At the start of Tuesday’s rush hour, pieces of pipe appeared on the rails of the Dutch railway network — deliberately placed at several locations, according to the infrastructure operator ProRail, which said it was treating the cause as possible sabotage. Track circuits failed. The safety systems that watch for trains on the line reported their blocks occupied, and the signals went red. NS said items were found on the lines between Utrecht and Arnhem and between Amersfoort and Deventer, among others. Several level crossings failed with them and backed up road traffic. The Reisplanner app went down too, as DutchNews.nl reported.

Nobody cut a cable. Nobody hacked a signal box. Nobody derailed anything. Someone laid pipe across steel, and a wealthy country’s transport spine declined to move.

The predictable response is already assembling itself: this is hybrid warfare, the Russians are coming, double the security budget, put boots on the platforms. Note what the coverage actually supports. Dutch authorities have named no one. The Times of India’s write-up reaches for Ukraine’s Centre for Strategic Communication and Information Security; DW notes that French authorities had ruled out an attack in a train derailment two days earlier, which tells you how jumpy the continent is. Everyone wants to know who did it, and the honest answer is that we do not know and may never.

The attack cost less than dinner

That uncertainty is not a failure of the method. It is the method. A length of pipe can be bought for pocket change. What it produces is a national news cycle, a parliamentary question, an emergency review, and a NATO member state publicly explaining itself. The saboteur’s payoff is not the damage — the damage is trivial and repaired by lunchtime. The payoff is the meeting.

This is the part the security-spending consensus keeps missing. Deterrence is a tool for stopping acts whose value lies in their consequences. It is nearly useless against an act whose value lies in the argument it provokes. You cannot deter a man who wants to be discussed. You can only decide, in advance, how much of the discussion you are willing to hand him.

Fail-safe is a doctrine, not a virtue

Railway signalling rests on a principle that sounds like a compliment and functions like a liability: the system presumes the track is occupied until it can prove otherwise. A low current runs through the rails; anything bridging them — axle, animal, pipe — reads as a train. Ambiguity does not produce caution. It produces a red light and a stopped country.

This is why Dutch railways are among the safest ways on earth to travel, and it is why three corridors can be shut down by scrap metal. Aviation resolves ambiguity in the other direction: when something is unclear in the air, the default is generally to keep going, because diverting and grounding everything is presumed worse than the alternative. Both doctrines are defensible. Only one is cheap to attack.

Fail-safe systems are also honest. They announce that they do not know. The attacker does not need to fool the system, only to make it face a question it is obliged to answer with a halt.

A signalling technician waiting for clearance at a level crossing outside Amersfoort, tools still in the back of his van, put it less diplomatically. “The system did exactly what we built it to do. That’s the part nobody wants to hear. We don’t have a failure problem, we have a doctrine problem. Ask me for a fix and I’ll give you sensors. Ask me the real question and I’ll tell you the railways were never designed to be defended.”

What hardening cannot buy

The reflex answer is guards and fences. Consider what is being guarded. A national rail network is thousands of kilometres of track running through farmland, industrial estates, allotments and unlit outskirts — a fence you can climb in four seconds, at a hundred thousand points, in the dark. The cost curve of physical protection on a distributed network is not merely steep; it inverts. The first million buys you a great deal. The hundredth million buys you a patrol car.

What small money actually buys is detection and segmentation: sensors that notice a circuit tripping and locate it fast, redundant routing so that trouble on the Amersfoort line does not also eat the Utrecht line, and an information layer that stays up when the physical one doesn’t. NS’s own journey planner fell over on Tuesday. That is the cheapest thing on this entire list, and it was the one that failed first.

Which leaves the uncomfortable option, the one that no Dutch minister wants to say aloud: running trains in degraded mode. Reduced speed, on sight, on a line where someone may have put something on the rail. Every safety regulator and passenger association in Europe will fight that proposal, and they will be right that it carries risk. They will simply have to be told that the alternative carries more.

The bill nobody wants to vote for

Here is where the right-of-center reader should start feeling uncomfortable. The instinct in these moments is that more hardening equals more safety, and that the answer to a gray-zone attack is a bigger gray-zone budget. But hardening defends against destruction. It does not defend against embarrassment. A country that treats every uncertain circuit as an emergency has handed any bored vandal a remote control for its economy.

The genuinely conservative answer is not more guards. It is a doctrine change: treat uncertainty as a routine operating condition rather than an incident, build the redundancy to keep moving through it, and accept a slightly higher tolerance for risk in exchange for a far lower tolerance for being stopped. That is a harder speech in parliament than a security package, because it asks voters to accept a small ongoing hazard instead of demanding a guarantee.

Tuesday’s lesson is not that the Netherlands is soft, or that Europe’s infrastructure is unprotected, or that someone, somewhere, is winning. It is that a rich country built a magnificent system on an honest assumption — that when you do not know, you stop — and honesty is the cheapest thing in the world to exploit. The fix is not to become dishonest. It is to stop being surprised that somebody read the manual.

Sources