New Delhi: The 25-year-old denied at first, only to then admit, it was he who set off panic at the Indira Gandhi International (IGI) Airport with an email indicating presence of bombs onboard domestic IndiGo flights. “My father would scold me everyday for not earning. I just wanted attention. I had seen news reports of bomb threats,” Shubham Upadhyay told the police team that came knocking on his door in Delhi’s Uttam Nagar last month, it is learnt.
A Class-12 passout, he sent the email on the intervening night of 25-26 October from his own mailing address. Police eventually traced his IP address and tracked him down. Investigators said he had seen TV reports on bomb threats and wanted to play a “prank”.
He was not the only one. Delhi Police sources said at least 16 FIRs were lodged in October this year in connection with a spate of bomb threats that kept the security apparatus on tenterhooks throughout the month. Besides Upadhyay, others including a teenager from Chhattisgarh and a 35-year-old from Nagpur were also apprehended for sending similar hoax messages. Their motives ranged from publicity stunts to personal vendetta.
The most recent incident involved a Nagpur-Kolkata flight which had to make an emergency landing at the Raipur airport in Chhattisgarh Thursday after one of its passengers claimed there was a bomb on board.
As they continue to zero in on the culprits, investigators suspect a larger conspiracy behind the string of threats received by Indian airlines last month. “The spate of such hoax threats are suggestive of a larger conspiracy at play to hurt the Indian economy. The ones doing it want to destabilise the country, create a sense of panic,” said one source.
It was against this backdrop that Gurpatwant Singh Pannun, US-based general counsel of Sikhs For Justice (SFJ), in a broadcast last month warned Sikhs not to fly Air India from 1-19 November. He later claimed he had called for a “boycott” of the carrier and not a ‘bombing’. Pannun was declared a designated terrorist by the Ministry of Home Affairs (MHA) in 2020, while the ban on SFJ, the Sikh separatist outfit he spearheads, was extended for another five years this July for its anti-India activities.
In most of these cases of hoax bomb threats, the accused relied on a virtual private network (VPN) to mask their IP address and physical location.
As ThePrint reported earlier, in case of threats made to flights to and from Delhi and Mumbai, the IP addresses were traced to London and Germany.
Indian agencies have reached out to the Federal Bureau of Investigation (FBI) as well as Meta and ‘X’ (formerly Twitter) for assistance in identifying other culprits. They have also sought help of VPN companies, it is learnt.
As for carriers, a hoax bomb threat means added costs—from fuel to unscheduled landing and parking to compensation for passengers.
For instance, Air India flight AI 119 from Mumbai to New York was diverted mid-air to Delhi on 14 October as a preventive measure following a bomb threat. The Boeing 777 aircraft with 200 passengers onboard had to reportedly dump 100 tonnes of fuel in order to land safely, a move expected to have cost the airline anywhere between Rs 1-3 crore.
To deal with situations like these, the Bureau of Civil Aviation Security came up with revised guidelines to identify a serious threat from a hoax, which came into effect on 19 October.
ThePrint takes a deep dive into emergency procedures triggered by a bomb threat, the various kinds of threats received by authorities, challenges faced by agencies in investigating such threats and the resultant disruption.
Also Read: Are flight bomb threats pranks or conspiracy? Cost of ‘hoax’ to Indian aviation is real
Author, teenager: Characters behind hoax threats
In the two-week period between 14 and 30 October, more than 510 domestic and international flights (Air India, IndiGo, SpiceJet and Vistara) received bomb threats that later turned out to be fake.
At the time Upadhyay sent that email, around 275 such threats had already been made.
Sources in the security establishment explained that while such bomb threats to flights started in May, they were “stray” incidents, unlike the spate of threats in October. These also coincided with similar threats issued to schools and hospitals, especially in Delhi.
“The bomb threats in October were a string of events, and all came one after the other. While some were sent by individuals like Shubham Upadhyay, central agencies along with different state police are working to identify the real culprits. It is being done to create a law and order situation and also to hurt the Indian aviation industry,” said a second source.
In the case of 25-year-old Shubham Upadhyay, he told police during interrogation that his father would reprimand him for not having a job. “His father is also unemployed. He used to work at Sadar Bazaar earlier. The family survives on Upadhyay’s brother’s income of Rs 10,000-15,000 doing odd jobs,” said a senior police official who did not wish to be named.
Similarly, Mumbai police detained a teenager from Chhattisgarh last month for issuing threats to two IndiGo and three Air India flights in a bid to allegedly frame a 32-year-old with whom he had a monetary dispute.
Another case is that of 35-year-old Jagdish Uikey, author of a book on terrorism arrested from Nagpur this month for allegedly sending emails hinting at a potential hijacking by the terror outfit Jaish-e-Mohammed in what the police have termed a “publicity stunt”. Uikey also allegedly made similar threats for market places and railway stations since January.
Investigators said such threats can be broadly divided into three categories: social media posts; emails or calls; and written notes. “Some threats are received by authorities via mail. Others post on social media and even make calls. There have also been instances of a note on a tissue paper thrown inside the aircraft,” said the second source.
For instance, at around 8.45 am on 9 October, the Airport Operation Control Center (AOCC) at IGI was made aware of a written note recovered from the lavatory of a Vistara flight which read: “BOMB THIS FLIGHT.”
Yet another case involved a 13-year-old detained from Uttarakhand’s Pithoragarh in June for allegedly sending a hoax bomb threat via email for a Delhi-Dubai flight earlier that month. Investigators found that the sender’s mailing address was deleted immediately after the email was sent. When questioned, the boy said he saw TV reports about another minor making a hoax bomb threat and decided to do the same for “fun and excitement”.
Encrypted tunnel & lack of cooperation
The probe into such bomb threats involves meticulous technical investigation, but the probe itself is to some extent dependent on cooperation between investigators and a host of entities, from social media giants to VPN companies and email service providers.
Lack of this cooperation is why a number of probes hit a dead end. “The anonymous servers cannot be controlled. There is no such mechanism, which is why these investigations often do not yield any result,” said a third source.
Perpetrors, the third source explained, use multiple servers which makes it difficult for investigators to track them down unless there is access to information sought from email service providers or messaging platforms.
How is VPN used here? An official in the security establishment explains it thus: “They (hoaxers) mask their IP address. It’s an encrypted tunnel. The individual may be sitting here in Delhi and the IP will show as Hong Kong, or some other place.”
Adding, “Even if we manage to break through some of the layers, we cannot reach the origin.”
Further, the official told ThePrint, “There are ‘n’ number of VPN companies. It gets difficult to get them to cooperate if they don’t have offices in India.”
A fourth source underlined the need for a stringent law to deal with this issue. “Dubai has banned VPNs. It can only be used as per guidelines of the regulatory authority. It is not open for all to play with. India must come up with something like it to tackle this menace.”
Bomb Threat Assessment Committee
Protocol dictates that as soon as a threat is received, it must be brought to the notice of the Airport Operation Control Center (AOCC). As security agencies launch a probe, the aircraft in question is inspected along with all its baggage. A meeting of the Bomb Threat Assessment Committee (BTAC) deployed at major airports is convened simultaneously.
The BTAC comprises officials from Central Industrial Security Force (CISF), airport security, AOCC, local law enforcement and local Bomb Detection and Disposal Squad (BDDS). In the first few minutes of the BTAC meet, the AOCC staffer or airline employee who received or spotted the threat summarises “every possible” detail on a threat assessment form.
“The form has columns for all minute details such as nature of posts in which threat was given, kind of social media account used for the purpose and overall activity of that account. For threats received over call, details such as tone and voice of the person making the threat, presence of any background noise which may hint at a pattern, have to be recorded on the threat assessment form,” an official familiar with the process told ThePrint.
Once all relevant information is recorded, BTAC initiates the process to ascertain the nature and authenticity of the threat. Threats are broadly classified into “specific” and “non-specific”. Though officials highlighted that there is “no thumb rule” of classification of threats, they alluded to certain parameters that attract special attention. These include the source of the threat, specific details mentioned, and timing, among other things.
Another official familiar with the process explained, “If a person has issued a threat against one particular airline giving details that a flight of that airline between one city to another has a bomb, the analysis begins with verification of flight records to check if the airline has a flight flying that route. If indeed there is a flight on that particular route on that given day, the threat is taken as a specific one and dealt with step by step.”
Once a threat is classified as “specific”, instructions are issued to relevant airport officials in line with norms laid down by the Directorate General of Civil Aviation (DGCA).
If the threat pertains to a specific aircraft already in the air, BTAC alerts the pilot through Air Traffic Control (ATC) and charts the next course of action.
A call is then taken on whether to direct the pilot to return the aircraft to the base airport or attempt an emergency landing at the nearest airport or to continue flying to the destination depending on the nature of the threat.
On the other hand, when a threat is received for an aircraft yet to take off, the same is moved to an isolated holding bay for thorough inspection.
Sources in the aviation industry confirmed to ThePrint that when a bomb threat is received, the airline’s security team is promptly alerted to it. “Passengers and crew are evacuated, after which the aircraft undergoes a thorough inspection. These checks are conducted on the aircraft, luggage, and cargo to ensure complete safety,” said one industry source.
A third official emphasised, “No flight for which a threat is received can take off without security clearance from the local law enforcement agency.”
At the same time, officials ThePrint spoke to conceded that existing Standard Operating Procedure (SOP) for classification of threats may need some changes, given the sheer number of threats that stand to overburden the system. “There is only a specific bit about today’s threat calls and that these are hoaxes. But since the security of so many people is involved no chance can be taken. This menace poses a new set of challenges which require a new perspective at the decision-making level,” said a fourth official.
All hands on deck
In India, like in most other countries, aviation security framework follows guidelines laid down by International Civil Aviation Organization (ICAO), a specialised agency of the United Nations. India was a founding member of ICAO. The ICAO’s Annex 17 document outlines standards and recommended practices (SARPs) for international air transport.
The SARPs for international aviation security were first adopted by the ICAO Council in March 1974, and designated as Annex 17 to the Chicago Convention, 1944.
Equally important is the ICAO Aviation Security Manual (Doc 8973 – Restricted) that assists member states in implementing Annex 17 by providing guidance on how to implement SARPs. “Annex 17 and Doc 8973 are constantly being reviewed and amended in light of new threats and technological developments that have a bearing on the effectiveness of measures designed to prevent acts of unlawful interference,” as per ICAO.
Amid the spate of hoax bomb threats, Civil Aviation Minister Ram Mohan Naidu last month said the Centre is considering legislative action to bring in harsher punishments with an aim to deter people from making such threats. This may include amendments to the Aircraft (Security) Rules, 2023, allowing the Centre to put offenders on the ‘no flying’ list.
Given the nature of the threats, the Ministry of Electronics and Information Technology (MeitY), too, issued an advisory last month to social media giants asking them to ensure such threats are not disseminated widely. The social media intermediaries were also asked to cooperate with authorities, or risk losing protection against third party content.
“The exemption from liability for any third party information, data, or communication link made available or hosted by social media intermediaries as provided under section 79 of the IT Act shall not apply if such intermediaries do not follow the due diligence obligations as prescribed under the IT Act read with IT Rules, 2021 or abetted or aided, in the commission of the unlawful act,” the advisory read.
It added that such hoax bomb threats while affecting a large number of citizens also destabilise the economic security of the country, and that the scale of spread of such hoax bomb threats has been observed to be dangerously unrestrained due to the availability of the option of “forwarding/re-sharing/re-posting/re-tweeting” on social media platforms.
(Edited by Amrtansh Arora)