50 threat emails, 500 schools: What’s been keeping Delhi Police’s bomb squads on alert 24*7 for two years

The BDT and BDS teams – comprising a total 430 personnel of ranks from Constable to Inspector – have been unusually busy since the summer of 2024, when schools in Delhi and several NCR cities began to frequently receive emails threatening bomb attacks.

All the threats so far have turned out to be hoaxes – but there is never the slightest scope for police to take any threat lightly. “We remain on standby 24 hours,” one of the men in the room said.

“Earlier, some days would be lean, but now our workload has gone up significantly due to the bomb threats that schools have been receiving,” the other official said.

Coordinated response

Once a call comes in through the local PCR unit, a BDS team is deployed along with the Dog Squad and the Bomb Detection Team (BDT). “All three units work together,” a BDT officer said.

Multiple schools have been receiving threat emails or calls at the same time. Every school is evacuated and checked. The Dog Squad and BDT enter first, and the BDS is called in subsequently, if required. As the premises are swept, the local police maintain law and order, and personnel of the Delhi Fire Services and the National Disaster Response Force (NDRF) stand by.

“We check every suspected corner,” the BDT officer said. The call is declared a hoax only after a thorough search.

Over the past two years, more than 50 threat emails, coming from different email IDs, have been received by more than 500 schools in Delhi. Some threats have also been directed at hospitals, airports, airline companies, courts, prisons, and secretariats.

Almost every major school, both government and private, has been threatened at least once – and more than 100 schools have received bomb threats more than a dozen times in the past six months.

A senior Delhi Police official said school administrations have started to follow Standard Operating Procedures (SOPs) prescribed by the government for such situations.

“One of the key guidelines is to avoid creating panic whenever such calls are received. Teachers and principals evacuate the premises calmly without creating chaos,” the officer said.

It started in May 2024

In the first week of May 2024, around 200 schools received a strange and sinister email from the address sawariim@mail.ru: “Kill them wherever you meet them and drive them out from the places from which they drove you,” it said. “There are many explosive devices in the school.”

The police were taken aback – never before had such a threat been issued to so many schools at the same time. Investigators noted that the Arabic word ‘Sawarim’ was popular with Islamist terrorists – the Islamic State (ISIS) had used “Salil al-Sawarim” as a propaganda chant in its videos over the years.

Since the domain mail.ru, used for sending the threat, is Russian, police wrote to the Interpol’s National Central Bureau (NCB) in Moscow, seeking help to track down the senders of the email. But they seemed to have used a virtual private network (VPN), and the probe has gone nowhere.

The threats – mostly through emails sent in bulk – continued. In June, August, October, and November of 2024, schools – but also some colleges, hospitals, airlines, and government institutions – received emails.

Schools continued to receive threats through 2025. More than 35 emails were received from different IDs, and police were unable to trace their origins.

The most recent bomb threat was received on February 23 from the address krishtalburnette93@gmail.com by Army schools, the Delhi Secretariat, the Assembly, and the Speaker’s office. The senders announced “Delhi banega Khalistan”, and that there would be explosions over the next three days, officers said.

A difficult investigation

A senior police officer said many of the emails were sent using VPNs, Tor networks, or proxy servers, mostly based abroad. IP addresses were often encrypted.

“In recent months, the domains used in the emails have been traced to European countries. However, accessing the IP addresses or other sender details has been nearly impossible as they were encrypted and masked using VPNs or proxy servers,” the officer said.

Cyber expert Shashank Shekhar, co-founder of thinktank FCRF, said that in many cases, layered anonymity techniques were employed. A sender can route communications through multiple VPN servers, temporary email services, and compromised infrastructure across different countries, which makes attribution extremely complex, Shekhar said.

“Even when investigators trace a digital trail, it often leads to jurisdictions outside India, where cooperation from service providers or foreign agencies can take time. Another factor is that threat actors are increasingly aware of investigative methods and deliberately use disposable accounts and short-lived digital identities,” he said.

As a result, agencies must rely on a combination of digital forensics, behavioural analysis, and international coordination, which slows down the investigations and make them more difficult, Shekhar added.

A few have been pranks

Since all the emails received over the past 22 months have turned out to be hoaxes, police believe their senders may be mischief-makers. But at the same time, they cannot afford to take any threat lightly, police officers said.

The mischief theory is substantiated by the breakthroughs in a few cases – both in the past couple of years and earlier – in which schoolchildren, using VPNs, were found to have sent the threat emails.

These students told police they had hoped to get exams cancelled, get the day off, or sent the emails simply as a prank. In each case, they were let off after counselling.

In January 2025, the South district police said they had identified a student who had allegedly sent threats to more than 100 schools on multiple occasions, and had been caught after he neglected to use a VPN the last time. He told police he sent the emails for “fun”.

In July 2025, a 12-year-old boy was found to have sent threats to two educational institutions, police said.

A student of Class 8, who too was caught because he had not used a VPN, told counsellors that he had sent the threat randomly to many schools because he wanted them all to close.

Ceaseless vigil

In November 2024, the Delhi High Court directed the Delhi government and Delhi Police to clearly outline the roles and responsibilities of all stakeholders, including law enforcement agencies, school managements, and municipal authorities to ensure seamless coordination and implementation in dealing with such threats.

The Delhi Police informed the court that there were only five BDSes and 18 BDTs for more than 4,600 schools in the national capital. The strength of both units is now being augmented, and Dog Squad is getting more ‘K9s’ or police dogs and handlers, officials said.

“Delhi is always on alert. These BDS, BDT, and Dog Squad are also deployed for VVIP movements and to check venues. We take crash courses with central agencies from time to time so that these units can work with updated technologies,” an official said.