Private Group Chat Leaked Online — Harassment, Rape Threats, and What the Law Says

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

A close-knit group of young women from Jaipur became part of an online social circle that grew through mutual connections on Instagram. A man using the handle @captain_skywing_99 had carefully built a fake persona — presenting himself as a commercial airline pilot employed with a major Gulf carrier. He shared convincing cockpit videos, posted flight rosters, and even mentioned a fiancée, whom he identified as a fellow pilot named "Nadia Qureshi." Over several weeks, he introduced two additional accounts, both posing as women pilots.

Trusting these accounts to be genuine women, the original group added them to a private, women-only WhatsApp group. That decision had consequences none of them anticipated. Once removed from the group following a dispute, the man turned hostile. He began leaking private screenshots and personal messages from the women-only chat into a separate group, body-shaming the women, rating their appearances, and orchestrating conflict between the two groups while pretending to be a neutral observer. All three "pilot" accounts were, in fact, the same person — later identified as a travel agent and Umrah guide based in Lucknow, operating multiple fake identities.

Several women, some of whom wore hijab and valued their privacy deeply, found their private messages circulating across Instagram. They began receiving harassment, bullying, and explicit rape threats from unknown accounts. One of the affected families approached Advocate Sudhir Rao in mid-March 2025, after an initial complaint to the local police station in Gomti Nagar had not resulted in any formal action. A structured legal strategy — combining a cyber crime complaint, supporting evidence documentation, and a representation to the Superintendent of Police — led to the case being registered and the preliminary investigation being initiated within a few weeks.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Preserve all digital evidence immediately: Don't wait. Take screenshots of every threatening message, fake profile, and leaked chat before the perpetrator can delete them. Save URLs, usernames, and timestamps — all of it, right now.

File a complaint on the National Cyber Crime Reporting Portal: Visit cybercrime.gov.in and file a complaint under the "Report Cyber Crime" section. For cases involving rape threats and morphed or private image sharing, use the "Women and Child" category specifically. A lawyer can help draft this complaint precisely so that the right offences are flagged from the outset.

Now, before you act alone — this category of matter, online impersonation combined with non-consensual sharing of private communications and criminal threats, involves procedural and evidentiary nuances that a general practitioner may not be fully familiar with. Advocates who regularly handle cyber crime and digital harassment cases understand how to preserve metadata, how to approach platform-level data requests, and how to structure complaints so that the investigation moves purposefully. Engaging such an advocate typically leads to faster and more effective outcomes.

Applicable Sections of Law

• Section 308 BNS (Extortion) and Section 351 BNS (Criminal Intimidation): Rape threats and intimidatory messages sent with intent to cause alarm attract Section 351 BNS, which covers criminal intimidation. Where the threats are used to coerce the victim, Section 308 BNS applies.
• Section 318 BNS (Cheating by Personation): Creating fake identities to infiltrate a private group and deceive members into disclosing private information amounts to cheating by personation.
• Section 72 of the Information Technology Act, 2000: Breach of confidentiality and privacy by publishing or transmitting private information without consent.
• Section 67 and Section 67A of the IT Act, 2000: Publishing obscene or sexually explicit material in electronic form — relevant where leaked messages include sexually explicit content or body-shaming material of a sexual nature.
• Section 77B BNSS read with Section 356 BNS (Defamation): Publicly sharing private messages to damage reputation can attract defamation under BNS as well.

Punishment and Penalties

• Section 351 BNS (Criminal Intimidation): Imprisonment up to two years, or fine, or both. Where the threat is to cause death or grievous hurt, imprisonment up to seven years.
• Section 318 BNS (Cheating by Personation): Imprisonment up to three years and fine.
• Section 67 IT Act: First conviction — imprisonment up to three years and fine up to Rs. 5 lakh. Subsequent conviction — up to five years and fine up to Rs. 10 lakh.
• Section 67A IT Act: First conviction — imprisonment up to five years and fine up to Rs. 10 lakh.
• Offences under Section 351 and Section 318 BNS are cognizable and non-bailable in aggravated form. Offences under the IT Act are cognizable. None of the primary offences here are compoundable without court permission.

Jurisdiction — Where to File the Case

Here's something many victims don't realise. For cyber crime matters, jurisdiction lies with the police station in whose area the victim resides or where the offending content was accessed or received — not necessarily where the perpetrator is located. This is confirmed by the principle in Shri Ram v. State of UP, 2016 regarding territorial jurisdiction in electronic offence cases. The complaint can be filed at the nearest cyber crime police station or at the local police station. Parallel complaints can be filed on cybercrime.gov.in, which routes complaints to the relevant state cyber cell. The trial, once chargesheet is filed, will be before the Chief Judicial Magistrate or Judicial Magistrate of the competent area.

What if Police Refuse to File FIR?

Make no mistake — refusal to register an FIR in a cognizable offence is itself actionable. Here's what you can do:

• Submit a written complaint to the Superintendent of Police of the district under Section 173(4) BNSS. The SP is required to direct registration of the FIR if the offence is prima facie made out.
• File a private complaint directly before the Chief Judicial Magistrate under Section 175(3) BNSS. The Magistrate can direct the police to investigate and report.
• Approach the High Court under Article 226 of the Constitution by way of writ petition if both the above steps fail and inaction is apparent.
• Document every attempt to register the complaint — date, officer's name, and the response given. This trail is critical if you need to escalate.

The Supreme Court in Lalita Kumari v. Government of UP, 2014 held that registration of FIR is mandatory upon receipt of information disclosing a cognizable offence. That judgment is your legal foundation if police refuse to act.

Rights of the Accused

• Right against self-incrimination: Under Article 20(3) of the Constitution, no person accused of an offence shall be compelled to be a witness against themselves.
• Right to legal representation: Article 22 guarantees the right to consult and be defended by a legal practitioner of one's choice from the moment of arrest.
• Right to be produced before Magistrate within 24 hours: Under Section 57 BNSS, an arrested person must be produced before the nearest Magistrate within 24 hours of arrest.
• Right to know grounds of arrest: The accused must be informed of the grounds of arrest at the time of arrest, as held in D.K. Basu v. State of West Bengal, 1997.
• Right to a copy of the FIR: The accused is entitled to a free copy of the FIR upon arrest.

Bail Provisions

Offences under Section 351 BNS in aggravated form and Section 67A of the IT Act are non-bailable. Frankly, the accused would need to apply for bail before the Sessions Court. Anticipatory bail under Section 482 BNSS can be sought if the accused apprehends arrest, though courts exercise discretion carefully in cases involving repeat digital harassment and criminal threats. Regular bail, if arrested, is governed by Section 480 and Section 483 BNSS. Typical bail conditions in such cases include surrender of all devices, restriction from contacting victims, and deposit of passport. The bail strategy should be discussed carefully with an advocate experienced in cyber crime matters, since courts look closely at the nature and severity of threats made.

Quashing of FIR / Case

The accused may approach the High Court under Section 528 BNSS (inherent powers) to seek quashing of the FIR. Grounds typically advanced include absence of a prima facie case, abuse of the legal process, or settlement between parties. And here's the thing — in cases involving rape threats, non-consensual sharing of private communications, and impersonation to infiltrate private spaces, courts have consistently taken a serious view. The Supreme Court in State of Haryana v. Bhajan Lal, 1992 laid down the limited grounds for quashing, and offences with clear prima facie evidence rarely succeed. Quashing is not a realistic strategy for perpetrators in cases of this nature.

If You Are the Victim

• Screenshot and preserve all threatening messages, fake profiles, and leaked content immediately — with timestamps visible. Do not delete anything.
• Report the fake accounts and the offending content to Instagram and WhatsApp directly through the platform's reporting tools. Request content removal and account suspension.
• File a complaint on cybercrime.gov.in under the "Women and Child" cyber crime category without delay.
• Approach the local cyber crime police station with a written complaint, printouts of evidence, and a chronological account of events.
• Consult an advocate with experience in cyber crime and digital harassment matters before making any public statements about the incident online.

Documents You Must Keep Ready

• Aadhaar card and PAN card as identity proof
• Screenshots of all threatening messages, with dates and sender usernames clearly visible
• Screenshots of the fake profiles and any posts made by the perpetrator
• Records of the private chat messages that were leaked, including the context
• Any communication received from the perpetrator or unknown harassers via DM or comments
• URLs of the offending profiles and posts (note these down before they are deleted)
• Records of complaints made to Instagram, WhatsApp, or other platforms, including reference numbers
• Any prior communication with the perpetrator that establishes the deception and infiltration

What Evidence Is Required?

• Primary digital evidence: Screenshots with metadata, URL records, and downloaded copies of offending posts and profiles
• Device evidence: The phone or device on which messages were received can be examined by the cyber forensic team to establish authenticity
• Platform data: Formal requests to Instagram/Meta and WhatsApp for user data linked to fake accounts — this is typically done through the investigating officer with a court order
• Witness statements: Statements from other group members who witnessed the infiltration and subsequent harassment
• IP address logs: Where obtainable through platform data requests, IP logs can link the fake accounts to a single device or location
• Expert forensic report: A certified cyber forensic expert's report confirming the authenticity and non-tampering of preserved digital evidence

How the Police Behave in Such Cases

Cyber crime cases, particularly those involving anonymous online harassment, often hit a wall at local police stations. Officers at general police stations may suggest the matter is "minor" or tell victims to "block and move on." That's incorrect and legally untenable given the nature of offences involved here. Dedicated cyber crime cells, however, are better equipped. Once a complaint is formally registered, investigation typically involves device seizure, platform data requisitions, and forensic analysis. Delays are common if the complaint isn't structured properly from the outset, so a well-drafted complaint with organised evidence significantly reduces the wait.

Timeline of Legal Process

• Week 1-2: File complaint on cybercrime.gov.in and at cyber crime police station. FIR registration upon police satisfaction of prima facie case.
• Week 2-8: Investigation phase — police collect evidence, issue notices to social media platforms, and trace fake account operators.
• Week 8-16: Forensic analysis of devices and digital data obtained from platforms.
• Within 60-90 days: Chargesheet filed before the competent Magistrate under Section 193 BNSS (for offences triable by Sessions Court) or before Judicial Magistrate as applicable.
• Month 3-6: Court takes cognizance, summons or warrant issued to accused.
• Month 6-18: Framing of charges, trial commences, evidence recorded.
• Year 1.5-3: Arguments, judgment, and if convicted, sentencing. Appeal thereafter to Sessions Court or High Court as applicable.

How Long Will the Investigation Take?

Advocate Sudhir Rao, Supreme Court of India