Digital Tradecraft in Terrorism

Context

In November 2025, a car explosion near Delhi’s Red Fort revealed the use of advanced digital tradecraft in terrorism (like encrypted apps, private servers and spy-style communication), showcasing a shift from physical spaces to digital networks, making counter-terrorism much more challenging.

What is Digital Tradecraft in Terrorism?

Digital tradecraft refers to advanced online techniques used by terrorists to hide communication, organise attacks, and avoid detection. It includes:

1. Using end-to-end encrypted apps
2. Operating private servers
3. Using VPNs and anonymising services
4. Communicating through dead-drop email drafts
5. Reducing digital footprints and metadata trails
6. Combining digital secrecy with traditional reconnaissance

This allows terrorists to plan operations with high secrecy and minimal traceability.

Why Does This Matter?

Digital tradecraft matters because:

1. Modern terror groups are highly tech-savvy, using tools designed to protect privacy.
2. Traditional surveillance methods like phone tapping or email monitoring become less effective.
3. Terrorists can hide their identities, communications, and location using VPNs and encrypted apps.
4. This shifts the battleground from just physical policing to cyber-forensics and digital intelligence.
5. It increases the risk of covert, high-impact attacks planned digitally with little physical trace.
6. Even banned apps can be accessed through foreign servers or proxies, making enforcement difficult.

How Was the Attack Planned?

1. Use of Encrypted App – Threema
   1. The three suspects used Threema, a Swiss encrypted messaging app.
   2. Threema does not require a phone number or email; it assigns a random ID, ensuring anonymity.
   3. Investigators think they may have used a private Threema server, possibly hosted abroad.
   4. Threema has no metadata storage, and allows two-side message deletion, making forensics extremely difficult.
2. Spy-Style ‘Dead-Drop’ Email Communication
   1. They used a shared email ID and typed messages in unsent drafts.
   2. Another member logged in, read, edited, or deleted the draft.
   3. Since no email was sent, no digital trail was created.
   4. This method creates almost zero digital footprint.
3. Reconnaissance & Explosives Stockpiling
   1. The accused conducted multiple recce missions around Red Fort.
   2. They used a familiar red EcoSport vehicle for transporting ammonium nitrate, avoiding suspicion.
   3. This shows operational discipline and careful planning.

4. Cutting Digital Links After Arrests: After two associates were caught, Dr. Umar allegedly switched off his devices and cut all communication, another advanced operational tactic.
5. Possible External Linkages
   1. There may be connections to Jaish-e-Mohammed (JeM) or JeM-inspired modules.
   2. The use of multi-layered secrecy indicates a trained, structured cell, not a lone group.

Implications

1. Traditional surveillance (phone tapping, email monitoring) becomes highly ineffective.
2. India’s ban on Threema under Section 69A (IT Act) is not enough; VPNs bypass restrictions.

3. Investigations require advanced digital forensics, like server tracking and memory forensics.
4. The attack suggests the presence of transnational networks, using foreign servers and encrypted systems.
5. Universities and professional spaces may become targets for radicalisation, as seen in the involvement of three doctors.
6. Terrorism is shifting to a multi-domain model, mixing digital secrecy with physical operations.

Challenges and Way Forward

Conclusion

The Red Fort blast shows that terrorism today blends digital secrecy with traditional planning. As terrorists adopt encrypted platforms, private servers and spy-style methods, India must upgrade its counter-terrorism approach. The next battlefield is not only in physical spaces but also inside servers, encrypted channels, and code. Stronger cyber-forensics, updated laws, proactive monitoring and international cooperation are essential to counter this new threat.