The three doctors linked to Faridabad’s Al Falah University, who are under scanner for the deadly car blast near the Red Fort on Monday evening, were in constant contact through a Swiss communication app called Threema.
The three suspects — Dr Umar Un Nabi, Dr Muzammil Ganaie, and Dr Shaheen Shahid — allegedly used the encrypted messaging app to plan and coordinate their activities related to the terror conspiracy, they said.
Investigators also suspect that Umar, the man behind the wheel of the car that exploded on Monday, and his team used a red EcoSport car, which has been seized from Faridabad, to transport and stockpile ammonium nitrate over time.
Describing Umar as the most radicalised member of the module and the bridge between all the doctors, sources said he allegedly switched off his phones and snapped digital contacts after the arrest of Muzammil and others connected to the terror conspiracy. The death toll in the blast near the Red Fort rose to 13 on Thursday after another injured person succumbed to his injuries at the LNJP Hospital, while several others remain under treatment, an official said.
The suspects had conducted several recce in the Capital. The group was planning multiple serial blasts and was awaiting final orders from its handlers at the time it was busted. “Unlike conventional messaging platforms, Threema does not require a phone number or email ID for registration, making it extremely difficult to trace the users,” a source said. The app assigns each user a unique ID not linked to any mobile number or SIM card and offers end-to-end encryption with an option to be run on private servers.
Investigators suspect the accused doctors set up a private Threema server to communicate securely and evade detection.
This server was allegedly used to share sensitive documents, maps, and layouts related to the Delhi blast conspiracy.
“Detailed planning, including location sharing and task allocation, is believed to have been conducted through this private network,” a police source added.
The trio reportedly used the app for encrypted text chats, sharing of documents and designs, and voice communication instead of relying on standard mobile networks. For additional secrecy, Threema allows messages to be deleted from both ends and does not store metadata, further complicating forensic retrieval, the source added. Agencies believe this closed Threema network played a crucial role in the planning and coordination of the blast.
Investigators are now working to determine whether the private server used by the group was hosted inside India or abroad, and whether other members of the module had access to it.
Preliminary findings suggest the app was used to transfer restricted material and coded messages among the members of the terror module, officials said.
