Evidence Planted On Activist Stan Swamy's Laptop, Claims US Report

A new report by an American forensic firm shows that multiple incriminating documents were planted in the computer of Father Stan Swamy, the 83-year-old activist-priest who was arrested for alleged terror links in 2020 and who died in custody a year later.

The report blasts a hole in the National Investigation Agency (NIA)'s charges against Stan Swamy, which centre around alleged electronic correspondence between the priest and supposed Maoist leaders to make the case that he was part of an explosive Naxal conspiracy.

In its findings, Arsenal Consulting, a Boston-based forensic outfit hired by Swamy's lawyers, says close to 44 documents, including the so-called Maoist letters, were planted by an unknown cyber attacker who gained access to Swamy's computer over an extended period of five years, starting from 2014 to the point when he was raided in 2019.

Arsenal Consulting says it has extensive experience of working in digital forensics and has investigated multiple high-profile cases like the Boston Marathon bombing case.

This story is being simultaneously reported by the Washington Post.

Swamy, a Jharkhand-based Jesuit priest who worked among tribals, was arrested in the Bhima Koregaon case, a move that sparked wide condemnation. The criticism escalated when he died within a year of his incarceration due to Covid-related complications. The UN and the EU both reacted strongly to the news of Father Stan Swamy's death. A UN official called the news "devastating," and added that the priest had been imprisoned on "false charges of terrorism".  

The NIA, however, claimed he was part of a conspiracy along with 15 others to instigate riots in the village of Bhima-Koregaon in Maharashtra in 2018, when scores of Dalits had gathered to commemorate a historic battle in which Dalits defeated an upper caste army.

Based on documents retrieved from their computers, the NIA had also charged Swamy and the others - mainly left-leaning activists, academics, and human rights defenders - with plotting with Maoists to kill Prime Minister Narendra Modi.

In a video recorded just before his arrest in 2020, Father Swamy had rubbished the purported Maoist letters found on his computer, saying he "denied and disowned every single extract that was put before me" by investigators.

Now, about 17 months after his death, Arsenal Consulting's report shows that the hacker used a malware called NetWire to gain access to Father Swamy's computer on October 19, 2014, for both highly invasive surveillance and "document delivery".

According to Arsenal, one such document "delivered" by the attacker to Stan Swamy's computer and part of the NIA's chargesheet against the priest, was an alleged letter sent by one "SS" - presumed to be Father Stan Swamy - to a "Vijayan Dada" on October 2017. In the letter, "SS" asks "Vijayan" to take action "to capture senior leaders of ruling BJP in the state and demand that the oppressive laws be done with."

Another document in the NIA chargesheet against Swamy, detailing the manpower and weaponry of a Maoist outfit called People's Liberation Guerilla Army in different Indian states, is also among the planted documents, Arsenal says.

According to Arsenal, they "found no evidence which would suggest that the... documents were ever interacted with in any legitimate way on Fr. Swamy's computer. More specifically, there is no evidence which would suggest any of the (planted) documents, or the hidden 22 folders they were contained in, were ever opened" by Swamy.

Earlier reports by Arsenal Consulting had found proof of similar planting of evidence on the systems of at least two other co-accused in the Bhima Koregaon case - activists Rona Wilson and Surendra Gadling. The reports found an unknown hacker had planted over 30 documents on the computer belonging to Rona Wilson and at least 14 incriminating letters on Surendra Gadling's computer.

All three – Stan Swamy, Surendra Gadling and Rona Wilson - were targeted by the same hacker, according to Arsenal.

While Arsenal has not speculated on the identity of the attacker, the report says the attacker made frantic attempts to "perform an extensive cleanup of their malicious activities" on June 11, 2019 - a day before the Pune Police seized Stan Swamy's computer (June 12). The timing raises the question of whether the hacker had prior knowledge of the impending police action.

NDTV wrote to the NIA requesting for comments on the findings of Arsenal Consulting, but did not receive a response till the time this article was published. The story will be updated if any response is received from the agency.