Bhima Koregaon: Day After Swamy's Death, Report Claims 'Proof' Planted in PC

The report claims that the accused Surendra Gadling's computer was targeted by the same malware as Rona Wilson's.

Just a day after the death of activist Father Stan Swamy, who was arrested in the Bhima Koregaon case under UAPA for alleged links with banned Maoists, a report by an American forensic agency has claimed that evidence was 'planted' on the computer of another activist, Surendra Gadling, also arrested in the case.

The malware that targeted Gadling's computer via emails also had several other Bhima-Koregaon accused, including Swamy and Sudha Bhardwaj copied on the mails, the forensic agency has claimed.

The report comes just months after similar claims were made for another arrested activist Rona Wilson, who is also believed to be a victim of the same hackers who targeted Gadling.

Approached by the defence lawyers of the case, the agency previously published two reports regarding the tampering of Rona Wilson's computer to allegedly plant evidence.

What The Report Says

The report, dated June 2021, was published by Arsenal Consulting based in Boston.

According to the report, Gadling's computer had been targeted for over two years via emails, on which several accused including Stan Swamy were also copied, NDTV reported.

NetWire, a commercially available form of malware, was reportedly used to target Gadling's computer.

The analysts reportedly diagnosed Gadling's hard drive to find proof of planting of incriminating evidence and reported that his system was compromised between February 2016 and November 2017.

It further says that at least 14 incriminating letters were planted on the computer by the same attacker who targeted Rona Wilson's system.

The attacker reportedly made several attempts at compromising Gadling's computer via email by 'sending him identical malware (but packaged differently)' through February 2016.

"Ultimately, on 29 February, 2016, Mr Gadling executed this malware," the report said, as quoted by NDTV.

The Washington Post quoted from the report to claim that one afternoon in July 2017, the attacker was active on the two computers for 20 minutes, during which the same incriminating document was deposited on both.

The report further said that the ones copied on the malware-tainted email were the other accused arrested in the case, like Swamy and Bharadwaj.

What the President of Arsenal Consulting Said

Speaking to NDTV, Mark Spencer, President of Arsenal Consulting said, "For documents to be delivered over months and even years, is not something we have ever seen or heard of. An intrusion for that length of time ultimately results in the delivery of incriminating documents. As far as we know, this is the first case of its kind."

Spencer also said that while it was impossible for anyone but the attacker to know how extensive the compromise of devices and accounts is, he agreed that the computers of other defendants in the case could be comprised, because they had been targeted.

Further, he said that the fact that Father Stan Swamy was copied on one of the malware-tainted mails showed that he had been targeted and that it was likely that his computer had been compromised as well.

Speaking about the identity of those involved, Spencer said it would be appropriate for the Indian government to be naming the attacker. He said, "As far as our role, we are focusing on analysing the electronic evidence that has been put in our hands..."

What Lawyer, NIA Said On the Report

Legal expert Mihir Desai, who's a part of the defence team in the case, told WP that the findings "go a long way in exonerating the accused and destroying the prosecution’s case."

Speaking to The Quint, Desai said, "My preliminary comments are that the accused in the case, the BK-16, which are 15 now, have always claimed that the incriminating documents that were found do not belong to them. The fulcrum of the NIA's case were these documents."

These people have always said that these documents do not belong to us. We have never seen them, we have never written them. So, this report actually goes to show what these people were saying is correct, that these documents did not originate either in their computer, nor were they ever seen by the accused.

Mihir Desai to The Quint

When asked if such reports, of which this is the third, would be admissible in court, Desai said, "Well, that we will have to see. According to us, there is no reason where these would not be admissible. There is no judicial system where only the prosecution can produce documents, and the defence cannot. Our judicial system doesn't allow it."

Desai further added that the report would destroy the prosecution's case.

Meanwhile, Jaya Roy, a spokesperson for the National Investigation Agency (NIA), declined to comment on the report citing that the matter is sub-judice, WP reported.

'Final Blow to the Case'

'Mumbai Rises to Save Democracy', a coalition of more than 40 civil society organisations, issued a statement to say that this was the "final blow" to the case.

"These findings point to an organised conspiracy of evidence tampering/planting in the Bhima Koregaon case. The extent of the attack renders the Bhima Koregaon case hollow and opens new questions about the state’s prosecution and participation in the conspiracy," it said.

"With the publication of Report III, the total number of files documented as having been planted on the defendants’ hard drives now stands at 48. These 48 files represent the most significant portion of the alleged evidence that the prosecution has brought in their chargesheets. Report III also stands as a stellar example of high quality digital forensic work that establishes a clear case of highly organised evidence tampering and fabrication," it said.

(With inputs from The Washington Post and NDTV.)