Over two years and hundreds of hoax bomb threats to schools later, Delhi Police has cracked just one case, and experts, principals and parents are losing patience with a force that has yet to find an answer.
The latest threats came on Thursday morning, when at least six Delhi schools, including The British School, Mount Carmel, and Ahlcon Public School received emails warning of bombs on their premises. Bomb squads searched the schools after the emails came in around 9am, and the threats were declared a hoax — the same drill Delhi’s schools have been through hundreds of times in two years, with only one hoax perpetrator ever caught.
Experts and parents now want police to stop treating each email as a separate incident and build a system to trace repeat senders, and want schools given a common procedure that ends the routine of full evacuations every time a threat comes in.
To be sure, such problems have existed before 2024 but people aware of the matter say it has ballooned particularly over the last two years. The police finally set up a dedicated cell only in May this year, and have limited their advice to schools to verbal requests for more guards and daily email checks.
{{/usCountry}}To be sure, such problems have existed before 2024 but people aware of the matter say it has ballooned particularly over the last two years. The police finally set up a dedicated cell only in May this year, and have limited their advice to schools to verbal requests for more guards and daily email checks.
{{/usCountry}}“Bomb hoaxes are far from harmless pranks,” said Namita Singhal, principal of Venkateshwar Global School in Rohini. “They require authorities to be called in, and the subsequent security checks and inspections consume several hours of the school day.”
Hard to trace
Officials cite technical and legal obstacles that make senders hard to trace. About 99% of the emails trace to IP addresses outside India, one official said on condition of anonymity, and requests to foreign companies for user details mostly go unanswered.
“The main struggle is the legal procedure of MLAT and LR,” an officer with the Intelligence Fusion and Strategic Operations (IFSO) unit said, referring to requests (under a mutual legal assistance treaty) and letters rogatory sent to foreign countries through the courts.
A Delhi Police investigator on one such case, who asked not to be named, said most senders route their traffic through virtual private networks (VPNs), the Tor anonymity network or proxy servers abroad, and almost never use an Indian internet provider. Even when police trace a VPN address a step further, it can lead to thousands of users with identical traffic.
Cases that went cold
The Russia-linked emails of 2024 show how such cases stall. Threats to more than 250 Delhi schools in April that year came from IDs resembling those used that January, “swarim” and “swareem,” on a Russian domain, and police traced both to the same person, based in Russia, but could not make an arrest.
Foreign companies either say they keep no logs or do not respond because they do not treat a hoax as serious, a second officer said. When details are shared, it takes three to six months, and countries with and without treaties with India have responded alike.
Investigators said a 2022 directive from CERT-In, India’s cybersecurity agency, requiring VPN companies to keep user logs made matters worse, as companies with servers or offices in India shut them and moved abroad.
Email accounts are easy to create, as privacy-focused providers such as Proton and Tuta often skip phone verification. Some threats have come from hacked accounts belonging to real people, police said.
Cracked by luck
Till now, Delhi Police has cracked only one case. In January 2025, south district police zeroed in on a 17-year-old Class 12 student who, investigators said, had sent mass emails, mostly to south Delhi schools, on at least 10 to 12 occasions between July 2024 and January 2025, timed around exams or weekends.
“We were checking for the IP address each time but the sender was using a VPN. There was no way of finding who the sender was,” the investigating officer said.
In early January, a weakness tied to the free VPN the boy was using gave investigators a pool of shared addresses, which they narrowed down to two.
“It also required us to see other factors like the fact that the mails were to south Delhi schools and that they were being sent around exams and weekends ,” the officer said. Investigators finally identified the boy, who lived and studied in south Delhi.
Also Read I Bomb threat emails trigger security checks at schools in Noida and Greater Noida; nothing suspicious found
Elsewhere too, it was only a single slip that worked. In June 2025, Gujarat Police arrested Rene Joshilda, a Chennai-based engineer behind over more than 21 bomb threats across 11 states; she used VPNs and virtual numbers from an app called GetCode, but police said she was traced because she had once logged into her real and fake email accounts from the same device.
Stretched thin
Both breakthroughs depended on mistakes by the senders: a free VPN in one case, a careless login in the other. Police estimate more than half the emails are sent by students, with the rest coming from groups abroad.
“It’s all mischief but people plan and do it,” the officer said.
The cell formed in May has six officials under an assistant commissioner who reports to the deputy commissioner of IFSO, Delhi Police’s cybercrime wing, but it too juggles cases of other nature.
“We can’t have a dedicated team since there are other fraud cases, OTP scams, Chinese app scams, hacking cases and organised scams,” the officer said, adding that IFSO reported about 4,000 cases last year involving losses of ₹850 crore.
Schools left to cope
Nor is there a common procedure that would spare schools a full evacuation and sweep each time. Schools have drawn up their own protocols, and every email, however familiar its wording, still sets off the same response, with children sent home or moved to an open ground and bomb disposal and dog squads searching the premises.
Parents, many of them working professionals, have to leave work to collect their children, while schools arrange buses to take other students home, Singhal said.
Tania Joshi, principal of The Indian School in south Delhi, said the threats have become so frequent that most schools have devised their own methods to keep disruption to a minimum. Her school’s protocol involves informing government authorities and parents promptly and evacuating students safely.
“The entire school community is constantly on alert mode due to the frequency of these threats,” Joshi said. “However, the fear that the ‘cry wolf’ scenario could one day become real continues to persist.”
Rajan Bhagat, a former deputy commissioner of Delhi Police, said the failure cannot be pinned on VPNs or foreign email services alone. The real gap, he said, is that police do not quickly connect evidence across cases, from email headers and account records to intelligence from earlier incidents.
He called for centralised data and immediate preservation of electronic evidence, so that police can identify common infrastructure behind cases that appear unrelated. “Policy must now shift from incident-by-incident investigation to a permanent, intelligence-led bomb-threat attribution system,” Bhagat said.
How others do it
Other countries have mechanisms to limit disruption when obvious hoaxes come in: UK guidance for schools and public venues assumes most bomb threats are hoaxes, and lets those in charge evacuate, move people to safer areas inside, search, or take no visible action. Some US school districts let the principal order a quiet search without dismissing classes if a threat is judged a hoax, keeping police and evacuation for threats that appear genuine.
International cooperation has caught at least one prolific sender: Michael Kadar, a US-Israeli teenager accused of around 2,000 bomb threats worldwide, was arrested in Israel in 2017 after a joint operation by the FBI, Israeli authorities and police in New Zealand, Australia and Europe.
New Zealand police traced one of his first threats to an Israeli IP address, and investigators narrowed it to his apartment in Ashkelon, which was rigged to a large antenna that let him use distant wireless networks.