Over two years and hundreds of hoax bomb threats to schools later, Delhi Police has cracked just one case, and experts, principals and parents are losing patience with a force that has yet to find an answer.
Also Read I Delta flight bomb threat: Plane arriving from New York evacuated after landing at Tel Aviv airport – what we know so far To be sure, such problems have existed before 2024 but people aware of the matter say it has ballooned particularly over the last two years. About 99% of the emails trace to IP addresses outside India, one official said on condition of anonymity, and requests to foreign companies for user details mostly go unanswered. The Russia-linked emails of 2024 show how such cases stall. Investigators said a 2022 directive from CERT-In, India’s cybersecurity agency, requiring VPN companies to keep user logs made matters worse, as companies with servers or offices in India shut them and moved abroad. In January 2025, south district police zeroed in on a 17-year-old Class 12 student who, investigators said, had sent mass emails, mostly to south Delhi schools, on at least 10 to 12 occasions between July 2024 and January 2025, timed around exams or weekends.
Because they do not treat a hoax as serious, a second officer said, foreign companies either say they keep no logs or do not respond. Because she had once logged into her real and fake email accounts from the same device, in June 2025, Gujarat Police arrested Rene Joshilda, a Chennai-based engineer behind over more than 21 bomb threats across 11 states; she used VPNs and virtual numbers from an app called GetCode, but police said she was traced. Bomb squads searched the schools after the emails came in around 9am, and the threats were declared a hoax — the same drill Delhi’s schools have been through hundreds of times in two years, with only one hoax perpetrator ever caught. Experts and parents now want police to stop treating each email as a separate incident and build a system to trace repeat senders, and want schools given a common procedure that ends the routine of full evacuations every time a threat comes in. The police finally set up a dedicated cell only in May this year, and have limited their advice to schools to verbal requests for more guards and daily email checks. “They require authorities to be called in, and the subsequent security checks and inspections consume several hours of the school day. Officials cite technical and legal obstacles that make senders hard to trace. Even when police trace a VPN address a step further, it can lead to thousands of users with identical traffic. When details are shared, it takes three to six months, and countries with and without treaties with India have responded alike. Email accounts are easy to create, as privacy-focused providers such as Proton and Tuta often skip phone verification. Till now, Delhi Police has cracked only one case. “We were checking for the IP address each time but the sender was using a VPN. In early January, a weakness tied to the free VPN the boy was using gave investigators a pool of shared addresses, which they narrowed down to two. Investigators finally identified the boy, who lived and studied in south Delhi. Also Read I Bomb threat emails trigger security checks at schools in Noida and Greater Noida; nothing suspicious found Elsewhere too, it was only a single slip that worked. Both breakthroughs depended on mistakes by the senders: a free VPN in one case, a careless login in the other. Police estimate more than half the emails are sent by students, with the rest coming from groups abroad. The cell formed in May has six officials under an assistant commissioner who reports to the deputy commissioner of IFSO, Delhi Police’s cybercrime wing, but it too juggles cases of other nature. Nor is there a common procedure that would spare schools a full evacuation and sweep each time. Schools have drawn up their own protocols, and every email, however familiar its wording, still sets off the same response, with children sent home or moved to an open ground and bomb disposal and dog squads searching the premises. Her school’s protocol involves informing government authorities and parents promptly and evacuating students safely. “However, the fear that the ‘cry wolf’ scenario could one day become real continues to persist.
“Bomb hoaxes are far from harmless pranks,” said Namita Singhal, principal of Venkateshwar Global School in Rohini . “The main struggle is the legal procedure of MLAT and LR,” an officer with the Intelligence Fusion and Strategic Operations (IFSO) unit said, referring to requests (under a mutual legal assistance treaty) and letters rogatory sent to foreign countries through the courts. A Delhi Police investigator on one such case, who asked not to be named, said most senders route their traffic through virtual private networks (VPNs), the Tor anonymity network or proxy servers abroad, and almost never use an Indian internet provider. Threats to more than 250 Delhi schools in April that year came from IDs resembling those used that January, “swarim” and “swareem,” on a Russian domain, and police traced both to the same person, based in Russia, but could not make an arrest. Some threats have come from hacked accounts belonging to real people, police said. There was no way of finding who the sender was,” the investigating officer said. “It also required us to see other factors like the fact that the mails were to south Delhi schools and that they were being sent around exams and weekends ,” the officer said. “It’s all mischief but people plan and do it,” the officer said. “We can’t have a dedicated team since there are other fraud cases, OTP scams, Chinese app scams, hacking cases and organised scams,” the officer said, adding that IFSO reported about 4,000 cases last year involving losses of ₹ 850 crore. Parents, many of them working professionals, have to leave work to collect their children, while schools arrange buses to take other students home, Singhal said. Tania Joshi, principal of The Indian School in south Delhi, said the threats have become so frequent that most schools have devised their own methods to keep disruption to a minimum. “The entire school community is constantly on alert mode due to the frequency of these threats,” Joshi said. Rajan Bhagat, a former deputy commissioner of Delhi Police, said the failure cannot be pinned on VPNs or foreign email services alone. The real gap, he said, is that police do not quickly connect evidence across cases, from email headers and account records to intelligence from earlier incidents.
The latest threats came on Thursday morning, when at least six Delhi schools, including The British School, Mount Carmel, and Ahlcon Public School received emails warning of bombs on their premises.
Other countries have mechanisms to limit disruption when obvious hoaxes come in: UK guidance for schools and public venues assumes most bomb threats are hoaxes, and lets those in charge evacuate, move people to safer areas inside, search, or take no visible action. Some US school districts let the principal order a quiet search without dismissing classes if a threat is judged a hoax, keeping police and evacuation for threats that appear genuine. New Zealand police traced one of his first threats to an Israeli IP address, and investigators narrowed it to his apartment in Ashkelon, which was rigged to a large antenna that let him use distant wireless networks.
International cooperation has caught at least one prolific sender: Michael Kadar, a US-Israeli teenager accused of around 2,000 bomb threats worldwide, was arrested in Israel in 2017 after a joint operation by the FBI, Israeli authorities and police in New Zealand, Australia and Europe. He called for centralised data and immediate preservation of electronic evidence, so that police can identify common infrastructure behind cases that appear unrelated.
“Policy must now shift from incident-by-incident investigation to a permanent, intelligence-led bomb-threat attribution system,” Bhagat said.
