New Delhi: Using Instagram as a recruitment tool, and targeting tech-savvy but cash-strapped youngsters from villages in Uttar Pradesh, the alleged espionage racket had a free run for two years, until the Ghaziabad Police dismantled it. Those arrested in connection with the alleged racket are accused of filming military establishments and railway stations and sharing the video feed with, among others, Pakistan-based handlers.
So far, police have arrested 18, including six juveniles between the ages of 15 and 17.
The accused have been identified as Naushad Ali (20), Meera (28), Suhel alias Romeo (23), Iram alias Mahak (25), Praveen (19), Raj Valmiki (21), Shiva Valmiki (20), Ritik Gangwar (23), Ganesh (20), Vivek (18), Gagan Kumar Prajapati (22), and Durgesh Nishad (26).
Police officials familiar with the probe also said that the alleged racket recruited young men and women who had some experience working as mobile repair technicians, CCTV operators or computer mechanics; and were in immediate need of money.
A tip-off
On 14 March, a beat officer, posted at Kaushambi police station, received a tip-off about a group of men residing in Bhovapur acting suspiciously. “These individuals were reportedly recording videos of railway stations and locations associated with security forces, transmitting them to specific individuals, and luring other youngsters into participating in these activities by offering financial incentives,” Ghaziabad Police said in a statement.
Acting on the tip-off, police registered a case at Kaushambi police station under sections 61(2) (criminal conspiracy) and 152 (acts endangering sovereignty, unity and integrity of India) of the Bharatiya Nyaya Sanhita (BNS), along with sections 3 and 5 of the Official Secrets Act.
Police initially arrested five men and a woman in connection with this case on 14 March. Their mobile phone galleries contained ‘incriminating’ videos and photographs, as well as location data pertaining to critical establishments, Additional Commissioner of Police (LO & Traffic) Raj Karan Nayyar had said at a press briefing later the same day.
A person is usually paid around Rs 6,000-7,000 to install a CCTV camera but, in this case, the accused were getting paid Rs 16,000-17,000, police sources said, adding that the alleged racket was run by two or three handlers based in India, who shared specific information with handlers based in foreign countries.
“The racket’s operations were built on finding needy people who required quick money,” the statement from Ghaziabad Police added.
An officer, part of the Special Investigation Team (SIT) formed by Ghaziabad Police to probe the case, told ThePrint, “The main handlers included Naushad Ali, Sohail Malik, Sameer alias ‘shooter’ whose job was to scout on Instagram for specific profiles.”
“They looked for young men, with technical skills, like mobile repair, computer mechanics, CCTV operation—who were in need of money,” the officer said.
In its statement, the police also said that to minimise suspicion, the racket recruited men and women in their early twenties, and even minors. The two women arrested in the case, Meera and Mehak, had started working with the other accused only recently.
“The accused were trained to use apps that overlay GPS coordinates and timestamps directly onto photographs of sensitive installations,” said the officer part of the SIT.
Beyond physical recce, members of the alleged racket were also tasked with installing solar-powered, SIM-based standalone CCTV cameras.
According to the police statement, the accused during detailed interrogation “revealed that the entire racket was being operated from across the border”. “Naushad Ali stated that he had joined this racket through various social media platforms,” the statement added.
Previously, Naushad was allegedly tasked with conducting reconnaissance (recce) of security installations and other critical establishments including railway stations, and similar locations in various parts of the country. He was required to send photographs, videos, and GPS coordinates of these locations to foreign phone numbers, the police alleged.
“To facilitate the capture of these photographs and videos, he had installed a specific application from the Play Store, and he had also received training on how to operate it. It was through these very social media groups that he came into contact with Meera,” the Ghaziabad Police said.
The primary role of Meera, previously arrested in 2025 by Delhi Police’s Special Cell in connection with an Arms Act case, was to smuggle firearms. “At the time of her current arrest, Meera was operating strictly in accordance with instructions received directly from across the border,” the police statement added.
Naushad’s main role included inducting young boys—specifically those with technical skills (mobile repair, computer repair, CCTV operation, etc.) and hailing from economically disadvantaged backgrounds—into the racket by luring them with money, police said.
“Naushad scouted various social media groups to recruit young men who possessed a criminal mindset but lacked any prior criminal records. The accused—either personally or through other arrested accomplices—conducted reconnaissance (recce) of security force bases, other critical establishments, railway stations, etc., located at various places across the country,” Ghaziabad Police said in the statement.
Adding, “They subsequently transmitted photographs, videos, and GPS coordinates of these locations to foreign phone numbers. To facilitate the sharing of GPS coordinates, the accused had installed a specialised application on their mobile phones.”
Police also said the accused allegedly received online training on how to operate this application from their handlers situated across the border.
Furthermore, the accused had installed solar-powered, SIM-based, standalone CCTV cameras at Delhi Cantt railway station and Sonipat railway station and the video feeds from these cameras were being shared via WhatsApp, police said. In addition to these instances, police suspect that there were plans to install similar CCTV cameras at 50 other locations.
Payment for OTPs
Ghaziabad Police also said that the accused had been forwarding One-Time Passwords (OTPs) generated for Indian SIM cards for use on WhatsApp and other social media platforms to recipients abroad. During interrogation, the accused confessed to having shared these OTPs—enabling the operation of WhatsApp accounts abroad using Indian SIM cards—in exchange for payments ranging from Rs 500 to Rs 5,000 per instance.
The SIM cards were procured and utilised to share OTPs through various means—by snatching them, by purchasing pre-activated SIMs via various agents, and by purchasing SIMs registered in their own names or those of their family members, police said.
“They received payment for every task they executed, ranging from Rs 500 to Rs 15,000. The accused individuals utilised UPI platforms for these payments; however, instead of receiving the funds directly into their own bank accounts, they arranged for the payments to be routed to various public service centers or shops, from where they subsequently collected the money in cash,” said an officer familiar with the probe.
Police also claim to have recovered chat logs involving foreign phone numbers that were discovered on the mobile phones of all the accused.
Court says sovereignty endangered
On 17 March, two of the accused, Shiva and Ritik, had applied for bail.
The counsel for one of the accused stated that he had been falsely implicated in the said case, arguing that he had not committed the alleged offence, had no criminal antecedents or independent evidence against him, and that he was willing to furnish reasonable bail.
However, the court dismissed the bail application, stating: “The accused is accused of systematically adversely affecting religious harmony, engaging in unlawful activities that endanger the sovereignty, unity, and integrity of the country, and installing solar cameras at railway stations, sending photographs and videos and locations of the cantonment area to foreign numbers via phone chat. The investigation in the case is ongoing.”
(Edited by Amrtansh Arora)