New Delhi: Two posts, the first claiming responsibility for the attack on tourists in Jammu and Kashmir’s Pahalgam on 22 April last year, and the second denying any role in the attack after global outrage and condemnation by the United Nations Security Council, were traced to Pakistan, according to the chargesheet filed by the National Investigation Agency (NIA).
On 22 April 2025, terrorists killed 25 Indians—24 tourists and one Kashmiri local—as well as a Nepalese tourist at the Baisaran meadows in Pahalgam before fleeing the tourist spot. Eyewitness accounts indicate victims were singled out on the basis of religion, and shot at close range in front of their families.
The first post appeared on open-source microblogging platform Mastodon at around 4.32 pm on 22 April, a couple of hours after the carnage. It was pushed by a propaganda handle of The Resistance Front (TRF), a handle named ‘Kashmir Fight’, explicitly referring to the incident using the hashtag ‘#PahalgamAttack’.
The TRF is a militant group active in Jammu and Kashmir, designated a terrorist organisation by India and the United States.
Later, on 25 April, the TRF used a newly created digital outlet called ‘TheResistanceFront Official’ to issue a denial, which the NIA has explained as “attempts of deniability by TRF and Pakistan”.
The Internet Protocol used for creating both these posts belongs to Pakistan, according to the chargesheet of the NIA. While the first IP address was traced to Battagram city of Khyber Pakhtunkhwa province, the IP address used for the Telegram account to issue a denial was traced to Rawalpindi, and the account was registered using a Pakistani mobile phone number, the NIA has alleged in its chargesheet of December last year.
“TRF had claimed the Pahalgam attack 2.5 hours after the attack through social media posts. It withdrew the claim after three days. The social media analysis of both these posts has revealed that they were uploaded from Pakistan from handles associated with TRF,” the NIA has alleged in the chargesheet filed before a Special NIA court in Jammu.
The NIA officially took over the Pahalgam terror attack probe on 27 April last year, following orders from the Ministry of Home Affairs (MHA). It went on to lodge the chargesheet on 15 December, including against the Pakistan-based chief of the TRF, named Sajid Jatt, who masterminded the entire attack while being in touch with the three terrorists who carried out the killings.
Three months after the attack, Union Home Minister Amit Shah informed Parliament that the three terrorists—Faisal Jatt alias Suleman Shah, Habeeb Tahir alias Jibran, and Hamza Afghani—were silenced in an encounter at Dachigam forest on the outskirts of Srinagar. The two local pony wallahs, who allegedly provided food and shelter to the terrorists, were arrested by the NIA in June last year.
Operation Mahadev, as this joint operation of the Indian Army, Central Reserve Police Force and the Jammu and Kashmir Police was called, resulted in the recovery of the firearms used in the killings, as well as two mobile phones used by the terrorists.
Beyond the roots of the claims and denials of the attacks, the NIA also found that the two mobile phones used by the terrorists were shipped into Pakistan by Chinese mobile company Xiaomi. According to the company’s supply chain records—shared with the agency—the two mobile phones were delivered to addresses in Karachi and Lahore.
Digital and forensic examination of the phones revealed that the geographical coordinates of the Baisaran meadows were screen-captured and stored in the AlpineQuest application on those phones. The screenshots were taken on 15 April, confirming that the conspiracy of an attack in the Baisaran valley was in place at least a week before the attack.
“During scrutiny of the data recovered from the phone of the killed terrorist in Operation Mahadev, as received by the Investigating Officer (IO) from National Forensic Sciences University, Gandhinagar and forwarded by the IO to the Chief IO of the instant case, it was ascertained that two points plotted on AlpineQuest app were screenshotted and stored in those devices. A detailed analysis of these two points was done, and the investigation revealed that these two screenshots were taken on 15.04.2025 and 16.04.2025,” the NIA chargesheet says.
“Since both the coordinates pinned in the screenshots were found to be adjacent to the Baisaran Park, it can be concluded that the conspiracy of this terror attack was live at least as on 15.04.2025,” the NIA has alleged in chargesheet.
(Edited by Nardeep Singh Dahiya)