₹1 crore. Barely two days later, ₹2 crore. Then, a continuous stream of death threats. Accompanying these are anti-national slogans like ‘Pakistan Zindabad’ and ‘Hindustan Murdabad’. This series of social media threats directed at Assam Chief Minister Dr. Himanta Biswa Sarma has now raised a deeply unsettling question: is this the isolated madness of a few misguided individuals, or is there an organized, radical network operating behind the scenes?
August 15. Independence Day. The Chief Minister is broadcasting a Facebook Live. Right then, a comment drops from an account named ‘Abdul Mutaleb’—an offer of ₹1 crore to assassinate the Chief Minister. A mobile number is provided for contact. The post also contains aggressively anti-India rhetoric, including ‘Pakistan Zindabad’.
Police apprehended Mutaleb on suspicion of his involvement with the account. Preliminary investigations revealed that the mobile number associated with the threat was registered in his name. However, investigators are simultaneously analyzing a crucial angle: did Mutaleb actually operate the social media account himself, or was his digital identity hijacked by a malicious third party?
Just two days later, on August 17, the threat was replicated.
This time, it came from an account named ‘Mubarak Ali’. The claim: for ₹2 crore, the Chief Minister would be assassinated in central Assam. The account featured an address in Gadaimari, Juria, and echoed the same slogans: ‘Pakistan Zindabad, Hindustan Murdabad’. Police immediately launched an investigation into this incident as well.
Since then, on August 25 claims of similar threats have surfaced.
Three threats. Bounties ranging from ₹1 crore to ₹2 crore. And in each instance, identical violent and pro-Pakistan rhetoric. This is exactly where the issue crosses the boundary of ordinary ‘Facebook trolling’ and escalates into a serious national security concern.
Why Target Himanta Biswa Sarma?
This question must form a core pillar of the investigation.
Over the past few years, Chief Minister Dr. Himanta Biswa Sarma has adopted a hardline, uncompromising stance against illegal Bangladeshi immigration. His government’s eviction drives, particularly in Bengali-speaking Muslim-dominated areas, have sparked fierce national debate. He has also publicly stated his intent to create an environment by 2026 where illegal immigrants can no longer comfortably reside in Assam.
In essence, a central axis of the Chief Minister’s political and administrative agenda revolves around illegal immigration, demographic shifts, and the reclamation of encroached lands.
It is entirely natural, therefore, for security agencies to ask: have these hardline policies made the Chief Minister a target for a radical Islamist network? However, a crucial caveat must be applied here. Current public information does not prove the direct involvement of any specific Islamist organization behind these threats. Therefore, this is not a foregone conclusion—it is merely a plausible intelligence hypothesis for the investigation.
The First Step: Evidence Preservation
In cases involving severe threats of this nature, cyber experts and investigating officers prioritize evidence preservation above all else. A professional investigation does not stop at taking screenshots of Facebook posts. Standard forensic procedure dictates the immediate and lawful preservation of original post/comment URLs, account IDs, exact timestamps, available metadata, and critical platform/server-side records in accordance with CERT-In guidelines.
Tracing the Digital Trail
If these are merely isolated Facebook accounts, digital forensics will eventually reveal that isolation. But if these incidents are linked to a single individual, a specific group, or a coordinated network, that connection will not be exposed by simply looking at profile names or photographs. It will emerge from the correlation of multiple layers of digital evidence.
In such scenarios, investigators typically analyze the following parameters meticulously:
- When were these accounts created, and what is their login history?
- From which devices and IP addresses were the accounts accessed?
- Is there any mutual correlation between the accounts regarding devices, networks, VPN exit nodes, or digital fingerprints?
- Are they linked to common recovery mobile numbers, emails, or other digital identities?
- Was there any digital communication between the suspects before or after the threats were issued?
- Is there an abnormal linguistic pattern or signature—matching vocabulary, timing, phrasing, or account behavior—across all three threats?
Crucially, when an individual claims an account is not theirs (as in Mutaleb’s case), investigators look for forensic evidence to support one of three primary scenarios: account fabrication (creating a fake profile), account takeover (hacking or hijacking an existing profile), or genuine-user activity. The subsequent direction of the investigation hinges on which scenario the forensic evidence corroborates.
A New Dimension: An Attempt to Manipulate Identity?
Amidst the ongoing investigation, a sensational new detail has emerged. Claims have surfaced that a deliberate attempt was made on social media to project Abdul Mutaleb as a Hindu individual named ‘Narayan Das’. This brings a critical question into the investigative fold: parallel to the assassination threats, was there a coordinated effort to create a separate, communal narrative by manipulating the identity of the alleged threat actor?
On August 20, Assam Police, with assistance from Tamil Nadu Police, apprehended an individual named Muksidul Rahman from Hosur. The report identifies him as the ‘alleged mastermind’ behind the campaign to project Mutaleb as a Hindu.
This development adds a complex new layer to the case. Investigators are no longer just asking, “Who issued the threat?” They must also ask, “Who tried to create a communal smokescreen around the threat actor’s identity, how, and why?”
If the investigation reveals that these two digital trails—the threat trail and the identity-manipulation trail—converge on the same individual, group, or digital infrastructure, the gravity of the incident multiplies significantly. Yet, caution is still required: the apprehension of a suspect or labeling someone an ‘alleged mastermind’ does not inherently prove the existence of a massive, organized network. That requires sustained forensic and intelligence evidence.
Two Separate Digital Trails, or One Coordinated Operation?
Currently, the case presents at least two potential digital trails:
- Trail 1: Facebook threat → account → device/IP → telecom details → actual operator
- Trail 2: Propagation of Mutaleb’s alternative identity → social media accounts → originator → device/IP → communication → motive
If these two trails remain separate, the entire episode might just be a culmination of isolated social media activities. But if forensic evidence links both to the same individual, network, or digital infrastructure, the investigative picture changes entirely. The scope would immediately expand beyond death threats to include identity manipulation, communal provocation, and coordinated digital activity.
What Else Lies in the Cyber Trail?
Cyber intelligence and digital forensic experts may also examine whether there are connections to anonymous infrastructure, VPNs, encrypted communication platforms, foreign-hosted services, or the Dark Web.
However, from an intelligence analysis perspective, the mere use of a foreign server or a VPN does not automatically indicate a foreign terror network. Similarly, while a Dark Web footprint doesn’t confirm a radical network, the absence of one doesn’t completely rule out an organized group either. The crux of the matter lies in attribution—how many independent digital indicators converge on a single source.
The Chief Minister’s Security Background
Chief Minister Dr. Sarma has himself stated that following serious threat inputs to his life from Delhi previously, the Intelligence Bureau advised him to cancel his ‘Ashirwad Yatra’. Therefore, dismissing these social media threats as mere bluster is not an option. At the same time, there is no public evidence as of yet to directly link the current threats to those previous intelligence inputs.
The Real Test
In this investigation, the name on a Facebook profile is not the evidence. The true evidence will be the correlation between multiple, independent digital indicators.
If forensic evidence points multiple independent vectors toward the same person, network, or digital infrastructure, then the ₹1 crore and ₹2 crore threats might not be isolated events.
Conversely, if the forensic trail proves that the individuals named in the profiles did not actually post the threats, the narrative shifts dramatically: it indicates that someone is actively trying to sow the seeds of violence over a politically sensitive issue in Assam, while simultaneously hijacking innocent identities to manufacture a volatile communal narrative.
And if the digital trail of the individual arrested for allegedly projecting Mutaleb as a Hindu intersects with the threat trail, the hypothesis of a coordinated digital operation will become heavily pronounced. But establishing that requires hard evidence.
Therefore, the biggest question right now is not just one:
Are these death threats to Chief Minister Himanta Biswa Sarma simply the madness of a few misguided Facebook radicals, or has an organized radical network begun digitally targeting him in retaliation for his anti-illegal immigration and eviction drives?
Or, concurrently, is someone deliberately attempting to trigger widespread communal unrest in Assam by manipulating the identities of the alleged perpetrators?
The answers to these questions won’t be found in Facebook comment sections. They lie buried in the depths of the digital trail—and only the independent, forensic verification of that trail will reveal the true picture of this unfolding threat.
