Delhi Blast Accused Doctors Used Encrypted ‘Session’ App to Talk to Turkey-Based Handler

Officials probing the Delhi Blast say the suspects relied on the privacy-focused Session app to avoid digital surveillance.

Investigations into the recent blast near Red Fort in Delhi have revealed that the accused doctors involved in the suspected terror plot were using the encrypted messaging application Session to communicate with their foreign handler. According to officials, the app’s privacy-focused features, which do not require a mobile number for registration and store no chat metadata, have made it extremely difficult for investigators to trace their communication or identify the users involved.

White-collar terror module exposed

The Delhi Police and central intelligence agencies have uncovered what they call a “white-collar terror module” consisting of highly educated professionals, including Dr Umar Un Nabi and Dr Muzammil Shakeel, both medical practitioners. Investigators allege that they were part of a radicalised group linked to the Pakistan-based terror outfit Jaish-e-Mohammed (JeM). The two doctors are believed to have played crucial roles in planning the car explosion that took place near Red Fort Metro Station on November 10, now being treated as a terror incident.

Officials have recovered explosives, communication records, and travel documents that connect the group to operatives abroad. It has also been found that the accused doctors travelled to Turkey in March 2022 and stayed in Ankara for about two weeks. This trip is believed to have been a turning point in establishing their connections with foreign handlers.

Handler ‘Ukasa’ directed module from Ankara

Investigators have identified a foreign handler using the codename “Ukasa,” who is suspected to be operating from Ankara, Turkey. The name Ukasa translates to “spider” in Arabic, symbolising how he managed multiple covert cells. Officials say Ukasa provided the accused with detailed instructions on setting up secret communication channels, avoiding surveillance, and conducting reconnaissance in potential target areas.

Initially, the accused communicated with the handler on WhatsApp using a Turkish virtual number. Later, they were instructed to shift their conversations to the Session app to ensure complete anonymity and avoid tracking by Indian agencies.

Also Read: Google Nano Banana 2 Launch Expected Soon, Offering 4K AI Images and Lightning-Fast Editing Tools

Session app’s features make tracking nearly impossible

The Session app has become a focus of attention because of its unique privacy features. Unlike other encrypted apps, Session does not ask for a phone number or email address for registration. It stores no metadata such as timestamps, contact lists, or message logs. The app also uses decentralised servers to route traffic through multiple points, effectively hiding the user’s real location.

These privacy measures have made it almost impossible for investigators to retrieve data or trace communication. According to officials, the accused deliberately shifted to Session to escape intelligence monitoring and make their digital trail untraceable.

Digital trail and reconstruction efforts

Even with such hurdles, investigators have managed to piece together parts of the network using other forms of evidence. Mobile dump data, tower location records, travel history, and vehicle registration details are helping authorities reconstruct the timeline of events.

Officials believe that the accused had conducted detailed surveillance of key locations, including Red Fort, before the blast. They suspect that the module was planning multiple vehicle-borne improvised explosive device (IED) attacks around significant national dates, such as Republic Day on January 26. The forensic analysis of mobile data has helped establish how the accused coordinated with their handlers overseas and planned the attack sequence.

Radicalisation and recruitment

The Delhi blast investigation has drawn attention to the growing threat of educated professionals being radicalised into extremist ideologies. According to officials, doctors, engineers, and teachers are increasingly being targeted online and manipulated through ideological indoctrination. These individuals are then offered roles that use their professional skills for logistical or technical support to terror organisations.

In this case, intelligence sources suggest that Dr Umar and Dr Muzammil were exposed to radical elements during their stay abroad. They were later instructed to recruit more individuals in India and help build covert networks for carrying out attacks.

Delhi Blast Continuing investigation

The investigation is still underway to establish the full financial, logistical, and organisational links between the accused doctors, their Turkey-based handler, and Jaish-e-Mohammed’s network. It is not yet known if any data can be recovered from Session’s encrypted system, which is designed to leave no digital footprint.

Authorities are also examining whether the group used other encrypted platforms such as Telegram or Signal in combination with Session to coordinate funding or communication. The focus remains on identifying all members of the module, tracing their funding sources, and preventing any follow-up attacks.

A challenge for global counterterrorism efforts

The use of highly secure and anonymous communication platforms like Session has become a growing concern for counterterrorism agencies worldwide. While these apps are built to protect privacy and security for ordinary users, their misuse by extremist groups creates serious national security challenges.

Officials emphasise that this case highlights the need for updated digital investigation frameworks, stronger cyber-intelligence tools, and international cooperation. The Delhi blast probe has shown how modern terror networks are evolving beyond traditional surveillance systems, relying on anonymous communication to plan and execute attacks without leaving a trace.