"It's really amazing how much time the attacker spent on Rona Wilson's computer," Mark Spencer said.
Highlights
- Rona Wilson's computer was hacked two years before his arrest: US Expert
- Arsenal Consulting was asked by his lawyers to investigate the matter
- 10 letters were planted in Rona Wilson's computer, it said
Writer-activist Rona Jacob Wilson's computer was hacked two years before his arrest in the Bhima-Koregaon case, and the purpose was "aggressive surveillance" and inserting fake documents, Mark Spencer of US-based digital forensics firm Arsenal Consulting told NDTV on Wednesday. Earlier this year, the firm was asked by Mr Wilson's lawyers to examine an electronic copy of the hard disc of his laptop, the one in which the police said they had found incriminating documents.
The firm said there was proof that 10 letters were planted in the activist's computer, US daily Washington Post reported yesterday.
Mr Wilson and four others were arrested in the Bhima-Koregaon case in June 2018. They were accused of links with the banned CPI-Maoist.
The initial case involved violence at Koregaon Bhima on the outskirts of Pune, where members of the Dalit community had gathered on December 31, to celebrate what they called a historic victory over Maratha Peshwas.
Later, the police said they have found letters from a suspected Maoist in Mr Wilson's laptop, which revealed a plot to assassinate Prime Minister Narendra Modi.
In their report, Arsenal said the laptop -- which was the key piece of evidence against the arrested activists -- was infiltrated by malware.
"What we can say confidently is it is very obvious that the goals were surveillance, we would say very aggressive surveillance, and document delivery -- more specifically incriminating document delivery, and the attacker had extensive time and resources. I would say emphasis on time - it's really amazing how much time the attacker spent on Rona Wilson's computer," Mr Spencer told NDTV.
The laptop was initially compromised by the "netwire" remote access trojan on June 13, 2016. A hidden folder where the police said they found the incriminating documents was created November 3, 2016, the Arsenal chief said.
The documents were placed days before Mr Wilson's arrest.
"The final document at least of what we are aware of - the top 10 incriminating documents - was placed into that folder on April 6, 2018. And then the laptop is seized shortly thereafter on April 17," Mr Spencer added.
Asked if it is possible to identify the attacker, Mr Spencer said, "No, we are not going to be involved in the attribution at this point in any way related to the identity of the attacker."
But he was sanguine that the findings of his firm cannot be refuted by the authorities.
"We based our work off of the forensic images that were obtained by the police and they are in the exact same condition as when the police obtained them. So that's a very straightforward thing to deal with," Mr Spencer added.
The police said a letter was addressed to one "Comrade Prakash". It mentioned a plot to assassinate PM Modi in a "Rajiv Gandhi-type incident" during one of his roadshows.
Public prosecutor Ujjwala Pawar read out a part in the court. "We are thinking along the lines of another Rajiv Gandhi-type incident. It sounds suicidal and there is a chance that we might fail but party must deliberate on our proposal...," the prosecutor was quoted as reading out.
The letter also mentioned that Rs 8 crore was needed annually for M4 carbines and 400,000 rounds of ammunition.
In the months after the seizure of the laptop, several others including poet-activist Varavara Rao and tribal rights activist Stan Swamy were arrested. All of them have been in jail since.
The National Investigation Agency (NIA), which is probing the case, refuted the allegations and said based on its investigations and reports of forensic experts, there was nothing to suggest that any evidence was planted and digital devices were compromised.
"The report of 'Arsenal Consulting' is an attempt to tarnish the investigation and the evidence collected therein...It needs no reiteration that India has a highly robust judicial system and the accused persons get best possible opportunity to represent their case. The attempt to discredit the investigation and finding faults with the evidence is another ploy by the defence," said the agency.
"During investigation in addition to the digital evidence, highly incriminating oral and documentary evidence has been collected which has already been submitted along with the chargesheet and a cogent case with the entire evidence against the accused has been submitted before the trial court and the matter is subjudice," it added.