In a shocking development, a US digital forensics firm has said that the laptop belonging to Bhima Koregaon violence accused Rona Wilson was compromised for over 22 months. Following this revelation, Wilson moved the Bombay High Court seeking the quashing of criminal proceedings against him.
US-based Washington Post first reported the findings of the Massachusetts-based digital forensics firm – Arsenal Consulting. In a report, Arsenal Consulting said that hackers “planted” 10 incriminating letters in Wilson’s laptop using malware or malicious software.
Wilson’s lawyer Sudeep Pasbola attached Arsenal’s digital forensic report and filed a petition in the Bombay HC seeking quashing of the case against Wilson in 2018 Bhima Koregaon violence. In the petition, Wilson’s lawyers have sought the formation of a special investigation team to analyse the electronic evidence. The petition also states that Wilson is seeking compensation for wrongful detention. Some reports suggest that Wilson’s lawyers have retained Arsenal to analyze all electronic evidence seized by the Pune Police from his house during his arrest.
In its report, Arsenal said that it received a hard drive on July 31, 2020. The hard drive contained forensic images and police work product related to Wilson and other defendants in the Bhima Koregaon case. The reports added that the firm’s analysis is largely based on a forensic image obtained from the hard drive within Wilson's computer and a thumb drive which was also attached to the computer.
Not only did Arsenal Consulting reportedly find that the evidence was “planted” on Wilson’s laptop, but also found that the laptop was compromised for over 22 months. In fact, Wilson was not the only victim. According to the report, a series of suspicious emails were sent from the account of Varavara Rao, who is co-accused in the case. The firm said that someone used Rao’s account to send a phishing mail to Wilson.
Arsenal added that a NetWire Remote Access Trojan (RAT) was installed on Wilson’s laptop after he clicked on what he thought was a mere Dropbox link. This allowed the attacker to conduct surveillance for over 22 months and ‘plant’ the evidence on Wilson’s laptop. According to the firm, Wilson’s laptop was compromised between June 13, 2016, and April 17, 2018. Wilson was arrested in June 2018. The report further added that there is no evidence that the document (“planted” evidence) or the hidden folder containing the documents, were ever opened.
According to reports, officials probing are claiming that Arsenal’s findings reports are an attempt to ruin the investigation. Also, the National Investigation Agency (NIA) has said that the digital extracts were examined at the Regional Forensic Science Laboratory in Pune and no evidence of any malware was found, thus, denying the claims made by Arsenal. The Pune Police and the NIA used the letters as evidence to file the chargesheet. The above mentioned digital extracts were submitted in court along with the chargesheet.
Meanwhile, reportedly, the Left parties in India are demanding the release of those arrested in the Bhima Koregaon case, stating that the evidence against them was “planted”.
“The politburo of the CPI(M) demands the dropping of cases against activists arrested in the Bhima Koregaon case and asks the Maharashtra government to set up a Special Investigation Team to enquire into the developments exposed by the credible reports of international experts as to how evidence was manufactured and planted in the computer of one of the activists Rona Wilson,” the party said in a statement.
THE BHIMA KOREGAON CASE
On January 1, 2018, violence broke out in Bhima Koregaon village in Pune which left one dead and several injured including 10 police officers. Violence erupted after some people, reportedly with saffron flags, pelted stones at cars heading for the commemoration of the 200 years of Bhima-Koregaon war on January 1. Wilson was taken into custody in June 2018 under the Unlawful Activities (Prevention) Act. In August of the same year, several activists – Varavara Rao, Arun Ferreira, Sudha Bharadwaj and Gautam Navlakha – were also arrested in connection to the violence.
In 2020, the NIA took over the case from the Maharashtra Vikas Aghadi (MVA) government. Maharashtra Home Minister Anil Deshmukh accused the Centre of handing over the case to the NIA without taking the state government’s consent. In its chargesheet, the NIA named Jesuit priest and activist Stan Swamy as an accused.
