Centre says it has dismantled ISI-backed Shahzad Bhatti Network. What was the nexus?

New Delhi: The Centre says Indian security agencies have dismantled the Shahzad Bhatti Network (SBN), which the Union home ministry describes as a Pakistan-based, Inter-Services Intelligence (ISI) backed terror syndicate. A coordinated operation on August 12 led to 253 detentions across 14 states, while more than 80 FIRs and over 200 arrests have cumulatively been recorded in cases linked to the network, according to the ministry.

The home ministry said the operation was carried out to counter SBN-linked disruptions planned around Independence Day. Security agencies used a real-time intelligence sharing system with state police forces to conduct coordinated action across multiple locations.

Uttar Pradesh accounted for 62 detentions, followed by Haryana with 52, Delhi with 51 and Punjab with 44. Rajasthan recorded 15, Maharashtra 8 and Uttarakhand 5. Karnataka, Gujarat and Bihar recorded 3 each, while Telangana, Himachal Pradesh, Jammu & Kashmir and Kerala recorded 2 each. Fresh FIRs were registered in Delhi and Karnataka.

The home ministry said recoveries in cases linked to the network included improvised explosive devices (IEDs), grenades bearing Pakistan Ordnance Factory markings, pistols, live cartridges and CCTV cameras allegedly used for espionage. The government cited the seizures as evidence of what it described as the network’s cross-border links.

The home minister, Amit Shah, said in a post on X that the operation had thwarted plans for subversive attacks and that more than 200 operatives had been arrested. The official release, however, makes a distinction between the figures: 253 people were detained during the August 12 operation, while more than 200 arrests and over 80 FIRs are cumulative figures recorded against SBN.

Pakistan rejects India’s charge

Pakistan’s foreign ministry rejected the allegations on August 17, saying India was attempting to link Pakistan with arrests made inside the country. Islamabad accused New Delhi of using the allegations to divert attention from domestic security issues and made counter-allegations of Indian involvement in terrorism and subversion abroad.

Pakistan also cited the case of Kulbhushan Jadhav while urging the international community to reject India’s allegations. The statement did not, however, provide a case-specific explanation for the evidence cited by the Indian government, including the alleged Pakistan-marked grenades, reconnaissance network and Bhatti-linked NIA cases.

There was no separate public response from the Ministry of External Affairs specifically addressing Pakistan’s statement on the Shahzad Bhatti Network at the time of publication.

What was the Shahzad Bhatti nexus?

At the centre of the investigations is Shahzad Bhatti, a Pakistan based accused who has been named in several National Investigation Agency (NIA) cases involving alleged terror-gangster activity in India. Economic Times reported, citing investigative material, that Bhatti had allegedly combined an organized crime network with terror-related activity and used social media to communicate with operatives.

The alleged nexus becomes clearer from NIA investigations into attacks in Haryana and Punjab.

On May 26, the NIA charged nine accused, including Pakistani nationals and alleged handlers Shahzad Bhatti and Sohail Ahmad alias Sohail Baloch, in connection with the November 2025 grenade attack on the women police station in Sirsa, Haryana. A chargesheet contains the investigating agency’s allegations and does not by itself establish guilt.

According to the NIA, Bhatti and Sohail allegedly recruited and radicalized accused through social media platforms and encrypted communication channels. The agency’s investigation dealt with an alleged chain involving recruitment, financing, operational coordination and procurement of explosive material, providing investigators with a picture of how Pakistan-based handlers were allegedly connected with local operatives.

The August 17 home ministry statement provided further details of the alleged network. It said SBN paid local conduits to conduct reconnaissance of police, defence and religious sites and to install CCTV cameras for espionage. The ministry also linked the network to grenade, IED and petrol-bomb attacks and targeted killings. These remain government and investigative allegations that have to be established through evidence in individual cases.

The NIA’s previous action shows that investigators had been pursuing Bhatti-linked cases for several months before the nationwide crackdown.

On June 9, the agency searched 18 locations in Punjab and Haryana in three Bhatti-linked terror gangster cases. The investigations covered the March 2025 grenade attack at the residence of a social media influencer in Jalandhar, the November 2025 Sirsa police station attack and the January 2026 blast at Baldev Nagar police station in Ambala.

Those cases are relevant because investigators have explicitly linked them to Bhatti and say they illustrate the alleged connection between Pakistan based handlers and operatives recruited or tasked inside India. They should not, however, be taken to establish that every criminal or terror case involving Pakistan-based actors was part of SBN.

The alleged operating model described by the Centre and the NIA relied heavily on remote recruitment and tasking. Investigators say social media and encrypted platforms were used to identify or communicate with recruits, while local conduits were allegedly used for reconnaissance and other operational tasks. The Centre has additionally alleged ISI backing, an assertion Pakistan denies.

The spread across 14 states also explains the emphasis on coordination. The home ministry said the August 12 operation used real-time intelligence sharing between security agencies and state police forces, allowing suspected operatives and links to be checked simultaneously across multiple locations

The Centre’s announcement does not mean that every person detained has been arrested, charged or found guilty. The distinction is particularly important in a security investigation of this scale: detention allows agencies to question and verify suspected links, while criminal liability has to be established separately through investigation and judicial proceedings.

What Indian response could

If New Delhi chooses to respond to Pakistan’s denial, an evidence-led approach could provide the strongest basis for challenging Islamabad’s position.

The government has already placed specific claims in the public domain, including grenades bearing Pakistan Ordnance Factory markings, alleged payments to local conduits, reconnaissance of sensitive locations, CCTV equipment allegedly used for espionage and NIA investigations involving online recruitment and encrypted communications.

Where investigations and court proceedings permit, presenting forensic evidence on recovered weapons, financial trails, digital communications and relevant court records could move the issue beyond competing official claims and towards material that can be independently examined.

For Indian agencies, the immediate task is more concrete, establish the individual roles of those detained and trace the alleged financial, digital and operational links connecting local operatives with Bhatti and other Pakistan-based handlers.

The home ministry says action against SBN linked networks will continue. The longer test will be whether investigators can convert the intelligence behind the crackdown into evidence that withstands judicial scrutiny while detecting attempts to rebuild similar recruitment channels.