Last year, 43 false bomb threats were recorded in Montenegro, causing school closures, and police say that the perpetrators identified were most often minors.
According to the records of the Police Directorate, 38 false reports of planted bombs were sent last year to the e-mail addresses of educational institutions in Podgorica, Nikšić, Bar, Cetinje, Tivat, Bijelo Polje, Danilovgrad and Ulcinj.
"In 18 cases, the perpetrators were identified, and based on these proceedings it can be concluded that the perpetrators are most often minors," the Police Directorate told Vijesti.
On February 22, the police filed a criminal complaint against a minor from Ulcinj who last December sent a message from an Instagram profile to the administration of the "Maršal Tito" Elementary School in Ulcinj, stating that a bomb had been placed in the school and was about to explode.
She is charged with committing the criminal offense of causing panic and disorder, while a request has been filed against the parents of the fourteen-year-old girl to initiate misdemeanor proceedings for neglect in the family.
The first false bomb threats in Montenegro were recorded in March 2022, targeting mostly primary and secondary schools. The wave of threats has since spread to other countries in the region, with new false reports prompting the evacuation of courthouses, shopping malls, government institutions and airports.
Although no real bombs were found in any of the cases, repeated false alarms, police actions, school closures, and evacuations disrupted classes and affected people's mental health.
Due to false bomb threats that were repeated daily, schools in Montenegro held online classes twice in 2022.
The Ministry of Education, Science and Innovation states that schools have been evacuated every time bomb threats are reported.
"Although all previous cases of threatening emails arriving at the email addresses of educational institutions were false reports, all activities prescribed by law are always carried out. In practice, this means that classes are immediately suspended, students are evacuated, and the Police Directorate inspects the facility. After a security check, students return to classes," the Ministry of Education said.
Students are looking forward to the reports
According to data from the Police Directorate, from 2022 to March 2024, 46 false bomb reports were registered, of which seven cases were solved, and the perpetrators of the criminal offense of false reporting were children under the age of 14.
False bomb threats are treated in Montenegro as a criminal offense of causing panic and disorder or causing general danger, for which the Criminal Code provides for a fine and imprisonment of up to one year.
In the event that the perpetrator is a minor, responsibility is transferred to the parents who are charged with neglect under the Law on Protection from Domestic Violence.
The director of Podgorica's Slobodan Škerović Gymnasium, Zoran Pejović, claims that last year, emails with false reports were sent to the school's address about ten times.
"All reports are accompanied by joy and support from students, even when they disrupt scheduled written tests or reduce the space for grading. Such a reaction is continuous. Parents generally did not panic and did not announce that they would not send their children to school due to the reports. However, some absences were subsequently justified by fear," said Pejović.
The assistant director of the Stojan Cerović Gymnasium in Nikšić, Slobodanka Žižić, claims that they had eight anonymous tips last year, emphasizing that in each case, they acted in accordance with security protocols.
"The first report caused more pronounced anxiety, while later situations were calmer thanks to clearly defined procedures," said Žižić.
Investigations are complicated and lengthy
The Police Directorate states that platforms that ensure user anonymity were used in most false reports.
"Threats were made using email platforms that provide anonymization of users in order to replace identification data and protect their privacy. The complexity of information technology allows easy concealment of traces with minimal knowledge, which prolongs the course of the investigation. In serial and international cases, investigations can last from several days to several months of active work," the Police Directorate said.
Regional media previously reported that threatening messages were being sent via "Proton Mail", "Eunet Mail" and "Landek", which provide anonymity to their users.
Europol's report on hybrid threats and the misuse of digital tools states that digital platforms enable anonymous false bomb threats as a form of destabilization that creates panic and wastes resources.
The US Cybersecurity and Infrastructure Security Agency (CISA) announced last August that hoax bomb threats have become a significant and cheap tactic for spreading panic, stating that the threats are often made via email, phone or social media.
Professor at the Faculty of Information Technology and court expert in the field of digital forensics, Nikola Cmiljanić, states that threats via e-mail cannot be observed only through the content of the message, stating that the most important thing is to look at the infrastructure through which the message passed and the data stored by the services where the account was opened and used.
"It is relatively easy for a person with basic knowledge to hide a directly visible IP address by using a VPN or the Tor network, as well as to open a new account without personal data. However, in technical terms, this usually does not mean that the traces disappear, but that they are moved to other places," claims Cmiljanić.
Cmiljanić points out that the difference between amateur senders and organized groups is reflected in discipline and methodology, stating that amateurs leave uneven traces and repeat the same orders and writing style. Organized groups, he argues, demonstrate consistency, planned timing, and distribution of communication across multiple identities.
"When it comes to possible foreign influence, the geolocation of an IP address or the use of foreign services cannot be evidence in itself. Campaign patterns are more reliable - repeating patterns towards multiple targets, time alignment with other zones, and infrastructure similarities between incidents," Cimiljanić said.
Bonus video:
