Two fake court orders switched off 129 websites. India's blocking system never checked

Two emails, 129 blocked websites

At 8:59 on a Sunday night in July, an email reached India's Department of Telecommunications (DoT). It carried what looked like an order of the Rajasthan High Court, complete with a blue seal bearing the national emblem, an instruction to act within 24 hours, and a citation of the IT Act provision that allows blocking in the interest of national security. It was signed by an "Aryan Chaudhary", described as an advocate on record. Two days later, on 21 July, the DoT told internet service providers to block 34 betting websites "as specified in the court order".

A second document followed the same path. Dated 14 August and signed in the name of "Justice Garima Prashad" of the Allahabad High Court, it granted an "ex-parte ad-interim dynamic injunction" against 95 websites said to be running fake IPL match streaming and betting. A man calling himself advocate Kartikey Pandey emailed it to officials on 22 August. After an exchange of internal letters, the DoT told internet providers on 2 September to take "immediate necessary action" to block all 95, and copied the letter to MeitY's cyber law division, asking it to act as per the court order.

Neither order was real. A Reuters investigation published on 11 November found that neither appeared in the courts' online registration records. The Rajasthan High Court's registrar said the order bearing its name "appears to be fraudulent". The Allahabad High Court found its order was fake and filed a police complaint on 6 November, and Uttar Pradesh police registered a case of forgery and cheating against unknown persons. Justice Prashad's office told police that no such order had been passed.

How the forgeries slipped through

The details show how little it took. The Allahabad order carried a QR code, the feature that normally lets anyone confirm a court document is genuine. Reuters found it led to a random webpage showing only a one line case number, the same number Pandey quoted in his email. Reuters' email to the Chaudhary address bounced as "Recipient not found". MediaNama, reading the published correspondence, noted that the DoT even copied its 2 September blocking letter to Pandey, describing him as a "Senior Advocate".

Both fake orders, along with the officials' letters acting on them, sat on the DoT's own website for months as part of its routine uploads of blocking directions. That public list is how Reuters found them. As of Saturday, the Times of India reported, one of the fake orders was still accessible on the government site while the other had been taken down.

Digital rights expert Apar Gupta told CNBC-TV18 that many takedown orders simply cite a provision and a list of URLs without explaining why the content is illegal. "So, in effect, there is no actual legal threshold in place. Because of this, a fake order and a genuine order end up looking quite similar," he said.

A week of fallout

The response has escalated quickly. On 12 November officials told Reuters the telecom ministry had opened an inquiry that will review its procedures and consider extra checks before acting on court orders seeking takedowns. "It's serious ... Maybe in future some genuine websites may also be blocked in the same manner," one official said. Uttar Pradesh police asked the ministry for details of its content management system and digital logs and sent it 24 questions, according to cybercrime official Ghanshyam Yadav.

On 13 November, BusinessLine reported, the DoT ordered all internet licensees to unblock 95 of the 129 websites with immediate effect, in an order also marked to MeitY. The reports we reviewed do not say what has happened to the other 34. On Saturday, 14 November, the Prime Minister's Office summoned Telecom Secretary Amit Agrawal to explain the lapse, cutting short his trip to another state, according to government officials quoted by Reuters, BusinessLine and the Times of India. No arrests had been reported, and it is still not known who forged the orders or why.

Why it matters beyond betting sites

The blocked websites offered gambling, which is illegal in India, so few users will miss them. The worry is the method. If two emailed PDFs with a seal and a QR code could switch off 129 websites across the country, the same trick could be aimed at a news site, a startup's storefront or a rival's app. Every company that does business online in India depends on the blocking system acting only on genuine legal authority.

It is not an isolated case. As Reuters and MediaNama reported, X recently told the Delhi High Court that takedown notices sent to two free speech groups, the Internet Freedom Foundation and SFLC.in, in the name of Delhi Police were fake. And in July the Supreme Court set aside a tribunal's orders that relied on judgments that did not exist. Reuters said it was not clear whether AI was used to generate the forged orders.

There is also the question of who should have checked. MediaNama founder Nikhil Pahwa argued that a ministry which forwards an order cannot treat itself as a courier: "Any fake order being delivered to any platform through MeitY is its responsibility, not that of the platform or of the sender." Digital rights expert Mishi Choudhary told CNBC-TV18 that the shortened window for platforms to act on takedown requests, cut from 36 hours to three under the IT Rules, leaves little room for scrutiny, and that automated compliance could carry out a wrong takedown before anyone examines it.

What to watch

Three things will show whether this becomes a fix or a footnote. First, whether the DoT's inquiry produces a published verification step, such as checking every court order against the court's own records before acting, the question MediaNama has put to the DoT and MeitY. Second, whether the remaining 34 blocks are formally revoked and the forged documents removed from the government website. Third, whether the police, who are now reading the ministry's logs, can trace the email accounts back to a person and a motive. Until then, the safest assumption for anyone running a website in India is that a seal and a QR code are no longer proof of anything.