Delhi Police say most unsolved hoax bomb threat emails were routed through VPNs and overseas servers, masking the senders’ identities.
Investigators say requests for information often run into encryption and cross-border jurisdiction hurdles.
With threats rising for nearly two years, ministry-level discussions are underway on possible regulation of VPN services in India.
In December, Vikas Sharma and his wife were at their workplaces when Sharma received a sudden call from his children’s school. Yet another bomb threat had been reported at the school.
Sharma rushed to pick his three children from New Delhi’s DAV Public School in north-west Delhi’s Pushpanjali Enclave, but due to the threat the cab driver refused to go near the school gates. As he lives some distance away from the school, Sharma was forced to request another parent who stayed closer to keep his children at their house temporarily and could only pick them up hours later when the threat was declared a hoax.
“Suddenly when such a bomb threat comes, our entire life gets disturbed,” he told Outlook.
Over the past 18 months, such disruptions have become routine for hundreds of families across Delhi and neighbouring Gurgaon where schools have been receiving these hoax bomb threats almost on a daily basis. Schools are evacuated, fire tenders line up outside school campuses to prepare in case an actual bomb causes fire, bomb disposal squads sweep through nooks and corners of classrooms and corridors.
Sharma, 44, a businessman, has a daughter in Class 10 and two sons in Class 6 who are now experiencing the psychological impact of repeated evacuations and threat drills. "For the children, the experience of being rushed out of classrooms, seeing police and bomb squads, and hearing words like ‘bomb threat’ can be frightening," he says.
After what felt like a lull in bomb threats, in late January the trend started to pick up all over again as a fresh wave of threats hit schools in Gurgaon and Delhi, followed by a Delhi court.
In the past two weeks, several Delhi schools have been receiving similar emails over and over again with every major school finding itself on the receiving end of an email claiming explosives on campus.
A senior official working with Intelligence Fusion and Strategic Operations (IFSO), a specialised cybercrime unit under the Delhi Police Special Cell, who wished to stay anonymous, told Outlook that most unsolved cases involve masking tools that create multiple digital layers.
“You need to understand VPN (Virtual Private Network) here. It goes through multiple nodes and the IP address keeps changing. By the time it hits Google’s or Microsoft’s server, it won’t be clear which backend it actually came from or what exactly it is,” the officer explained.
Ordinarily, he said, if someone sends an email without masking software, the IP address — a unique string of characters that identifies each computer using the Internet Protocol to communicate over a network — directly reaches the email provider. However, in these cases, the visible IP often leads only to an intermediary.
“When you ask Google, they give you a particular IP,” he said, adding that in the next step when that provider is approached, it rarely yields results. “Most of the servers are located outside. So at present they are located abroad. So far, nothing concrete has been found.”
Requests for information require international cooperation and central agency involvement, and even then, encryption or lack of data retention can stall investigations.
Nearly two years into recurring threats, the official said that discussions are happening at the ministry level. “The possibility of putting regulations on VPNs in India is being discussed with the Ministry of Electronics and Information Technology now,” he said.
“Every third day this issue comes up. It creates fear. It’s like that childhood story, ‘the tiger came, the tiger came.’ If it doesn’t come 10 times but comes once for real, what will we do then?,” asked Sharma.
Emergency Protocol, Every Time
The pattern of these hoax bomb threats dates back to 2022, when a private school in south Delhi’s Sadiq Nagar received such a threat. In 2023, multiple schools were targeted on three separate occasions. In May 2024, the scale escalated dramatically when over 200 schools received bulk threat emails, prompting authorities to register an FIR and club subsequent cases under the same investigation.
The threats continued through June, August, October and November, expanding beyond schools to colleges, hospitals, airlines and government institutions. Throughout 2025, the emails did not stop. More than 35 emails from different IDs were reported that year alone, most of them untraceable.
For emergency responders of these threats, there is no such thing as a “routine” bomb threat.
Atul Garg, who retired as Director of the Delhi Fire Service in October 2025, told Outlook that nearly 60 schools had received hoax calls or emails at one stage. “Whenever a call comes from a school, you have to send a fire tender to every single school. You cannot ignore even one,” said Garg, adding that the standard protocol is immediate as two fire vehicles are dispatched and stationed outside the school. The entire campus is evacuated while police and bomb disposal squads conduct a thorough search.
“If there is a bomb and it explodes, naturally there will be a fire,” Garg explained. “We stay ready in case a blast causes fire, our goal is to control the fire immediately and minimize damage.”
Each operation can take two to three hours and for that time, the fire vehicles remain stationed there until the entire school is searched. In case multiple schools receive threats at once, the strain multiplies. “If 40 schools receive threats at the same time, then my manpower and vehicles are reduced by 40 deployments. If another real call comes somewhere else, that may get compromised.”
In the past two years, no actual bomb has been found in Delhi’s schools. However, the emergency responders cannot afford to take chances. “For us, a call is a call. Our training is that every call must be taken seriously,” he said.
How Hoax Calls Impact Children
For parents, the moment a hoax bomb threat is received by the school, it immediately results in parents shutting shops, leaving offices midway and scrambling for transport.
Some of the children have become anxious about stepping outside or playing in neighbourhood parks, another parent, Pankaj Gupta said. “They are not able to live in a fully healthy and safe environment anymore.”
Delhi Parents’ Association president Aparajitha Gautam believes authorities should examine patterns more closely. “Please check the dates,” she said. “They happen before term exams or final exams,” questioning why reputed private schools are frequently targeted while government schools appear less affected.
In the handful of previous cases where police made breakthroughs, the senders turned out to be schoolchildren, and the common factor was simple: they had not masked their digital trail.
In 2022 and 2023, students were identified and counselled after sending threat emails to get exams cancelled, secure a day off or as a prank. In December 2024, a student was traced because he had not used a VPN. In July 2025, a 12-year-old boy was found to have sent threats to two institutions. In another instance, a Class 8 student reportedly admitted he wanted schools shut and had randomly added email IDs while drafting the threat.
In these earlier cases, Gautam said, authorities should have publicly clarified that action was taken, without naming the child, to create deterrence. Urging caution, Garg said that unless police confirm it, “saying that students are behind this is just an assumption,” she said. “Anyone could be doing it.”
Balancing Security With Privacy
Prateek Waghre, Head of Programmes at the Tech Global Institute, a nonprofit working to make technology policy more equitable for the Global Majority, told Outlook that the difficulty in tracing such emails highlights the structural limitations of digital investigations in a globalised internet ecosystem.
“An IP address is not always a definitive identifier of a person. When someone uses a VPN or proxy service, what platforms see is the IP address of that intermediary service, not the original user,” Waghre said.
He added that when law enforcement identifies the VPN provider, access to subscriber information depends on where the company is incorporated, what data retention practices it follows, and whether there are effective cross-border cooperation mechanisms in place.
“The internet is borderless, but law enforcement is not. That mismatch creates real investigative challenges,” he said. At the same time, Waghre cautioned against oversimplifying the solution.
“While public anxiety is understandable, any response must balance security with privacy. VPNs also have legitimate uses, from protecting journalists to ensuring online security,” he said.
