Preliminary findings in two Ahmedabad bomb-threat investigations point to email-account activity in Bangladesh and Pakistan, as police examine whether compromised accounts were used to send threats naming 16 and 19 locations.
The Oct. 7 case involved messages from two accounts listing 16 sites, including 10 schools, the Gujarat High Court, other Ahmedabad courts and Narendra Modi Stadium. The Cyber Crime Branch said initial findings placed account access in Bangladesh and Rawalpindi, Pakistan. The messages invoked Khalistan and threatened blasts at singer Diljit Dosanjh’s scheduled shows in Delhi on Sunday, Nov. 1, and Ahmedabad on Nov. 21.
A separate case opened Oct. 27 followed an email naming 19 sites, including 14 schools, government offices, courts and the stadium. It also invoked Khalistan and warned people against attending Dosanjh’s Ahmedabad show. The branch said a review of the email headers, along with information from Gmail, indicated that the account was accessed from Rangpur, Bangladesh, and Lahore, Pakistan.
The locations indicate where the accounts were accessed; they do not identify who sent the messages or where the senders were.
In an earlier investigation into similar threats made in the name of a Khalistani organization, Gujarat police arrested a man in West Bengal. The branch said that case traced a chain of hacked Gmail account sales: the man sold accounts to a buyer in Bangladesh, who resold them to someone in Pakistan for cryptocurrency. Police are checking whether similar links exist in the Ahmedabad cases.
The branch said both investigations are continuing in coordination with central agencies.
