Bengaluru cafe blast suspect used fake ID credentials for Chennai stay, probe reveals

The investigations have found that the suspect – now identified in all probability as being Musavir Hussain Shazib, a missing terror suspect from the Shivamogga region of Karnataka – stayed in Chennai for over a month before travelling to Bengaluru on the night of February 29.

Sources said the probe had found that the suspect had been staying at a lodging facility in Chennai after providing fake credentials, including an Aadhaar card and a driving licence. The suspect is alleged to have travelled to Bengaluru, via Tirupati, to plant an IED on February 29.

“The suspect did not take shelter in Bengaluru but arrived on the morning of March 1 and travelled to the cafe to plant the device and left the same day,” a source familiar with the probe said. The CCTV trail of the suspect in Bengaluru was picked up from footage in the Silk Board area in southeast Bengaluru on the morning of March 1.

The CCTV trail has found footage of the suspect travelling in public buses to get to the cafe and his arrival at the cafe with a cap, a mask, glasses to shield his eyes, wearing a full-sleeved shirt, a dark pair of pants, and sports sneakers. He entered the café at around 11.35 am and exited by 11.45 am.

The IED went off at 12.56 pm, leaving nine people injured. The suspect was seen on CCTV footage boarding public buses and leaving the city after multiple changes in his attire, including a change of shirt and discarding of his cap around three km from the cafe at a religious centre. The suspect was last seen on CCTV footage at the Ballari bus stand at 9 pm on March 1.

The trail of the cap left behind by the suspect took investigators to Chennai where the cap was purchased at a clothing retail store in a mall.

The Shivamogga IS module links

Investigations in Chennai have revealed that the suspect and his associate – both linked to the Shivamogga IS module – fled from the city at the end of the first week of March.

Evidence from past Unlawful Activities (Prevention) Act (UAPA) cases where the Shivamogga module of the IS has been involved – like the accidental Mangaluru cooker bomb blast case on November 19, 2022 – has revealed that the members of the group are adept at using terror tradecraft like fake identities, encrypted communication (including avoidance of usage of cell phones linked to real identities) and obscure financing methods like cryptocurrencies.

The NIA investigations of the Shivamogga module, the Ballari Module and the Al Hind module of ISIS – especially after arrests carried out in Karnataka from 2020 to 2023 of young recruits – have revealed the creation of a network that is being remotely trained by online handlers in the tradecraft of terrorism.

The NIA told a terrorism court last year that the suspects from the Shivamogga IS module case were using encrypted communication technology to communicate with the handlers for the larger IS-linked operatives network for south India.

“As per the data extracted from the electronic gadgets, the accused persons were using many encrypted communication platforms such as Wire, Wickr-Me, Element, Status, Session, Signal, Protected Text(PT), Telegram, Telegram-X, Graph, etc., and they used the said encrypted communication platforms with an intention to mask their identity,” the NIA alleged.

Investigating agencies have found that the suspects in the Shivamogga module received several lakhs in funding – almost Rs 8 crore according to some estimates – through cryptocurrencies, an aspect which the Directorate of Enforcement has now started investigating for possible money laundering.