The tragedies in the Petrokhan and Okolchitsa region shook society with their difficult questions and contradictory versions of what happened. Six victims, numerous hypotheses and institutional reactions that gave rise to both trust and doubts. About the logic of the investigation, the role of the services and possible gaps in the security system… Assoc. Prof. Milen Ivanov, former deputy rector of the Ministry of Interior Academy and national security expert, speaks to FACTI.
- Mr. Ivanov, the tragedies of Petrokhan and Okolchitsa caused a great resonance. But… Why are the three bodies found in Petrokhan not included in the Ministry of Interior's summary for the day. Let's start like this? When is such a tragedy omitted from the Ministry of Interior bulletin?
- The daily bulletin of the Ministry of Interior has a specific operational purpose. It does not represent a complete picture of all events, but selected information intended for quick orientation and public communication, without jeopardizing ongoing investigative actions. In this logic, the absence of a specific case in the bulletin is not in itself automatic evidence of omission or concealment. There are several possible explanations.
First - in serious incidents with unclear circumstances, the initial work is often done along the lines of "found body" until the forensic and criminalistic picture is clarified. Until then, the information is sometimes not included in the public bulletin.
Second - when potentially related persons are being searched for and the crime scene is still being processed, it is entirely possible to apply operational considerations for temporary information restriction. The goal is not to compromise the search, not to signal possible accomplices and to maintain procedural purity. Thirdly - the daily bulletin also has purely technological limitations: it is prepared at a certain time and does not always reflect events in a dynamic phase.
In the presence of active search operations, an unclear initial situation and an incompletely processed crime scene, the temporary absence of information from the bulletin can also be a purposeful operational decision, and not necessarily an omission.
However, the final assessment should always be made after the facts and official announcements on the case have been stabilized.
- The initials of the victims are also missing from the first comments from the authorities, which is also not common practice. Time is gained or...
- The lack of initials of the victims in the first official announcements is indeed striking, but it should not automatically be interpreted as an omission or an attempt to conceal information. In the practice of the Ministry of Interior and the Prosecutor's Office, there are cases, especially in severe and dynamic investigations, when publicity is deliberately dosed. When the situation surrounding the crime has not yet been clarified, the institutions work with increased caution. In the initial stage, key elements are often specified - the exact chronology of events, the number of people involved, the mechanism of the act and the connections between the participants. Until this picture stabilizes, any premature disclosure of specific data can create undesirable effects.
From an operational point of view, the main risk is not to give an information advantage to a possible perpetrator or his accomplices.
Sometimes it is through public details that suspects assess what investigators know and adjust their behavior accordingly. Therefore, in such situations, it is not excluded that institutions consciously “buy time“ while they form their working hypotheses and complete the initial procedural and investigative actions.
In this sense, the more likely explanation for the lack of initials is related to the unclear situation at that time – including the chronology of the committed crime and the possible number of persons involved. This is a protective approach aimed at preserving the procedural purity and efficiency of the investigation, and not necessarily an indication of an unusual omission.
The final assessment, of course, can only be given after the facts of the case are fully clarified and officially confirmed.
- We have a TOLL system, we have road navigation, and a camper with Ivaylo Kalushev travels around Bulgaria without being detected. How does this happen?
- The question seems logical at first glance - we have a TOLL system, we have navigation and video surveillance networks, and a wanted camper is moving around the country. However, it later became clear that Ivaylo Kalushev's vehicle was actually detected by the cameras. The problem is not the lack of traces, but the operational complexity of tracking them.
It seems that Kalushev acted quite resourcefully and made efforts to minimize his passes through checkpoints and cameras. This does not make a vehicle "invisible", but it greatly complicates and slows down real-time tracking. The systems work effectively when there is already a specific object to search for - a specific number, model and direction of travel.
After it was established that it was his camper van that was of interest, the information from the cameras was submitted to the Ministry of Internal Affairs and the classic search operations began. In such cases, work is done from the last confirmed point - the last camera that detected the vehicle - and a so-called probabilistic perimeter is built. The problem here is that this perimeter can be very wide, especially in mountainous and secondary road areas.
That is why the obvious directions are checked first, and in parallel, recordings from municipal and private video surveillance cameras are requested.
It is this multi-stage check that explains the delay in locating the camper in the Okolchitsa area.
An additional complication is always the working version for a possible change of the registration number. In such a hypothesis, the car temporarily “falls” out of the system's automatic filters until the number used is identified or the version is rejected. This requires a broader and slower analytical approach. Ultimately, the discovery of the camper was accelerated by a combination of circumstances, but given the available traces and the narrowing of the perimeter, it is very likely that the police authorities would have reached this area anyway.
- Could the second three victims - Kalushev and his companions, have been saved?
- This is one of the most difficult questions in such cases – not so much legal as retrospective-analytical. With the current public information, a definitive answer cannot be given as to whether the second three victims could have been saved. But from an operational point of view, logical hypotheses can be outlined.
Even at the initial stage, there were enough indications that Kalushev was deliberately avoiding contact with the Ministry of Internal Affairs authorities. This behavior in itself is a strong indicator. When we have three corpses in one place and in parallel – a group of three people who are on the run, the natural working hypothesis always includes an internal connection between the two events.
If we accept the alternative version - that the three are running from an external perpetrator - then the question logically arises why they do not immediately seek protection from the police.
In practice, this is the typical behavior of innocent witnesses who find themselves in a deadly situation. Of course, there are always subjective factors - fear, distrust, shock - but as a probabilistic model, hiding usually draws attention to an internal risk within the group itself.
On the other hand, if there was indeed a potential perpetrator or accomplice among the fugitives, it is logical to assume that prolonged hiding in a small group is an unstable situation. Such configurations rarely last long without escalation. After the initial adrenaline rush, a phase of “sobering“ often occurs - mutual suspicions, fear of detection, disagreements about the next steps begin. It is in this psychological window that the risk of internal violence sharply increases.
Therefore, even then, a cautious probabilistic assumption could be made that with prolonged hiding, the danger to the lives of at least part of the group is high. However, this is an analytical assessment, not a sure prediction – in real time, the services work with incomplete information and multiple parallel versions.
If we assume that the factual situation at Okolchitsa announced by the Ministry of Interior is reliable, one of the possible explanatory models is indeed an internal escalation in the group after the initial shock and pressure from the search. But final conclusions can only be drawn after the full volume of evidence – forensic, ballistic and procedural.
In other words: risk indicators can be outlined retrospectively, but a categorical statement that the outcome was preventable would require a much more complete evidentiary picture.
- SANS were on site, SANS were not on site - allegations…. What is the role of SANS in a criminal investigation in general…
- The allegations “ SANS were on site“ or “ SANS were not on site“ without clear evidence remain at the level of speculation. The more important question is what, in principle, is the role of SANS in a similar case.
In this case, I see a role for SANS only if the agency had operational developments of the group or part of it and/or if people from this group were its voluntary collaborators. Such information has not been officially released at this time, but the public has the right to receive clarity on this issue.
The essential thing here is something else - why the National Security Agency (DANS) stopped its active actions after the withdrawal of the signal about the children. We are talking about a crime of a general nature, but also about circumstances that potentially affect national security - including suspicions of drug trafficking through ties with Mexico, as well as hypotheses about a structured group with paramilitary characteristics in an extremely sensitive area.
A quick review of the biographies, cohesion, training, equipment, weapons and lifestyle of these individuals - which, as is evident from the distributed report, was done - is
should have raised a serious red flag that something in the profile of these “environmentalists“ does not fit into the usual pattern.
These are indicators that in principle require a thorough counterintelligence check on all versions - including the possible involvement of foreign special services in the activities of this NGO. Society owes an answer not so much to the question of “who was there“, but whether all relevant versions have been thoroughly checked and with the necessary institutional seriousness.
- Kalushev “flees“ to... commit suicide? He holds hostages across half of Bulgaria?
- The version “Kalushev flees to commit suicide“ at this stage sounds more like a simplified retrospective than a convincing primary motivation. According to the facts that we have publicly available, he began his active movement and hiding after the sudden return from the sea – a moment that is key in itself and has yet to be explained.
This is precisely the task of the investigation and operational-search work: to restore the logic of behavior - what caused the abrupt change, what contacts he had immediately before, what decisions he made in a short period of time. In such cases, the chronology often says more than the individual facts.
If a person is only planning suicide, the classic pattern of behavior is usually different from prolonged movement, hiding and keeping other people in the orbit of events. However, this is not evidence in itself - mixed motives are also possible, including escalation of intentions in motion.
Therefore, at the moment, the more professional approach is to avoid categorical psychological conclusions and to wait for the full clarification of:
-- the reason for the sudden withdrawal from the sea;
-- the dynamics of his movement across the country;
-- the role and behavior of the companions;
-- and the exact sequence of events until the finale at Okolchitsa
In other words - the key is in the logic of the chain of decisions, and it can be restored only through the comprehensive evidentiary and operational analysis of the case.
- We have 6 murders. Do you understand what the motive is?
- At this stage, we cannot speak categorically about “six murders“. According to the information officially released so far about the Petrokhan case, a version of two murders and four suicides is being worked out, but this ratio may change upon the overall assessment of all evidence – forensic, ballistic and procedural.
That is why the question of motive is key. Revealing the internal logic of what happened will determine not only the legal qualification of the acts, but will also show whether there are other accomplices, as well as whether there are additional crimes surrounding the case.
In criminal practice, motives are rarely an infinite spectrum – they are usually grouped around a few stable cores: money, passion, ideology or order. The final picture of the investigation will depend on which of these versions will be proven or convincingly ruled out.
Therefore, at this stage, the more professional approach is not to rush to final conclusions, but to wait for the full evidentiary assembly of the case. It is the motive that will show whether this is an isolated criminal act, an internal escalation within the group, or a more complex criminal configuration.
- Will we have an answer as to why all this happened?
- Society has every right to expect a clear answer as to why all this happened – and the state owes such an answer. This is a matter not only of criminal justice, but also of institutional trust.
However, whether we will get the whole picture remains an open question. In practice, the degree of publicity often depends on how complex the case is, how many people are involved, and what the nature of their activities is. In more complex configurations, sometimes only part of the facts are made public – due to pending proceedings, classified information, or procedural restrictions.
However, this carries its own risks. If society does not receive a convincing and consistent picture, the vacuum is almost inevitably filled with speculation and conspiracy theories. And any feeling of understatement further erodes trust in institutions.
Therefore, the healthiest outcome is maximum clarity within the framework of the law - sufficient to understand the logic of what happened and to see that all relevant versions have been thoroughly verified. Only in this way can this difficult public case be closed in a way that restores trust, instead of undermining it.
- We have signals to the National Security Agency about the work of the murdered, but there is a 2-year “pass“ there. Why?
- Regarding the issue of the two-year “pass“ in the presence of signals to the National Security Agency, one can speak responsibly only after an institutional check. In principle, the explanations can be different – from lack of sufficient data in the initial signal, through redirection by competence, to work on a line that is not publicly visible. But the specific answer can and should come only from the management of SANS.
That is why in such a situation it is necessary and statesmanlike to conduct an inspection of SANS, within the framework of legality supervision. This way, the public can get a clear answer whether it is about objective operational reasons, an institutional omission or something else.
Such an inspection is not directed against the service, but is a normal mechanism for restoring trust. Because with such a heavy public response, the worst-case scenario is that the feeling of an inexplicable pause in the work of any service remains.
The public has the right to know what was actually done on the signals – and what not.
- If a conclusion had to be drawn about the whole incident at this point, what would it be?
- If a general conclusion had to be drawn at this point, it could hardly be comforting. The case shows serious deficiencies in the early recognition of risk indicators and in the coordination between the surveillance, analysis and response systems.
It seems that the state failed to promptly integrate the available information - from signals, behavioral models and technical observations - into a working picture of the risk. This does not automatically mean “loss of control over the territory”, but it clearly speaks of gaps in the ability for preventive detection and rapid operational synchronization, especially when it comes to groups with an atypical profile.
The real test of the system is not whether it can react after the tragedy - this usually happens - and whether it can recognize in time behavior with the potential for a serious crime or a threat to national security. It is here that the case raises the most serious questions.
However, the final institutional conclusion should be made after a full evidentiary analysis. Until then, the most accurate professional conclusion is that there are visible weaknesses in the preventive and coordination capacity, which the state owes to society to analyze openly and correct systematically.
----------------------------
Milen Mirchev Ivanov is the author of specialized literature related to the Ministry of Internal Affairs, security and police tactics. His works present theoretical principles and applied models for work in the sector. His famous books include: "Infrastructure of Intelligence", "Policing Tactics", "Shadows of Power", "The Bodyguard - The Last Line of Defense", Corporate Security 2025, Counterintelligence - Secret Tools of Influence, etc.