Investigations into the blast near Delhi’s Red Fort on November 10 last year have revealed that highly educated doctors allegedly used a sophisticated network of “ghost” SIM cards and encrypted messaging apps to coordinate with handlers in Pakistan, officials said on Sunday.

The findings of the probe into what investigators describe as a “white-collar” terror module formed the basis for the Department of Telecommunications’ November 28 directive mandating that app-based communication services such as WhatsApp, Telegram and Signal remain continuously linked to an active, physical SIM card within the device.

Officials said the arrested doctors, including Muzammil Ganaie and Adeel Rather, followed a tactical “dual-phone” protocol designed to evade security agencies. Each accused, including Dr Umar-un-Nabi — who was killed while driving the explosives-laden vehicle near the Red Fort — carried two to three mobile handsets.

According to investigators, one “clean” phone was registered in the accused’s own name and used for routine personal and professional communication. A second device, described as the “terror phone”, was used exclusively for WhatsApp and Telegram conversations with Pakistani handlers operating under codenames such as ‘Ukasa’, ‘Faizan’ and ‘Hashmi’.

The SIM cards used in these secondary devices were allegedly issued in the names of unsuspecting civilians, whose Aadhaar details were misused, officials said.

Jammu and Kashmir Police further unearthed a separate racket where SIMs were issued using fake Aadhaar cards, they added.

According to the officials, the security agencies noted a disturbing trend where these compromised SIMs remained active on messaging platforms across the border in Pakistan-occupied Kashmir (PoK) or Pakistan.

By exploiting features that allow messaging apps to run without a physical SIM in the device, the handlers were able to direct the module to learn IED assembly via YouTube and plot "hinterland" attacks, despite the recruits initially wanting to join conflict zones in Syria or Afghanistan.

To plug these security gaps, the Centre has invoked the Telecommunications Act, 2023, and Telecom Cyber Security Rules to "safeguard the integrity of the telecom ecosystem", which includes a rule that within 90 days, all Telecommunication Identifier User Entities (TIUEs) must ensure their apps function only if an active SIM is installed in the device.

The order further directs the telecom operators to automatically log out users from apps like WhatsApp, Telegram and Signal in case of the absence of an active SIM, the officials said, adding that all service providers, including Snapchat, Sharechat and Jiochat, must submit compliance reports to the DoT.

This feature of using apps without a SIM is posing a challenge to telecom cyber security as it is being misused from outside the country to commit cyber frauds and terror activities, the DoT statement had said while explaining the reasoning behind the move.

The directive is being fast-tracked in the Jammu and Kashmir telecom circle. While officials admit it will take time to deactivate all expired or fraudulent SIMs, the move is seen as a critical blow to the digital infrastructure used by terror networks to radicalise and manage "white-collar" operatives.

Failure to comply with these norms will attract stringent action under the Telecom Cyber Security Rules and other applicable laws, the officials said.

The "white-collar" terror module began to unravel on the intervening night of October 18-19, 2025, when posters of the banned Jaish-e-Mohammad (JeM) surfaced on walls just outside Srinagar city. The posters warned of attacks on police and security forces in the valley.

Treating it as a serious matter, Senior Superintendent of Police, Srinagar, G V Sundeep Chakravarthy formed several teams to conduct an in-depth investigation into the case.

After piecing together the statements of the arrested accused, the probe led the Srinagar police to Al Falah University in Haryana's Faridabad, where two doctors -- Ganaie, a resident of Koil in south Kashmir's Pulwama and Shaheen Sayeed from Lucknow -- were arrested. A huge quantity of arms and ammunition, including 2,900 kg of ammonium nitrate, potassium nitrate and sulphur, was also seized.

The car explosion case near the Red Fort claimed 15 lives and is being investigated by the National Investigation Agency.