Threema: What Is This Encrypted Messaging App?

Investigators probing the recent explosion near Delhi’s Red Fort have highlighted the use of Threema, a Swiss-based encrypted messaging service, as a critical communication tool for the accused. The platform’s anonymity-focused design and restricted traceability made it central to the module’s covert planning, according to officials handling the case.

Background of the Case

The blast claimed several lives and prompted a multi-agency investigation into a suspected network operating across the capital. Authorities revealed that the three accused relied on secure digital channels to coordinate movements, exchange instructions and circulate sensitive documents while preparing for multiple attacks.

How Threema Was Used

Officials believe the group constructed a closed communication system using Threema’s architecture, which does not require phone numbers or email IDs for registration. Each user operates via a randomly generated ID, offering a high degree of anonymity. Investigators suspect the accused operated a private server, enabling file sharing, voice exchanges and message deletion that left limited recoverable data.

Why Threema Appeals to Covert Networks

Threema is known for its strong encryption model, absence of metadata retention and decentralised registration system. These features, originally intended for privacy-conscious users, also attract groups seeking to evade surveillance. Several similar apps — many blocked in India — offer anonymous identifiers, on-device encryption and self-erasing messages that challenge traditional monitoring methods.

Exam Oriented Facts

• Threema is a Switzerland-based encrypted messaging app banned in India since 2023.
• It uses randomly generated user IDs instead of phone numbers or email registration.
• The platform stores minimal metadata and allows message deletion on both ends.
• Many privacy-focused apps are used by criminal networks due to anonymity features.

Discovery and Investigative Challenges

The link to Threema emerged after agencies uncovered other encrypted channels linked to the module. Limited metadata and encrypted storage have made forensic reconstruction difficult, with investigators still analysing devices to trace the network’s full scale. Despite technical barriers, authorities believe that timely disruptions prevented a larger sequence of planned attacks across Delhi.