Delhi cyber commandos are becoming a new layer of the city’s policing system, working behind screens to trace hoax bomb threats, identify manipulated videos, follow cryptocurrency transfers and convert scattered digital records into investigative leads. Their emergence reflects a wider shift in public safety: crimes that once depended mainly on physical evidence now require specialised capacity to interpret platforms, networks, devices and digital financial trails.
The Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) unit in Dwarka is at the centre of this work. In an interaction with The Hindu, cyber commando Akhil Raj described how investigators examine email records, virtual private networks, cryptocurrency transactions and online content while supporting investigations into complex cybercrime cases. The unit has also worked on hoax bomb threats received in Delhi in 2024 and 2025, as well as misleading and AI-generated videos circulating on social media.
This is not simply a technology upgrade inside the police force. It changes the institutional route through which an urban complaint is investigated. A threatening email, a manipulated video or a digital arrest scam may originate outside Delhi, move through several online services and leave evidence distributed across private companies, internet service providers, cryptocurrency exchanges and blockchain networks. The police response therefore depends on the ability to join information held by different systems and translate it into evidence that conventional investigators can use.
The cyber commando programme was inaugurated in 2024, with 300 personnel trained in its first batch. The Union Home Ministry’s Indian Cyber Crime Coordination Centre, or I4C, selected police personnel from different States through an entrance examination focused on cybersecurity and cybercrime. Those selected underwent six months of residential training at eight centres, including the National Forensic Sciences University and IITs.
Delhi has eight cyber commandos. Their deployment depends on the technical requirements of a case and the skills needed. A commando may assist State police in investigating a ransomware attack on a government system, for example, although the State police remains the first responder. This arrangement creates a division of labour: local police retain responsibility for the initial response, while specialised personnel provide technical assistance where the case exceeds the capacity of a routine investigation.
The structure also shows why cybercrime cannot be treated as a narrow policing problem. The first challenge is often not the absence of a digital trace, but the difficulty of obtaining, interpreting and legally using it. According to Mr. Raj, investigators may approach email service providers for IP addresses, registered contact numbers and alternate email IDs. They may seek records covering six months to a year to establish a sender’s online activity.
That trail becomes harder to follow when suspects use VPNs or the Tor network to conceal their location. In some cases involving free VPN services, a temporary break in the connection can expose an actual IP address. Investigators can then approach internet service providers for further details. The process is dependent on timing, technical knowledge and cooperation from multiple service providers, making the speed and quality of the investigation partly an institutional coordination issue.
The results described by Mr. Raj show both the value and the limits of this approach. Of more than 20 bomb threat cases in which he was involved, the police traced the senders in four or five cases. Three involved school students who, according to the account, used VPN connections in an attempt to postpone examinations. The cases demonstrate that a digital threat can produce immediate disruption in a city even when the sender is not part of a sophisticated criminal network.
The public-safety consequences of such threats are physical as well as digital. A hoax email can trigger searches, security responses and disruption at schools or other institutions. Yet tracing the sender may require months of records, technical analysis and coordination with companies that hold relevant data. The gap between the speed at which a message can cause disruption and the time required to establish responsibility is one of the central operational problems of digital policing.
The IFSO unit’s work has expanded beyond tracing individual suspects. With protests continuing in the capital, cyber commandos have monitored trending keywords and hashtags to identify potentially misleading posts, reels and videos, including content generated using artificial intelligence. When content is flagged, the police send takedown requests to platforms such as X and Meta.
Mr. Raj also described a case involving an AI-generated video of Delhi Police ACP Vivek Bhagat. The police identified the video and initiated legal action against the accused, according to the report. The example illustrates the changing evidentiary environment for law enforcement: investigators must now determine not only who posted content, but also whether an apparently authentic recording has been synthetically generated or manipulated.
Additional Commissioner of Police (IFSO) Sanjay Bhatia said cyber commandos had improved the speed of investigations by helping police personnel map digital trails and connections. He said that work which earlier took weeks to establish could now be mapped in two to four days. The stated benefit is therefore not only specialist expertise, but faster conversion of technical information into an investigative map.
That speed matters because digital evidence can be spread across platforms and jurisdictions, while online content can circulate widely before a response is organised. At the same time, the supplied account does not establish how many cases are resolved through this process, how often takedown requests succeed or how many investigations result in charges or convictions. The available evidence supports a conclusion about increased investigative capacity, but not a broader measure of effectiveness across Delhi’s cybercrime system.
Cryptocurrency investigations present another layer of complexity. In digital arrest scams, stolen money may be quickly converted into cryptocurrency and transferred abroad. Investigators seek information from exchanges used to convert cryptocurrency into Indian currency and request customer information that may help identify those involved. They also examine publicly accessible blockchain records to trace subsequent transfers and establish links between wallets.
This work combines financial investigation with technical analysis. A blockchain may preserve a record of transactions, but connecting a wallet to a person requires information from exchanges, service providers and other investigative sources. Mr. Raj’s description of analysing digital evidence, correlating records and tracing connections shows that the cyber commando’s role is not limited to operating software. It involves building a chain of evidence from separate digital systems.
The institutional need for this capacity is underscored by findings cited from the Status of Policing in India Report 2026, based on a survey by Lokniti-CSDS and Common Cause across 16 States. The report examines the experience of cybercrime victims, the functioning of police and banks, and the factors affecting redressal. The account says that 63% of victims remain dissatisfied with police handling, while satisfaction falls to 43% during investigations. Women and rural victims face additional difficulties, including repeated visits and long waiting times.
These findings place specialised policing within a broader question of access to justice. A cybercrime unit may be able to trace an IP address or a cryptocurrency transaction, but victims still encounter the administrative system through complaint registration, follow-up and investigation. Technical capacity can accelerate a case after it reaches the right team; it does not by itself resolve delays, uneven access or a lack of confidence in the complaint process.
The report also identifies bribery and the use of personal networks as factors examined in the progress of cybercrime complaints. The supplied material says both channels are used more often and appear to work more for victims from marginalised groups. This creates a contrast between two aspects of cybercrime governance: the specialised, highly technical work of tracing digital evidence and the more familiar institutional barriers that shape whether a victim can obtain a response.
Delhi’s cyber commandos therefore represent an important but limited intervention. Their training in digital forensics, cryptocurrency investigations and malware analysis gives the police capabilities that are not available across the force. Their deployment through I4C also creates a mechanism for sharing specialist expertise with State police. But the city’s ability to respond to cybercrime will depend on how this specialist layer connects with first responders, investigators, platforms, financial institutions and victims.
The evidence currently available confirms that Delhi Police is building dedicated expertise and that this has shortened some investigative processes. It also shows that cybercrime redressal remains marked by dissatisfaction and uneven access. The next measure of the system will not be only whether commandos can identify digital trails, but whether that expertise consistently improves the experience and outcomes of people who report cybercrime.
