Fear is cheap. It’s the ultimate low-margin, high-impact commodity, and right now, the ROI is through the roof.

Last week, Punjab’s Director General of Police, Gaurav Yadav, stood before the press to deliver what was meant to be a reassuring update. The wave of bomb threat emails paralyzing schools, airports, and government buildings across the state finally had a digital footprint. The breadcrumbs, he said, lead to servers in Bangladesh.

It sounds like a breakthrough. It sounds like the plot of a mid-season CSI episode where the lead investigator screams "Enhance!" at a grainy monitor. In reality, it’s the digital equivalent of finding a generic candy wrapper at a crime scene and announcing you’ve narrowed the suspect list down to anyone who shops at a grocery store.

Let’s talk about the friction. On one side, you have the state apparatus. You have thousands of panicked parents, grounded flights at Amritsar, sniffer dogs working overtime, and bomb squads clearing hallways for the fifth time in a month. The economic cost is staggering. One grounded international flight can bleed a carrier six figures in fuel, rescheduling, and landing fees. The psychic cost to a community? Immeasurable.

On the other side of the ledger, the cost to the perpetrator is basically zero. You don’t need a shadowy bunker or a state-sponsored cyber-army to do this. You need a burner laptop, a decent VPN, and a $5-a-month Virtual Private Server (VPS) hosted in Dhaka. If you’re feeling fancy, you use a decentralized email service that prides itself on not keeping logs. Total overhead: the price of a venti latte and about twenty minutes of effort.

The DGP’s announcement about Bangladesh is a classic bit of bureaucratic theater. It’s meant to project competence. It says, "We are looking. We have traced the signal." But tracing an IP address to a server in a different jurisdiction is the easy part. It’s the digital version of a "You Are Here" sticker on a map of the universe.

The problem is that servers don't commit crimes; people do. And those people aren’t sitting in the server rack. They’re likely three hops away, tunneling through an exit node in Stockholm or a proxy in Brazil. By the time the Punjab Police send a formal request for data to a Bangladeshi ISP—a process that involves enough red tape to wrap around the globe twice—the logs will be wiped, the VPS instance will be deleted, and the "threat actor" will be back on Reddit complaining about the latest Star Wars show.

We are watching a 20th-century legal system try to tackle a 21st-century nuisance. The DGP mentioned "international cooperation," which is law enforcement speak for "we’re waiting for an email that might never come." Inter-agency cooperation across borders is notoriously sluggish. Unless there’s a body count or a direct threat to national security, a request from Chandigarh to Dhaka regarding a series of hoax emails sits at the bottom of a very tall digital pile.

This isn't just a Punjab problem. It’s a systemic vulnerability. Our infrastructure—our schools, our transit hubs—is designed for physical security. We have fences and metal detectors. But we are wide open to "denial-of-service" attacks on our collective nervous system. The threat doesn't even have to be real to work. The threat is the work. It forces the system to react, to spend money, and to look foolish when nothing explodes but the evening news cycle.

The DGP says they are "working on it." They probably are. They’ll look at the headers, they’ll contact Interpol, and they’ll issue stern warnings about the consequences of "misusing the internet."

But meanwhile, the script kiddies and the bored trolls have realized that for the price of a cheap meal, they can make an entire state hold its breath. They don’t need to build a bomb. They just need to hit "Send."

Is it a prank? Is it a dry run by someone more malicious? Is it just the inevitable byproduct of a world where anonymity is a feature and accountability is a bug?

We’re focusing on where the server is, as if the geography matters in a world without borders. We’re patting ourselves on the back for identifying a location in Bangladesh while the next batch of emails is already sitting in an outbox in a data center in Singapore, or Ohio, or nowhere at all.

I wonder if the DGP realizes that in the time it took him to finish his press conference, someone could have spun up ten new servers and done it all over again.