Somewhere in Kyiv on Sunday night, a parent read a push notification about a nuclear threat and had to decide in seconds whether it was real. Somewhere in Russia, another parent got a false warning of their own. We don't know who sent either one. We do know who received them: ordinary people with no say in this war and no means of verifying anything in the time they were given.
That is the story. Not the cleverness of the hack, but the target. Emergency alerts are among the most basic public goods a state provides. They are a promise that when danger comes, someone will tell you the truth fast enough to matter. Poison that promise and you've done something worse than cause a panic. You've taught people to doubt the next warning, and the next warning may be real. Ukrainians have lived with air raid sirens for years. Corrupting the one system that tells them when to run to a shelter is an attack on their survival instincts.
Both countries were hit within hours, and I'd resist the urge to build a theory out of that. It might be coordination, opportunism, or two unrelated actors. What matters is the pattern it confirms: in modern war, civilians' phones are part of the front line, and nobody is protecting them.
The timing is the second scandal. The false alerts landed as a local ceasefire around Russian-occupied Oleshky expired. That pause existed so aid could get in and civilians could get out. Now it is over. Whoever didn't make it out, the elderly, the sick, the people without a car or a relative on the other side, is back inside a combat zone. Armies find it easy to declare humanitarian pauses when the pause serves them and just as easy to let them lapse. The people in Oleshky should not have to wait for the next negotiated window. Evacuation access should be a standing obligation, not a favor granted in installments.
There's a lesson here for those of us watching from the comfortable side of the Atlantic, and it's an uncomfortable one for Washington. Americans got a preview in 2018, when a Hawaii emergency worker pushed the wrong button and told a state of 1.4 million people that a ballistic missile was inbound. Thirty-eight minutes of terror came from one human error. Now imagine deliberate sabotage. Yet our government has spent the last year gutting the civilian cyber defense agency, CISA, whose job includes protecting exactly this kind of infrastructure. It has also weakened FEMA while politicians praise "resilience" in speeches. You cannot cut public safety to the bone and then act surprised when a fake alert spreads faster than a real one.
The Left has its own work to do. Some of us have grown so fluent in the language of geopolitics that we treat civilian harm as a footnote. Whether your instinct is to arm Ukraine or to push harder for a negotiated end, the test is the same: does your position make the person holding that phone safer? Whoever is behind these attacks, in Moscow, Kyiv or anywhere else, has decided that civilian fear is a legitimate military tool. The world should say plainly that it is not.
We have norms against bombing hospitals, however often they're broken. We need an equally firm norm against sabotaging the systems that tell civilians when to take cover. It won't stop a determined hacker. But it will make clear who is violating a line, and it will give governments a reason to treat alert systems as critical infrastructure rather than as apps.
A false alarm is cheap to send. The trust it destroys is not cheap to rebuild, and the people who pay for it will never be the ones who made the decision.
