Amid a series of hoax bomb threats and ongoing protests, the Delhi Police’s cyber commandos have been working round the clock to trace digital footprints, identify misleading social media content and help investigators unravel complex cybercrime cases.
From examining email records and virtual private networks (VPNs) to tracing cryptocurrency transactions in ‘digital arrest’ scams, the specialised personnel use technical expertise to turn digital clues into investigative leads.
In an exclusive interaction with The Hindu, cyber commando Akhil Raj, who works with the Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) unit, explained how the team tracks suspects, investigates online fraud and flags manipulated videos circulating on social media.
Mr. Raj, who was involved in investigations into hoax bomb threats received in Delhi in 2024 and 2025, said investigators approach email service providers for information such as IP addresses, registered contact number, and alternate email IDs. Investigators may seek records spanning six months to a year to establish the sender’s online activity.
The process becomes more difficult when suspects use VPNs or the Tor network to conceal their digital footprints. In some cases involving free VPN services, a temporary break in the connection can expose the actual IP address, allowing investigators to approach internet service providers for further details.
Of more than 20 bomb threat cases he was involved in investigating, the police traced the senders in four to five cases, Mr. Raj said. These included three cases in which school students used VPN connections to send hoax emails “in an attempt to postpone examinations”.
Tracking misleading content
With protests continuing in the capital, cyber commandos have also been involved in monitoring social media for triggering and misleading posts, reels, and videos. The team tracks trending keywords and hashtags around the clock to identify potentially manipulated content, including videos generated using artificial intelligence (AI).
Once a video is flagged, the police send takedown requests to social media platforms such as X and Meta.
Recalling a recent case involving an AI-generated video of Delhi Police ACP Vivek Bhagat, Mr. Raj said the police identified the video and initiated legal action against the accused.
Additional Commissioner of Police (IFSO) Sanjay Bhatia said cyber commandos had helped improve the speed of investigations by enabling police personnel to map digital trails and connections more quickly.
“What would earlier take weeks to establish — the path of a crime and the various digital nodes involved — can now be mapped in just two to four days,” he said.
“They bring specialised skills that are not available elsewhere in the police force, and we are constantly working to upgrade their expertise as technology and cybercrime evolve Mr. Bhatia said.
Specialised training
Cyber Commando Akhil Raj and other part of the cyber lab team. Photo credit: Special Arrangement
The cyber commando programme was inaugurated in 2024, with 300 personnel trained in its first batch. The Union Home Ministry’s Indian Cyber Crime Coordination Centre (I4C) selected police personnel from across States through an entrance examination focused on cybersecurity and cybercrime. Those selected underwent six months of residential training at eight centres, including the National Forensic Sciences University (NFSU) and IITs.
Mr. Raj trained at NFSU in Gandhinagar. He has been working with the Delhi Police’s IFSO unit since 2019 and has spent nearly two years as a cyber commando. His areas of expertise include digital forensics, cryptocurrency investigations and malware analysis.
Delhi has eight cyber commandos. Their deployment depends on a case’s technical requirements and the expertise needed. In the event of a ransomware attack on a government system, for instance, the I4C identifies a suitable commando to assist the investigation alongside the State police, which remains the first responder.
Following the money
Cryptocurrency-related frauds, including ‘digital arrest’ scams, in which stolen amounts are quickly converted into cryptocurrency and transferred abroad, is also becoming a growing area of concern.
Investigators seek information from exchanges used to convert cryptocurrency into Indian currency and request customer information that could help identify those behind the transactions. They also examine publicly accessible blockchain records to trace subsequent transfers and establish links between wallets, Mr. Raj said.
Mr. Raj spends much of his working day behind a large screen, analysing digital evidence, correlating records and tracing connections across online platforms and networks. The aim is to turn scattered technical clues into leads that investigators can use to identify suspects and build their cases.