The investigation into the car explosion near Delhi’s Red Fort earlier this week has taken a digital turn. Police say the three doctors linked to the blast – identified as Dr Umar Un Nabi, Dr Muzammil Ganaie, and Dr Shaheen Shahid – allegedly used an encrypted Swiss-based messaging app called Threema to plan and coordinate the attack. All three are said to be associated with Faridabad’s Al Falah University. Also Read: WhatsApp Dating Scam: How A Bengaluru Man Lost Rs 32 Lakh To Fake High-Profile Matches
According to officials, the suspects stayed in contact through Threema, which offers high levels of privacy and anonymity. The app does not ask for a phone number or email ID during registration. Instead, users are given a random ID, making it nearly impossible to trace their identity. Investigators believe this anonymity helped the accused communicate without drawing attention. 
Also Read: “This Is How Cybercrime Begins”: Akshay Kumar Shares Shocking Daughter’s Online Gaming Incident
How Threema Works
Police sources told PTI that the suspects may have gone a step further by setting up a private Threema server. This could have allowed them to exchange files, maps, and instructions securely, away from public servers. Officials believe detailed planning, including location sharing and coordination, took place on this private network. Also Read: How Scammers Are Using eSIMs To Steal Your Money – And How To Stop Them
Threema uses end-to-end encryption for all messages and files. The app doesn’t store any metadata or chat backups, which means deleted messages can’t be recovered. For investigators, that has made tracing the suspects’ conversations far more difficult.
Officials are also trying to find out where the Threema server used by the accused was based – in India or abroad. Early findings suggest the app may have been used to share coded messages and sensitive files between the group members.
Threema’s Ban in India
Threema has been on India’s banned list since May 2023. The government had blocked several foreign messaging apps under Section 69A of the IT Act, saying they were being misused by groups outside the country. The list included platforms like Briar, BChat, Nandbox, and Safeswiss – all known for their heavy encryption and limited visibility to law enforcement.
Investigators believe the accused managed to access Threema despite the ban by using VPNs to hide their location. Investigators are also probing whether the app was used during their reported visits abroad, including to Turkey and the UAE.
Forensic experts are now analysing seized devices to determine how far the digital network extended and whether more people were involved in the plot.
