Bangladeshi held in Bengal for Khalistan-linked bomb threat emails

The Ahmedabad Crime Branch and Cyber Crime Cell have arrested a man alleged to be part of an international cyber module responsible for sending bomb threat emails to schools, Metro services and government offices in Gujarat and several other states over the past year.

Addressing the media, Joint Commissioner of Police (Crime Branch) Sharad Singhal said the accused, identified as Saurabh Biswas alias Michael Biswas, was apprehended from West Bengal. Police claim he is originally a resident of Bangladesh and had been living illegally in India after entering the country during the Covid-19 pandemic in 2021.

According to officials, two types of threatening emails were circulated — some invoking the name of “Khalistan” and others warning of imminent bomb blasts at specified times. “In connection with the emails containing Khalistan-related content, one accused has been arrested. The investigation is of a sensitive nature and further details cannot be disclosed at this stage,” Singhal said.

Seven Ahmedabad cases linked

Police said at least seven cases registered in Ahmedabad — on dates including January 5, January 27 and February 16 — are linked to the accused. Similar emails were reported from Delhi, Maharashtra, West Bengal and at least six other states, triggering panic and extensive security drills.

Over the past year, several schools, the Ahmedabad Metro and government establishments had received bomb threat emails, some of which also referred to a “Tamil Nadu module”, officials said. Each alert led to evacuation and searches, though no explosives were found.

Modus operandi: hacked IDs, crypto payments

Investigators said Biswas allegedly specialised in hacking email accounts and manipulating recovery IDs and passwords. These compromised accounts were then used to send mass bomb threats and other provocative messages.

“The entire operation revolved around recovery email IDs. Once access was gained, credentials were changed and the accounts were sold or used for further activities,” an officer said.

Police claim the accused created and sold fake email IDs for sums ranging from $1 to $5, while in some cases he was paid up to 50 USDT (a cryptocurrency) per assignment. In the initial phase, he allegedly earned around $50 per email ID used for specific operations.

The Crime Branch laid a trap by transferring around $100 in cryptocurrency to establish contact and trace the accused. “We engaged him over WhatsApp and transferred US dollars in crypto transactions as part of the operation to reach him,” Singhal said.

Officials added that more than 250 email IDs are suspected to have been created or circulated by the accused so far. About 50 to 60 fake accounts directly linked to bomb threats have been identified.

Electronic devices, including a high-configuration computer, hard disks and other digital equipment, have been seized from his possession.

VPNs and proxies used to mask identity

Police said the accused used VPNs, proxy servers and masked IP addresses to conceal his digital footprint, making it difficult for agencies across states to trace him.

“Reaching the accused was extremely challenging. However, a minor technical error on his part enabled us to track him down,” an officer said, adding that multiple state police forces and central agencies were probing the emails, but the breakthrough came through a joint operation by the Ahmedabad Crime Branch and Cyber Crime Cell.

The accused was brought to Ahmedabad on transit remand and interrogated for 10 days, during which several disclosures were made. His sister’s alleged involvement has also surfaced, and further investigation is underway.

Fake identity documents

Police said that after entering India in 2021, Biswas allegedly procured forged Aadhaar documents and assumed a false Indian identity. Officers described him as Class 12 pass and “technically proficient”, claiming he operated as a cyber expert despite limited formal education.

Authorities believe the accused’s links may extend to international cyber mafia networks. However, officials declined to reveal details about the alleged mastermind, citing the sensitivity of the case.

A case has been registered under sections pertaining to cyber terrorism and other relevant provisions. Further investigation is being conducted in coordination with central agencies.

“This case serves as a serious warning about the evolving nature of cyber terrorism. More links of this international network are expected to emerge in the coming days,” Singhal said.