Documents Planted On Computers: New Report After Stan Swamy's Death

A day after activist Stan Swamy's death, a report from an American forensic agency claims that incriminating evidence was planted on the computer of Surendra Gadling, who, like the Christian priest, was arrested under a harsh anti-terror law for alleged links to the banned CPI(Maoist) group.

The report says Surendra Gadling's computer had been compromised over two years before he was arrested through emails that he received, and on which others like Stan Swamy were copied, raising the possibility that Mr Swamy's computer too may have been targeted.

The 84-year-old Christian priest and Surendra Gadling are among 16 people accused in what is known as the Bhima-Koregaon case.

Till his death, Stan Swamy, like the others named in this case, had argued, including in his multiple bail applications, that the evidence presented against him of instigating a riot and of links to Maoist guerrillas was fabricated.

The National Investigation Agency or NIA claims that Stan Swamy and 15 others instigated the Bhima-Koregaon riot in Maharashtra three years ago when lakhs of Dalits had gathered to commemorate a historic battle which saw Dalits defeating an upper caste army.

All 16 of them, of which Stan Swamy was the oldest, have been arrested under the Unlawful Activities Prevention Act, which enables prolonged detention for questioning; they have even been named for plotting to assassinate the Prime Minister.

The stringent law has been used by the government to target opponents including left-leaning intellectuals, say critics.

The report accessed by NDTV is the diagnosis of Arsenal Consulting, based in Boston. Earlier this year, The Washington Post had reported on a similar document from the same firm, alleging that an unknown hacker had planted over 30 documents on the computer belonging to Rona Wilson, one of those named for terrorist links.

The latest Arsenal report, dated June 2021, analysed the hard drive of Surendra Gadling, 53, a Dalit rights activist based in Nagpur, finding even deeper proof of the planting of incriminating evidence.

"It should be noted that this is one of the most serious cases involving evidence-tampering that Arsenal has ever encountered," reads the report.

Arsenal, according to their website, has worked on a number of high-profile cases including the Boston Marathon bombing.

The report says his system was compromised for over 20 months between February 2016 and November 2017, and at least 14 incriminating letters planted on the computer by the same attacker who targeted Rona Wilson's system and planted 30 files there.

Surendra Gadling was arrested over three years ago and has been in jail since.

The NIA refused to comment on the report, saying the matter is sub judice.

Stan Swamy had Parkinson's disease. He was arrested in October last year under the stringent anti-terrorism law and moved to a Mumbai jail from his home in Ranchi, where he campaigned for tribal rights. In May, he was hospitalized. The news of his death was broken by attending doctors in court, where his hearing for bail was underway; it triggered outrage including from the Opposition and top UN Human Rights officials.

The attacker who compromised Surendra Gadling's computer had extensive resources including time, according to Arsenal, and indulged in both surveillance and planting evidence. The report suggests that other defendants in the Bhima Koregaon case may have been compromised, including Stan Swamy.

'PLANTED' LETTERS: HOW IT WORKED

The hard drive of Surendra Gadling's computer was seized by the police, and a copy of it was given to his lawyers; they, in turn, shared the device with Arsenal for analysis. According to Arsenal, the attacker made several attempts at compromising Mr Gadling's computer via email, "sending him identical malware (but packaged differently)" through February 2016. "Ultimately, on February 29, 2016, Mr Gadling executed this malware," the report reads.

The malware, which is software that is designed to gain access to someone's computer, was packaged innocuously as emails with attachments from Mr Gadling's acquaintances.

Amongst those copied on a malware-tainted email are other accused in the case, like Stan Swamy and Sudha Bharadwaj, raising the question of whether their computers were also compromised. The new Arsenal report says that "by February 2016, the attacker had compromised not just Gadling's computer, but also the email accounts of multiple defendants in the Bhima Koregaon case."

Arsenal said that they caught the attacker "red-handed" based on remnants of the attacker's activity imprinted on Mr Gadling's system.

14 'MAOIST PLOT' LETTERS PLANTED ON GADLING'S COMPUTER?

Arsenal says that Surendra Gadling's defense team had asked them to focus on 14 documents recovered from his computer. All of these are letters, many of them appearing to be communication between Surendra Gadling and other alleged Maoist leaders and sympathisers, like 'Sudarshan', which could be a reference to the alias for Maoist leader Sriramula Srinivas, said to be involved in multiple cases. The letters discuss past and future Maoist attacks, and funds for operations, among other things, and form the core of the NIA's case against the activists.

Arsenal found that the 14 letters were delivered to a hidden folder titled 'Material' on Surendra Gadling's computer between December 2016 and October 2017.

"Arsenal has found no evidence which would suggest that the 14 important documents were ever interacted with in any legitimate way on Mr Gadling's computer... More specifically, there is no evidence which would suggest any of the fourteen important documents, or the hidden "Material" folder they were contained in, were ever opened," it says.

Lawyers for Rona Wilson, armed with the earlier Arsenal report on his malware, had gone to the Bombay High Court in February this year, challenging the charges levelled against him and demanding an independent investigation into the matter.

The court is currently hearing the matter.