Lost in dark web and misled by VPN, Delhi police struggle to trace origin of bomb threat emails to schools

New Delhi: A fresh wave of bomb threats targeting schools and colleges has kept Delhi Police on its toes as many education institutes panicked for three days straight, with senior officers saying the emails were sent using encrypted networks, making them hard to track.

Cyber experts of the Delhi Police and senior officers investigating the threats said the senders are using Virtual Private Networks (VPNs) and the dark web.

The dark web is a part of the Internet that is not indexed by traditional search engines and is accessible only through special browsers, allowing illegal activities such as cybercrime, human trafficking, and drugs and weapons trade to thrive.

VPN adds a layer of anonymity by allowing users to create a secure connection to another network.

"Tracking someone on the dark web is like chasing a shadow in a room full of mirrors. The moment you think you have found a lead, it vanishes behind another layer of anonymity," a Delhi Police officer explained.

Ten bomb threat emails have been received by nine schools in the city in the past three days. Last February, a private school and a Delhi University college in the capital received bomb threat emails, which were later confirmed by authorities to be hoaxes.

In October last year, an explosion occurred outside the CRPF school in Prashant Vihar, but no one was injured. In January this year, police arrested a Class 12 student who had allegedly sent bomb threats to over 400 schools.

Amid growing concerns over such threats, the Directorate of Education (DoE) issued a comprehensive 115-point Standard Operating Procedure (SOP) in May to handle bomb threats in schools.

Sources said that each of the recent emails carried a similar pattern: vague but alarming language, timed before school hours, and often routed through international servers. Police believe that the sender or the group involved is adept at using anonymising tools and cyber tactics to avoid detection.

"It is not easy to trace emails that are routed through multiple proxy servers. They are using VPN chains and tools on the dark web to bounce their location across several countries. In such cases, even service providers are often helpless," a source said.

A cyber expert of the Delhi Police said the investigating officers are no longer treating the threats as a mere prank.

"Multiple probe agencies are involved in investigating the matter. These threats are affecting children, parents and the school staff psychologically," the expert said on the condition of anonymity.

During a press conference, a senior Delhi Police officer said that the use of VPN by the sender of the emails significantly hampered efforts to track the threat.

"We were tracking the emails, but VPN makes it difficult to track their origin. We also had to check for any possible terror link," he had said.

The recurring threats have caused considerable anxiety among parents and teachers.

At St Thomas School in Dwarka, which received two threats in less than 24 hours, Rakesh Arora, the father of a 12-year-old student, said, "Schools receiving bomb threats is very worrying. It not only creates fear but also disrupts the children's studies.

"These may turn out to be hoaxes, but as parents, we can't help but be scared," he said.

On Tuesday, Varun Kumar, whose daughter is a kindergarten student, said, "This is not the first time. These kinds of threats are happening quite often. Police must take strict action against those responsible for sending such emails. It creates unnecessary panic and disturbs everyone."

"Parents are genuinely scared to send their children to school now," Kumar added.

Following the DoE's SOP, schools have tightened their security protocols, increased bag checks, restricted outsider entry, and are coordinating with the local police stations on a daily basis.

Police said that they are not ruling out any angle in their probe into the threats.

"The January case had revealed a possible link to a civil society group and a political entity, which had drawn significant attention. The accused student's father was reportedly associated with an NGO that had previously supported terrorist Afzal Guru," a senior police officer said.

Police have urged people not to panic over such threats and to report any suspicious activity. They have issued advisories and hold interactive sessions in schools from time to time, informing stakeholders how to handle threat emails and maintain evidence that could help in tracking the perpetrators.