VZCZCXRO8438
RR RUEHBI RUEHCI
DE RUEHBI #0365/01 2111104
ZNR UUUUU ZZH
R 291104Z JUL 08
FM AMCONSUL MUMBAI
TO RUEHC/SECSTATE WASHDC 6464
INFO RUEHNE/AMEMBASSY NEW DELHI 7703
RUEHCG/AMCONSUL CHENNAI 1830
RUEHCI/AMCONSUL KOLKATA 1635
RUEHBI/AMCONSUL MUMBAI 1599

UNCLAS SECTION 01 OF 02 MUMBAI 000365 
 
SENSITIVE 
SIPDIS 
 
DEPT FOR DS/TIA/ITA AND DS/IP/SCA 
 
E.O. 12958: N/A 
TAGS: PTER ASEC PGOV IN
SUBJECT: MUMBAI EAC MEETING AND AHMEDABAD BLAST UPDATE 
 
REF: MUMBAI 364 
 
¶1. (U) American Consulate General Mumbai's Emergency Action 
Committee met to discuss the July 26, 2008 bombings in 
Ahmedabad, India.  Since the initial attack on July 26, 2008 up 
to fifteen improvised explosive devices have been found and 
safely disarmed by police bomb squad personnel.  EAC Mumbai 
continues to monitor this situation. 
 
¶2.  (SBU) On Saturday, July 26, 2008, 16 to 17 improvised 
explosive devices (IEDs) detonated in Ahmadabad, the major city 
in the Indian state of Gujarat.  The devices detonated over a 70 
minute period commencing at approximately 1845 with the final 
device exploding around 2000.  The initial blasts appear to be 
low-intensity IEDs placed in markets, residential areas, bus 
stops, and finally hospitals.  It appears that the IEDs at three 
hospitals were timed to detonate as causalities from the initial 
blasts were brought for treatment.  Media reports state that a 
vehicle borne improvised explosive devices were used at LG 
Hospital and the Civil Hospital.  The VBIED that targeted the 
Civil Hospital was a Maruti WagonR with a factory installed 22.5 
liter liquefied petroleum gas (LPG) tank.  The bomb makers then 
packed ammonium nitrate and additional liquefied natural gas 
(LNG) cylinders into the rear hatch back storage compartment of 
the WagonR where the LPG tank was installed.  At this time all 
devices appear to have used a timer (possibly a microprocessor) 
and there are conflicting reports about the explosive 
composition of the devices. Approximately 50 people were killed 
in the attack. American Citizen Services personnel have received 
no reports of American citizens killed or injured in the attack. 
 
¶3.  (SBU) Prior to the attacks in Ahmedabad an email was sent to 
a number of media outlets in India by a group professing to be 
the Indian Mujahideen in the Land of Hind claiming credit for 
the attack, and promising further attacks against the India 
states of Rajasthan, Uttar Pradesh, Madhya Pradesh, Andra 
Pradesh, Karnataka, and Maharashtra.  The email demands the 
cities of Indore, Ujjain, Mumbai, and other cities in Karnataka 
to release all detained members of the Student Islamic Movement 
of India (SIMI) or else these cities will become the group's 
next targets.  For Maharashtra the email threatens action 
against the state for the treatment of Madrasa students and 
Muslim women on the Western railway line.   The group also 
voiced their dissatisfaction with the lack of prosecutorial 
action against the perpetrators of 1993 Mumbai riots, when 
compared to the prosecution of Muslims involved in the 1993 
Mumbai serial bombing.  Media reporting over the weekend claimed 
that the Bombay Stock Exchange was listed as a potential target 
in the email which is not accurate.  The email specifically 
mentions Indian industrialist Mukesh Ambani for "usurping" 
property from the Muslim Waqf Board to build his new 
multi-million dollar residence in Mumbai.  The property was 
previously an orphanage.  A copy of the email has been forwarded 
to DS/TIA/ITA. 
 
¶4.  (SBU) Indian police and security services determined that 
the email was sent from an IP address that resolved to an 
apartment in Navi Mumbai, a satellite community separated from 
Mumbai by the Thane Creek.   At approximately 2230 hours on July 
26, 2007 Mumbai Police Anti-Terrorist Squad (ATS) officers 
appeared at the apartment rented by American Kenneth Lee 
Haywood, initiating a search of his residence and began 
questioning Haywood about the email.  Consulate personnel first 
learned of the Navi Mumbai email connection on July 27, 2008 
when coverage in the Sunday Times of India stated that the 
Indian Mujahideen email originated from Haywood's apartment.  DS 
and Consular personnel linked Haywood's to an American 
registered with the Consulate.  Consular Section Chief verified 
with the Mumbai Police that Haywood was indeed being questioned 
by ATS personnel, but was not in custody.  Latter in the day the 
Consular Section Chief was able to make contact with Haywood who 
stated he was being treated well and was cooperating with the 
investigation.  Haywood did note that there was a heavy media 
presence outside his residence.  ACS personnel spoke with 
Haywood on July 28, 2008 and related that the Haywood was doing 
well, but that ATS personnel had sealed his apartment office and 
confiscated his hard drive.  The individuals who sent the email 
were able to exploit Haywood's wireless internet service, and 
send the email via his IP address.  ATS personnel have not 
contacted the Consulate for assistance in the case, despite ATS 
Chief Hemant Karkare claiming on Monday that "we have requested 
the US Consulate and few other allied agencies to assist us in 
verifying Heywood's background," to Mumbai's Daily News and 
Analysis.  ACS personnel have maintained regular contact with 
Haywood since Sunday. 
 
¶5. (SBU) Heywood's corporate attorney provided ACS with a series 
of questions from Mumbai's Mid-Day News and Haywood's answers to 
those questions: 
 
MUMBAI 00000365  002 OF 002 
 
 
 
Question: When did you realize the IP address had been hacked 
into? 
Answer: Saturday (26 Jul 08) at around 10pm I received a call 
from the ATS in Delhi asking if I ran a cyber cafi.  I told them 
no I live here.  Within 30 minutes, the ATS were at my door 
telling me my internet had been compromised. 
 
Question: Do you use wi-fi to connect to the net? If yes, do you 
think it has been hacked to steal your IP address?  If not do 
you think a cyber hacker used software to clone your IP address? 
Answer: Yes, I have a wireless router.  The ATS are certain that 
is what occurred. 
 
Question: Is your laptop/desktop secure? 
Answer:  All computers are secure within my flat.  However, the 
Tata/VSNL Technician who setup the wireless router said it was 
not necessary to setup security because the computers have 
firewalls.  He also disables the routers logging capability. 
 
Question: What did the cops ask you? 
Answer: From the beginning the police were reassuring me that I 
had done nothing wrong.  They wanted to know who had access to 
my network. I talked to them for 72 hours.  They asked me many 
questions.  The most often asked was has anyone had access to my 
computers? (Only my family and the Tata-VSNL Technicians.) 
We've come to know now that the router was not secure. 
 
Question: What impression (of India, its police) has this 
incident left on you? 
Answer: The police/ATS have been very professional and 
courteous.  They have been have been helpful in addressing my 
concerns.  We are fully confident they will find the culprits of 
this horrific act. 
 
Question: Has the Anti-Terrorist Squad given a clean chit 
officially? 
Answer: The top ATS agents have continued to tell me how we have 
completely cooperated.  They have said nothing has been found to 
implicate us.  We have not been arrested nor has it ever been 
suggested that we might be.  I have been told that an official 
statement will be coming soon.  ATS in Delhi told me on the 
phone that I was completely clear. 
 
Question: Do you suspect someone? 
Answer: I don't know who could have done this.  The police are 
handling the investigation. 
 
Question: What is your biggest fear? 
Answer: I fear for the safety of my family. 
 
¶6. (SBU) On Sunday July 27, 2008 two additional Maruti WagonR 
vehicles containing explosives were found in Surat, India. Both 
vehicles had counterfeit Gujarat license plates, but a search of 
their vehicle identification numbers indicated that the vehicles 
came from Maharashtra.  The Marutis were stolen from the Nerul 
area of Navi Mumbai before being equipped with Gujarat license 
plates and moving to Surat.  On July 28, 2008 post's Senior 
Foreign Service National Investigator spoke with Surat police 
contacts to gather more information on the vehicles.  According 
to police sources one vehicle contained approximately 17 kg of 
ammonium nitrate fuel oil mixture (ANFO), 20 nine volt 
batteries, one timer, and nuts and bolts which could be used for 
fragmentation.  The second vehicle contained 32 kg of ANFO, 30 
detonators, and one battery.  It us still unclear if the 
vehicles were actually vehicle borne improvised explosive 
devices, or vehicles being used to ferry explosives and other 
materials to cells operating in Gujarat. 
 
¶7.  (U) Media reports on July 29, 2008 thirteen IEDs were 
discovered in Surat over a four hour period.  Surat Police bomb 
squad personnel were able to defuse the each device.  The 
devices were found in the Varacha area of Surat.  One device was 
found in a tree near a police post. 
 
¶8. (SBU) EAC Mumbai will continue to track the incident and 
provide updates as necessary.  RSO Mumbai personnel are speaking 
with contacts in Ahmedabad to confirm the design of the IEDs as 
well as to gather further information on the tactics, techniques 
and procedures used in the hospital attacks.  Post will also 
work to develop additional information on the two explosive 
laden vehicles recovered in Surat.  RSO Mumbai plans to meet 
with Haywood on July 30, 2008.  Post does note that both the 
Surat vehicles and the Indian Mujihadeen email originated from 
Navi Mumbai.  EAC Mumbai will meet on July 30, 2008 to discuss 
the recent targeting of Surat. 
FOLMSBEE