India Grapples with Homegrown, Foreign Trained Terrorists

A pair of bombings in Hyderabad late on Thursday left nearly 20 dead and many more injured. Reporting out of India, while remaining careful about attribution, is likening the attacks to tactics previously carried out by Indian Mujahideen (IM). IM is a designated terrorist group by several countries including the United States with suspected ties to Lashkar-e-Taiba (LeT) and ideological links to Al Qaeda. In addition to unfolding details about the attacks, there are also reports emerging that broad intelligence warnings were made several days prior to the bombings.

Analysis of open source reporting on the Indian Mujahideen reveals an extremely active period of arrests and scrutiny during the last three months. It also shows the complexity of the security challenge faced by India in unraveling a network of operatives across several groups including IM, LeT, and the Students Islamic Movement of India (SIMI) as well as the border of neighboring Pakistan. The timeline below shows events related to the IM taking place between December and Wednesday, February 20, one day prior to the attacks.

We’ll call out some of the crucial events that were known during the three months prior to the bombings:

• Dec 27 as reported by the New Indian Express: The Maharashtra Anti Terrorism Squad arrested three more members of Indian Mujahideen related to an August 1 bombing in Pune. Arrested were Sayyed Arif alias Kashif Biyabani, Munib Iqbal Memon, and Farooq Bagwan.
• January 18 as reported by Bhaskar: Delhi police were warned of a possible attack by Indian Mujahideen and Lashkar-e-Taiba in the capital on Republic Day. The holiday passed without incident.
• February 5 as reported by the Indian Express: The National Investigation Agency (NIA) arrested an alleged Indian Mujahideen operative Aftab Alam alias Farooq, who is reportedly an IED expert. He was already being held in Tihar Jail west of New Delhi.

One of the takeaways from this set of events is that Indian security organizations were well aware of threats and actively pursuing leads on known entities within the organization. A particular With an idea of what events related to the Indian Mujahideen preceded the attacks, we also want to sketch out alleged affiliations of the organization’s recognized leadership and head figures including brothers Riyaz Bhatkal (now known to have been briefly held by police in 2008) and Iqbal Bhatkal as well as Abdul Subhan Quereshi and Fasih Mohammad (now under arrest after being deported from Saudi Arabia).

The network of known affiliations to other individuals aside, there are some key points to be noted in considering what was available in the open source before the recent bombings.  During June of 2012, reports allegations emerged that Pakistan’s ISI was protecting the Bhatkal brothers living in Karachi. After the arrest of Fasih Mohammed in October, charges filed by the Special Cell in the court of Chief Metropolitan Magistrate Vidya Prakash reportedly said that Mohammed and “LeT chief Zaki-ur-Rehman alias Lakhvi monitored the 26/11 attacks from a control room set up in Malir in Karachi, Pakistan.” There are also indications that bomb plots to be carried out in Hyderabad were prepared and approved well before the lighter weight August 1 bombing series in Pune based on intelligence gathered from an arrested IM member.

This quick summary of open source information available prior to yesterday’s bombings suggests that attention to key IM operations by Indian security forces may have delayed the attacks in Hyderabad. Still, the inability to ultimately prevent the attacks shows just how challenging a security scenario India faces with operatives interacting across groups (IM, LeT, and the banned SIMI) while receiving training and possibly protection across the border in Pakistan. We’ll go further into these issues during the weeks to come, but for now, we hope these tools from Recorded Future provide support to anyone following the still unfolding details of the tragic events in Hyderabad.