(Image source from: Canva.com)

Since the Pahalgam terror attack and India's response through Operation Sindoor, Indian counterintelligence agencies have heightened their vigilance. In the last month alone, authorities have detained or arrested around 15 individuals across several states, including Rajasthan, Maharashtra, Delhi, Haryana, Uttar Pradesh, Gujarat, and Punjab. Among those apprehended is an engineer from Mumbai, who created blueprints for warships after being lured into a honeytrap on Facebook, a travel vlogger from Haryana who was escorted by armed men in the markets of Lahore, a government worker in Rajasthan with numerous unexplained trips to Pakistan, and a SIM card provider in Deeg who was relaying information to handlers from Pakistan's Inter-Services Intelligence (ISI). Each case, while separate, underscores a broader network engaged in the transfer of sensitive information to Pakistan.

Moti Ram Jat was not a senior official, yet his access to critical operational data within the Central Reserve Police Force made him an attractive target for exploitation by Pakistani operatives. The National Investigation Agency (NIA) reports that Jat had been in touch with Pakistan Intelligence Officers (PIOs) since 2023, relaying confidential information in return for financial compensation. He was apprehended in Delhi this month after his social media activities raised concerns. The CRPF publicly acknowledged that Jat was terminated after violating established protocols. He remains in the custody of the NIA until June 6, as investigations continue to ascertain the specifics of the information he provided to India's nuclear-capable neighbor.

In Maharashtra, the Anti-Terrorism Squad (ATS) arrested 27-year-old mechanical engineer Ravindra Verma, who worked for a defence technology firm in Mumbai. Verma had access to the Naval Dockyard in South Mumbai and was involved in submarine and warship-related projects. His arrest stemmed from forensic evidence that connected him to Facebook accounts under the aliases "Payal Sharma" and "Ispreet." Authorities believe these accounts were operated by Pakistani agents who ensnared Verma in a honeytrap. He reportedly started sharing intricate sketches, diagrams, and audio files regarding naval assets for payments made through both Indian and international banking channels. The police assert that Verma was not just a victim but willingly and repeatedly disclosed classified information. Although phones were banned within the Naval Dockyard, he would draw from memory and later send images. The ATS suspects he also provided information about ship names and docking schedules. He had been in contact with the Pakistani agent since November 2024 and is now in custody.

One of the most prominent cases that has captured public attention is that of travel vlogger Jyoti Malhotra, known for her well-followed YouTube channel. She was arrested by Haryana Police in mid-May due to her suspected connections with ISI agents. Investigators claim that Malhotra maintained direct and consistent communication with individuals affiliated with the Pakistan High Commission in Delhi, as well as during her trips to Pakistan, at least two of which were verified through travel logs. Reports indicate that she had interactions with Pakistani intelligence officials identified as Danish, Ahsan, and Shahid. A forensic analysis of her confiscated mobile devices and laptops uncovered over 12 terabytes of data, which included communications that officials assert demonstrate her knowledge of these agents' ties to the ISI.

Malhotra, despite facing criticism for excessive spending and numerous international trips—including to Pakistan and China—continued her exchanges with suspected handlers. A particularly striking moment was captured in a video by Scottish YouTuber Callum Mill, where she was seen walking through Lahore's Anarkali Bazaar flanked by six men armed with AK-47 rifles. She has been charged under the Official Secrets Act and related sections of the Bharatiya Nyaya Sanhita, with her trial set to commence in June.

In another development, a 28-year-old healthcare professional from Gujarat was apprehended for leaking sensitive information regarding Indian military infrastructure to a Pakistani agent. On Saturday, officials from the Gujarat Anti-Terrorism Squad (ATS) disclosed that Sahdev Singh Gohil, who resides in the border district of Kachchh, was arrested earlier this month for allegedly sharing classified images and videos of newly built Indian Air Force (IAF) and Border Security Force (BSF) facilities with a foreign operative. Senior ATS officer K Siddharth stated that Gohil had made contact in 2023 with an individual posing as Aditi Bharadwaj through WhatsApp. Investigators now suspect that Bharadwaj was a false identity created by an operative from Pakistani intelligence. ATS sources reveal that their correspondence escalated into a sharing of visuals and information focused on Indian military establishments near the border.

Authorities have reported that Gohil acquired a new SIM card that was registered using his Aadhaar details in early 2025, through which he activated a WhatsApp account for the supposed handler using a one-time-password (OTP) method for authentication. Officials believe this channel was later employed to send sensitive information about military developments in the region. Additionally, the ATS indicated that Gohil received a cash payment of Rs 40,000 from an unknown source. Meanwhile, recent arrests in Haryana suggest a systematic recruitment initiative by the ISI aimed at economically disadvantaged young men.

Davender Singh Dhillon, a 25-year-old studying political science in Patiala, was taken into custody after he posted images of guns online. The investigation uncovered that in November 2024, he had traveled to Pakistan and leaked sensitive photos of military sites. A 24-year-old security guard named Nauman Ilahi was apprehended in Panipat for allegedly relaying information to ISI agents through his brother-in-law's bank account. Officials confirmed that there were cross-border transactions involved. Meanwhile, two individuals from the Nuh district in Haryana, Arman, aged 23, and Tarif, were arrested days apart. The police caught Tarif attempting to erase conversations with Pakistani contacts when they arrived at his home.

In a related incident, Shakur Khan, a 49-year-old employee of the Rajasthan government from Jaisalmer, was arrested on charges of espionage. He had previously worked as a personal assistant to Shale Mohammad, a former Rajasthan minister from the Congress party during Chief Minister Ashok Gehlot's administration. Both Khan and Mohammad hail from villages located just 8 kilometers apart. Mohammad, who has served two terms in the legislature and held cabinet positions, has participated in four state elections and is associated with the 'Pir Pagara' title, which belongs to the leader of the Muslim Sufi order of Hurs in Sindh, Pakistan. Khan's history includes at least seven trips to Pakistan, and his digital activities revealed deleted files along with questionable transactions, prompting further investigation by central agencies.

In a different case, the Delhi Police detained Kasim, a 34-year-old from Deeg in Rajasthan, for allegedly providing Indian mobile SIM cards to Persons of Indian Origin (PIOs). Between August 2024 and March 2025, he made two trips to Pakistan, where he stayed for lengthy durations. The police stated that Kasim played a role in the unlawful export of Indian SIM cards, which were subsequently utilized by ISI agents to contact Indians and gather military intelligence. He confessed to erasing sensitive information after the Pahalgam attack out of fear of being discovered amid a wave of national arrests. Nevertheless, forensic experts are analyzing his devices and studying call records to identify his network. Additionally, an individual from Thane was arrested in Mumbai for sharing sensitive information through Facebook and WhatsApp between November 2024 and March 2025.

In Uttar Pradesh, a businessman named Shahzad from Rampur was captured by the Special Task Force in Moradabad. Reports indicate that he exchanged intelligence with handlers during several trips to Pakistan and was involved in smuggling consumer goods. In Jalandhar, Mohammad Murtaza Ali was arrested for allegedly using a mobile application he created to relay sensitive information to ISI operatives. Authorities confiscated four mobile phones and three SIM cards from his home. Besides these verified cases, police and intelligence agencies are currently looking into two other suspects from Punjab, Gazala and Yamin Mohammad, for similar activities. Officials believe both individuals were in contact with foreign agents and are likely involved in disseminating sensitive information.

The counter-intelligence efforts in India have undergone significant changes after the implementation of Operation Sindoor. This operation was launched in response to the tragic Pahalgam attack that resulted in the deaths of 26 individuals. It involved India targeting terrorist training facilities located in Pakistan and Pakistan-Occupied Kashmir. Following this, Pakistan carried out retaliatory actions through drones and missiles, which were largely countered by Indian defensive measures. Since that time, monitoring activities in border regions and strategic areas have ramped up. As reported by law enforcement in Rajasthan, seven individuals considered suspects have been interrogated in Jaisalmer over the past month. Meanwhile, in Haryana, officials have started examining the financial documents and travel backgrounds of people working in at-risk occupations.