Family members of Bhima Koregaon accused, cyber experts raise questions on investigation following reports of ‘planted evidence’

Image Courtesy: The Leaflet

Besides demanding the release of all the accused, the speakers pointed out that the Arsenal report has raised some serious questions such as, “Why couldn’t the government and the forensic lab find evidence of hacking and if they did, why did they ignore it? Why did NIA not verify the authenticity of the files as they were the primary evidence in the case?” 

Suprakash Majumdar,

Support TwoCircles

New Delhi: During a press conference by Mumbai Rises to Save Democracy (MRSD), the family members of the Bhima Koregaon accused, activists and digital security experts raised questions on ‘the intention of the government and the National Investigation Agency (NIA)’ following a report by the United States-based digital forensic firm Arsenal Consulting alleging that evidence was planted in one of the accused’s computer.

The report by Arsenal Consulting posed questions on the evidence against Bhima Koregaon accused Rona Wilson.

The report by Arsenal Consulting said that the letters found in Wilson’s computer, which are the key evidence against the accused, were planted months before his arrest and his computer was controlled remotely at least 22 times. Till now, sixteen people have been arrested for allegedly plotting to assassinate Prime Minister Narendra Modi in the Bhima Koregaon case.

Advocate Mihir Desai said that the letters found in Wilson’s computer were the only and the primary evidence presented by the agency in the case. “Did our forensics department ever try to find out malware or viruses?” he asked in the press conference.

“I don’t know if they found the malware and did not tell or there was a lack of communication between our agencies,” he added.

Dr Jedidiah Crandall who is an assistant professor in computer security and privacy at Arizona State University was a speaker at the press conference. He explained various technical details of the report. According to him, the country’s highest cybersecurity agency took a bare minimum effort in investigating the evidence.

He explained that five of the NetWire malware can be detected by ordinary antivirus scan and saying that the agencies did not find any malware with their sophisticated technology, which is highly unlikely. “For the administration that admits to not even finding the instances of malware that are detectable by an ordinary virus scan software, leave alone the more sophisticated and custom installations of NetWire, to call the forensic report a distortion is unfortunate,” he said.

Crandall emphasized that the methods used by the attacker are known tactics and cybersecurity experts are used to identify such attacks.

Professor Sandeep Shukla of IIT Kanpur and a cybersecurity expert further explained the details of the Arsenal report. He said nothing was surprising and these kinds of phishing scams happen every day.

He said that multiple documents were planted in Wilson’s computer from September 2016, the majority of which were planted from January 6, 2018, till March 2018. The files were planted in the hidden directory of the computer which was later moved to other visible directories on March 14, 2018.

“All of these documents which were planted in the computer were created in Microsoft Office 2010 or 2013 but the victim’s computer had Microsoft office 2007, which is technically impossible to create,” he further said. “Unless these files were created in any other computer these files cannot be created in Wilson’s computer,” he added.

“A computer can be hacked to insert documents was beyond the imagination for the people in their 60s and 70s,” said Father Soloman, a relative of Stan Swamy (83), a tribal activist and an accused in the Bhima Koregaon case.

“When I told him that a computer was compromised, he was baffled initially. He did not believe, but gradually Stan began grasping the terrifying intricacies of hacking and inserting the documents,” Soloman said.

He said that Stan was interrogated for 15 hours from July 27, 2020, to August 6, 2020, but Stan denied the existence of a particular document which was allegedly found in his computer and he insisted that the document was actually inserted from an external source.

Sagar Gonsalves, son of Vernon Gonsalves, another accused in the Bhima Koregaon case expressed his disappointment on the lack of coverage of the Arsenal report in the media. “Personally, I feel that this story hasn’t got the coverage it required, especially from the TV news wherein the beginning of the case we saw them baying for blood and calling the accused Urban Naxals, Maoists and all sorts of names,” he said.

He demanded the immediate release of all the accused in the case, as the primary evidence is in question now. He also demanded an additional enquiry on how the authorities and the national agencies have neglected key discrepancies in the evidence provided.

Sagar raised questions on various rules in the Evidence Act that were neglected. He said that all of the electronics present in the house were confiscated including spare phones, CDs, laptops etc and when his father asked for a clone of the evidence, it was denied by the agencies.

“We had doubts and questioned the evidence from the beginning” he added.

Rama Ambedkar, the granddaughter of Baba Saheb Ambedkar, who was supposed to speak in the press conference but couldn’t join the conference, demanded the immediate release of all the accused and further asked for an independent investigation following the Arsenal report in a note she sent.

“This has gone on for too long. Arsenal has done the work that the responsible government agency should have done. We must immediately put this evidence at the centre of the case and not only release all accused on bail but also institute a Special Investigation Team charged with the task of getting to the bottom of how such a conspiracy was created,” she said in the note she sent.

When asked whether the accused in the case have been subjected to this treatment because of them being Dalit/Adivasis or working on Dalit/Adivasi issues, Father Soloman said this can be viewed from various viewpoints. “This could be true as well, as Stan Swamy and other accused have always raised questions on the issues of Dalits and Adivasis from land rights to basic human rights and have questioned the current economic policies of the current government and its impact on them,” he said.

The speakers pointed out that the Arsenal report has raised some serious questions such as, “Why couldn’t the government and the forensic lab find evidence of hacking and if they did, why did they ignore it? Why did NIA not verify the authenticity of the files as they were the primary evidence in the case?”