Skip to main content
Sabrang
Sabrang
Freedom Rule of Law

Another bullet from Arsenal pierces through NIA’s Bhima Koregaon case!

Now evidence emerges of files being planted on Surendra Gadling’s hard drive using same malware as in the case of Rona Wilson

Sabrangindia 07 Jul 2021

NIAImage Courtesy:livelaw.in

American digital forensics firm Arsenal has delivered yet another body blow to the case being built by the National Investigation Agency (NIA) against the activists and human rights defenders accused in the Bhima Koregaon conspiracy case. It has unearthed evidence that 14 key files mentioned in the chargesheet against activist and lawyer Surendra Gadling were planted on his hard drive using Netwire, the very same malware that was used to plant false evidence on a laptop belonging to Rona Wilson, another accused in the case.

SabrangIndia had previously reported Arsenal’s findings in Rona Wilson's case. “Arsenal has connected the same attacker to a significant malware infrastructure which has been deployed over the course of approximately four years to not only attack and compromise Mr. Wilson’s computer for 22 months, but to attack his co-defendants in the Bhima Koregaon case and defendants in other high-profile cases as well,” a report by the Massachusetts-based digital forensics firm had said after they had examined an electronic copy of Wilson’s laptop.

In light of the new developments related to evidence being planted on Surendra Gadling’s hard drive, friends and family of Bhima Koregaon accused have released a statement sharing Arsenal’s findings. “This new report finds the exact same malware infrastructure (customized NetWire Remote Access Trojan) on Gadling’s hard drive, and the identity of the attacker as common to both Wilson and Gadling. These findings point to an organized conspiracy of evidence tampering/planting in the Bhima Koregaon case,” they say.

Further, Arsenal has found this new development to be “one of the most serious cases involving evidence tampering that Arsenal has ever encountered, based on various metrics which include the vast timespan between the delivery of the first and last incriminating documents on multiple defendants’ computers.” 

According to the latest findings in the case, 14 files were allegedly planted on Gadling’s computer between February 29, 2016, when the computer was first infected via an email sent to Gadling and November 2, 2017. That was when the attacker lost access to Gadling’s computer because of a Windows reinstallation. The report also documents extensive surveillance of Mr. Gadling’s computer with over 30,000 files being allegedly copied from his devices to the attacker’s command and control (C2) server. These new findings take the total number of files documented as having been planted on defendants’ hard drives to 48! 

The report documents in detail the full transcript of the attacker’s work across multiple computers on July 22, 2017 when the attacker first moved a set of files from their ‘command and control’ server to Rona Wilson's hard drive, and 15 minutes later using the same malware infrastructure moved another set of files to Gadling’s computer.

Friends and family of the Bhima Koregaon accused have now demanded answers from the Pune Police and the NIA to the following questions:

  • Who planted the files?
  • How did the police or the regional forensic lab locate hidden folders and files planted through the use of malware while at the same time claiming that they did not detect any malware on the said devices?
  • Why are the NIA or police not interested in investigating this planting of evidence?
  • With three reports published that establish without doubt that the incriminating evidence was planted by a hacker, is the case any longer maintainable?

Rona Wilson and Sudha Bharadwaj have already demanded a probe into Arsenal’s findings. Shoma Sen has moved court demanding that UAPA charges against her be dropped in light of Arsenal’s findings. But the NIA has attempted to dismiss Arsenal’s findings. In an affidavit submitted to the Bombay High Court in May, the NIA said, “All the contentions which are raised by the Petitioner are entirely based on the basis of the report of M/s. Arsenal Consultancy. This report does not form part of the Chargesheets which are filed by the Respondent and Pune police. It is settled position of law that, documents which are not relied into the Chargesheet cannot be relied by the Petitioner and as such there is no question of looking into the report of the M/s. Arsenel Consultancy and as such the entire contention of the Petitioner deserve to be rejected as the same are based on the report which does not find place in the present Chargesheet.”

Related:

Bhima Koregaon case: Was evidence planted to implicate activists?
Primary goals were surveillance and incriminating document delivery: Arsenal Report
Rona Wilson moves Bombay HC, demands probe into ‘planted evidence’
Probe claims of Rona Wilson’s laptop being hacked: Sudha Bharadwaj's family and friends
Former Professor Shoma Sen moves Bombay HC against UAPA charges
Bhima Koregaon case: NIA attempts to dismiss Arsenal’s findings about Rona Wilson’s laptop

Another bullet from Arsenal pierces through NIA’s Bhima Koregaon case!

Now evidence emerges of files being planted on Surendra Gadling’s hard drive using same malware as in the case of Rona Wilson

NIAImage Courtesy:livelaw.in

American digital forensics firm Arsenal has delivered yet another body blow to the case being built by the National Investigation Agency (NIA) against the activists and human rights defenders accused in the Bhima Koregaon conspiracy case. It has unearthed evidence that 14 key files mentioned in the chargesheet against activist and lawyer Surendra Gadling were planted on his hard drive using Netwire, the very same malware that was used to plant false evidence on a laptop belonging to Rona Wilson, another accused in the case.

SabrangIndia had previously reported Arsenal’s findings in Rona Wilson's case. “Arsenal has connected the same attacker to a significant malware infrastructure which has been deployed over the course of approximately four years to not only attack and compromise Mr. Wilson’s computer for 22 months, but to attack his co-defendants in the Bhima Koregaon case and defendants in other high-profile cases as well,” a report by the Massachusetts-based digital forensics firm had said after they had examined an electronic copy of Wilson’s laptop.

In light of the new developments related to evidence being planted on Surendra Gadling’s hard drive, friends and family of Bhima Koregaon accused have released a statement sharing Arsenal’s findings. “This new report finds the exact same malware infrastructure (customized NetWire Remote Access Trojan) on Gadling’s hard drive, and the identity of the attacker as common to both Wilson and Gadling. These findings point to an organized conspiracy of evidence tampering/planting in the Bhima Koregaon case,” they say.

Further, Arsenal has found this new development to be “one of the most serious cases involving evidence tampering that Arsenal has ever encountered, based on various metrics which include the vast timespan between the delivery of the first and last incriminating documents on multiple defendants’ computers.” 

According to the latest findings in the case, 14 files were allegedly planted on Gadling’s computer between February 29, 2016, when the computer was first infected via an email sent to Gadling and November 2, 2017. That was when the attacker lost access to Gadling’s computer because of a Windows reinstallation. The report also documents extensive surveillance of Mr. Gadling’s computer with over 30,000 files being allegedly copied from his devices to the attacker’s command and control (C2) server. These new findings take the total number of files documented as having been planted on defendants’ hard drives to 48! 

The report documents in detail the full transcript of the attacker’s work across multiple computers on July 22, 2017 when the attacker first moved a set of files from their ‘command and control’ server to Rona Wilson's hard drive, and 15 minutes later using the same malware infrastructure moved another set of files to Gadling’s computer.

Friends and family of the Bhima Koregaon accused have now demanded answers from the Pune Police and the NIA to the following questions:

  • Who planted the files?
  • How did the police or the regional forensic lab locate hidden folders and files planted through the use of malware while at the same time claiming that they did not detect any malware on the said devices?
  • Why are the NIA or police not interested in investigating this planting of evidence?
  • With three reports published that establish without doubt that the incriminating evidence was planted by a hacker, is the case any longer maintainable?

Rona Wilson and Sudha Bharadwaj have already demanded a probe into Arsenal’s findings. Shoma Sen has moved court demanding that UAPA charges against her be dropped in light of Arsenal’s findings. But the NIA has attempted to dismiss Arsenal’s findings. In an affidavit submitted to the Bombay High Court in May, the NIA said, “All the contentions which are raised by the Petitioner are entirely based on the basis of the report of M/s. Arsenal Consultancy. This report does not form part of the Chargesheets which are filed by the Respondent and Pune police. It is settled position of law that, documents which are not relied into the Chargesheet cannot be relied by the Petitioner and as such there is no question of looking into the report of the M/s. Arsenel Consultancy and as such the entire contention of the Petitioner deserve to be rejected as the same are based on the report which does not find place in the present Chargesheet.”

Related:

Bhima Koregaon case: Was evidence planted to implicate activists?
Primary goals were surveillance and incriminating document delivery: Arsenal Report
Rona Wilson moves Bombay HC, demands probe into ‘planted evidence’
Probe claims of Rona Wilson’s laptop being hacked: Sudha Bharadwaj's family and friends
Former Professor Shoma Sen moves Bombay HC against UAPA charges
Bhima Koregaon case: NIA attempts to dismiss Arsenal’s findings about Rona Wilson’s laptop

Related Articles

Secularism

Gujarat 1992: Hindus who saved a dargah in Surat

‘Ram & Rahim are same’: For over two years, Muslims and local families have started coming to the dargah that has been protected by Hindu families for over 30 years; Hindus also arrange free tea, water, and food for Muslims visiting the dargah

Secularism

Gujarat 1992: Hindus who saved a dargah in Surat

‘Ram & Rahim are same’: For over two years, Muslims and local families have started coming to the dargah that has been protected by Hindu families for over 30 years; Hindus also arrange free tea, water, and food for Muslims visiting the dargah


Sunday

03

Jan

Pan-India

Saturday

05

Dec

05 pm onwards

Rise in Rage!

North Gate, JNU campus

Thursday

26

Nov

10 am onwards

Delhi Chalo

Pan India

Theme

Stop Hate

Hate and Harmony in 2021

A recap of all that transpired across India in terms of hate speech and even outright hate crimes, as well as the persecution of those who dared to speak up against hate. This disturbing harvest of hate should now push us to do more to forge harmony.
Taliban 2021

Taliban in Afghanistan: A look back

Communalism Combat had taken a deep dive into the lives of people of Afghanistan under the Taliban regime. Here we reproduce some of our archives documenting the plight of hapless Afghanis, especially women, who suffered the most under the hardline regime.
2020

Milestones 2020

In the year devastated by the Covid 19 Pandemic, India witnessed apathy against some of its most marginalised people and vilification of dissenters by powerful state and non state actors. As 2020 draws to a close, and hundreds of thousands of Indian farmers continue their protest in the bitter North Indian cold. Read how Indians resisted all attempts to snatch away fundamental and constitutional freedoms.
Migrant Diaries

Migrant Diaries

The 2020 COVID pandemic brought to fore the dismal lives that our migrant workers lead. Read these heartbreaking stories of how they lived before the pandemic, how the lockdown changed their lives and what they’re doing now.

Campaigns

Sunday

03

Jan

Pan-India

Saturday

05

Dec

05 pm onwards

Rise in Rage!

North Gate, JNU campus

Thursday

26

Nov

10 am onwards

Delhi Chalo

Pan India

Videos

Communalism

Bastar violence: Anti-Christian Campaign causes breach in Adivasi unity

Hundreds of Adivasi church-goers across villages in Narayanpur and Bastar, Chhattisgarh have been experiencing boycott, intimidation and violence since December last year, forcing them to leave their homes and live in refugee camps. Reportedly, Adivasi districts across Madhya Pradesh and Chattisgarh is seeing a rise Hindutva mobilisation against Christians .

Communalism

Bastar violence: Anti-Christian Campaign causes breach in Adivasi unity

Hundreds of Adivasi church-goers across villages in Narayanpur and Bastar, Chhattisgarh have been experiencing boycott, intimidation and violence since December last year, forcing them to leave their homes and live in refugee camps. Reportedly, Adivasi districts across Madhya Pradesh and Chattisgarh is seeing a rise Hindutva mobilisation against Christians .

IN FACT

Analysis

Stop Hate

Hate and Harmony in 2021

A recap of all that transpired across India in terms of hate speech and even outright hate crimes, as well as the persecution of those who dared to speak up against hate. This disturbing harvest of hate should now push us to do more to forge harmony.
Taliban 2021

Taliban in Afghanistan: A look back

Communalism Combat had taken a deep dive into the lives of people of Afghanistan under the Taliban regime. Here we reproduce some of our archives documenting the plight of hapless Afghanis, especially women, who suffered the most under the hardline regime.
2020

Milestones 2020

In the year devastated by the Covid 19 Pandemic, India witnessed apathy against some of its most marginalised people and vilification of dissenters by powerful state and non state actors. As 2020 draws to a close, and hundreds of thousands of Indian farmers continue their protest in the bitter North Indian cold. Read how Indians resisted all attempts to snatch away fundamental and constitutional freedoms.
Migrant Diaries

Migrant Diaries

The 2020 COVID pandemic brought to fore the dismal lives that our migrant workers lead. Read these heartbreaking stories of how they lived before the pandemic, how the lockdown changed their lives and what they’re doing now.

Archives