UP Authorities Dismantle Major Pak-Linked Spy Network Conducting Pre-Attack Recon

On March 14, Kaushambi police in Ghaziabad received an intelligence tip about youths acting suspiciously in Bhovapur. They were reportedly taking photos and videos of railway stations and military sites.

What began as a routine alert has revealed a structured espionage module. Investigators say the group operated under handlers based in Pakistan.

Investigation and arrests

A special investigation team was formed immediately. It included Indirapuram Police, the Crime Branch, cyber crime units, intelligence officers, and SWAT personnel.

Six people were arrested in the first sweep. Their phones contained videos, photographs, location tags, and other data tied to military and railway installations.

Interrogations began on March 17. The SIT identified a command structure linked to Pakistan.

At least 22 people have been arrested so far. Several of the detainees are minors.

Key individuals and locations

• Suhail Malik, Naushad Ali (alias Lalu), and Sameer (alias Shooter) were identified as central figures.
• Naushad Ali was arrested in Faridabad on March 22.
• Meera, an e-rickshaw driver from Mathura, was detained with Naushad. She had earlier been arrested by the Delhi Police Special Cell in a weapons-supply case.
• Sameer remains untraceable, and agencies suspect he is central to the Pakistan-based module.

Scope and methods

Investigators found specific instructions for filming and mapping perimeters. They were told which stations to film, the angles to shoot, and when to send coordinates.

Payments ranged from Rs 5,000 to Rs 20,000 per assignment. The sums were small but enough to lure vulnerable youths.

Four of the initial six arrested had traveled to Pulwama in Jammu and Kashmir. They sent sensitive intelligence back to handlers abroad.

Authorities concluded the activity amounted to pre-attack reconnaissance rather than casual spying. This raised concerns about preparations for another large-scale attack in Jammu and Kashmir.

Surveillance infrastructure

The module planned to install solar-powered CCTV cameras along the Delhi-Jammu railway corridor. Two cameras, at Delhi Cantonment and Sonipat, were already operational.

Forensic teams are analyzing recovered units. Early findings suggest a target list approaching fifty installations nationwide.

Investigators believe continuous surveillance of troop movements would have been possible if the network reached its full scope.

Communication and training

The group used social media and encrypted messaging apps for recruitment. A foreign-controlled mobile application transmitted photos, videos, and GPS data.

Online training modules originated abroad. Over 450 files were traced back to Pakistan.

Recruiters targeted youths with technical skills. Mobile repair technicians, CCTV workers, and those with basic networking skills were approached.

Women and minors were used to lower suspicion. A key recruiter was identified as Iram, also known as Mahak.

Parallel SIM and OTP racket

Investigators ran a parallel probe into a SIM and OTP supply operation. The accused forwarded Indian OTPs abroad.

That enabled foreign actors to run WhatsApp and social accounts with Indian numbers. Payments for this ranged from Rs 500 to Rs 5,000.

SIMs were acquired via snatching, phishing, forged IDs, and pre-activated cards through agents. Money transfers avoided personal accounts.

Funds were routed through Jan Seva Kendras and small shops. Cash withdrawals minimized traceability.

Further arrests and geographic links

On March 20, nine more people were arrested. Five of them were minors.

The module had links in Uttar Pradesh, Bihar, Maharashtra, and Nepal. This confirmed a dispersed recruitment and logistics network.

Agencies involved now include the NIA, ATS, and police forces in UP, Delhi, and Haryana. They are coordinating the ongoing investigation.

Next steps

Investigators will take the accused to sites where cameras were installed. They will visit locations where videos were recorded and SIMs purchased.

Forensic analysis of recovered devices will continue. Agencies aim to reconstruct the full chain of operations.

Filmogaz.com notes that UP authorities have dismantled a Pak-linked spy network that was conducting pre-attack reconnaissance. The case remains under active investigation.