Hoax bomb threats to Indian flights made using VPN as IP addresses traced to London, Germany

Following several bomb threats against planes on social media, central intelligence services have traced the IP addresses of the threatening posts to Germany and London.

Earlier this week, over 20 Indian flights including domestic and international, received hoax bomb threats. Among them, three Indian carrier foreign flights received bomb threats on Oct 14, while ten more received similar threats on Oct 15.

At least six of these threats surfaced a day later. Following security assessments, it was determined that these threats— which originated on social media platforms — were fraudulent.

Central intelligence agencies reached out to microblogging site X to reveal the IP addresses that were used to create all of the posts.

“We have received the preliminary reports, and they have informed us that posts were made from three separate handles. Of these three handles, they have traced two IP addresses — two common IPs from London and Deutschland,” a source said.

“The users have tweeted after using a virtual private network, or VPN — an encrypted connection over the Internet between a device and a remote server which is aimed at masking one’s online identity. Details of another handle are still awaited,” the source added.

The source said that the Central Intelligence agencies have requested additional specific details from X and are awaiting their response.

“This month so far, the IGI Airport Police responded to seven incidents involving reported bomb threats. After thorough verifications and inspection, all threats were confirmed as hoaxes,” said Usha Rangnani, Deputy Commissioner of Police (IGI Airport).

“Legal action has been initiated against those responsible for these false alarms to ensure strict measures against misuse and to maintain the safety and security of passengers and airport operations,” added Rangnani.

Rangnani continued, “An FIR has been registered under sections 217 and 351 (4) of the BNS, as well as section 3 (1)(d) of the Suppression of Unlawful Acts against Safety of Civil Aviation Act, 1982, in connection with the recent hoax bomb threat concerning Akasa Air flight.”

“A detailed investigation is currently underway, and after coordinating with the concerned social media platform, all accounts responsible for spreading these false threats have been suspended to prevent further misuse and ensure public safety,” said Rangnani.

Senior representatives of the Ministry of Civil Aviation (MoCA) have said that they are considering taking steps to tighten laws in order to allow for tougher penalties for those who pose such a threat. One such action is adding them to the list of those who cannot fly on aircraft operated by Indian carriers.

According to senior government officials, the civil aviation ministry is strengthening the Indian model for managing such incidents by analyzing the best model currently in use around the world and by negotiating with the International Civil Aviation Organization (ICAO).

“This is an inconvenience not just to passengers and airlines but for every stakeholder. The aviation and home ministries and security regulator Bureau of Civil Aviation Security (BCAS) are working at multiple levels to not just check this menace but bring in enough punishments to discourage people from doing it,” said an anonymous top government official.

The Ministry of Home Affairs and security authorities are contacting virtual private network (VPN) service providers to find out the location of these messages, while the aviation ministry is enacting penalties for those involved in making these calls.

To discourage people from making such threats, the Home Ministry is also considering to introduce regulations under the current cyber laws.

The majority of these risks are delivered via VPNs, which use IP address masking and data encryption to establish safe connections between computers over the internet.

According to a senior government official, there's a possibility that some people issued fictitious threats and others followed suit, possibly with the intention of upsetting someone's travel plans.

“Look at the case of the minor arrested by Mumbi police — we need to ensure that there are enough consequences built-in in the system to deter such people,” the official added.

Earlier, a 17-year-old Chhattisgarh boy was taken into custody by the Mumbai Police for allegedly threatening to blow up an Air India flight on social media.

Currently, there is no clause in aviation regulations that would sanction such individuals.

In the event of such a threat, an airport-based Bomb Threat Assessment Committee (BTAC) meets to evaluate the threat. Representatives from the airline, BCAS, Central Industrial Security Force (CISF), and airport operator constitute the committee.

Several variables are assessed, including the threat's source, the details offered, and the message's timing. An aircraft is not inspected if a danger is deemed to be "non-specific."

If the threat is considered to be “specific,” however, flights are rerouted to the closest airport and then flown to a remote harbor where passengers are evacuated and all of the luggage is inspected.

After a comprehensive inspection, the aircraft is only allowed to take off.

According to officials, this predetermined process will not be reviewed and will still be used to inform decisions about threats.