𝗣𝗮𝗸𝗶𝘀𝘁𝗮𝗻–𝗜𝗻𝗱𝗶𝗮 — 𝗧𝗵𝗲 𝟱,𝟬𝟬𝟬-𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗰𝗹𝗮𝗶𝗺 𝗯𝗲𝗵𝗶𝗻𝗱 𝗮 𝗿𝗲𝗮𝗹 𝘄𝗮𝘃𝗲 𝗼𝗳 𝗽𝗿𝗼𝘁𝗲𝘀𝘁 𝗱𝗶𝘀𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 A burst of false reports surrounding India's protests over the Special Intensive Revision of electoral rolls provides a clear example of how genuine political unrest can become a target for cross-border information manipulation. What remains considerably less certain is the scale and command structure of the campaign. Indian intelligence officials have alleged that more than 5,000 social-media accounts were created in Pakistan within roughly two weeks to exploit protests against the electoral-roll revision and the Election Commission. According to reporting based on Intelligence Bureau sources, the accounts were intended to circulate claims of police violence, casualties and government repression, while encouraging those narratives to travel beyond Delhi into other parts of India. Several of the individual fabrications are independently verifiable. One account using the identity “Anushi Tiwari Indian” and the handle @indiantiwari01 circulated old footage with claims that Delhi Police had opened fire on demonstrators. Different posts attributed multiple deaths to the supposed firing and claimed that opposition leader Rahul Gandhi had been shot or injured. Fact-checkers established that footage used to support such claims came from earlier events, including the 2024 farmers' protests, rather than the demonstrations then taking place in Delhi. Delhi Police publicly identified the account and said it had a history of distributing doctored material, old footage and fabricated narratives. Police subsequently registered four cases concerning alleged misinformation around the protests, while officials said hundreds of posts had been removed. India Today later reported that the Delhi Police Cyber Cell had traced the account's IP address to Pakistan and that the account was subsequently withheld in India. Earlier investigations had also documented the same persona circulating misleading material about Indian political and security events. That evidence establishes a meaningful Pakistan-linked component to the disinformation environment. It does not, however, independently establish a 5,000-account ISI network. The larger allegation comes primarily from Indian intelligence reporting. The Statesman, citing an IANS report and an Intelligence Bureau official, said accounts were being operated from several locations including Bhimber, Rawalakot, Sialkot and Peshawar rather than primarily from Rawalpindi and Islamabad. Officials alleged that operators were supplied with narratives to circulate and instructed to tag users outside India to increase their reach. The same reporting connected the activity to “Operation Ground Wire”, described by Indian sources as an effort to recruit Indian nationals to generate material that could then appear to originate domestically. The concept predates the October protests. A September investigation by CNN-News18 alleged that a platform called Bharat Bytes News had been used to recruit young Indian contributors for politically sensitive assignments, with material subsequently handled from Pakistan. There is an important evidential gap. No public list of the alleged 5,000 accounts has been released. There is no published network graph, platform transparency report, forensic infrastructure analysis or dataset allowing independent researchers to reproduce the Intelligence Bureau's assessment. Nor has public evidence demonstrated that all the accounts described in media reports belong to a single centrally controlled network rather than several clusters, individual propagandists and opportunistic accounts exploiting the same political crisis. The attribution to Pakistan's Inter-Services Intelligence is therefore an intelligence claim rather than an independently demonstrated technical attribution. Reporting by Indian outlets repeatedly cites intelligence and police sources, but the underlying evidence has not been released publicly. At the time of this review, no equivalent technical report from Meta, X, Google or another major platform had been identified that confirmed the existence of a 5,000-account ISI-controlled operation. This distinction matters particularly in the India–Pakistan information environment. Both states routinely accuse the other of covert influence and disinformation. Pakistan itself has alleged Indian-backed social-media operations targeting Pakistani institutions, and Islamabad has previously rejected Indian security allegations as politically motivated. That does not invalidate evidence surrounding particular Pakistan-based accounts, but it raises the evidential threshold required for attributing thousands of accounts to a state intelligence service. There is another reason for caution. The information environment around the Indian protests contains misinformation from more than one political direction. Independent fact-checkers have identified AI-generated protest scenes, old videos recaptioned as current events and fabricated images supporting competing narratives. In an earlier case involving the Cockroach Janta Party protests, BOOM and Alt News found that Delhi Police themselves had incorrectly dismissed authentic footage as fake. Government attribution should therefore be treated as evidence to investigate, not as a substitute for forensic verification. No confirmed individual mastermind can presently be named for the October 5,000-account operation. “Anushi Tiwari Indian” is a documented online persona, not a verified real-world identity. Earlier reporting on the broader Ground Wire allegation named individuals said to be Pakistani handlers, including a person identified as Abdullah Shad and a Pakistani military officer described as Lieutenant Colonel Zia. Those identities have not been independently established through publicly available judicial records, financial evidence or a technical attribution report, and there is insufficient evidence to identify either man as responsible for the current 5,000-account campaign. The most defensible conclusion is narrower but still significant. A cluster of false narratives exploiting India's election-related protests existed; several prominent examples have been independently debunked; and at least one central amplifier has been reported by police investigators as Pakistan-based. The much larger claim — that more than 5,000 newly created accounts form a coordinated ISI operation — remains plausible but unproven on the public evidence currently available. For an information operation, that gap between what can be demonstrated and what intelligence authorities say they know is itself part of the story. 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 1. The Statesman — “Pakistan creates 5,000 fake social media accounts amid anti-SIR protests: IB official”, 14 October 2026. This is the principal published source for the 5,000-account figure, alleged geographic distribution and Operation Ground Wire connection. The Statesman https://www.thestatesman.com/india/pakistan-creates-5000-fake-social-media-accounts-amid-anti-sir-protests-ib-official-1503650989.html 2. India Today — “ISI-linked accounts post fake Rahul injury video, deaths amid Delhi protests”, 13 October 2026. Documents the fake Rahul Gandhi injury story, false casualty reports and attribution supplied by security sources. India Today https://www.indiatoday.in/india/story/anti-cec-protests-isi-linked-pakistan-accounts-spread-false-rahul-gandhi-injury-claim-fake-deaths-amid-delhi-protests-3016235-2026-10-13 3. India Today / PTI — Delhi Police investigation, four FIRs and approximately 500 posts removed, 13 October 2026. India Today https://www.indiatoday.in/cities/delhi/story/delhi-police-files-four-firs-removes-500-posts-over-protest-misinformation-3016760-2026-10-13 4. The New Indian Express — Delhi Police warning concerning @indiantiwari01, 12 October 2026. Includes the police's public identification of the account and its description of previous fabricated narratives. The New Indian Express https://www.newindianexpress.com/cities/delhi/2026/Oct/12/delhi-police-warns-of-action-over-fake-claim-of-firing-at-rahul-gandhi-rally-300-posts-taken-down 5. India Today — “Pakistani Fake News Account Banned on X Over Fabricated Videos on Delhi Protests and Rahul Gandhi”, 15 October 2026. Reports the Cyber Cell finding that the account's IP address traced to Pakistan. India Today https://www.indiatoday.in/india/video/pakistani-fake-news-account-banned-on-x-over-fabricated-videos-on-delhi-protests-and-rahul-gandhi-ytvd-3017879-2026-10-15 6. The Quint / WebQoof — independent verification of old footage falsely presented as Delhi Police firing on protesters. The investigated post from @indiantiwari01 had accumulated more than 35,000 views when checked. TheQuint https://www.thequint.com/news/webqoof/old-video-farmers-protest-falsely-linked-to-cjp-delhi-police-firing-fact-check 7. BOOM — “Old Farmers Protest Video Falsely Shared As Fatalities From October 10 Protest”, 10 October 2026. Independent visual verification of another falsely contextualised protest video. BOOM https://www.boomlive.in/fact-check/old-farmers-protest-video-falsely-shared-as-fatalities-from-october-10-protest-32352 8. Newschecker — independent fact-check of the false Delhi Police firing and casualty story, 13 October 2026. Newschecker https://www.newschecker.in/fact-check/old-video-shared-as-delhi-police-firing-at-rahul-gandhi-led-march-against-cec 9. DFRAC — earlier investigation of the “Anushi Tiwari Indian” persona during the September BRICS information environment. This establishes that the account's misleading activity preceded the October protests. DFRAC_ORG https://dfrac.org/en/2026/09/16/brics-summit-disinformation-fake-and-misleading-claims-flood-social-media/ 10. ETGovernment — Maj Gen Rajan Kochhar (Retd), analysis of the earlier Ground Wire allegations, September 2026. Importantly, the article itself stresses that claims concerning named operators, payment mechanisms and Bharat Bytes require independent verification. ETGovernment.com https://government.economictimes.indiatimes.com/amp/blog/the-evolution-of-proxy-warfare-how-narrative-manipulation-is-transforming-india-pakistan-conflict/134347274 11. BOOM — AI-generated imagery falsely connected to the election-related protests, 12 October 2026. Demonstrates that the broader information disorder was not confined to the specifically Pakistan-attributed examples. BOOM https://www.boomlive.in/fact-check/ai-visuals-falsely-shared-as-real-fuel-misinformation-amid-cec-protests-32353 12. Alt News — investigation showing that Delhi Police had incorrectly labelled genuine July protest footage as fake. Relevant to the need for independent verification of official fact-checking claims. Alt News https://www.altnews.in/hindi/baton-with-nails-videos-indeed-from-july-20-protests-delhi-police-pibs-fact-check-incorrect/ 𝗞𝗘𝗬𝗪𝗢𝗥𝗗𝗦 #Disinformed #Disinformation #Propaganda #InfluenceOperations #India #Pakistan #ISI #ElectionSecurity #ElectionIntegrity #SIR #SpecialIntensiveRevision #DelhiProtests #RahulGandhi #GyaneshKumar #SocialMedia #FakeAccounts #FakeNews #InformationWarfare #CognitiveWarfare #HybridWarfare #OSINT #DigitalPropaganda #ForeignInfluence #InformationOperations #FactChecking #CyberSecurity #OperationGroundWire #PakistanIndia #PoliticalDisinformation #InformationIntegrity
