”
Cosmo, Sneakers (I signori della truffa, 1992).[1] English translation of the Italian quotation reproduced in the original essay.
Cosmo describes a war fought through information. His warning becomes easier to grasp when we start with an ordinary event: someone receives a message and decides what to do. What happens when that message seems credible but was designed to mislead?
A command can change how an installation operates; an alarm can force a crew to interrupt a journey. Technicians, checks, authorisations and decisions then come into play. Whoever introduced the false signal may set in motion far more work than their initial intervention required, while those receiving it must establish what has happened and how to resume normal operations.
The European incidents of autumn 2026 discussed in this essay let us follow both paths. From 11 October, the French authorities documented compromises of remote controllers used in commercial refrigeration. Between 1 and 2 November, the European Commission and ENISA reported a further wave of incidents. On 5 November, a bomb threat forced a flight from Dublin to Rome to divert to Évreux. In Madrid, other warnings prompted checks on several aircraft, without the searches reported by Reuters finding the announced devices. [7; 6; 5]
The methods differ, yet both cases draw attention to the work demanded of those affected. An installation has to be checked and made safe; a threat has to be assessed before a flight can resume. Resources assigned to those checks are temporarily diverted from other activities.
This is where a technical question becomes a strategic one: how much freedom to set its own priorities does an organisation retain when it is compelled to react? Liddell Hart approached this problem through the indirect approach; John Boyd examined how uncertainty can undermine orientation and the coordination of responses. Their ideas help explain how a limited intervention can disorganise a much larger system. The first step is to follow a digital instruction through to its consequences in the physical world. [2, pp. 326–328] [4, chs. 5–7]
When an instruction reaches the physical world
Understanding how a digital alteration can result in lost goods requires considering the normal operation of a refrigeration installation. Its temperature, which changes whenever doors are opened, products arrive or heat exchange with the environment varies, is measured by a sensor and compared by a controller with a predetermined value, the setpoint. On the basis of this comparison, the controller sends the necessary instructions to the actuators, while subsequent measurements establish whether further corrections are required. This circuit, known as feedback, is one of the fundamental mechanisms of operational technology (OT), the category under which NIST groups computing systems that directly monitor or modify physical processes. [9, § 2.3, pp. 10–11] If unauthorised access changes the target value, the machine may correctly execute a sequence of commands that produces a harmful result because its premise has been altered. This can happen, for example, when the defrost function, needed to remove ice that impedes heat exchange, is scheduled in a way that causes excessive or prolonged warming — a possibility noted in the joint US authorities’ advisory on refrigeration systems. [8, p. 1]
Parameter alteration is only one possible point of intervention, since effective process management also requires reliable measurements. When an abnormal temperature is reported, staff can determine its cause and correct the operation; a manipulated representation of actual conditions, however, may induce a false diagnosis, delaying intervention precisely when it is needed. It is therefore useful to distinguish changes to operating parameters from manipulation of the information displayed to the operator, two techniques that MITRE describes separately for industrial systems. [11; 12] The former affects the instructions executed by the equipment, the latter the operator’s knowledge of its behaviour. Combined, they can cause an installation to depart from prescribed conditions while those monitoring it continue to receive reassuring data. In both cases, the effect depends on the device’s position in a chain of decisions already organised to manage the material world. This makes it necessary to understand the access routes through which an outsider might reach the controller or the information it produces.
Figure 1. Measurements return to the controller, which determines the intervention. Unauthorised access to parameters and manipulation of the information intended for the operator affect two distinct points in the control loop. [9; 11; 12]
Since many installations distributed across different shops are maintained remotely, a technician can reach an administration interface without physically visiting the refrigerator. For this convenience to remain safe, the system must first recognise the person entering through authentication, then restrict the permitted operations through authorisation. If a valid password is stolen, or weak default credentials remain usable, their holder may receive the same privileges assigned to an administrator. Entirely ordinary commands, such as changing a threshold or an operating cycle, can then be issued for purposes unrelated to preserving goods. MITRE documents this access method under valid accounts. [13] A different route opens when an application reachable over the network contains an exploitable flaw. In that case, an exploit — a procedure that takes advantage of a program vulnerability — may bypass a protection without knowing the password, another technique recorded by MITRE for industrial environments. [14] To reduce these possibilities, the French refrigeration alert specifically calls for protecting Internet-exposed interfaces, replacing initial credentials and updating firmware. [7]
The existence of several entry routes has a consequence often overlooked in journalistic language: the severity of damage does not, by itself, reveal the sophistication of the technique used, since a compromised password may confer operational authority comparable to that obtained by exploiting a complex flaw. Once the controller has been reached, the power to alter its parameters derives from the acquired privileges and the functions they expose; determining how innovative the means was instead requires reconstructing the intruder’s route of entry. Some software vulnerabilities also create a particular temporal asymmetry, because an attacker may know a weakness before users have a fix available. This is the circumstance to which zero-day refers, and understanding it requires separating discovery, disclosure and effective device protection.
The time between discovery and protection
A vulnerability exists in a program even before anyone has identified it, and it may be discovered either by a researcher intending to report it to the vendor or by an attacker seeking to exploit it. Private knowledge of a flaw and the absence of public technical details therefore do not, without further evidence, establish how it will be used. Under coordinated disclosure, FIRST’s guidelines envisage researchers confidentially notifying the vendor so that a remedy can be prepared before details facilitating exploitation are released. [17] When a flaw is maliciously exploited before a publicly available fix exists, Google Threat Intelligence classifies it as a zero-day for reporting purposes; the NIST glossary instead emphasises that the vulnerability was previously unknown. [15; 16] The definitions stress different aspects but identify the same operational problem: while the attacker already has a means of intervening, the system administrator may either be unaware of the weakness or know about it without yet having the specific tools to remove it.
The availability of a patch, the update that corrects the defect, does not mean that risk immediately disappears. In industrial installations, the fix often has to be checked for compatibility, tested and installed on devices that cannot be stopped indiscriminately. NIST therefore treats patch management as an ongoing activity in which technical preparation intersects with operational needs. [18] Once a patch is released, a device that has not yet received it remains vulnerable to a now-known flaw, although it is no longer in the period preceding the remedy’s availability. Discovery, possible disclosure, correction and installation are thus distinct moments during which the defender’s position can change without the running software changing immediately. The refrigeration advisories establish compromises and exposure conditions, while the techniques actually used in individual intrusions require specific investigations. Indiscriminately calling the whole wave zero-day would therefore attribute a characteristic not established by the cited documents. [7; 8]
Figure 2. Private discovery, exploitation, possible disclosure, patch availability and installation belong to different stages. The intervals show how an already-public fix can still take time to reach every installation. [16; 17; 18]
Whether through stolen credentials, exposed software or a flaw for which no remedy yet exists, intrusion exploits the gap between the ability to intervene in a system and the preparedness of those administering it. That gap may persist when defence requires checks and updates across many devices. The bomb threats of those same days reveal organisational pressure arising through a very different route: the sender of a fabricated message already knows the warning is unfounded, while the recipient must establish that without ruling out a genuine threat at the outset. Here the issue is the time and work required to decide responsibly under uncertainty, rather than unauthorised access to a program.
Checking danger and the cost of deciding
Responsibility for flight safety requires a received threat to be assessed even when its provenance is obscure, because the possibility of underestimating a genuine warning requires the risk to be weighed before it is ruled out. For a decision to be justified, those making it must compare the available information and, depending on the circumstances, order checks and coordinate crews, airports and security bodies. In the cases reported by Reuters, this duty of investigation led to inspections, diversions and, for some aircraft, military escorts, although searches did not discover the announced explosives. [5] The sender of a false warning can therefore complete the action by transmitting a message, while the recipient, responsible for protecting people and equipment, must undertake a sequence of real activities: initial analysis, contact with air traffic control, possible decisions to land elsewhere, and arrangements for inspections, passenger assistance and service resumption. The burden does not arise from unauthorised access to aircraft systems — something a simple emailed threat does not demonstrate — but from the institutional need to distinguish actual risk from declared danger.
The comparison with refrigeration controllers becomes relevant once the transformation of information into action is traced in each case. The controller executes an instruction because its author has been recognised as holding certain permissions; the bomb warning is assessed by people who must determine its credibility before resuming normal operations. The obligations therefore differ — restoring or verifying control over a material process in one case, establishing danger and deciding how to ensure safety in the other — but both absorb staff, equipment and time that would otherwise provide the service. The more resources an organisation must use to verify what comes from outside, the fewer it can freely allocate to planned activities. If further warnings arrive before earlier operations have ended, the difficulty increases: the same staff cannot handle every demand simultaneously, and priorities must be reconsidered. The effect of interest to strategic analysis thus arises from the relationship between the initiator of the disturbance and the obligations of those managing its consequences.
Figure 3. An unauthorised instruction enters the control loop; an unfounded threat enters the process of assessing danger. Their consequences converge in the verification and restoration work required of the affected service. [8; 5]
Suppose a technician is already checking an installation’s settings and must address another anomaly while that check remains open; or a crew, after a diversion, is waiting for authorisations without which it cannot resume the flight schedule. In both situations, loss includes postponed activities as well as the time directly spent responding to the incident. The cost of disruption therefore depends on the full set of tasks it makes necessary and on the ability to absorb them with available resources. This constraint becomes strategically significant when organisational priorities, rather than being determined solely by ordinary objectives, are partly determined by events caused by an outside actor. Freedom to choose where to concentrate effort is then reduced without necessarily destroying the resources the organisation possesses. The relationship between a relatively limited intervention and the redistribution of work it imposes helps explain why Liddell Hart, reflecting on past wars, placed such importance on threats against connections and manoeuvres that force an opponent to react before the decisive clash.
Liddell Hart: dislocating before fighting
Basil Henry Liddell Hart’s enquiry grew out of the Great War, in which he served as a British infantry officer and was injured in a gas attack during the Battle of the Somme in July 1916. Letters held at King’s College London convey the experience of fighting in which modern firepower could consume entire formations for minimal territorial gains. [19] In subsequent years, reconsidering the relationship between results achieved and losses incurred, Hart asked what value remained in a victory won after dissipating the human and material strength needed to sustain the war’s political objectives. His answer began from the principle that battlefield success can undermine what it was intended to secure if it bleeds a nation dry. In Strategy, he wrote that even the most decisive victory loses value when a country must pay for it by exhausting its essential resources. [2, p. 212] If the political outcome is the criterion of success, strategy must seek, before resorting to costly fighting, conditions under which enemy resistance can be weakened through movements, threats and surprise.
This need underlay Hart’s polemic against the military tradition he associated with Clausewitz and his followers, whom he accused of giving decisive battle, mass concentration and destruction of the main opposing forces such priority that they favoured confronting the strongest defences. In his interpretation, trench warfare had shown how costly a conception of victory based on direct attrition could become, especially where firepower made advance without disproportionate loss extremely difficult. He therefore sought a strategy that would alter the balance of resistance beforehand rather than confront it under the defender’s chosen conditions. Osinga reconstructs the development of this outlook in the chapter on the indirect approach, also tracing Hart’s influence on Boyd. [4, ch. 2, “The Indirect Approach”] For Hart, the commander should create a situation in which the opposing force, even before being defeated, is compelled to redeploy and expend effort on tasks different from those originally envisaged. Combat, if still necessary, would then encounter already-weakened resistance.
The indirect approach translated this criterion into a precise relationship between movement and expectation. By bypassing a strongly defended sector to threaten its supplies, connections or rear, the attacker could force the opposing command to change front and commit resources to protecting what it had previously regarded as secure. If the manoeuvre was unforeseen, the time needed to understand and adapt to it would amplify the threat’s effect. Hart therefore paired the “line of least resistance”, concerning the physical possibility of reaching an objective, with the “line of least expectation”, concerning the defender’s predictions: an easy route would have little value if the opponent had anticipated it and prepared to block it. [2, p. 327] Surprise thus worked in two directions, facilitating the initiator’s movement while compelling the other side to expend energy correcting an arrangement that had become inadequate. This consequence, more than geographical outflanking alone, determined strategic dislocation.
Figure 4. An indirect threat to command and supply can force an opponent to redistribute effort; the diagram summarises the relationship between movement, surprise and loss of freedom of action described by Hart. [2, pp. 326–328]
The connections Hart referred to were initially concrete: supply routes, lines of retreat, relationships between units and the ability to bring reinforcements where needed. The larger and more complex an army, the more its strength depends on the continuity of those relationships. Threatening a line of communication can therefore force it to protect part of its logistical system with people and equipment otherwise intended for combat. [2, p. 326] The physical effect nevertheless remains incomplete without considering the commander’s mind, where enemy movements must be interpreted and the response concentrated. When a threat appears from an unexpected direction, uncertainty about its seriousness may disperse attention across secondary objectives, further reducing coordinated use of the deployment. Hart called this process distraction, explaining that loss of freedom of action follows loss of freedom of conception. [2, pp. 327–328][note 1]
The psychological dimension becomes still more important when uncertainty is accompanied by fear, which can spread through people and change decisions beyond its point of origin. Hart expressed this possibility by describing the shaken individual as a vehicle for an “epidemic of panic”, then observing that the impression made on a commander can neutralise the fighting capacity of forces still materially available. [2, p. 212] In other words, an army retains its people and equipment, but their effectiveness depends on the judgement and connections through which they are directed. The same relationship helps explain why civilian disturbances matter strategically beyond the technology employed. Someone altering a command or spreading an unfounded threat can compel the recipient to reorganise work and investigate functions that previously ran normally, temporarily reducing freedom to choose priorities. Hart explains why reaction can become part of the effect; understanding how successive uncertain information makes it harder to restore a common direction, however, requires examining how organisations form, correct and share their representation of events.
John Boyd: interpreting before reacting
John Boyd approached the problem through his experience of aerial combat, where the ability to change manoeuvre rapidly can put an opposing pilot in difficulty, forcing adaptation to a situation that changes before the previous one has been understood. Ian T. Brown reconstructs how Boyd moved from fighter performance and transitions between manoeuvres to treating the other combatant’s mental representation as decisive: advantages in space and time have greater effects when the opponent misinterprets what is seen and directs decisions towards a situation already superseded. [3, ch. 4] In the oral testimony quoted by Brown, Boyd describes the process from the recipient’s perspective, explaining how ambiguity in another’s actions makes one progressively uncertain, then confused and disorganised, eventually panicked. [3, p. 94, note 17] The formulation reveals a causal sequence: if the available information no longer supports a reliable picture, even a prompt decision may respond to an event different from the one actually unfolding.
To explain how individuals and organisations interpret and adjust their relationship with the environment, Boyd developed the process known as OODA: Observe, Orient, Decide, Act. Observing means detecting signals and changes; orienting means assigning them meaning in light of experience and knowledge; deciding means selecting a course of action; acting then makes it possible to test the effects, from which further observations begin. Osinga’s account emphasises the central place of orientation, because it influences what is noticed and how a possible action is judged. Culture, previous experience, learned capabilities and new information contribute to a representation that must continually be tested. [4, ch. 6, “The Essence of Winning and Losing”, fig. 6.1] Boyd captures this centrality by calling orientation the Schwerpunkt, the focal point of an organisation’s intellectual activity: even abundant, timely data lose value if they are not interpreted appropriately to the circumstances. [4, ch. 6, “The big O: orientation”, note 13]
Figure 5. OODA in Osinga’s account: experience, culture and new information contribute to orientation; action produces consequences that in turn modify observations and subsequent assessment. [4, ch. 6, fig. 6.1]
When a task requires several people, the quality of orientation also depends on bringing partial observations together into a shared judgement. Staff handling goods may observe an abnormal temperature without knowing the controller settings; a technician may identify an altered parameter without being responsible for what happens to the products; the manager must decide whether to stop the installation or protect stock. For the organisation to act coherently, these different forms of knowledge must be compared and produce a common representation, whereas contradictory or incomplete messages can delay precisely those decisions requiring several functions to cooperate. Boyd therefore attached great importance to implicit guidance: when shared experience, trust and clear objectives enable members to recognise the general intent, they can take mutually compatible initiatives without awaiting detailed instructions for every circumstance. Osinga connects this principle with reduced organisational friction and adaptability. [4, ch. 6, “Organic Design for Command and Control”]
Speed is useful in this theory insofar as it accompanies interpretation capable of correcting itself. Acting immediately on a false representation can compound error, whereas promptly recognising that initial assumptions are inadequate allows decisions to change before consequences worsen. If another disturbance follows before the first has been clarified, verification work overlaps with new demands, making it harder to determine which information is relevant, which decisions take precedence and who should assume responsibility. The dislocation described by Hart then extends into an orientation problem: resources already committed to the response cannot readily be redistributed while the picture remains uncertain. Boyd analysed this circumstance through the relationship between shock, available time and adaptive capacity.
Repeated shock, isolation and recovery capacity
In the chapter on manoeuvre conflict, Osinga reports that Boyd regarded surprise and shock as forms of overload produced by a succession of threatening events exceeding the mental or physical capacity to respond, adapt or resist. [4, ch. 5, “Maneuver conflict”, note 103] The severity of this overload depends on the relationship between the rate at which new demands arrive and the time required to understand them. When a team is still checking an installation and another anomaly appears, or an inspection remains unfinished when a new report requires a decision, unresolved tasks compete for the same people and information. Since each assessment must be coordinated with other functions, accumulation can make it harder to establish which checks are urgent and in what order they should be performed. The increased burden therefore also depends on overlap: every new episode must be addressed while the previous one continues to absorb resources.
Figure 6. A succession of requests can create simultaneous work while earlier investigations remain open. The diagram illustrates the relationship between the interval separating events and the time available to respond, following Boyd’s discussion of overload. [4, ch. 5, “Maneuver conflict”]
If signals concern risks that cannot be ruled out without investigation, uncertainty itself demands further checks, reducing the time available to understand subsequent events. If messages are also contradictory, decision-makers may have to revisit judgements already reached while new activities have begun on their basis. In Patterns of Conflict, according to the passage reported by Osinga, Boyd associated disrupting the connections supporting communications, command and support with producing surprise and shock repeatedly, “again and again and again”: the intended effect was loss of the cohesion that allows an opponent to react as an organised whole. [4, ch. 5, “The nucleus of victory”, note 92: Patterns of Conflict, slide 98] Understanding the significance requires a broad conception of connections. Osinga shows that in The Strategic Game of ? and ?, Boyd distinguishes the physical relationship, enabling exchange of resources and information, from the mental relationship, supporting adequate understanding of events, and the moral relationship, sustaining cooperation through norms and trust. Strategy thus becomes a contest between capacities for interaction and conditions of isolation. [4, ch. 6, “The Strategic Game of ? and ?”]
Figure 7. The capacity to act together requires the exchange of resources, the understanding of events and trust in people to remain mutually supportive. [4, ch. 6, “The Strategic Game of ? and ?”]
A network can continue transmitting messages without ensuring coordinated action. If information is unreliable, people may act on incompatible interpretations; if trust in others’ assessments is absent, even technically correct communications require continual confirmation and ultimately burden the response. When verification takes energy away from subsequent activities, which introduce further uncertainties of their own, the initial disturbance can sustain a cycle in which difficulty understanding the overall picture increases decision delays, while delays multiply unresolved problems. In Boyd’s theory, this progression can lead to paralysis if collective orientation cannot be rebuilt. The outcome changes, however, if the organisation preserves reliable connections, its members’ initiative and the ability to learn from investigations, since these resources can interrupt overload and restore a common direction. [4, chs. 5 and 7]
The cost of disturbance therefore includes the work needed to restore signal reliability, command legitimacy and continuity of decisions, even when immediate material damage remains limited. When this work absorbs resources otherwise intended for normal activity, freedom to concentrate effort is reduced in Hart’s sense. If uncertainty then accumulates and shocks recur before the organisation regains a reliable representation of events, Boyd’s theory explains how deteriorating orientation and cohesion can compound the loss of initiative. Containing this progression requires protected access and updated systems, as the security authorities recommend, together with the ability to verify data, share assessments and decide under clear responsibilities. Restoring service can then coincide with recovering the freedom of action on which the continuity of normal activities depends. [7; 8] [4, ch. 7, “Mental and organizational agility”]
Note
[1] In the original: “The loss of his freedom of action is the sequel to the loss of his freedom of conception”; B. H. Liddell Hart, Strategy, p. 328.
References
- [1] Phil Alden Robinson (director), Sneakers (I signori della truffa), Universal Pictures, 1992; Cosmo’s line in the Italian version. Italian transcription of the quotation.
- [2] B. H. Liddell Hart, Strategy, second revised edition, 1967; Meridian reprint, New York, 1991. Supplied edition: pp. 212, 324–328.
- [3] Ian T. Brown, A New Conception of War: John Boyd, the U.S. Marines, and Maneuver Warfare, Marine Corps University Press, Quantico, 2018. Supplied edition: ch. 4, p. 94, note 17, citing Boyd’s oral testimony, pp. 134–135.
- [4] Frans P. B. Osinga, Science, Strategy and War: The Strategic Theory of John Boyd, Routledge, 2007; supplied electronic edition, 2006. Ch. 2, “The Indirect Approach”; ch. 5, “The nucleus of victory: the themes of Blitzkrieg and guerrilla warfare”, note 92 (Patterns of Conflict, slide 98), and “Maneuver conflict”, note 103 (slide 117); ch. 6, “The big O: orientation”, note 13 (Organic Design, slide 16), “The Strategic Game of ? and ?”, note 56 (slide 33), and “The Essence of Winning and Losing”, fig. 6.1; ch. 7, sections on orientation, adaptation, organisational agility and “Cyberwar and swarming”. Section references identify passages in the reflowable EPUB.
- [5] Reuters, Bomb threats cause flight disruptions across Europe, 5 November 2026, republished by Internazionale, 6 November 2026. Report.
- [6] European Commission and ENISA, Joint statement on cyber incidents in refrigeration systems across the EU, 4 November 2026. Official statement.
- [7] ANSSI / CERT-FR, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, CERTFR-2026-ALE-012, 12 October 2026, updated 16 October 2026. Technical alert.
- [8] CISA, FBI, HHS, USDA and DoT, US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems, 5 November 2026, pp. 1–2. Joint advisory.
- [9] Keith Stouffer et al., Guide to Operational Technology (OT) Security, NIST SP 800-82, revision 3, September 2023, especially §§ 2–2.3 and pp. 10–11. doi:10.6028/NIST.SP.800-82r3.
- [10] NIST, CSRC Glossary, entry Operational technology. Definitions and sources.
- [11] MITRE, ATT&CK for ICS, Modify Parameter, technique T0836. Technique entry.
- [12] MITRE, ATT&CK for ICS, Manipulation of View, technique T0832. Technique entry.
- [13] MITRE, ATT&CK for ICS, Valid Accounts, technique T0859. Technique entry.
- [14] MITRE, ATT&CK for ICS, Exploit Public-Facing Application, technique T0819. Technique entry.
- [15] NIST, CSRC Glossary, entry Zero-day attack. Definition and sources.
- [16] Google Threat Intelligence Group, Casey Charrier et al., Look What You Made Us Patch: 2025 Zero-Days in Review, 5 March 2026, “Scope” section. Report and classification criterion.
- [17] FIRST, Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure, version 1.0, 2017, use case 2 and variants. Guidelines.
- [18] Murugiah Souppaya and Karen Scarfone, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology, NIST SP 800-40, revision 4, April 2022. doi:10.6028/NIST.SP.800-40r4.
- [19] Liddell Hart Centre for Military Archives, King’s College London, presentation by Patricia Methven of Hart’s letter to his parents of 15 July 1916 and his Somme account of 18 September 1916, 3 March 2014; reference Liddell Hart 7/1916/15a. Introduction and archival materials.
Source criteria. The historical and theoretical argument rests on the three supplied volumes, which follow the film quotation in the list. The computing explanations use the cited technical sources, while the initial chronology comes from institutional statements and Reuters. Applications of the concepts to contemporary incidents are developed in the text. Online sources consulted on 7 November 2026, as recorded in the original Italian essay.