From invisible life to national probe: Inside India’s first ricin ‘bioterrorism’ case

So, when the police came to search his home days after his arrest on November 7, the neighbourhood suddenly — and rudely — became aware of his presence. “We know there’s a case, because the police came. But we have no clue who the accused is,” a neighbour tells The Indian Express.

Last month, the Gujarat Anti-Terrorism Squad (ATS) handed over what it describes as a bioterrorism case to the National Investigation Agency (NIA). The development came two months after Saiyed and two other men — Azad Suleman Sheikh, 20, and Mohammad Suhail Mohammad Saleem Khan, 23 — were arrested in what is being seen as India’s first bioterrorism plot involving the deadly ricin toxin.

For investigators, the handover marks another turn in a case that took them across four states — Gujarat, Uttar Pradesh, Rajasthan and Telangana — and allegedly led them to uncover a home-grown laboratory, a cross-border weapons-smuggling network, a possible international terror link and an alleged bioterrorism plot. At the centre of it all, investigators say, was Saiyed.

Meanwhile, the family and his lawyer deny the allegations, saying he was “framed and misled”. They also claim that he was “never in touch” with the two others arrested with him.

Items allegedly seized from Saiyed’s home included a barrel of “hazardous” liquid, several chemicals, and six bottles of acetone.

K V Dastoor, Saiyed’s advocate on record, says: “His version has been that he was lured into the business of making castor oil by someone, an unknown someone, who promised him money. In the conversations he has had online with this person he was never instructed to extract ricin. He was not found in possession of ricin.”

The unravelling

Ricin is a protein that can be extracted from the castor bean, grown industrially for castor oil production in countries such as India, Brazil and China, and is fatal to humans even in minor doses. It is listed as a Schedule 1 toxin under the Chemical Weapons Convention — substances that pose the highest risk of being used as chemical weapons.

There is currently no antidote for ricin poisoning. The Organisation for the Prohibition of Chemical Weapons notes that ricin has never been used as a military weapon, although limited weaponisation was achieved during World War II.

There is no recorded instance of ricin being used in a mass-casualty event, either in war by a state entity or for bioterrorism by a rogue actor. However, ricin has previously been used in targeted assassinations, with reports of accidental exposure linked to illegal production, arrests for possession, and the infamous “ricin letters” — packages containing traces of the toxin sent to President Barack Obama in 2013, the Pentagon in 2018 and President Donald Trump in 2020 — all of which were intercepted at the mail-sorting stage.

This, according to experts, is largely due to difficulties in producing it at scale, the lack of an effective delivery mechanism, and the quantity required for aerosolisation — dispersing it into the atmosphere. However, a 2018 case in Cologne, Germany, where suspects managed to isolate ricin before being arrested, offers a rare precedent.

The plot allegedly began to unravel on the morning of November 7, 2025, when Deputy Superintendent of Police S L Chaudhary of the Gujarat ATS received confidential information that Saiyed was in Gujarat with the alleged intention of “carrying out a terrorist attack”.

That set the ball rolling. Police tracked Saiyed’s mobile phone and found that he had driven from Telangana to Gujarat in a silver Ford Figo and would, by evening, reach the Adalaj toll plaza from Kalol. A town between Gujarat’s financial capital Ahmedabad and political capital Gandhinagar, Adalaj is where National Highway 147 forms a bow tie, with the north-western end extending to Kalol and on to Mehsana.

The Adalaj toll plaza, where Saiyed was allegedly intercepted, lies 6 km from Adalaj town and 10 km from Kalol.

Armed with this intelligence, one police team was allegedly dispatched to Adalaj while another tracked Saiyed’s movements. That evening, police stopped and searched the vehicle at the toll plaza, allegedly finding three pistols, 30 live cartridges, and four litres of liquid in a 10-litre plastic jar, later confirmed through forensic tests to be castor oil.

Saiyed, police said, was on his way back to Hyderabad after picking up the weapons from a “dead drop” near Kalol in rural Gandhinagar. A dead drop is a delivery — often illicit — made anonymously to ensure the sender, courier and recipient never meet, making the supply chain harder to trace.

At a press conference on November 9, 2025, Gujarat ATS Deputy Inspector General (DIG) Sunil Joshi said Saiyed had been in contact with a foreign national called Abu Khadija — allegedly known to the suspect as “Aamir” — “to carry out terrorist activities in India”. His alleged handler, Aamir, is believed to be part of the Islamic State of Khorasan Province (ISKP), the Central Asian branch of the militant Islamic State.

While examining Saiyed’s phone, police allegedly found numbers they traced to Sheikh and Khan, both from Uttar Pradesh. Sheikh is a tailor from Shamli, while Khan is a student from Lakhimpur Kheri.

Investigators allege it was these two men who picked up the weapons later found in Saiyed’s car from a dead drop in Rajasthan’s border district of Hanumangarh and brought them to Gujarat. Soon after, the ATS arrested the two men from Gujarat’s Banaskantha district.

When asked about their arrest, an ATS officer declined to comment. At the press conference, however, DIG Joshi said the two men “harboured extremist ideology” and had disclosed during questioning that their handler “had sent the arms consignment to Hanumangarh district in Rajasthan, via a drone across the international border from Pakistan”.

The suspects, he claimed, had planned to use ricin as a bioterrorism weapon. “We believe he [Saiyed] was attempting to isolate the chemical toxin ricin, which is more toxic than cyanide and even a small amount is enough to kill a large number of people. He was developing the toxin at his workshop in Hyderabad and it is in powder form,” Joshi said.

Asked whether the border in Hanumangarh had previously been used as a weapons dead-drop route, IG Vikas Yadav of the Rajasthan ATS denied knowledge, telling The Indian Express earlier: “The Gujarat Police have said what they did, it is their investigation”.

Making ricin using AI

On November 13, days after Saiyed’s arrest, the Gujarat ATS released photographs of items seized from his home, including a blue barrel filled with liquid, several chemicals, and at least six bottles of acetone — an industrial solvent that can be used to extract and purify ricin from castor bean waste mash left after oil extraction. Police also allegedly found several kilograms of castor bean waste mash, an oil press machine, and equipment such as sieves, funnels and a mixer.

According to a senior official, the blue drum contained a “hazardous substance” that was transported unopened to the ATS headquarters in Ahmedabad and then sent to a forensic science laboratory. Officials said the seizures suggested a “home laboratory” and, taken together with the raw materials sourced and Saiyed’s AI searches, indicated that “he was trying to formulate ricin”.

Investigators, however, believe Saiyed had neither successfully isolated Ricin nor identified an effective delivery mechanism. As a result, while forensic reports that came in at the end of December allegedly detected “traces of ricin”, it was found to be mixed with acetone.

Meanwhile, the two other suspects — Sheikh and Khan — were allegedly tasked with scouting locations for possible terror attacks. Police said the men had surveyed at least three sites: the office of the Rashtriya Swayamsevak Sangh in Lucknow, the Agricultural Produce Market Committee (APMC) in Delhi’s Azadpur, and the fruit market in Ahmedabad’s Naroda.

On November 8, 2025, Saiyed, Sheikh and Khan — along with the suspected handler and a wanted accused, Abu Khadija — were booked under sections of the Unlawful Activities (Prevention) Act, the Bharatiya Nyaya Sanhita (BNS), and the Arms Act. Police also seized the arms and castor oil found in Saiyed’s possession, along with four mobile phones, two laptops and the car he was driving.

Subsequent raids allegedly led to the seizure of a black flag with Arabic inscription from Khan’s home. While the ATS has denied finding conclusive evidence linking the three Indian suspects to any terror outfit, the flag — along with a virtual flag found on one of Saiyed’s social media accounts and the suspected affiliation of the foreign handler — has led investigators to probe a possible ISKP connection.

The ATS is also examining literature on how to evade detection that it allegedly seized from Saiyed.

When contacted, a senior officer said all terror cases were transferred to the NIA as a matter of routine. Regarding the flag, an investigator said: “It’s a flag with religious connotation. It has to do with the belief, an interpretation of a hadith (quotes of Prophet Muhammad) that there will be a ghazwa-e-hind (battle in the Indian subcontinent) where the righteous will ride horses and carry black flags. This concept is frequently invoked by multiple terror groups”.

The family of one of the arrested suspects, Sheikh, declined to comment.

Meanwhile, a Hyderabad Police officer says Saiyed appeared to be working alone. “In Hyderabad, there was no one to support him. It’s not a module,” an intelligence source told The Indian Express.

On November 18 — 12 hours after the suspects were transferred to Sabarmati Central Jail in Ahmedabad — Saiyed, Khan and Sheikh were attacked by three inmates inside their cell. The attack took place at 7 am.

According to an FIR in Ahmedabad’s Ranip Police Station, Saiyed was wounded in one eye and required treatment at Ahmedabad Civil Hospital. While the investigation is ongoing, police suspect the men were targeted because they were terror accused. “All three have been moved to a high-security cell,” prison superintendent Gaurav Agrawal told The Indian Express.

The ‘invisible man’

In their house in the by-lanes of Hyderabad’s Fort View Colony — with its low-rise buildings and kirana shops — Saiyed’s family is still struggling to come to terms with what has happened. Originally from Telangana’s Khammam, about 200 km from Hyderabad, the family moved here after Saiyed’s parents separated two decades ago, leaving his grandfather, a government school teacher, to support them.

The eldest of six siblings, Saiyed studied medicine in China. He got married in 2021 but later separated from his wife.

At the family home, his younger brother describes a different man: a loving and responsible sibling, warm, gentle, affable and studious, whose online medical consultations were a major source of income for the family.

“He was ordinary, like anyone else in the neighbourhood. He was [frequently] seen reading books and manuals of medical research,” his brother said. “Anyone in our family and friends’ circle would say he cared about everyone, regardless of their religion. We just can’t believe that this [radicalisation] is possible.”

The family believes he was framed by someone he trusted. “He went to Gujarat for a business deal. We did not know anything more about this,” the brother said, adding: “We don’t think he is capable of plotting a terror strike.”

His lawyer, K V Dastoor claims this was a case of a person being “lured with money”, and that Saiyed had “no idea” of the weapons and cartridges found in a “sealed case” in his possession.

“He thought he was doing the business of castor oil for money and repeatedly asked the person who lured him about payment. But he was given different tasks for which he was not paid. He was desperately doing those tasks as he was waiting for his payment.

But the arrest and subsequent raids have left the neighbourhood uneasy. In one corner, a group of youngsters stood chatting quietly. Mention the case, and the conversation stops. “We too are curious to know what happened,” a lanky 20-year-old said after a pause. “We can’t believe there was a terrorist in our midst.”