Bhima Koregaon: Forensic Report Says Evidence Was Planted On Stan Swamy's Laptop

Evidence was planted on activist Stan Swamy's computer to implicate him in the Bhima Koregaon case, an investigation by a Massachusetts-based digital forensics firm has found. Swamy, 83, was jailed in 2020 and died in custody on July 5, 2021, after spending around nine months in prison.

The report by the digital forensics firm Arsenal Consulting, which was hired by Swamy's lawyers, said that the malware attack on his laptop began on October 19, 2014 and continued till June 12, 2019, when his laptop was seized by Pune Police in a raid. "Arsenal's analysis in this case has revealed that Stanislaus Lourduswamy's computer was compromised by the same attacker identified in Reports I, Il, and III over the course of three distinct campaigns, beginning on October 19, 2014 and ending upon the seizure of his computer by Pune police department on June 12, 2019," the report said.

This investigation was first reported by the Washington Post.

Here is all you need to know about the latest investigation:

What does the probe say?

The report said that the hacker's primary goals were "surveillance and incriminating document delivery." The hacker gained full access to Swamy's computer and dropped several files into a hidden folder, according to the report. These files included alleged letters between the activists and the Maoist group and have been shown as evidence against the activists, including Swamy, in the Bhima Koregaon case.

"Arsenal has effectively caught the attacker red-handed (yet again), based on remnants of their activity left behind in file system transactions, application execution data, and otherwise," the report said.

Arsenal Consulting did a similar investigation last year, published as Reports I, Il, and III, which concluded that evidence was planted on activists Rona Wilson and Surendra Gadling's laptops in Bhima Koregaon case.

According to a report published in Washington Post in 2021, the devices of at least two defendants in Bhima Koregaon case had been attacked with dozens of "incriminating documents". This malware campaign targeted individuals beyond those facing charges in the case, the report said.

The hackers used malware called NetWire to attack, according to Arsenal Consulting. NetWire, according to the report, is a popular multi-platform remote access trojan (RAT) and is available for purchase online.

Why was Swamy arrested?

Swamy, including 15 other activists, was accused of instigating violence at the January 1, 2018 event to commemorate the Battle of Bhima Koregaon. The activists were accused of plotting with Maoists to assassinate Prime Minister Narendra Modi.

Swamy was a Jharkhand-based Catholic priest and worked with the tribal communities. In 2020, he was arrested by the National Investigation Agency (NIA) and charged for terrorism under the Unlawful Activities (Prevention) Act (UAPA) in connection with the Bhima Koregaon case. His health started deteriorating as he suffered several age-related conditions like Parkinson's syndrome and hearing loss. After the court's directions, he was admitted to Mumbai's Holy Family hospital where he tested positive for Covid-19.

He died on July 5, 2021, a day after being put on a ventilator.

In a report published last month, the United States Commission on International Religious Freedom (USCIRF) termed charges filed against Swamy as "dubious".
After his death in July 2021, the United Nations said that Swamy was jailed on "false charges of terrorism". Mary Lawlor, UN Special Rapporteur on Human Rights Defenders then said that the news of his death was "devastating" and that jailing human rights defenders is inexcusable.