Police in Maharashtra, run by a coalition of the Shiv Sena, Congress and the NCP, have arrested a 19-year-old girl from Uttarakhand and an engineering student from Bangalore in the Bulli Bai app case.

The two have been identified as Shweta Singh and Vishal Kumar Jha, 21. The police said the knew each other.

Mumbai police had registered an FIR against unidentified persons following complaints that photographs of hundreds of Muslim women were uploaded for a mock auction on an app called Bulli Bai, hosted on the open-source software platform GitHub.

The objective of the app seemed to be to humiliate and intimidate the targeted women, many of whom are active social media users.

The action of Mumbai police stands out against the manner in which the BJP-helmed Uttarakhand government had responded to the hate speeches in Hardwar. No one has been arrested yet although the identity and whereabouts of most of the speakers are known.

The girl, arrested by a team of the cyber wing of Mumbai police, was suspected to be operating multiple accounts related to the app, an official said.

She was produced before a court in Uttarakhand that granted transit remand, and was being brought to Mumbai, he said.

Shiv Sena MP Priyanka Chaturvedi, who had complained to Mumbai police about Bulli Bai, tweeted: “That it had to be a woman who’s part of this larger network behind the online harassment is saddening. For a woman to harass and demean fellow women is beyond me, but yes this is what all consuming hate can do.”

Earlier, the cyber police arrested engineering student Jha, who had been detained in Bangalore.

The Mumbai cyber police station has also registered a case against the app's unidentified developers and Twitter handles which promoted it.

A few of these Twitter handles had photographs or caricatures of turbaned persons in their profile pictures and posts in the Punjabi script in an apparent attempt to mislead others about the identity, the police said. The app used doctored photographs of hundreds of Muslim women, sourced without permission.

The police produced Jha before the Bandra metropolitan magistrate’s court in Mumbai on Tuesday, and sought his custody for 10 days. The court remanded him in police custody till January 10. It granted police permission to carry out searches at his house in Bangalore.

He has been charged under IPC Sections 153 (wantonly provoking with intent to cause riot), 509 (insulting the modesty of a woman) and 354 (assault or use of criminal force to any woman with intention to outrage modesty) and Section 67 (publishing or transmitting obscene material in electronic form) of the Information Technology Act for allegedly sharing the contents of the app.

“My client Vishal Jha has been falsely implicated in the case. He had no role to play in the creation of this app or any fake accounts. He is only a student,” his lawyer Dinesh Prajapati told PTI. Prajapati denied that Jha knew the woman.

A cyber security expert has called the Bulli Bai app and website a “planned and targeted event”, even as the US-based host of the platform said it had demanded a legal notice from the police in order to help with the probe.

Sociologist Shiv Visvanathan said the trend had been designed to “put fear into the (Muslim) community”.

Last May, a similar effort had been made via the app Sulli Deals. Both apps were hosted on the Microsoft-owned GitHub, which offers anonymity to creators.

Bulli Bai was taken down after the victims and several Opposition leaders spoke up, but GitHub said any further action would only be taken if it was made party to a “valid legal process”.

India and the US have had a Mutual Legal Assistance Treaty (MLAT) since 2005, but an expert called the process for the police to seek information under it “complex”.

Cyber security expert Pawan Kumar Singh told The Telegraph: “What stops these companies from saying where the IP address is (located is) not understandable…. Once the IP address is known, we can ask other countries as well on the basis of the MLAT…. In the first episode (Sulli Deals), no one (police) did much….”

He added: “The list of women shows that it is a planned and targeted event.… One community, known people. They know this will catch attention…. There is no other purpose but to create disturbance between two communities.”

The police in Delhi, Mumbai and Hyderabad had registered FIRs on separate complaints. PTI had quoted unnamed officials as saying on Monday that Delhi police had sought “details from the GitHub platform about the developer of the controversial Bulli Bai mobile application and have written to Twitter for information about the account handler who first posted about the app”.

The Delhi Commission for Women summoned a deputy commissioner of the Delhi police on Tuesday.

A GitHub spokesperson had said on Monday: “We informed India police of our policy in this case, and will assist upon receiving a valid legal process from them.”

Jaipur-based cyber security consultant Mukesh Choudhary told this newspaper: “The MLAT process is complex and law enforcement agencies struggle to process routine cases…. They (platforms like GitHub) may ask for a request under the MLAT or a court order. Companies like Facebook, Google and Yahoo, which have offices in India, usually respond to police notices for information under Section 91 of the Criminal Procedure Code.”

Visvanathan, who teaches at OP Jindal Global University in Sonipat, said: “There is an ongoing climate of harassment, oral and digital. Oral is religious people asking for ethnic cleansing (at Dharma Sansads in Haridwar and other places)…. None of it is being prosecuted in a way that would deter others from doing it…. The danger of a majoritarian system is that what is majoritarian in votes becomes majoritarian in law and order. When you make that transition, you move to authoritarianism.”

He added: “It is very clear that the old Congress idea that a minority should be protected is over. Now a minority is something that should be harassed. The best way to do that is to target members of the community who are visible and you put fear into the community. It is a symbolic injection of fear anticipating elections. Democracy cannot tolerate this. The very fact that top leaders of the BJP are silent on this is disgusting.”

Union minister for electronics and information technology Ashwini Vaishnaw had tweeted that GitHub had blocked the user (who created the site) and that the Centre’s Computer Emergency Response Team and the police were coordinating further action. His colleague, minority affairs minister Mukhtar Abbas Naqvi, called it a “cyber criminal communal conspiracy.” Madhya Pradesh’s home minister, Narottam Mishra of the BJP, has promised action if his state’s police receive a complaint.

Afeeda KT, who teaches sociology at Bangalore’s Mount Carmel College, told this newspaper: “This (crimes such as the Bulli Bai auction) is part of the construction of an image of the ‘Muslim community’ by the Hindutva forces where Muslim men are over sexualised and Muslim women are exoticised. The intention of these particular cases of Sulli Deals and Bulli Bai is to disrupt the public appearance and participation of Muslim women. It will definitely create a sense of insecurity among these women when they step out to public spaces. It is not just about objectification of women’s body but hatred towards a community; a call to cancel out a community.”

Independent researcher of digital cultures in India, Sagorika Singha, told this newspaper: “The targeting of women journalists is part of the continued silencing of voices with particular authority. This incident makes the discussion around privacy and control over personal data imminent. The broad canvas of sexual harassment categories will only expand with tech.”