NIA detains 1 in Bengaluru Rameshwaram Cafe blast probe; cracking terror tradecraft a challenge for investigating agencies

Despite the probe by the NIA and the Bengaluru police narrowing the identity of a suspect involved in The Rameshwaram Cafe blast down to an individual from the Shivamogga module of an Islamic State group, the efforts to nab the suspect and possible collaborators had remained a challenge on account of the group being adept in the usage of terror tradecraft.

The cafe blast suspect’s trail has been pieced together through the CCTV footage on his escape route travelled by two intra-state government buses to get to Ballari and travelled further to another unidentified destination, police sources said.

The CCTV trail of the suspect captured from buses and bus stops in Bengaluru and Ballari showed him arriving in Ballari, located around 300 km away from Bengaluru, at around 8.58 pm on March 1 after the blast at The Rameshwaram Cafe at 12.56 pm. The suspect was believed to have met an acquaintance in Ballari before travelling further towards Kalaburagi in a bus.

Between March 6 and 9, the NIA had questioned four members of an ISIS Ballari module, who are in prison after their arrest in December 2023, for possible clues on who the suspect in the blast case could have met in Ballari. The NIA took these four men into custody for interrogation after learning that The Rameshwaram Cafe blast suspect had used Ballari as a stop-over point during his escape from Bengaluru.

Minaj alias Md Sulaiman, 26,  Anas Iqbal Shaikh, 23, Shayan Rahman @Hussain, 26, and Syed Sameer, 19, from the Ballari ISIS module were taken into custody for three days to carry out investigations on March 6. They had earlier been arrested in December 2023 during an NIA crackdown on a Ballari ISIS module.

Cracking terror tradecraft a challenge

The investigations into The Rameshwaram Cafe blast case have narrowed down the identity of the suspect captured in dozens of CCTV footage of his arrival and exit from the cafe, as well as his arrival and exit from Bengaluru on the day of the crime, to a missing member from a Shivamogga module of ISIS busted by the state police and NIA between 2020 and 2023.

Abdul Taha Matheen and Mussavir Hussain Shazib, the two missing suspects from the Shivamogga module, have emerged as the main suspects in The Rameshwaram Cafe blast case.

However, the investigators are yet to find evidence of the location of the main suspect or the identities of collaborators in the cafe attack largely because the group adopted secretive communication and identity tactics in the course of operations, police sources said.

Although The Rameshwaram Cafe blast case suspect seems to be using a cell phone at the cafe in the CCTV footage, the probe is yet to find evidence from cell data for the cafe area for the suspect’s cell phone. Sources said the suspect may have faked cell usage knowing that this would be a key clue followed by the police in the probe.

The police also suspect that the group may not have used cell phones with their own identities but would have used other identities or encrypted communication during the operation. Bengaluru police sources said efforts are on to analyse mountains of data for possible clues on communications by the suspect.

The evidence from past cases where the module has been involved — the accidental Mangaluru cooker bomb blast case on November 19, 2022, the Shivamogga bomb testing episode from early 2022 which led to arrests in September 2022, a provocative graffiti incident in Mangaluru in December 2020, and a larger South India ISIS conspiracy case or Al Hind conspiracy from January 2020 — indicate knowledge of terror tradecraft in the group.

Mohammed Shariq, 24, from the Shivamogga module, was arrested on November 19, 2022, after a bomb he was carrying for planting in Mangaluru accidentally detonated on his lap in an auto-rickshaw in Mangaluru moved around with an Aadhaar card of a railway employee from Hubbali.

Shariq also used the fake identity of a person called Arun Kumar Gawli to stay at a boarding house in Coimbatore in August-September 2022 before he was caught following the accidental explosion in Mangaluru. Shariq has told investigators he mistakenly set the timer on the IED for nine minutes instead of 90 minutes resulting in the accidental blast.

The NIA investigations into the Shivamogga module, the Ballari module, and the Al Hind module of ISIS — especially after arrests carried out in Karnataka from 2020 to 2023 of young recruits — have revealed the creation of a network that is being remotely trained by online handlers in the tradecraft of terrorism.

Last year, the NIA told a terrorism court that the suspects from the Shivamogga IS module case were using encrypted communication technology to communicate with the handlers for the larger IS-linked operatives network for South India. “As per the data extracted from the electronic gadgets, the accused persons were using many encrypted communication platforms such as Wire, Wickr-Me, Element, Status, Session, Signal, Protected Text(PT), Telegram, Telegram-X, Graph, etc., and they used the said encrypted communication platforms with an intention to mask their identity,” NIA alleged.

One of the arrested suspects communicated with a handler identified as ‘Colonel’ on the Session communication platform which facilitates the disappearance of chats. However, the suspect saved copies of his chats with ‘Colonel’ on a laptop which the NIA has managed to extract.

The Karnataka Police have identified the handlers of the Shivamogga group as Ahmed Matheen Taha, an engineer and former resident of Thirthahalli in Shivamogga, and a shadowy figure Musavir Hussain Shazib who have been missing since 2020 and were linked to an ISIS plot in 2020 by the NIA and the Karnataka police.

In the course of the NIA probe into the 2020 Al Hind module case spanning Karnataka, Tamil Nadu and Kerala, where Ahmed Matheen Taha and his Shivamogga associate Musavir Hussain Shazib are also accused, the NIA said Taha “has good knowledge in the field of information technology” and helped others contact remote handlers on encrypted platforms. One of the online handlers of the Al Hind group was known to the group only as “Bhai”.

Main suspects in The Rameshwaram Cafe blast case

Taha and Shazib are key suspects in The Rameshwaram Cafe blast case with the scanner on Shazib on account of his close resemblance to the suspect seen in CCTV footage and on account of Taha being identified as a bald man. He was part of a radical-minded youth group that emerged in the Thirthahalli region of Shivamogga between 2013-2016. “Taha and Shazib were believed to be operating from a location outside India until now,” a police source said.

The probe in the case based on CCTV analysis on the movement of the suspect towards the cafe after boarding a bus in Southeast Bengaluru and his escape after planting the IED by using buses going to North Bengaluru, on March, 1 has provided a fair idea of the suspect’s travel path, stopovers and identity, sources said.

The probe via CCTV analysis has found that the suspect travelled towards Ballari and probably further towards Kalaburagi. It is yet to be ascertained how the suspect arrived in Southeast Bengaluru on the morning of March 1.

On March 8, the NIA released two CCTV clips of the suspect from the Rameshwaram Cafe blast, including one at the Ballari bus stand, and on March 9 it released a few images of the suspect during his escape as part of a request for information on him.

The IED used in The Rameshwaram Cafe blast is very similar in the detonation system and materials used to the cooker bomb that accidentally detonated in Mangaluru on November 19, 2022, while it was being ferried by the Shivamogga ISIS module member Mohammed Shariq. It also matches with efforts made by the module to carry out test blasts in Shivamogga in 2022.

Karnataka and Tamil Nadu linkages

With the NIA leading the investigation, the agency is looking in-depth into the role of inter-linked IS modules in Karnataka and Tamil Nadu. The Mangaluru bomb blast suspect from the Shivamogga IS module Mohammed Shariq is known to have spent nine days in Coimbatore at the end of August 2022 and in early September 2022.

The NIA has been investigating possible links between Shariq who was injured in the accidental blast on November 19, 2022, and Jamesha Mubeen, 25, a Tamil Nadu man who was killed in a blast in a car on October 23, 2022, near a temple in Coimbatore.

There are indications the man involved in the Coimbatore case and that in the Mangaluru case were in groups on encrypted messaging apps like Telegram, Wire, Element and Signal and were possibly connected initially through these groups, police sources said.

NIA probe into Karnataka, Tamil Nadu IS modules

The key missing suspects in The Rameshwaram Cafe case, Abdul Matheen Taha and Musavir Hussain Shazib, from the Shivamogga module are also accused in a case filed in Bengaluru in 2020 by the local police for the creation of an ISIS-inspired terrorist gang with members from Kerala, Tamil Nadu, and Karnataka called the Al Hind module.

The alleged IS-linked recruitment and radicalisation plot emerged in December 2019 after the Tamil Nadu Police began a hunt for the IS-linked Khaja Moideen from the state who disappeared despite being undertrial for two terrorism cases — the murder of a right-wing leader and recruitment of youths on behalf of the Islamic State.

Moideen was accused by the NIA in 2017 of involvement in an Islamic State recruitment case along with Haja Fakkrudeen, a Tamil Nadu man alleged to have travelled to Syria from Singapore in 2014 to join the Islamic State.

In a chargesheet filed in March 2018 in Tamil Nadu, the NIA said Moideen “knowingly and wilfully assisted Haja Fakkurudeen in joining the ISIS/ISIL/Daish in Syria” in January 2014.

“Haja Fakkurudeen (A-1) visited Chennai three times during a short span of three months in late 2013 and conducted conspiracy meetings at Chennai, Keelakarai in Ramanathapuram district and Parangipettai in Cuddalore district of Tamil Nadu besides at R T Nagar in Bangalore, along with co-accused Khaja Moideen (A-2),” and others “with the intention of recruiting the other accused persons to ISIS/Daish” the NIA said in a statement in 2018.

On January 9, 2020, the Delhi Police Special Cell reported the arrest of Moideen and two of his associates Abdul Samad and Ali Nawaz in the national capital.

No claimants for The Rameshwaram Cafe blast

No group has claimed responsibility for The Rameshwaram Cafe blast case. In 2022, after the accidental blast in the auto-rickshaw in Mangaluru, a group calling itself the Islamic Resistance Council claimed to be behind the suspect Mohammed Shariq from the Shivamogga IS module.

“Although this operation didn’t meet its objectives we still consider it a success from a tradecraft and tactics point of view as the brother in spite of being wanted and being pursued by the state and central agencies was not only able to successfully evade them but even prepared and mounted an attack,” said a message released by the self-styled IRC in 2022. “We are only responding to the worst form of state terrorism,” the IRC note said.

The police said the IRC is a fake organisation with no prior history of activities in Karnataka.