Investigations into the blast near Delhi&rsquo;s Red Fort last year have revealed that a group of highly educated doctors used an elaborate network of &ldquo;ghost&rdquo; SIM cards and encrypted messaging applications to communicate with handlers based in Pakistan. Officials familiar with the probe said these findings led to a major policy shift in India&rsquo;s telecom regulations.
The blast took place on the evening of November 10, when a Hyundai i20 car exploded near the Red Fort, resulting in multiple deaths. Investigators said the vehicle was driven by Dr Umar-un-Nabi, a resident of Pulwama who was working at Al-Falah University in Faridabad. He died in the explosion.
According to officials, members of the so-called &ldquo;white-collar&rdquo; terror module relied on a sophisticated dual-phone strategy to evade surveillance. Arrested accused, including doctors Muzammil Ganaie and Adeel Rather, allegedly carried two or more mobile phones each. One device was used for everyday communication and registered in their own names, while the second was dedicated solely to encrypted messaging apps used to contact terror handlers.
The secondary devices, described by investigators as terror phones, were allegedly linked to SIM cards procured using misused or fake Aadhaar credentials of unsuspecting individuals. These phones were used exclusively for WhatsApp and Telegram conversations with handlers operating under coded identities.
Security agencies also uncovered a parallel racket in Jammu and Kashmir involving SIM cards issued on forged Aadhaar documents. A particularly alarming pattern emerged when investigators found that many of these SIM-linked accounts remained active on messaging platforms even while being operated from Pakistan or Pakistan-occupied Kashmir.
Officials said the handlers exploited app features that allow communication without a physical SIM card to guide the recruits. The accused allegedly learned how to assemble improvised explosive devices through online videos and was directed to plan attacks in India&rsquo;s hinterland, despite initially expressing interest in travelling to conflict zones such as Syria or Afghanistan.
These findings prompted the Department of Telecommunications to invoke provisions of the Telecommunications Act, 2023, along with new Telecom Cyber Security Rules. Under the directive issued on November 28, app-based communication platforms will be required to function only when linked to an active physical SIM card.
Within 90 days, all Telecommunication Identifier User Entities must ensure their applications automatically log users out if no active SIM is detected in the device. Telecom operators and messaging platforms, including WhatsApp, Telegram, Signal, Snapchat, Sharechat and JioChat, have been instructed to submit compliance reports to the DoT.
Officials said the move is being prioritised in Jammu and Kashmir, where terror-linked misuse of digital infrastructure has been more prevalent. While authorities acknowledged that identifying and deactivating all fraudulent SIM cards will take time, they described the directive as a major step towards dismantling the communication backbone used by terror networks to recruit, radicalise and manage operatives.

Probe reveals encrypted apps, fake SIMs led to new telecom crackdown

Ghost SIMs, Doctors in Red Fort Blast Plot

Probe reveals encrypted apps, fake SIMs led to new telecom crackdown

January 4, 2026 | 23:51 IST