Skip to main content
Sabrang
Sabrang
India World

Bhima Koregaon case: Was evidence planted to implicate activists?

US-based digital forensics firm finds malware was used to plant incriminating letters!

Sabrangindia 10 Feb 2021

bhima koregaon

Arsenal Consulting, a Massachusetts-based digital forensics firm has analysed an electronic copy of activist Rona Wilson’s laptop and arrived at the conclusion that an attacker used malware to infiltrate the laptop and place incriminating evidence on it, reported The Washington Post.

Rona Wilson is the public relations secretary for the Committee for Release of Political Prisoners. He was at the forefront of the struggle to release SAR Geelani in the 2001 Parliament attack case. Pune Police had raided his home in April 2018, and he was arrested on June 6, 2018.

He had been accused of being part of a conspiracy to assassinate Prime Minister Narendra Modi. Wilson was accused of channeling funds towards Maoist groups for this purpose. He was charged under the Unlawful Activities (Prevention) Act (UAPA) and the charges were based on a letter he allegedly wrote to a Maoist leader discussing the need for guns and ammunition, urging the group to assassinate the Prime Minister.

The Washington Post report says, “Arsenal’s report on the Indian case does not identify the perpetrator of the cyberattack. The analysis, which has not been previously reported, was reviewed by The Washington Post. Three outside experts who reviewed the document at The Post’s request said the report’s conclusions were valid,” adding, “Arsenal Consulting found that the letter — along with at least nine others — had been planted in a hidden folder on Wilson’s computer by an unidentified attacker who used malware to control and spy on the laptop.”

The Arsenal report finds that evidence tampering took place over a “vast timespan” as the period between the time the laptop was first compromised and the time when the last piece of incriminating evidence was placed on it was two years! This startling revelation suggests a vast conspiracy against Rona Wilson and perhaps even others.

Arsenal’s report gives details of the chillingly detailed and systematic manner in which the evidence was planted on Wilson’s laptop. According to the Washington Post, “Arsenal’s report gives a detailed account of the cyberattack. One afternoon in June 2016, it said, Wilson received several emails that appeared to be from a fellow activist he knew well. The friend urged him to click on a link to download an innocuous statement from a civil liberties group. Instead, the report says, the link deployed NetWire, a commercially available form of malicious software that allowed a hacker to access Wilson’s device.”

The Washington Post report further says, “Arsenal discovered records of the malware logging Wilson’s keystrokes, passwords and browsing activity. It also recovered file system information showing the attacker creating the hidden folder to which at least 10 incriminating letters were delivered — and then attempting to conceal those steps. The letters were created using a newer version of Microsoft Word that did not exist on Wilson’s computer, the report said. Arsenal found no evidence that the documents or the hidden folder were ever opened.”

The recent revelations are even more significant in light of similar revelations by Amnesty last year that nine people seeking to help the activists accused in the Bhima Koregaon case were also targeted with emails containing malicious links that deployed the NetWire malware.

At present the chargesheet in the case runs into thousands of pages, while the 16 accused have been suffering in custody, being denied bail repeatedly, most notably the sick and the elderly among them such as poet Dr. Varavara Rao and Jesuit Priest and Adivasi rights activist Fr. Stan Swamy. 

Related:

Rona Wilson worked for release of political prisoners, now a prisoner himself

Still no respite for Varavara Rao, Bombay HC reserves order

Fr. Stan Swamy SJ already ‘One Hundred Days in Prison’

The many plots to assassinate Narendra Modi

Bhima Koregaon case: Was evidence planted to implicate activists?

US-based digital forensics firm finds malware was used to plant incriminating letters!

bhima koregaon

Arsenal Consulting, a Massachusetts-based digital forensics firm has analysed an electronic copy of activist Rona Wilson’s laptop and arrived at the conclusion that an attacker used malware to infiltrate the laptop and place incriminating evidence on it, reported The Washington Post.

Rona Wilson is the public relations secretary for the Committee for Release of Political Prisoners. He was at the forefront of the struggle to release SAR Geelani in the 2001 Parliament attack case. Pune Police had raided his home in April 2018, and he was arrested on June 6, 2018.

He had been accused of being part of a conspiracy to assassinate Prime Minister Narendra Modi. Wilson was accused of channeling funds towards Maoist groups for this purpose. He was charged under the Unlawful Activities (Prevention) Act (UAPA) and the charges were based on a letter he allegedly wrote to a Maoist leader discussing the need for guns and ammunition, urging the group to assassinate the Prime Minister.

The Washington Post report says, “Arsenal’s report on the Indian case does not identify the perpetrator of the cyberattack. The analysis, which has not been previously reported, was reviewed by The Washington Post. Three outside experts who reviewed the document at The Post’s request said the report’s conclusions were valid,” adding, “Arsenal Consulting found that the letter — along with at least nine others — had been planted in a hidden folder on Wilson’s computer by an unidentified attacker who used malware to control and spy on the laptop.”

The Arsenal report finds that evidence tampering took place over a “vast timespan” as the period between the time the laptop was first compromised and the time when the last piece of incriminating evidence was placed on it was two years! This startling revelation suggests a vast conspiracy against Rona Wilson and perhaps even others.

Arsenal’s report gives details of the chillingly detailed and systematic manner in which the evidence was planted on Wilson’s laptop. According to the Washington Post, “Arsenal’s report gives a detailed account of the cyberattack. One afternoon in June 2016, it said, Wilson received several emails that appeared to be from a fellow activist he knew well. The friend urged him to click on a link to download an innocuous statement from a civil liberties group. Instead, the report says, the link deployed NetWire, a commercially available form of malicious software that allowed a hacker to access Wilson’s device.”

The Washington Post report further says, “Arsenal discovered records of the malware logging Wilson’s keystrokes, passwords and browsing activity. It also recovered file system information showing the attacker creating the hidden folder to which at least 10 incriminating letters were delivered — and then attempting to conceal those steps. The letters were created using a newer version of Microsoft Word that did not exist on Wilson’s computer, the report said. Arsenal found no evidence that the documents or the hidden folder were ever opened.”

The recent revelations are even more significant in light of similar revelations by Amnesty last year that nine people seeking to help the activists accused in the Bhima Koregaon case were also targeted with emails containing malicious links that deployed the NetWire malware.

At present the chargesheet in the case runs into thousands of pages, while the 16 accused have been suffering in custody, being denied bail repeatedly, most notably the sick and the elderly among them such as poet Dr. Varavara Rao and Jesuit Priest and Adivasi rights activist Fr. Stan Swamy. 

Related:

Rona Wilson worked for release of political prisoners, now a prisoner himself

Still no respite for Varavara Rao, Bombay HC reserves order

Fr. Stan Swamy SJ already ‘One Hundred Days in Prison’

The many plots to assassinate Narendra Modi

Related Articles

Communalism

Bilkis Bano gang rape convict shares stage with BJP MP, MLA: Gujarat

On the day before the Supreme Court of India is set to hear a batch of petitions challenging the premature release of all 11 convicts by the Gujarat government on March 27, an elected representative of the ruling Bharatiya Janata Party (BJP) shares a stage with gang rape convict

Communalism

Bilkis Bano gang rape convict shares stage with BJP MP, MLA: Gujarat

On the day before the Supreme Court of India is set to hear a batch of petitions challenging the premature release of all 11 convicts by the Gujarat government on March 27, an elected representative of the ruling Bharatiya Janata Party (BJP) shares a stage with gang rape convict


Sunday

03

Jan

Pan-India

Saturday

05

Dec

05 pm onwards

Rise in Rage!

North Gate, JNU campus

Thursday

26

Nov

10 am onwards

Delhi Chalo

Pan India

Theme

Stop Hate

Hate and Harmony in 2021

A recap of all that transpired across India in terms of hate speech and even outright hate crimes, as well as the persecution of those who dared to speak up against hate. This disturbing harvest of hate should now push us to do more to forge harmony.
Taliban 2021

Taliban in Afghanistan: A look back

Communalism Combat had taken a deep dive into the lives of people of Afghanistan under the Taliban regime. Here we reproduce some of our archives documenting the plight of hapless Afghanis, especially women, who suffered the most under the hardline regime.
2020

Milestones 2020

In the year devastated by the Covid 19 Pandemic, India witnessed apathy against some of its most marginalised people and vilification of dissenters by powerful state and non state actors. As 2020 draws to a close, and hundreds of thousands of Indian farmers continue their protest in the bitter North Indian cold. Read how Indians resisted all attempts to snatch away fundamental and constitutional freedoms.
Migrant Diaries

Migrant Diaries

The 2020 COVID pandemic brought to fore the dismal lives that our migrant workers lead. Read these heartbreaking stories of how they lived before the pandemic, how the lockdown changed their lives and what they’re doing now.

Campaigns

Sunday

03

Jan

Pan-India

Saturday

05

Dec

05 pm onwards

Rise in Rage!

North Gate, JNU campus

Thursday

26

Nov

10 am onwards

Delhi Chalo

Pan India

Videos

Communalism

Bastar violence: Anti-Christian Campaign causes breach in Adivasi unity

Hundreds of Adivasi church-goers across villages in Narayanpur and Bastar, Chhattisgarh have been experiencing boycott, intimidation and violence since December last year, forcing them to leave their homes and live in refugee camps. Reportedly, Adivasi districts across Madhya Pradesh and Chattisgarh is seeing a rise Hindutva mobilisation against Christians .

Communalism

Bastar violence: Anti-Christian Campaign causes breach in Adivasi unity

Hundreds of Adivasi church-goers across villages in Narayanpur and Bastar, Chhattisgarh have been experiencing boycott, intimidation and violence since December last year, forcing them to leave their homes and live in refugee camps. Reportedly, Adivasi districts across Madhya Pradesh and Chattisgarh is seeing a rise Hindutva mobilisation against Christians .

IN FACT

Analysis

Stop Hate

Hate and Harmony in 2021

A recap of all that transpired across India in terms of hate speech and even outright hate crimes, as well as the persecution of those who dared to speak up against hate. This disturbing harvest of hate should now push us to do more to forge harmony.
Taliban 2021

Taliban in Afghanistan: A look back

Communalism Combat had taken a deep dive into the lives of people of Afghanistan under the Taliban regime. Here we reproduce some of our archives documenting the plight of hapless Afghanis, especially women, who suffered the most under the hardline regime.
2020

Milestones 2020

In the year devastated by the Covid 19 Pandemic, India witnessed apathy against some of its most marginalised people and vilification of dissenters by powerful state and non state actors. As 2020 draws to a close, and hundreds of thousands of Indian farmers continue their protest in the bitter North Indian cold. Read how Indians resisted all attempts to snatch away fundamental and constitutional freedoms.
Migrant Diaries

Migrant Diaries

The 2020 COVID pandemic brought to fore the dismal lives that our migrant workers lead. Read these heartbreaking stories of how they lived before the pandemic, how the lockdown changed their lives and what they’re doing now.

Archives