Delhi Police Special Cell has busted an espionage module in which Pakistan’s Inter-Services Intelligence allegedly received live visual feeds from nine solar-powered, SIM-enabled CCTV cameras installed near strategic Indian defence installations and Central Armed Police Forces sites across Punjab, Haryana, Rajasthan, and Jammu and Kashmir.
The cameras used EseeCloud - a Chinese software platform developed by Guangzhou Juan Intelligent Tech - which allegedly transmitted live footage to data centres in China, from where it was relayed to ISI handlers in Pakistan. Six people have been arrested, three each from Punjab and Delhi.
The operation was allegedly supervised by an ISI handler identified by the code name Captain Rana, used Babbar Khalsa International’s terror infrastructure for manpower, and was coordinated by a Dubai-based Indian operator with sleeper cells across Spain, Germany, and Dubai.
The Surveillance Infrastructure
Nine EseeCloud cameras were installed at locations identified as highly sensitive due to regular troop movements, proximity to international borders, and the presence of key Army cantonments and logistical corridors. The sites: Kapurthala, Jalandhar, Pathankot, Patiala, and Moga (Punjab); Ambala (Haryana); Kathua (Jammu and Kashmir); Bikaner and Alwar (Rajasthan).
Each installation cost approximately ₹15,000, including ₹5,000–7,000 for the camera. The solar-powered, SIM-enabled design made the cameras self-sufficient - no external power connection required, no local network dependency, transmitting continuously via cellular data. The installations were carried out under the guise of monitoring truck movement in a transportation business, providing a legitimate cover for the camera placement near military corridors.
The EseeCloud platform’s data flow: live footage → Chinese data centres → ISI handlers in Pakistan. The three-hop architecture - camera to China to Pakistan - creates geographic and jurisdictional distance between the surveillance collection point and the intelligence consumer, complicating attribution and interdiction.
The Network Structure
The operation combined ISI direction, BKI terror infrastructure, and a Dubai-based Indian operator. ISI handler “Captain Rana” supervised the Indian module. BKI provided manpower management and sleeper cell infrastructure across Spain, Germany, and Dubai. The Dubai-based Indian operator served as the ring leader for installation assignments.
The use of BKI’s existing infrastructure for an ISI surveillance operation illustrates the operational convergence between Pakistani state intelligence and Khalistani militant networks — a pattern that Indian security agencies have documented across multiple cases but which this investigation makes unusually explicit in its operational detail.
The EseeCloud Vulnerability and the STQC Framework
The investigation has renewed attention on India’s new CCTV oversight framework, applicable from April 2026, which introduces STQC Essential Requirements for surveillance systems - combining cybersecurity standards, trusted supply chain requirements, and continuing compliance obligations. Sanjeev Sehgal, founder of Sparsh CCTV and convener of the Video Surveillance Committee at the Bureau of Indian Standards, described the framework as among the earliest and most comprehensive globally.
The EseeCloud case is precisely the vulnerability the STQC framework is designed to address: Chinese-manufactured surveillance equipment with Chinese-controlled software transmitting to Chinese data centres, installed near Indian military infrastructure.
The ₹15,000 per installation cost - and the ease of installation under commercial cover - demonstrates that the barrier to deploying this surveillance infrastructure is low. The STQC framework’s focus on trusted supply chains and continuing compliance is the structural response to that low barrier.
The Financial Trail: UPI and Weapons Proceeds
The accused were receiving funds through UPI accounts, with part of the money allegedly coming from proceeds linked to the sale of smuggled weapons. The UPI payment trail - which creates a documented transaction record - is part of the evidence base that investigators are using to map the network’s financial flows and identify additional participants.
Shunyatax Global Insight
The EseeCloud case is a national security case, but its financial infrastructure - UPI payments, weapons sale proceeds, Dubai-based operator coordination - follows the same money laundering pattern that appears across organised crime cases: layered payment channels, cross-border fund flows, and the use of legitimate payment infrastructure (UPI) to move illicit funds.
The UPI transaction trail that investigators are using to map the spy network’s financial flows is the same kind of transaction documentation that professional bookkeeping services in India maintain for legitimate businesses - and that forensic investigators reconstruct when those records are absent or manipulated. In both contexts, the transaction record is the evidence. Its completeness and accuracy determine what investigators can establish and what remains unresolvable.
For businesses with UAE connections - particularly those with Dubai-based operators or partners - the case is a reminder that cross-border financial flows attract scrutiny from multiple enforcement agencies simultaneously. Maintaining clean, well-documented financial records across all jurisdictions is not just good practice; it is the primary protection against being drawn into investigations that originate from the activities of connected parties.
🔍 Is your cross-border financial documentation framework built to withstand multi-agency scrutiny? Get a free strategy call with Shunyatax Global →
Quick News Summary
Delhi Police Special Cell busted an ISI espionage module using 9 solar-powered, SIM-enabled EseeCloud (Chinese) CCTV cameras installed near Indian military installations in Punjab (Kapurthala, Jalandhar, Pathankot, Patiala, Moga), Haryana (Ambala), J&K (Kathua), and Rajasthan (Bikaner, Alwar). Live feeds transmitted to Chinese data centres, relayed to ISI handlers in Pakistan. ISI handler: “Captain Rana.” BKI terror infrastructure used for manpower. Dubai-based Indian operator coordinated installations, disguised as truck movement monitoring. 6 arrested (3 Punjab, 3 Delhi). Installation cost: ₹15,000/camera. Funding via UPI accounts, partly from smuggled weapons proceeds. India’s new STQC framework (April 2026) addresses Chinese CCTV supply chain vulnerabilities.
📰 News Summary
Delhi Police Special Cell has busted an espionage module in which Pakistan’s Inter-Services Intelligence allegedly received live visual feeds from nine solar-powered, SIM-enabled CCTV cameras installed near strategic Indian defence installations and Central Armed Police Forces sites across...
Need Expert Help?
Talk to Shunyatax Global for audits, bookkeeping, and international setups.