Tube train drivers in the RMT union have called eight 24-hour strikes running over 16 days – including six in the lead-up to Christmas – that threaten to bring transport chaos to the capital.

The drivers will start another series of 24-hour strikes in late November in opposition to plans for a four-day week – a proposal that has been warmly welcomed by the majority of London Underground drivers represented by the Aslef union.

Disruption could mean few tube trains over the last shopping weekend before Christmas, with strikes running from noon on Thursday 17 December and again on Saturday 19 December.

The 24-hour strikes will begin at noon on 26 November, followed by the Christmas walkout, with two more planned in early January and more in February.

The RMT claims the new four-day week, which Transport for London (TfL) has said would be voluntary, would “undermine existing agreements and worsen working conditions”.

Previous strikes earlier this year resulted in widespread disruption to London Underground services, although trains ran on most lines.

The RMT said it has yet to receive guarantees about drivers’ right to remain on existing five-day working arrangements. It believes the proposals would worsen shift times and certainty.

The RMT’s general secretary, Eddie Dempsey, said: “London Underground is attempting to dress up a wholesale attack on drivers’ working conditions as a voluntary four-day week.

“Our members are being asked to spend more time driving trains, accept longer and more unpredictable shifts and surrender agreements that have been negotiated and defended over many years.

“This is not about improving work-life balance. It is about squeezing more work out of fewer drivers while giving management greater flexibility at the expense of our members.”

Similar, highly disruptive strikes took place in London in April and June, despite TfL insisting the proposals were completely voluntary, and the plans having been fully endorsed by the main drivers union, Aslef.

Good morning. A multiplicity of hoax bomb threats divert passenger flights across Europe. A malign cyber-attack targets supermarket fridges in Belgium, Sweden, the UK and – in a sickening escalation – the cold storage facilities of France’s national blood service.

The actors behind this week of chaos and disruption, be they hostile states or criminal gangs – or even enterprising teenagers – are yet to be identified. But what is certain is that they operate in a context of deepening global conflicts, building national threat and an accompanying, pervasive sense of vulnerability.

Welcome to the grey zone – that ambiguous space between routine peace and conventional military conflict, where proxies duck state accountability and cyber-tactics are developing at an alarming rate.

For today’s newsletter, I spoke to the Guardian’s defence and security editor, Dan Sabbagh, and our global technology team about flights, fridges and why “keep calm and carry on” is more than a tote bag slogan.

But first the headlines.

Five big stories

1. UK news | Russell Brand has been found guilty of raping a woman and sexually assaulting three others over the course of five years of his show business career.

2. US politics | Donald Trump signed a proclamation that he says will prevent future administrations from changing his design of the Oval Office and Cabinet Room, spaces he declared as national monuments that should be preserved.

3. UK politics | Andy Burnham has said he wants to “recast” the UK’s deal to cede control of the Chagos Islands after resistance from Washington.

4. Health | Cancer diagnoses in England have hit record highs, with more than 1,000 people a day diagnosed, NHS figures show.

5. World news | The UN-recognised government of Yemen has shaken up its political and military leadership in an attempt to regain territory lost to the Houthis in September.

In depth: ‘Terrorism doesn’t have to be violent. The purpose is to scare’

Hoax bomb threats disrupted at least 25 different commercial flights across Europe yesterday, with some forced to make emergency landings, and after similar threats on Tuesday, when seven planes were searched or diverted after malicious alerts.

There is, at least so for, no suggestion of orchestration by a hostile terror group or state actor according to investigators, although investigations continue. It’s perfectly possible that this could be the work of some lone disruptors, says Dan, who reminds me that “airlines receive bomb threats on a daily basis, at a rate that we would find extraordinary if we knew”. Nonetheless, the fact that these airlines are treating these threats as credible suggests a potential level of coordination, aviation experts told the Guardian on Thursday.

These threats take place with aviation security under sharper scrutiny after the flydubai incident, when a pilot fought off his knife-wielding colleague in an apparent attempt to crash a full passenger flight heading for Tel Aviv.

But beyond that “jittery background noise”, is a significant step-change in the manner of threat we face. Twenty-five years on from the inception of the War on Terror, when Islamist terrorism has receded relative to the hostile state threats, “we’re living in a different world with familiar uncertainties, but attributed to different players,” Dan tells me.

Conflicts in Ukraine and the Middle East are reverberating closer to home. Since 2022, we’ve witnessed intensifying acts of sabotage on European states that are believed to trace back to Russia but deliberately fall below the threshold for military response – a so-called hybrid or “shadow war” with the singular purpose of disrupting support for Ukraine. Only two months ago, an alleged attack plot on RAF Fairford was organised by a handler police believe was working on behalf of Iran.

Meanwhile, tech expert Azeem Azhar warned recently that the internet is experiencing it’s own Wuhan moment, as AI enables bad actors to hunt for system flaws and spread them, mirroring the early days of the Covid pandemic.

“Terrorism doesn’t have to be violent to terrorise,” says Dan. “The purpose of terrorism is to scare.”

What about other targets?

Ratcheting up disruption, and the accompanying psychological hit, is precisely what we’ve seen elsewhere this week. Supermarket fridges and freezers in seven European countries malfunctioned earlier this week, their thermostats remotely cranked up in some cases to 50C, in what some fear indicates a new front in hacking tactics.

Similar incidents have been reported in the UK, and I spoke to our global technology editor Dan Milmo on his way back from interviewing a fruit and veg wholesaler based near Heathrow, whose fridges went on the blink on Monday. The experience has prompted him to add some tinned goods to his weekend shopping list.

“There are only ever two likely candidates for a hack,” Dan tells me. “Criminal gangs or nation states.” He adds an emerging tertiary category of “troublesome teenagers”, such as the loose collective of English-speaking hackers Scattered Spider, two of whom were jailed in July for their attack on Transport for London.

One cybersecurity researcher told Dan that attacks on dummy Danfoss fridge controls – one of the software systems also targeted by the hackers in mainland Europe – had “all the hallmarks” of operations linked to Russia.

What are security services doing about these threats?

“There is a very real and intense cyberwar going on out there,” Dan Sabbagh tells me, and security agencies in the UK have viewed technological resilience as a key part of their responsibility for a number of years. The Turing Institute, for example, is looking at ways to utilise AI to make critical infrastructure systems more secure.

The police and security services are monitoring for threats all the time – MI5 has about 3,000 active subjects of interest currently – arranged in a hierarchy, with an understandable focus on the more serious ones, including threats to life. But lower level activity that is not obviously threatening, whether that’s online activity or buying paint with the intention of daubing racist graffiti, can be harder to pick up. As with other public services, this is a resourcing question as much as anything else.

Is chaos easier to generate in our interconnected world?

I put this to our global technology reporter Aisha Down, who explains that many hacks happen though edge devices – networked items that are connected to the internet but don’t have processing power and so aren’t the main focus of security upgrades by a company or household.

Famously, in 2016, North Korea came within a few keystrokes of pulling off a billion-dollar heist by hacking the Bank of Bangladesh via an unsecured printer.

Aisha is keen to dial down the panic. The point about cyber-attacks is that every single one is opportunistic: a hacker has to find a vulnerability and then discover a way to exploit it. “Just like a burglary, you might get into the room where all the jewellery is stored,” she says, “but the damage you can do is not a given.”

There is, however, a steady escalation in this type of threat. Aisha gives the example of Finland which, given its proximity to Russia, is watching cyber-tactics very closely. “What people report to their national cybersecurity centre is growing, from 18,000 reports last year for a population of 6 million people, to 21,000 this year.” This can be partly traced back to a developing criminal hacking ecosystem, some with loose links to the Russian state.

Do we need to buy more beans?

While a key element of a cyber-attack is the psychological impact, that can be hard to square with the UK government’s own Be Ready initiative, which advises us to off-set threats of hybrid warfare and hostile state sabotage by stockpiling 72 hours’ worth of emergency supplies – including water, beans and Twiglets (if you’re Andy Burnham). Indeed, governments across Europe are advising citizens to build up non-perishable larders.

It’s perhaps useful to balance the likelihood of a cyber-attack with the potential scope, suggests Aisha, who confesses she’s too busy sourcing furniture for her new flat to think about tinned goods.

One European cybersecurity official told Aisha recently that there’s a vulnerability in every 1,500 lines of code, on average.

“Their view is: it’s going to happen. It’s going to be opportunistic. But, unlike bombing a power station in the dead of winter, you won’t be offline for months.”

With that perspective, keeping a bunch of tenners handy to see you through a few days of disruption makes sense.

As for stockpiling food and water, Dan is still debating with his partner just how necessary those extra tins of peas really are. “If you’re a government wanting to spend £10bn more on defence by the end of the decade, it’s useful to have that message about keeping a few bottles of water at home,” he says.

To be clear: it’s not Dan’s intention to dismiss stockpiling advice as a purely cynical exercise. The developing threats are all too real. But as he puts it: “If the purpose of terrorism is to generate fear, the first thing you should do is not panic and keep calm.”

What else we’ve been reading

• We got movies that inspired GTA before GTA VI – a joke that will (hopefully) soon be gone. Anyway, it was fun reading how huge classics influenced the making of the most iconic game. Lysia Wright, newsletters team

• In AD43, Roman emperor Claudius invaded Kent, after being persuaded by a British “king”. Now, an archaeologist claims the British ruler was a queen. If the Roman empire is your bag, Nicola Davis’s article on the controversy is a thought-provoking read. Micha Frazer-Carroll, newsletters team

• Christmas decorations are adorable, but they definitely create a lot of waste. I enjoyed reading the best reusable Christmas things. Lysia

• Parts of Erin Somers’ piece on lab-grown meat made me salivate, others made me nauseous. I was entirely immersed in her quest to find out why it never really took off. Micha

• If I wrote a masterpiece during the Enlightenment I too would probably believe I was mythical. I hadn’t heard of Jan Potocki or his werewolf ways before reading Tobias Grey’s article. Lysia

Sport

Football | Sunderland’s unbeaten run in the Europa League came to an end as they were beaten 2-0 by Dinamo Zagreb at the Stadium of Light, while Celtic got off the mark in a 3-2 victory over Besiktas.

Rugby union | Tom Curry has emerged as a major doubt for England’s autumn opener against Australia on Sunday, handing Steve Borthwick a huge blow before a crucial November campaign.

Football | Cristiano Ronaldo has announced that he will not play for Portugal any more, ending an international career that spanned six World Cups and included a European title and the men’s all-time scoring record.

Something for the weekend

Our critics’ roundup of the best things to watch, read, play and listen to right now

Art and design

Constantinople to Istanbul (V&A, London) | ★★★★★

With tiled portraits and handmade robes, Victoria and Albert’s new exhibition showcases the colours of the Ottoman and Byzantine Empires. Read Jonathan Jones’s full review.

Film

I Play Rocky (in cinemas now)
| ★★★★☆

Sylvester Stallone stars as himself in his latest film. A struggling American-Italian desperate to get his screenplay “Rocky” out there. Read Peter Bradshaw’s full review.

TV

Black Doves (Netflix) | ★★★★
☆

Keira Knightely returns to our screens as Helen Webb, an undercover spy and protagonist of Netflix drama Black Doves. Alongside her espionage work, she certainly keeps busy as a mother, wife to the prime minister and best friend to a hitman. Read Rachel Aroesti’s full review.

Game

The Legend of Zelda: Ocarina of Time | ★★★★★


After changing a generation of gamers and their childhoods, The legend of Zelda lives on. Yesterday, Link came back to Nintendo screens, just in better definition and with fully voiced cutscenes. Read Keza MacDonald’s full review.

The front pages

“Brand faces ‘significant’ prison term for rape and sexual assault”, is the Guardian’s front page today. The Times writes “Brand found guilty of rape”, the Telegraph says “BBC ‘enabled’ rapist Brand”, the Sun has “Rapist”, and the Mirror’s take is “Justice”. On the same story, the Mail splashes “Downfall of the swaggering sex predator fawned over by the Left”, and Metro has “Rapist Brand caged”.

Elsewhere, the i Paper leads on “Godfather of AI warns humanity: it’s all hurtling out of control”, and the FT has “Tech stocks plunge as investors worry blue wave will sink AI spending boom”.

The Latest

Will the UK finally pay slavery reparations?

Andy Burnham has asked countries affected by Britain’s role in slavery to help shape a formal apology through a ‘structured dialogue’. During the prime minister’s visit to the Commonwealth heads of government meeting in Antigua and Barbuda, Downing Street said affected countries would play an indispensable role in crafting an enduring message. Though the plans for talks were received positively, the British government is still ruling out the idea of paying reparations, which for decades campaigners have been calling for. Lucy Hough speaks to the Guardian’s Caribbean correspondent, Natricia Duncan.

Cartoon of the day | Ben Jennings

The Upside

A bit of good news to remind you that the world’s not all bad

On 25 October, as Brazil held its presidential election, 101-year-old Celia de Oliveira Soares left home for the first time in months, to vote for the first time in nearly a decade. She was determined that Luiz Inácio Lula da Silva (known as Lula) – who had lost in the first round – should beat the far-right candidate Flávio Bolsonaro.

Since Brazil’s return to democracy in the 1980s, no first-round loser has ever bounced back. But 3 million extra voters took part in the second round, after skipping the first – and 1.4 million of them were over 70 years old. The victorious Lula, along with many others, is now hailing elderly voters as the election’s heroes.

“It is possible to resist fascism – all you need to do is mobilise society,” the former minister Simone Tebet said. “Young people hit the streets and golden-agers saved our democracy.”

Sign up here for a weekly roundup of The Upside, sent to you every Sunday

Bored at work?

And finally, the Guardian’s puzzles are here to keep you entertained throughout the day. Until tomorrow.

Bomb threats have caused diversions and emergency landings for at least 15 flights across Europe, renewing questions about a possibly coordinated effort to disrupt travel.

The series of warnings on Thursday morning affected flights between Italy, Ireland, the UK, Spain, Bulgaria, Romania, Poland, Finland, Austria, Denmark, Belgium, Portugal, Greece and Czechia.

On Tuesday seven planes across Europe were searched or diverted after malicious hoax bomb alerts. On Monday a flight from the UK to Bulgaria was diverted after a threat that was apparently without substance.

The latest alerts affected flights by Ryanair, Aer Lingus, Wizz Air, Finnair and LOT. All landed safely. Initial searches of some of the planes found nothing suspicious.

Two Ryanair flights from Copenhagen and Madrid to Sofia made emergency landings in the Bulgarian capital while a Ryanair flight from London to Sofia was diverted and landed at Plovdiv, Bulgaria’s second largest city.

A Bulgarian government spokesperson said: “Upon landing, the necessary inspections were carried out in accordance with the applicable procedures and no issues were identified. Airport operations at both Sofia airport and Plovdiv airport have returned to normal.”

An Aer Lingus flight from Dublin to Rome was diverted to the Évreux-Fauville military airbase in northern France. A Wizz Air flight from Milan to Warsaw was diverted to Vienna, while a Ryanair flight from Porto and an Aegean Airlines flight from Thessaloniki, both to Milan, were searched upon arrival at Milan’s Malpensa airport.

Also affected were an LOT Polish Airlines flight from Warsaw to Brussels, two Finnair flights from Helsinki to Rome and Vienna and four flights by other airlines to Prague.

A Czech police spokesperson said: “Security measures at Prague airport have just ended, with pyrotechnic inspections yielding negative results.”

The threats against the Finnair flights were “unfounded or hoax”, said an airline representative. “Unfortunately, air traffic is sometimes subject to threats, as we have seen this week, when also other airlines in Europe have faced hoax bomb threats. Threats are almost always unfounded.”

The travel disruption followed cyber-attacks this week against supermarket refrigeration systems. Some analysts speculate the disruption, along with drone incursions and triggering of app alerts, is part of a hybrid campaign to unsettle Europe on behalf of Iran, Russia or other state actors.

A Kremlin spokesperson said on Thursday it was “absurd” to blame Vladimir Putin’s administration for the hackers who targeted fridges. “We have ​such baseless accusations against our country, implicating it in everything,” Dmitry Peskov told reporters.

Many of the affected flights on Thursday were operated by low-cost carriers but there was little discernible pattern surrounding the incidents.

The Italian news agency Ansa, citing police sources, said the warning for the Helsinki-Rome and Dublin-Rome flights came from an anonymous email written in Italian and sent to the Rome airport company, ADR, and other affiliated companies. The subject heading was “segnalazione minaccia” (“threat warning”).

Aviation experts say fake threats occur daily but that such a number of credible threats, even if malicious hoaxes, appears to point to coordinated action.

Capt Martin Drake, a former airline pilot and technical adviser to the Balpa union, said airlines had security teams who assessed each threat on a traffic-light scale: green to keep going or red to be grounded, with an amber option only for flights yet to take off, allowing tighter checks and searches of the plane before clearing it to fly.

“If you want to deliberately disrupt a flight, then you need to do so once it’s airborne,” said Drake. Pilots have a QRH – a quick response handbook – whose instructions will probably include to descend quickly as well as divert to the nearest airport on receipt of a red alert. At cruising altitude, “aircraft pressurisation would do a lot of the work of any improvised explosive device”.

Diversions are expensive as well as highly disruptive, but airlines have little choice in the face of any remotely credible threat.

The ready availability of airline operations information on the internet means that any hoaxer now has a level of detail about the schedules, the type of plane and its technical specifications that would have eluded all but insiders decades ago.

Rhys Jones, an analyst at Osprey Flight Solutions, an aviation intelligence firm, said the confidence of airlines in European airport security should not mean any change to normal protocols after the hoaxes, but “one of the natural responses will be to see double-downed security, media coverage and public concern about travelling”.

He said the threats seemed linked but “a reasonably chaotic campaign with no particular region targeted”, and while they could weaken future security responses through the normalisation of threats, simply creating disruption could be regarded as a success by those carrying out the hoaxes.