At 3:15 in the morning on July 8, a low-intensity grenade hit the wall of Sadar Moga police station in Punjab. The men who threw it were local boys in their twenties. The man who told them to do it has never set foot in India this decade - he's been living in the UK.

17 arrests, but only one name actually matters for policy

Who actually gets caught and who never does Look at the 17 names in this case.

Gagan alias Kali. Rajesh alias Khanna. Shubham alias Bhinder. Local men, arrested, facing trial under Indian law, their futures now tied to an Indian courtroom. Then look at the name the DGP said was actually running the operation: Iqbal Singh, alias Ravi Dhaliwal - sitting in the UK, outside the reach of the same courtroom, the same warrant, the same police station he allegedly ordered attacked.

That gap is the real story here, not the grenade. India's internal security apparatus is very good at catching the people who physically execute an attack - the local module, recruited, supplied and instructed to act. It is far weaker at reaching the person who never leaves their own jurisdiction while directing the whole thing by phone.

Punjab has now recorded this pattern repeatedly: a 2022 rocket-propelled grenade attack on Punjab Police's own intelligence headquarters in Mohali carried the same signature - foreign-based handler, local hands, cross-border weapon supply.

The mechanism worth understanding This isn't classic infiltration, where an armed operative crosses the border directly.

It's something closer to a franchise model. A handler abroad - protected by distance, by a foreign passport, by the slow grind of extradition law - identifies or cultivates local recruits, often already inside criminal networks rather than religious or ideological ones.

Weapons and explosives arrive not through the border fence but by drone, dropped at a coordinate, collected quietly. The handler never needs to touch Indian soil to run an operation on it. This is why the recovered items in this case matter as much as the arrests: an IED, an electronic detonator, a 9mm Glock, alongside the motorcycle used in the actual attack - a full weapons and logistics chain that had to physically enter Punjab from somewhere, almost certainly by air, not by foot.

Why this is a policy problem, not just a police case Punjab Police can arrest every local participant in this module and the structural vulnerability remains untouched, because the actual command node sits in a country India cannot simply walk into. Solving this requires two different kinds of state capacity operating together: better counter-drone detection at the physical border to intercept the arms supply chain and sustained diplomatic pressure - extradition requests, intelligence-sharing agreements, coordinated designation of individuals as terrorists - aimed at the country hosting the handler. Neither alone closes the gap. India can arrest every Gagan and Rajesh in Punjab and the Ravi Dhaliwals will simply recruit the next batch, unless the handler's own sanctuary becomes as costly to hold as the attack itself.