Man accused of sending terror email after blast acquitted

 Ejaz Shaikh

Mateen Hafeez





Mumbai:  A Sewri court on Tuesday discharged Ejaz Shaikh (28), a suspected Indian Mujahideen (IM) operative, in a case of sending terror email after the 2010 Varanasi bomb blast.
Shaikh, a Pune resident, was first arrested on September 6, 2014, from outside Saharanpur station in UP by the Delhi Police's special cell. Later, he was taken into custody by the Maharashtra ATS for his alleged role in providing logistics in the 2010 Pune German Bakery blast, the 137 Mumbai triple blasts and the Varanasi email case. On February 6, this year, Mumbai crime branch's cyber crime investigation cell (CCIC) took Shakih in custody for allegedly sending another terror email after a blast outside Delhi's Jama Masjid.

“During the investigation, the police did not find evidence against Shaikh and hence we filed an application under Section 169 of the Code of Criminal Procedure requesting the court to discharge him from the case,“ confirmed a senior ATS officer. Shaikh's lawyer, advocate Tahawwar Rana, said, “We have been saying my client is innocent. Today , the court has discharged him.“

On December 7, 2010, a day after the completion of 18 years of Babri Masjid's dem olition, an email was sent from Mansarovar building, Section 17, Vashi, claiming responsibility of the Varanasi blast. The sender had hacked into the unsecured WiFi of the sixth floor residents. The email was sent with a subject, “Indian Mujahideen ­ Let's feel the pain together“, and the mail focused mainly on the Babri Masjid demolition and Ayodhya verdict.

The police had earlier said that besides sending emails, Sheikh used to provide logistics to the IM men in India and prepared fake identities needed by them to procure mobile SIM cards, collecting foreign money transfers, obtaining rooms on rent and even in getting enrolled in professional educational institutions as a cover, police said. Police said he was never present during the actual crime.

The Times of India, Apirl 8, 2015

‘IM’ tweet traced to Karachi cyber cafe: Investigators

Policemen step up patrolling at Dadar station on Friday

City On Alert For July 13 Threat

 

Mateen Hafeez TNN

Mumbai: Security agencies, probing intothesuspectedIndian Mujahideen (IM)tweet,have reportedly zeroed in on a cyber café in Karachi from where the message claiming responsibility for the Bodh Gaya serial blastshadbeen uploaded. 

    Theclaim on theBodhGaya blasts may not be genuine, but the fact that the account generated its first tweet barely 16 hours before the explosions forced the agencies to take it up with the US-based micro-blogging giantTwitter Inctofindout the location that could have been usedtouploadthetweet.  Now, security personnel in the city are worried about Saturday—July 13—when the outfit has reportedly threatened to createhavocin Mumbai.
 

    July 13 is coincidentally the second anniversary of thetriple blasts in Mumbai. On July 13, 2011, three bombs planted at Zaveri Bazar, Opera House and near Dadar station exploded, killing 27 and injuring 127. The ATS arrested five suspected IM operatives, and the trial is still on in thecase.
 

    On the Centre’s request, Twitter Inc, on Thursday, suspended an account—@Indian-Mujahidin—for violation of the Twitter rule. But a second accountimmediately appearedon the site showing continuation from the first one and giving a deadline of 48 hours (July 13) to attack Mumbai. The new account even taunted by tweeting “Dekhte hai tum log kitne accounts block karte ho (Let’s see how many accounts you guys will block).” The first account issued a warning via its first tweet on July 6, giving a sevendaytimeframe.
 

    “Though it does not seem to be genuine, we cannot take a risk. Citizens’ safety is our priority. The tweet could be fake or someone mightbecreating panic, but we have to be on alert. The entire Force One staff, Quick Response Team commandos and special squads are on standby duty,” said an officer.
 

    “We do not think it is the IM who is tweeting. It is also possible that someone might have createdtheTwitter handlewith this name andisusedittocreate panic.IMhas notsent any email describing or claiming responsibility. Moreover, the terror outfit is known to have been using mobile internet to send threat mails,claim responsibility or communicate with media houses. It has never used a cyber Café where the chances of getting caught arehigh,” added another officer. 

 
    IM & THE JULY CONNECTION
    On July 13, 2011, three blasts in planted at Zaveri Bazar, Opera House and near Dadar railway station exploded, killing 27 

    More than 24 blasts rocked Ahmedabad, killing 50, and equal number of bombs were found and defused in Surat on July 26, 2008 

    Four blasts were to be executed on July 31, 2012, on JM Road in Pune, but the operation got delayed by a day; the bombs exploded on August 1, 2012

The Times of India, July 13, 2013

BOREDOM, REVENGE DRIVE TERROR HOAX CALLERS

Offenders Behind Terror-Related Hoax Calls & E-Mails Are Jilted Youth Seeking Revenge Or Teens In Search Of Fun And Fame

Mateen Hafeez | TNN

Terror e-mail hoaxes have become the weapon of choice for the jealous or jilted lover and the teenager or young professional looking for a bit of fun or fame. The police are now calling for stricter laws to act as a deterrent to future callers. In the past, most offenders simply got away with a rap on the wrist despite the fact that that investigating agencies end up diverting a large chunk of their resources and time assessing the veracity and threat level of the hoax. But in three recent hoax e-mail cases in the aftermath of the Delhi High Court blast, the offenders have been booked for cyber terrorism, where the maximum sentence is life imprisonment.

In September, three people from different parts of India—all in their late teens or early 20s—had various investigating agencies chasing false leads by claiming to be associated with terrorist groups like the Lashkar-e-Taiba (LeT) and Harkat-ul-Jihad-e-Islami (HuJI). Kolkata resident Sunny Shukla (23) sent a terror email after the Delhi High Court blast posing as a HuJI member and taking responsibility for the attack. He was motivated by the need to have “some fun”.

In an unrelated case, UPbased Manoj Ojha (24) who works as a data operator also sent an e-mail claiming to be a HuJi member. In the third instance, the NIA arrested Kashmiri teenager Aamir Ahmed (19) after he sent the agency a terror e-mail posing as an Indian Mujahideen member.

“By using the names of terror groups the offenders know that they will get publicity at the national level. They also believe that they can get away with the crime,” said a senior police officer. An unrepentant Ojha said he was testing the Delhi police’s security, preparedness and response levels. “I wanted to check the police’s alertness so I sent them an e-mail claiming responsibility of the Delhi HC blast,” he told the police.

Revenge was 24-year-old Pune resident Rashmi Shinde’s motive. She had called up a local newspaper in Pune and the Union home ministry control room in New Delhi on August 30 warning them that a person by name of Shirish Kulkarni was on his way to assassinate anticorruption crusader Anna Hazare. When the police finally questioned Shinde and identified the would-be assassin, they unravelled the age-old plot of a jilted lover exacting revenge on her former boyfriend.

The problem is rampant in Mumbai, too, where the police receive a terror hoax call alm o s t e ve r day. Em a i l threats are also on the rise, said investigators with the cyber crime cell of the Mumbai police.

In May 2011, the city police arrested software developer Tushar Sawant (27) for sending a terror e-mail to the CBI. ‘‘Sawant had lost his job at a multinational company prior to sending the e-mail where he claimed to be a part of terror group, which was planning to carry out a nationwide attack. He said that cities like Mumbai and Delhi would be targeted,’’ said a police official said. Sawant was not booked for cyber terrorism as the police believed he was not mentally stable. Instead he was booked for hacking under the Information Technology Act, which has a more lenient sentence of two years imprisonment and (or) a fine.

Convicted, but not punished
A16-year-old teenager from Ahmedabad sent an e-mail to a private news channel on March 18, 2008 warning officials of a bomb on an Andheri-bound train. In the e-mail, he claimed to be a member of the Dawood Ibrahim gang. Three days later, the Cyber Crime Investigation Cell (CCIC) of the city police arrested the boy under Section 506 (ii) for criminal intimidation. He was convicted, but did not face imprisonment. A juvenile court let him off with a warning


Living Vicariously? On April 1 2011, as Mumbai geared up for Cricket World Cup match, which was to be held at Wankhede stadium in Mumbai, Rajesh Dave (40), a ticketing agent, posted a threat on the city police’s website posing as an LeT member. He said he had planted 30 bombs at the stadium and dared the police to find them. When investigators finally traced him, Dave said he had posted it for fun


Depression and mental illness In May this year, the city police arrested software developer Tushar Sawant (27) for sending a terror e-mail to the CBI. ‘‘Sawant had lost his job at a multinational company prior to sending a threatening e-mail where he claimed to be a part of terror group, which was planning to carry out a nationwide attack. In his e-mail he said that cities like Mumbai and Delhi would be targeted,’’ said a police official said. But Sawant was not booked for cyber terrorism as he was not mentally stable. Instead he was booked for hacking under Section 66 of the Information Technology Act, which has a more lenient sentence of two years imprisonment and (or) a fine

Past Cases

NOV 11, 2009 | The cyber crime cell arrested a 17-yearold boy for sending a hoax e-mail to Air India “to see how the security agencies responded”. The offender was the son of a doctor employed at a government hospital in Haryana. He wrote in the mail that there will be a bomb on an IA plane on November 1.’’
STATUS: Charge sheet filed, trial on

July 29, 2008: A 14-year-old Colaba boy sent a hoax e-mail to a TV channel in Madhya Pradesh, three days after the July 26, 2008, Ahmedabad bomb blasts. He claimed that 29 bombs would go off in Jabalpur. He was picked up by officers of the Anti-Terrorism Squad (ATS) who, with the help of the MP police, were able to trace the e-mail to a cyber café in Colaba. STATUS: No FIR was registered. The Cuffe Parade police registered a non-cognizable (NC) complaint against him, and the boy was allowed to go home after the police gave him a “strict warning”

February 26, 2006: A 17-year-old student from Jamnabai Narsee School called an Alitalia flight bound to Milan at 2am telling them there was a bomb on board. He wanted to stop his girlfriend from going abroad. She was one of the 12 students on their way to attend a mock United Nations session in Genoa

May 25, 2009: A 15-year-old teenager from Bangalore was arrested for allegedly sending a terror e-mail to a private news channel claiming that he had planted five bombs in Mumbai. He had challenged the police to find them before it was too late. His hoax mail read: “I have planted five bombs in Mumbai; you have two hours to find it.” The police traced the Internet Protocol (IP) address to Vijay Nagar in Bangalore, and the boy was booked for criminal intimidation. The Information Technology (amended) Acts section for cyber terrorism, where the maximum penalty is life imprisonment, however, was not included in the charge sheet.
STATUS: Trial pending


The Times of India, October 12, 2011

Woman implicates ex in ‘kill Anna’ plot

1) Rashmi Shinde (24), a graduate from Yavatmal, was in love with computer engineer, Shirish Kulkarni, but their marriage did not work out 2) Shinde called up the home ministry in New Delhi and claimed that Kulkarni would shoot anti-corruption crusader, Anna Hazare, in hospital 3) The Haveli police in Pune summoned Kulkarni and realised that Shinde did it to seek revenge

ATS Detains Graduate From Yavatmal

Mateen Hafeez TNN

Mumbai: The Union home ministry control room in New Delhi received a call on August 30 that anti-corruption crusader, Anna Hazare, will be shot in hospital.
The caller said computer engineer, Shirish Kulkarni, from Pune was planning to execute the operation. When the anti-terrorism squad (ATS) caught the culprit, they were shocked that the call was by Kulkarni’s former girlfriend who was seeking revenge.

The culprit, Rashmi Shinde (24), a graduate from Yavatmal, was detained by the ATS and handed over to the Haveli police in Pune (rural). “The girl first called up the mobile number of a Pune resident who used to write feature articles in Marathi newspapers in Pune. She told him that Kulkarni had planned to shoot Hazare in hospital on the morning of August 31. She gave Kulkarni’s name and contact number and hung up. Shinde had used a PCO to make the phone call,” ATS chief Rakesh Maria said on Thursday. He added that the person, who had received the call, immediately informed the police about it.

“The same day, another similar call was made to the Union home ministry’s control room. The information was passed on to the Maharashtra police and our staff began probing the case. We called Kulkarni for questioning and found that he had no such plan and was completely unaware about the phone call,” he said.

“Kulkarni told our men that he was in love with a girl but her parents had disapproved of their relationship. Shinde’s parents arranged her wedding with someone else in Yavatmal but she refused to marry against her wishes. She was not in touch with Kulkarni for almost six months, but later came to Pune,” Maria said.

The ATS chief said that during this period, Kulkarni had married another woman. Shinde, unaware about the developments, kept urging Kulkarni to marry her, but he refused.

“She could not tolerate rejection in love and planned to retaliate by wrongly implicating Kulkarni in a sensitive case. Hence, she made the threat calls,” the ATS chief said on Thursday.
Shinde has confessed her crime and her statement has been recorded by the Haveli police. She is likely to be arrested on Friday.

(The names of the couple have been changed to protect their identities)


The Times of India, September 23, 2011

Man who sent terror mail not booked for cyber terrorism

Mateen Hafeez TNN

Mumbai: The twenty-sevenyear-old Tushar Sawant, who had sent a terror email to the CBI warning them about terror strikes across the city, has not been booked for cyber terrorism. The reason being that cops fell that he was frustrated and not mentally stable at the time of sending the mail.

In 2009, the Powai police had arrested a 34-year-old
man who had sent a terror mailtoblowup a Hiranandani residential complex. Even though it was a case of a gay love triangle, the suspect was booked for cyber terrorism.

Sawant, on the other hand, claimed that he was a member of a terror group andthatthey were going to carry out blasts various places in the country. In spite of this, the police haven’t booked him for cyber terrorism.

‘‘Sawant is a software developer. He used to work for L&T for a while but was sacked
sometime ago. Sawant had sent a mail to the CBI on May 29 stating that he was a part of a terror group and that the group was planning to carry out terror strikes. Major cities like Mumbai, Delhi etc would be targeted, the mail read,’’ a police official said.

After receiving the mail, there was a high alert across all the police stations in the country. When the police learnt that it was a prank they trackeddown theIP addressto Sawant. He was arrested on May 31.

‘‘When we interrogated Sawant, he told us that he got the CBI’s email address from the internet. We are verifying whether he has any association with any anti-socialbodies,’’ said an official. When asked as to why the cyber terrorism charges were not applied to Sawant, the official refused to comment.

Sawant has been booked for hacking under the Information Technology Act.
Experts believe that those who send such mails are unaware of the repercussions of such actions. “Most of those who send terror/hoax mails don’t realizethatitis a serious offence. The new amendment for such an offence comes under ‘cyber terrorism’, and the maximum punishment is life imprisonment,” said a cyber expert.

Past Cases
August 7, 2010: Sagar Kashyap (20), son of a CR motorman who was studying computer science, sent an email to two news channels posing as a militant and threatned to blow up their offices.
Nov 11, 2009: The cyber crime cell arrested a 17-year-old Harish Yadav (name changed) who had sent a threat e-mail to Air India to see how the security agencies responded.
May 25, 2009: A Bangalore teenager, Krishna Singh (15), was arrested for allegedly sending a terror email to a private news channel claiming that he had planted five bombs in Mumbai. He had challenged the police to find them before it was too late.

The Times of India, June 2, 2011

Ticketing agent arrested for WC bomb hoax

HE DID IT JUST FOR KICKS

Mateen Hafeez TNN

Mumbai: The Anti-Terrorism Squad (ATS) on Friday arrested a 40-year-old ticketing agent on charges of posting threat comments on the Mumbai police’s website a day before the 2011 cricket world cup final between India and Sri Lanka. The suspect, Rajesh Dave, had posed as a member of Lashkar-e-Taiba (LeT).

“Dave was picked up from his residence in Mani Bhavan area in south Mumbai. He had used someone’s phone with a Nashik sim card to post the comment,” said ATS chief Rakesh Maria. However, The cyber crime investigation cell, which was investigating the case parallelly, reached a dead end after it found that the server used for posting the comment was located in Norway.

The comment, posted at 7.22 pm on April 1, read: ‘30 plastic bombs have been planted in the Wankhede stadium. The bombs will be exploded through satellite. Save if you can. Pakistan Zindabad. LeT’. The comment did not have any signature or name attached.

“Dave told us that he had posted the comment just for fun. However, questioning is still on,” added Maria. Dave is married and stays with his wife and mother. “He is into booking railway tickets on commission and is well-versed in technonology. We are still probing his credentials,” said Maria.

DCP Pradip Sawant said Dave, along with others, was earlier summoned by the V P Road police in connection with betting before the final match.
mateen.hafeez@timesgroup.com


The Times of India, April 9, 2011

WC threat comment posted from Norway

TIMES NEWS NETWORK

Mumbai: The cyber crime investigation cell, probing a comment posted on the Mumbai police’s website warning about bomb blasts on the day of the cricket World Cup final at Wankhede stadium, has found that it was posted from Norway.

The comment, posted around 7.22 pm on April 1, a day before the India versus Sri Lanka match, read: ‘30 plastic bombs have been planted in the Wankhede stadium. The bombs will be exploded through satellite. Save if you can. Pakistani Zindabad. LeT’.

The comment did not have any signature or name attached. The police immediately alerted security agencies about the comment and a group of National Security Guard commandos was sent to the stadium. They, with the help of sniffer dogs, searched the stadium but did not find any bomb. The guards, along with the other anti-terror teams, were at the stadium while the match was on too.

Anti-explosive devices and bomb detection machines were also sent to the stadium but nothing was detected. Special commandos were deployed near the players’ dressing rooms as a precaution.

“The internet protocol (IP) address has been traced to Norway. It was a hoax, but we did not want to take chances,” a police officer said.


The Times of India, April 6, 2011

Blast triggers ATS, crime branch ‘race’

Mateen Hafeez TNN

Mumbai: The Maharashtra anti-terrorism squad (ATS) and the Mumbai crime branch swung into action to trace the culprit soon after Indian Mujahideen (IM) sent a terror email a few minutes after the Varanasi blast. However, both began separate investigations.

The five-page email, which talks about Babri Masjid, the clean chit to Gujarat chief minister Narendra Modi and a section of the Muslim leadership, was sent from Navi Mumbai using an unsecured wi-fi network.

The ATS, which had almost scrapped its cyber unit after its officers were transferred to other units, swung into action. It had been focusing on the IM’s Karnataka module. The crime branch, which has a cyber crime police station and a cyber crime investigation cell under it, has vast experience of detecting cases related to terror emails.

In 2008, when a terror email was sent from the unsecured wi-fi connection of US national Kenneth Heywood, before the Ahmedabad blasts, there was a race between the crime branch and the ATS.

ATS officers, who reached Navi Mumbai before the crime branch sleuths, had almost “captured” everything. The crime branch personnel, said sources, had to wait until the ATS team left. In the recent case, while the crime branch has clearly said it’s only assisting the ATS in the case, it is learnt that the cell’s officers are in constant touch with their bosses for instructions.

ATS officers, who were earlier with the crime branch, are trying to use their old contacts to crack the case. The sources said that after the terror emails two years ago, the crime branch had solved the cases. Now, with seniors transferred from the crime branch to the ATS, the race has taken a strange twist. Personnel from both agencies are using their contacts to get information.

In 2009, the crime branch had filed a chargesheet against 21 IM members. In the chargesheet, the crime branch mentioned the IM’s role in various blasts since 2005, including the July 11, 2006, train blasts. But the ATS, which investigated the blasts — the only terror attack between 2005 and the 2008 strikes — denied this. While a section of the media, which is believed to have spoken to senior crime branch officers, wrote that IM member Sadiq Shaikh was the bomb planter in the 11/7 train blasts case, the ATS, which had arrested 13 SIMI members, denied it.

The ATS even took custody of Shaikh, subjected him to forensic tests and filed an application in court seeking to discharge him from their case.

The crime branch chargesheet had clearly mentioned that the 21 accused were involved in all blasts — Jaipur, Ahmedabad, Hyderabad, Lukcnow, Delhi, Surat and Mumbai — since 2005.

“The only blast between 2005 and September 2008 (when the arrests took place) was the July 11, 2006, blasts that killed 188 and injured 817,’’ a policeman said.


The Times of India, December 11, 2010

Mumbai deserves a fresh bloodbath: IM

WARNING BEFORE THE GAMES: A car carrying an inflammable substance catches fire (above) two hours after the blast at Jama Masjid on Sunday morning.

After Delhi Attack, Indian Mujahideen Says It Wants To Avenge Kashmir, Target Commercial Capital

Pune Blast Arrests, KEM ‘Humiliation’ Spark Terror Email

Vishwa Mohan & S Ahmed Ali | TNN

New Delhi/Mumbai: The Centre on Sunday put Mumbai on a red alert after the terrorist outfit Indian Mujahideen warned the city of a fresh bloodbath, in a chilling reminder of 26/11 and other terror atrocities inflicted upon the country’s commercial capital.

The group, which has claimed responsibility for Sunday’s terror incidents in New Delhi, referred to the arrests in the German Bakery case and the alleged incident of humiliation of a Muslim woman at Mumbai’s KEM Hospital, to declare: “Remember! We will once again come upon Bombay if you do not desist.And you know it very well that we@Indian Mujahideen act as we speak.’’

The email, laced with Quranic verses justifying holy war against oppressors, nonbelievers and the collaborators of ‘Shaitan’, and invoking the plight of Muslims facing alleged atrocities in J&K, Mumbai and Madhya Pradesh chillingly warned, “The incident of our sister wearing hijab who was insulted and humiliated at the KEM hospital in Bombay on the orders of Bombay police will not be forgiven. It seems Bombayites have very poor memory and they deserve a fresh bloodbath. We hereby warn that the Bombay Police Commissioner’s office will be squarely responsible for the outcome.’’

The email, titled ‘As we bleed, so will you seep (sic)’, also justified the killing of innocents, saying many innocents were being killed in Kashmir too.

The Centre is taking the claim seriously for a number of reasons. Firstly, the timing of the attacks in New Delhi on Sunday coincided with the second anniversary of the Batla House encounter in which IM commander, Atif Amin, was killed along with his comrade, Muhammad Sajid. The email sent by Indian Mujahideen, around the same time when a crude car bomb went off inDelhi, declares the intention of IM to avenge the killings of its key operatives.

Al Arbi, the name used in the email sent by IM to own up to the two terror incidents, also matches with the one used in the emails IM sent after the previous terror attacks it was linked to.

As in the past, the jihadi group, in the fresh email, has trained its ire on the Mumbai police, expressing outrage at the arrests of “innocents’’ in Pune’s German Bakery case.

‘Why is Maria destroying his career for Patil?’
We feel sorry to say that Rakesh Maria has shattered the myth of being an intelligent officer by arresting innocent youth who are totally unconcerned (sic) in the German Bakery case. The ceaseless urge to show has bitten the top-cop mad and driven him out of his mind as every other day he pops up with fake accused, thanks to his accumen (sic),’’ wrote Al Arbi.

Continuing his tirade against Maria, he asks, “Why are you bent upon to (sic) destroy your career for the sake of this anti-Muslim and ignorant R R Patil?’’ Security agencies in Mumbai, however, feel that the mail was sent in desperation after their module was wiped off in a series of arrest particularly after the anti-terrorism squad (ATS) recently cracked the German Bakery blast case and arrested their key member Himayat Baig along with Bilal Fareed Shaikh.

Sources said that Baig and Bilal in custodial interrogations have revealed so much on the IM operations and its sleepers cells and their links with the LET, that almost all the sleepers cells have been forced to go underground and wind up their operations in at least Maharashtra. And the police believe this could have trigger them to send such desperate mails sitting somewhere in a foreign country.

The IM mail also hinted that ATS chief Rakesh Maria had wrongly arrested the two “innocent’’ youths. But a top official said that this is nothing new. Even in 2008, when Maria’s team arrested 21 members of IM involved in a series of blasts in Ahmedabad, Gujarat and Delhi, the IM sent similar threatening mails and abused the policemen.

The IM has claimed that the police are catching innocent Muslims and framing them in the pending blast cases. Maria refusing to comment just said, “I have done nothing wrong. The mails have been sent in retaliation for the arrest of the accused in the German Bakery blasts.

‘‘We had even arrested Prashant Juikar, a Hindu, who was involved in the Goa blast earlier this year,’’ he added.

Sources said that the Dawood Ibrahim gang had similarly maligned him when he solved the 1993 serial bomb blast. They alleged that he was arresting innocent Muslims youths.

A CHILLING TERRORIST MESSAGE AT JAMA MASJID

Policemen barricade the Jama Masjid and a bullet lodged in a vehicle at the site testifies to the attackers’ deadly intent

The Times of India, September 20, 2010

‘Tech, cloning used to send terror email’

Mateen Hafeez I TNN

Mumbai: Investigations into the terror email case have revealed that prime suspect, Sagar Kashyap, had used a technique called Team Viewer. He made use of a desktop of one of his associates and carried out all the operations from his own computer. That is why the results of the probe showed that the email was sent from another computer. In Team Viewer, the desktop of a computer can be operated from any computer.

Kashyap (20), son of a CR motorman, is a second-year student of computer science. On August 7, he sent an email to two news channel offices posing as a militant, Gulam Imran Khan, and threatened to blow up their offices on August 12. A team led by antiterrorism squad additional commissioner Sukhvindar Singh, officers Nasir Kulkarni and Mahesh Parkar arrested Kashyap on August 11. “Kashyap had stolen the password and logged on with the names of around 24 people,’’ said Singh.

When asked whether Kashyap was linked to any terror outfit, ATS chief Rakesh Maria said, “Our probe is still on. No such information has come to our knowledge.’’ According to a source, Kashyap is also accused of internet time theft, which he committed using someone else’s log-in.

Initially, the ATS found that Kashyap had actually cloned the MAC number of someone else’s computer and was using his internet protocol (IP) address. A MAC number is a computer’s identification number. “In earlier cases, the police would first detect the IP address, which would help them to solve the case. But, here, results showed that the IP address belonged to a Ghatkoparbased businessman,’’ said an officer. To solve the mystery, the police team had to check on more than 17,500 users of Wnet, an internet service provider.

When the police found out that Kashyap had used the desktop of one of his associates, they summoned the latter for questioning. However, the owner of the computer said that the crime was committed without his knowledge. Kashyap has been booked for impersonation, cheating and cyber crime.

The Times of India, August 17, 2010

Student held for terror email - 20-Year-Old Had Cloned Ghatkopar Bizman’s Comp ID For Crime

Mateen Hafeez I TNN

Mumbai: The 20-year-old youth, arrested by the antiterrorism squad (ATS) on Wednesday for sending emails to private news channels threatening to blow up their offices, had actually cloned the MAC number of someone else’s computer and hence was using his internet protocol (IP) address.

The suspect, Sagar Kashayap, had cloned the MAC number (a computer’s identification number) and copied it on his computer before sending the e-mail. The IP address was allotted to this MAC number which was, in fact, owned by a businessman.

Initially, the police suspected the e-mail could have been sent by the banned outfit, Indian Mujahideen, whose members send such e-mails using unsecured WiFi network. Later, Kashayap—a second-year student of Bachelor in Computer Science—was arrested for sending a threat email, posing as a militant.

“In earlier cases, the police would first detect the IP address which would help them to solve the case. But, here, Kashayap had cloned the MAC number where the IP addresses was allotted and it showed that the IP address belongs to a Ghatkoparbased businessman. We questioned him but he was not the culprit,’’ said an officer.

An ATS team, led by additional commissioner Sukhvindar Singh, and comprising assistant inspector Nasir Kulkarni and Mahesh Parkar had to struggle with around 17,500 users of Wnet, an internet service provider, to nab Kashayap.

Son of a train motorman, Kashayap, resides at Kurla railway quarters. He had sent an e-mail to two private news channels and a computer firm, posing as a militant. He sent the e-mail using an account,yuvraj.patil00@gmail.com and in the e-mail, posed as one Gulam Khan. “Kashayap threatened to blow up his targets on August 12,’’ said an officer.

The police first began hunting for Yuvraj Patil. Soon after he was traced, the police realised that Patil, a pharmaceutical company’s executive, was not the suspect. “Patil told us that on August 3, he had given his login name and password to one of his subordinates, Nalawade. Nalawade also gave a satisfactory reply and the police reached a dead end,’’ the officer added.

Then began a door-to-door search for the culprit since the businessman, Patil and Nalawade’s fate was dependent on the arrest of the real culprit. The police zeroed in on the Line Area Network (LAN) and found that someone from Kurla must have used the IP address. “When we reached Kashayap’s residence, he was about to go to sleep and asked to us to come the next morning. While we were making enquires with his mother, he went in to another room and disconnected the internet connection. While searching his computer, we found some suspicious material and seized it. During sustained questioning, Kashayap admitted to having sent the email,’’ said the officer. Kashayap was booked for impersonation and cyber terrorism. He has been remanded in police custody till August 16.

Nigerian gang member held for e-fraud
Mumbai: A Malad resident was arrested by the cyber police for allegedly hacking into the net-banking account of an accountant of a private company and siphoning off Rs 2 lakh.

Giriraj Tiwari (28), who is part of a gang of Nigerians, has been arrested for cheating and breach of trust. The complaint was filed by an accountant working for a private firm in Andheri.

In February, the risk control unit office of the ICICI Bank called him and enquired whether he
had transferred Rs 2 lakh to other accounts and that, too, in 10 instalments in an hour’s time. The victim went to the bank and the statement showed Rs 2 lakh missing. The bank forwarded his complaint to the cyber cops.

The cops found that three persons were beneficiaries of the siphoned amount. The first beneficiary was a Nigerian national who was arrested last month. The accused revealed that he had used Tiwari’s bank account to siphon off the victim’s money. -S Ahmed Ali I TNN

The Times of India, August 13, 2010

Extortionists turn terrorists, target 5-stars

Mateen Hafeez | TNN

Mumbai: Extortionists are apparently bored of using the names of dreaded underworld gangs to scare their targets. They have now started dropping the names of terror organisations. At least five five-star hotels in the city have received similar emails asking them to cough up huge sums of money, failing which the sender—claiming to be an Al-Qaeda operative—has threatened to blow up the establishment.

The emails are being probed by the Crime Branch’s Cyber Crime Investigation Cell (CCIC). “The sender, who has referred to himself as an Al-Qaeda operative, says he is part of a group that has been assigned the task of targeting these hotels. But he has also specified that the hotels could prevent the attacks by paying up,’’ an officer said. Officials, however, refused to divulge the amounts the hotels had been asked to pay up.

The internet protocol (IP) address from which the mails were sent had been traced to the United States. “The sender has given a Western Union account number asking the hotels to transfer the money to that account,’’ an official said, adding that the account was registered in someone’s name in the US.

“But it could also have been a proxy email that would show the IP address in a foreign country despite it being sent from somewhere in India itself,’’ said an officer.

Cops are probing the case but security in and around these five-star hotels has been beefed up. “Such emails are now being frequently sent by Nigerian fraudsters. These five could also part of the same chain,’’ an officer said.

The Leela Group of hotels received such mails in January 2009, warning it that explosive devices had been planted at all its establishments across the country; they would be detonated if a ransom of Rs 42 lakh (in Australian dollars) was not paid. The series of emails was traced to Kenya and the United Arab Emirates.

Similarly on March 31, 2009, security had to be beefed up across all prominent hotels in the city after the Taj Mahal Palace and Tower and the group’s seaside resort on the outskirts of Chennai received e-mailed threats. Those mails were traced back to Rawalpindi in Pakistan. But neither set of emails led to any untoward incident.

The Strategy
Five five-star hotels receive emails asking them to cough up huge sums of money, failing which the sender—claiming to be an Al-Qaeda operative—threatens to blow up the establishment

What The Police Fear
Investigators feel the mails could have been forwarded by Nigerian fraudsters. “The IP address from which the mails were sent had been traced to the US. But it could also have been a proxy email that would show the IP address in a foreign country despite it being sent from somewhere in India itself,’’ said an officer

The Times of India, February 5, 2010

Hoax terror SMS a bid to frame wife’s lover

Mateen Hafeez | TNN

Mumbai: Mumtaz Shaikh stayed in jail for only four months but his world changed more than Rip Van Winkle’s in 20 years.

The 33-year-old came out of Kalyan prison recently, after being arrested for robbery and attempted murder, and found that his wife—a mother of three—was having an affair with another man. Enraged, Shaikh and his friend composed and sent an SMS to the man he suspected of being his wife’s lover.

According to anti-terrorism squad (ATS) sources, Altaf Ahmed (28), the son of a Grant Road businessman, received an SMS which read, “The RDX has been transported to Mumbai. Be prepared. We have to execute our operation tommorow.’’ Ahmed, fearing he was being framed,informed the police, who forwarded his complaint to the ATS. Nothing
suspicious emerged from Ahmed’s mobile records or his interrogation. The police traced the phone from which the SMS was sent, but the owner said it had gone missing.
During further questioning, Ahmed said that he met Mumbra resident Rukhsar at a court. She told him her husband Shaikh had been framed and she was struggling to get him released. Ahmed helped her, and their friendship bloomed into an intimate relationship.

The police summoned Shaikh, who said, “I was traumatised when learnt about the affair....My friend found a mobile and we planned to SMS Ahmed, thinking the cops would nab him. All I wanted is that he not ruin my life. I have no terrorist connections.’’
(Some names have been changed)

The Times of India, December 11, 2009

‘Teen sent threat e-mail to test security agencies’

Mateen Hafeez | TNN

Mumbai: The cyber crime investigation cell (CCIC) said 17-year-old Haryana boy Yadav (name withheld as he is a minor) had sent a threat e-mail to Air India to see how the security agencies responded. Yadav is the son of a doctor employed with a government hospital in Haryana.

Yadav, a first-year Commerce student of a college in Naseebpur, Haryana, is the second minor to be arrested this year for sending terror e-mails. On May 29, the CCIC had arrested a 15-yearold from Bangalore. Sharma claimed to have planted five bombs in Mumbai, challenging the police to find them before it was too late.

In an e-mail sent on October 23 at around 4.48 pm, Yadav wrote, “There will be a bomb on (an) Indian Airlines plane on November 1.’’ The police said Yadav had created a fake ID, zatkh@yahoo.in, and sent it to Air India’s official email ID, ialcshq@airindia.in. “We traced the Internet Protocol (IP) address to his house. Sub-inspector S Y Mane and constable Krishna Dhamapurkar reached Yadav’s Haryana house. However, he kept saying he had not sent it. Then we realised that the boy’s computer had a BSNL connection. It has a ‘dynamic IP address’ every time someone logs on,’’ the officer said.

Yadav told interrogators that he had no intention of committing a crime but simply wanted to find out what would happen if he sent a hoax threat by e-mail. Yadav has been sent to a juvenile remand home till November 23.

The Times of India, November 11, 2009

Terror messages coded in blog rants, say cops

Mateen Hafeez I TNN

Mumbai: Provocative rants by bloggers are a familiar sight to regular surfers of the internet. But some of these diatribes are more than simply a matter of disgruntled people venting their spleen—police say blogs have emerged as the favoured mode of communication of terrrorists seeking to convey hidden messages to accomplices.

Police officials are now busy scouring provocative blogs for such messages. “Earlier, terrorists used email and social networking websites to chat. However, in some cases, the modules were busted precisely with the help of web chat. To avoid this pitfall, terrorists have begun relying on blogs now,” said an anti-terrorism squad officer.

It may be recalled several Indian Mujahideen operatives were caught after the police engaged them in chat while posing as their associates. Similarly, police zeroed in on the location of a 7/11 train bombing suspect by resorting to web chat.

Police officials explained that blogs made it harder for police to tune in to chatter. An officer said, “In e-mails, many other e-mail IDs can be traced. But a blog could be read by anyone, and all the police will get is the internet protocol (IP) address of the blog’s readers. It will not give us the exact e-mail ID to identify the person. Moreover, blogs are being written in such a manner that the content looks religious or fanatical, but it actually contains coded messages for terrorists,” added an officer.

Officers of the Cyber Crime Investigation Cell (CCIC) scan blogs and websites that contain remarks aimed at offending someone’s religious sentiment.

They search them and send a request to the Computer Emergency Response Team (CERT) to block it. Meanwhile, the National Technology Research Organisation (NTRO), the country’s secret agency that monitors cyber crime, also tracks cyber terrorists. But many cyber experts are not reassured by the investigations of NTRO and other agencies, saying there’s need for more investment and training.

Cyber guru Vijay Mukhi said the minute someone starts using the internet, the chances of him or her being identified or caught are low. “They can be anywhere in the world but do their activities regularly. Even professionals and techsavvy people are far behind cyber terrorists. We need to grasp the importance of cyber terrorism and chalk out a plan to control it,” said Mukhi.

Former IPS officer Sanjay Pande, who now runs an e-security agency, said the US spends billions of dollars to control cyber crime and to train law enforcement personnel, but there’s no such awareness in India. “Intelligencegathering is now more dependent on technology than on human intelligence. We’re not training our students enough. There’s inadequate investment in controlling or probing cyber crime in our country,” he added. He noted that terror outfits use sophisticated technology. “Terrorists today send messages through blogs, cryptography, stegnography and so on, but most police personnel in cyber units in our country are not even aware of these terminologies,” added Pandey. According to Pandey, there’s no adequate programme to train officers in cyber crime. “It’s time we realised the importance of cyber terrorism. Several countries have already raised cyber armies to control and probe cyber attacks,” he said.

The Times of India, October 30, 2009

Curiosity was his main motive, say city police

In Letter To News Channel, Bangalore Boy Said He Planted 5 Bombs In Mumbai

Mateen Hafeez | TNN

Mumbai: A 15-year-old Bangalore teenager was arrested by the Cyber Crime Investigation Cell (CCIC) of the city crime branch on Friday for allegedly sending a hoax email to a private news channel. In the e-mail, he claimed to have planted five bombs in Mumbai, challenging the police to find them before it was too late.

According to police officials, at around 1pm on May 25, the news channel received an e-mail that read: “I have planted five bombs in Mumbai; you have two hours to find it.” The police, who were alerted immediately, traced the Internet Protocol (IP) address to Vijay Nagar in Bangalore. The internet service provider for the account was BSNL, said officials.

In a joint operation with the Bangalore police, CCIC investigators identified the perpetrator of the e-mail and zeroed in on teenager Krishna Singh (name changed), son a local businessman.

Singh was brought to Mumbai on Thursday night and arrested for criminal intimidation. The Information Technology (amended) Acts section for cyber terrorism, however, was not included in the charge sheet.

Curiosity, it appears, was the main motive. During the interrogation, Singh allegedly told the police that he had no intention of committing any crime, but simply wanted to know what would happen if he sent a hoax threat by e-mail to a news channel. Nevertheless, police officials said they checked his computer thoroughly.

Singh was sent to a juvenile remand home in Dongri on Friday, and was granted bail on Saturday.

But what is more worrying is a steady increase in hoax threats and e-mails, not by adults, but by minors who, more often than not, do it “just for fun”. This year alone, the CCIC has received 21 such threat complaints applications. And it's not the first time a juvenile has been arrested for sending hoax emails (See box).

Experts believe that children are unaware of the repercussions of such actions. Cyber guru, Vijay Mukhi, said, “Most of the children who send such e-mails don’t realise that it is a serious offence. The new amendment for such an offence comes under ‘cyber terrorism’, and the maximum punishment is life imprisonment.

The wastage of manpower and police time to simply track these offenders is criminal, say experts. In an attempt to build awareness and educate students, the city’s police force and cyber cell has been conducting programmes on “future crime” in schools and colleges. The aim, said one police officer, is to help minors realise that sending such threats is a crime. More often than not, most of the minors arrested are let off with a warning

MINOR HOAX SPELLS MAJOR TROUBLE

1) Sixteen-year-old Rakesh Patel (name changed), a student from Ahmedabad, sent an email to a private news channel on March 18, 2008, warning officials of a bomb on an Andheri-bound train. In the e-mail, he claimed to be a member of the Dawood Ibrahim gang. Three days later, the Crime Investigation Cell (CCIC) of the city police arrested the boy under Section 506 (ii) for criminal intimidation. He was charge sheeted on November 28, 2008
Status: Patel was given a warning by a juvenile court

2 )A 14-year-old Colaba boy sent a hoax e-mail to a TV channel in Madhya Pradesh, three days after the July 26, 2008, Ahmedabad bomb blasts. He claimed that 29 bombs would go off in Jabalpur. He was picked up by officers of the Anti-Terrorism Squad (ATS) who, with the help of the MP police, were able to trace the e-mail to a cyber café in Colaba.
Status: No FIR was registered. The Cuffe Parade police registered a non-cognizable (NC) complaint against him, and the boy was allowed to go home after the police gave him a “strict warning”

3) Shariq Khan, 18, was arrested in Bhopal on July 26, 2006, for sending out three e-mails claiming to be a member of the terrorist organisation, which the police believed was behind the 7/11 train bombings. He was arrested by the Bhopal police. Later, the ATS brought the boy to Mumbai and also booked him for a five-year-old unsolved case where an unknown accused had sent e-mail warnings to the department of Atomic Energy (DAE) in 2001.
Status: The police filed a charge sheet against Shariq who claimed that he had sent the e-mails for fun. Trial is pending in a juvenile court. Shariq is presently out on bail in Bhopal

4) On February 26, 2006, a 17-yearold student from Jamnabai Narsee School called an Alitalia flight bound to Milan at 2am telling them there was a bomb on board. He wanted to stop his girlfriend from going abroad. She was one of the 12 students on their way to attend a mock United Nations session in Genoa
Status: After being grilled by the police, he was arrested, but let out on bail

The Times of India, May 31, 2009

BSE threat probe: Cops return from Bihar

Mateen Hafeez I TNN
Mumbai: Mumbai: The police probe into the email threatening to blow up the Bombay Stock Exchange (BSE) and National Stock Exchange (NSE) does not seem to have much progress in cracking the case. The IP address of the email was traced to Patna, Bihar.

A cyber crime investigation cell (CCIC) team that reached Patna on May 5 returned to the city last week. The police team, comprising an officer and two constables, flew to Patna on May 5 and went to a cyber cafe where the email originated.

The cyber cafe had five computers. “The cafe owner did not maintain a log book. He did not ask for proof of identity, neither were CCTV cameras installed there,’’ said an officer. “The police recorded the owner’s - ment and asked him to be alert so that he could identify the sender if he comes there again,’’ he added. The police retrieved the hard disc of the computer purportedly used to send the email.

“Our team has returned from Patna and we are exploring all the angles. We would not like to disclose the progress of our probe,’’ said crime branch chief Rakesh Maria.

The email reached BSE’s administrative ID around 10.44 am on May 4. It was sent by one Shahab Md. The user had created the ID just four minutes prior to sending the email.

The Times of India, May 12, 2009

Threat email: Police slap cyber-terrorism charges

Mateen Hafeez I TNN
Mumbai: The police have registered a case of ‘cyber terrorism’—the first in the state since an amendment to the Information Technology Act—where a threat email was sent to the BSE and NSE on Monday. The maximum punishment for cyber terrorism is life imprisonment.
The IT Act was amended on February 5 this year when the law on cyber terrorism was introduced. Prior to that, offenders were booked only for hacking. The MRA Marg police and the Cyber Crime Investigation Cell are jointly probing the case. The suspect has been detained in this case.

The police said an email challenging the security agencies to prevent a terror attack was sent by one Shahab Md with an ID sh.itaiyeb125@yahoo.in to BSE’s administrative email ID corp.relations@bseindia.com at around 10.44 am on Monday. The IP address of the sender has been traced to Patna in Bihar. The ISP is Sify. The email ID was created just four minutes before the email was sent. “The sender had, while creating the new ID, given two mobile numbers in the personal details column. Both the numbers belong to a photo frame-maker in Patna,’’ said an officer. The email was written in English.

The MRA Marg police have registered forgery for purpose of cheating, criminal intimidation cases under the IPC and a cyber-terrorism case under the IT Act.

The Times of India, May 6, 2009

Email warns of terror attack on BSE, NSE

IN FOCUS: The email was sent to the BSE’s administrative ID

Internet Protocol Address Traced To Bihar

Mateen Hafeez I TNN
Mumbai: A threat email challenging security agencies to prevent a terror attack was received by the Bombay Stock Exchange (BSE) on Monday morning. The email sender stated that the Pakistan-based terror outfit, Lashkar-e-Taiba (LeT), was planning a terror strike at the BSE and the National Stock Exchange (NSE).

The Internet Protocol (IP) address of the sender has been traced to Patna in Bihar. According to the police, the email was received at the BSE’s administrative ID, corp.relations@bseindia.com, around 10.44 am on Monday.

“The email was sent by one Shahab Md with an ID, sh.itaiyeb125@yahoo.in, and the user was in Patna at the time of sending the threat mail,’’ said an officer.

The email, written in English, said, “Around 10 terrorists of the Lashkar-e-Taiyeba have planned to strike BSE & NSE around 12.55 hours today.’’ The mail warned the security agencies and further stated, “We dare Indian forces to prevent us from doing so. Moreover, five terrorists have already entered the premises at 10 am. Yours most faithfully.’’

Officers probing the case said it could be a prank mail. “However, we cannot take chances and a case has been registered with the MRA Marg police,’’ said an officer.

“The cyber crime investigation cell (CCIC) is carrying out a parallel investigation in the case. “We will trace the accused soon,’’ said crime branch joint commissioner of police Rakesh Maria.

There have been a series of mails since the 26/11 carnage when 10 Pakistani terrorists entered Mumbai via the sea route and went on a killing spree. While nine terrorists were killed in a threeday long gun battle, a 21-yearold gunman, Ajmal Kasab, was captured alive.

This is the four threat mail in the last month. The first two mails were sent to a fivestar hotel while the third one was sent to Air India threatening to blow up the airport.

Later, a mail was sent to a news channel threatening to carry out blasts during the Lok Sabha elections.

THREAT TALK
Around 10 terrorists of the Lashkar-e-Taiba have planned to strike BSE & NSE around 12.55 hours today
We dare Indian forces to prevent us from doing so. Moreover, five terrorists have already entered the premises at 10 am. Yours most faithfully.

The Times of India, May 5, 2009

Gay actor will not face charge of cyber terror

SPURNED IN LOVE: Anand Kumar

ATS PROBE IN POWAI EMAIL CASE

Mateen Hafeez I TNN
Mumbai: The anti-terrorism squad (ATS), investigating the “terror email” sent by a smalltime gay actor in order to win his lover back, will not book the actor for cyber terrorism as there was no intention to carry out any act of terror.

“Anand Kumar did not intend to carry out a terror strike but was spurned in love. Therefore, we have not booked him for cyber terrorism, which could get him life imprisonment if convicted,” said an officer. Anand now faces the charge of sending an offensive message through a communication service, which attracts a maximum punishment of three years in jail.
The ATS last week arrested Anand from Thrissur in Kerala after he sent a e-mail to Hiranandani Complex in Powai, threatening to blow it up. Anand is a businessman from Saudi Arabia and has reportedly signed up for a role in a Malayalam movie.

Whenever Anand used to visit Mumbai for business purposes, he stayed with his gay partner, the vice-president of a multinational company. However, his partner became close to another man, an HR executive in a tech firm. This enraged Anand, who called his partner’s new lover a terrorist in the email.

According to an amendment in the Information Technology Act, which came into force in February this year, anyone indulging in cyber terrorism could be sentenced to life imprisonment. Prior to this, even the sending of threat emails was considered “hacking”.

Meanwhile, ATS investigations have revealed that Anand was earlier jailed for four months in Saudi Arabia for abusing a trader. “He had business deals with a trader. Anand abused him and the trader complained to court officials. The police detained Anand and jailed him for four months before he was released,’’ said an officer. “He is not ready to admit to his crime. However, we have gathered all technical evidence against him,’’ the officer added.

ATS officials said two emails were sent to info@hiranandani.net, the official mail address of the group’s administration department, on February 14 and 15. Both came from karmavisva@yahoo.com. The emails claimed that a person staying in the complex had a nexus with terrorists and was assisting them in plotting more attacks.

NET EFFECT
As the amendment to the Information Technology Act came into force only in February this year, all cases of cyber terrorism were treated as hacking. In the Indian Mujahideen cases, where terror emails were sent minutes before and after the Ahmedabad and Delhi bomb blasts last year, the accused were booked for hacking and hence will attract a punishment of three years in prison. The other case of hacking is the Tarannum one in which the Juhu-based bar dancer was booked after the crime branch found details of cricket betting on her computer.

The Times of India, May 4, 2009