Delhi Police seek help from French authorities to trace bomb threat senders

Sanskriti School has received at least 40 threats in the past year, as investigators confront the challenges of tracing anonymous emails.

Delhi Police are seeking help from French authorities under the Mutual Legal Assistance Treaty (MLAT) to ascertain the identity of the senders of multiple bomb threat emails this year, targeting Sanskriti School, after police traced two internet protocol (IP) addresses masked by a virtual private network (VPN) operating in France, officers aware of the investigation said.

Students of Sanskriti School are evacuated on Thursday morning. (Vipin Kumar/HT Photo)

A senior police officer said that a case was registered at Chanakyapuri police station in September based on an email received by the school on September 15 from a Gmail account. The messages contained threatening references to several locations and public infrastructure in Delhi, including schools, metro and train services, courts and police stations. The content also contained references to Khalistan and political figures.

“We have traced the IP addresses used to send the emails to a common VPN service provider, which is operating in France. Since the service is based overseas, we have initiated the process of seeking information through the MLAT route,” the senior police officer, asking not to be named, said.

Police said the school received at least 40 threats in the past year.

The incident is indicative of the difficulties faced by investigators in tracing people bomb threats targeting schools across the Capital. Investigators have now sought assistance from authorities there to obtain further details that could help establish the identity of the sender.

The MLAT (Mutual Legal Assistance Treaty) route is a formal legal mechanism through which one country asks another country for assistance in a criminal investigation. The Union ministry of home affairs (MHA) is the nodal agency and central authority for criminal-investigation-related MLAT requests.

MHA did not respond to requests for comment.

The senior police officer said that after a case was registered on charges of criminal intimidation under Section 351 of the Bharatiya Nyaya Sanhita (BNS), among other sections. “We found that the sender was always found on two IP addresses. They were traced to the same VPN service. The VPN service provider was traced to France,” the officer said.

Police are now relying on international legal cooperation to obtain information that could help them move beyond the VPN addresses and establish the user of the email account. Investigators said such requests are often time-consuming, as foreign service providers and authorities have to be approached through prescribed legal channels.

The investigation also underlines a persistent challenge for Delhi Police, with most bomb threat emails sent to schools in recent years being routed through overseas IP addresses, VPNs or other anonymity services.

Delhi Police have registered at least 120 cases related to bomb threats sent through emails since 2024, most of them targeting schools. The force set up a dedicated cell to investigate such threats only in May this year.

Officials have previously said that nearly 99% of such emails originate from IP addresses outside India, and even when investigators manage to trace an IP address to a VPN provider, it can be shared by thousands of users, making it hard to pinpoint the sender.

The legal process of seeking information from foreign jurisdictions is another major hurdle. Requests under the MLAT mechanism and letters rogatory can take months, while some foreign service providers either do not maintain user logs or fail to respond to law enforcement requests, officials said.

In the Sanskriti School case, investigators said they are hoping that the response from France will provide further leads to identify the person or persons behind the emails.