Bomb hoaxes: Militant groups in West, South Asian 'state actors' among suspects

From Khalistani Sikh extremists in the West to cyber-crime syndicates in Southeast Asia, various groups are under the scanner of Indian security agencies investigating a string of hoax threats made to airlines and hotels across India.

On Sunday (October 27) alone, around 50 flights, a dozen hotels and a temple faced bomb threats. This trend, which began early this month, has kept the security agencies on tenterhooks, especially since it's the festival season.

Also read: Hoax bomb threats | Centre issues advisory to social media platforms, tells them to act

The multi-agencies investigating the “hoaxathon” feel there is more to these incidents than meets the eye.

Delhi youth arrested

On Saturday (October 26), a Delhi youth who claimed to have made hoax calls to several flights and the Indira Gandhi International Airport to “draw attention” was arrested.

“The case of the youth arrested from Delhi’s Uttam Nagar is an aberration. He sent the message via a social media account after seeing reports of hoax threats. Unlike in most cases, the account was easily traced to him, indicating an amateurish job,” said an official at a central investigating agency based in Kolkata.

Also read | Bomb scares: As airlines foot the bills, here’s what they can do to mitigate risks

Most hoax bomb threat messages and calls are made using virtual private networks (VPNs) and dark web browsers, which make tracing the actual Internet Protocol (IP) address from which the messages emanated difficult, the official said, pointing to the likely involvement of cyber criminals.

Western links to threats

The location of IP addresses of some X handles used for sending the threat showed multiple countries.

For instance, the location of the IP address of X handle @schizobomber777 from which several threats were sent was traced to London and Germany. The location rebounded to different countries as multiple VPNs were used.

Such deft camouflaging led the investigators to suspect the involvement of organised groups behind the hoaxes.

The Indian aviation industry has already incurred a loss of several hundred crores of rupees because of the threats targeting about 350 flights in the past weeks.

Huge financial losses

“The financial impact on airlines has been substantial, with losses estimated in crores of rupees," said Helwing Villamizar, the digital editor at Airways Magazine. "A Boeing 777 flight from Mumbai to New York had to dump over 100 tonnes of fuel due to a threat, costing the airline Rs 1 crore in fuel alone."

Also read | Centre blasts X over 90 bomb threats in a week to flights; accuses platform of 'abetting crime'

“The total cost of a single hoax threat can exceed Rs 3 crore, including unscheduled landings, passenger accommodations and crew replacements,” Villamizar added.

“It seems the aviation and the hotel industries have been deliberately targeted at the festive season to inflict more harm,” said the official at the investigating agency quoted earlier.

Indian agencies at work

The National Investigation Agency, the Intelligence Bureau, the Indian Cyber Crime Coordination Centre (I4C) and the Indian Computer Emergency Response Team (CERT-In) and the Bureau of Civil Aviation Security (BCAS) are among the agencies closely monitoring the developments.

The Director General of the Central Industrial Security Force, Rajwinder Singh Bhatti, and his counterpart in the Bureau of Civil Aviation Security, Zulfiquar Hasan, gave a detailed presentation to Union Home Secretary Govind Mohan last week.

The same day, the US-based Sikhs for Justice leader Gurpatwant Singh Pannun, in a video message, warned flyers against taking Air India flights from November 1-19. The warning made the secessionist group one of the suspects, sources told The Federal.

Pakistan, China links?

Apart from the outlawed Sikh group, the role of external state actors (read Pakistan and China) behind the threats too is not ruled out, stated the official.

He said such state actors usually outsource darknet-enabled cybercrime to gangs operating from Cambodia, Laos and Myanmar for plausible deniability if traced.

There are ample evidence of Beijing using the Southeast Asian cyber-criminal groups such as Wan Kuok-koi’s Hongmen cartel to advance its Belt and Road Initiative and new Global Security Initiative, the sources claimed.