Beyond Article 370: Recalibrating India's Counterterrorism Architecture in Jammu & Kashmir Against Hybrid Threats

Writter: Sreoshi Sinha, Postdoctoral Fellow, School of International Relations and Peace Studies, Nalanda University.

The abrogation of Article 370 in August 2019 was a significant transformation in India's constitutional, administrative, and security strategy for Jammu & Kashmir. Despite enhanced institutional coherence, improved intelligence cooperation, and ongoing counterterrorism efforts since 2019, it would be hasty to correlate a decrease in violence with the eradication of the fundamental danger landscape. The recent events of 2026, including heightened counter-terrorism efforts in Poonch and Rajouri, as well as many alleged Pakistani drone infiltrations along the International Border and Line of Control, indicate that the danger persists, although evolving in its nature, location, and tactics.

The evolving security landscape highlights that there is still more needed to be done in terms of the conventional counter-insurgency framework used to assess Jammu & Kashmir. In July 2026, the Union Home Ministry designated 23 operators from the Pakistan-based Jaish-e-Mohammed and Lashkar-e-Taiba as terrorists under the UAPA due to their participation in recruiting, infiltration, training, drone-assisted weaponry supply, and attack preparation in Jammu & Kashmir. This designation implies the robustness of an external framework capable of supporting a dispersed terror network, even as conventional terrorist organisations face increasing scrutiny. The repeated identification of suspected drones in advance zones in 2026 indicates that the border is progressively evolving into a technical competition, where inexpensive unmanned devices may circumvent conventional monitoring and physical obstacles.

So now, the crucial inquiry is not just about whether the post-2019 security framework has succeeded or faltered, but rather whether it has adequately adapted to confront the next wave of challenges. The security reassessment after the Pahalgam attack has prompted the counter-terrorism framework to adopt a greater emphasis on pre-emptive measures, territorial control, and aggressive tactics. The institutional reaction is clearly shown by the subsequent enhancement of security measures and the transition to intelligence-driven operations. The ongoing presence of terrorist organisations, their infiltration efforts, and drone operations suggest that more efficient structural changes should accompany strategic adjustments. 

Apparently, the nascent problem is more multifaceted. Kinetic assaults are integrated with drone-assisted logistics, secure communications, digital radicalisation, misinformation, narco-terrorism, and cognitive strategies to influence views both inside and beyond Jammu & Kashmir. 

In this context, Pakistan's annual observance of Youm-e-Istehsal on 5 August provides a pertinent illustration of this cognitive and narrative dimension of the Kashmir contest. Through official statements, diplomatic messaging and coordinated information campaigns surrounding the anniversary of the 2019 constitutional changes, Islamabad seeks to sustain the Kashmir issue within domestic and international discourse and contest India's political and constitutional narrative in Jammu & Kashmir. While such activities are distinct from conventional terrorist operations, they form part of a broader information environment in which state-sponsored narratives, extremist propaganda and digitally amplified grievances can interact. The significance for India's internal security, therefore, lies not merely in the content of individual narratives but in their potential convergence with existing networks of radicalisation, disinformation and psychological mobilisation.

Consequently, the security framework after Article 370 cannot be confined to administrative unification, geographical dominance, and active suppression. The security threat remains unchanged, notwithstanding the alterations brought by Article 370 to the political and administrative framework of Jammu & Kashmir, remarked J&K LG Manoj Sinha, regarding the situation. The opponent has shifted from efforts to undermine territory to endeavours aimed at infiltrating systems, physical, technical, financial, and cognitive. This might deeply influence the internal security framework of India in the years to come.

For now, our objective should not be to just prevent the forthcoming terrorist assault, but to essentially locate and dismantle the ecosystem that enables the emergence of an attack. This involves pinpointing the financial channels, facilitators, recruiters, digital networks, logistical pathways, local support systems, and external operatives that collectively form the modern terror ecosystem. 

In this regard, this piece contends that the security improvements in Jammu & Kashmir after 2019 must not be seen only as a reason for strategic complacency but rather as a foundation for the next evolution of counterterrorism strategies. India's predicament now extends beyond only safeguarding its borders from physical encroachment. It aims to safeguard the broader national-security framework against enemies capable of functioning concurrently across physical, digital, financial, and cognitive spheres. Ultimately, the efficacy of India's Jammu & Kashmir policy will depend on its security framework's ability to foresee this multifaceted danger more swiftly than its opponents can adjust.

Transitioning from Traditional Counterinsurgency to Hybrid Threat Mitigation

The evolution of the security landscape in Jammu & Kashmir demands a reassessment of the current counterterrorism dilemma. Traditional counterinsurgency models were mostly developed based on recognisable militant groups, territory control, infiltration pathways, arms trafficking, and tangible support networks. The efficacy of their operations relied on the capacity of security forces to recognise, segregate, and incapacitate terrorist elements and their logistical networks.

The emerging threat is far more dispersed. Terrorist groups are progressively functioning through networks rather than traditional hierarchies, while overseas operatives may exert operational influence without maintaining a constant physical presence in Jammu & Kashmir. Recruitment, funding, ideological conditioning, logistics and operational direction can increasingly occur across multiple geographical and technological domains. India's National Counter-Terrorism Policy & Strategy notes that foreign-based terrorist handlers use drones to facilitate terrorist activities in Jammu & Kashmir, while terrorist groups increasingly engage organised criminal networks for logistics and recruitment and exploit social media, instant-messaging applications, encryption and crypto wallets for propaganda, communication, funding and operational guidance. 

The National Investigation Agency's investigations in Jammu & Kashmir similarly identify Pakistan-based operatives, hybrid terrorists and overground workers involved in facilitating terrorist activities, radicalising local youth, mobilising support networks, and using online platforms and drones to deliver arms, ammunition and narcotics.  

This is a significant obstacle for India's counterterrorism framework. The ramifications are especially immense for Jammu & Kashmir since the area embodies the intersection of many security realms. The International Border and Line of Control continue to serve as possible conduits for physical infiltration and the trafficking of arms and drugs. Digital platforms offer avenues for radicalism and propaganda. Monetary networks may enable the transfer of funding for terrorist activities. Simultaneously, information operations may endeavour to influence opinions about security initiatives, governance, and political occurrences.

Thus, the modern danger needs to be viewed as a continuum rather than a collection of discrete events. A drone observation, a drug confiscation, an internet recruiting effort, a dubious financial transaction, and the transfer of a weapons shipment can seem disconnected when evaluated individually. But when examined as a whole, they may uncover several nodes within the same ecosystem. This requires a shift from incident-driven counterterrorism to an ecosystem-oriented approach to counterterrorism.

The Intersection of Drones, Terrorism, and Narcotics

A prominent indication of the evolving danger landscape in Jammu & Kashmir is the rising use of unmanned aerial vehicles for transnational logistical operations. The importance of drone-assisted operations, meanwhile, transcends the immediate task of identifying and neutralising unmanned systems. Drones are becoming more significant within a broader ecosystem where terrorism, drug trafficking, weapons smuggling, and organised crime converge.

Historically, the transportation of arms, explosives, and drugs across borders relied heavily on human couriers and infiltration networks. This created several opportunities for monitoring and intelligence gathering. Drone-assisted delivery changes this dynamic by enabling the transport of small payloads through difficult terrains while reducing the risk to human operators. The technology thus provides terrorist and criminal organisations with increased separation, plausible deniability, and operational flexibility.

Recent observations and recoveries of drones in the regions of Jammu, Samba, Kathua, Rajouri, and Poonch are noteworthy in this regard. They suggest that border management is progressively evolving into a competition not just of personnel and physical obstacles but also of technology, detecting proficiency, and intelligence integration. The difficulty is thus not confined to identifying an unmanned aerial vehicle after it has entered Indian airspace. The primary counterterrorism goal is to ascertain the network supporting the platform: its operators, funders, handlers, intended recipients, and the eventual distribution of the payload.

The rising drone menace illustrates the need to analyse terrorism in conjunction with international organised crime. Armaments and controlled substances may traverse intersecting logistical pathways, whilst revenues from illegal trafficking might facilitate the funding of terrorism. The convergence creates a security landscape where a drug confiscation or drone capture may only signify one apparent facet of a more extensive network.

This necessitates a change in analytical viewpoint. The interception of a drone is a tactical achievement; however, the identification and dismantling of the network responsible for its deployment represent a strategic triumph. Counter-drone capabilities have to be amalgamated with human intelligence, technical intelligence, financial scrutiny, and criminal network analysis instead of being seen just as a technology or border-security necessity.

The difficulty is exacerbated by the fast advancement of commercially accessible drone technology. Affordable platforms, enhanced autonomy, and advancements in navigation and payload functionalities might diminish the technical obstacles for non-state entities. This makes it more challenging to depend only on traditional monitoring and physical barriers as the primary methods for guarding the border.

India's strategy must thus evolve into a multi-tiered counter-drone framework, including continuous surveillance, swift identification, electronic and kinetic counteractions, forensic analysis of retrieved devices, and intelligence-driven enquiries. The establishment of systems that swiftly link information from border accidents to inland investigations is equally crucial.

The essential policy inquiry is not only how India can stop drones from breaching the border, but rather how India can use each drone-related occurrence to expose and demolish the broader terror-criminal syndicate that underpins it. This distinction is essential to the overarching thesis of this article: hybrid threats need a response grounded in an ecosystem approach.  

The Evolving Landscape of Terrorist Recruitment that transitions from Cadres to Hybrid Operatives

The evolution of terrorist recruitment in Jammu & Kashmir represents one of the most significant changes in the contemporary security landscape. The traditional paradigm of militancy was comparatively more identifiable: induction into an established terrorist organisation, physical training, movement through designated infiltration and logistical routes, and eventual deployment as an armed cadre. NIA investigations into LeT- and JeM-linked networks in Jammu & Kashmir have documented established terrorist organisations, cadres and overground workers, with infiltrating terrorists receiving training, logistical support, food, shelter and money before moving into the hinterland.  

The developing framework is much more non-linear. Recruitment may now transpire via digital communication, ideological persuasion, local support, and gradual engagement, enabling a person to be operationally effective without officially joining a terrorist group. This difference is crucial since it alters the intelligence dilemma. The conventional counterterrorism framework aimed to pinpoint terrorist groups; the modern approach must furthermore recognise those who enable, fund, shelter, enlist, communicate with, or otherwise assist terrorist operations without directly executing an assault.

The enquiries conducted by the National Investigation Agency in Jammu & Kashmir exemplify this burgeoning ecology. In June 2025, the NIA conducted searches at 32 sites connected to hybrid terrorists and overground operatives affiliated with Pakistan-supported terrorist factions. The CIA reports that these networks participated in aiding terrorists, disseminating explosives and weaponry, raising finances and drugs, and inciting local youngsters. The NIA further said that operators headquartered in Pakistan were using social media and internet platforms to enable and advocate for terrorism.

The March 2025 NIA inquiry into the infiltration of Lashkar-e-Taiba and Jaish-e-Mohammed also highlighted the significance of the local facilitation network. The CIA reports that surface-level operatives and terrorist affiliates supplied infiltrating militants with sustenance, accommodation, financial resources, and logistical support, aiding their navigation through challenging landscapes into the interior regions of Jammu and Kashmir.

This implies that the modern terrorist network need not be seen only as a linear connection from a commander in Pakistan to an armed insurgent. It is more effectively understood as a decentralised network of foreign agents, local enablers, hybrid participants, supporters, recruiters, funders, and logistical suppliers.

From hiring to extremism

The distinction between radicalism and recruiting is becoming more significant. Recruitment conventionally denotes the intentional integration of a person into an organisation. Radicalisation may transpire at an earlier stage and may happen without direct affiliation to an organisation.

Digital platforms have considerably broadened this domain. The National Counter-Terrorism Policy & Strategy of the Ministry of Home Affairs acknowledges that terrorist groups are progressively utilising social media and instant messaging platforms for propaganda, communication, financing, and direction, while encryption and other technologies facilitate more covert operations.

As a result, the trajectory from exposure to extremist material → ideological indoctrination → online interaction → facilitation → operational engagement may stay disjointed across several platforms and sites. A security framework that concentrates only on recognised militants may only detect the danger at the concluding phase.

This is the point at which the notion of the hybrid actor becomes advantageous. A hybrid actor may not conform to the traditional classifications of militant, overt operative, or typical citizen. The person might lead a seemingly ordinary civilian life while performing certain roles for a terrorist organisation, offering shelter, carrying goods, transferring funds, liaising with operatives, enlisting others, or aiding in movement. The task is not only to ascertain who qualifies as a terrorist, but to comprehend the specific roles individuals play inside the network.

The ramifications for intelligence

This requires a significant shift in intelligence methodology. Rather than relying primarily on lists of known militants, counterterrorism agencies need to develop network-based threat assessments capable of identifying relationships between:

• External Handlers;

• Local Facilitators;

• Potential Recruits;

• Financial Intermediaries;

• Narcotics Traffickers;

• Arms Suppliers;

• Digital Accounts;

• Communication Patterns; And

• Logistical Movements.

Such an approach does not imply indiscriminate surveillance of communities or individuals. Rather, it requires intelligence agencies to integrate legally obtained information from multiple domains so that apparently isolated indicators can be assessed collectively.

For example, an individual with no previous history of militancy may not immediately appear significant. However, if that individual is simultaneously connected to a known facilitator, receives unexplained financial transfers, communicates through a suspicious digital network and becomes involved in moving contraband, the combined pattern may warrant investigation. The analytical shift is therefore from identity-based intelligence to behaviour- and network-based intelligence.

The issue with the "local interface

The enduring presence of a local facilitation layer further challenges the belief that cross-border terrorism can be eradicated just by enhancing border control. A terrorist group functioning from outside requires an intermediary inside India to convert foreign directives into domestic operations. This platform may include shelter providers, couriers, recruiters, funders, guides, and supporters. The NIA inquiry conducted in March 2025 is notably pertinent as it recognised OGWs and terror affiliates as enablers of terrorist infiltration from border regions into districts such as Kathua, Udhampur, Doda, Kishtwar, Reasi, Rajouri, and Poonch, illustrating the growing artificiality of the border-hinterland dichotomy. 

An incursion at the border and a terrorist event occurring hundreds of miles away can be elements of the same operational network. An effective counterterrorism strategy should therefore trace the network from the border to the interior, instead of seeing border control and domestic counterterrorism as distinct policy areas.

In favour of pre-emptive interruption

The evolving recruiting paradigm eventually bolsters the argument for transitioning from reactive counterterrorism to proactive disruption. The aim should be to detect the network at the phases of radicalisation, recruiting, funding, or logistical arrangement, prior to a person attaining the capability to execute an attack. This necessitates three synergistic strategies: Initially, intelligence-driven prevention, detecting nascent recruiting and facilitation networks by multi-source intelligence. 

Secondly, community resilience: guaranteeing that at-risk groups, especially youth, possess access to reliable information, educational resources, and channels for reporting dubious recruiting efforts without fostering a climate of widespread distrust.

Thirdly, digital resilience: enhancing the capacity of organisations and communities to identify extremist exploitation, recruiting strategies, and orchestrated misinformation. The primary takeaway is evident: the terrorist of the future may differ significantly from the combatant of the past. He is prohibited from crossing the border with a weapon, being affiliated with a terrorist organisation, or being listed in any current intelligence database. He may alternatively arise from a digitally facilitated recruiting procedure and execute a singular logistical or operational role within a more extensive network.

For India's counterterrorism framework, this signifies that hindering recruiting is intrinsically linked to dismantling the surrounding ecology. The objective has evolved beyond just obstructing cadres from accessing Jammu & Kashmir; it now includes thwarting terrorist networks from perpetually producing fresh operatives in the area.

Funding of Terrorism and the Broadening Financial Arena

The progression of terrorism in Jammu & Kashmir cannot be fully comprehended without understanding the financial framework that underpins it. The overt expressions of terrorism are often kinetic—such as assaults, infiltration efforts, arms retrieval, or drone observations, yet the ability to execute these actions relies on a more obscure financial framework. Recruitment, transportation, lodging, communication, weapon purchase, drug trafficking, and digital infrastructure all need monetary resources. The current dilemma is not just to track terrorist funding post-attack, but to discern financial activities that may operate as precursors to terrorist mobilisation.

The intersection of terrorism, drug trafficking, and organised crime makes this especially significant. In regions where terrorist organisations use illegal trafficking pathways, financial enquiries must extend beyond the direct gains of a specific offence. The overarching inquiry is whether such funds are being used for recruiting, procurement, facilitation, or operational endeavours.

This thus alters the function of financial intelligence in counterterrorism efforts. A dubious financial transaction could seem trivial when analysed independently. When linked to a recognised facilitator, an unaccounted transfer of cash, a drug confiscation, atypical digital correspondence, or transnational operations, it might serve as a significant marker of an emerging network.

The financial trail can therefore precede the physical attack.

This becomes financial intelligence, a crucial element of proactive counterterrorism. Enhanced collaboration among the Financial Intelligence Unit, National Investigation Agency, Jammu & Kashmir Police, narcotics enforcement agencies, customs, and other pertinent organisations might facilitate the detection of links between seemingly distinct criminal and terrorist operations.

The difficulty is especially apparent at the intersection of conventional and innovative financial systems. Unregulated transfer methods, cash runners, drug trafficking revenues, fictitious companies, and progressively advanced digital financial systems may establish several intermediaries between the origin and final beneficiary of money. As a result, counterterrorism enquiries must analyse not just singular transactions but also financial networks and relational patterns. A significant conceptual transition is also present here. The aim of financial counterterrorism should extend beyond mere wealth confiscation. It ought to be a network interruption.

Should a terrorist organisation lose a specific benefactor but have access to other funding avenues, the interruption might be temporary. On the other side, recognising the extensive network linking funders, facilitators, recruits, smugglers, and overseas operatives may lead to a far more lasting disruption. The increasing connection between drugs and terrorism makes this especially important for Jammu & Kashmir. Narcotics smuggling may provide both monetary assets and operational frameworks for extremist organisations. The same pathways, middlemen, and facilitators might be used for other unlawful objectives. Thus, counter-narcotics initiatives need to be increasingly seen as integral components of the broader counterterrorism framework rather than as a wholly distinct law enforcement activity.

From "Follow the Money" to "Anticipate the Attack"

India's counterterrorism framework should therefore move beyond the traditional principle of “follow the money” towards a more anticipatory model: identifying financial patterns that may signal the preparation of an attack before the operational stage is reached. The financial trail should not be treated merely as evidence of an offence that has already occurred; it can potentially serve as an early indicator of recruitment, logistical preparation, procurement and network activation.

This requires the systematic integration of financial intelligence with:

• human intelligence; 

• border intelligence; 

• digital intelligence; 

• narcotics investigations; 

• drone-related investigations; and 

• local police intelligence. 

The significance lies in connecting otherwise fragmented indicators. A suspicious financial transfer may appear innocuous in isolation; when correlated with a known facilitator, a cross-border movement, a narcotics transaction, unusual digital communication or a drone-related incident, it may reveal a much larger operational network.

Such integration can transform financial intelligence from an investigative tool used primarily after an incident into an early-warning mechanism capable of identifying network activation before it translates into violence.

This, however, exposes another limitation of a purely kinetic counterterrorism framework. Terrorist networks do not operate only through weapons, money and physical movement; they also compete for ideas, perceptions and narratives. An attack may be operationally prepared through physical and financial networks, but its wider impact can be amplified through information manipulation. The battlefield, therefore, extends from the physical and financial domains into the cognitive domain, the battle over information, perception and legitimacy.

The Cognitive Battlefield of Narrative Contestation

The evolution of the security landscape in Jammu & Kashmir transcends the tangible and monetary aspects of terrorism. As traditional terrorist organisations encounter heightened scrutiny from intelligence-driven initiatives and improved border defences, the struggle increasingly transitions to the realms of information and cognition. The aim has expanded beyond only causing bodily harm; it now includes shaping civilians' perceptions of security, governance, political legitimacy, and the essence of the struggle.

This presents a unique obstacle for India's counterterrorism framework. A terrorist assault could consist of a limited cadre of assailants, but the informational landscape can significantly magnify its psychological and political ramifications. Visuals, footage, speculation, distorted accounts, and radical propaganda may be disseminated via digital channels in only moments, thereby fostering feelings of vulnerability that extend far beyond the site of the initial event.

The cognitive domain, therefore, signifies a crucial expansion of the modern security dilemma. The aim of cognitive warfare is not primarily to dominate land, but to shape attitudes of that land. It aims to influence public perceptions, establish trust, interpret security measures, and frame political events.

In the framework of Jammu & Kashmir, this aspect is notably important due to the region's ongoing political and diplomatic disputes with Pakistan. Pakistan's yearly commemoration of Youm-e-Istehsal on August 5 exemplifies this storytelling technique. Via formal declarations, diplomatic correspondence, and synchronised public messaging regarding the anniversary of India's 2019 constitutional amendments, Islamabad aims to maintain the Kashmir issue at the forefront of both domestic and global discussions while solidifying its perspective on the events in Jammu & Kashmir.

It would be analytically unsound to immediately connect Youm-e-Istehsal or diplomatic communication with terrorism. Its importance resides in another realm: it exemplifies the ongoing existence of a concurrent narrative struggle that functions alongside the issue of physical security. State-supported narratives may coexist within the same overarching information landscape as extreme propaganda, technologically enhanced grievances, and misinformation. The possible interplay among these many communications types is hence more significant from an internal-security standpoint than any single campaign considered independently.

The difficulty is exacerbated by the dispersed characteristics of modern information distribution. In contrast to conventional propaganda, which relied on recognisable entities and regulated communication pathways, digital platforms enable narratives to be replicated and intensified by many participants concurrently. A communication from outside India may be reformulated by anonymous profiles, disseminated over encrypted platforms, transformed into brief video content, and ultimately portrayed as domestically produced media. This establishes a narrative supply chain: an external communication may evolve into a localised complaint, which may then be magnified via digital platforms and perhaps lead to radicalism or mobilisation.

The emergence of artificial intelligence is expected to exacerbate this issue. Deepfakes, synthetic audio, altered visuals, and AI-generated text render falsified information more challenging to differentiate from genuine content. In the midst of a security crisis, the rapid dissemination of such information may surpass the capacity of institutions to authenticate and address it. The significance is crucial for counterterrorism strategy. Kinetic actions may incapacitate a terrorist; yet, they alone cannot dismantle the narrative framework that facilitates recruiting, grievance mobilisation, or psychological enhancement.

India thus, must cultivate cognitive resilience as an integral facet of domestic security. This must not imply categorising dissent, criticism, or political opposition as security risks. Counter-disinformation must not serve as a rationale for blanket censorship. A democratic security framework must maintain a distinct separation between valid political discourse and material that promotes terrorist recruiting, incites violence, or intentionally attempts to exploit a security crisis via misinformation.

The aim should thus be to enhance the resilience of institutions and communities by means of reliable information, swift verification, digital literacy, strategic communication, and the deliberate destruction of verifiably detrimental extremist networks. This necessitates enhanced collaboration among security agencies, intelligence entities, technological platforms, and public information organisations. In the event of a terrorist attack or significant security operation, delays in disseminating confirmed information can generate an information void that adversarial entities may swiftly take advantage of. Strategic communication should thus be an essential element of crisis management instead of a task executed post-initiation of the security response. 

Thus, the broader lesson is that India's counterterrorism architecture must protect not only the physical territory of Jammu & Kashmir but also the information environment surrounding it. If terrorist networks increasingly operate across physical, financial, technological and cognitive domains, India's response must possess the capacity to identify and disrupt threats across all four.

The central challenge, therefore, is not simply to counter hostile narratives, but to build a security environment in which hostile narratives have progressively less capacity to translate into radicalisation, mobilisation or violence.

And this brings the argument back to the central proposition of this article: the adversary's transition from territorial disruption to system penetration requires India to transition from incident response to ecosystem resilience. The next question is consequently institutional: how effectively can India's existing intelligence and security agencies connect these dispersed physical, financial, digital and cognitive indicators into a single actionable threat picture?

Transitioning from Intelligence Sharing to Intelligence Fusion

The primary institutional issue has shifted from a lack of intelligence to the capacity to swiftly integrate disparate information to recognise an impending danger. A presumed drone incursion, a questionable cash exchange, an atypical digital correspondence, a drug confiscation, or a regional recruiting effort may seem trivial when assessed in isolation. Their confluence, although, may uncover various elements of the same terrorist network.

India's counterterrorism framework must evolve from traditional information sharing to authentic intelligence integration. Data produced by border troops, Jammu & Kashmir Police, intelligence organisations, financial investigators, cyber units, and narcotics authorities should contribute to a unified and actionable threat assessment. The emphasis needs to transition from only enquiring “Who is the terrorist?” to questioning “Who supports, funds, enlists, communicates with, and empowers the network?” This network-oriented strategy is especially crucial when engaging with hybrid entities that could inhabit just a single node inside a broader operational framework.

The differentiation between border security and interior security should also become more flexible. Intelligence produced at the border needs to guide enquiries and monitoring inside Jammu & Kashmir, whilst data originating from the interior should perpetually enhance evaluations of border risks. Technological advancements and AI-driven analytics may assist with recognising trends throughout extensive datasets; nevertheless, they need to enhance rather than supplant human intellect and expert discernment. The aim is not only to amass more data, but to link the appropriate information at the opportune moment. The primary criterion for the efficacy of intelligence should be its predictive nature: the ability to link several signs before their alignment in an assault. India's counterterrorism efficacy will progressively rely not just on the volume of intelligence it gathers, but also on the speed and astuteness with which it synthesises that information.

Recalibrating India's Counterterrorism Architecture

The changing threat environment does not require India to abandon the security architecture developed after 2019. It requires that architecture to evolve beyond its predominantly kinetic foundations.

Five priorities are particularly important.

First, institutionalise hybrid-threat assessment. Jammu & Kashmir requires a mechanism capable of assessing terrorism alongside drone activity, narcotics, organised crime, cyber activity, financial flows and information operations rather than treating them as separate security problems.

Second, integrate counter-drone capabilities with intelligence. The objective should not end with detecting or neutralising a drone. Every interception should generate forensic and intelligence leads concerning its operator, payload, intended recipient and wider logistical network.

Third, strengthen preventive counter-radicalisation. Intelligence-led intervention must be complemented by community resilience, youth engagement and digital literacy so that recruitment networks can be disrupted before individuals become operational assets.

Fourth, make financial and digital intelligence integral to counterterrorism. Terror financing, online recruitment and encrypted communications should be treated as interconnected elements of the same ecosystem wherever the evidence establishes such linkages.

Fifth, institutionalise strategic communication and cognitive resilience. During a security crisis, credible information must reach the public faster than rumours and manipulated narratives. Countering hostile information operations should therefore be understood as an element of internal security, while preserving legitimate political expression and democratic freedoms.

The larger objective should be a shift from incident response to ecosystem disruption. Instead of asking only how to prevent the next attack, India's security institutions must ask how the network preparing that attack can be identified, penetrated and dismantled before it becomes operational.

Conclusion 

The post-2019 transformation of Jammu & Kashmir has produced important security gains, but those gains should not be mistaken for the disappearance of the threat. The nature of the challenge is changing. Conventional terrorist networks are under pressure, yet their supporting ecosystems continue to adapt through drones, hybrid actors, narcotics, digital platforms, financial networks and cognitive operations.

The strategic challenge for India is therefore moving beyond the physical defence of territory. It is increasingly about defending the systems through which terrorism can reproduce itself.

Article 370 altered the political and administrative architecture of Jammu & Kashmir. The next phase must transform the security architecture in response to an adversary that is itself becoming more dispersed, technologically enabled and multidimensional.

The objective should ultimately be to move:

from cadres to networks,
from reaction to anticipation,
from intelligence sharing to intelligence fusion,
from territorial security to system security,
and from preventing attacks to dismantling the ecosystem that produces them.

India's long-term advantage will depend on whether its institutions can adapt faster than the threat itself evolves. That is the real test of the next phase of counterterrorism in Jammu & Kashmir.