Amid a series of hoax bomb threats and ongoing youth-led protests demanding the resignation of the Chief Election Commissioner over alleged voter list manipulation, Delhi Police’s cyber commandos are working round the clock to trace digital footprints, identify misleading social media content and help investigators unravel complex cybercrime cases. From examining email records and Virtual Private Networks (VPNs) to tracing cryptocurrency transactions in digital arrest scams, the specialised personnel use technical expertise to turn digital clues into investigative leads.

In an exclusive interaction with The Hindu, cyber commando Akhil Raj, who works with the Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) unit, explained how the team tracks suspects, investigates online fraud and flags manipulated videos circulating on social media.

Mr. Raj, who was involved in investigations into hoax bomb threats received in Delhi in 2024 and 2025, said investigators approach email service providers for information such as IP addresses, registered contact numbers, and alternate email IDs. They routinely seek records spanning six months to a year to establish a sender’s online activity.

The process becomes more difficult when suspects use Virtual Private Networks (VPNs) or the Onion Router (Tor) network to conceal their digital footprints. However, in some cases involving free VPN services, a temporary break in the connection can expose the actual IP address, allowing investigators to approach internet service providers for further details.

Of the more than 20 bomb threat cases he has investigated, the police traced the senders in four to five instances, Mr. Raj said. These included three cases in which school students used VPN connections to send hoax emails in an attempt to postpone examinations.

With protests continuing in the Capital, cyber commandos are also monitoring social media for triggering and misleading posts, reels and videos. The surveillance load has mounted with Maharashtra cyber officials identifying over 400 instances of digital misuse, including 140 Artificial Intelligence (AI)-generated items linked to the Cockroach Janta Party (CJP) agitations. The team constantly tracks keywords to identify potentially manipulated content.

Once a video is flagged, the police send takedown requests to social media platforms such as X and Meta. Recalling a recent case involving an AI-generated video of Delhi Police Assistant Commissioner of Police (ACP) Vivek Bhagat, Mr. Raj said the police identified the video and initiated legal action.

Earlier this month, a 24-year-old ‘independent’ journalist was arrested from Haryana’s Palwal for allegedly circulating the deepfake that ‘falsely’ portrayed the ACP in an objectionable situation with a woman. He was booked under the Bharatiya Nyaya Sanhita (BNS) for tarnishing the image of the police force and attempting to incite public unrest during the CJP protests.

Additional Commissioner of Police (IFSO) Sanjay Bhatia said cyber commandos have improved the speed of investigations by enabling officers to map digital trails and connections more quickly.

“What would earlier take weeks to establish — the path of a crime and the various digital nodes involved — can now be mapped in just two to four days,” he said. “They bring specialised skills that are not available elsewhere in the force, and we are constantly working to upgrade their expertise as technology and cybercrime evolve,” Mr. Bhatia added.

The Cyber Commando programme was inaugurated in 2024, with 300 personnel trained in its first batch. The Union Home Ministry’s Indian Cyber Crime Coordination Centre (I4C) selected officers from across States through an entrance examination focused on cybersecurity and cybercrime.

The selected officers underwent six months of residential training at eight centres, including the National Forensic Sciences University (NFSU) and Indian Institutes of Technology (IITs). Mr. Raj trained at the NFSU in Gandhinagar. He has worked with the Delhi Police’s IFSO unit since 2019 and spent nearly two years as a cyber commando. His areas of expertise include digital forensics, cryptocurrency investigations and malware analysis.

Delhi has eight cyber commandos. Their deployment depends on a case’s technical requirements and the expertise needed. In the event of a ransomware attack on a government system, for instance, the I4C identifies a suitable commando to assist the investigation alongside the State police, which remains the first responder.

Cryptocurrency-related fraud, including ‘digital arrest’ scams where stolen amounts are quickly converted into cryptocurrency and transferred abroad, is a growing area of concern.

Investigators seek information from exchanges used to convert cryptocurrency into Indian currency and request customer information that could help identify those behind the transactions. They also examine publicly accessible blockchain records to trace subsequent transfers and establish links between wallets, Mr. Raj said.

Mr. Raj spends much of his working day behind a large screen, analysing digital evidence, correlating records and tracing connections across online platforms and networks. The aim is to turn scattered technical clues into leads that investigators can use to identify suspects and build their cases.