India’s counter-terrorism and counter-intelligence architecture has undergone a marked transformation over the past decade under the leadership of Prime Minister Narendra Modi and Home Minister Amit Shah. The government asserts that terrorism has been significantly controlled through a combination of identifying terrorist groups, strengthening intelligence coordination, and undertaking calibrated cross-border military responses against Pakistan. At the heart of this shift lies a renewed emphasis on counter-intelligence (CI), a domain that was earlier considered under-prioritised but is now central to India’s national security doctrine.
Since assuming office as Home Minister, Amit Shah has consistently highlighted the importance of counter-intelligence as a strategic pillar. The focus has been on dismantling espionage networks, monitoring foreign intelligence agencies, and strengthening institutional coordination. Government sources indicate that foreign intelligence operations within India are now being systematically tracked, assessed, and neutralised through proactive measures. This marks a departure from earlier approaches, where scrutiny of external agencies such as Pakistan’s Inter-Services Intelligence and China’s Ministry of State Security, along with Western intelligence actors, was comparatively limited.
Strengthening counter-intelligence and institutional coordination
India’s evolving intelligence ecosystem is anchored in a network of specialised agencies working in tandem. The National Investigation Agency (NIA) plays a central role in investigating terror-related cases under the Unlawful Activities (Prevention) Act (UAPA), maintaining a reported success rate of around 95 percent in cases it directly handles. The Intelligence Bureau (IB) manages internal intelligence and operates the Multi-Agency Centre (MAC), which enables real-time information sharing across agencies.
Externally, the Research and Analysis Wing (R&AW) monitors foreign intelligence activities and cross-border espionage threats. Border-focused forces such as the Sashastra Seema Bal (SSB), which secures the Indo-Nepal border, have become critical in detecting infiltration attempts linked to Chinese intelligence networks. State police forces in Andhra Pradesh, Maharashtra, Uttar Pradesh, and Punjab have also emerged as frontline actors in early-stage intelligence operations. Additionally, the Border Security Force (BSF) and army units provide operational support in areas where terrorism and espionage intersect.
Expanding Threat Landscape: From borders to internal networks
Government assessments suggest that India’s security challenges are no longer confined to its borders. Instead, threats have evolved into complex, multi-layered operations involving both external and internal actors. Foreign intelligence agencies have attempted to infiltrate sensitive military zones using forged identity documents, while also deploying surveillance technologies within high-security establishments. Pakistan’s ISI, Chinese intelligence networks, Bangladeshi terror groups, and even Western intelligence entities are reported to have pursued strategic objectives within India. These include espionage, surveillance, recruitment of local assets, and attempts to access classified defence information. However, Indian agencies have successfully thwarted several such operations, leading to arrests of foreign agents and illegal infiltrators.
A discernible pattern has emerged over the past decade. ISI-linked espionage activities have expanded beyond Jammu and Kashmir, with technical surveillance detected in areas such as Delhi Cantonment. The Visakhapatnam naval espionage case, which led to multiple arrests, highlighted the vulnerability of maritime installations. Similarly, intelligence inputs indicate that China has been conducting a sustained and systematic intelligence campaign through Nepal, leveraging geographical and administrative vulnerabilities.
The Indo-Nepal corridor and document fraud networks
One of the most critical vulnerabilities identified by Indian intelligence agencies is the Indo-Nepal border. This region has emerged as a key transit route for foreign operatives due to its relatively porous nature. Chinese intelligence agents, ISI-linked operatives, and Bangladeshi terror recruits have all used this corridor to enter India. A common operational method across these networks is document fraud. Agents have been found using or fabricating Indian identity credentials, including Aadhaar cards, voter IDs, and passports, to establish legitimacy within the country. This tactic allows them to operate undetected while gaining access to sensitive locations and networks.
The scale and consistency of such cases between 2022 and 2025 indicate a coordinated effort rather than isolated incidents. From individuals posing as Buddhist monks in Delhi to operatives filming military installations near the Bihar border, the evidence points to a structured intelligence campaign targeting India’s defence infrastructure.
Foreign espionage cases and counter-intelligence operations
Several high-profile counter-intelligence operations in recent years illustrate the depth and complexity of these threats. In one of the most significant cases, Van Dyke, founder of the private mercenary outfit Sons of Liberty International (SOLI), was arrested at Kolkata airport on March 13, 2026. Along with six associates, Hurbba Petro, Sylviak Taras, Ivan Sukmanovsky, Stefankin Marian, Honcharuk Maxim, and Kamensky Viktor, he was detained for training armed groups in Myanmar. According to the NIA chargesheet, these groups had links with banned Indian insurgent organisations and were being trained in drone operations, assembly, and jamming technology. All seven individuals were remanded to judicial custody under Section 18 (terrorist conspiracy) of UAPA.
In another case, the Delhi Police Special Cell arrested Pakistani spy Ansarul Mian Ansari on February 15 while he attempted to flee to Pakistan via Nepal. Trained in Rawalpindi, Ansari had collected classified Indian Army documents and was tasked by the ISI to transfer them via digital media. Investigations revealed that he was recruited while working as a taxi driver in Qatar. A joint operation by central agencies and Delhi Police confirmed the authenticity of the recovered military documents. The ISI’s surveillance operations have also grown more technologically advanced. Authorities uncovered a network of solar-powered, SIM-enabled CCTV cameras installed at strategic locations such as Delhi Cantonment Railway Station and Pune Railway Station. These devices transmitted live footage directly to ISI handlers in Pakistan via encrypted communication platforms. The plan reportedly involved deploying over 50 such cameras nationwide before being dismantled by Uttar Pradesh Police and central agencies, leading to 15 arrests.
Chinese intelligence operations and covert networks
Chinese intelligence activities have demonstrated a high degree of sophistication and patience. Multiple cases reveal attempts to infiltrate India using false identities and covert networks. Two suspected Chinese agents, Wu Hailong and Zeng Jun Yong from Liaoning province, were arrested near the Indo-Nepal border in Bihar’s Madhubani district without valid travel documents. Their devices contained anti-India and pro-Khalistan content, raising concerns about coordinated psychological and informational operations.
In May 2024, another Chinese national was arrested along the Indo-Nepal border with images of military installations and evidence of travel to Pakistan. This reinforced suspicions of cross-border intelligence collaboration. Similarly, three Chinese nationals arrested in 2023 were found using fake Nepali identities and fraudulent Indian passports, suggesting the involvement of local facilitators and corrupt officials.
One notable case involved Wang Goujun, who entered India via Nepal without a visa and visited sensitive institutions in Delhi before being detained at the Gaurifanta border. He was charged under Section 121 of the Indian Penal Code, an unusually severe provision in espionage cases, indicating the seriousness of his activities. Another case exposed a deep-cover operation involving Kai Ruo, a Chinese national who lived in India under the alias Dolma Lama, posing as a Nepalese Buddhist. His inability to speak Nepali raised suspicion, leading to his arrest in October 2022. Investigations uncovered forged identity documents and confirmed espionage-related activities.
Domestic networks, terror links and intelligence successes
Indian agencies have also dismantled domestic support networks linked to foreign intelligence. In Noida, police uncovered a covert Chinese coordination centre operating in Gharbara village. Around 20 Chinese nationals were found residing illegally, with equipment used to manufacture fake identity documents, including Aadhaar cards and voter IDs. The operation revealed links spanning Uttar Pradesh, Gujarat, West Bengal, and northeast India.
Pakistani national Mir Balaj Khan was identified as the mastermind behind a naval espionage ring that leaked sensitive information about the Karwar and Kochi naval bases via social media. The case, initially registered by the Andhra Pradesh Counterintelligence Cell in 2021, was later taken over by the NIA, leading to arrests across multiple states.
In another significant operation, the NIA arrested two operatives of Jamaat-ul-Mujahideen Bangladesh (JMB) in Bhopal in August 2022. Investigations revealed that they had entered India illegally and were planning terrorist activities while communicating through encrypted platforms. A chargesheet was subsequently filed in a special court.
Evolving intelligence capabilities and persistent threats
India’s counter-intelligence framework has become more operationally precise, legally robust, and globally integrated. Agencies are now better equipped to detect, intercept, and neutralise threats across multiple domains, including cyber, surveillance, and human intelligence. However, the threat landscape continues to evolve. Pakistan is increasingly relying on advanced surveillance technologies, while China is expanding its cross-border intelligence footprint. The northeast region remains vulnerable to foreign mercenary networks, and the Indo-Nepal corridor continues to pose structural challenges.
Despite these complexities, Indian intelligence agencies remain focused on safeguarding national security, protecting sensitive information, and countering both state-sponsored and non-state threats. The pattern of recent operations indicates a sustained and proactive approach aimed at neutralising adversaries before they can establish deeper networks within the country.
