Galileo spyware, ISI claims: Conspiracy in Assembly bomb threats

A fresh threat email sent to Delhi Assembly Speaker Vijender Gupta on April 14 claimed that five RDX bombs would be detonated inside the Delhi Assembly within two hours and alleged that Pakistan’s intelligence agency ISI had tested bomb detection systems (BDDS) at the premises the previous day. The email, sent from the address sourav_biswas1@outlook.com in the name of Sourav Biswas Khan, warned: “Ignore at your own risk.”

The email, written in Hindi and addressed personally to the Speaker, went beyond a simple bomb threat. It alleged a conspiracy involving Pakistan’s ISI and a political party, claimed the sender had access to confidential police intelligence reports, and named specific individuals, including a retired IPS officer from Tamil Nadu.

The email claimed that spyware called “Remote Control Systems (RCS) Galileo,” purchased from an Italian company called “Hacking Team,” was being used by Pakistan’s representatives in Coimbatore to obtain confidential daily situation reports issued by police. It alleged that the software was being used for blackmail. The email concluded with a direct message to the Speaker: ‘Do not think that you can ever catch us. Now you only have one thing to do. Run.”

This is the sixth bomb threat email received by the Delhi Assembly since the Budget Session last month. On Monday, April 13, a separate threat email claimed that 15 RDX bombs laced with cyanide gas would be detonated within three hours and demanded the evacuation of Muslim employees from the premises.

Another email on the same day claimed 16 RDX-laden improvised explosive devices had been planted inside the Assembly, with a warning of detonation at 1:40 PM. Security agencies evacuated the building and conducted thorough checks. Nothing suspicious was found.

Three threat emails were received during the Budget Session itself, on March 23, 24, and 25. All were found to be hoaxes after thorough police checks. Officials said the sender of earlier emails was allegedly traced to Coimbatore and had cited political grievances, and efforts to verify the authenticity of all threats are ongoing.

The wave of threats has spread beyond the Assembly. On Wednesday, Lok Nayak Bhavan near Khan Market also received a bomb threat email, following which the building was evacuated, and teams, including dog squads, bomb disposal units, and fire services, were deployed. Police said nothing suspicious was found, and searches continued.

Speaker Gupta has written to Delhi Police Commissioner Satish Golcha seeking urgent action. In a letter dated April 15 to Delhi Police Commissioner Satish Golcha, the Speaker described the threat as a matter of grave concern, noting that it was the first time such an email had directly addressed him by name. He said the message originated from the email address sourav.biswas1@outlook.com and contained references to alleged links involving Pakistan’s ISI.

Gupta pointed out that the email was received while the Assembly premises were hosting celebrations for the birth anniversary of Dr BR Ambedkar. He said the timing of such threats appeared aimed at disrupting key proceedings and official events of the Assembly.

He also noted that earlier emails were received during the Budget Session, suggesting a pattern intended to interfere with legislative functioning. The Speaker wrote this letter to the Delhi Police Commissioner in continuation of his earlier communication dated 13th April 2026, following the receipt of the bomb threat mail on Monday.

The repeated threats come in the backdrop of a serious security breach at the Assembly on April 6, when a car with a Uttar Pradesh registration rammed through Gate No. 2, drove to the Speaker’s porch, and left a bouquet and garland before fleeing. Three suspects were subsequently detained.

“The repeatedly received threat emails not only hamper the smooth functioning of the Assembly but also instil a sense of fear among the staff working there,” the Speaker said.

“The Delhi Legislative Assembly is a very important democratic institution, and any threat to it is a threat to the democratic system itself.” Investigation into the source of all threat emails is underway.