Digital Terrorism for Hire

How Stolen Email Accounts Spread Fear Across Borders? The email that empties a school this morning may have been sent from an account its owner hasn’t opened in years. The owner lives in one country. The hacker who stole it lives in a second. The person who typed the threat may live in a third. Police can trace the account within hours. Finding the person behind it can take years, if it happens at all.

That gap is the business model of digital terror. Email accounts are now stolen, bundled and sold like any other product and every sale puts another layer between a threat and the hand that sent it.

A Market in Stolen Identities

Most accounts aren’t hacked by geniuses. They’re lost to a phishing link, a reused password or a data breach. Criminals then prefer the old accounts to new ones, because a real name and a long history slip past spam filters and put a stranger, not the sender, at the front of any investigation.

What’s changed is the commerce. In August 2023, INTERPOL shut down 16shop, a “phishing-as-a-service” platform whose kits had compromised more than 70,000 people in 43 countries. Its operator was arrested in Indonesia, a facilitator in Japan and its servers sat with a US hosting company. One person built the tools, others stole the credentials and customers anywhere could use them.

16shop wasn’t a bomb-threat operation. But it shows the supply chain that threat campaigns now draw on, and once that chain exists, a single email can do damage out of all proportion to its cost.

Fear Without a Bomb

A hoax doesn’t need explosives. It only needs to be believed long enough to empty a building.

Europe learned that in September 2024 when thousands of emails threatening explosions hit schools in the Czech Republic, Slovakia and Latvia on the first days of term. Classes stopped and buildings were searched. It took a joint investigation by four countries ten months to reach a suspect in Dnipro, Ukraine.

Then the allies split. Czech intelligence said the suspect was probably financed by a person from Russia. Slovakia’s interior minister replied that such working hypotheses were never meant for public release. Two partners on the same case couldn’t agree on how much of the blame story was proven.

That’s the first lesson of digital terror: the fear is real even when the bomb isn’t, and the places a campaign hits say nothing about who’s behind it. The second lesson is about money.

Terror as a Transaction

On 13 December 2018, hundreds of businesses, schools and offices across the United States and Canada received the same email: pay $20,000 in Bitcoin or a bomb in the building goes off. Hospitals and courthouses were evacuated. It looked like terrorism. It was extortion, and researchers traced some of the messages to the same addresses used in earlier sextortion spam.

The payment demand also exposed a myth. Each email carried its own Bitcoin wallet, and every Bitcoin transaction sits on a public ledger. Crypto moves money fast and outside banks, but it isn’t invisible. For investigators, a payment trail is often the strongest lead they have.

The deeper lesson is that the same method can serve opposite ends. A threatening email can extort, disrupt, intimidate or fake a political cause. The method never settles the motive. And when the motive is unclear, the temptation is to read it from the trail itself, which is where attribution goes wrong.

Whose Trail Is It?

Every threatening email raises five separate questions: who registered the account, who controlled it, who sent the message, who organised the campaign and who, if anyone, paid for it. In the market for stolen accounts, each answer can point to a different person. An IP address shows where a connection came from, which may be a VPN or a borrowed network. A login shows where an account was opened, not who was at the keyboard. These are leads, not verdicts.

The United States learned how costly it is to confuse the two. In early 2017, Jewish community centres were hit by nearly 150 bomb threats in three months, and many assumed an organised antisemitic campaign. One culprit turned out to be a former journalist, Juan Thompson, who made threats to harass an ex-girlfriend, sometimes in her name. The main suspect in the wider wave was a 19-year-old arrested in Israel.

A threat can be built to point at the wrong person, and its politics can be part of the disguise. Tracing a digital footprint isn’t the same as proving who is responsible. That principle was about to be tested in Ahmedabad.

Ahmedabad: A Case Study in Cross-Border Digital Threats

All of these problems surfaced at once this autumn in Ahmedabad, the largest city in the western Indian state of Gujarat.

The city’s schools have become a regular target. A fresh wave this week was the eighth such incident in 11 months, and the latest messages, sent in the name of a “Khalistan National Army”, also threatened Punjabi singer Diljit Dosanjh’s concerts in Delhi on 1 November and at Narendra Modi Stadium on 21 November. Parents rushed to collect their children while bomb squads searched classrooms.

Ahmedabad’s Cyber Crime Branch is now investigating two recent cases covering 35 locations. The first, registered on 7 October, involved emails from two Gmail accounts to 16 sites, including 10 schools. The second named 19 locations: 14 schools, two courts, two municipal offices and the stadium.

What investigators have reported so far needs careful reading, because it comes from three different sources of evidence.

The two recent cases: preliminary findings. Officials say the accounts used in the first case were operated from Bangladesh and Rawalpindi, and that the second case’s connections were traced to Rangpur in Bangladesh and Lahore. The accounts appear to be old ones, procured earlier and used under false names. Police have not said who operated them, and the sender’s identity and the credibility of the threats are yet to be established.

An earlier investigation: a statement from one accused. In a previous probe into threats sent in the name of a Khalistani group, an accused arrested in West Bengal allegedly told police he had sold hacked Gmail accounts to a person in Bangladesh, who passed them on to someone in Pakistan in exchange for cryptocurrency, with deals reportedly made over Telegram and WhatsApp.

The September case: scale. A month earlier, Gujarat Police said they had broken up a network holding 513,847 Gmail IDs and passwords in use since 2022, after a hoax threat was sent to the state government days before the BRICS summit in New Delhi. Two men were arrested in Bihar and Jharkhand, one of them allegedly in contact with a buyer in Bangladesh who paid partly in cryptocurrency. Each fraudulent account had two-factor authentication enabled, and police plan to question Google about how its safeguards were bypassed. Investigators haven’t established that every account was used for threats.

Taken together, the reporting fits the pattern described throughout this article: accounts sourced inside India, traded across borders through intermediaries and paid for in crypto, then used against public institutions. But each piece carries a different weight. Login locations are leads. One suspect’s account of where he sold accounts is an allegation. And nothing reported so far establishes that the September network and the October threats are the same operation, who actually sent the messages, or that any organisation or state directed them.

Investigating Beyond Borders

If Ahmedabad’s threats were assembled across three countries, they can only be solved across them. That’s less a slogan than a list of practical steps, each of which can fail.

Preserve the evidence. Login records, IP logs and account metadata are held by email providers and telecom companies, and they don’t last forever. Investigators have to ask for them to be preserved before they’re deleted or overwritten.

Get the records lawfully. Gmail is run by a US company, so account data usually has to be requested through legal channels that work across jurisdictions. That’s slow even between close allies.

Connect accounts to people. A login from Rangpur or Lahore is a place, not a person. Turning it into a suspect requires local police to identify who used the connection, which in turn requires their willingness and their legal authority to act.

Follow the money. Crypto payments can be traced on the blockchain, but tying a wallet to a person usually depends on an exchange in yet another country handing over customer records.

Link or separate incidents. Investigators need to know whether the September network, the earlier West Bengal case and the October threats share operators, accounts or infrastructure. Shared methods aren’t enough; shared evidence is.

The European and INTERPOL cases show this can work. Czech, Slovak, Latvian and Ukrainian authorities built a joint investigation team, and the 16shop takedown depended on INTERPOL working with the FBI because the platform’s servers sat in the United States. But those cases relied on institutions and trust that don’t exist everywhere. Between neighbours with strained relations, the channels Europe used may simply not be available, and that gap is where the leads stop.

When Threats Invoke Ideology

The Ahmedabad emails didn’t arrive as anonymous noise. They carried a name, the “Khalistan National Army”, and a target with obvious resonance in Punjabi popular culture. That’s exactly what makes them hard to read.

A political label in a threat can mean three very different things. It can be a claimed affiliation, which anyone can type. It can reflect a verified organisational connection, which investigators would need to prove through communications, money or membership. Or it can point to operational responsibility, meaning the named group actually planned and sent the threats. Only evidence moves a case from the first category to the others.

The pattern isn’t unique to India. The 2024 European threats were signed with references to a Ukrainian “maniacs” group and a Telegram channel, while Ukraine’s own security service blamed Russia. In the Thompson case, the name on the threats was the victim’s. A label tells you what the sender wanted you to think. It doesn’t tell you who the sender is.

A genuine ideological motive remains possible in Ahmedabad, and investigators should test it. But political references also create pressure for quick conclusions, and a premature one does real damage. Blame a movement on the strength of a signature, and its sympathisers face suspicion they haven’t earned. Blame a state on the strength of a login location, and a criminal investigation becomes a diplomatic dispute, as Europe’s own experience shows when two allied governments split publicly over a suspected Russian link. Geography can show where a connection was made. Only evidence can show who controlled it and why.

The AI Accelerant

Everything described so far is about to get faster.

Europol’s 2025 assessment of organised crime found that generative AI had lowered the barriers to entry for digital crime, letting criminals write convincing messages in many languages and automate phishing at scale. Its 2026 internet crime report went further, warning of a “velocity gap” in which criminals are pulling ahead of the police trying to catch them.

For threat campaigns, that changes two things. First, scale: one person can now produce thousands of fluent, varied threats in English, Hindi or Gujarati in minutes. Second, and more important, it removes a clue. Investigators used to read a message’s spelling, grammar and phrasing for hints about where its author came from. A machine-written threat carries no accent. It can mimic any group’s style, borrow any cause’s slogans and sound like it came from anywhere. Attribution, already hard, gets harder.

India’s own military planners clearly see where this is heading. On 23 October, Defence Minister Rajnath Singh released the Army’s Land Warfare Doctrine 2026, which puts drones, AI and information warfare at the centre of future conflict, and urged faster progress in AI, cybersecurity and secure communications. In February, the Home Ministry’s new counter-terrorism strategy, PRAHAAR, folded cybersecurity into India’s counter-terrorism framework.

That’s the right instinct. But if the digital domain is now a battlefield, it deserves battlefield discipline. No serious commander announces who fired a shot before confirming it. A state that treats AI as a weapon of war should be the first to recognise how easily AI can disguise who sent a threat, and the last to blame a neighbour on the strength of a login.

What Credible Attribution Looks Like

If geography can’t answer the question of who sent a threat, institutions have to. The real test of a state’s seriousness about digital crime isn’t how quickly it names a suspect country. It’s whether it can turn a lead into a lawful case, and whether it acts when another country hands it one.

A recent case shows what that looks like in practice. On 20 October, Pakistan’s National Cyber Crime Investigation Agency arrested Faheem Akram in Lahore, a Pakistani national indicted in the United States for allegedly running LabelsBank.com, a website that sold more than 5.1 million counterfeit US postage labels and cost the US Postal Service more than $126 million. According to agency officials, the FBI traced the suspect and shared information with Pakistani authorities. The NCCIA then followed the money, identifying 16 bank accounts, raiding 35 locations and questioning 47 people.

That sequence is the model the Ahmedabad leads need. Evidence moved from one state to another through proper channels, a dedicated agency verified it on the ground, and a suspect was arrested in his own country on the strength of a foreign investigation. If logins in the October threats really do trace to Lahore or Rawalpindi, the route to whoever used them runs through the same kind of formal request and cooperation. It doesn’t run through press briefings.

India isn’t short of institutions of its own. It has a national cybercrime coordination centre and well-resourced state police cyber units, and the September arrests show they can deliver. The gap lies elsewhere: in what happens to preliminary findings. Eight waves of threats in 11 months have produced cross-border traces in the headlines, but the senders behind the recent cases remain unidentified, and no formal request to the countries named has been reported.

Politics helps explain why that gap persists. Critics have long argued that invoking Pakistan carries domestic value in Indian politics. In 2019, India’s Election Commission advised parties not to use the armed forces in their campaigns, yet Prime Minister Narendra Modi urged first-time voters to dedicate their votes to the pilots of the Balakot strike on Pakistan; the Commission later cleared his remarks. Whatever one’s view of that episode, where a neighbour is a familiar political theme, a login trace pointing across the border is easily absorbed into a story the audience already expects. That’s precisely why attribution discipline matters most where political incentives run strongest.

A responsible state treats a foreign lead as something to verify, not something to publicise. Pakistan’s handling of the American case shows it understands that obligation. The same standard, applied in both directions, is the only one that will actually stop the threats.

Why Cyber Terror Needs a Hotline

States already know how to manage dangerous threats between rivals. They just haven’t applied the lesson online.

For conventional war, India and Pakistan keep a hotline between their directors general of military operations, the channel through which they agreed the ceasefire of May 2025. For nuclear risk, they have exchanged lists of each other’s nuclear installations every January since 1992. For physical terrorism, the world built shared sanctions lists and financial watchdogs. None of these arrangements requires trust. They exist because both sides learned that miscalculation costs more than cooperation.

Digital terror has no equivalent. When a threat arrives from a borrowed account traced to a neighbouring country, there is no agreed number to call, no standard request for account records and no deadline for preserving evidence. So the trace ends up in a press briefing instead of a case file, and political rhetoric fills the space where an investigation should be.

The tools to fix this already exist. The US postal fraud case described above shows how it works between two states: one shares evidence, the other verifies it and acts, and nobody needs a headline. The new UN Convention against Cybercrime, adopted in December 2024, goes further, requiring every state that joins to set up a 24/7 contact point to help locate suspects, preserve evidence and share electronic data in urgent cases.

A working channel between neighbours wouldn’t need to be complicated. It would need named contact points on both sides, a standard format for requesting account and payment data, agreed time limits for preserving logs, and one simple rule: no public attribution until the request has been answered.

Channels only work if there’s capacity behind them. States spend heavily on armies and counter-terrorism forces because they take physical threats seriously. Cyber terror deserves the same: trained investigators, forensic laboratories and agencies with the legal power to act on what they find. Pakistan has begun building that through its cybercrime agency. The region as a whole needs to treat it as a security priority, not a public-relations one.

Beyond the Hoax: Digital Security and Public Trust

The cases in this article point to a shift that’s easy to miss. The danger of a digital threat no longer lies mainly in whether one message is credible. It lies in whether institutions can find its source, respond in proportion and tell the public what they actually know.

That puts responsibility in three places at once.

Platforms. When half a million accounts with two-factor authentication can sit in one criminal database, account security is no longer just a private matter between a user and a provider. It’s a public-safety issue. Gujarat Police’s decision to question Google reflects a fair demand: the companies that issue digital identities need to make them harder to mass-produce and resell.

Authorities. Every evacuation is a reasonable precaution, but every unexplained one wears down trust. Officials have to balance warning the public against amplifying a hoaxer’s reach, a dilemma Canada’s public safety minister described openly during the 2018 wave. Slovakia’s insistence on releasing only confirmed facts made the same point from the other direction.

The press. Reporting that turns a preliminary login trace into a confirmed foreign plot does the threat-maker’s work for them. It spreads the fear, assigns blame the evidence hasn’t earned and makes the eventual truth harder to hear.

A society that reacts to every threat with panic, and to every trace with accusation, hands the advantage to whoever sends the next email. A society that responds calmly and attributes carefully takes that advantage away.

Follow the Evidence, Not the Geography

Locating an account and identifying its operator are different tasks, and the gap between them is where digital threats thrive.

The market in stolen and mass-produced identities exists precisely to widen that gap. It lets one person build the tools, another harvest the accounts, a third resell them and a fourth press send, each in a different country and none of them necessarily the one with a motive. A login trace that ends in Rangpur, Lahore or Dnipro marks one link in that chain. It doesn’t reveal the chain’s owner.

An effective response has to answer four questions in order: who controlled the accounts, who sent the threats, whether the incidents are connected, and whether anyone organised or paid for them. Skip straight to the last question, and investigators risk punishing geography while the operators simply buy new accounts.

The lesson from Europe, North America and now Ahmedabad is the same. In a world where identities can be bought, the most dangerous thing a threat can produce isn’t panic. It’s the wrong answer to the question of who sent it.