Amal Kumar Tiwari, 22, a jobless resident of Buxar, was arrested on April 8 after sending a threat email to the United States Central Intelligence Agency in October 2025. Police found VPNs, dark web access tools, and fake identity documents on his devices. This was not his first offence.
By NewsRevolt India Desk | Published: April 15, 2026 | Buxar, Bihar
In October 2025, an unemployed 22-year-old man sitting in a village in Buxar district, Bihar, opened his laptop and emailed the Central Intelligence Agency of the United States. In that email, he offered to eliminate Prime Minister Narendra Modi. He named a price. He claimed he could carry out the act within 22 days.
It took nearly six months for the full weight of that act to land on him.
On the night of April 8, 2026, as Amal Kumar Tiwari returned home after dropping his father at a temple in Araria village, Buxar, Bihar Police arrested him. He is now in custody, being interrogated by both local police and central security agencies. His room has been sealed. His laptop, mobile phones, and other digital devices have been seized. Forensic teams are examining every gigabyte.
The case is as much a story about the vulnerabilities of an underprepared young man drawn to the dark web as it is about a serious, credible threat to the security of India’s Prime Minister.
What He Sent and What He Said
The email, sent in October 2025 to the CIA’s official digital address, was explicit in its claim and transactional in its framing. Tiwari did not send a vague, impulsive threat. He offered a service: the elimination of Prime Minister Modi, to be completed in 22 days, in exchange for payment.
Buxar Superintendent of Police Shubham Arya confirmed the details to ThePrint, stating that Tiwari “demanded money in exchange for compromising the security of the Indian Prime Minister.” SP Arya added that the accused had claimed he could “execute the task in 22 days.”
It remains unclear whether the CIA forwarded the communication to Indian intelligence agencies directly or whether the information reached Bihar Police through separate confidential channels. What is clear is that after receiving the tip-off, Gittikhadan police and Buxar Police launched a sustained investigation, registered an FIR under the Simri police station jurisdiction, and tracked Tiwari for months before making the arrest.
During interrogation, Tiwari offered multiple, shifting versions of events, as per police. Investigators believe the motive was not ideological but financial. “We suspect he wrote the email for money. His motive was to demand money in exchange for secret information,” a police officer involved in the investigation told ThePrint.
A History of Cyber Threats Going Back to 2022
What makes the Tiwari case especially alarming is that this was not his first brush with law enforcement over digital threats.
In 2022, when Tiwari was still a juvenile, he was detained in a coordinated operation by Kolkata Police and Buxar Police for allegedly sending a hoax email threatening to blow up Kolkata Airport. He was processed as a juvenile offender at the time, which limited the legal consequences he faced.
Four years later, now legally an adult, he allegedly returned to the same method: crafting threatening emails using digital anonymity tools, targeting institutions and individuals for financial gain.
Police found multiple Virtual Private Networks (VPNs) installed on his seized mobile phones, along with applications used to access the dark web. The VPNs would have allowed him to mask his physical location and IP address while sending the email. The dark web applications suggest a deeper familiarity with underground digital networks than would be expected from a random, impulsive actor.
Critically, investigators also recovered fake identity documents from Tiwari’s premises, which police said were being used for cybercrime-related activities beyond the PM threat case. The full scope of his alleged criminal activity online is still being determined.
Two Others Detained, Family Members Questioned
The arrest of Tiwari is not the end of the investigation. Buxar SP Shubham Arya confirmed that two other individuals have been detained in connection with the case, and that their precise involvement is still being established. Their identities have not been made public.
Police are also questioning Tiwari’s family members and associates. As of the last available update, no criminal involvement has been established against any family member. The investigation, however, is ongoing, with forensic teams still working through the seized digital equipment.
The scale of the response, involving local police, central agencies, and forensic units, reflects the seriousness with which Indian security establishments treat any threat to the Prime Minister’s security, regardless of whether the accused had the actual capability to carry it out.
The Larger Question: Threat or Delusion?
A consistent question that arises in cases like this is whether the accused represented a genuine threat or was acting out of a deluded belief that a foreign intelligence agency would respond to a cold email from an unemployed man in rural Bihar by wiring him money.
Investigators have not publicly concluded either way. That ambiguity is itself instructive. Tiwari clearly had technical knowledge. He used VPNs. He accessed the dark web. He had fake identity documents. He had done this before. Whatever his mental state or genuine capability, he was not operating entirely in ignorance of how to conceal his digital footprint.
The fact that he was nonetheless caught, through patient intelligence work rather than a dramatic operational failure, is a credit to the agencies involved. But the six-month gap between the email being sent in October 2025 and the arrest in April 2026 is a gap that will draw scrutiny.
What Charges He Faces
Tiwari has been booked under an FIR registered at Simri Police Station in Buxar. The specific sections under which he has been charged have not been fully detailed in official statements. Given the nature of the alleged offence, charges are expected to include relevant sections of the Bharatiya Nyaya Sanhita relating to threats against the state and its representatives, alongside provisions of the Information Technology Act covering cybercrimes and impersonation facilitated by fake identity documents.
Central agencies, including those responsible for the Prime Minister’s security, are also conducting parallel interrogation.
Bihar, Buxar, and a Recurring Problem
Buxar district is not a name that typically appears in national security conversations. But this case joins a growing pattern of cyber threat incidents originating from economically marginalised areas of India, where young men with technical knowledge, access to cheap internet, and no employment path are increasingly intersecting with the anonymity of the dark web and the transactional logic of ransom-based cybercrime.
Tiwari is not the first from such a background to have sent threats to foreign agencies or Indian institutions in the hope of receiving money. He is unlikely to be the last.
The arrest is a necessary and correct outcome. The investigation that follows must go beyond Tiwari himself, examining the digital ecosystem that made these acts possible, the networks he operated within, and whether others remain at large who either assisted him or share his methods.
Amal Kumar Tiwari is 22 years old. He had been flagged once before. The system caught him twice. The question worth asking is what happens to those it does not catch in between.
— NewsRevolt India | newsrevolt.in
Reported by the NewsRevolt Security and Crime Desk. Facts sourced from ThePrint, NDTV, and official statements by Buxar SP Shubham Arya, as published between April 8 and April 12, 2026.
