When hundreds of schools receive a threat within days and every one of them turns out to be false, the damage lies not in what failed to happen but in everything that had to be set in motion.

After a wave of false bomb reports, Croatian police detained three young men, two of them minors, on suspicion of terrorism. Nova TV’s evening news discussed the case with security expert Tonći Prodan, who pointed out that at the start of a criminal investigation every version has to be treated as equally plausible, from hybrid activity and organised crime to a group of youngsters who know each other from online games. The same broadcast featured Tomislav Vazdar, founder and CEO of Riskoria, on the part of the story that rarely reaches a headline: the price the system pays every time a report comes in, whether or not it is true.

One report never costs one report

Every threat triggers the same sequence. Somebody has to receive and assess it, the school stops teaching and walks the children out, police send a patrol and a bomb disposal team, firefighters and paramedics stand ready, the head teacher informs the parents, and the school day is no longer the one that was planned. Repeat that two hundred times and the cost does not add up in a straight line. The system is stretched instead: people and vehicles standing in one place cannot be in another at the same time.

Vazdar describes this as an attack on the capacity to respond rather than on a building. The logic matches denial of service in networks, except that what gets consumed here is not servers but shifts, fuel and patience. That is why the question of whether the sender genuinely meant to hurt anyone is not the only question worth asking. Capacity spent on an empty report is missing from whoever calls that same afternoon about something real.

The trail crosses a border before the investigation starts

The message travels through a server in one country, from an account opened with a provider registered in a second, after a conversation on a platform operated from a third. No single police force can close that chain alone, which makes international cooperation a precondition rather than an extra. Croatia is a party to the Council of Europe Convention on Cybercrime, known as the Budapest Convention, which for precisely this reason sets up a network of contact points available at any hour, Article 35, so that data can be requested and preserved before a provider deletes it. Europol and Eurojust sit alongside it, joining investigations that run in several countries at once.

Time is the real opponent here. Access and delivery records are kept briefly, and the clock on them starts when they are created, not when an investigation finally begins.

Forensics is what turns suspicion into evidence

Digital forensics in cases like this is not a scene about cracking a password. It is the patient assembly of records: message timestamps, delivery data, how the account was opened, which device signed in, a pattern of phrasing that keeps recurring. In the same broadcast Prodan stressed that personal and physical traces exist alongside digital ones, and that offenders are found by combining them, as happened here.

The gap between suspicion and evidence is not paperwork. A court decides on what has been gathered in a way that survives scrutiny, not on public impression, and with terrorism the hardest part is proving intent. That is why a message is preserved in its original form, headers included, rather than as a screenshot.

When the offender is a child, responsibility does not stop

In Croatia a child under fourteen bears no criminal responsibility. A younger minor, from fourteen to sixteen, can receive educational measures only, while an older minor, from sixteen to eighteen, may under the conditions of the Juvenile Courts Act also receive juvenile imprisonment.

Vazdar argues the story cannot stop there, because criminal proceedings are not the only route. The Civil Obligations Act, Article 1056 paragraph 4, makes parents liable for damage caused to others by their minor child over the age of seven unless they prove the damage arose without any fault of theirs, and Article 1059 provides for parental liability even where supervision rested with somebody else, if the damage followed from poor upbringing and poor example. The cost of the call-outs, the interrupted lessons and the teams deployed is not an abstract figure. Somebody paid it.

This is not about retribution. It is about the consequence reaching the household the message was sent from. While the investigation continues the presumption of innocence applies, and proceedings against a minor are held without the public present.

What this means for an institution on the receiving end

A school, a hospital or an office that receives a threat thinks about evacuation first and evidence second. Both belong to the same minute. Preserve the message in its original form, note when it arrived, who saw it, who decided what and at what time, then hand that record to the police together with the report. That is the difference between a case that can be investigated and a case that stays at the level of impression.

For organisations covered by the Cyber Security Act the habit is already an obligation. Measure 11, incident handling, requires basic procedures at every level along with training staff to recognise and report suspicious events, which we cover on the page about the thirteen measures, while the working shape of it is described under incident management. An institution that has this written down has nothing left to invent when the phone rings.

This wave will pass, as it has in other European countries. What remains is the response capacity an organisation had built by then, or had not. The Nova TV report is available on their site.