How a young man hacked the Mumbai Police website, became notorious, and got caught

In early June 2001, I started receiving anonymous calls from someone who sounded like he could not be more twenty-two years old. He never told me his name and every call was to inform me about his hacking achievements. Sometimes he would say he had hacked websites in other countries or institutions to show how vulnerable they were to cyberattacks. I could tell he was passionate about establishing himself in the digital world the way I wanted to make it big in journalism, and I felt a strange sense of connection to him.

Though none of this was printable, I nurtured him as a source, anticipating that he would be useful to me some day. Neither of us insisted on meeting each other, but we kept in touch over the phone and at times discussed his motives for hacking.

But what brought us closer was something beyond my wildest imagination.

One evening, a call on my office landline became a turning point for my career. It was him. But his voice sounded different. There was a mix of excitement, fear and anxiety in his tone, and it was obvious that he had done something big. “I hacked the Mumbai Police’s website,” he said.

Now I was scared because I could possibly be considered an accomplice.

I said, “Abey, bahut marenge tereko, tu ghar pe bola kya” (They will beat the hell out of you. Did you tell your family)? I had hoped he was kidding, but he replied, “You think this is a joke? I am very serious. Go to their website and you will see that their homepage is disrupted.”

I immediately logged in and saw that the homepages of two sites – cybercellmumbaicity.com and www.ccicmumbai.com – displayed the Information Technology Act and other laws pertaining to IT Act violations. He wanted to call out the cops for letting their guard down.

The young ambitious journalist and the idealistic young citizen in me were in a tussle. This would be my biggest scoop till date if I reported it. I was torn between writing about it and reporting it to the police. He probably sensed my indecisiveness because he hung up saying he would call back in fifteen minutes.

I rushed to my editor’s cabin and discussed the story with him. We decided to persuade the caller to meet and I would record the interaction on a phone camera. I would also carry a pen camera as I anticipated that he wouldn’t let me take his picture. We would take a call later on whether to identify him or not.

I went back to my seat and waited for his call; I wasn’t sure if he would call me back. But exactly fifteen minutes later, the phone rang again. This time, he sounded more confident. I made my request to meet him, but he hung up, thinking that it was a set-up for the cops. Before he could cut the call, I managed to tell him, “I am as hungry for this story as you are for glory in the cyber world, so please have faith in me and give me an opportunity to meet you once.” But he did not give in.

I lost my cool and banged the phone down, startling the entire office. “What’s wrong with you?” a colleague sitting next to me asked in an irritated tone. I preferred to ignore her and walked out for a break.

I had never anticipated that I would lose the story so easily.

At that time, it felt like I had lost the one opportunity to kick-start my career. I was most upset that I had not been able to convince him.

When I returned, a colleague told me that someone had called and left a message that he would call back again in a few minutes. “Did you ask his name?” I asked. The caller had just replied saying that it was an important call. I heaved a sigh of relief. It had to be him. And I was right. The hacker called me back.

“I am talking to you only on one condition. You will not mention my name. I want you to come alone near Kabutar Khana in Dadar. I will see you in exactly one hour,” he said, referring to the pigeon-feeding square in Mumbai’s central neighbourhood.

“But how do I recognise you? Can I have your number?” I asked.

“Once you reach the spot, I will give you a call and give you further instructions,” was his reply.

It seemed like he had learnt his moves from films. I informed the office and rushed to Dadar without wasting any time. It took me less than half an hour to reach the spot. I kept looking at the people passing by and saw him in every young boy that walked past me; I even tried to make eye contact with some.

Exactly an hour after the last conversation, I got a call on my mobile number from a landline number. From where I stood, I could see three public call office (PCO) booths, of which two were busy. One was occupied by a middle-aged man while the other had a younger boy. I was sure the latter was the one I was looking for.

The hacker asked me what I was wearing.

On hearing my response, he cut the call. The young boy also put down the phone. The boy then began walking straight in my direction. As I raised my hand in greeting, someone tapped me on my back and said, “I am the one you are looking for.”

I turned around and saw a six-foot-tall plump boy standing behind me. He was wearing a green T-shirt with beige three-fourth pants. He kept looking around shiftily to make sure there were no cops nearby. I assured him and asked him to relax. “Let’s go to a more secluded place and talk, this spot is not safe,” he said and led me towards one of the smaller lanes in Dadar.

He still refused to tell me his name. “I am going to be Dr Neurkar for you, you don’t have to know my real name. Let’s keep it that way,” he said. I learnt later that his pseudonym was inspired by Dr Neurkar of G-Force, the world-renowned hacker.

Though he was extra cautious about scanning our surroundings for danger, he missed the pen camera in my shirt pocket. At that time, the pen camera was not very common.

Once we sat down outside a shuttered shop, he revealed a few more details about himself, telling me his larger circle of friends was also responsible for hacking the Mumbai Police’s website.

“And your motive?” I asked him.

“What kind of training are these officers getting when they cannot protect their own online properties? How will they protect the sites of others? Only passing the Indian Police Service exams is not enough for these guys, they should also be aware how to prevent cybercrimes in Mumbai. They must keep up with the times. The agency that is fighting for justice for the victims of cybercrime has to first secure itself,” he explained.

“If you notice the trends in the US and European countries, crimes on the Internet are far more complicated. We only want them to take this as a lesson,” he said, as if he was doing some kind of service to the police department.

The hacker said that he was part of a thirteen-member team called G-Force.

Other members on the team were Da Libran, Lil_dvil and The_anaylizer, all of whom were Indians. Seven of the members were Pakistani nationals while the remaining two were Russian. All members were in constant touch with each other over the Internet and worked as security advisers to companies abroad.

“Have you considered sharing this with the police?” I asked.

He snubbed me and said, “Do you think they would agree that the team that is manning one of the first cybercrime cells in the country is incapable of handling the cases? They would never do that,” he added.

“Any fear of consequences?” I asked.

“I have to take this gamble. If the police force is sporting enough to take criticism and improve their ability to deal with what is anticipated in the future, it will benefit the city,” he said.

After chatting for almost two hours, the hacker sensed that I could be trusted. He agreed to get in touch in the next two or three days. But the deal was that he would call on my landline and start with the secret code: “Dr Neurkar of G-Force.”

Gauging that he was comfortable talking to me, I requested him to give me a photograph of himself without revealing his identity. Though he refused flatly initially, he agreed after I persisted. He allowed me to take a picture where his back was to the camera. “Boss, I am taking a big risk trusting you. I hope you will not break my trust,” he added. He was still unaware that our entire conversation was being recorded.

I was in two minds now. The innocence I had seen in his eyes made me feel guilty about exposing his identity, but my newspaper had given me clear instructions to get him on tape. Sometimes my profession demands things that the heart doesn’t support. I reached office and sat at my desk. It was now very close to the deadline and my editors worked with me to figure out how to position the story.

They bombarded me with questions. “How did the interview go?” “Who is this man?” “How old is he?” Had I managed to catch him on camera? I connected my pen camera to the computer to view the footage. Strangely, the video had not been recorded due to a technical snag, but I still had an audio recording.

My editor yelled at the top of his voice when he found out what had happened. “Useless, ch****a, g****u! You missed the golden chance. What is the point of running the story now? We don’t have a face for the man who is throwing a challenge to the cops to come and arrest him,” he said.

The pressure was mounting as the deadline approached.

I thought I would lose my job soon after beginning my career. After a minute of pin-drop silence, I gathered courage and told my city editor, Lajwanti D’Souza, that I had a photograph of the man’s back.

“Okay, let me talk to him (editor) and figure things out,” she said and walked into the editor’s cabin. After a brief chat, she came out and hurried towards me. We would carry the story with the photograph. When I called the cops for their side of the story, they maintained that their in-house hackers had penetrated the site for an experiment. This did not explain the changed homepage, a classic hacker trademark. The police also claimed that the hacking was over, but the site hadn’t been fully restored till early next morning.

When the story broke, it was everywhere. Every newspaper had reported the news about the police website being hacked, but we outshone the others with the interview of the hacker. I still remember that a senior reporter from a rival newspaper who I could barely stand approached me to offer his congratulations. However, he tried to mask it by talking about the layout of the story and not the content.

In just a few hours of the issue reaching the newspaper stands, I was chased by almost every news channel and multiple police officers who wanted to know where they could find the hacker. I received close to a hundred calls, inquiring whether I would share the number of the hacker.

Senior officers of the Crime Branch, who usually made me wait outside their cabins for hours for one quote, called up and requested that I visit them for tea. A deputy commissioner of police, who I had known for a while, wanted the hacker to surrender and asked me to convey the message to him.

But I was firm. I had betrayed the hacker enough and could not expose him any further. He had not wanted publicity. His “social service” was highly misunderstood by the police, as he had anticipated.

The cops were under tremendous pressure to trace the guy.

The Cyber Cell traced the hacking to an Internet café in Dadar. They arrested the owner, Pradeep Yadav, and a hardware engineer, Jagdish Sabnis, who had no clue about the hacking. In those days, the cafés maintained no records of visitors, making it more difficult for cops. The city also had no CCTV surveillance.

I was sure the cops would have no option but to tap my personal numbers. After a while, I decided to use only the office landline phones as it is difficult to receive permission to tap landlines of newspaper organisations.

Soon after the story was published, I was advised by my office legal team to stop communicating with the hacker. Almost a week after the story broke, the hacker called me on the landline. “Dr Neurkar of G-Force. The two arrested have nothing to do with the case, they have been framed,” he said.

The police had claimed that they had concrete evidence against the duo and that one of the accused had already confessed. The two arrested were detained under various sections of the Information Technology Act and several sections of the Indian Penal Code. They faced a minimum sentence of three years.

“I called the senior police inspector of the Cyber Crime Cell, IM Zahid,” the hacker continued.

“Why would you do that?” I asked.

“I asked him, ‘Pakad rahe ho ya nahin’ (Are you going to arrest me or not)?” he replied.

“What! Are you out of your mind?” I said.

He gave me Zahid’s cell phone number as proof and then abruptly disconnected our call. We published another story about him, claiming that he had mocked the cops about arresting him. The day the story was published, the pressure on the cops increased.

It turned out that this call would set off Neurkar’s downfall. He had dared to do something that even hardcore criminals and gangsters would not think of doing.

In a closed-door meeting, the then joint commissioner of police, Bhujangrao Mohite, involved other units of the Crime Branch in tracing this man. This meant that almost half a dozen police units were desperately looking for him. The officers were instructed to find him in a week’s time. It was a matter of prestige and every officer in the unit wanted to be the one to solve the case.

Three computer experts, part of the Mumbai Police’s advisory committee, were also called in: Internet guru Vijay Mukhi, and ethical hackers.

In less than a week, the Crime Branch cracked the case and arrested Anand Ashok Khare, then 23, alias Dr Neurkar and Mahesh Subhash Mhatre, also 23, alias Da Libran. Khare had dropped out of a telecom engineering programme and was a Cisco-certified network associate, while Mhatre was a software programmer.

Excerpted with permission from The Anatomy Of A Sting: An Inside Look Into Undercover Operations, Bhupen Patel, Penguin Books.