In 2014, an investigation by a British television news channel into the identity of a social media propagandist promoting the rising acts of terrorism of the Islamic State, which had declared a caliphate in Iraq and Syria, led to the arrest of a 24-year-old in Bengaluru.
Mehdi Masroor Biswas, who hailed from West Bengal and worked in a private firm in Bengaluru, was arrested at his residence in Jalahalli on December 13, 2014, after he was outed as the person operating the online identity of @shamiwitness, a flag bearer of radical Islamism.
His arrest was only a small step in countering the rampant ISIS terror propaganda on social media at the time. Identifying the person who operated the @shamiwitness account did not guarantee a terrorism conviction, as he was not directly involved in any act of terror in India, and his social media activity was through platforms with servers located in the United States.
The investigation that followed saw the Karnataka Police seize electronic devices, scour call records, IP logs, and archived tweets, and document his social media posts related to ISIS activities. It culminated in a chargesheet of more than 35,000 pages and ultimately in his being sentenced to 10 years in prison on terrorism charges, among others.
What Channel 4 found
The online investigation by the UK’s Channel 4 extracted a phone number for @shamiwitness from his social media account and resulted in a telephonic interview with Biswas, who allegedly acknowledged his association with the Twitter account which was being used to glorify ISIS terrorists in Syria, including several from Britain.
The Channel 4 probe found that Biswas first started tweeting with the identity @elsalvator before creating the @shamiwitness account using an elsalvator email identity which eventually led to the revelation of his real identity through a Facebook account.
The revelation facilitated an investigation by the Karnataka Internal Security Department and the Bengaluru Central Crime Branch, which led to Biswas’s arrest. On questioning, Biswas allegedly admitted that he was the person who had created the ‘ShamiWitness’ Twitter account and a case of terrorism, waging war against an Asiatic power, and cyber terrorism was registered by the Bengaluru police under sections 3, 13, 18 and 39 of the Unlawful Activities (Prevention) Act, 1967, Section 125 of the Indian Penal Code, and Section 66 F of the Information Technology Act, 2000.
Story continues below this ad
The hard task of finding evidence
While finding the culprit is often seen as the essence of solving crimes, one of the crucial aspects of investigations is also finding the evidence to link the accused to his alleged crimes after an arrest—especially in cases where it involves digital footprints for the allegation of online promotion of terrorist groups and activities.
“@ShamiWitness did whatever he could possibly do sitting behind a computer in India—far away from the battlefield—to help the ISIS agenda, by promoting pro-ISIS accounts through his tweets/retweets. Not only did he give vital information to help misguided youths to reach Syria/Raqqa and join ISIS, but he also posted brutal ISIS videos,” M K Thammaiah, a police officer who was tasked in 2014 to gather evidence to prosecute Biswas, said.
The investigations following Biswas’s arrest led to the seizure of a laptop, an external hard disk, two mobile phones, and two pen drives. The laptop allegedly revealed that Biswas used software like ‘VPN’ and ‘Ghost IP’ successfully to mask his IP address and his identity while operating online. Further, to delete incriminating materials, he used ‘C Cleaner’ and other software, the probe found.
The call records and the GPRS call records obtained from mobile service providers allegedly confirmed the usage of the internet, matching the dates and timing of social media posts by Biswas under the @shamiwitness social media account.
Story continues below this ad
The IP logs of the Twitter account @shamiwitness, which were obtained by the investigators from Twitter for the period between 2013 and 2014, were traced to a landline number and mobile numbers in Biswas’s name. The applications obtained from telecom service providers confirmed the link, as per the probe.
Among the IP addresses provided by Twitter for @shamiwitness were many proxy IP addresses related to various parts of the world, like Australia, Greenland, and Spain, which confirmed the usage of IP-masking software on occasions to hide the real IP address, the probe found.
The probe also found that Biswas deleted his Facebook and Gmail accounts on December 12, 2014, after his real identity was exposed by Channel 4, and this was confirmed by the IP details provided by Facebook on the request of the police.
The investigation also obtained the details of archived tweets and direct messages of @shamiwitness from Twitter Inc. The probe collected screenshots of direct messages containing incriminating material allegedly posted by @shamiwitness in support of ISIS. This evidence, running into 1,023 pages, was placed in court. The direct messages provided by Twitter confirmed that these were part of the @shamiwitness Twitter account.
Story continues below this ad
Biswas also voluntarily identified 48 accounts of ISIS fighters with whom he was in touch.
A 36,986-page chargesheet filed
“From the observation of tweets and images it is revealed, the accused a self-motivated Islamist with radical views on the practice of Islam, and Jihad, on an average made five to six hours of time a day to tweet, retweet, mention, post images, search and paste links of radical Islamic scholars with an intention to invite support for the activity of the banned terrorist organization the ISIS,” investigators told a trial court.
The Bengaluru Central Crime Branch police filed a 36,986-page chargesheet in 2015, largely documenting the digital tracks of Biswas’s operations as a social media propagandist for ISIS, which included 1.22 lakh posts and 15,446 images related to ISIS activities.
Predicting on Twitter the beheading of US journalist James Foley and UK aid worker Peter Kassig several weeks before the Islamic State actually killed them, calling for IS support in Kashmir, frequent retweets about the life of UK jihadist Iftekhar Jaman were among key propaganda activities highlighted in the chargesheet.
Story continues below this ad
In January 2024, Biswas was sentenced to 10 years in prison on charges of terrorism and waging war against an Asiatic ally by a special court for terrorism cases in Bengaluru. The special court acquitted Biswas of charges of waging war against the government of India under Section 121 of the IPC, and cyber terrorism under Section 66F of the IT Act.
In November this year, Thammaiah, who is currently an additional superintendent of police in Karnataka, was chosen for the Union home minister’s award for excellence in investigations for the Biswas case.