- Routine intelligence led to uncovering a major espionage network linked to Pakistan handlers
- At least 22 arrested, including minors, in a structured operation targeting military and rail sites
- Network used encrypted apps, paid youths Rs 5,000-20,000 per task to gather sensitive info
What began as a routine intelligence input at Ghaziabad's Kaushambi police station on March 14 has now unfolded into one of the most serious espionage cases in recent times. It first looked like a group of youths indulging in "suspicious activities". But it has revealed itself as an organised module operating under direct instruction from handlers across the border in Pakistan.
At least 22 people have been arrested so far. Several minors were also involved in the chain, and the network was neither local nor amateur.
Police moved in quickly after the initial alert that said youths in Uttar Pradesh's Bhovapur were taking photos and videos of railway stations and military bases and sending them abroad. The lure was money. They were told to recruit more youths in order to earn more.
Six accused - five men and a woman - were arrested in the first sweep by the police. Their phones carried material that changed the direction of the investigation. Galleries filled with videos, photographs, location tags and installations connected to the military. There were also railway nodes and camp perimeters, which were enough evidence to confirm that a structured operation was underway, not just a neighbourhood hustle.
A special investigation team (SIT) was formed immediately including personnel of Indirapuram Police, Crime Branch, cyber crime, intelligence, and SWAT. The interrogation of the arrested accused began on March 17, after which the SIT found the command structure quickly. They have been identified as Suhail Malik, Naushad Ali and Sameer alias Shooter, all operating from Pakistan.
Their recruitment pipeline ran through social media and encrypted messaging apps. The instructions were specific like which railway stations to film, which perimeters to map, what angles to shoot, and when to send coordinates.
The payments ranged from Rs 5,000 to Rs 20,000 per 'assignment'. These amounts are small enough to blend in but large enough to lure vulnerable youths.
Four of the six arrested accused had travelled to Jammu and Kashmir's Pulwama earlier. There, they sent sensitive intelligence back to Pakistan. Investigators now believe the network was part of preparations for a second large-scale attack in Jammu and Kashmir.
In this context, it was more of a pre-attack reconnaissance and not just espionage.
The SIT discovered other alarming terror plans. The network wanted to install solar-powered CCTV cameras along the Delhi-Jammu railway corridor to stream live feeds directly to Pakistan and track military movement.
A camera at Delhi Cantonment and Haryana's Sonipat were already operational. Forensic teams are analysing the recovered units, and early indicators suggest a larger target list of nearly 50 installations across the country.
Had the network reached that number, the surveillance of troop mobility would have been continuous, investigators believe. The group used a foreign-controlled mobile application for direct transmission of photos, videos, and GPS data. Online training modules came from abroad and over 450 files have been traced back to Pakistan.
The recruitment focused on youths with technical skills such as those working at mobile repair shops, those who do CCTV work, and those with basic networking skills. Economically vulnerable youths were added to the mix, and women and minors were used to reduce suspicion.
One of the key recruiters has been identified as Iram alias Mahak.
Parallel Operation
A parallel operation was launched in the background to investigate an OTP and SIM supply racket. The accused forwarded Indian OTPs abroad, enabling foreign actors to run WhatsApp and social media accounts with Indian numbers. Payments ranged from Rs 500 to Rs 5,000.
SIM acquisition was built on a set of interchangeable tactics such as snatching, phishing, forged IDs, and pre-activated SIMs via agents. Money moved through UPI but avoided personal accounts. The funds were routed through Jan Seva Kendras and small shops and cash withdrawals ensured minimal traceability.
On March 20, the SIT arrested and detained nine more people, including five minors. The module had links in Uttar Pradesh, Bihar, Maharashtra, and Nepal. The geography yet again confirmed this was not a neighbourhood cluster but a dispersed recruitment and logistics network.
On March 22, Naushad Ali alias Lalu was arrested in Faridabad. He ran a tyre-puncture repair shop at a fuel station - an ordinary job and life, but a concealed role. With him, the police detained Meera, an e-rickshaw driver in Mathura and a minor.
She had earlier been arrested by the Delhi Police Special Cell in a weapons-supply case. Her current links point to Sarfaraz alias Sardar in Pakistan as she helped recruit women and supported logistics.
Sameer alias Shooter remains untraceable. Agencies believe he is central to the Pakistan-based module. The NIA, ATS, and the police in UP, Delhi, and Haryana are coordinating the chase. Investigators will now take the accused to every site where cameras were installed, videos were recorded and SIMs were purchased to reconstruct the chain.
Track Latest News Live on NDTV.com and get news updates from India and around the world
