Noida: On April 11, eight labour activists were picked up from Botanical Garden Metro Station at 6:55 PM.
This was two days after nearly 50,000 workers gathered across Noida and Greater Noida — garment units, hosiery clusters, automotive component factories— demanding for better working conditions, and implementation of revised minimum pay.
The detained activists, members of Mazdoor Bigul, a workers' collective, had been participating in the protests. According to witnesses at the site, the police dragged them into a vehicle without explanation.
When two lawyers, Prateek Kumar and Mohd Tanveer Ali, went to Surajpur Court the next day to find out where these eight people were being held, police detained them there too — manhandling and threatening them, according to a statement by the organisation, before releasing them late that night under pressure from worker groups and human rights organisations. The DCP's office, when contacted by reporters, said it had no knowledge of any detention.
What had drawn police attention was, in part, a WhatsApp group.
Gautam Buddh Nagar Police Commissioner Laxmi Singh spoke to the media on April 15 at the Phase 2 Police station, described the WhatsApp infrastructure at the centre of the investigation. Between April 9 and the morning of April 14, multiple groups had been created and populated through QR codes circulated via union channels. One was named "Workers' Movement." Another, "Mazdoor Andolan".
Workers in Phase 2 found Manesar counterparts had received a wage hike, triggering protests. (Image Credit: Sajid Ali)
The QR code mechanism—which allows a group admin to add members at scale without saving individual contacts, and without leaving traces of who recruited whom — is what investigators keep returning to. Thousands of workers, Singh said, were pulled into this network and then fed provocative audio, video, and messages.
The UP Special Task Force is separately examining more than 50 accounts on X, which police say were created within 24 hours of the protests beginning.
An FIR at Sector 20 police station names two handles — @Proudindianavi and @Mir_Ilyas_INC — for posting false claims on April 13 of police firing and 14 deaths among protesters. BOOM fact-checked and debunked both. Singh said technical analysis traced both accounts to Pakistan, operated using VPNs, active for three months before the protests.
Thirteen FIRs have been registered. Charges invoked include Sections 353(1) and 353(2) of the Bharatiya Nyaya Sanhita which deal with statements and rumours that can incite public mischief or disturb public order, as well as Section 66 of the Information Technology Act, which pertains to the dishonest or fraudulent use of digital platforms.
The National Security Act, Singh warned, would be used against some of those held.
The investigation's implied theory is that the technology preceded the unrest and that the groups, the QR codes, the accounts were infrastructure built to manufacture a crisis, not tools that workers reached for after one was already underway.
Workers and unions say the sequence was the other way around.
The Wage Gap That Started It
On April 9, Haryana notified a 35 percent increase in minimum wages, effective April 1, raising the monthly floor for unskilled workers to Rs 15,221. In Noida, the same category of worker was earning Rs 435 a day while Haryana workers were going to get Rs 585 after the revision.
Apurva, a labour rights activist with the All India Central Council of Trade Unions (AICCTU) who has been assisting detained workers, says the protest began before any WhatsApp group was built for it.
Workers at a Phase 2 garment unit discovered that colleagues at the same company's Manesar plant had received a wage hike while they had not. They walked out. Other factories followed — Richa Global Exports, Motherson Group, Sahu Exports, Paramount Exports, Rainbow Fabart, Anubhav Apparels. Work at nearly 300 factories in the Phase 2 Hosiery Complex was partially disrupted.
"That is what set it off," Apurva said. "After that, workers from other factories started joining in,” she said, adding that reports of vandalism only began surfacing around April 12–13.
By April 13, thousands of workers had gathered across more than 83 locations. Soon after, there were reports of violence— stone-pelting in Sector 121, arson in Phase 2. Two FIRs were filed by factory management — one by Richa Global invoking Section 109(1) of the BNS, attempt to murder, alleging that "miscreants attacked company management, employees, and police personnel with intent to kill." The other by Modelama Exports, invoking provisions related to unlawful assembly and causing hurt to public servants.
The protest turned violent in two pockets, reporting arson and stone-pelting. (Image Credit: Sajid Ali)
Apurva, who has been assisting detained workers, said many protesters allege that the initial violence was not started by workers. “They are saying bouncers deployed by factories initiated it,” she said.
She also questioned the framing of the investigation, arguing that invoking labels such as “Naxal” or “Pakistan-backed” allows for the use of stricter, non-bailable charges.
“These are workers earning barely Rs 300 a day. Rents keep rising every year, while wages go up by Rs 20–30 annually. Even now, the revised minimum wage is not in line with the formula,” she said, referring to the standard minimum wage calculation that factors in inflation, cost of living, and dearness allowance.
The Organisation, and the Engineer
Bigul Mazdoor Dasta is a labour collective affiliated with the Communist Party of India (Marxist-Leninist). It publishes a workers' journal, Mazdoor Bigul, and runs outreach campaigns in industrial clusters — door-to-door canvassing, factory-gate distributions, public meetings.
In late March, members conducted a campaign in Greater Noida's Kulesara area distributing the publication. Between March 30 and April 1, the Special Task Force says, meetings were held at a rented accommodation in Sector 37's Arun Vihar, attended by members linked to Mazdoor Bigul, Disha Student Organisation, Naujawan Bharat Sabha, and Ekta Sangharsh Samiti.
Rupesh Roy, the organisation's leader by police account, was arrested on April 11 by Sector 39 police, alongside Manisha Chauhan. Then, Himanshu Thakur and Satyam Verma were arrested April 18-19, described by police as active members who mobilised protesters in Phase 2 and were in contact with the primary accused.
The primary accused is Aditya Anand. A 28-year-old from Hajipur in Bihar, who holds a BTech from NIT Jamshedpur, and was recruited through campus placement as a software engineer at a private Noida firm. Police say his association with Mazdoor Bigul dates to 2022, when he found the group on Facebook and began documenting conditions in local factories. Police also allege that he created multiple WhatsApp groups using QR codes to add protesters and circulated provocative messages, audio, and videos that allegedly fuelled the violence.
Workers alleged the violence was initiated by factory bouncers. (Image Credit: Sajid Ali)
In 2023, during the Bhagat Singh Jan Adhikar Yatra — an outreach campaign by the group — he met Rupesh Roy. Investigators say he presented himself to worker communities as a journalist covering labour issues for a magazine and YouTube channel. He is additionally linked, police say, to Disha Student Organisation, the Revolutionary Workers' Party of India, and Naujawan Bharat Sabha.
Videos circulating on social media show him addressing a crowd on April 13.
After the violence, he went underground, changing locations frequently. A non-bailable warrant was issued on April 16, with a Rs 1 lakh reward. A joint team of Noida Police and Uttar Pradesh’s Special Task Force tracked him across multiple states before arresting him at 1:40 AM on April 18 at Tiruchirappalli Railway Station in Tamil Nadu.
Inside the Crackdown
When Decode visited the Phase 2 police station on Wednesday (April 15) afternoon, the surrounding roads were empty. Barricades blocked access roads, a PAC van was stationed at the entrance, a few damaged vehicles nearby.
Inside, through semi-transparent curtains keeping the press back, dozens of detained workers were visible — some sitting on the floor, others crowded onto staircases. A state-run bus waited outside to ferry detainees to Surajpur Court in Greater Noida.
A volunteer panel of lawyers, coordinated by AICCTU-affiliated advocate Surya Prakash, has been working on bail for the detained. Prakash says the detentions have been indiscriminate — people "simply out on the road for routine work" picked up alongside those who had been at the protests.
He says detainees were not produced before a judicial magistrate within the required 24 hours, but before an executive magistrate instead. "This arbitrary functioning goes against the principles laid down in the D.K. Basu judgment," he said.
Most of the workers are migrants — families in Bihar, Jharkhand, and West Bengal. Relatives who travelled to Noida were turned away and left to find their kin on their own among hundreds in custody.
The family of one of the arrested workers has also received a police notice asking them to deposit a surety of Rs 50,000.
Police notice directing a worker's family to furnish a Rs 50,000 surety.
Only a fraction of those detained were produced in court on April 16, several days after arrests had begun.
Advocate Vinod Bhati, representing some of the workers, echoed similar concerns. “There was no sinister plan, no WhatsApp network behind this. Workers were agitated over their pay. Now these theories are being used to justify action against them,” he told Decode, adding that workers often put in 12-hour shifts without adequate overtime.
Bhati also flagged what he described as delays and inconsistencies in due process. “For days, no FIRs were made public. We were told this was preventive detention under Section 170 of the BNSS,” he said.
He explained that under preventive detention, the police can keep individuals in custody for up to 14 days without immediately presenting them before a court. “This can be extended in successive 14-day periods, potentially going up to six months,” Bhati said, adding that such extensions are often justified on the grounds that release could aggravate the situation.
“In effect, it gives wide discretion to the police, with the duration of detention largely dependent on the Commissioner’s assessment,” he added.
The Technical Claims, Examined
The Pakistan attribution is the part of the investigation that most requires independent scrutiny.
Police said the two X accounts were using VPNs and were being operated from Pakistan. A VPN routes internet traffic through a server in another country, so the location that shows up in logs is the server’s, not the actual user’s. This means that saying the accounts were “operated from Pakistan” based only on these IP logs really points to where the server was, not necessarily where the person was.
Commissioner Singh said the conclusion was based on “technical analysis of data obtained from X”. However, she did not clarify what specific data informed this finding or what kind of analysis the Special Task Force conducted. X has also not commented.
The 50-accounts-in-24-hours finding similarly needs context. Account clustering of this kind is one signal among many that platform researchers use to identify coordinated inauthentic behaviour—it is not, by itself, conclusive. Uttar Pradesh’s Special Task Force examination is described as ongoing.
What is not in dispute is what the technology did in the days before April 13: it moved information—about the Haryana wage hike, about which factories had joined the protest, about where workers were gathering—across an industrial belt of hundreds of thousands of people, faster than any prior method of labour organising could have.
Activist Priyamvada, at the April 20 press conference, said, "The narrative that UP Police and mainstream media are spreading, that Aditya and Rupesh are the masterminds who instigated violence by creating WhatsApp groups, is baseless." Akash Bhattacharya of AICCTU called the framing "a dog whistle to delegitimise dissent".
The UP government has since announced revised minimum wages for Noida and Ghaziabad—Rs 13,690 for unskilled workers, Rs 15,059 for semi-skilled, Rs 16,868 for skilled. The workers had been demanding Rs 20,000.
Nearly 150-200 workers have been released so far. But, as Bhati pointed out, many who remain in custody are those who were only protesting for basic rights and were not involved in any violence, yet now face charges under the BNSS. The next hearing is dated April 28.
Behind these numbers are families in distant villages still waiting, unsure when or if their loved ones will return home.
The story has been edited by Adrija Bose.
