If you are trying to decide whether a run of deaths around the Khalistani movement proves an intelligence campaign, the honest answer is no. The sequence raises a serious attribution question, but it does not settle that question. Getting this distinction wrong can distort Bharat’s security priorities, stigmatise Sikh communities and deliver a narrative advantage to the very actors an investigation is meant to expose.
Four cases sit at the centre of the debate. Hardeep Singh Nijjar was shot in the parking area of a gurdwara in Canada. Paramjit Singh Panjwar was shot while on a morning walk. Avtar Singh Khanda died in a hospital amid an unproven allegation of poisoning. Harmeet Singh was killed at a gurdwara in Lahore. You can examine these events as a possible pattern without pretending that their common sponsor, if there was one, has already been identified.
Four cases do not yet prove one operation
The first analytical mistake is to collapse event, pattern and attribution into a single claim. An event tells you what happened to a person. A pattern tells you that two or more events share relevant features. Attribution identifies who ordered, enabled or executed them. Each conclusion requires evidence of its own.
Start by sorting every new claim into five separate boxes:
- Established event: What can be confirmed about the death, location and immediate method?
- Allegation: Which part depends on an unnamed official, partisan statement or unsupported social-media claim?
- Connection: What evidence links this case to another case beyond proximity in time or a generally similar attack?
- Motive and opportunity: Which actors might have wanted the outcome and possessed the ability to pursue it?
- Attribution: What evidence connects a particular actor to planning, logistical support, payment, direction or execution?
Do not let evidence in one box fill an empty box elsewhere. Khanda’s death in a hospital and the allegation that he was poisoned, for example, are not the same fact. Repeating the allegation as an established cause quietly manufactures certainty that the available information does not provide.
The appearance of a planned or professionally executed attack is also a weak attribution signal. An intelligence service could conduct such an operation, but so could a criminal contractor, a factional rival or another organised group. The method may narrow the required capability; it does not identify the customer.
A useful language scale is possible, plausible, probable and established. Motive plus capability may make a theory possible. Alignment with known case facts may make it plausible. Corroborated operational evidence and the exclusion of credible alternatives may make it probable. Direct, independently verified evidence or an authoritative legal finding is needed before you treat it as established. These are not official intelligence labels here; they are guardrails for your own judgment.
Map the network before you name an intelligence service
A network is not merely a list of prominent people. It is a set of functions. If you focus only on famous faces, you can mistake a visible loss for the destruction of the underlying system. Map roles first and names second.
- Public faces provide speeches, symbolism, mobilisation and an identifiable centre of attention.
- Organisers and handlers connect public leadership with recruiters, local operatives or outside facilitators.
- Operational enablers supply whatever communications, transport, money, documents or other support a particular activity requires. Their existence must be demonstrated in each case, not assumed from the label attached to a movement.
- External sponsors may provide direction, protection or resources, but foreign residence or contact alone does not prove sponsorship.
- Community and religious institutions are part of the surrounding social environment, not automatically part of an operational network.
That last distinction is essential. A gurdwara is a Sikh religious institution. A killing in or near one does not establish that the institution, its management or its congregation sponsored the victim’s political activity. Likewise, Sikh, diaspora member, dissident, gurdwara attendee and Khalistani operative are not interchangeable descriptions. Blurring them creates false positives, alienates potential community partners and makes genuine threat detection harder.
Amritpal Singh’s rapid emergence through Waris De Punjab put this network problem in practical form. Punjab Police, working with Central Armed Police Forces and the wider security establishment, eventually took him into custody after a period of observation and coordinated action. Khanda was alleged to have acted as one of his handlers. Even if that description is accepted, however, the loss of a public leader and an alleged handler does not by itself tell you which other functions survived.
Judge disruption by asking functional questions. Did recruitment stop or move to less visible channels? Were command relationships severed or merely reassigned? Did financing and logistical support disappear, fragment or pass to new intermediaries? Did previously inactive figures become more prominent? A network can be weakened, decentralised, rebuilt or driven underground. Those outcomes require different security responses.
Three hypotheses remain open, and each needs different proof
Theories about these deaths tend to converge on three broad possibilities: an Indian intelligence operation, a Pakistani intelligence purge or reboot, and factional conflict assisted by criminal or intelligence actors. Strategic reasoning can show why each actor might benefit. It cannot substitute for an operational link.
The R&AW hypothesis
India had an evident security interest in preventing an attempted Khalistani revival from developing into a harder threat. Former Research and Analysis Wing Special Secretary B. Raman wrote in Kaoboys that R&AW had previously been active in tracking and killing Khalistani leaders, although he did not provide case-specific details. That background makes Indian involvement conceivable; it does not attribute any of these four cases to R&AW.
To move this hypothesis beyond motive and historical precedent, investigators would need evidence tied to the operations themselves: authenticated directions, a traceable logistical or financial chain, corroborated testimony from someone with access, forensic links, or authoritative findings that connect planners and attackers to the service. The claim should remain provisional without that bridge.
The ISI purge or false-flag hypothesis
A second theory begins with the exposure and disruption of the network around Amritpal. Pakistan’s Inter-Services Intelligence could have viewed established figures as liabilities and sought to replace them with younger recruits who had no prior record likely to attract immediate scrutiny. Removing old figures could also cause observers to suspect R&AW first, giving ISI the potential benefit of a false attribution.
This is strategically coherent, but coherence is not evidence that the operation occurred. A serious assessment would look for an organised succession: new handlers appearing after the deaths, recruitment methods changing, resources moving to lower-profile figures, or communications showing that exposed members were being treated as liabilities. Without evidence of such a transition, the proposed reboot remains a hypothesis built from possible motive and benefit.
The factional or criminal-conflict hypothesis
Internal competition offers a third explanation. Disputes over authority, Akal Takht-related influence or supremacy within Khalistani organisations could give factions a reason to remove rivals. An intelligence service or criminal group might then act as a facilitator without having originated the dispute.
Test this theory by looking for conflict before the death and redistribution after it: threats, expulsions, contested appointments, control of organisations or resources, and identifiable beneficiaries. A beneficiary is still not automatically the perpetrator, but the sequence can reveal where a factional inquiry should concentrate.
There is also no sound reason to assume that all four cases must have one sponsor. One killing could be state-directed, another factional and another unrelated to the proposed pattern. A neat single-actor story is emotionally satisfying, but intelligence analysis has to tolerate mixed causes.
Real intelligence success is measured before the next crisis
An arrest or the death of a prominent figure may produce an immediate tactical effect. Strategic success means that the system can detect replacement leaders, identify surviving relationships and prevent reconstitution. Body counts and headlines are poor substitutes for those measurements.
For Bharat’s security institutions, five capabilities matter most:
- Early warning: Detect changes in recruitment, leadership and coordination before a charismatic figure becomes the sole focus of public attention.
- Human intelligence: Develop reliable insight into relationships, intentions and internal disputes. Technical signals can reveal patterns, but they do not always explain what those patterns mean.
- Technical verification: Use modern analytical tools to corroborate human reporting, identify inconsistencies and distinguish a durable network from a collection of loud but disconnected individuals.
- Institutional coordination: Connect local police knowledge, central security capabilities and counter-intelligence assessment. The coordinated operation involving Punjab Police and central forces shows why a shared picture can matter more than an impulsive reaction.
- Counter-intelligence discipline: Treat deception, planted narratives and false flags as hypotheses to test. An adversary knows which conclusion Indian observers are predisposed to accept and may design an operation or information campaign around that expectation.
Community precision belongs on that list as well. Security agencies gain little by applying a separatist label to ordinary Sikh religious or political life. Precise targeting protects civil trust, improves the quality of human intelligence and isolates violent or foreign-directed activity from the wider Panth rather than granting extremists the community-wide confrontation they may seek.
Nor should an unproven killing abroad be celebrated as an intelligence victory. If state responsibility for an extraterritorial killing were established, sovereignty disputes, criminal exposure, diplomatic retaliation and escalation would become serious consequences. The safer public position is to support evidence-led investigation, lawful prosecution, defensive intelligence work and disruption conducted through applicable legal channels while attribution remains unresolved.
Key takeaways: five questions to ask before sharing a claim
- What is confirmed? Separate the death, location and known method from claims about poisoning, sponsorship or motive.
- What role did the person actually perform? Look for evidence of leadership, handling, recruitment or operational support rather than relying on a broad political label.
- What connects the cases? Timing and a planned appearance justify inquiry, but they do not prove common direction.
- Does the claim identify evidence or merely a beneficiary? Motive, capability and advantage make an actor worth investigating; they do not establish responsibility.
- Have credible alternatives been tested? Compare R&AW involvement, an ISI purge, factional conflict and mixed causes before assigning confidence.
The next time a dramatic death produces instant certainty, keep two notes: confirmed facts and analytical inferences. Update the first only when information is corroborated, and allow attribution to lag behind the headline. If you care about Bharat’s unity, insist on accurate network mapping, stronger human and technical intelligence, lawful disruption and a clear separation between Sikh religious life and separatist violence. Strategic seriousness begins when suspicion is no longer allowed to masquerade as proof.
References
- DharmaRenaissance Blog — Hunting Khalistani Network And Question of Intelligence Agencies
