It is unlikely that the Delhi Police will be able to trace the person or source who sent bomb threat emails to hundreds of schools or hospitals or the IGI airport this year. Why?
Because the majority of e-mails sent between May 1 and the last 10 days used a virtual private network (VPN). Senior police officials said that the entire business model of VPNs works on the principle that servers do not reveal location or details.
A senior police officer said, “It is not possible to locate an e-mail sent through a VPN; if the location is determined, it will show multiple locations, sometimes Sweden, the Netherlands, or some other country in Europe. Currently, India does not have its own VPN network. So all these VPNs being used for mail are based abroad. If India had its own VPN network, that country would be bound by law and the details would have to be shared with law enforcement agencies.”
The officer added that it’s a similar problem with Proton Mail as it offers end-to-end encryption: “If it’s connected to a masked VPN, it’s impossible to figure out who or where it was sent from.”
Currently, only critical infrastructure such as banking systems are building their own VPNs. Experts said India or its security agencies should completely ban VPNs operating in the country if they do not cooperate with law enforcement agencies.
Sunny Nehra, founder of Cyber Security firm Secure Your Hacks, said: “Blackmailers are using VPNs to hide their IP addresses. Most VPN companies have strict policies of not logging their users’ details, and if they do keep those logs, they avoid sharing them with the authorities. Also, since most major VPN companies are based abroad, mainly in countries like Panama, they generally do not cooperate with Indian law-enforcement agencies.
“In case of a bomb threat, the IPs have private internet access and prefer to leave India in 2022 as they don’t want to share details with the authorities,” he said.
Nehra added that there are ways to trace VPNs as well but highlighted that the process is long and the prospects are bleak.
Another problem for the police is time. “Though we know the VPN is from the Netherlands, the VPN will reflect another location until we write to their authorities to share the details,” said a police official.
Delhi Police also wrote to Interpol for help.
The first incidents of threats to schools and hospitals in Delhi were reported in May. Bomb threats were also made to Tihar Jail and several other government establishments, including some central ministry departments.
In October, more than 150 domestic and international flights operating from Delhi received similar bomb threat messages sent to X, where the sender used VPN networks. The Delhi Airport Police has registered 16 separate cases but has seen no success so far.
Why should you buy our membership?
You want to be the smartest in the room.
You want access to our award-winning journalism.
You don’t want to be confused and misinformed.
Choose your subscription package