A low intensity blast on a Bhopal-Ujjain passenger train on Tuesday morning led to initial claims that this was the “first ISIS attack” in India, a reference to the Islamic State, the Syria-based terrorist organisation. However, this claim was soon downgraded, and the blast was blamed on a “self-radicalised” group.

Intelligence officials have been expecting an attack by the Islamic State-Khorasan Province – an outfit in Afghanistan that swears allegiance to the Syria-based extremist group – for months. So when news of the train blast first reached intelligence officials, it seemed possible that the attack was linked to that terrorist group. However, as investigations progressed, investigating officers were unable to find evidence to back up their initial suspicions, leading to frustration among intelligence officials. Clearly, this wasn’t the attack they had been warned about.

Tenuous linkages

For over a year, Indian intelligence analysts have been receiving inputs about the growing presence of the Islamic State-Khorasan Province, and its plans to target India.

A few years ago, a few young men from Hyderabad were intercepted on the Indo-Bangladesh border while attempting to cross over to Bangladesh. Based on their revelations after interrogation, Bangladeshi intelligence authorities picked up a man in Dhaka who is claimed to have confessed that the intercepted men were heading for Khorasan Province in Afghanistan via Bangladesh and Pakistan. Similarly, a group of 21 men and women from Kerala, who disappeared last year, are believed to have joined the Islamic State in Afghanistan.

The growth of the Islamic State-Khorasan Province and its linkages with Pakistan have worried Indian security officials for months. Government insiders said that the top American military commander in Afghanistan, General John Nicholson, has also accepted that the Afghanistan branch of the Islamic State has been growing, as more Pakistanis from Punjab sign up.

On Tuesday, when the Madhya Pradesh police was alerted about the low-intensity train blast that took place in the morning, they began to pore through closed circuit television camera footage and cell phone call records looking for clues. By afternoon, the Intelligence Bureau alerted them about possible suspects trying to make their way through Hoshangabad district in Madhya Pradesh. The police finally intercepted and arrested the three men – Danish Akhtar, Syed Mir and Atif Muzaffar – near Pipariya in Hoshangabad district. After hours of interrogation, one of them is reported to have told the police about other members of their group who were based in Uttar Pradesh.

“We are still investigating the links to the IS [Islamic State], but we don’t have any clear indications between these men and those abroad,” a senior intelligence official told this reporter. “We found some tentative links when they tried to connect with some known recruiters of the IS who are abroad, but we haven’t been able to establish them fully. But this looks similar to the Gulshan attack case in Dhaka, Bangladesh, where the young men had met the IS recruiters online.”

Following the train blast, intelligence officials were also intrigued by the silence from Amaq, the official news outlet for the Islamic State, as well as on encrypted channels like Telegram, believed to be the preferred channel of communication for the extremist organisation. Attacks by the Islamic State or its followers usually lead to some kind of chatter on these channels. On Wednesday, there was a much bigger attack in a hospital in Kabul in which 49 people were killed. The Islamic State claimed credit for this attack via Amaq.

“Unlike the Gulshan attack when Amaq released images of the young men within hours of the attack, no such claims came forward after the Bhopal blast,” said the senior intelligence official. The police just found a hand-painted IS [Islamic State] flag from the house of Mohammed Saifullah, who was killed in the encounter by the UP Anti-Terrorism Squad [in Lucknow on Wednesday]. These raise doubts about the affiliations of this group with either the IS [Islamic State] or the IS-KP [Islamic State-Khorastan Province].”

A new Indian Mujahideen?

In the early years of Al Qaeda, many analysts were confused by the terrorist organisation’s seeming omnipresence across continents. Much later, after the 9/11 attacks on the US, intelligence officials began to realise that Al Qaeda was a body of loosely-connected individuals who converged on ideology, but shared very little in terms of resources or an organisational structure.

By 2006, as the Indian Mujahideen emerged from the banned Students Islamic Movement of India, it created fears of a new “home grown” terror organisation that could strike at will. The emergence of the current group seems akin to what the Indian Mujahideen was until the infamous Batla House encounter in Delhi delivered a death blow to the organisation.

“We believe that this group is part of a federated organisation, where they may not be connected in terms of finances or logistics, but are keen to shape a single identity because that helps everyone” said a senior security professional who has had years tracking terrorism in India. “We believe that like the IM [Indian Mujahideen], we may be seeing smaller groups emerging, who may not be formally connected, but will have similar points of angst and radicalisation.”

Indian intelligence officials also point to the fact that while the Indian Mujahideen was disbanded after repeated encounters and arrests, those who fled abroad continue to operate out of Afghanistan and have joined the Islamic State-Khorastan Province.

The senior security official added: “The inputs we have so far indicate that those same people are getting in touch with a new generation of young men and women, aiding them to sign up for the IS-KP [Islamic State-Khorastan Province], even if it doesn’t mean any formal association.”

By Thursday, with help from the Intelligence Bureau, the Uttar Pradesh Anti-Terrorism Squad also picked up Ghaus Khan – a former corporal with the Indian Air Force who had taken voluntary retirement in 1993 – in connection with the train blast. Ghaus Khan reportedly told his interrogators that he had been inspired by the speeches of Delhi-based cleric Mufti Abdus Sami Qasmi, who the National Investigation Agency arrested last year. Apparently Qasmi’s provocative speeches about the rise of the Islamic State caliphate in India seems to have been the trigger for Ghaus Khan to raise a group of extremists in India.

Crude country-made pistols were recovered from the house in Lucknow that Saifullah was killed in. This is offered as further proof that the train blast was conceived of by a local group with little or minimal international linkages.

However, there is a growing fear that increasing communal polarisation in India will continue to fan extremism as more groups choose violent means to strike back against perceived wrongs.