Zarrar Shah

Zarrar Shah (Urdu: ضرار شاہ, born 16 April 1979) is the Lashkar-e-Taiba's communications and technology chief, and also one its primary liaisons with the Pakistani intelligence agency ISI.^[2] According to The New York Times, Shah is "a senior Lashkar commander" and "a central character" behind the plot of the 2008 Mumbai attacks.^[3] Fox News reports Shah communicated with gunmen over the telephone and helped direct their activities as he watched the events unfold on television.^[2]

Shah was born on 16 April 1979 according to a report published by ProPublica and Frontline.^[4] According to a 2009 Pakistani First information report (FIR) released by the South Asia Terrorism Portal, Shah's birth name was Abdul Wajid, while Zarrar Shah and Rana were his aliases. The FIR revealed his father's name was Nazir Ahmed, who was a resident of Nangal Sahdan village in Ferozewala Tehsil, Sheikhupura District.^[5] Shah's existence was known to Indian authorities since at least 2006.^[4] In his late 20s, Shah rose to the rank of emir (chief) of the Lashkar-e-Taiba (LeT) media unit. This relatively young chief attracted the attention of Indian, American and British agencies. By September 2008, British agencies including the GCHQ were monitoring most of his digital activity and communications.^[6]

According to the confession of attacker Ajmal Kasab, on the 13th day of the month of Ramzan in 2008, Kasab and the nine other attackers met Shah, who taught them how to make an outgoing call from Pakistan appear like it was being dialed from another country. They were told Shah had a media room with detailed information about places in other countries, how he chooses targets from among these and then relays the targets to Zakiur Rehman Lakhvi.^[7] On the same day, CD footage and maps of the targets were shown to the attackers. Kasab in particular was shown targets like the Chhatrapati Shivaji Terminus station (CSMT, previously the VST), Malabar Hill and city roads going to these two targets.^[8] The two attackers going to the Taj Mahal Palace Hotel were shown a 3D model of the hotel, created by its management as an advertising tool. The attackers could thus familiarize themselves with the architecture of the hotel, its entries and exits, and the city road going towards Leopold Cafe.^[9]

Kasab probably met Shah at a new LeT base in Muridke, where he and other attackers trained under Shah in the Daura-e-Riba (intelligence gathering and accumulation). They were taught digital reconnaissance, surveillance, the deciphering and encrypting of digital communications, and also how to operate multiple communication channels. Shah then distributed wireless radios, GPS equipment and satellite phones (of the Hughes and Ascom brands, connected by Thuraya networks). Shah and his unit stayed at the base for a week to train the attackers.^[10] At the Baitul Mujahideen camp, they were told about the plan to attack Mumbai for the first time. At the camp, LeT chief Hafiz Saeed declared Lakhvi as the mission commander; the junior commanders appointed were Shah, Abu Hamza, Abu Kahafa, Yousuf Muzzamil, Alqama and Shahid Jamil Riaz.^[11] The ten attackers were then taken to the LeT base at Azizabad graveyard south of Gulberg Town. At this base, Shah had his media room with many electronic devices.^[12] In September 2008, Lakhvi and his junior commanders met to discuss the timeline of the attack.^[13]

On 20 October 2008, Shah contacted the New Jersey based company Callphonex to inquire about Voice over IP (VoIP) systems.^[1] He posed as Kharak Singh, a Mumbai-based telephone merchant.^[a] The VoIP system would make it look like calls between the Pakistani handlers and Mumbai attackers were originating in New Jersey and Austria.^[6] The VoIP services purchased by Shah were paid for by LeT members from Karachi and Barcelona.^[16] Meanwhile, at a training camp in Pakistan administered Kashmir (PaK), Shah and other LeT handlers showed the ten attackers how to navigate to their targets in Mumbai by using Google Earth. They mapped out the sea route to be taken, the landing area in Mumbai, and the city roads the attackers would use to reach their targets. According to Indian police officer Deven Bharti, the attackers were taught how to locate sites in Mumbai even before they arrived in the city, primarily by using Global Positioning System equipment.^[6] The attackers were shown video footage of their targets filmed by David Headley and received by Shah.^[17]

On 22 October, Shah looked up past terror attacks in India, and researched potential targets including the Taj Mahal Palace Hotel and luxury hotels in Delhi. He went over weather forecasts for the Arabian Sea, and checked if there were any ongoing naval exercises on the route. He put the VoIP system in place, which would make his outgoing calls appear like they were originating from area code 201 in New Jersey. In November, Callphonex asked why there had been no usage of its systems till then. Shah, using his disguise as Singh, said utilization would begin at the end of the month.^[6] Callphonex was also worried when the Kharak Singh email address, after every email sent, bore a new IP address located in one of various countries.^[15] The communications network used in the attacks was much more sophisticated if not multiple generations ahead of Indian police systems.^[18][19]

Five Austrian Direct inward dial numbers were purchased from Callphonex and used by the terrorists. The New Jersey number also purchased was a virtual number, and it was used to route the calls from the handlers to the attackers. The New Jersey number was paid for by a MoneyGram payment. The five Austrian numbers were paid for by a Western Union transfer from Pakistan to an agent in Brescia, Italy.^[20] According to British journalists Adrian Levy and Cathy Scott-Clark, this communication network was set up by Shah working in concert with the Owls, a group of young and unemployed technology students recruited from Karachi, Dubai and Gulf countries.^[21] Callphonex inquired why the payment came from Pakistan when the services were purchased by an Indian, but did not receive a response.^[20]

On 21 November, Shah gave each attacker one Nokia cell phone with Indian SIM cards, which would activate only after they moved into Mumbai waters. The attackers were told to switch on their phones only after they arrived in Mumbai. Lakhvi told the attackers Shah had stored a phone number in their cells which they could call to talk to their handlers.^[22] The Nokia India and USA branches found these cellphones had unique IMEI numbers and were purchased from Nokia China by Pakistani sellers.^[23] On 22 November, Shah was with the attackers as they travelled from Azizabad base to Keti Bandar, where they boarded the boat going to Mumbai.^[24] Shah tracked and guided the attackers via GPS as they sailed towards Mumbai.^[25]

On 24 November, Shah arrived at Malir Town in Karachi, where he established a digital control room with help from Indian terrorist Abu Jundal.^[b][28] This room was used by Shah and other LeT commanders to relay orders to the attackers. On 25 November, Abu Jundal checked if the VoIP system was working, while commanders Shah, Lakhvi and Sajid Mir waited for news updates on the attacks. On 26 November, the day of the attack, Shah wrote a press release claiming responsibility for the attack by the fake Hyderabad based group Deccan Mujahideen, and began to circulate it through his network.^[c][6] Before the attacks began, Shah looked up images of the Oberoi Hotel, and Wikimapia maps of Taj Mahal Palace Hotel and Nariman House (also known as Chabad House).^[6]

Shah and other LeT members present in the control room fasted throughout the day, and broke their fasts just before they started watching the attack on TV.^[26] Shah and the other handlers were constantly in touch with the ten attackers through cell phones, the VoIP system and Thuraya satellite phones.^[30] Upon entering CSMT, Kasab thought the crowd there was lower than what he had seen in the CD shown by Shah. They tried to contact their handlers, but could not get through due to low network coverage.^[31]

The other handlers were reportedly Abu Jundal, Major General, Kafa, Wassi,^[d] and Buzurg.^[e] According to a US military intelligence official quoted by Bill Roggio, the Major General mentioned here was Hamid Gul.^[34] According to the call recordings analyzed by Indian authorities, all the handlers except Kafa talked to the attackers at Nariman House. However, only Kafa, Wassi and Zarar talked to the attackers at the Oberoi Hotel; and only Wassi talked to the attackers at the Taj Mahal Palace.^[35] After attackers Fahadullah and Abdul Rehman killed their non-Muslim hostages at the tenth/eleventh floor of the Oberoi Hotel on 27 November, Shah told Fahadullah to search for a route to go to lower floors.^[36] When National Security Guard commandos were para-dropped at Nariman House on 28 November, Shah started looking for news updates, using search terms like Jew, Israeli and Chabad.^[4]

Officials of the Intelligence Bureau, India's internal security agency, claimed they were not monitoring Shah's online movements as claimed by the ProPublica and Frontline investigation. They said Shah's laptop activity and the naval route he mapped were shared by the GCHQ only after the attacks began. Before the attacks, GCHQ believed the intelligence they had was not detailed enough to be shared with Indian agencies.^[37] British, Indian and American agencies did not share the intelligence they had with each other before the attack. After the attack began, the agencies started collating their data to piece together the planning and timeline of the attack. Shivshankar Menon, the Indian foreign minister at the time, said the data was available but the analysis was lacking. Menon said monitoring Shah showed the limits of Signals intelligence without proper analysis.^[6]

Investigations of Shah's computer and email accounts revealed a list of 320 locations worldwide deemed as possible targets for terrorist attacks similar to the Mumbai attacks. Only 20 of the targets were locations in India. Analysts believed the list was a statement of intent rather than a list of locations where LeT cells were established and ready to attack.^[38] Shah was researching targets in Kashmir, Punjab, India, New Delhi, and Afghanistan, as well as United States Army bases in Germany and Canada. M. K. Narayanan, then the Indian National Security Advisor, asked American officials to provide the list of potential targets selected by Shah.^[6] In 2014, the New York Times released a redacted National Security Agency document, which revealed Shah had researched and reconnoitered multiple locations including the Gateway of India, other tourist sites, dams, power plants and various potential landing areas for the attackers' boats.^[39]

On 2 February 2009, in an interview with Karan Thapar on the CNN-IBN channel, Narayanan said Shah and Lakhvi were practically under house arrest and were not actually imprisoned.^[40] On 29 July 2009, Manmohan Singh, the Prime Minister of India at the time, claimed the FIA had sent a 34-page dossier with details of its investigation. According to Singh, the dossier stated Pakistan had extensive proof which confirmed the LeT carried out the attack. The dossier further detailed the charges filed against Shah and Lakhvi under the Anti-Terrorism Act 1997.^[41] Shah and Lakhvi were also charged with murder, abetment to murder, misuse of encryption and cyberterrorism.^[42] Intelligence researcher Prem Mahadevan argues Shah's arrest was allowed as the LeT's cybersecurity and communications were compromised under his watch. Mahadevan postulates Shah was "burned" in order to avoid blowing the cover of the ISI agents involved.^[43]

In March 2009, Shah, Lakhvi and Yousuf Muzzamil Bhat, all imprisoned at the time, were replaced as LeT commanders in Kashmir by Abu Anas, Hyder Bhayee, Huzefa (Abdul Ghaffar) and Walid.^[44] Also in March 2009, Shah's involvement and his real name were uncovered after a joint effort by the Federal Bureau of Investigation (FBI) and Indian agencies. They recorded Shah's voice from the VoIP calls, and questioned LeT terrorists imprisoned in India and elsewhere about the identity of this person. Kasab confirmed Shah's fake identity, however, he was not aware Shah's real name was Abdul Wajid. The FBI also wanted to interrogate Shah's co-accused Mazhar Iqbal, also known by his alias Abu Alqama.^[16]

On 26 August 2009, Interpol issued red corner notices for Saeed and Lakhvi; at the same time, India appealed for similar notices against Shah and Alqama after submitting the evidence against them, Interpol said it was still examining this evidence. The red corner notices were issued after the Indian Central Bureau of Investigation submitted non-bailable warrants approved by investigating judge M. L. Tahaliyani on 23 June.^[45][46][47]

In December 2009, Indian authorities requested the Pakistani Federal Investigation Agency (FIA) to provide photographs and voice samples of Wajid/Shah so they could comprehensively confirm his identity. However, the FIA did not respond to their requests.^[48] One of the issues the FBI wanted to interrogate Shah on was whether any Pakistani officials or government organizations helped them execute the attacks.^[16] According to research by Indian think tank Observer Research Foundation, Brigadier Riaz Chibb of the ISI regularly communicated with Shah and other LeT commanders.^[49] After the 2008 bombing of the Indian embassy in Kabul, US intelligence sent India intercepted calls between the attack's planners and ISI officials. Some of the numbers which the Mumbai attackers called belonged to these officials, according to Indian journalist Prem Shankar Jha. Also, Shah was in touch with the ISI even after the LeT was officially banned in Pakistan.^[50]

The FBI evidence named "A", a LeT commander the Pakistani government knew about and who had significant powers within the LeT. According to journalist Vijay Singh of The Times of India, "A" was actually Zarrar Shah.^[17] As of 2016, seven years after the attacks, Indian authorities were still waiting for the complete records GCHQ and the other Five Eyes agencies had on Shah. Indian officials said GCHQ most probably had access to all of Shah's emails, and had the technology to record all the conversations in the Karachi control room during the attack. Western agencies also might have accessed all devices linked to the VoIP system. Indian officials said Western agencies did not share this information to avoid incriminating the ISI and damaging their relations.^[51] As of 2014, according to journalist Sebastian Rotella, Shah and other LeT commanders were still able to execute acts of terror from their jail cells. According to former American intelligence agents, they had a control room in Adiala similar to the one they had in Karachi.^[1]

According to Indian journalist Praveen Swami, many Indian officials believe Zarrar Shah is actually just another alias of Sajid Mir. Swami says Abdul Wajid might be a junior Lashkar member who was arrested and said to be Zarrar Shah, because the FBI was denied approval to interrogate him. However, the FBI was also refused access to Lakhvi and Mazhar Iqbal. Swami says the voice samples and photographs of Wajid were not provided to Indian authorities because this may confirm Wajid was not the person behind the alias of Shah. However, voice samples and pictures of Lakhvi and Mazhar Iqbal also were not provided.^[52]

On 10 December 2008, Pakistan announced the arrest of Shah for his role in the Mumbai attacks.^[53] Shah was one among the ten to twenty LeT militants arrested during raids in PaK.^[30] Shah and Lakhvi were reportedly arrested from an LeT camp near the PaK capital of Muzaffarabad.^[54] Admiral Michael Mullen, the US Chairman of the Joint Chiefs of Staff, praised the raid and arrests, saying it was an initial step towards peace in the region.^[55] On 31 December 2008, Pakistan announced Shah's confession of LeT's involvement and his own central role in the attack. According to Pakistani officials, Shah's interrogation confirmed most of the details obtained from Ajmal Kasab, the only captured attacker.^[56] However, Farhatullah Babar, the spokesperson for President Asif Ali Zardari, said on the same day that he was not aware of any such confessions.^[57] Shah was among 35 LeT operatives wanted by the Mumbai Police for planning and facilitating the attack between December 2007 and November 2008.^[58] Voice recordings of Shah, Lakhvi and three others were taken from the calls they had with the attackers. However, these recordings were not admissible in Indian courts as they weren't attributed to official sources.^[59]

In January 2009, the FBI sent its evidence to Pakistan, including the call transcripts of Shah, Lakhvi and the attackers; and the fake email claiming responsibility for the attack sent by Shah.^[60] As of February 2009, the FBI hadn't received Pakistani approval to interrogate Shah and Lakhvi, according to David C. Mulford, the US Ambassador to India. There were also reports about the ISI refusing to hand over Shah and Lakhvi to the FIA.^[61] On 12 February, Rehman Malik, interior adviser to the prime minister, stated Shah was still in custody and allegedly wrote the emails claiming responsibility for the attacks.^[62][63][64]

On 15 February 2009, Shah was remanded to the custody of the FIA by Anti-Terrorism Court (ATC) judge Sakhi Muhammad Kahut.^[54] Shah was to be held in FIA custody till 3 March. On 4 March, Kahut extended his remand by two weeks.^[65] On 7 March, the FIA told the interior ministry it might have to stop the investigation because India and other countries were not sending the required evidence.^[66] On 19 March, Kahut extended the remand by 14 days,^[42] as Shah and the others were scheduled to see the CD footage of the attack sent by India.^[67] On 14 April, Kahut placed Shah, Lakhvi and two others in further custody for two weeks till 28 April, as the FIA hadn't finished its charge sheet till then.^[68] On 28 April, an interim charge sheet was filed.^[69]

On 12 May, the ATC granted the FIA more time to submit the final charges against Shah and the other accused. The same day, the US Embassy in Islamabad sent a cable to the US Secretary of State which was published by WikiLeaks. The embassy appreciated the FIA's investigation and the strong case it had, but said the agency did not have enough evidence to convict the five accused. The embassy said such evidence was not shared by India, and in cases where evidence was shared, it was never judicially certified and usually of low quality. The FIA needed either the call recordings of the LeT handlers, "or a sworn testimony by suspects in Indian custody regarding the recordings". The FBI also could not share the evidence without Indian authorization. The embassy officials lamented the possibility of the LeT handlers' acquittal because of a lack of evidence.^[70][71]

Also on 12 May 2009, Anne W. Patterson, the US Ambassador to Pakistan at the time, sent a diplomatic cable which said the evidence India was sending to Pakistan was not judicially certified. Patterson said Pakistan would have to acquit Shah and Lakhvi because of this issue.^[72] On 6 June, judge Awan adjourned the trial of Shah and others till 20 June.^[73] In July, the FIA submitted a 61-page report to the ATC with details of all the accused including Shah.^[74] On 18 July, the updated charges were filed.^[69] In August, presiding judge Baqir Ali Rana banned media coverage of the trial.^[75] On 5 September, Rana adjourned the case till 19 September.^[76] Rana reportedly received death threats from the LeT due to his role in the trial. He asked to be recused from the case, and was replaced by Malik Muhammad Akram Awan in October 2009.^[77]

Shah and the four other accused were tried on camera at Adiala Jail in Rawalpindi to maintain secrecy. Their lawyers were told not to talk about the case. Pakistani newspaper Dawn News claimed the trial was held on camera to ensure the safety of the judge, lawyers and witnesses.^[78] On 25 November 2009, all the accused pleaded not guilty when the charges against them were filed. Their trial was scheduled to begin on 5 December.^[79] The charge sheet states Shah and Mazhar Iqbal ordered the attackers to murder as many people as they could.^[14] Defence lawyer Rajput said he could not estimate when the case would conclude, because the ATC was trying many other cases at the time. From May 2009 to May 2010, the court conducted more than ten hearings. According to Rajput, the charges levied against the five accused were not comprehensive, which would prolong the case.^[80]

On 27 January 2010, Pakistani prosecutors said the evidence they had was enough to prosecute Shah, Lakhvi and the five other accused. However, on 25 April, Pakistani officials suggested the trial of these seven could not conclude till India extradited Kasab to Pakistan as a witness. On 24 December 2010, India proposed a commission be sent to Pakistan in order to question Shah and Lakhvi and get their voice samples.^[74] On 11 November 2012, during an ATC hearing, officials of the Pakistani Crime Investigation Department (CID) said Shah, Lakhvi and three others trained the Mumbai attackers at Yousaf Goth in Karachi's Gadap Town, and Mirpur Sakro in Thatta.^[81][82] At the same time, the FIA asked the ATC to conduct daily hearings, and the Pakistani administration suggested amendments to the evidence law, removing the compulsory consent required for obtaining voice recordings from accused persons. The hearing was adjourned to 17 November.^[83]

In May 2013, Chaudhry Zulfikar Ali, the FIA public prosecutor in the case, was assassinated in Pakistan's capital Islamabad.^[84] In April 2018, Chaudhry Azhar, the FIA prosecution chief in the case since 2009, was removed from the case and told to stop investigating it further. By then, the ATC had heard all the Pakistani witnesses, and said the case could not proceed until 24 Indian witnesses gave their statements in Pakistan.^[85] From 2008 to 2017, over a period of nine years, the presiding judges were changed nine times, and thus the case stalled indefinitely.^[86] In 2015, the Islamabad High Court ordered the case be concluded in two months. In April that year, Lakhvi was freed on bail while the other six accused continued to remain in custody at Adiala Jail.^[87]

By January 2016, the ATC had heard 68 prosecution witnesses.^[88] The testimony of the last two witnesses was scheduled for May 2018,^[f][89] when the ATC resumed the case after Prime Minister Nawaz Sharif said 26/11 was probably executed by Pakistani terrorists,^[90] and the trial was delayed because of civilian-army intervention. Shahrukh Arjumand was the presiding judge, and he ordered the FIA to ascertain whether the 27 Indian witnesses in the case were willing to testify. The FIA hadn't informed the ATC about the position of the Indian witnesses since January 2016.^[91]

• Basrur, Rajesh; Hoyt, Timothy; Hussain, Rifaat; Mandal, Sujoyini (2009). The 2008 Mumbai Terrorist Attacks: Strategic Fallout (PDF). Singapore: S. Rajaratnam School of International Studies. ISBN 9789810846848. JSTOR resrep05887. Archived (PDF) from the original on 26 March 2025.
• Bhasin, Avtar Singh (2010). India's Foreign Relations – 2009: Documents (PDF). New Delhi: Geetika Publishers; Ministry of External Affairs. ISBN 9788190315081. Archived (PDF) from the original on 8 June 2023.
• Farina, Major Joseph I. (2019). "Cyberspace in the Megacity: Thickening the Fog of War?". In Jensen, Benjamin M.; Breitenbauch, Henrik; Valeriano, Brandon (eds.). Complex Terrain: Megacities and the Changing Character of Urban Operations (PDF). Quantico, Virginia: Marine Corps University. doi:10.56686/9780160954344. ISBN 9780160954344. Archived (PDF) from the original on 27 May 2025.
• Levy, Adrian; Scott-Clark, Cathy (2013). The Siege: The Attack On The Taj. New Delhi: Penguin Books. ISBN 9780143420101.
• Reich, Pauline C.; Gelbstein, Eduardo (2012). Law, policy, and technology: Cyberterrorism, information warfare, and internet immobilization. Hershey, Pennsylvania: IGI Global. ISBN 9781615208319.
• Rodrigues, Rommel (2010). Kasab: The Face of 26/11. New Delhi: Penguin Books India. ISBN 9780143415473.

• The State of Maharashtra v. Mohammed Ajmal Mohammad Amir Kasab (Mumbai HC 21 February 2011), Text, archived from the original on 24 May 2024.
• "Mumbai Terrorist Attacks (Nov. 26-29) | Indian Dossier, Annexure 1" (PDF). The Hindu. Archived from the original (PDF) on 17 January 2009.
• "Indian Dossier, Annexure VII" (PDF). The Hindu. Archived from the original (PDF) on 17 January 2009.

• Glanz, James; Rotella, Sebastian; Sanger, David E. (21 December 2014). "In 2008 Mumbai Attacks, Piles of Spy Data, but an Uncompleted Puzzle". PBS Frontline. Archived from the original on 14 October 2023.
• John, Wilson (April 2009). "Military-militant nexus in Pakistan and implications for peace with India" (PDF). ORF Issue Brief. 17: 4–5. Archived (PDF) from the original on 6 September 2025.
• Mahadevan, Prem (January 2019). An Inconvenient Reality: 26/11 as State-Sponsored Terrorism (PDF) (Report). Archived (PDF) from the original on 31 March 2022.
• Mahadevan, Prem (27 June 2019). "A Decade on from the 2008 Mumbai Attack: Reviewing the question of state-sponsorship". International Centre for Counter-Terrorism. Archived from the original on 28 September 2025.
• Peevey, Anna Belle; Sanger, David E.; Glanz, James; Larson, Jeff; Rotella, Sebastian; Jennings, Tom (2014). "Web of Terror | MIT Docubase". MIT Docubase. Archived from the original on 18 June 2025.
• Roul, Animesh (4 March 2009). "Lashkar-e-Taiba Resumes Operations Against Indian Forces in Jammu and Kashmir". Jamestown Foundation. Archived from the original on 18 December 2025.

• "State vs Hammad Amin Sadiq etc" (PDF). BBC. 25 November 2009. Archived from the original (PDF) on 29 December 2009. The court chargesheet filed against Shah and 6 other accused.