Why IM sent Varanasi terror mail from Mumbai

The e-mail sent out by terror group Indian Mujahideen claiming responsibility for Tuesday's Varanasi blast, which killed an infant and injured 32 people, was traced back to Navi Mumbai. The e-mail shot to media houses minutes after the blast has got both the investigators as well as intelligence agencies thinking. Why do IM operatives continue to hack Mumbai servers to shoot terror mails? Has the IM re-established a strong technical cell in the city?   

Looking back at the last few terror attacks for which the IM has claimed responsibility, it has come to the fore that most mails have been sent from Mumbai based-servers. 

In July 2008, the IM sent a mail before the Ahmedabad blasts, which was traced to a flat in Navi Mumbai. Another mail on the probe of the blasts sent a month later was traced to Khalsa College in Matunga.

In September 2008, IM's mail claiming responsibility for the Delhi blasts came from Chembur. In fact, the e-mail by the terror group as recently as September after the Jama Masjid firing incident in Delhi was also traced back to Mumbai.    

And the story is no different as far as Tuesday's blast goes. Indian intelligence agencies are now looking into what they call an interesting trend and are investigating the matter.

Initially, e-mails were being sent out from Mumbai since the IM had set up its tech module in Mumbai under the leadership of Mansoor Peerbhoy, who held a senior position in Yahoo and was arrested in September 2008 by the Mumbai police for sending terror mails on behalf of the IM. This arrest was considered as a crackdown on IM's tech cell.

However, two years on, the IM continue to hack servers in Mumbai with the sole intention of playing hide and seek with the Mumbai police who according to them were the primary force to decimate their organisation, say sources.

This was quite clear from the e-mail sent in the aftermath of the Jama Masjid firing, which took a dig at the Mumbai police, especially Anti-Terrorism Squad chief Rakesh Maria. The mail went on to say that the Mumbai police need not feel happy that they had broken up their organisation and that the IM has not lost its core strength and were capable of striking any time. But sources points out that these mails are like an open challenge to the Mumbai police with an underlying message -- Catch us if you can.

When the IM started its terror operations it decided to set up a technical cell since it was aware that the police in India were light years away when it came to cracking technology. They were aware that if they sent out mails after every attack, the police would try and chase the mails, which gave the operatives sufficient time to give the law enforcers the slip.

This task was assigned to Abdul Subhan, the techie jihadi from Mumbai and Peerbhoy, say sources in the Intelligence Bureau. 

One of the first ideas devised by the duo was to set up IM's technical cell and use WiFi networks, which were not secure to send out terror mails. But the catch was never to set up base in a particular city and send mails.

This is when Peerbhoy played a crucial role. The Pune-based techie mastered how to hack WiFi networks from anywhere in the country using internet protocol addresses and bounce mails from those servers.            

The IB says that today most IM operatives including the low-ranking ones can hack servers. During the initial part of their operations they sent out mails from Mumbai, but today they are able to shoot mails using servers in Mumbai sitting in any other city in India.

Sending mails from servers in Mumbai does not necessarily indicate that their tech cell is as strong as it was two years back. This is just a challenge to the Mumbai police that was responsible for cracking down on this cell earlier, according to the IB. 

In addition to Mumbai, the IM had also set up a technical cell in Thane. This was in fact revealed by Abdul Bashir, who was arrested in connection with the Gujarat blasts. This particular cell was headed by Toufiq Bilal, a techie who looks into technical operations for the banned Students Islamic Movement of India. 

The IB says that they now need to investigate the working of this cell as well, since it was not active at the time of SIMI's Operation BAD, decoded by the intelligence as Bangalore, Ahmedabad and New Delhi, in 2008. But there is a possibility that it is revamped now to send out the mails, they feel.