Ahmedabad: School case morphs into Indo-US operation

AHMEDABAD: India’s premier security agencies and even US spooks may help Ahmedabad cybercrime cops ferret out the person responsible for posting morphed pictures of some Anand Niketan students.
The city cybercrime cops had found themselves in the blind alleys of the internet in their search for the culprit. So they have approached a clutch of central intelligence agencies.
India’s nodal agency for cyber security, the Indian Computer Emergency Response Team (CERT-In), is among the agencies contacted by the Ahmedabad cops.
That the matter has become a high-stakes probe is reflected by the fact that Ahmedabad cops have also reached out to officials in India’s hub of secret service offices at CGO Complex, New Delhi. The Ahmedabad cops want the US-based National Security Agency’s Central Security Service (NSA-CSS) to trace the IP addresses through which the threat mails were sent to the school. This information was revealed by highly placed sources in Ahmedabad’s cybercrime police.
A senior officer of Ahmedabad cybercrime police said, “We have already taken the help of CERT-In in the case and of various other central agencies including some secret service agencies.” The officer added: “The accused had used the dark web browser called Tor. Specialists are needed to find the offender in such circumstances.”
Tor was originally created for the US Naval Research Laboratory for exchanging classified communication. The Tor browser makes all its users look alike. The accused apparently also jumps from one IP to the next across several countries. The cybercrime cell had a few days earlier approached 358 ISPs (internet service providers) to narrow down the search.
The NSA of the US, according to police officials, creates “fingerprints” that detect hypertext transfer protocol (HTTP) requests from the Tor network to particular servers. That can help home in on the accused.
The accused made the first threat in September 2020 to force the school to postpone its exams. Though the school management and parents went to police, the accused subsequently emailed more such warnings. The accused had on March 31 joined an online session for Class 12 and had shared with the attendees a link to the morphed images of students. The latest demand of the accused was: ‘No online classes till June first week’.
Cops consider this their most complex cybercrime investigation. A team of 200 coding experts, including a few from private companies, had been roped in to identify the accused with the IP address of the initial threat mails.