The Foreign Hand, Measured: What Is Proven About the Amplification of India's Protests

On 23 July 2026, three days after the march on Parliament, the Delhi Police announced that it had identified and blocked 480 Pakistan-based social media handles spreading misinformation about the Jantar Mantar protest, the same handles, it said, that had pushed fake narratives during Operation Sindoor a year before. Two months earlier a Union minister had told reporters that 49 per cent of the Cockroach Janta Party's followers were in Pakistan and only 9 per cent in India. In August the police described a "digital conspiracy": thousands of fake profiles, foreign bot networks, 180 influencers and three marketing firms.

Part 1 of this series showed that Indians are protesting more. Part 2 showed what about. Part 3 followed the money. This part asks the question those claims raise: is the protest being amplified from outside, and how would we know?

The method is simple and strict. A claim of coordinated amplification counts as proven when one of three things exists: a platform's own attribution with numbers, as Meta publishes when it removes a network; a dataset study that outsiders can check, with account identities, creation dates and timing; or a case tested in court. Everything else is an assertion. By that standard, foreign amplification of Indian protest is documented in several past cases, in more than one direction. For 2026 it is, so far, documented in none.

What has been proven before

Start with what is real, because it is.

In April 2019 Facebook removed 24 Pages, 57 accounts, 7 Groups and 15 Instagram accounts that it linked to employees of the Inter-Services Public Relations wing of the Pakistani military. They had 2.8 million followers and posted about Kashmir, the Indian Army and Indian politicians. In 2021 the research firm Graphika traced a second Pakistani network, run through a public-relations company called AlphaPro, and found open-source links between the firm and the ISPR. In March 2026 Meta's threat report described a Pakistan-origin network notable for its use of artificial intelligence to write multilingual content and generate video. Pakistani information operations aimed at Indian audiences exist. That is not in dispute.

China's are documented too, and they have touched Indian protest. In May 2024 Meta removed "Operation K", a China-based network of 37 accounts, 13 Pages, 5 Groups and 9 Instagram accounts that posed as a pro-Sikh activist movement and pushed Khalistan content and calls to protest. In November 2024 the Australian Strategic Policy Institute found a handful of Spamouflage-style accounts pushing "Little China in India" narratives about Manipur during the election. The evidence base there is thin, a few accounts, and ASPI said so.

And India's own operations are documented, by the same sources. The same April 2019 Facebook takedown removed 138 Pages and 549 accounts linked to a Congress IT cell and a pro-BJP network run by an IT firm with 2.6 million followers. Oxford's Internet Institute lists India among the countries with permanent "cyber troops". A peer-reviewed study of the 2019 election joined 600 pro-BJP WhatsApp groups and documented 75 hashtag campaigns, 69 of which reached India-wide trending, run through pre-written tweets. EU DisinfoLab's "Indian Chronicles" exposed a fifteen-year network of 750 fake media outlets in 119 countries built to discredit Pakistan. The Stanford Internet Observatory analysed 1,198 Twitter accounts running fake Kashmiri personas that praised the Army and smeared journalists; Stanford stopped short of attributing them, but said their content was "consistent with the stated objectives" of the Army's Chinar Corps. Canada's Hogue inquiry found India the second most active foreign interferer in Canadian elections, using disinformation as a tool.

So the honest premise is this. Coordinated amplification around Indian politics runs in every direction: Pakistani, Chinese and Indian. The question for 2026 is not whether such things happen. It is whether they happened here, and whether anyone has shown it.

The Cockroach Janta Party: what the record shows

The Cockroach Janta Party was founded on 16 May 2026, the day after the Chief Justice's remark, by a political-communications strategist, Abhijeet Dipke. Its growth was the fastest any Indian account has recorded: 550,000 Instagram followers in 48 hours, 10.5 million by day four, 15.6 million by 21 May, when it passed both national parties, and 22 million by 23 May, with a million sign-ups and 600,000 signatures on a petition for the Education Minister's resignation. Its content was reels and memes around an AI-generated cockroach; its hashtag, #MainBhiCockroach, was carried by Sonam Wangchuk, Anna Hazare, Arundhati Roy and a run of actors.

A rise like that invites one of two explanations: a nerve touched, or a machine. The record of what followed tells you which one the state believed, and how little it has shown.

The follower graphic. On 21 and 22 May a pie chart circulated showing the account's followers as 49 per cent Pakistani, 14 per cent American, 14 per cent Bangladeshi and 9 per cent Indian. It was posted by a national secretary of the BJP's youth wing with the caption "Pakistan Janta Party", amplified by two television anchors, and repeated the next day by the Minister of State for Education. No source, tool or method was ever given for it. It could not have come from Instagram, because Instagram shows a follower-country breakdown only to the account's owner. The owner's own panel, which he recorded and Alt News published, showed 94.7 per cent of followers in India, and Pakistan absent. Alt News noted that it could not verify the recording independently; nobody outside Meta can. A fact-check by Oneindia put it plainly: the viral graphic was "unverified, as such country-specific data isn't publicly available on Instagram".

The blocking order. On 21 May the Ministry of Electronics ordered X to withhold the party's account in India under Section 69A, on an Intelligence Bureau input citing a threat to sovereignty. On 7 July the Delhi High Court ordered it restored after the Centre said it had no objection: the account had been blocked "at a time when the NEET examination was to take place" and the "primary concern underlying the blocking order was no longer relevant." The state's own account of the block, in other words, was the exam, not a foreign power.

The 480 handles. The police statement of 23 July said that "more than 400 Pakistani social media handles have been identified so far", that they were "spreading fake content and rumours", and that they were being blocked. In no report could we find which platform the handles were on, how "Pakistan-based" had been determined, under which legal provision they were blocked, or a single example. A "Pakistan-based" label can come from three places: the platform's internal data, a profile's self-declared location, or an inference from phone and IP records obtained by notice. None has been published. The number itself moved between "more than 400" in the police video and 480 in the briefings.

The digital conspiracy. In August the police told reporters of a two-week forensic investigation that had found an "artificial narrative" built between 20 and 23 July through thousands of fake profiles and foreign bot networks, named the party's founder and spokesman as under scrutiny, and sent notices to Meta, Google and X for server logs and the ownership of suspicious accounts. The three marketing firms have never been named in any official statement, and this series does not name them. One of the outlets that carried the story, DNA, added the sentence that matters: these allegations "are part of the police's working theory and are yet to be tested legally". Two months later there has been no arrest and no charge sheet in the digital probe. On 1 September the Supreme Court quashed all thirteen FIRs against the protesters.

The money. On 23 July a BJP MP said that "foreign forces have hijacked the students' outrage", naming Khalistani groups, Bangladeshi Islamists, Pakistan and "groups associated with the Soros Foundation". The evidence he cited was a video by Gurpatwant Singh Pannun, a sanctioned separatist, claiming a Zoom call and "almost 10 crore" rupees; the outlet that carried the video said it had not verified it. The next day the Ministry of External Affairs, asked whether the foreign-funding allegations were true, said: "I have no information to share on this issue with you." A petition in the Allahabad High Court seeking an NIA and ED probe was dismissed.

The platforms. Meta's two 2026 threat reports attribute no network to the Cockroach protests. Neither Graphika, DFRLab, the Institute for Strategic Dialogue, EU DisinfoLab nor any Indian research group has published a network analysis of the account's growth or the protest hashtags. We looked for one, because it would have settled the question. It does not exist.

What the record does document

What is documented about the information war of summer 2026 is almost entirely the state's side of it. A blocking order abandoned in court. Instagram removals under Section 79(3)(b) that took down, among other things, Alt News fact-checks and posts by Scroll and The Hindu. Police notices to Meta for the identities of creators, which Meta told its users it intended to comply with, after the FIRs they rested on had been quashed. A five-hour restriction of the Prime Minister's video on Facebook that produced a parliamentary summons for Meta, Google, X and Snapchat and a demand that Mark Zuckerberg apologise within three days, which he did. And the follower graphic that launched the "Pakistan Janta Party" line, posted by a party functionary without a source and repeated by a minister within a day.

This is not a finding that no foreign account ever posted about the protest. Pakistani accounts post about everything India does; the Operation Sindoor fog of May 2025 produced more than sixty false claims from Pakistani sources and, as Alt News documented, a comparable stream from Indian television that the government's fact-checkers ignored. It is a finding about scale and causation. A movement that gained twenty-two million followers in a week, filled Jantar Mantar for seven weeks and brought down a minister would show up in platform data, in a takedown, in a dataset or in a charge sheet if a foreign network had made it. Nothing of the kind has appeared.

The doctrine behind the vocabulary

The words matter, because they come from doctrine. In November 2021 the National Security Adviser told a passing-out parade of police officers that "the new frontiers of war, what we call the fourth-generation warfare, is the civil society", which "can be subverted, divided, manipulated to hurt the interest of a nation." The Army's Land Warfare Doctrine of 2018 had already defined a "grey zone" in which nations are neither at peace nor at war and committed the Army to "full spectrum information dominance" across it, including in internal security. A Director General of Information Warfare was created in 2020. The Chief of Defence Staff spoke of grey-zone warfare at Raisina in 2024 and, in his last year, of a "cognitive domain" in which sovereignty "has become functionally porous"; in September 2026, retired, he warned of "cognitive colonialism".

None of this is wrong as a description of how states now compete. But a doctrine that locates the front line in civil society gives every official a ready category for a protest he did not expect: not a grievance to be met but an operation to be countered. The Prime Minister's phrase in 2021, during the farmers' protest, was "foreign destructive ideology". Five years on, the category arrived at Jantar Mantar before the evidence did.

The last time this happened, the record was tested. In February 2021 the Delhi Police arrested a 22-year-old climate activist, Disha Ravi, over a protest "toolkit" and alleged links to a Khalistani group. Ten days later a sessions judge granted bail on what he called "scanty and sketchy evidence", noting that any call to violence was "conspicuously absent" from the document. The 2026 allegations have the same evidentiary status today that the toolkit case had before Judge Rana read the file.

How this could be settled, and why it has not been

It is worth saying what proof would look like, because the gap between the claims and the possible evidence is the finding.

Meta can see, and has in other cases published, whether a set of accounts shares devices, IP ranges and payment methods: that is its definition of coordinated inauthentic behaviour, and it is the standard its India and Pakistan takedowns of 2019 met. Researchers can build the second kind of proof from public data: account-creation dates clustered in a week, the same images and hashtag sequences posted within seconds, retweet rings; the methods are published and were enough for Stanford's Kashmir study and ASPI's Manipur one. A police force can produce the third kind by putting a case before a court.

The obstacles are real but not decisive. Follower geography is visible only to Meta and the account owner. X's full-archive data now costs five thousand dollars a month at the professional tier, so a study of #MainBhiCockroach is a five-figure exercise for an Indian lab. Bot classifiers misfire in Hindi and Urdu and cannot score suspended accounts, which are the only ones a blocking claim concerns. But the state faces none of these obstacles. It served notices on Meta, Google and X in August. If the server logs showed thousands of fake profiles managed by foreign automation, the material for a charge sheet, or at least a published summary, has been in official hands for two months.

What this part settles

Three things, and one it cannot.

First, coordinated amplification of Indian political argument is real and runs in every direction. Pakistan's military-linked networks, China's Sikh and Manipur operations, and India's own party cells, vendors and Army-adjacent networks are all on the platforms' record. Anyone who says foreign manipulation of Indian opinion is a fantasy is wrong.

Second, for the protests of 2026, no element of the foreign-hand account has met the evidentiary bar that past cases met. The follower graphic has no source and contradicts the only data that exists. The 480 handles have no platform, method or list. The digital conspiracy is a working theory without a charge sheet. The funding claim rests on a sanctioned separatist's video that its own amplifiers did not verify, and the foreign ministry says it has no information.

Third, the state's response to the movement is documented in detail, and it was heavy: a blocking order the Centre dropped in court, removals that reached fact-checkers and newspapers, identity notices after quashed FIRs. A government that had evidence of a foreign operation behind the largest youth movement in a generation would have every incentive to publish it. It has published the response and not the evidence.

What this part cannot settle is motive. Officials who reach for the foreign hand may believe it, may be applying a doctrine that tells them to expect it, or may find it useful. The record does not say which. Part 3 examined the money; Part 5 puts five movements side by side on one template, and Part 6 weighs all of it. The provisional verdict on the information layer is the one a court would give on this file: the allegation is unproven, and the burden of proof has not moved.

Method and sources

This part uses a three-tier standard for claims of coordinated amplification: documented (a platform attribution with numbers, a checkable dataset study, or a court finding), claimed (an assertion by an official, politician or outlet without published evidence), and unverified (not checkable against a primary source). Every item above is tagged accordingly in the research note, which lists each source with its date and status, the items that could not be fetched, and the full table of documented takedowns since 2019. Follower counts are press reports of the public counter, not platform data. Meta's transparency reports for 2023 to 2026, Graphika, the Stanford Internet Observatory, ASPI, EU DisinfoLab, the Oxford Internet Institute, Alt News, Medianama's censorship tracker and the Internet Freedom Foundation are the primary documentary sources; the Delhi Police, ministers and MPs are quoted from contemporaneous reports. The Wire's 2022 "Tek Fog" investigation was retracted and is not used.