NEW DELHI: Delhi Police claimed on Tuesday they were investigating a larger conspiracy behind the barrage of bomb hoaxes sent to schools which had kept the city on tenterhooks through 2024. Forensic investigation of a laptop and phone seized from a student identified and located last week has allegedly led the cops to an NGO which was supported and closely associated with a political party, police claimed. They named neither the NGO, nor the party.
Special CP Madhup Tiwari said police carried out a background check of the accused after it emerged that he had allegedly sent 400 emails to schools between Feb 2024 and Jan 2025. “It emerged that an NGO had significant influence at the workplace of the juvenile’s guardian. This NGO has a long-standing association and deep connection with a political party. This NGO is known for opposing the hanging of Afzal Guru, a terrorist involved in the 2001 Parliament attack,” Tiwari said.
How cops traced origin of bomb hoax emails
“It (the NGO) also openly engages in advocacy of and supporting a particular political party on various issues. The influence of this NGO and its proximity to a political party raises critical questions about a possible larger conspiracy to create public unrest through disruptive tactics. Through scientific means, digital forensic analysis and other technical surveillance and intelligence apparatus, further deep investigation is in progress to ascertain the angle of the larger conspiracy, players involved (directly or indirectly) behind this sinister activity and other such hoax emails,” Tiwari added.
The probe is now focused on ascertaining if the accused student acted alone. “It seems unlikely that he did due to several factors. The probe is at an initial stage. We will divulge more at an appropriate time,” said Tiwari. During questioning, the juvenile claimed to have sent the mails to get an exam postponed or cancelled but the cops found instances where he sent out mails when there were no exams. He didn’t answer when the cops pointed this out, prompting the cops to probe a bigger conspiracy.
According to police, the hoax threats were delivered through heavily encrypted email services and complex digital pathways, indicating an intent to conceal identity and evade detection. Considering the technical complexities and advanced techniques used in sending these emails, besides the involvement of a juvenile, the role of other entities was also probed.
The first email from the accused allegedly came in Feb 2024. In May last year, he allegedly sent mails to 250 schools at one go, police claimed. The last mail came on Jan 7-8 this year when 23 schools received hoax mails. The sender used the ID troyisns@gmail.com and wrote that powerful bombs had been planted to destroy buildings and harm everyone within the blast radius. The email also claimed that the invigilators would be distracted during exams and the bombs would be detonated at that “precise moment” to cause maximum impact.
The cops used advanced cyber forensic techniques to trace the origin of these emails. Earlier, the mails had been sent using a VPN service. The cops had sought replies from Google, service providers and VPN firms. This time, sources said, the VPN plan of the accused student had expired, exposing the IP address of the sender.
The cops subsequently located the device using IPDR (internet protocol details records) analysis. The investigators successfully identified the accused using digital footprints and email-tracking mechanisms. “The accused used multiple anonymous and encrypted email service providers and advanced tools to conceal his identity. However, advanced technical methods helped in uncovering his digital trail. He was traced to his residence, where a search operation was conducted and two phones and a laptop were seized,” said DCP Ankit Chauhan.
“These devices were subjected to a preliminary forensic analysis, revealing conclusive and irrefutable digital evidence directly linking the accused to the threatening emails,” he added.
A preliminary examination and analysis of the evidence have revealed that the primary motive behind these hoax threatening emails was to create panic and disruption in schools, the police said. An extensive probe is still on to decipher the exact motives behind sending such a large number of hoax emails, officials said.
The case was investigated by a special team led by joint CP Sanjay Jain and DCP Chauhan. The SIT comprised additional DCP Achin Garg, ACP Abhinendra Jain, inspector Hansraj Swami and SI Sandeep Saini amongst others.