Operation Sindoor fallout: India expels Pakistan diplomat, cracks down on local espionage links

In a significant intelligence-led crackdown, Indian security agencies have arrested six individuals from Malerkotla in Punjab and various locations in Haryana on charges of espionage for Pakistan. The arrests followed the expulsion of Pakistan High Commission official Danish Rahim, declared persona non grata by the Indian government on 14 May. Danish, whose real name is believed to be Ehsan Ur Rahim, had been operating under diplomatic cover in New Delhi and was accused of espionage linked to Pakistan’s Inter-Services Intelligence (ISI).

Officials confirmed that the six individuals were in direct or indirect contact with Danish, who was ordered to leave India within 24 hours for allegedly conducting activities inconsistent with his diplomatic status. One of the arrested individuals has been identified as Jyoti Malhotra, a travel YouTuber, who reportedly travelled to Pakistan using a visa arranged by the expelled official and had previously attended an Iftar event hosted at the Pakistan High Commission.

What Triggered the Espionage Crackdown in Punjab and Haryana?

The multi-agency operation followed a surge in counterintelligence alerts received by Indian authorities in the wake of Operation Sindoor—India’s ongoing military retaliation to the 2025 Pahalgam terror attack. Danish Rahim, a Pakistani national employed at the Pakistan High Commission, was placed under surveillance after intelligence inputs suggested his involvement in a covert ISI-led network targeting sensitive Indian data.

On 14 May, the Ministry of External Affairs issued a demarche to the Charge d’Affaires at the Pakistan High Commission, citing violations of diplomatic protocol. Danish was formally declared persona non grata and ordered to leave India. Within 48 hours of his exit, law enforcement arrested six individuals allegedly recruited by him for intelligence-gathering purposes.

The operation was carried out with coordinated efforts from the Intelligence Bureau, Delhi Police Special Cell, Haryana Police, and Punjab Police. Multiple residences were raided in Hisar, Malerkotla, and Karnal, with digital devices and confidential documents seized.

Who Is Jyoti Malhotra and How Is She Linked to Danish?

One of the most prominent individuals arrested is Jyoti Malhotra, known online for her YouTube channel “Travel With Jo.” Authorities confirmed that she had developed a relationship with Danish Rahim after attending a cultural Iftar event at the Pakistan High Commission in March 2024. In a vlog posted publicly, she was seen interacting with Danish and his spouse, and discussing her desire to visit Pakistan.

Officials stated that Danish facilitated her visa application to Pakistan, where she travelled earlier this year. Following her return, she allegedly continued her communication with Rahim and was found in possession of materials considered sensitive to national security.

Speaking on condition of anonymity, a senior official involved in the probe said Malhotra’s devices contained images, location data, and conversation threads that suggested deliberate attempts to gather and transmit restricted information to foreign handlers. These materials were recovered from her phone and laptop during a search of her residence in Hisar.

Deputy Superintendent of Police Kamaljeet from Hisar confirmed the arrest, stating: “Based on specific inputs, Jyoti, daughter of Haris Kumar, was arrested under the Official Secrets Act and section 152 of the Bharatiya Nyaya Sanhita. She has been remanded for five days. We are verifying the extent of her contacts and the data she shared.”

What Charges Have Been Filed Against the Accused?

All six individuals have been booked under the Official Secrets Act, 1923—India’s principal law against espionage—and under section 152 of the BNS, which addresses collaboration with enemy nations. These laws prohibit unauthorized communication of sensitive data that could threaten national integrity.

Judicial authorities in both Punjab and Haryana have granted five-day police remand for custodial interrogation. Officials are currently verifying whether the arrested individuals were acting independently or as part of a larger recruitment chain being operated by ISI handlers through diplomatic channels.

Senior sources from the Central Bureau of Investigation (CBI) have been tasked with forensically analysing the seized material. The National Technical Research Organisation (NTRO) is also assisting with cyber-tracing data pathways used by the accused.

Was Danish Rahim an Undercover ISI Officer?

Though no official statement has described Danish Rahim explicitly as an ISI officer, Indian officials believe he operated as a covert ISI handler under diplomatic cover. According to intelligence sources, Rahim—operating as a consular staffer—engaged in the recruitment of Indian citizens using a mix of social invitations, visas to Pakistan, and monetary inducements.

His connections with Indian nationals reportedly began under the guise of cultural and people-to-people exchanges, including invitations to High Commission events. Over time, these interactions allegedly shifted into sensitive information gathering, involving border movement updates, infrastructure photos, and internal security data.

The Ministry of External Affairs’ statement on May 13 noted, “The Government of India has declared a Pakistani official, working at the Pakistan High Commission in New Delhi, persona non grata for indulging in activities not in keeping with his official status in India. The official has been asked to leave India within 24 hours.”

Sources told this publication that his activities had been monitored for several months, especially after the escalation of terror activities in Kashmir and amid rising concerns of cyber and human intelligence breaches.

How Is This Linked to Operation Sindoor and India-Pakistan Tensions?

The timing of Danish Rahim’s expulsion and the arrests directly correlates with India’s heightened security response following the Pahalgam terror attack, which claimed over 40 civilian lives in April. In retaliation, India launched Operation Sindoor, deploying drone strikes and targeted military operations in Pakistan-occupied Kashmir (PoK) and Pakistani forward regions hosting terror camps.

Officials believe Rahim was attempting to collect on-ground information related to these operations and troop logistics. Security agencies now view this espionage ring as an extended front of Pakistan’s hybrid warfare strategy—using digital, human, and diplomatic channels to undermine India’s internal security posture.

The revelation also follows renewed diplomatic standoffs between India and Pakistan, where ceasefire violations and infiltration attempts have surged in recent weeks. India’s move to expel a diplomatic official on espionage grounds marks a serious escalation that could prompt reciprocal steps from Islamabad.

Are More Arrests Likely in This Espionage Case?

Sources indicate that more arrests could follow. Indian agencies are reportedly tracking additional individuals who may have interacted with Danish during his tenure in Delhi. Investigations are focused on tracing WhatsApp conversations, VPN-based email exchanges, and financial transactions routed via digital wallets.

A senior security official in New Delhi stated that Indian intelligence is pursuing leads involving possible NGO operatives, freelance journalists, and digital influencers who may have been approached by foreign intelligence handlers.

“There are individuals in media and academia who were engaged under the guise of cultural engagement or cross-border storytelling. We’re not ruling out a wider espionage chain,” the official said.

What Happens Next in Diplomatic Terms?

The arrests come at a time when India-Pakistan relations are already strained. Analysts say the Indian government’s decision to act decisively against espionage is likely to be supported by its strategic partners, including the United States, France, and Israel, all of whom have recently collaborated with India on counterterrorism.

It is unclear how Pakistan will officially respond to the expulsion of Danish and the subsequent arrests. In previous instances, such expulsions have been followed by tit-for-tat diplomatic actions, including the recall or expulsion of Indian High Commission staffers from Islamabad.

External Affairs Ministry officials in India are reportedly preparing a dossier summarising Danish’s espionage activities and may share it with the United Nations Security Council and Financial Action Task Force (FATF) platforms to highlight Pakistan’s continuing use of diplomatic cover for subversive activities.

Situation Update as of 06:00 IST, 18 May

As of this morning, all six accused remain in police custody under interrogation. Forensic teams are scanning the seized digital devices for metadata linking them to Pakistani IPs or handlers. Investigative agencies are working under tight timelines to complete the first round of interrogation within the remand period.

Judicial proceedings are expected to continue through next week, and further charges may be filed under additional provisions depending on the outcome of digital evidence review.