You are here: Home > Delhi > IM media wing in Mumbai?

Threat mail sent after Jama Masjid attack indicates that

Peerbhoy, then Media Head of Indian Mujahideen, produced at Tees Hazari Court in New Delhi on 28 February 2009. PIC/SUBHASH BAROLIA

Sunday's shooting incident in old Delhi may or may not be the work of the Indian Mujahideen (IM), but the threat mail allegedly sent by the banned terror outfit to sections of the media points towards presence of the group's media wing in the country's financial capital.

The matter first came into focus two years ago with the arrest of Mohammad Mansoor Asgar Peerbhoy, co-founder of the media cell of Indian Mujahideen (IM) along with six others. According to an expert, within these two years, IM has developed a new media wing and the new threat mail is showing its existence in Mumbai again.

The five-page e-mail, sent at 1:37 pm on Sunday, "dedicates" the attack to the "martyrdom" of Mohammed Atif Amin and Mohammad Sajid, two years to the day at Batla House in Delhi.

Titled "As We Bleed, So Will You Seep", it warns against the hosting of the Commonwealth Games, saying the group was preparing for a "great surprise", and warns "Bombayites" of a "fresh bloodbath". Also, for the first time in an e-mail attributed to the IM, the Kashmir problem is talked about at length.

The threat mail consistently refers to 'Bombay', including 'Bombay Police'. Three previous mails sent by the IM had referred to the city as 'Mumbai' all along. The repeated use of the term "idol worshippers" to describe the security forces is another new feature. And unlike earlier e-mails, the latest does not have any pictures.

According to the expert the mail is sent through a data card from Mumbai and police is trying to gather further information. The details furnished by Gmail to the security agency revealed that the account, al.arbi99913@gmail.com, which was used to send the threat mail to a media organisation, was created by a user who has an alternate Rediff account. The police suspect this mail id is fake as well.

"We are suspecting that this email id could be fake. We are in touch with Gmail to get more details. Our investigations are still on and we are in the process of verifying the status of his account," said a senior police officer.

Officials said the account was created at 11.30 am on Sunday while the alleged incident of firing was reported at 11.22 am.
The e-mail to news channels and agencies was sent at 1.30 pm. The account says it will automatically become non-operational on September 26.

The name provided by the person operating the account is 'Veera'. The attack, which was carried out on the second anniversary of Batla House encounter was to avenge the death of two Indian Mujahideen terrorists who were gunned down that day.

The statement from Indian Mujahideen disseminated from email on September 19, is shown as having been signed by someone called Al Arbi the same day. It refers to certain anti-Muslim incidents, which allegedly took place in Ratlam in Madhya Pradesh on the day of Eid (September 11). It also refers to the day when the total number of people allegedly killed by the security forces in Jammu & Kashmir crossed 100 (September 17). This indicates that this message must have been drafted between September 17 and 19.

According to the expert, IM has found a successor to Peerbhoy during these two years as the modus operandi remains the same. Moreover, the fact that the mail leads to Mumbai could be a trap as it's very simple to change the origin of mail by changing the proxy server.

"The statement is in good English with very few grammar or typing mistakes. It has been drafted by someone well versed in the Holy Koran. Earlier we have seen threat mail senders using proxy servers," said a cyber expert.
Previous IM e-mails were traced to Mumbai after which the outfit's media cell in Pune was busted and a software programmer was arrested.

TERROR IN CYBERSPACE
Mohammad Mansoor Asgar Peerbhoy, co-founder of the media cell of Indian Mujahideen (IM), had come up with the idea to hack the WiFi connection of computers.
Mansoor had been interacting with cyber experts from across the globe through emails asking them about the proxy server technology, the police said. An investigator said, "Mansoor had sent emails to several cyber experts and hackers from United States, Europe, and Asia."
The official said that in August 2007, Mansoor had allegedly sent 32 emails to cyber experts across the world. "Mansoor used to surf the internet for hours. He had also received feedback from several computer experts who gave him detailed information on how to hack a WiFi network," he said.

MAIL TRAIL
The mail which claims to be from Indian Mujahideen (IM) was sent using a Tata Indicom connection registered in the name of a woman. But investigations have revealed that the name is fictitious and all the documents are fake.
"The mail has been sent using a data card and a mobile phone and the Internet Protocol (IP) address has been traced to Mumbai, but chances are high that a proxy server was used to make the mail appear to be coming from Mumbai.
"The message by IM was an attached file in a PDF format, which was kept ready to be sent. But it was finally sent at around 2pm. The reason for the delay could be the pressure cooker bomb, which was scheduled to explode at noon. Due to a malfunction the bomb didn't explode and only the car caught fire. This is when the e-mail senders must have sent the mail," said a senior police officer.