Pegasus in Bhima-Koregaon Case

By a Correspondent

The government’s use of spyware for phone tapping first surfaced in the context of tapping the phones of Elgar Parishad activists.

The case, in which human rights activists have been arrested, pertains to caste violence that took place near the Koregaon-Bhima war memorial in Pune district on January 1, 2018, following alleged provocative speeches at the Elgar Parishad conclave held the previous day.

The National Investigation Agency (NIA) team, led by a Superintendent of Police-rank officer, met senior police officials of Maharashtra Government, including the investiga-tion officer, and handed them a letter, informing that the case has been entrusted to the central agency and they will take over the Bhima Koregaon case..

He said relevant authorities in the state government have been informed about the move.

The NIA team also took a review of the case from officials concerned.

NIA taking over the case comes a day after Maharashtra Home Minister Anil Deshmukh alleged that the Fadnavis dispensation had misused the government machinery to tap the phones of opposition leaders, especially during the formation of the MVA government.

The Maharashtra home minister also said that the Devendra Fadnavis government had sent some officials to Israel to study the snooping software. "There were reports that some officers were sent to Israel to study the snooping software. We are finding out who had gone to Israel and whether there was any official engagement," Deshmukh said.

What is Bhima Koregaon Case?

Violence had broken out near the Koregaon-Bhima war memorial in Pune district on January 1, 2018.

Scheduled Castes visit the memorial in large numbers as it commemorates the victory of British forces, which included SC soldiers over the army of the Brahmin Peshwa rulers of Pune in 1818.

The police had claimed that provocative speeches at Elgar Parishad conclave held in Pune on December 31, 2017, led to the violence and Maoists were behind the conclave.

They later arrested several Left-leaning activists including Telugu poet Varavara Rao and activist Sudha Bharadwaj for alleged links to Maoists.

Leaked data has revealed a surveillance net in the Elgar Parishad case might have crossed a line, a report in The Wire said. The families of activists figure on a leaked list of numbers that included some selected for surveillance by a client of Israel’s NSO Group.

A review of the leaked database shows that at least nine numbers belonged to eight activists, lawyers and academics arrested between June 2018 and October 2020 for their supposed role in the Elgar Parishad case.

Others who are on the list, besides Wilson and Hany Babu, from the Elgar Parishad case include rights activist Vernon Gonsalves; academic and civil liberties activist Anand Teltumbde; retired professor Shoma Sen (her number is first selected in 2017); journalist and rights activist Gautam Navlakha; lawyer Arun Ferreira; and academic and activist Sudha Bharadwaj.

Sixteen activists, lawyers and academics from across India have been arrested in the Bhima Koregaon case since 2018. The France-based media non-profit, Forbidden Stories, and Amnesty International's Security Lab had access to these records, which they shared with The Wire and 15 other news organisations worldwide as part of a collaborative investigation and reporting project.

The leaked records also include the numbers of Telugu poet and writer Varavara Rao's daughter Pavana; lawyer Surendra Gadling's wife Minal Gadling, his associate lawyers Nihalsingh Rathod and Jagadish Meshram, one of his former clients Maruti Kurwatkar, who was charged in multiple cases under the Unlawful Activities (Prevention) Act (UAPA), incarcerated for over 4 years and later released on bail; Bharadwaj's lawyer Shalini Gera; Teltumbde's friend Jaison Cooper, a Kerala-based rights activist; scholar of the Naxalite movement and Bastar-based lawyer Bela Bhatia; one of the oldest members of the Kabir Kala Manch cultural group Rupali Jadhav; and tribal rights activist Mahesh Raut's close associate and lawyer Lalsu Nagoti. The list includes as many as 5 family members of an Elgar Parishad accused. It is unclear if the attacker had managed to gain access to their phones. The addition of numbers began mid-2018 and continued for months.

In its second report, Massa-chusetts—based digital forensics firm Arsenal Consulting found that a malicious software used by an attacker had planted an additional set of files on prison rights’ activist Rona Wilson’s computer. The firm said that there was no evidence that Wilson interacted with these files and documents, which are cited by the National Investigative Agency (NIA) in its charge-sheet against Wilson and others in the Bhima-Koregaon case.

The Washington Post and The Reporter’s Collective were the first to report on the findings of Arsenal Consulting. The second report by the forensics firm was submitted to the special NIA court on March 27, 2021. WaPo published a copy of the report, while the Reporter’s Collective published articles in 11 languages across multiple platforms.

In its first report submitted to the NIA court, Arsenal found that Wilson’s computer was compromised for 22 months prior to his arrest on April 17, 2018. The report said that the attacker had planted 10 incriminating letters based on which the NIA has charged Wilson and 15 other human-rights activists Sudha Bharadwaj, Varavara Rao, Arun Ferreira, Vernon Gonsalves for conspiring against the state. The NIA has charged the activists for also instigating violence three years ago during the Elgar Parishad convention which was celebrating the 200th anniversary of the Battle of Bhima Koregaon.

Arsenal’s first report was reported by the Washington Post, and confirmed an earlier report by The Caravan magazine in March 2019. An investigation by The Caravan found that a malware on Wilson’s computer had delivered the incriminating documents detailing a plot to overthrow the government. In its second report, Arsenal said that Wilson did not interact with additional files cited by the NIA as evidence in the case.

“Arsenal has found no evidence which would suggest that any of the additional files of interest were ever interacted with in any legitimate way on Mr. Wilson’s computer, and can confirm that 22 of the 24 files were delivered to a hidden folder on Mr. Wilson’s computer by NetWire and not by other means”—Arsenal Consulting.

Key evidence against a group of social activists accused of plotting to overthrow the government was planted on a laptop seized by police, a new forensics report concludes, deepening doubts about a case viewed as a test of the rule of law under Prime Minister Narendra Modi.

An attacker used malware to infiltrate a laptop belonging to one of the activists, Rona Wilson, before his arrest and deposited at least 10 incriminating letters on the computer, according to a report from Arsenal Consulting, a Massachusetts-based digital forensics firm that examined an electronic copy of the laptop at the request of Wilson’s lawyers.

Many of the activists have been jailed for more than two years without trial under a stringent anti-terrorism law. Human rights groups and legal experts consider the case an attempt to suppress dissent in India, where government critics have faced intimidation, harassment and arrest during Modi’s tenure.

Arsenal’s report on the Indian case does not identify the perpetrator of the cyberattack. The analysis, which has not been previously reported, was reviewed by The Washington Post. Three outside experts who reviewed the document at The Post’s request said the report’s conclusions were valid.

More than a dozen activists have been targeted in the investigation. They include Wilson, a Delhi-based activist, as well as a labour lawyer, a prominent academic, a poet and a priest. All are advocates for the rights of India’s most underprivileged communities, including tribal peoples and Dalits, formerly known as “untouchables.”

They’re also outspoken opponents of Modi’s government. They have denied the charges, which accuse them of working with a banned militant group—CPI (Maoist) Maoist—to wage an insurgency against the Indian state.

The initial accusations against the activists rested heavily on incriminating letters recovered from electronic devices, particularly from Wilson’s laptop.

The most explosive allegation came from a letter that police said Wilson had written to a Maoist militant in which Wilson discussed the need for guns and ammunition and urged the banned group to assassinate Modi. Arsenal Consulting found that the letter—along with at least nine others—had been planted in a hidden folder on Wilson’s computer by an unidentified attacker who used malware to control and spy on the laptop.

“This is one of the most serious cases involving evidence tampering that Arsenal has ever encountered,” the report said, citing the “vast timespan”—nearly two years— between the time the laptop was first compromised and the moment the attacker delivered the last incriminating document.

Arsenal has so far conducted its work on the report on a pro bono basis, said Mark Spencer, the firm’s president. The company was founded in 2009 and has performed digital forensic analysis in other high-profile cases, including the Boston Marathon bombing.

The case against the rights activists has drawn criticism from rights groups and experts. A spokeswoman for the UN high commissioner for human rights recently urged the Indian authorities to release the detained activists. Earlier UN experts called the accusations a “pretext” aimed at silencing defenders of marginalised groups. The American Bar Association has also expressed concern about the case, and its human rights initiative helped Wilson’s lawyers facilitate the review of the digital evidence.

The case against the activists has its origins in events that unfolded on Jan. 1, 2018, in a village known as Bhima Koregaon in western India. That day marked the 200th anniversary of a colonial-era battle that many Dalits view as a victory over their oppressors in India’s caste system. The annual commemoration turned hostile as Hindu nationalist groups and Dalits clashed. One person was killed.

The early police investigation focused on the Jan. 1 violence but rapidly transformed into a probe of what authorities called “other destructive activities.” The initial charges cited some of the letters that the Arsenal report said were planted. The authenticity of the letters has also been questioned by experts, a 2019 story in the Caravan magazine and a supreme court justice who cast doubt on the impartiality of the probe.

After three years of investigation, the charging documents in the case now run to more than 17,000 pages. They cite both digital evidence and accounts by witnesses, who allege that some of the activists were members of the banned Communist Party of India (Maoist), a group that has fought an armed insurgency against the government for decades. Most of the accounts are not sworn testimony and none have been tested in court, defense lawyers have pointed out.

Meanwhile, judges have rejected bail applications for the activists. Nearly all of the 16 accused have remained imprisoned throughout the pandemic, even as India temporarily released thousands of other prisoners because of worries about rising infections. Several of the activists are senior citizens with serious health ailments.

Back to Home Page

Frontier
Vol. 54, No. 10, Sep 5 - 11, 2021