Police Academy Faculty Member Dr. Alp Cenk Arslan wrote for AA Analysis about the test of the traditional security approach against changing cyber threats and how non-critical everyday infrastructures turn into strategic security risks.
Between 1881 and 1901, many state leaders and dynasty members fell victim to various assassinations. Russian Tsar Alexander II, French President Sadi Carnot, Austrian Empress Elisabeth, Italian King Umberto the First and US President William McKinley were among these names. This period, defined as the "anarchist wave" in the historical development of terrorism, showed how changing conditions gave small groups a violent capacity that could produce strategic results. As a matter of fact, the protection duties of the US Secret Service, which was established in 1865 to combat the production of counterfeit money, were expanded only after the McKinley assassination. These leaders were protected by the criteria of a very old era. King Umberto was killed in a convertible and President Carnot was killed among a large crowd. The emerging new security paradigm could not be read well even at the highest levels of states. This historical experience raises the question of what happens when the nature of threats changes, while the priorities of security institutions continue to be shaped by the threats of the past.
Everyday infrastructures become fronts for cyber sabotage
On the night of October 11-12, 2026, some attackers infiltrated the control units of industrial refrigeration systems in more than 700 retail outlets across France. Changing defrost settings resulted in food losses worth tens of millions of euros, equipment damage and at least fifteen fires, according to French government estimates. On November 9, France officially attributed the attacks to Shahid Kaveh, a cyber unit affiliated with Iran's Revolutionary Guard Corps. Iran denied the accusations. The Paris administration summoned the Iranian Ambassador to the Ministry of Foreign Affairs and stated that it would evaluate sanctions and proportionate response options at the European level. Thus, an intervention against the systems that maintain daily commercial activities went beyond economic destruction and turned into a diplomatic tension.
On November 1-2, there was a new wave of attacks affecting facilities in various countries in Europe. The European Commission, the European Union Cyber Security Agency (ENISA), Europol, the EU Computer Security Incident Response Teams Network (CSIRTs Network) and the European Cyber Crisis Liaison Organization Network (EU-CyCLONe) acted in coordination to monitor the developments. The perpetrators of this second wave of attacks have not yet been identified. Cooling systems at three facilities of the French Blood Agency were also affected by equipment from a supplier. However, thanks to independent monitoring and alarm mechanisms, timely intervention prevented the loss of any blood product. Attacks on supermarkets demonstrated the destructive capacity of cyber interventions, while events at blood storage facilities demonstrated how independent security measures can prevent a potential public health crisis.
These developments point to a significant transformation from cyber security to "security of cyber-physical systems". Operational technologies and industrial control systems control physical processes through remote access interfaces and externally accessible management ports. Unauthorized modification of operating parameters in these systems means direct intervention in physical functioning. The result can be spoiled food products, damaged equipment or disrupted essential services. A control unit that gives a heating command instead of cooling can turn a simple operation performed in the digital environment into irreversible financial losses. While the effects of attacks on information can often be eliminated, attacks on physical processes that ensure the continuity of economic and social life leave behind tangible destruction.
The changing geography of strategic vulnerability
The problem that world societies face today is that the security paradigm lags behind the transformation in threats. Although security agencies have significant technical capabilities, their established priorities often focus on protecting clearly strategic assets, such as power plants or military networks. However, the functioning of modern societies is based on technologies that appear to have limited strategic importance on their own, but are systemic when evaluated as a whole, and are mostly operated by the private sector. The widespread use of similar cooling control systems can turn local vulnerabilities into widespread economic losses and diplomatic consequences. Therefore, an attacker does not need to disable a major power plant or infiltrate a military network to have consequences beyond the system they directly target. This situation shows that the geography of strategic fragility is gradually expanding.
Similar events in the past also support this determination. US authorities had warned in 2023 that malicious actors were targeting programmable logic controllers used in water and wastewater facilities. Attackers were exploiting vulnerabilities in industrial devices exposed to the internet. Therefore, threats to industrial control systems are not limited to cooling infrastructures in the retail sector. Europe's regulatory approach in this area includes the NIS2 Directive and the Cyber Resilience Act, which expand obligations regarding the management of cyber security risks and incident notification. While the obligations of the said law regarding reporting security vulnerabilities will come into force in September 2026, comprehensive security-related obligations from design are expected to be implemented in December 2027. Although these regulations are necessary, they are not sufficient on their own. The extent to which corporate responsibilities, private sector practices, technical security measures and national security assessments are handled with an integrated approach is gaining more importance.
Redefining digital sovereignty and security
Today, security is increasingly dependent on maintaining the uninterrupted operation of commercial refrigeration systems, industrial temperature control mechanisms, water infrastructure, energy distribution, and logistics networks supporting healthcare. The connections these systems establish with the digital environment transform the seemingly ordinary technological dependencies of modern societies into areas of strategic vulnerability. Thus, state capacity, social endurance and the practical meaning of sovereignty are being tested again.
Assassinations in the late nineteenth century demonstrated how security institutions organized around old threats could be unprepared for new methods of attack. McKinley's assassination accelerated the transformation of the presidential protection system as the current institutional mandate failed to respond to the changing threat environment. Cyber attacks on cooling systems in Europe today also bring up a similar structural problem. While technological transformation changes the tools and systems through which damage can be produced, security institutions can continue to act with the understanding inherited from the past regarding strategically important targets. In this new era, the real criterion of sovereignty goes beyond the state's capacity to protect its symbolic and strategic assets. The ability to prevent ordinary operational technologies that sustain daily life from turning into tools of remote intervention and destruction stands out as a capability that states must achieve.
