The Indo-Nepal border has become the single most exploited entry corridor
As foreign powers grow more patient and precise in their methods, India finds itself navigating a quiet war fought not on open battlefields but through forged documents, disguised cameras, and borrowed identities. Under the current government's sharpened focus, counter-intelligence agencies have moved to dismantle networks linked to Pakistan, China, Bangladesh, and Western private military actors — each exploiting different seams in India's vast and porous geography. The arrests and convictions accumulating since 2022 tell a story not merely of individual spies caught, but of a nation reckoning with the depth of its exposure and the cost of long neglect. What is being built now is not just a response, but a doctrine.
- Foreign intelligence services — from Pakistan's ISI to Chinese operatives and Bangladeshi terror networks — have been running simultaneous, coordinated infiltration campaigns inside Indian territory, some for years before detection.
- The Indo-Nepal border has emerged as the single most exploited corridor, used by Chinese agents with fake Nepali identities, ISI-recruited Nepali nationals, and Pakistani spy networks moving classified military documents across the frontier.
- Document forgery has become the operational backbone of nearly every foreign network uncovered — fake Aadhaar cards, fraudulent Indian passports, and fabricated identities enabling deep-cover agents to embed themselves in Indian cities for extended periods.
- India's National Investigation Agency now maintains a 95 percent conviction rate in cases it handles directly, and the Intelligence Bureau has received substantial budget and recruitment expansion under Home Minister Amit Shah.
- Despite measurable gains, the threat is accelerating in sophistication — Pakistani networks are deploying solar-powered SIM-equipped surveillance cameras at military installations, while foreign mercenaries are conducting drone training for insurgent groups along India's northeastern borders.
India's security establishment has made counter-intelligence its defining mission, dismantling foreign spy networks that previous governments largely left undisturbed. What recent operations reveal is not a collection of isolated incidents but a portrait of coordinated, patient infiltration — Pakistani surveillance networks at military installations, Chinese operatives crossing the Nepal border under false identities, and Bangladeshi terror operatives embedding themselves in Indian cities through forged documents.
The breadth of exposure is striking. In early 2026, American private military founder Matthew Aaron Van Dyke and six Ukrainian nationals were arrested at multiple Indian airports after conducting drone training for ethnic armed groups in Myanmar with ties to Indian insurgent organizations. Months earlier, a Nepali-origin Pakistani spy trained in Rawalpindi was caught in Delhi with genuine classified Armed Forces documents, attempting to flee to Pakistan through Nepal. Pakistan's ISI has also deployed disguised solar-powered cameras equipped with SIM cards at sensitive locations including military railway stations, streaming live feeds to handlers via WhatsApp — a network of roughly two dozen operatives dismantled through fifteen arrests.
China's operations follow a more methodical pattern, heavily reliant on the Indo-Nepal border corridor. Suspected operatives have been arrested in Bihar carrying no valid documents but phones loaded with anti-India content, their arrival preceded by drone intrusions from Nepal. Others entered using fabricated Nepali identities and fraudulent Indian passports, photographing military installations before attempting to slip back across the border. One deep-cover operative lived in India for an extended period under a false Nepalese Buddhist identity before her inability to speak Nepalese drew suspicion.
Document forgery binds nearly all these operations together. A safe house raided in Uttar Pradesh contained equipment capable of producing fake national identity documents, with connections traced across four states. Bangladeshi operatives employed identical methods, with arrested individuals linked to Jamaat-ul-Mujahideen Bangladesh manufacturing forged credentials for terror network members with suspected Al-Qaeda ties.
India's counter-intelligence response has grown more capable — the National Investigation Agency's 95 percent conviction rate reflects a maturing institutional architecture spanning multiple agencies and security forces. Yet the threat has evolved in equal measure, and the Indo-Nepal border remains a structural vulnerability exploited simultaneously by every major foreign actor. With budgets and recruitment expanding, pressure on these networks has intensified, but the contest itself has only grown more complex.
India's national security apparatus has made counter-intelligence its defining priority. Under Home Minister Amit Shah, the government has shifted focus sharply toward dismantling foreign spy networks operating inside Indian territory—a task that previous administrations largely neglected. What emerges from recent operations is a portrait of coordinated, patient infiltration: Pakistani intelligence services running surveillance networks at military installations, Chinese operatives crossing the Nepal border with fake identities, Ukrainian mercenaries training insurgent groups in Myanmar, and Bangladeshi terror operatives manufacturing false documents to embed themselves in Indian cities.
The scale and sophistication of these operations reveal vulnerabilities that cut across India's security landscape. In March 2026, authorities arrested Matthew Aaron Van Dyke, an American founder of a private military firm called Sons of Liberty International, along with six Ukrainian nationals at airports in Kolkata, Lucknow and Delhi. The group had moved to Mizoram without proper permits, crossed into Myanmar repeatedly, and conducted drone training for ethnic armed groups with documented ties to Indian insurgent organizations. All seven faced terror conspiracy charges under the Unlawful Activities Prevention Act. Months earlier, in February 2025, Delhi Police arrested Ansarul Mian Ansari, a Nepali-origin Pakistani spy trained in Rawalpindi, who had been gathering classified military documents and attempting to flee to Pakistan via Nepal. Forensic analysis confirmed the documents were genuine Armed Forces material.
Pakistan's intelligence directorate has deployed increasingly technical methods. A sophisticated surveillance network planted disguised solar-powered cameras equipped with SIM cards at high-security locations including Delhi Cantonment Railway Station and Pune Railway Station, streaming live feeds directly to ISI handlers via WhatsApp. The network comprised roughly 20 to 25 members, with handlers paying operatives between 500 and 15,000 rupees per installation task. Authorities made 15 arrests dismantling the operation. In a separate case, Pakistani national Meer Balaj Khan leaked classified information about the Karwar and Kochi naval bases through social media, receiving cash payments routed from Pakistani intelligence operatives. That investigation, which began in Andhra Pradesh in January 2021 and was taken over by the National Investigation Agency in June 2023, resulted in eight arrests across three states.
China's intelligence operations follow a different pattern—methodical, coordinated, and heavily dependent on the porous Indo-Nepal border. In May 2025, the Sashastra Seema Bal arrested two suspected Chinese operatives, Wu Hailong and Seng Jun Yong, in Bihar's Madhubani district near the border. Both lacked valid travel documents; their phones contained anti-India and pro-Khalistan videos. Their arrest followed two consecutive days of unidentified drone intrusions from Nepal. A separate case involved a Chinese national arrested in Uttar Pradesh with photographs of Indian Army installations and records of trips to Pakistan on his phone. Three other Chinese nationals attempted to infiltrate India through Nepal using fake Nepali identities and fraudulent Indian passports. Wang Goujun, 26, traveled to Delhi to photograph critical installations before being arrested at the Gauriphanta border in Lakhimpur Kheri while attempting to return to Nepal—authorities charged him under a rarely invoked provision for waging war against the Indian state. In another operation, Delhi Police apprehended Cai Ruo, a Chinese national from Hainan province who had lived in India under a false Nepalese Buddhist identity. Her inability to speak Nepalese raised suspicion; investigation revealed fabricated documents and confirmed a sophisticated deep-cover operation.
Document fraud emerges as the common thread binding all these operations. In June 2022, Noida Police raided a property in Gharbara village that functioned as a safe house and coordination point for nearly 20 unlawfully resident Chinese nationals. The raid uncovered document forgery equipment capable of producing fake Aadhaar cards and voter IDs, with network connections traced across Uttar Pradesh, Gujarat, West Bengal and the Northeast. Bangladeshi operatives employed identical methods. The National Investigation Agency arrested two Jamaat-ul-Mujahideen Bangladesh operatives from Bhopal in August 2022 who had illegally entered India to radicalize Indian Muslims toward violent jihad. Another Bangladeshi JMB operative arrested in West Bengal had been manufacturing forged voter ID cards and Aadhaar cards for terror network members, with suspected links to Al-Qaeda and other militant organizations.
The Indo-Nepal border has become the single most exploited entry corridor, used simultaneously by Chinese intelligence operatives, ISI-recruited Nepali agents, and Pakistani spy networks. This structural vulnerability cuts across all threat streams. India's counter-intelligence response has grown measurably more capable—the National Investigation Agency maintains a 95 percent conviction rate in cases it handles directly, drawing on a layered institutional architecture that includes the Intelligence Bureau, the Research and Analysis Wing, the Sashastra Seema Bal, state police forces and military units. Yet the threat has evolved in equal measure. Pakistani networks are running increasingly technical surveillance operations. China is conducting coordinated cross-border intelligence collection. Foreign mercenaries are treating India's Northeast as an open corridor. With Amit Shah expanding the Intelligence Bureau's budget and recruitment substantially, pressure on these networks has intensified, but the game itself has only grown more complex.
Citas Notables
Different actors, different nationalities and different objectives, but a remarkably consistent set of methods, entry routes and vulnerabilities— Pattern identified across India's counter-intelligence operations
La Conversación del Hearth Otra perspectiva de la historia
Why has counter-intelligence suddenly become the government's top priority now, after being neglected for so long?
Because the threat became impossible to ignore. For years, foreign intelligence services operated with relative impunity inside India. Now they're not just at the borders—they're in Delhi Cantonment, they're photographing naval bases, they're manufacturing fake identity documents in safe houses. The government realized it was losing the invisible war.
What makes the Indo-Nepal border so vulnerable compared to other borders?
It's porous, it's long, and it's become a highway for multiple intelligence services at once. Pakistan uses it, China uses it, and they've recruited Nepali agents who know the terrain. It's not just one threat—it's a structural weakness that everyone is exploiting simultaneously.
The document forgery angle keeps appearing in every case. Why is that the common thread?
Because a fake Aadhaar card or voter ID lets you disappear into Indian society. You're no longer a foreigner—you're a citizen. You can rent apartments, move between states, access installations. It's the skeleton key to embedding yourself.
How sophisticated are these operations really? Are we talking about lone operatives or coordinated campaigns?
Coordinated campaigns. The Chinese operations show clear coordination across multiple years and entry points. Pakistan's surveillance network had handlers paying operatives per task—that's infrastructure. These aren't accidents. They're patient, systematic intelligence collection.
What does a 95 percent conviction rate actually mean for deterrence?
It means if you're caught, you're going to prison. But the real question is whether it stops the next operative from trying. The threat keeps evolving because the intelligence value is worth the risk. The agencies are getting sharper, but so are the adversaries.