Evil twin: the name checks out, the network does not

On Tuesday and Wednesday the cybersecurity world gathers at the World Forum in The Hague. In June 2025, during the NATO summit held there, a Wi-Fi network was visible under the same name as the legitimate NATO guest network.

The AIVD devotes one paragraph to it in its annual report for 2025: during the summit the service and the police carried out a successful search for a rogue network, started when a Wi-Fi network became visible bearing the same name as the legitimate NATO guest network. Who was behind it, and to what end, is not stated.

A network presenting itself under the name of a legitimate one is what wireless security calls an evil twin. A visitor’s device sees a familiar network name, and in many configurations connects to it unprompted. Everything that passes over that network afterwards passes the person who set it up.

The Hague knows this pattern. In 2018 the Russian military intelligence service tried to get in over Wi-Fi from a car park beside the OPCW, within walking distance of the World Forum. That case is set out in the Nearest Neighbor Attack, where the same service reached the same goal four years later from thousands of kilometres away.

This week thousands of security professionals walk through that same building, carrying laptops, phones, hotspots and temporary infrastructure. Precisely the setting in which one extra network name does not stand out.

The same annual report carries a second figure. In 2025 the AIVD, together with the MIVD and the police, examined 124 rooms for eavesdropping equipment, hidden cameras and other sensors. Among others at the request of the Ministry of General Affairs and during the NATO summit. One hundred and twenty-four rooms in a full year, for the entire country.

How many of your rooms have ever been examined?

A network name says what a network claims to be. Not who is behind it.