Indian activist’s computer hacked to insert incriminating letters on Modi murder plot

Indian activist’s computer hacked to insert incriminating letters on Modi murder plot
Indian writer-activist Rona Wilson. (Photo Courtesy Facebook/Rona Wilson)

Indian activist’s computer hacked to insert incriminating letters on Modi murder plotISLAMABAD, Feb 12 (APP): Stooping to a new low, the Narendra Modi’s government falsely incriminated a writer-activist Rona Jacob Wilson and others for Modi’s assassination plot, by hacking his computer and inserting fake documents.

Arrested in June 2018, in Bhima-Koregaon case, Rona Wilson and others have been charged of plotting to assassinate Modi.

Initially, the case involved violence at Koregaon Bhima on the outskirts of Pune, where members of the Dalit community had gathered on December 31, to celebrate what they called a historic victory over Maratha Peshwas.

Later, the police said they have found letters from a suspected Maoist in Rona Wilson’s laptop, which revealed a plot to assassinate Prime Minister Narendra Modi.

Published by the US daily Washington Post, a report of the Arsenal Consulting, a Massachusetts-based digital forensics firm, revealed that Rona Wilson’s computer was hacked two years before his arrest, and the purpose was “aggressive surveillance” and inserting fake documents.

The firm was asked by Wilson’s lawyers to examine an electronic copy of the hard disc of his laptop which was being used as key evidence against him.

Indian activist’s computer hacked to insert incriminating letters on Modi murder plot
Screenshot of a suspicious email that Nihalsing Rathod received.

According to the daily, the report had deepened the “doubts about a case viewed as a test of the rule of law under Prime Minister Narendra Modi.”

It said an attacker used malware to infiltrate a laptop belonging to Rona Wilson deposited at least 10 incriminating letters on the computer.

Human rights groups and legal experts consider the case an attempt to suppress dissent in India, where government critics have faced intimidation, harassment and arrest during Modi’s tenure.

Arsenal’s report was also reviewed by three outside experts who reviewed the document said the report’s conclusions were valid.

Sudeep Pasbola, a lawyer representing Wilson, said the Arsenal report proved his client’s innocence and “destabilizes” the prosecution case against the activists.

Wilson’s lawyers included the report in a petition filed in the High Court of Bombay urging judges to dismiss the case against their client.


Jaya Roy, a spokeswoman for the National Investigation Agency, the anti-terrorism authority overseeing the cases against the activists, said that the forensic analysis of Wilson’s laptop conducted by law enforcement did not show any evidence of malware on the device. She added that there was “substantial documentary and oral evidence” against the individuals charged in the case.

Indian activist’s computer hacked to insert incriminating letters on Modi murder plot
Those arrested along with Rona Wilson (extreme right) in the Bhima Koregaon case: Sudhir Dhawale, Surendra Gadling, Shoma Sen, Mahesh Raut. Photo courtesy The Wire

More than a dozen activists have been targeted in the investigation. All are advocates for the rights of India’s most underprivileged communities, including tribal peoples and Dalits, formerly known as “untouchables.” They’re also outspoken opponents of Modi’s government.


They have denied the charges, which accuse them of working with a banned Maoist militant group to wage an insurgency against the Indian state.

The most explosive allegation came from a letter that police said Wilson had written to a Maoist militant in which Wilson discussed the need for guns and ammunition and urged the banned group to assassinate Modi.

Arsenal Consulting found that the letter — along with at least nine others — had been planted in a hidden folder on Wilson’s computer by an unidentified attacker who used malware to control and spy on the laptop.

“This is one of the most serious cases involving evidence tampering that Arsenal has ever encountered,” the report said, citing the “vast timespan” — nearly two years — between the time the laptop was first compromised and the moment the attacker delivered the last incriminating document.

The case against the Indian activists has drawn criticism from rights groups and experts.

A spokeswoman for the U.N. high commissioner for human rights recently urged the Indian authorities to release the detained activists. Earlier U.N. experts called the accusations a “pretext” aimed at silencing defenders of marginalized groups.

The American Bar Association has also expressed concern about the case, and its human rights initiative helped Wilson’s lawyers facilitate the review of the digital evidence.

Arsenal’s report gives a detailed account of the cyberattack. One afternoon in June 2016, it said, Wilson received several emails that appeared to be from a fellow activist he knew well. The friend urged him to click on a link to download an innocuous statement from a civil liberties group.

Instead, the report says, the link deployed NetWire, a commercially available form of malicious software that allowed a hacker to access Wilson’s device.

Arsenal discovered records of the malware logging Wilson’s keystrokes, passwords and browsing activity. It also recovered file system information showing the attacker creating the hidden folder to which at least 10 incriminating letters were delivered — and then attempting to conceal those steps. The letters were created using a newer version of Microsoft Word that did not exist on Wilson’s computer, the report said.

Arsenal found no evidence that the documents or the hidden folder were ever opened.

Spencer, Arsenal’s president, called the attack “very organized” and “extremely dark” in intent.

Arsenal has spent more than 300 hours analyzing the laptop’s contents, he said.

Spencer said the company has only rarely seen malware used for evidence tampering and that Wilson’s case was “unique and deeply disturbing.”

Arsenal produced a “serious and credible” analysis documenting how the laptop was infected with malware, said John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto. It raises “urgent questions about the reliability of evidence from that computer in a prosecution.”

The report does not identify the person or institution behind the malware attack on Wilson’s laptop. But it notes that Wilson was not the attacker’s only victim. The same attacker deployed some of the same servers and IP addresses to target Wilson’s co-defendants in the case over a period of four years, the report said, based on a review of forensic images related to those individuals.

Last year, Amnesty International revealed that nine people seeking to help the activists accused in the case were also targeted with emails containing malicious links that deployed NetWire.

Indian activist’s computer hacked to insert incriminating letters on Modi murder plot

The fact that the same domain names and IP addresses appear both in the Arsenal and Amnesty reports is “not a coincidence,” said Adam Meyers, senior vice president of intelligence at the cybersecurity firm CrowdStrike, one of the experts who reviewed the report at The Post’s request.

Lawyers for other defendants in the case have asked law enforcement authorities to provide digital images of the electronic devices seized from their clients — including phones and laptops — for possible analysis. To date, copies of digital devices belonging to at least two of the activists have been shared, defense lawyers said.

After three years of investigation, the charging documents in the case now run to more than 17,000 pages. They cite both digital evidence and accounts by witnesses, who allege that some of the activists were members of the banned Communist Party of India (Maoist), a group that has fought an armed insurgency against the government for decades.

Nearly all of the 16 accused have remained imprisoned throughout the pandemic, even as India temporarily released thousands of other prisoners because of worries about rising infections. Several of the activists are senior citizens with serious health ailments, their friends and family say; one, a Jesuit priest named Stan Swamy, 83, suffers from Parkinson’s disease.

Poet Varavara Rao, 80, is another of the imprisoned activists. His health has deteriorated in jail and he became incoherent last summer, his family said. He also contracted the coronavirus and repeatedly had to be transferred to the hospital.
Sudha Bharadwaj, a labor lawyer and activist who gave up her American citizenship after returning to India to work for the rights of tribal communities, has spent more than two years behind bars.

                                                                           APP Digital Report By Ishtiaq Ahmed

By Ishtiaq Rao

Ishtiaq Ahmed is a Sr. Reporter who reports on Prime Minister, President, Foreign Office, and special assignments. Backed by 20-year experience, he has written for local and foreign newspapers. Reach out at 03335293238/ [email protected]/ X: ishtiaqrao

Serving the nation since 1947 by providing an accurate, objective, uninterrupted flow of news to the people, the national news service is pursuing a comprehensive strategy to transform the existing news operations into a forward-looking service – APP Digital for its diverse subscriber-base and the public.

Follow Us

APP Services