Mumbai Rises to Save Democracy, a group of activists, organised a webinar to discuss the possible impact of the recent revelations made by Arsenal Consulting, an American digital forensics firm in the Bhima Koregaon case.
Arsenal had analysed an electronic copy of activist Rona Wilson’s laptop and arrived at the conclusion that an attacker used malware to infiltrate the laptop and place incriminating evidence on it. Rona Wilson is the public relations secretary for the Committee for Release of Political Prisoners. He was at the forefront of the struggle to release SAR Geelani in the 2001 Parliament attack case. Pune Police had raided his home in April 2018, and he was arrested on June 6, 2018.
He had been accused of being part of a conspiracy to assassinate Prime Minister Narendra Modi. Wilson was accused of channeling funds towards Maoist groups for this purpose. He was charged under the Unlawful Activities (Prevention) Act (UAPA) and the charges were based on a letter he allegedly wrote to a Maoist leader discussing the need for guns and ammunition, urging the group to assassinate the Prime Minister.
According to Arsenal’s report, “Rona Wilson’s computer was compromised for just over 22 months.” They also found, “The attacker responsible for compromising Mr. Wilson’s computer had extensive resources (including time) and it is obvious that their primary goals were surveillance and incriminating document delivery.”
But there was another chilling revelation, “Arsenal has connected the same attacker to a significant malware infrastructure which has been deployed over the course of approximately four years to not only attack and compromise Mr. Wilson’s computer for 22 months, but to attack his co-defendants in the Bhima Koregaon case and defendants in other high-profile cases as well.”
In light of this activists and lawyers are demanding immediate action. Senior Advocate Mihir Desai said, “Now that we have been able to show that the entire evidence upon which the case is based is suspect, the case should be quashed. At the very least, the accused should be released immediately on bail.”
Advocate Desai said, “It is a neutral, independent report that punches a huge hole into the case of the prosecution.” He added, “If malware can be used to implicate people in this Bhima Koregaon case, it can be similarly used in other cases against other people. So, we are demanding that an inquiry be carried out to find out exactly how this malware was planted, and who was responsible for it. It appears now that the conspiracy is not by Bhima Koregaon people, but against them to implicate them.”
Dr. Jedidiah Crandall, who is the Associate Professor, Biodesign Center for Biocomputing, Security and Society; Associate Professor, School of Computing, Informatics and Decision Systems Engineering, Arizona State University, also weighed in with his technical expertise. He said, “There were five instances of Netwire which is a malicious trojan, two of those could have easily been found by anti-virus software. So, there’s no room for doubt.”
“Could the cloned hard-drive sent from India have been tampered with en route? That is also not possible. When law enforcement confiscates a device like a computer or a USB stick, they not only create an image of it, they also calculate an MD5 hash, which is a cryptographically strong hash of that image. So that hash can be part of the record, and anybody who is evaluating that image, can check that the image that they have, matches the hash value,” explained Dr. Crandall.
Further illustrating how it is easy to detect tampering, he said, “There are events that happen behind the scenes in an operating system like Windows. They typically have sequence numbers,” adding, “If somebody goes and forges a time stamp, it’s still possible to look at the sequence numbers and know the time when something actually happened, even if somebody has changed the time stamp to make it look like it happened at a different time.”
Another technical expert Professor Sandeep Shukla, who is Professor of Computer Science and Engineering, IIT Kanpur, pointed at another curious element that suggested that the evidence had been planted. He said, “All documents were created using MS Office 2010 or 2013, but the victim’s computer had MS 2007. You can’t use 2007 to create 2010 or 2013 documents.” He also added, “No object ID was found on this computer for these files, which means the files were never opened.”
Father Solomon, Director, Bagaicha, Ranchi, Fr. Stan Swamy’s colleague, also spoke at the webinar. He said, “That our computer could be hacked to insert a document was beyond the imagination of the people in their 60s and 70s.” He went on to share how octogenarian Fr. Stan was baffled when he was first told about his computer being compromised. Three incriminating documents were allegedly found on the Jesuit priest and Adivasi rights defender’s computer.
Another jailed activist Vernon Gonsalves’ son Sagar shared the experience of how evidence was collected from his home and the vilification campaign by the media. “At the beginning of this case, you saw them (media channels) baying for blood of these activists and calling them ‘Urban Naxals’, and all sorts of names on the basis of letters that were leaked to them by the police, but not given to the activists themselves. And now when there’s such a huge question mark being raised about it, you don’t see a lot of them talking about it,” he said. “These activists should at least be released on bail now, and then we should move to just ending this case,” urged Sagar.
Activist Rama Ambedkar, who is also the grand daughter of Dr. BR Ambedkar, and wife of Prof. Anand Teltumbde, also spoke at the webinar and echoed the demand for bail for all accused and an independent investigation. “We hope that after this mind-boggling revelation and this revealing report by this forensic expert, that the High Court will begin questioning the basis on which these 16 people have been kept behind bars,” said Ambedkar. Reminding everyone that the actual culprits still roamed free, Ambedkar said, “The culprits names at the time were Milind Ekbote and Sambhaji Bhide. And today there is no mention of these persons!”
