Ritesh Bhatia (@riteshb2) header
Ritesh Bhatia (@riteshb2) profile picture

Cyber Crime Investigator. Founder and Director - V4WEB Cybersecurity. TEDx Speaker. Certified Fraud Examiner.

Cyberspace
Joined July 2014
Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)Photo by Ritesh Bhatia (@riteshb2)
Ritesh Bhatia retweeted
Please to speak up and share in solidarity. If IFF's account disappears from X we may not be able to reach in future.
Delhi Police asks X to take down IFF's account and posts. IFF will challenge the notices in court unless they are withdrawn. The Delhi Police has asked X to remove the Internet Freedom Foundation's account, six of its posts, the accounts of SFLC and @geoblockedindia, and posts by 16 other users, on the ground that they defame the Rashtriya Swayamsevak Sangh. The posts document and comment on a legal notice sent in the RSS's name to IFF, SFLC and @geoblockedindia, which demanded that the three stop criticising and documenting government blocking orders. IFF received copies of the two police notices from X on the morning of 3 November 2026. IFF calls on the Delhi Police to withdraw both notices. If they are not withdrawn, IFF will challenge them in court. What has happened On 29 October 2026 at 9:54 PM, IFF, SFLC and the operator of @geoblockedindia received a two-page "legal notice" said to be issued on behalf of the RSS. It asked the three to stop opposing the government's blocking directions, stop documenting restricted content, stop posting details of geo-blocked posts, and confirm in writing within seven days that they would comply. It was signed by an unnamed "Authorised Signatory". Several RSS office-bearers have since said on X that the notice is not authentic. IFF replied to the notice, wrote to the RSS at its official address asking whether it had authorised it, and published both the notice and its reply on 30 October. On 31 October 2026 at 8:06 PM, the Special Commissioner of Police (Crime), Delhi Police, filed an "Illegal Content Report" with X (reference LD-321926). It listed two posts: IFF's post of 30 October on the notice, and SFLC post of the same day. The stated reason was that the posts are "defamatory towards the Rashtriya Swayamsevak Sangh under Section 356 of the Bharatiya Nyaya Sanhita, 2023". The boxes for "safety/security", "defamation" and "other" were ticked. The fields for the nature of the court order and court order details were left empty. The desired action was "Remove/withhold content". On 1 November 2026, a second notice arrived in the RSS's name. It said the matter had been handed to the Akhil Bharatiya Adhivakta Parishad, that complaints had been filed in several states, and that requests had been made to block IFF's X account and suspend the organisations. The Delhi Police had made its first request to X the previous evening. IFF did not know this until X told it on 3 November. On 2 November 2026 at 8:51 AM, the Special Commissioner of Police (Crime) filed a second notice with X (reference LD-322956). It lists 40 URLs. Thirty-seven are posts. Three are the entire accounts of @internetfreedom, @SFLCin and @geoblockedindia. This time the boxes for "Hate speech", "defamation", "safety/security", "enforcement of court order" and "other" were all ticked. The court order fields were again left empty. The stated reason reads: "The posts constitute defamation and illegal content under Section 356 BNS. Under Rule 3(1)(d) of the IT Rules, 2021, read with Section 79(3)(b) IT Act, lawful notices require action within 3 hours." The 16 other users are @ProdctiveUseful, @PanjwaniManoj, @jidge_, @RatanSharda55, @baxiabhishek, @SchrdingersDbag, @ashleshbiradar, @seemay, @NasirHussainINC, @Being_creat_ive, @AjoyDharmavaram, @othlaw, @_ananyaaa, @AimPoojaind, @incorigibleBhai and @rraoind. Their posts, as far as IFF can tell, comment on the notice or on the notice about it. X forwarded both notice to IFF on 3 November 2026, at 8:47 AM and 10:03 AM, saying it was doing so "in the interest of transparency" and that IFF may wish to seek legal counsel and challenge the request in court. X's emails do not say that it has acted on the requests. The Delhi Police has not written to IFF, and no court has been approached, as far as the reports disclose. SFLC and @geoblockedindia have separately reported notifications from X about requests from the Uttar Pradesh Police, the Telangana Police and the Delhi Police's Cyber Crime unit, one of them against the whole of the @geoblockedindia account. IFF's position IFF condemns this legal action. A police force has made itself the enforcement arm of a private legal notice whose authenticity the organisation it names has not confirmed, and whose demand was that three organisations stop documenting censorship. The notices would deliver exactly what the notice asked for as they would also remove the accounts of the three groups in India that keep public records of what is blocked, and of who ordered it. The posts in question are about a legal notice sent to us. They quote it, criticise how it was drafted, and say that we will carry on with our work. A person who receives a threat is entitled to publish it and answer it and that is not defamation of the sender. In the three weeks before the first notice, IFF assisted 86 people whose accounts were suspended or whose posts were withheld in India. SFLC's Free Speech Tracker recorded about 268 content restrictions and 83 account restrictions in the first 29 days of October. @geoblockedindia publishes the orders behind such blocks when platforms disclose them. None of this is unlawful. Documenting censorship and challenging it in court is what the Constitution expects of citizens. IFF will not delete the posts. If the Delhi Police does not withdraw the notices, we will challenge them in court. Why the reports are unlawful Defamation is not a police matter. Section 356 of the Bharatiya Nyaya Sanhita, 2023 is a non-cognizable and bailable offence. Under Section 222 of the Bharatiya Nagarik Suraksha Sanhita, 2023, no court can take cognizance of it except on a complaint by the person aggrieved. Under Section 174 of the BNSS, the police cannot investigate a non-cognizable offence without an order of a Magistrate. The Special Commissioner of Police (Crime) is not the person aggrieved. The notices disclose no complaint by the RSS and no order of any Magistrate. Whether a statement is defamatory is for a court to decide after hearing its author, with the defences of truth, fair comment and good faith available to that author. In Subramanian Swamy v. Union of India, (2016) 7 SCC 221, the Supreme Court upheld criminal defamation on the strength of these safeguards. A police officer who asks a platform to remove speech as defamatory has decided the question himself, without a complainant, a court or a hearing. The posts are protected comment. Exceptions 1 to 3 to Section 356(1) protect the truth published for the public good, opinion on the public conduct of public servants, and opinion on the conduct of any person touching a public question. The posts publish a notice that was sent to us and give our opinion of it. The RSS, if it sent the notice, chose to enter a public question. If it did not, the posts defame no one. Further, Section 79(3)(b) and Rule 3(1)(d) do not permit this. In Shreya Singhal v. Union of India, (2015) 5 SCC 1, the Supreme Court read down Section 79(3)(b) so that an intermediary acquires "actual knowledge" only through a court order, or a notification from the appropriate government or its agency that unlawful acts relatable to Article 19(2) are being committed. The court said that it would be difficult for intermediaries to judge the legitimacy of the millions of requests they receive, and that the burden must not be placed on them. Rule 3(1)(d), as amended in November 2025 and February 2026, now requires the intimation to come from an officer not below the rank of Joint Secretary or Deputy Inspector General, to be reasoned, and to specify the legal basis and the nature of the unlawful act, subject to a monthly review by a Secretary-level officer. The three-hour window the notice invokes applies to a lawful order that meets these conditions. A web form that ticks "hate speech" and "enforcement of court order" while leaving the court order fields blank, and that gives one sentence of reasons for 40 URLs, is not such an order. The notices by the Delhi Police are disproportionate. They seek to remove three accounts in their entirety, with years of posts, over six, four and eleven posts respectively. They sweep in 16 third parties whose only connection is that they commented on a public controversy. In Anuradha Bhasin v. Union of India, (2020) 3 SCC 637, the Supreme Court held that any restriction on speech must be necessary, proportionate and the least restrictive measure available, and that orders restricting speech must be published and reasoned. Removing an organisation's entire account for criticising a legal notice fails each of these tests. The effect is to silence documentation of censorship and providing legal aid to Indian internet users. The accounts named are those that record blocking orders in India. The notice asked them to stop. A takedown request that accomplishes the demand of an anonymous private notice is not law enforcement. It is the use of state power for a private end, which Article 14 forbids. Our demands 1. To the Delhi Police: Withdraw reports LD-321926 and LD-322956 and confirm the withdrawal in writing to X and to IFF. 2. To the Delhi Police: Disclose the complaint on which the Special Commissioner of Police (Crime) acted, the authority under which the reports were filed, and whether any order of a Magistrate under Section 174 BNSS exists. Disclose every request made to any platform in this matter, including those made by the Cyber Crime unit against @geoblockedindia. 3. To X: Do not act on the reports. If any content is withheld in India, tell the affected user before acting, give them the full request, and name the legal basis. Publish both reports to the Lumen database, as the reporting form itself contemplates. 4. To the Ministry of Electronics and Information Technology and the Ministry of Home Affairs: Have the Secretary-level review required by Rule 3(1)(d) examine these intimations, and tell police forces that Rule 3(1)(d) is not a remedy for defamation, which the law reserves to the person aggrieved and to the courts. 5. To the RSS: State publicly whether it authorised either notice or any complaint to the police. If it did not, say so to the Delhi Police. If the notices are not withdrawn, IFF will challenge them in court. We will continue to document blocking orders, to publish them, and to provide legal assistance to anyone whose account or post is withheld in India. Nothing in these notices changes that.
4
539
17
960
39,284
Ritesh Bhatia retweeted
This is in very bad faith Yuvraj. You are a good cricketer, you are a strong human, a cancer survivor. But you are an absolute health and science illiterate. People like you and your business of bad science deeply damages science literacy and public health in our society. It is a pathetic. You can be powerful allies for cancer patients and oncology societies and use your voice to educate people on evidence-based preventative care and direct cancer patients towards science-based care for improved survival outcomes. But instead, you chose to team up with unethical businessmen - some with long degrees, lengthy certifications and in high positions without any functioning brain cell - and among them, one of the worst "health" influencers on the internet right now, the so-called cancer surgeon Arpit Bansal who is a pseudoscience sympathizer, an Ayurveda apologist and quite similar to Luke Coutinho, but with actual medical degrees wasted. Know this first: Cancer patients who use alternative medicine die sooner, study finds - nbcnews.com/health/health-ne… Now coming to your product - P32 Among the 32 listed ingredients with 35+ distinct compounds in them, 13 carry documented risks of organ toxicity, mineral toxicity, capable of causing/promoting atherosclerosis inducing toxin generation, and with high rates of toxic environmental contamination. Four ingredients - Ashwagandha, Bacopa, Curcumin and Boswellia are among the most frequently implicated botanicals in liver injury in LiverTox registries. When they come together, it is going to be disastrous. medpagetoday.com/gastroenter… - The person who designed this complex formulation is really a clown. Nearly all 30 active ingredients in this 32-ingredient supplement lack solid scientific proof for the health benefits promised on the label. First, the company's own chart admits that eight ingredients have no gold-standard human trials behind them - two are just inactive fillers, and six rely on weaker data or are added only for safety, yet are still marketed as multi-organ boosters. At least 11 ingredients are "fairy-dusted," meaning the sachet contains only a tiny fraction of the daily dose actually proven to work in human studies. High-level clinical and translational evidence demonstrates that several components in this sachet can actually increase cancer risk or accelerate tumor progression in healthy adults: Vitamin E (prostate cancer), combined folic acid+B12 (lung and colon cancer) and NAC, Vit E, Vit C, Astaxanthin (increase risk of cancer spread). See this paper: Supplement Use and Increased Risks of Cancer: Unveiling the Other Side of the Coin - pmc.ncbi.nlm.nih.gov/article… Finally, the product stretches basic science by assuming that because a nutrient deficiency harms certain organs, taking extra amounts will supercharge those same organs in healthy adults who already get enough nutrients. Your product is absolute BS just like the whole of herbal and dietary supplement industry is. Have some shame selling this nonsense to public and people with cancer. I hope nobody accepts your stupid invite.
My second innings starts now. In 2011, I played the World Cup with cancer. Nobody knew. Neither did I. Now I take my daily health very seriously. So should entire India. Most Indians who take supplements take one, two or three. That isn’t enough to run the body. So we built Protocol32: 32 FSSAI-approved supplements, in the right quantities for an average Indian, working together to run 13 chains in the body. One sachet a day, mixed in water or milk. Co-formulated with Dr. Anurag Agrawal and Dr. Arpit Bansal. Built with Prashant Pitti and Prasad C P. Made in Bangalore. Swipe through to see every supplement, every dose and every chain. Protocol32 is invite only. The first batch is only a few hundred people, and we’re starting with fitness, health and nutrition creators, doctors, dietitians, entrepreneurs and celebrities. Apply at protocol32.com @P32wellness
155
1,392
36
7,252
614,762
We 3 speak on the actionable items that people should take. Thank you for having me on your show. Always a pleasure to be with @jiten_jain and @AdvPrashantMali
#CoverStory | हैकिंग का साया, पूरा विश्व घबराया ! दुनिया की 70% वेबसाइट पर खतरा? AI ने खोजी PHP की सबसे बड़ी खामी 24 घंटे...साइबर वर्ल्ड में हड़कंप PHP में मिलीं दो गंभीर खामियां देखिए साइबर लॉ एक्सपर्ट Dr. Prashant Mali, साइबर सिक्योरिटी एक्सपर्ट Jiten Jain और साइबर क्राइम इन्वेस्टिगेटर Ritesh Bhatia से ज़ी बिज़नेस एंकर Deepak Dobhal की खास बातचीत #CyberSecurity #PHP2Shell #PHPVulnerability #AI #AIHacking #CyberAttack #InternetSecurity @AdvPrashantMali @jiten_jain @riteshb2 @AnchorDeepak_
1
113
Ritesh Bhatia retweeted
SCOOP: The Censor Board has had a data breach exposing hundreds of documents from the e-Cinepramaan portal. Application dockets were uploaded in bulk on the Internet Archive by a user with a display ID that of Prasoon Joshi's name in Russian.thehindu.com/sci-tech/techno…
10
148
16
538
33,618
It has name, DOB, gender, mobile, email, full address , annual income, occupation, branch IFSC, CKYC number, religion, social category, and a VKYC session URL parameter. Imagine victim getting a call - Sir, your VKYC was incomplete, please share the OTP to activate your account.
Statement : SBI has told the stock exchanges about its data breach, but not the customers whose data was leaked New Delhi, 21 October 2026 Today, the State Bank of India told the BSE and the National Stock Exchange, in a disclosure under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, that it has experienced an incident involving the loss of customer data. On 16 October 2026 the bank received alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In that its customers’ data was available on the dark web. Its preliminary analysis of about 3.75 lakh records found 3,897 customer records containing personal information. These include registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and details linked to loan records. The bank says it does not yet know where the data came from, and it has engaged a CERT-In empanelled agency to find out. SBI did not detect this breach itself and learnt of it from outside agencies after the data had already been published. On the same day, a threat monitoring account on X flagged a claim by a group calling itself “Siriusim” that it had released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account opening forms. The bank’s disclosure does not mention these documents. It also does not say what the remaining records, beyond the 3,897 it has identified, contain. At the time of this statement, SBI has not said that it has informed any of the affected customers, and its disclosure is silent on the point. Five days passed between the alert and today’s filing. The filing assures investors that the incident has no material impact on the bank’s operations, financial performance or business continuity. However, it does not state anything to the 3,897 people whose phone numbers, dates of birth and home addresses are now with fraudsters. These customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them. A customer cannot guard against a fraud she has not been warned of. The Internet Freedom Foundation calls on SBI to inform every affected customer directly and without further delay. We regret to note that the law in force today does not compel the bank to do so. Section 8(6) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to intimate a personal data breach to the Data Protection Board and to each affected Data Principal, and Rule 7 of the DPDP Rules, 2025 prescribes how this is to be done. But the Union Government chose a staggered commencement, and these provisions will take effect only on 13 May 2027, nearly four years after Parliament enacted the law. The reporting obligations that apply today, under the CERT-In Directions of 28 April 2022 and the RBI’s cyber security framework for banks, are owed to regulators and not to customers. A listed bank is bound to keep the stock exchanges informed. No law in force clearly binds it to inform the people whose data it holds. Our demands 1. SBI must inform each affected customer by SMS, email and letter to the registered address, in English, Hindi and the language of the customer’s branch, stating what data was exposed and what steps they should take. It should open a dedicated helpline and an online facility for customers to check whether their data is affected. 2. SBI must state what the 3.75 lakh records and the 2,722 documents contain, how many customers they relate to, and whether they include KYC documents such as Aadhaar, PAN or passport copies. 3. When the investigation concludes, SBI must disclose how the data left its systems, including whether it came through a vendor or a direct selling agent, and publish a summary of the investigating agency’s findings. 4. The Reserve Bank of India should direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement of the DPDP Act. 5. The Ministry of Electronics and Information Technology should bring Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules into force immediately.
5
95
1
292
9,756
To all those who are mindlessly posting or reposting SBI data breach image shared by the threat actor, please note that the sample data has personal and sensitive details of victims. Kindly avoid or at least mask it. #SBIDataLeak
107
Ritesh Bhatia retweeted
News Alert! Maharashtra to impose minimum 10 pc water cut in all urban and rural local bodies from Oct 16 amid deficient monsoon.
62
260
54
1,887
121,151
Ritesh Bhatia retweeted
😂🔥
30
1,041
56
5,852
273,956
Ritesh Bhatia retweeted
When the legend @ravish_journo sir himself gives a shout out to The Telescope, it means we are doing something right. Humbled and blessed 🙏🏻♥️ Do subscribe to The Telescope on YouTube and follow on Instagram
20
405
2
2,264
21,956
₹2 buys a stranger's home address. We tested a Play Store app with 10M+ downloads selling VAHAN/eChallan data, one number plate gave us the owner's full name, father's name, permanent address, insurance policy, chassis and engine numbers, all of which Parivahan masks behind an OTP. This isn't a hack. Researchers at Cyderes traced it to licensed API keys given to KYC companies, now resold on Telegram. IFF has written to MoRTH, NIC & CERT-In demanding a forensic audit, and filed RTIs on 22 Sept. Found your own data on these apps or similar website? Write to [email protected]
53
747
69
1,288
97,597
Ritesh Bhatia retweeted
Replying to @News18India
@News18India वालों भांग खाकर बैठे हो क्या? Nidhi Tiwari नाम की Social Media Influencer की suicide की खबर में मेरी फोटो चला दी कम से कम खबर चलाने से पहले ये तो verify तो कर लिया करो कि जिस इंसान की फोटो लगा रहे हो वो वही है भी या नहीं
886
1,998
279
8,348
472,108
Ritesh Bhatia retweeted
My daughter has been brutally assaulted by Anmay Kumar, attempted to murder her , punched her face with his wrist, her stomach, dragged her hair , took her to the bathroom, slut shamed her , tried to break her hands , he threw her on the floor as a result her toe nail got broken she his internal injuries . We have been given acid attack and rape threats. This boy’s father is an IAS officer in the J&K ministry. He will apply all his energy and power to save his son. At the moment we are helpless . Please save us! @manojsinha_ @AmitShahOffice @AmitShah @narendramodi @PMOIndia #crimeagainstwomen
181
2,230
69
8,050
350,758
Thanks @disha2791 for having me on this.
#WIONFineprint | New garba trend under police scanner No garba partner for Navratri? Social media says you can rent one @eriknjoka has more with @disha2791
1
90
The AI concern is for real. Humanity and humans both already impacted. I discuss this on @MirrorNow youtu.be/9d8ZPwEgfNk?si=KF6X…
1
44
Ritesh Bhatia retweeted
Replying to @christinaqi
First it came for the chess masters. But I didn’t care, because I’m not a chess master. Then it came for the writers, paralegals, uber drivers, college students, content creators But I’m not one of those. Then it came for the mathematicians…
3
10
1
76
4,874
Ritesh Bhatia retweeted
Where are we heading my friends? We need to humanise the Cyberspace.
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
1
1
1
195
Ritesh Bhatia retweeted
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
20,420
166,797
39,464
799,476
175,591,883
Ritesh Bhatia retweeted
8
85
5
273
3,881