There are very significant differences between Friday’s bomb blasts in Bangalore and Saturday’s explosions in Ahmedabad. It is likely that they were carried out by different groups, although both probably belong to the many off-shoots set up by former members of the Students Islamic Movement of India (Simi), that too in the last couple of years. There was no email warning for the Bangalore blasts, unlike the 14-page email sent to media organisations just before the Ahmedabad explosions.
There are several puzzling features about the email sent to TV channels. The IP (internet protocol) address was traced to an apartment rented by American nationals in Navi Mumbai. But no one would be so naïve as to send a terror threat from his home computer with an IP address registered with a local ISP (internet service provider), VSNL in this case. Either his IP address was spoofed, which requires the terrorists to possess a certain degree of knowledge about the workings of the internet, or the computer was hacked into, as claimed by the American national. A terrorist would either use a cybercafé in another city (warnings of the earlier blasts in UP and Jaipur were traced to cybercafes in East Delhi and Ghaziabad respectively, but then the trail went cold), or use an insecure WiFi network to ride on someone else’s internet account. Or he would go through ‘Anonymiser’ servers or use a peer-to-peer network such as Tor. It is significant that in another incident, an innocent person had to spend ten months in jail because the ISP provided an incorrect IP address to the police.
But the earlier emails sent by the Indian Mujahideen regarding the May 2008 blasts in Jaipur and the November 2007 explosions in various courts in UP were probably authentic. These included the picture of one of the bicycles used in Jaipur, with the number visible, which was found to be authentic. These emails were sent from cybercafes in Ghaziabad and East Delhi respectively. The throwaway web email accounts used for sending all the warning emails are all very similar — firstname.lastname@example.org, email@example.com, firstname.lastname@example.org, email@example.com.
It is significant that the Indian Mujahideen asked the Lashkar-e-Tayyeba (LeT) not to claim credit for the Ahmedabad explosions. This follows little-known organisations claiming credit for various attacks — Inquilabi Group for the October 29, 2005, attacks in Delhi; Lashkar-e-Qahar for the Mumbai train blasts of July 2006; and Tehriq-e-Qasas for the Akshardham attack in September 2002. Not much is known about these organisations, and it is suspected that they have been set up by former members of Simi. The Lashkar-e-Tayyeba earlier used to claim credit for its suicide attacks, it has stopped doing so after it was proscribed by the Pakistani government. Significantly, the original Lashkar-e-Tayyeba never carried out bomb attacks in civilian areas since its proclaimed philosophy was that it was only against the Indian government and not against the Indian people. So it would only attack Indian troops or Indian government establishments in suicide gun attacks, but would take care not to attack Indian civilians. Attempts to create factions in the LeT caused it to depart from its original doctrine.
Another puzzling factor about the email is that the senders referred to themselves as ‘terrorists’ rather than as ‘freedom fighters’ or ‘liberators’. Moreover, the perpetrators of the Ahmedabad blasts rented the bicycles rather than buying them outright. It would require much more interaction with the bicycle vendors to rent a cycle, leading to greater chances of detection.
The Indian Mujahideen is probably an off-shoot of Simi, set up after several members of the top leadership of Simi were captured in Madhya Pradesh and Karnataka. Since the email referred to the UP and Mumbai blasts but not to the Bangalore ones, it is possible that the Bangalore blasts were carried out by an entirely different organisation, totally unaware of what was going to happen in Ahmedabad. Likely suspects are Al Ummah or Al Badr, or any of the various Kerala groups such as the Islamic Swayamsevak Sangh.
In fact, the Bangalore blasts bear an uncanny resemblance to the 400 small blasts that occurred in 63 of the 64 districts of Bangladesh on August 17, 2005, in that they were intended more to intimidate than to actually kill, with the perpetrators wishing to send a message to the authorities that they can strike anywhere.
Ravi Visvesvaraya Prasad heads a group on C4ISRT (Command, Control, Communications and Computers Intelligence, Surveillance, Reconnaissance and Targeting) in South Asia.