Accused Used Ghost SIMs to Contact Pak Handlers

Authorities said the investigation into the “white-collar” terror module and the explosion led to the use of a network of “ghost” SIM cards as part of a tactical “double phone” protocol by the arrested doctors, including Muzammil Ganaie, Adeel Pretty and others, to evade security agencies.

Dr. was killed while driving an explosives-laden vehicle near the Red Fort. They said each of the accused, including Umar-un-Nabi, was carrying two to three mobile phones.

The defendants carried a “clean” phone registered in their names for routine personal and professional use to avoid suspicion, one of which was a “terror phone” used solely for WhatsApp and Telegram communications with their handlers in Pakistan (identified by the code names ‘Ukasa’, ‘Faizan’ and ‘Hashmi’).

SIM cards for these secondary devices were issued in the names of innocent civilians whose Aadhaar information was misused, officials said.

Jammu and Kashmir Police added that it had also uncovered a separate blackmail in which SIMs were issued using fake Aadhaar cards.

According to officials, security agencies have noted a disturbing trend of these captured SIMs remaining active on cross-border messaging platforms in Pakistan-occupied Kashmir (PoK) or Pakistan.

Leveraging features that allow messaging apps to run without a physical SIM on the device, handlers were able to direct the module to learn IED assembly and plan “homeland” attacks via YouTube, despite initially wanting to join conflict zones in Syria or Afghanistan.

To plug these vulnerabilities, the Center has implemented the Telecommunications Act 2023 and the Telecom Cybersecurity Rules to “protect the integrity of the telecom ecosystem”, which includes a rule that within 90 days, all Telecom Identifier User Entities (TIUEs) must ensure that their applications work only if an active SIM is inserted into the device.

The order also directs telecom operators to automatically log users out of apps like WhatsApp, Telegram and Signal in case of absence of an active SIM, and all service providers, including Snapchat, Sharechat and Jiochat, must submit compliance reports to the DoT, officials added.

While explaining the reasoning behind this move, the DoT statement said that this feature of using apps without a SIM poses a challenge to telecommunications cybersecurity as it is misused to carry out cyber fraud and terrorist activities from outside the country.

The directive is being implemented rapidly in the Jammu and Kashmir telecom circle. While authorities acknowledge that it will take time to deactivate all expired or fake SIMs, the move is seen as a critical blow to the digital infrastructure used by terrorist networks to radicalize and manage “white-collar” operators.

Failure to comply with these norms will result in stringent sanctions under the Telecom Cyber ​​Security Rules and other relevant laws, officials said.

The “white collar” terror module began to unravel on the intervening night of October 18-19, 2025, when posters of the banned Jaish-e-Mohammad (JeM) appeared on walls just outside the city of Srinagar. Posters warned about attacks against police and security forces in the valley.

Treating this as a serious matter, Srinagar Senior Police Inspector GV Sundeep Chakravarthy formed several teams to conduct an in-depth investigation into the case.

After collating the statements of the arrested accused, the investigation took the Srinagar police to Al Falah University in Haryana’s Faridabad; Two doctors – Ganaie, a resident of Koil in South Kashmir’s Pulwama, and Shaheen Sayeed of Lucknow – were arrested here. A large amount of weapons and ammunition, including 2,900 kg of ammonium nitrate, potassium nitrate and sulfur, were also seized.

The car explosion case near the Red Fort killed 15 people and is being investigated by the National Investigation Agency.