The Fifth Column

ON MARCH 28 LAST YEAR, JYOTI MALHOTRA STOOD OUTSIDE the gate of the Pakistan High Commission in New Delhi, visibly excited. “Embassy dekhiye [see the embassy],” she said, making her way into the high commission’s premises, and onto a lawn where a large dinner party was underway. “I have no words. So excited. Super excited,” she went on.

Malhotra, a social media influencer from Hisar in Haryana, had been invited to an Iftar din­ner at the high commission. At the dinner, a video of which she later uploaded on YouTube, were present many Pakistani officials, individuals presumably belonging to other high com­missions and embassies in the capital, Indians who appeared to have been to Pakistan and were in touch with the high commission, and a few other Indian YouTubers like Malhotra.

Like any content creator invited to an event, Malhotra hustled through the dinner, re­cording short interactions with other guests, surveying the food, and making small talk.

There is one individual, however, whom she interacts with frequently in the video, someone she appears to know from before and often jokes with. This man, whom she re­fers to as Danish and whose official name has been revealed as Ehsan-ur-Rahim, was an official at the high commission who was expelled by India shortly after Operation Sindoor.

India’s Ministry of External Affairs (MEA), in its statement, described him as an official engaging in activities inconsistent with his official status. It is rumoured that he was in fact an Inter-Services Intelligence (ISI) operative. On May 21, another staffer at the high commission—its chargé d’affaires Saad Warraich—was also issued a demarche, allegedly for spying.

Back at the dinner, as Malhotra mingles and makes small talk, and discovers people who had been to Pakistan previously, she ex­presses her wish again and again, in the chirpy and upbeat tone of influencers, of wanting to get a visa to travel to Pakistan too. Some of this appears to be personal. In previous videos, she describes how her grandfather was born and raised in Pakistan before Par­tition. She had been to Pakistan only once before, back in 2022 when she travelled to Kartarpur, using the visa-free corridor that connects Gurdwara Dera Baba Nanak in India with Gurdwara Darbar Sahib in Kartarpur. Now she wanted a visa to enter farther into Pakistan. By the tenor of her conversation, she appears to have tried to get a visa many times earlier and failed.

About two weeks after she uploaded the video of the dinner, she uploaded another video on April 16. She was in Amritsar now and just about to cross the border into Pakistan. She had got a visa for 10 days.

“Give me lots of love in the comments yaar,” she says. “Ek saal ki kadi mashakat ke baadh, finally intezaar khatam hua [After a year of hard work, the wait is finally over.]”

This trip to Pakistan and her familiarity with the suspected ISI operative have now sent her to prison. According to police, Malhotra wasn’t just an influencer but was being groomed as an asset by Danish and other ISI handlers. Danish had, according to the police version, helped her secure a visa (Malhotra travelled to Paki­stan once again earlier this year on a seven-day visa), introduced her to other Pakistani officials there, some of whom she reportedly con­tinued to interact with using encrypted communication platforms like WhatsApp, Telegram and Snapchat after her return home. She also allegedly shared sensitive information with these people.

The authorities say she was on their radar for some time. They are now looking at her foreign travels and how she afforded them. Influencers do get invited on junkets, but a follower count under four lakh on YouTube and a little over one lakh on Instagram was hardly going to get her on the speed dial of travel planners. In one video posted right after the Pahalgam attack, she blamed Indian security agencies for the lapse in vigilance, and the police now claim it could have been part of a disinformation strategy to erode public trust in national institutions. There are even rumours that she was in a relationship with Danish, and that they had travelled on one such holiday together.

Malhotra isn’t the only one. Over the last few days, there has been a string of arrests across Punjab, Haryana and Uttar Pradesh (UP) of people allegedly spying or passing on sensitive informa­tion in the days following Operation Sindoor to Pakistani officials. These include a postgraduate student in Punjab (Devender Singh), a small-time smuggler in UP (Shehzad Wahab), two in­dividuals from Nuh in Haryana (Arman and Mohammad Tarif), a security guard in Panipat, Haryana (Nauman Ilahi), and many others across the three states. Other influencers are apparently also under watch. These individuals, accused of sharing sensi­tive information like photographs of defence establishments and troop movements on WhatsApp and providing logistical support like supplying SIM cards, were allegedly lured by monetary incen­tives and promises to help secure Pakistani visas. Since then it has also emerged that Indian intelligence officers helped arrest a highly trained foreign spy, Ansarul Miya Ansari, who was gather­ing intelligence to conduct a terror strike in Delhi, and an Indian national in Ranchi, Akhlaque Azam, who was providing logistical support. Ansari, originally from Nepal, is believed to have been living in Qatar where he was working as a taxi driver since 2008. He was reportedly lured by an ISI operative and later brainwashed to the cause when he spent around a month in Pakistan. Indian in­telligence had reportedly been shadowing him since he arrived in Delhi, and he was arrested with sensitive documents in February.

These arrests, one of the largest such crackdowns of an alleged spy network in India in recent history, also show just how large and spread out it was. The Indians arrested may not have direct access to classified information but they were allegedly being cultivated and used to provide logistical support and possibly influence public perception.

“This is a very alarming development,” says Shesh Paul Vaid, a former director general of police in Jammu & Kashmir who had often come across espionage attempts in the state during his ten­ure. “The way Pakistani officials, under the cover of diplomatic immunity, resort to espionage. [This case] shows just how they use these young boys and girls, social media influencers to do their bidding. The Pakistan High Commission is known to do a lot of such dirty work.”

THESE SETS OF arrests are not isolated incidents but part of a long history of espionage attempts by foreign agencies, particularly ISI. Over the years, there has been a range of targets, from individuals like researchers and scientists at critical research institutions to those at diplomatic missions, military establishments and India’s intelligence agency, the Research and Analysis Wing (RAW). While India’s counterintelligence capa­bilities are said to have evolved to confront these, so too have the methods of conducting espionage and the luring of targets.

In 2017, Nishant Agrawal, a 20-something engineer at BrahMos Aerospace in Nagpur, received a Facebook friendship request from someone named Sejal Kapoor. According to some accounts, once the two connected on Facebook and began chatting, Agrawal got attracted to her, and they developed a romantic relationship. But other accounts suggest the person posing as Kapoor introduced herself as a recruiter interested in hiring him for an aviation firm in the UK. The two subsequently also got connected on LinkedIn.

What did happen for certain was that his new Facebook friend got Agarwal to install a few new applications on his personal computer. These turned out to be malware that stole classified information that he had stored on his laptop.

No Sejal actually existed. The person behind the account, pos­sibly a male, was an ISI operative who is thought to have managed to hack into the computer systems of—apart from Agarwal—nearly 100 personnel of various defence forces between 2015 and 2018. The modus operandi was usually the same: approach the target online, and use the bait of either a job or a romantic entan­glement to get the target to download malware on their devices.

It was the oldest trick in spycraft—the honeytrap—but re­fashioned for the digital age.

Agarwal’s case represented a new paradigm in espionage tar­geting in India. Unlike past methods, which involved physical relationships between targets and spies, no direct contact was now necessary. Social media had lowered the operational barriers for foreign agencies. ISI could now strategically exploit India’s growing digital footprint and target tech-savvy professionals in sensitive sectors with something as simple as a Facebook friend­ship request. Since the hack was first discovered on Agarwal’s computer in 2018, this method has become particularly thorny for India’s counterintelligence forces.

This became most evident when a senior scientist at India’s Defence Research and Development Organisation (DRDO), who had been involved in many strategically sensitive projects, fell for the charms of an individual who identified as Zara Dasgupta on WhatsApp. Pradeep Kurulkar, about 59 years old when he was targeted, was the director of DRDO’s Research & Development Es­tablishment (Engineers) which handled sensitive projects like the development of strategic assets, ranging from military bridges to ground systems and launchers of almost all the missiles in India’s arsenal. According to some reports, he was a key member of teams that worked on significant projects like Mission Shakti (where the anti-satellite weapon was tested), the Agni-6 missile launcher, etc.

The individual behind Dasgupta posed as a software engineer based in the UK. Lured by voice and video calls and lurid chat mes­sages that went on for almost a year till 2023, Kurulkar divulged many confidential data and secrets.

Kurulkar may have been one of the most senior individuals at the organisation but he turned out to have had very little dis­cretion. He referred to Dasgupta as “babe” (so did she), bragged about himself (“The launcher is my design babe”, when asked about the Agni-6 launcher test), and poured out such excruciat­ing minutiae of his everyday life, from telling Dasgupta about a leopard that had entered the DRDO complex to adding Dasgupta to a WhatsApp group called ‘Happy Morning’—all mentioned in the chargesheet brought out against his name—that the ISI operative behind the account perhaps rolled his or her eyes.

The chargesheet reveals that Kurulkar shared a lot of confiden­tial data related to missile systems, drones and even duty charts of DRDO, apart from contacts of other senior scientists at DRDO and details of the CEO of a private company working with DRDO on certain projects. When his phone was examined, it was also found infected with malware, and one WhatsApp number, saved as Juhi Arora on his phone, had also used an Islamabad IP address.

Juhi Arora, it turned out, had been the name of another such individual who had been seeking confidential details from an Indian Air Force (IAF) official in Bengaluru. This officer, named Nikhil Shende, who was being investigated around the same time as Kurulkar, when made to listen to Dasgupta’s voice notes on Kurulkar’s chats, identified it as the voice belonging to Arora.

Not only were Dasgupta and Arora probably the same per­son, the operative behind the two accounts had tried to bait both Kurulkar and Shende, and possibly many more.

Adrian Levy and Cathy Scott-Clark’s 2021 book on RAW and ISI titled Spy Stories: Inside the Secret World of the RAW and the ISI carries an interesting account of a young Pakistani woman whose online presence is used by ISI to carry out such operations. This woman, a 25-year old academic then, who was looking for work to raise funds to enrol herself at a foreign college, was approached by a government official, telling her she was a good fit for a govern­ment job provided she had the “strength of character”.

The job description seemed sketchy but she took it up. It in­volved browsing profiles online for visiting academics and busi­nessmen, then creating a LinkedIn profile under her name and photograph, after which she was to contact executives and offi­cials for a job. Since she was well-educated and presented herself immaculately, there were often multiple responses, all of which she was instructed to help move to WhatsApp.

That was the extent of her role. Someone else would take over on WhatsApp and she was instructed not to tell anyone about her job.

Later however, when she logged into her WhatsApp account out of curiosity, she was shocked. “Her avatar had sent provocative messages which became flirtatious, the posts including attach­ments of movie clips and images—shots of a shoulder, a breast and then a thigh, purportedly filmed by her,” the authors write in the book. “These elicited a flurry of provocative and then explicit videos from her correspondent.” The woman deleted the account and was asked to leave the following day.

SEX OF COURSE is the old playbook of spycraft and ISI has always understood its use. Levy and Scott-Clark write how ISI operatives went after lonely Indian Army officers at staff college who, after an exchange of photographs, were blackmailed. “The honeytrap evolved, operating in cyberspace often, spawning provocative and enthralling female and male avatars, who fished for gay and straight, male and female, Indian engineers, defence contractors, scientists, and diplomats, enticing them into private, intimate chats, which became eroticised and escalated,” they write.

What they were also good at was in identifying vulnerabilities. Jyoti Malhotra, if indeed was being groomed to be a spy, was some­one who came from a modest background, but who wanted to do better. Born and raised in the Tier 2 city of Hisar, the glamorous capital of the country just a few hours’ drive away, Malhotra took up a variety of jobs once she completed her Class 12. She is said to have worked as a schoolteacher, a receptionist at a coaching centre, and later at a private office in Hisar. But after she lost her job during the pandemic, she turned to social media.

A decade-and-a-half before her, an Indian diplomat serving in the High Commission in Pakistan is believed to have been smit­ten with an ISI operative and passed on secrets. This diplomat, Madhuri Gupta, a single woman in her 50s then who was serv­ing as Second Secretary (Press & Information) in Islamabad, is reported to have become besotted with an ISI operative, identified as Jamshed, a much younger man in his 30s. She was eventually convicted and died a few years ago. While the use of honeytraps by Islamabad may not have been new, what set Gupta’s case apart was that it was a woman who had been trapped.

Men have been trapped many times before. The most infamous of these cases involved KV Unnikrishnan, a senior RAW officer in the 1980s. Having served successfully in Sri Lanka, he was promoted and transferred to Chennai, where he was running a highly sensi­tive portfolio covertly assisting Tamils in Sri Lanka, including the Liberation Tigers of Tamil Eelam (LTTE).

But there had always been a whiff of controversy about his career. It was rumoured that he had had an affair with a female US consular official, a woman suspected to be a CIA spy, when he was posted in Colombo. Later, when he was in Chennai, an American air hostess working for Pan Am out of Singapore began contacting him, and even sent him an air ticket to join her in the island city. Levy and Scott-Clark’s book quote a former RAW officer who worked with Unnikrishnan, who describes how his absences became more frequent and how suddenly RAW’s Sri Lanka desk began to flail, with Colombo appearing to know a lot of highly sensitive details about Indian operations. “His long-distance love affair [with the air hostess] had blown hot and cold, Monisha [the former RAW officer quoted in the book] learned. And finally, after a few months, a CIA case officer was waiting for him in Singapore in place of the Pan Am hostess. Confronting him with photos, the agency had suggested a trade. Unnikrishnan had, Monisha recalled, taken the deal and over the next two years handed over to the CIA some of India’s most secret and sensitive intelligence,” Levy and Scott-Clark write.

The CIA certainly has had a large role to play in the subconti­nent. In more recent years, it has pumped money into Pakistan during its war on terror while shoplifting what it needed from India’s classified resources, even when Washington and New Delhi were getting closer. Foreign agencies like CIA and oth­ers often used hard cash to flip government officials in India. The most famous of these was the discovery of spies located in some of the highest offices in the country—including in the Prime Minister’s Office (PMO) and the defence ministry—who were selling classified documents and state secrets to a lobbyist, Coomar Narain, through the 1970s and 1980s, who in turn passed it on to interested parties in France which is said to have used it to secure multi-billion-dollar defence contracts from India, the Soviet Union’s KGB, Poland, East Germany, and possibly many others. This went on till 1985 when it was finally discovered.

What had flipped these individuals, placed in such high offices in India, had been cash. And it appeared to be cash again, along with a rumoured honeytrap when Rabinder Singh, a senior official in RAW, was pressing a bit too hard on RAW’s Science and Technology desk to learn what the agency thought about Saddam Hussain’s Weapons of Mass Destruction (WMD) programme.

Singh was however always two steps ahead of his colleagues at the department. And when they finally showed up at his resi­dence, they found that he, along with his wife, had fled to Nepal where under new names and passports the couple had been flown to the US. Singh had turned out to be a CIA mole and it is believed that he had been sharing secrets long before he was unmasked.

It was not the first time a spy was discovered in India. And as the recent spate of arrests shows, it is unlikely to be the last time either.

aka Danishdigital ageEhsan-ur-RahimISI spy networkJyoti MalhotraOperation SindoorPakistan spysocial media influencers