3 Arrested as Pakistan's SBN Network Uses Encrypted Comms for Espionage in Assam

For defense technology stakeholders, the recent Assam arrests highlight how hostile intelligence actors are weaponizing commercial encryption to run espionage networks below the radar. The Shahzad Bhatti Network's reliance on encrypted messaging platforms to coordinate with Pakistan's ISI demonstrates an asymmetric threat that demands advanced SIGINT solutions and robust cyber-intelligence integration. As Indian security forces dismantle such cells, the need for scalable decryption tools and AI-driven network analysis has never been more urgent.

In a significant intelligence-led operation, Assam’s Special Task Force (STF) along with district police arrested three individuals on July 26, 2026, for their alleged links to the Pakistan-based Shahzad Bhatti Network (SBN), which reportedly operates under the direction of the Inter-Services Intelligence (ISI). The operation, carried out across Dhubri, Chirang, and Barpeta districts, underscores the persistent threat posed by cross-border espionage and radicalisation networks that exploit encrypted communication channels to evade detection. Chief Minister Himanta Biswa Sarma confirmed the arrests via social media, detailing that the detained operatives—Akramul Islam (26), Aminur Rahman (22), and Abdul Hussain (54)—were part of a larger network involved in recruitment, online radicalisation, logistics, reconnaissance, and the establishment of sleeper cells. The seizure of mobile phones, SIM cards, Aadhaar cards, debit cards, and bank passbooks indicates a sophisticated logistical apparatus that blends physical and digital tools to sustain covert operations.

The Shahzad Bhatti Network is not a new name in Indian counter-terrorism circles; it has been previously linked to espionage, arms procurement, and facilitation of terrorist activities across the country. According to official intelligence inputs forming part of STF P.S. Case No. 06/2026, SBN coordinates with ISI handlers via encrypted platforms, making it a model case for the intersection of terrorism and cyber-enabled covert operations. This arrests highlight how hostile intelligence agencies are increasingly leveraging low-cost, high-impact digital infrastructure—encrypted messaging apps, anonymised SIM cards, and digital finance tools—to run networks that are difficult to penetrate without advanced signals intelligence (SIGINT) and human intelligence (HUMINT) capabilities.

For the defense and security community, the operation offers a glimpse into the evolving threat landscape in South Asia. Pakistan’s ISI continues to rely on proxy networks that operate beneath the threshold of conventional conflict, using asymmetric methods that test the limits of border security and domestic surveillance. The use of encrypted communication not only complicates real-time monitoring but also necessitates investment in decryption technologies, AI-driven pattern recognition, and cross-agency data sharing. The Assam STF’s success was predicated on precise intelligence that likely involved a mix of digital forensics and human informants, underscoring the importance of integrating technical and traditional intelligence-gathering methods.

The geopolitical context adds another layer: India-Pakistan tensions have historically manifested through such covert channels, and the arrest of ISI-linked operatives on Indian soil is a recurring narrative. This incident, while localised in Assam, resonates nationally because it reaffirms the vulnerability of even distant states to international terror networks. The material seized—Aadhaar cards and debit cards—points to the misuse of domestic identification and financial systems, which could compromise internal security if not monitored. This raises questions about the robustness of Know Your Customer (KYC) norms and the traceability of prepaid SIM cards, both areas where regulation and technology need to evolve.