Illustrative     
A routine intelligence input at Ghaziabad’s Kaushambi police station on 14 March has spiralled into one of the most significant espionage cases in recent memory. What initially appeared to be a handful of youths engaged in suspicious behaviour has been exposed as a structured spy network operating under direct instructions from handlers in Pakistan.

So far, 22 individuals have been arrested, including several minors. The network was neither local nor amateur, but a dispersed and organised module. Police acted swiftly after receiving alerts that young men in Bhovapur, Uttar Pradesh, were filming railway stations and military bases, sending the material abroad in exchange for money. The lure was simple: cash rewards ranging from ₹5,000 to ₹20,000 per assignment, with additional incentives for recruiting more participants.

The first sweep netted six suspects, whose phones contained extensive evidence—videos, photographs, GPS-tagged locations, and images of military installations. This material confirmed that the operation was far more than a neighbourhood hustle. A Special Investigation Team (SIT) was immediately formed, comprising personnel from Indirapuram Police, Crime Branch, cyber crime, intelligence, and SWAT units.

Interrogations revealed the command structure, identifying handlers Suhail Malik, Naushad Ali, and Sameer alias Shooter, all based in Pakistan. Recruitment was conducted through social media and encrypted messaging apps, with precise instructions on what to film, which angles to capture, and when to transmit coordinates.

Investigators discovered that four of the arrested suspects had previously travelled to Pulwama, Jammu and Kashmir, where they transmitted sensitive intelligence back to Pakistan. This raised suspicions that the network was engaged in pre-attack reconnaissance rather than mere espionage.

The SIT uncovered even more alarming plans. The group intended to install solar-powered CCTV cameras along the Delhi–Jammu railway corridor to stream live feeds directly to Pakistan, tracking troop movements. Cameras had already been set up at Delhi Cantonment and Sonipat in Haryana. Forensic teams are now analysing the recovered units, with early findings suggesting a target list of nearly 50 installations nationwide.

The recruitment strategy was deliberate. Youths with technical skills—mobile repair workers, CCTV installers, and those with basic networking knowledge—were targeted. Economically vulnerable individuals, women, and minors were added to reduce suspicion. One key recruiter has been identified as Iram alias Mahak.

Parallel to this, investigators uncovered an OTP and SIM supply racket. Indian OTPs were forwarded abroad, enabling foreign actors to operate WhatsApp and social media accounts with Indian numbers. 

SIM cards were acquired through snatching, phishing, forged IDs, and pre-activated agents. Funds were moved via UPI but routed through Jan Seva Kendras and small shops, with cash withdrawals ensuring minimal traceability.

On 20 March, nine more people were detained, including five minors, with links traced to Uttar Pradesh, Bihar, Maharashtra, and Nepal. This confirmed the network’s dispersed nature. Two days later, Naushad Ali alias Lalu was arrested in Faridabad, where he ran a tyre-puncture repair shop. Alongside him, Meera, an e-rickshaw driver from Mathura, was detained. She had prior links to weapons supply cases and was connected to Sarfaraz alias Sardar in Pakistan.

Sameer alias Shooter remains untraceable, but agencies believe he is central to the Pakistan-based module. The NIA, ATS, and police forces across Uttar Pradesh, Delhi, and Haryana are coordinating efforts to dismantle the network fully. Investigators will now retrace every site where cameras were installed, videos recorded, and SIMs purchased to reconstruct the chain of operations.

Agencies