Just days before the country marked another Independence Day, a quiet but massive operation was already under way. Across fourteen states, security teams moved in coordination. By the time most people were preparing for celebrations, more than two hundred people linked to a Pakistan-based network had been taken into custody. The group was known as the Shahzad Bhatti Network. According to the government, it was backed by the ISI and had been preparing subversive attacks.

Union Home Minister Amit Shah announced the success of the operation on Monday. He described it as the government destroying the network and preventing planned disruptions. The numbers are striking. Two hundred and fifty-three people were detained. Over eighty FIRs were registered. Weapons, explosives and surveillance equipment were recovered. Some of the grenades carried markings from the Pakistan Ordnance Factory.

Who Is Shahzad Bhatti

Shahzad Bhatti is a Pakistani gangster who, over time, moved deeper into terror-related work. He operates from the UAE and is active on social media, posting in Punjabi. Intelligence agencies say he has been used by the ISI to recruit young people inside India, often through Instagram, Facebook and encrypted apps.

He is not a new name to investigators. The National Investigation Agency has been looking at him for some time. He has been linked to a grenade attack on the house of a social media influencer in Jalandhar in March 2025. He has also been named in connection with explosions at police stations in Haryana — one in Sirsa in November 2025 and another in Ambala in January 2026. In several of these cases he has been chargesheeted as an absconder.

What makes the network dangerous is the way it works. Handlers sitting outside the country identify vulnerable or opportunistic young men inside India. They are offered money — sometimes small amounts for putting up posters, sometimes larger sums for more serious tasks. The recruits are then asked to recce police stations, religious places or defence-related sites, or to plant small cameras for surveillance. Over time the tasks become more serious.

How the Operation Unfolded

The main coordinated action took place on 12 August. Central agencies and state police forces shared intelligence in real time. Teams moved almost simultaneously in different states. The highest numbers of detentions came from Uttar Pradesh (62), Haryana (52), Delhi (51) and Punjab (44). Smaller numbers were picked up in Rajasthan, Maharashtra, Uttarakhand, Karnataka, Gujarat, Bihar, Telangana, Himachal Pradesh, Jammu and Kashmir and Kerala.

Fresh FIRs were registered in Delhi and Karnataka as part of the same drive. The cases have been booked under the Unlawful Activities (Prevention) Act, the Bharatiya Nyaya Sanhita, the Arms Act, the NDPS Act and the Explosive Substances Act.

What the teams recovered tells its own story. Improvised explosive devices, grenades with Pakistani markings, pistols, live cartridges and CCTV cameras allegedly meant for espionage. The presence of Pakistan Ordnance Factory markings on some of the grenades is being treated as clear evidence of cross-border supply lines.

The Human Face of the Network

Many of those arrested are young Indian men. Some were ordinary workers — people selling food, dealing in small trade, or simply looking for quick money. The recruitment often began online. A friendly conversation, a small payment for a simple job, and then deeper involvement. Investigators say the handlers were careful. They used local language, played on grievances, and kept the first tasks small enough that the recruits did not immediately realise the seriousness of what they were doing.

This is one of the more troubling aspects of the case. It is not only about trained militants crossing the border. It is about a system that turns ordinary people into foot soldiers through social media and money. Once a person accepts the first payment, it becomes harder to walk away.

Families of some of the arrested men will now face difficult questions. Many may not have known the full extent of what their sons or brothers had gotten into. Others may have seen the money and chosen not to ask. Either way, the human cost is real on both sides of the story — the lives that could have been lost in attacks, and the lives that are now entangled in the legal process.

Why the Timing Mattered

Independence Day has long been a period of heightened alert. Groups looking to create panic or score propaganda points often try to time their actions around national occasions. The Shahzad Bhatti Network, according to the Home Ministry, was planning disruptions specifically around 15 August. The operation on 12 August was designed to break that plan before it could take shape.

By the time the country watched the flag-hoisting ceremonies, the network’s Indian modules had already been hit hard. Whether every planned action was prevented is something only the investigators fully know. What is public is that a significant number of people who could have been used for those actions are now in custody.

The Larger Pattern

This is not the first time Pakistan-based handlers have tried to use local recruits and social media. Similar patterns have appeared in earlier cases. What stands out here is the scale of the response. Fourteen states, real-time coordination, and a public statement from the Home Minister the same week. It signals that the system is trying to move faster than the networks that seek to exploit it.

At the same time, the case raises hard questions. How do young people in different states become available for recruitment so easily? How much of the problem is ideology, how much is money, and how much is simply the absence of better options? Security agencies can arrest people. They cannot, by themselves, close the gaps that make recruitment possible.

The NIA’s continuing investigations into Bhatti and his associates will take time. Some of those arrested may turn out to be peripheral. Others may be more deeply involved. The legal process will sort that out. What matters immediately is that a network that had been building capacity for attacks has been disrupted at a critical moment.

What the Recoveries Tell Us

Explosives and weapons are one thing. The CCTV cameras recovered for alleged espionage point to another layer. The network was not only planning sudden violence. It was also trying to gather information on targets over time. That kind of patient surveillance is harder to detect and more dangerous in the long run.

The fact that some of the grenades carried Pakistani factory markings is particularly significant. It suggests a supply chain that is organised rather than opportunistic. Cutting such chains requires sustained intelligence work on both sides of the border and beyond.

Looking Ahead

For the security forces the operation is a success. A network has been damaged, planned disruptions have been prevented, and a message has been sent. For the country it is a reminder that the threat does not always arrive in the form of trained fighters. Sometimes it arrives through a smartphone screen and a promise of money.

Shahzad Bhatti himself remains outside India. The real test will be whether the modules that were broken stay broken, and whether new ones are prevented from forming. The arrests of 12 August have bought time. How that time is used will determine whether the success is temporary or lasting.

In the end, the story is both simple and complicated. A Pakistan-based handler with ISI links recruited people inside India. Indian agencies found out, coordinated across states, and moved before the planned moment. More than two hundred people are now in custody. Explosives and weapons have been seized. Independence Day passed without the disruptions that had been feared.

Behind those facts are young men who made choices, families who will live with the consequences, investigators who put the pieces together, and a public that may never know how close some of the plans came to being carried out. That is the human texture of a counter-terror operation that, on paper, looks like a clean success.