NEW DELHI: Investigations into the “white-collar” terror module behind the November 10 blast near Delhi’s Red Fort have revealed that highly educated doctors used a sophisticated network of “ghost” SIM cards and encrypted messaging applications to coordinate with handlers based in Pakistan, officials said on Sunday.
The findings of the probe formed the basis for a sweeping directive issued by the Department of Telecommunications (DoT) on November 28 last year, mandating that app-based communication platforms such as WhatsApp, Telegram and Signal must remain continuously linked to an active physical SIM card installed in the device.
Officials said the investigation uncovered a tactical “dual-phone” protocol adopted by the accused, including Muzammil Ganaie and Adeel Rather, to evade surveillance. Each accused carried two to three mobile phones.
One handset was a “clean” phone, registered in their own names and used for routine personal and professional communication. The second device, referred to by investigators as a “terror phone”, was used exclusively for encrypted communication with Pakistan-based handlers through WhatsApp and Telegram.
The handlers operated under codenames such as ‘Ukasa’, ‘Faizan’ and ‘Hashmi’, officials said.
The SIM cards used in these secondary devices were issued in the names of unsuspecting civilians whose Aadhaar details were misused. Jammu and Kashmir Police also unearthed a separate racket involving SIM cards issued using fake Aadhaar documents, they added.
Security agencies observed that several compromised SIMs remained active on messaging platforms even when physically located across the border in Pakistan-occupied Kashmir (PoK) or Pakistan.
By exploiting features that allow messaging apps to function without a physical SIM in the device, handlers were able to guide the module in assembling IEDs using online platforms such as YouTube and to plan “hinterland” attacks. Officials said the recruits initially wanted to travel to conflict zones in Syria or Afghanistan.
To address these vulnerabilities, the Centre has invoked provisions of the Telecommunications Act, 2023, and the Telecom Cyber Security Rules. Under the new norms, all Telecommunication Identifier User Entities (TIUEs) must ensure their applications function only when an active SIM is present in the device within 90 days.
The directive also requires telecom operators to automatically log out users from platforms such as WhatsApp, Telegram and Signal if an active SIM is not detected. Service providers, including Snapchat, ShareChat and JioChat, have been asked to submit compliance reports to the DoT.
“This feature of using apps without a SIM poses a serious telecom cyber security challenge and is being misused from outside the country for cyber fraud and terror activities,” the DoT said in a statement.
The directive is being fast-tracked in the Jammu and Kashmir telecom circle. While officials acknowledged that deactivating all expired or fraudulent SIMs will take time, the move is being viewed as a significant blow to the digital infrastructure used by terror networks to radicalise and manage “white-collar” operatives.
Non-compliance will attract stringent action under the Telecom Cyber Security Rules and other applicable laws, officials said.
The “white-collar” terror module began to unravel on the intervening night of October 18–19, 2025, after posters of the banned Jaish-e-Mohammad (JeM) surfaced on walls outside Srinagar city, warning of attacks on police and security forces.
Treating the incident as a serious security threat, Senior Superintendent of Police (Srinagar) G V Sundeep Chakravarthy constituted multiple teams to investigate the case.
Based on disclosures by arrested suspects, Srinagar Police traced the module to Al Falah University in Faridabad, Haryana, where two doctors — Muzammil Ganaie of Pulwama in south Kashmir and Shaheen Sayeed of Lucknow — were arrested. A large quantity of explosives and chemicals, including ammonium nitrate, potassium nitrate and sulphur, was seized during the operation.
The car explosion near the Red Fort killed 15 people. The case is currently being investigated by the National Investigation Agency (NIA).
