It did not look like a spy operation. No dark rooms, no secret codes, no dramatic briefings. Instead, it began with a WhatsApp message, a small sum of money, and a simple task and take a photo of this railway station or note down what you see near that military gate.
That, according to investigators, is exactly how Pakistan's Inter-Services Intelligence, commonly known as the ISI, was running a spy network right inside India, one that stretched across Uttar Pradesh, Bihar, Haryana, and the Delhi-NCR region, and which has so far resulted in more than 14 arrests.
The Ghaziabad Police, working alongside central security agencies, have dismantled what is being described as one of the most organised low-level espionage networks linked to Pakistan in recent memory.
The Mechanics: Solar Cameras and WhatsApp Payments
The most alarming detail to emerge from the investigation is the use of solar-powered, SIM-enabled CCTV cameras. These are small, self-sufficient cameras that do not need electricity from a power socket and they transmit video over mobile networks. The network had installed at least two of these cameras at two sensitive locations, such as Delhi Cantonment railway station and Sonipat Railway Station. One of these cameras reportedly streamed live footage for 18 straight days before it was discovered.
The Special Investigation Team found that the ISI-run network was planning to install over 50 such cameras at locations across India. The cameras were cleverly disguised using solar panels to avoid drawing attention. And to further reduce suspicion, the network reportedly used Hindu recruits to carry out the installations and a calculated move to make these individuals blend into everyday surroundings.
The payments were small and deliberate. ISI handlers were paying anywhere between Rs 500 and Rs 15,000 per task, channelled through WhatsApp. For a young person from a poor background, that is enough money to be tempting. Certainly not enough to make anyone feel like a spy. That, it appears, was the entire point.
Who Was Recruited and Why That Should Alarm Us?
Police officials revealed that the accused primarily used social media and informal contacts to identify financially distressed young people. Once brought in, recruits were given instructions to collect photos, videos, and GPS coordinates of key areas around Delhi-NCR. The tasks sounded harmless. The consequences were anything but.
Among those arrested is Mohammad Naushad Ali, a 20-year-old who worked at a tyre puncture shop near a petrol station in Faridabad's Nacholi village. He allegedly recruited youths with technical skills such as mobile repair, computer operations, and CCTV handling, particularly from economically weaker sections, by offering them money.
Then there are the minors. Five young people between the ages of 15 and 17, from Uttar Pradesh and Bihar, were detained as part of this investigation. This is not a statistic to gloss over. These are teenagers who were recruited, used, and now face the consequences of decisions they may not have fully understood. The overall network is estimated to have had approximately 20 to 25 members, including both young men and women.
The Bigger Picture: Surveillance of the Military
What the ISI was trying to build here was not just gossip-level intelligence. The network was actively planting disguised cameras at high-security sites such as Delhi Cantonment Railway Station, Pune Railway Station, and other key military installations is potentially even naval bases, to monitor the real-time movement of Indian Army troops.
This is a pre-attack investigation. The kind of information gathering that happens before something much more serious is planned. The fact that at least one camera successfully transmitted live footage for over two weeks before being detected shows how close this came to being a serious breach.
The Grooming Playbook
Perhaps the most chilling part of this story is not the technology, but the method. A senior official described how the ISI identifies future recruits by first spreading rumours through unverified social media posts, then slowly grooming selected targets, sometimes starting with something as casual as a friend request on social media.
This is not unusual. The same pattern has been used elsewhere. Influencers and YouTubers, such as Jyoti Malhotra, were reportedly groomed for propaganda and intelligence-gathering under the cover of ordinary travel content. The appeal of these methods is clear that they carry lower risk, they reach more people, and they target anyone with a smartphone, like tech workers, students, or simply someone going through a difficult time financially. Security experts have emphasised the need for increased public awareness, particularly among young people, about the risks of sharing sensitive information for monetary gain.
What does this tell us about modern espionage?
The Ghaziabad spy ring is, in many ways a textbook case of what intelligence analysts call a low-budget technical network. There are no highly-trained agents here. No James Bond-style operatives. Just ordinary people, many of them young, many of them poor, being handed small amounts of money to do seemingly small things that together add up to a very serious threat.
This model is cost-effective for those running it. It is difficult to detect because the individual tasks look innocent in isolation. And it is easy to recruit for because economic vulnerability is widespread.
Indian agencies, including the Intelligence Bureau, the National Investigation Agency, and state police forces are countering such networks through raids, SIM card tracing, digital forensics, and expulsions. Cases of this nature typically lead to arrests under the Official Secrets Act. Two key suspects, identified as Naushad Ali from Muzaffarpur and Sameer alias Shooter from Bhagalpur, were still at large as of the latest reports.
. . .
References: