New Delhi, Dec. 9: Last week, as anti-terror sleuths tried to trace the source of the email owning up to the Mumbai attacks, a Pune engineering student didn’t budge from an Internet café computer for 16 hours.

Eventually, Sohail Quraishi did stop surfing — when police, alerted by the café owner, picked him up.

It didn’t help that the 25-year-old had newspaper clippings of the Taj hotel siege and gave “incoherent” answers. But in the end, Sohail didn’t turn out to be a terrorist.

“In custody, he was unusually calm but in his eyes one could see quick dilations that made him appear more suspicious,” said a sleuth who questioned the youth.

The Maharashtra anti-terror squad and local intelligence units were involved in the interrogation, which was said to have lasted a little more than 24 hours.

During questioning, though, the aeronautical engineering student almost foxed his interrogators for a moment by springing a question most policemen dread having to answer: was he detained because of his religion?

The sleuths didn’t answer his question. “But we told him we are fellow Indians. We stuck to the job and asked him to sing the national anthem,” said a source. Sohail sang.

His mailbox had more than 10,000 emails, which were probed along with the chat-groups of which he was a member. Fortunately, he had not sent any hate mails or clicked away messages to an obscure Pakistan town.

The detention of Sohail, whose family hails from Hyderabad but has been in Pune for four years, reflects another fallout of terror attacks — a rush to brand anyone “suspicious” a terrorist before anything is found.

Public outrage over such detentions is greater when the suspects belong to the minority community.

Questions have been raised, for instance, on whether those killed in September’s Batla House encounter in Delhi were terrorists.

But the sleuths aren’t taking any chances, stepping up cyber vigil after the Indian Mujahideen emails claimed responsibility for the blasts in Ahmedabad and Delhi this year.

In the Mumbai attacks, the investigation is focused on the databases of the Deccan Mujahideen, which sent the email from Karachi through a proxy server in Russia.

An Internet-user can create a proxy server that shows an Internet protocol address — the computer or server where it originated — to mislead the receiver or investigators.

As such cyber crimes increased over the past year, police have started learning the Internet’s ways, along with lawyers and judges who have to deal with such evidence.

The learning sessions appear to be paying off. “Cyber investigators can now find out if mails sent to Pakistan are by terrorists or benign citizens,” said an officer.