New Delhi: An investigation under New Delhi-based Voyager Infosec’s Digital Lab has raised doubts about the credibility of the evidence that the Pakistan military’s PR wing presented, accusing Indian intelligence agencies of orchestrating terrorist attacks inside the Pakistani territory.
Last week, the Inter-Services Public Relations (ISPR) held a press meeting. Flanked by senior political figures such as Deputy Prime Minister Ishaq Dar, ISPR unveiled what it called “irrefutable digital evidence” allegedly tying Indian operatives to terror networks in Pakistan. ISPR presented screenshots and audio recordings and seized digital materials.
Looking into the “evidence”, a team of cyber and open-source intelligence (OSINT) experts at the Digital Lab has found manipulated data, altered timelines and glaring inconsistencies in the collection and presentation of the materials.
“This is not a case of flawed evidence but of evidence that appears manufactured,” said Voyager Infosec Director Jiten Jain, speaking to ThePrint. “Technical inconsistencies to procedural lapses, the full presentation generates more questions than answers.”
Fabricated screenshots & audio recordings
Among the key claims by ISPR was a WhatsApp chat between a suspect and an alleged Indian handler. The Digital Lab forensics team said the screenshot showed the handler as ‘online’, though a Pakistani forensics team had the phone in its custody at the time, according to ISPR.
“On seizing a phone, it remains isolated from all networks,” Jain said. “If a chat shows someone as ‘online,’ it means the phone still had an Internet connection. That undermines the entire chain of custody.”
The investigation further questioned the inclusion of WhatsApp call recordings. Since WhatsApp does not store voice calls by default, the only way to access them would be via spyware or external recording. The ISPR did not mention any at its briefing.
The Digital Lab experts also analysed screenshots of financial transactions. They said the ISPR assertion that the screenshots reflect transfers conducted months prior is called into question by the timing of the images captured mere minutes after the transactions, indicating the possibility of more recent staging.
“The time stamps do not add up. There is no metadata to back the claims,” said Jain. “These are not verifiable financial records, just digital images, possibly created in minutes.”
Drone & timeline discrepancies
Another piece of evidence was a drone, which ISPR said originated in India, followed by its alleged recovery from a terror hideout. But a reverse image search by the Digital Lab identified the model as a China-manufactured, commercially available DJI drone.
“Does that mean it is a Chinese-sponsored terror attack in Pakistan?” Jain asked. He also pointed out that no procedural evidence, such as images showing the drone at the time of seizure, was presented by ISPR.
The analysis further flagged a timeline inconsistency involving a tweet shown to be from the ISPR briefing. The screenshot of the tweet was time-stamped 58 minutes after its posting on 19 March this year. But, the phone allegedly containing the screenshot was not seized until 25 April, according to ISPR.
“That raises a fundamental question,” said Jain. “How did ISPR have a screenshot dated five weeks before they seized the phone? Either the phone was not the source or someone else took that screenshot in advance.”
Consequently, with multiple discrepancies in the digital evidence and unanswered questions about its obtention, the investigation has cast serious doubt on the narrative put forward by Pakistan’s military.
As of now, ISPR has not responded publicly to the findings.
(Edited by Madhurita Goswami)