In a case that exposes the fractures of Slovak governance under Prime Minister Robert Fico and his allies, a coordinated international police operation in Ukraine has not only uncovered a likely Russian-backed campaign of bomb threats across Central Europe, but also ignited a diplomatic rift between Slovakia and its closest security partners. The 16 July 2025 arrest of a Ukrainian suspect in Dnipro—believed to be behind the September 2024 threats that paralysed schools in Slovakia and the Czech Republic—was the culmination of a joint investigation between Slovak, Czech, and Ukrainian agencies. Yet it was marred by the Slovak Police’s premature and uncoordinated announcement of the operation, issued while Czech officers were still deployed in the field.
The disclosure may have compromised the safety of Czech operatives in the conflict-affected east, a breach widely condemned in security circles as either recklessly politicised or dangerously amateur. Slovak authorities further inflamed tensions by omitting any mention of the Russian link later disclosed by the Czech Security Information Service (BIS), which reported the suspect’s actions were very likely financed by a Russian actor and accompanied by coordinated disinformation campaigns. The Slovak Minister of the Interior Matúš Šutaj Eštok—widely seen as an unapologetic populist politically loyal to Fico—defended the move and criticised the Czech intelligence service for “speculation”.
Members of Fico’s government have been repeatedly scrutinised for thier ties to Moscow. In 2025, its deputy chairman met with Sergey Naryshkin, director of Russia’s Foreign Intelligence Service (SVR), while Fico himself met with Putin twice in the last year and has only recently opposed EU sanctions on Russia. The scandal has not only revealed the growing permeability between Slovak political elites and Russian interests, but also deepened mistrust among Western intelligence and security partners, many of whom view Slovak services as compromised and unreliable—an erosion of credibility that stands in stark contrast to the professionalism attributed to their Czech counterparts.
A coordinated international police operation on 16 July 2025 led to the arrest of a Ukrainian national in the city of Dnipro in eastern Ukraine. The man is suspected of orchestrating a wave of bomb threats targeting schools in Slovakia and the Czech Republic in September 2024. The threats, which caused mass evacuations and significant disruptions to the education systems of both countries, are being investigated as acts of terrorism.
At the time of the initial threats in early 2024, Slovak authorities faced criticism for their muted public response. According to Slovak security analyst Victor Breiner, the police initially classified the threats merely as a “cyber incident” and failed to reassure the public or provide clarity. “The police said nothing more, gave no assurance that the situation was under control—which should be the first rule of strategic state communication in a crisis,”
Breiner wrote on Facebook. He further noted that, while the Czech interior minister publicly referenced a Russian link, Slovak authorities remained silent. Breiner also drew attention to a meeting that took place just days after the police’s vague statement. Between 1 and 9 January 2024, former Interior Minister Tibor Gašpar—father of the current director of the Slovak Information Service—and Richard Glück, then chair of the Slovak parliamentary defence and security committee, were seen in the National Council with Russian Ambassador Igor Bratchikov. When questioned by journalists, they claimed to have discussed “cybersecurity.”
The arrest was the result of nearly a year of joint investigation by law enforcement agencies from Slovakia, the Czech Republic, and Ukraine. The Slovak Police reported that the operation included early morning searches across several locations in Dnipro, during which investigators secured computer and mobile communication equipment believed to be crucial to the case.
Although the Slovak authorities were the first to announce the arrest publicly, it was the Czech Security Information Service (BIS)—the country’s domestic intelligence agency—that disclosed a potentially critical element of the investigation: the suspect’s activities were “very likely” financed by a Russian actor. BIS noted that the threats were part of a broader pattern of influence originating in Russian-speaking online environments and were accompanied by coordinated disinformation campaigns, one of which was attributed to a Russian media outlet.
In contrast, the Slovak Police did not mention any Russian connection in their official communication, prompting sharp criticism from Czech officials. According to the Czech Police and BIS, this omission disregarded prior coordination agreements between the investigative teams and created a serious rift between the two countries’ law enforcement bodies. Czech Minister of the Interior Vít Rakušan publicly expressed regret that the Slovak side had released details about the arrest without prior consultation, contrary to usual practices in international police cooperation.
The fallout from Slovakia’s premature disclosure extended beyond diplomatic embarrassment. According to reporting by the Czech weekly Respekt, the Slovak announcement came while operational teams were still deployed in Ukraine, near the conflict-affected eastern regions. The article cited security concerns that this uncoordinated move may have endangered the safety of officers on the ground. A communication by the Slovak Police, which initially acknowledged a “misunderstanding” about the timing of publication, was later edited to remove that admission.
Slovak Minister of the Interior Matúš Šutaj Eštok, a member of the governing Hlas party, defended the Slovak Police’s conduct, stating that the operation was a success and rejecting what he described as attempts to “devalue” the work of Slovak officers. He also called for mutual respect among international partners. Minister Eštok later criticised BIS for releasing information about the Russian link, arguing that it was an unverified hypothesis that could jeopardise the ongoing investigation.
Despite these tensions, Slovak officials emphasised their contributions to the raid, particularly the involvement of the national cybersecurity unit CSIRT, which operates under the Ministry of Investment, Regional Development and Informatics (MIRRI). Minister Samuel Migaľ praised CSIRT’s technical capabilities and highlighted the importance of investing in Slovakia’s digital security infrastructure.
In the Czech Republic, the case is being prosecuted under laws covering threats of terrorism, which carry penalties of five to fifteen years’ imprisonment. Slovak law provides for a maximum penalty of life imprisonment for similar offences. Investigators in both countries are currently working to determine whether the arrested individual acted alone or was part of a larger network. According to Czech Police, the suspect’s activities extended beyond the Czech Republic and Slovakia to include other European countries.
The political opposition in Slovakia strongly condemned the government’s handling of the case. Michal Šimečka, leader of the liberal party Progresívne Slovensko (Progressive Slovakia), accused the government of suppressing information about the Russian connection and undermining trust with European allies. He warned that the administration of Prime Minister Robert Fico is isolating Slovakia on the international stage and serving Russian interests. Other opposition lawmakers, including Jaroslav Spišiak and Zuzana Števulová, echoed these criticisms, warning of growing Russian influence in Slovakia and accusing the government of distorting facts to shift blame onto Ukraine.
Czech officials, meanwhile, reaffirmed that their law enforcement agencies played the leading role in the Dnipro operation. BIS and the National Centre Against Terrorism, Extremism and Cybercrime (NCTEKK) were central to the year-long investigation. The Czech Police were initially reluctant to release information about the arrest, intending to coordinate a unified communication strategy with Slovak and Ukrainian counterparts. They eventually confirmed the arrest following Slovakia’s public announcement.
Some of the threatening messages were reportedly distributed via the encrypted messaging platform Telegram by a user operating under the alias “maniaksatana.” Telegram is widely used in Russian-speaking online communities and has been identified by multiple European security agencies as a platform exploited for spreading violent extremist content. The user in question allegedly admitted to sending the bomb threats and claimed to have administered a private Telegram channel used to incite violence.
According to the Czech BIS’s most recent annual report, the September 2024 bomb threats were linked to a Russian-language online environment and were accompanied by specific “supporting informational activities”—a term often used to describe influence operations and disinformation. The investigation remains ongoing, with the possibility that further suspects or financiers may be identified.
