Delhi Police have traced just one school bomb-threat case despite hundreds of hoax emails reported over the past two years.
Why Are School Bomb Threats Difficult to Trace?
At least six Delhi schools, including The British School, Mount Carmel and Ahlcon Public School, received bomb-threat emails on Thursday morning. Bomb disposal teams searched the premises after the messages arrived around 9 am, but the threats were declared hoaxes.
Police officials say nearly 99% of threatening emails are linked to IP addresses outside India. Senders frequently use virtual private networks (VPNs), Tor or overseas proxy servers to conceal their identities.
Investigators also face delays obtaining information from foreign companies through mutual legal assistance treaties and letters rogatory. Some providers do not maintain user logs, while others take months to respond.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
How Many Cases Have Police Solved?
Despite more than 120 registered cases since 2024, Delhi Police have identified only one perpetrator. In January 2025, investigators traced a 17-year-old Class 12 student who allegedly sent repeated threats to south Delhi schools between July 2024 and January 2025. Police identified him after discovering a weakness in the free VPN service he used.
Another investigation involving threats to more than 250 schools in 2024 led police to a suspect based in Russia, but no arrest followed.
Why Are Schools Facing Repeated Disruptions?
Every threat generally triggers security checks, evacuation procedures and searches by bomb disposal squads, even when similar messages have previously proved false.
Namita Singhal, principal of Venkateshwar Global School in Rohini, said the inspections consume several hours of the school day. Tania Joshi, principal of The Indian School, said frequent threats have forced schools to develop their own emergency procedures.
Parents must often leave work to collect children, while schools arrange transport or move students to safer areas.
What Changes Could Improve Investigations?
Delhi Police established a dedicated cell in May, comprising six officials under an assistant commissioner. However, the unit also handles other cybercrime investigations.
Former deputy commissioner of police Rajan Bhagat called for centralised intelligence, faster preservation of electronic evidence and coordinated investigations instead of treating every threat separately. He suggested examining connections between email records, technical infrastructure and previous incidents to identify repeat offenders.
International practices also offer alternatives to automatic evacuation, including risk-based searches where threats are assessed as hoaxes.
The unresolved cases highlight the difficulties of tracing anonymous online threats across international networks. Stronger evidence-sharing, coordinated investigations and consistent school safety procedures could help authorities identify repeat offenders while reducing unnecessary disruption without compromising student safety.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
