After Maoists, counter-intelligence is the top priority of Modi government

However, since Amit Shah became the Home Minister, the main focus of the government has been on counter-intelligence (CI). Often neglected by previous regimes, the national security establishment has emboldened CI by cracking down on foreign intelligence, their networks and their operatives within India. Earlier, apart from the usual suspects – Pakistan’s ISI and the Chinese MSS – Western intelligence agencies infiltrating Indian society and social media had hardly any restraints on spreading their political and military tentacles within India.

India’s security landscape has faced threats from multiple fronts in the last decade, not only on its borders but also within its own region. Foreign actors have tried to infiltrate military areas using fake identities, have created document fraud networks in several states and planted surveillance devices inside high security establishments. The Pakistani ISI, Chinese intelligence, Bangladeshi terror networks and Western intelligence and their mercenaries have often tried to achieve their respective objectives on Indian soil, often simultaneously. However, India’s counter-intelligence agencies have gradually dismantled these operations, arresting operatives, charge-sheeting the operators and shutting down networks deeply embedded within Indian territory.

India’s CI response is based on a layered institutional architecture. The National Investigation Agency (NIA) leads the federal prosecution under the Unlawful Activities (Prevention) Act (UAPA) and the Official Secrets Act, with a conviction rate of about 95% in the cases it handles directly. The Intelligence Bureau (IB) manages internal intelligence and runs the Multi-Agency Center (MAC) for real-time intra-agency sharing. The Research and Analysis Wing (R&AW) keeps an eye on foreign operatives and cross-border intelligence networks. The Sashastra Seema Bal (SSB), which guards the India-Nepal border and plays a central role in preventing Chinese intelligence infiltration. State police, especially in Andhra Pradesh, Maharashtra, Uttar Pradesh and Punjab, have been the first line of detection in many major espionage cases. Border Security Force (BSF) and Army units have supported ground level operations where intelligence and terrorist threats have been gathered.

The cases below highlight some of the most significant counter-intelligence operations conducted by Indian security agencies in recent times.

USA and Ukraine:

Matthew Aaron Van Dyke (USA) and six Ukrainian citizens

(Secret military training and drone smuggling network- arrested in March 2026)

Van Dyke, founder of private mercenary firm Sons of Liberty International (SOLI), was arrested at Kolkata Airport on March 13, 2026. Six Ukrainians, Hruba Petro, Slivyak Taras, Ivan Sukmanovsky, Stefankiv Marian, Honcharuk Maxim and Kaminsky Victor, were arrested simultaneously at Lucknow and Delhi airports. They crossed into Mizoram without obtaining mandatory restricted area permits and crossed into Myanmar on several occasions. There, he conducted training sessions for ethnic armed groups in drone operation, assembly and jamming techniques. According to the NIA chargesheet, these groups have confirmed links to banned Indian insurgent organisations, and the accused were actively supporting them by supplying weapons, terrorist hardware and training. All seven were charged under Section 18 of the UAPA (terrorist conspiracy) and sent to 30-day judicial custody on 6 April 2026.

Pakistan/ISI-directed operators:

Delhi Police Special Cell on February 15 arrested Nepali-origin Pakistani spy Ansarul Mian Ansari from Central Delhi while he was trying to flee to Pakistan via Nepal. Trained in Rawalpindi, Ansari was collecting sensitive information about the Indian Army and was found to be in possession of classified documents. ISI had entrusted him with the task of making a CD of confidential documents and sending it to Pakistan. Ansarul revealed that he worked as a cab driver in Qatar, where he was recruited by his ISI handler. Forensic investigation confirmed that the recovered documents were classified armed forces material. The three-month-long operation was conducted jointly by central agencies and Delhi Police Special Cell from January to March 2025.

Pakistan’s ISI ran a sophisticated surveillance network inside India, installing solar-powered SIM-enabled CCTV cameras at high-security locations including Delhi Cantonment railway station, Pune railway station and other military establishments. The cameras streamed live feed via WhatsApp directly to ISI handlers in Pakistan. The network was planning to install more than 50 such cameras across India, for which operators would have to pay. ₹Rs 500 to Rs 15,000 per work. UP Police and central agencies foiled the operation, making 15 arrests. The network consisted of about 20 to 25 members, including foreign recruited handlers. Among those arrested was Nepal-origin Ganesh Giri, who was recruited and tasked by ISI operatives to install cameras at key military sites.

Mir Balazs Khan, a Pakistani national, ran an espionage network that leaked sensitive and classified information related to the Indian Navy, particularly details of the Karwar Naval Base and Kochi Naval Base, through social media in exchange for cash payments from Pakistani intelligence operatives. The case was originally registered by the Counter Intelligence Cell, Andhra Pradesh in January 2021. NIA took over it in June 2023. The total arrests in the case reached eight, spread across Andhra Pradesh, Karnataka and Kerala.

China:

woo hailong and seung joon yong

(Military reconnaissance, India-Nepal border in Bihar – arrested in May 2025)

Two suspected Chinese intelligence operators, Wu Hailong, 38, and Seng Jun Yong, 30, of Liaoning province, were arrested by SSB personnel in Bihar’s Madhubani district near the India-Nepal border. Both did not have valid travel documents. Several anti-India and pro-Khalistan videos were recovered from his mobile phone. His arrest came after two consecutive days of unidentified drone intrusions from Nepal into Bihar. Central intelligence agencies immediately took over the interrogation.

Uttar Pradesh Police and Sashastra Seema Bal have arrested a Chinese national on charges of espionage activities along the India-Nepal border. Photographs of Indian Army establishments and records of visits to Pakistan were found on his phone. The case reinforced the now-established pattern of Chinese operatives using the India-Nepal corridor as a covert entry route for military reconnaissance.

Three Chinese nationals were arrested for trying to infiltrate into India through Nepal using fake Nepali identities and fake Indian passports. Indian intelligence agencies suspected that it represented a broader Chinese operation involving recruited Nepalese agents and corrupt passport officers working along the porous border.

Wang Gaojun, 26, entered India through Nepal without a valid visa, traveled to Delhi where he visited various important establishments and was arrested by the SSB at Gauriphanta-Nepal border in Lakhimpur Kheri in UP while attempting to return to Nepal. He was charged with waging war against the Government of India under Section 121 of the IPC, a provision rarely invoked in espionage cases, indicating the seriousness with which the agencies assessed his reconnaissance activities.

Delhi Police caught Cai Ruo, a Chinese national from Hainan province who was living in India under false identity as a Nepali national named Dolma Lama, claiming to be a Buddhist. His inability to speak Nepali raised initial suspicion. The investigation revealed fake documents and identity cards and confirmed suspected espionage and anti-national activities. The case was characterized as a sophisticated deep-cover intelligence operation.

Xu Fei and the network

(Arrested in document forgery and safe house operation, Noida- June 2022)

Noida Police raided a property in Gharbara village, revealing a Chinese club operating as a safe house and coordination point for around 20 Chinese nationals living illegally in India. Chinese national Xu Fei, 36, resident of Xinji, Hebei, was arrested. Document forgery equipment including machinery used to make fake Aadhaar cards and voter ID cards and several blank smartcards were seized. Network connections were detected in Uttar Pradesh, Gujarat, West Bengal and Northeast India.

Bangladesh:

Hamidullah alias Raju Ghazi and Mohammad Sahadat Hussain alias Abidullah

(JMB infiltration and radicalization network- arrested in August 2022)

The NIA arrested two Jamaat-ul-Mujahideen Bangladesh (JMB) activists (Hamidullah from Narayanganj and Mohammad Sahadat Hussain from Madaripur districts of Bangladesh) from Bhopal, Madhya Pradesh. The investigation revealed that the two had entered India illegally to pursue violent activities, hatching a criminal conspiracy to radicalize Indian Muslims and inspire them to commit violent jihad. The duo communicated with the handlers through encrypted applications and the chargesheet was filed before a special NIA court in Bhopal.

The NIA arrested Mohammad Abdul Mannan Bachchu, a Bangladeshi JMB operative from South 24 Parganas, West Bengal, for arranging fake Indian identity documents, including fake voter ID cards and Aadhaar cards, for JMB members who entered India illegally. He was suspected to have links with Al-Qaeda and Harkat-ul-Jihad al-Islami and at the time of his arrest was actively building intelligence and terror modules in West Bengal.

A clear pattern runs through a decade of counter-intelligence operations in India’s security landscape. Different actors, different nationalities and different objectives, but a remarkably consistent set of methods, entry routes and vulnerabilities.

The reach of ISI’s espionage extends far beyond Jammu and Kashmir. Technical surveillance networks have been found operating inside Delhi Cantonment itself. The Visakhapatnam naval espionage case alone involved several arrests.

China is patiently carrying out systematic intelligence operations through Nepal. From fake Buddhist monks in Delhi to military installation photography on the Bihar border, several arrests from 2022 to 2025 point to coordination, not coincidence.

Document fraud is common across all nationalities. Pakistani ISI operatives, Chinese intelligence agents and Bangladeshi operatives used or created fake Indian identity documents, Aadhaar cards, voter ID cards and passports to infiltrate and operate inside India.

The India-Nepal border has emerged as the most exploited entry corridor. It is used simultaneously by Chinese intelligence operatives, Nepali agents recruited by the ISI, and Pakistani espionage networks, creating a structural vulnerability that cuts across all threat streams.

India’s counter-intelligence front has become much more capable in its response, operationally agile, legally strong and better connected internationally. Yet the threat has evolved in equal measure. Pakistani networks are conducting increasingly sophisticated technical surveillance operations. China is conducting coordinated cross-border intelligence collection. Foreign mercenaries are treating India’s Northeast as an open corridor and Pakistan’s military leadership is ready to exploit Indian weaknesses in the region by using networks in Bangladesh. Indian agencies are also focusing on enemies within the establishment who trade national security secrets in exchange for silver and goods. Home Minister Amit Shah’s massive budget hike and expansion of the IB network with big recruitment has put pressure on India’s adversaries.