Center for Cyber Diplomacy and International Security

By Vladimir Tsakanyan, Ph.D.
Center for Cyber Diplomacy and International Security (CCD-IS)

On November 8, 2026, Italy’s foreign ministry announced that hybrid threats would feature prominently at the G7 foreign ministers’ meeting in Paris on November 9–10, following a request from Foreign Minister Antonio Tajani. The announcement marks a diplomatic response to reported disruption and intimidation. Its significance is the effort to translate national security concerns into coordinated international action, while the evidence needed to assign responsibility remains a separate question.

The official statement says Tajani will seek a common response from partners and lists artificial intelligence among the meeting’s other subjects. This is an announced agenda and an Italian policy objective. It is not evidence that the G7 has already agreed sanctions, operational measures or a collective attribution.

What is confirmed, and what remains an assessment

The immediate background is documented in a November 7 ministry statement: Italian cybersecurity structures had identified the circulation of Tajani’s personal data on the dark web. The ministry said the minister connected the threats to Italy’s support for Ukraine. That explanation is an attributed political assessment; the statement does not publish a technical investigation establishing who obtained the data or demonstrating direction by a foreign government.

Maintaining that distinction is essential to sound diplomacy. The appearance of personal information online does not, by itself, establish how it was acquired, whether a particular institution was breached, or who commissioned its dissemination. Public reporting can confirm that an allegation has been made without independently confirming the allegation’s substance.

In a ministry-published interview dated November 8, Tajani also called for caution in the absence of formal evidence. The policy challenge is therefore twofold: organise protection and cooperation promptly, while keeping statements about responsibility proportionate to what can be demonstrated.

A familiar diplomatic instrument faces a broader problem

Cyber diplomacy has an established European history. On June 19, 2017, the Council of the European Union agreed a framework for a joint diplomatic response to malicious cyber activities, commonly called the cyber diplomacy toolbox. It envisaged the use of Common Foreign and Security Policy measures, including restrictive measures where necessary, and emphasised proportionality, peaceful dispute settlement and reducing escalation risks. [Council of the EU, June 19, 2017]

That history supplies an important comparison. A political forum can mobilise common attention and align priorities, but its members still need to determine which instruments fit the conduct under examination. The G7 and the European Union are different institutions. Putting a subject on a G7 agenda does not activate an EU sanctions mechanism or establish a legal finding against an actor.

Italy’s November 8 announcement groups recent incidents affecting aviation, retail and blood-transfusion services within its description of an escalating hybrid threat. Those characterisations belong to the ministry. The announcement is not a public forensic record proving that the incidents form one coordinated campaign. [Italian foreign ministry, November 8] Treating a broad security category as a settled explanation would obscure differences that may matter for prevention and response.

Coordination must produce usable protection

There is also an institutional dimension at home. A separate November 8 ministry release records Tajani’s visit to the Farnesina’s cyber operations room and describes continuing cooperation with national authorities. The ministry reports blocking more than 630,000 malicious events and attempts and neutralising approximately 3.5 million harmful emails since the start of 2026. These are official administrative figures, not independently audited evidence of an equivalent number of successful intrusions or a single adversary’s activity.

The analytical test for the forthcoming meeting is whether shared concern can become practical cooperation: clearer points of contact, timely exchanges of relevant evidence, assistance to affected services and consistent public communication. These are criteria for assessing a response, not measures already announced by the G7.

Partners may agree that essential services require protection while reaching different conclusions about attribution or the appropriate diplomatic instrument. Cooperation need not depend on collapsing those distinctions. A common account of what is known, what remains uncertain and what assistance is needed can itself improve the quality of collective decisions.

The November 8 development is consequently significant as an effort to bring cyber-related disruption into foreign-policy coordination. Its eventual importance will depend on the substance that follows the Paris discussions. A credible collective response must combine operational usefulness with evidentiary discipline: defending services and individuals while preserving the distinction between suspicion, attribution and agreed policy.

Cover: AI-generated illustration of a fictional diplomatic preparation room; not a photograph of the G7 meeting.