Dr Paul Davis: When did supermarkets become part of the battlefield?

Dr Paul Davis

THERE WAS A time when the word warfare conjured up familiar images of tanks crossing borders, aircraft overhead, naval vessels at sea. The battlefield was somewhere identifiable, usually some distance from ordinary civilian life.

Today it may be considerably closer. It may be in the skies, on the airwaves and even in the supermarket freezer beside the frozen peas.

We saw in full view last week how flights were disrupted in parts of Europe and how many of Ireland’s media outlets became the target of bomb threats. According to the Taoiseach, they don’t know for sure if these incidents and the disruption to supermarkets were linked, but there is a suspicion that these ‘hybrid attacks’ were coordinated.  

Certainly, if you wanted to destabilise public life and public debate in a region, the indirect targeting of its services, communication and travel systems is a clever way to go. No tanks, no soldiers… but still, impactful. 

If true, the targeting of our food’s cold chain storage systems is a new and concerning departure. Just days ago, 13 SuperValu stores pulled chilled and frozen food from sale after a cyber incident affected their refrigeration systems. Similar problems were reported by retailers across Europe, and last month hackers turned up fridge temperatures in hundreds of French supermarkets, spoiling food on a large scale. Musgrave said its systems detected the problem, that the disruption was confined to one refrigeration model, and that normal operations were restored later that day.

The story is remarkable precisely because the equipment is so ordinary. Yet when a supermarket fridge is compromised, food becomes unsafe, stock is withdrawn and costs mount. The immediate consequences may be modest. The wider implications are not.

Who is behind this?

We should be careful about the conclusions we draw. There is no established evidence that these incidents were directed by a foreign government or form part of a coordinated campaign of state sabotage. They could be the work of the proverbial bad actors, the guy living in his parent’s basement, intent on causing disruption because he can. Authorities will be busy trying to find some proof of who is behind it all. But the incidents raise a question worth asking regardless of who was responsible:

Advertisement

When did the ordinary systems supporting civilian life become potential instruments of economic disruption?

For decades, the organising principle of modern supply chains has been efficiency. Equipment that once needed an engineer on site can now be monitored and managed from anywhere, with real benefits for maintenance and energy use.

Yet the connectivity that makes these systems efficient can also make them vulnerable. Supermarket fridges are often connected to the internet, so suppliers can check performance and spot faults. That same connection can let someone else in if it is poorly protected. A shared software platform serving many customers becomes a common point of failure.

This is not an argument against digitalisation. Efficiency and resilience are simply not the same thing, and the more tightly integrated a system becomes, the further disruption can travel through it.

What makes these incidents interesting is the imbalance between the cost of causing disruption and the cost of responding to it.

Targeting social structures

Consider the bomb threats against an aircraft. On the 3 November, a Ryanair flight was among four passenger planes targeted by bomb threats across Europe. No explosives were found. Many similar cases followed across Europe last week. A threat costs almost nothing to make, however the responses involved diversions, airport disruption, emergency services, investigations and missed connections. Given the circumstances, EU authorities cannot ignore these cases.

Cyberattacks can create the same imbalance. Manipulating a refrigeration controller may take far fewer resources than managing the aftermath where the food is withdrawn, equipment inspected, and stock has to be replaced. The attacker does not need to destroy the supermarket. The disruption is enough.

This is a defining feature of asymmetric conflict. It is imposing disproportionate costs on a better-resourced opponent. Not every cyberattack is an act of war, but the techniques show how small interventions can produce large economic effects.

European governments have identified Russia as having the capability to be responsible for a range of hybrid activities, including cyber operations and sabotage. That context matters, but it does not establish responsibility for any particular incident. A recognised hybrid threat is not the same as attribution.

What these events share is more instructive. Modern societies depend on interconnected systems designed to deliver services, not to withstand deliberate interference. Ports, hospitals, retailers and manufacturers all depend on one another’s systems. A software problem becomes a logistics problem, a logistics problem becomes a production problem, and eventually it becomes a problem for consumers.

Related Reads

Raft of false bomb threats really the last thing we need right now

Who is behind the suspected ‘coordinated’ threats - and what if they keep coming?

‘We will go after this’: Taoiseach cannot confirm who is behind bomb threats but vows to find out

Guarding against attacks

Cybersecurity is essential, but it addresses only part of the challenge. Protecting a system from intrusion is a question of prevention. Ensuring that essential goods and services keep flowing when the system fails is a question of resilience: understanding dependencies, identifying alternatives and maintaining the capacity to recover.

A business can have excellent cybersecurity and still be exposed by the failure of a critical supplier. Equally, a supplier can suffer an incident without wider harm if its customers have alternative sources, adequate inventory or sound recovery plans.

Modern economies are networks of dependencies, not collections of independent organisations. Perhaps the most striking feature of these incidents is how quickly we absorb them. Aviation incidents become aviation stories. Cyberattacks become technology stories. Food losses become retail stories and bomb threats to media outlets become media stories. 

Yet the economic mechanisms connecting them deserve more attention. The question is not whether every incident is connected. It is whether our understanding of economic security has kept pace with the systems on which modern life depends. We have become extraordinarily good at making supply chains faster, cheaper and more responsive. We are still learning how to make them robust against disruption, whether caused by accident, criminality, nature or deliberate hostile action.

Food, energy, medicines and transport are commercial activities, but they are also essential to society. This does not mean supermarkets should be treated as military installations or every cyber incident described as warfare. It means that security can no longer be understood solely through military capability or territorial defence. Economic resilience is now part of the conversation.

The most important vulnerabilities may lie in routine technologies, ordinary commercial relationships and the invisible dependencies that make everyday life possible. A supermarket freezer may seem an unlikely place to begin a discussion about modern warfare.

But perhaps that is precisely the point. The systems we barely notice when they work may be the ones we most urgently need to understand when they fail. 

Dr Paul Davis is a lecturer at Dublin City University’s Business School. He specialises in supply chain management and procurement.