Cover Story

The Chilling Side of BHIMA KOREGAON CASE

The 83-year old Jesuit priest Stanislaus Lourduswamy or Stan Swamy, who was suffering from Parkinson’s disease and other age-related conditions, died in prison on July 5, 2021, having been denied bail because the special NIA Court found that the evidence presented prima facie showed that Stan Swamy and others “hatched a serious conspiracy to create unrest in the entire country and to overpower the Government, politically and by using muscle power”, and that he was a member of the banned organisation CPI (Maoist) and was involved in activities furthering “the objective of the organisation which is nothing but to overthrow the democracy of the nation.”

Arrested on October 9, 2020, by the National Investigation Agency (NIA) under the Unlawful Activities (Prevention) Act, 1967, for allegedly being a Maoist “sympathizer”, Stan Swamy was so severely ill that he could not lift a glass and had to approach the court through his lawyers and wait for nearly a month to get a straw and a sipper cup. His health kept deteriorating in prison but the NIA doggedly resisted his bail applications citing a mountain of damning evidence against the priest, most of which was from the documents and files found on his own computer, and based on which the Special Court concluded that “the collective interest of the community” outweighed “the right of personal liberty of the applicant and as such the old age and or alleged sickness of the applicant would not go in his favour, so that the discretion to release the applicant can be exercised in his favour.”

The NIA court cannot be faulted because the court was basing its conclusions on the chargesheet filed by the NIA, which says that Swamy was in constant communication with Maoist-CPI and was involved in plotting and orchestrating an armed uprising against what Swamy allegedly called the “fascist government” at the Center in his alleged letters. The plan, according to the chargesheet, was to “bring together most Dalit and Mulsim forces that are already taking shape in some parts of [the] country” and engage in an armed revolt against the government.

The Chargesheet

The chargesheet claims Swamy received money from the CPI (M) to promote Maoist activities, and the claim was supported by the documents recovered from the possession of Swamy, most of which were purported communications between Swamy and others relating to furthering, streamlining and better organizing the activities of Maoist groups with handbooks and guides to smuggle things and encrypt data for safer communications and so on.

The chargesheet further says that the documents recovered from Surendra Gadling on April 17, 2018 include letters from Sudha (Sudha Bhardwaj) to Prakash discussing Swamy’s role, and in one of the letters Swamy talks about secure communication. “The most urgent one is leakage of several secret letters including those meant only for senior leaders both outside and inside. It is unclear how so. Many of them were exposed from Delhi,” Swamy allegedly wrote, raising the possibility of the deleted letters’ having been recovered forensically using “specialised softwares”, and then there is the talk of how to get better at hiding digital footprints.

The chargesheet also mentions Swamy’s worries about the arrests of certain important “urban naxals”, and how the arrests in Maharashtra had weakened the “legal defence group because some of these comrades were coordinating defense of political prisoners on all India level.”

There is also a letter addressed to Sunil from Sridhar written in Telugu in July 2017 in which there is talk of a programme called “Brahmanical Hindu Anti Fascist Front” to further the CPI-Maoist agenda, which led to the formation of Bhima Koregaon Shaurya Din Prerana Abhiyan, and which, in turn, brought about the Elgar Parishad conference on December 12, 2017 in Pune, which, according to the chargesheet, was responsible for the violence at Bhima Koregaon on January 1, 2018. The letters also discuss not using “anti-fascist front” in the name to avoid creating a negative impression in public.

Long story short, the letters allegedly found on the computers of Swamy and other activists, including  Surendra Gadling (a lawyer) and Rona Wilson (a social worker), neatly lay down the internal workings of this urban naxal ecosystem. The letters also voice the concerns regarding the forensic discovery of internal communications, thereby conferring credibility on the process by which those credibility-conferring letters were purportedly discovered.

So all this evidence, clear and screaming, was just sitting there to be found by the NIA, like a fully baked cake. No missing links, no assumptions, no circumstantial inferences; all there in black and white — the proverbial smoking gun. It did appear too neat and well-defined to be real, but there was no concrete reason to doubt its genuineness, and with that kind of evidence, no court was going to grant bail to someone charged under the UAPA with several crimes punishable with life imprisonment.

However, a lot in this well-rounded, gift-wrapped package of evidence raises suspicion. How is it that in a radical departure from their time-honoured ways, the “Maoists” are using real names in written communications instead of code names? Why are so many unnecessary details there in these letters? And why are the letters talking so explicitly about things such as the plot to assassinate Prime Minister Narendra Modi in a “Rajiv Gandhi-type incident” and “overthrow the government” without bothering to give a codename even to such a high profile target? And this was when they were supposedly worried about their communication being compromised. Why the letters were so neatly arranged and stored in “.docx” and “.pdf” files? And why do these letters paint a picture that so closely conforms to the narrative of an elaborate “anti-national conspiracy” with intellectuals, lawyers, activists and opposition parties doing their part to bring down the great nation? Maybe because there is indeed such a deep-rooted, elaborate conspiracy in the works; or maybe, just maybe, the picture is made to order to serve purposes other than bringing the offenders to justice.

Evidence Tampering

On March 12, 2020, The Carvan published a report, according to which a cyber-forensic examination carried out by The Carvan of Rona Wilson’s computer hard disk revealed that it had an executable file infected with Win32:Trojan-Gen, a malaware that could be used to steal information from as well as plant files remotely on the computer. Also, the ShellBag information, which could reveal when Wilson accessed the folder with the incriminating files was found deleted along with the log of all Run commands, which could help in tracking the computer usage and whether the malicious programs were run on it. The Run log is found in the Registry of the computer and requires significant software skills to be deleted without compromising the system. Since the incriminating information was still on the computer, it made no sense for Wilson to delete the files that could potentially prove his innocence while retaining the incriminating ones.

Also, the report noted, the police had not followed the standard protocol of sharing the “hash value” of the seized device with the accused at the time of the seizure, which means that it could no longer be said that the device was not tampered with after seizure, which seriously undermines the evidentiary value of the data on the device. The court can throw the evidence out on that ground alone. And this hard disk supposedly had crucial information relating to a plot to assassinate Prime Minister Modi, no less. So why was everything not done strictly by the book to ensure a swift conviction of the plotters?

Before this, on December 14, 2019, The Carvan had published another report after scrutinizing the computer hard drives seized from the human-rights lawyer Surendra Gadling and Rona Wilson, according to which report the files on Gadling’s computer had been tampered with, and there were serious procedural violations suggesting evidence tampering.

Prior to this, on December 5, 2019, The Wire reported that in addition to the Israeli spyware Pegasus, there was another well-coordinated attempt at spying on “human rights defenders and journalists in India” through malaware-bearing emails, which, according to a study by the Berlin-based digital team of Amnesty International, lured the receiver into downloading a file, which instaled the intended malaware, giving “full visibility and control of your computer”. In the report, The Wire noted that most recipients of these emails were also targeted by Pegasus, and except for one Vijayan, a professor of English at Delhi University, “every other recipient has one common link: the Bhima Koregaon trial.”

The recipients included Degree Prasad Chouhan, a Dalit rights activist and People’s Union for Civil Liberties (PUCL) Chhattisgarh state president, working closely with Sudha Bharadwaj, and Nihalsing Rathod, a lawyer who was an associate of Surendra Gadling, another lawyer. Both Gadling and Bhardwaj have been arrested in connection with the Bhima Koregaon case and on the computers of both incriminating evidence was found, which both say has been planted.

At the request of the defence lawyers, Arsenal Consulting, a Massachusetts-based digital forensics firm that has conducted analyses in serious cases such as the Boston Marathon bombing, forensically examined the electronic copies of the computers and email accounts belonging to Surendra Gadling and Rona Wilson delivered to it through American Bar Association and found that an unidentified cyber attacker had infiltrated the two computers and stored dozens of files in hidden folders, and these files were never accessed on the computers, indicating that the owners of the computers did not know of their existence on their hard drive. Arsenal Consulting found that Rona Wilson’s computer was infiltrated on June 13, 2016 after he opened an attachment from the already compromised email of Varavara Rao, which resulted in the installation of NetWire Remote Access Trojan (RAT), a malaware that allows the attacker to have control of the computer and to monitor, upload and download data remotely. Like Wilson’s computer, Gadling’s computer was also infiltrated on February 29, 2016 through another trojan-carrying email. The report by Arsenal Consulting is categorical in its finding that the incriminating documents found on the computers were delivered by no means other than Netwire.

It seems that the evidence was so bang-on probably because it was carefully crafted to be, or maybe there is some other explanation. Either way, the supposedly clinching evidence is, at the very least, inadequate, and with procedural lapses added in, it would be an uphill task for the prosecution to secure a conviction.

So can the bail now be granted? Strictly speaking, no. And it would still be consistent with the law because the proviso to Section 43D (5) mandates that the accused “shall not be released on bail” if the court “on a perusal of the case diary or the report made under section 173 of the Code [Cr.P.C.]” finds that “there are reasonable grounds for believing that the accusation against such person is prima facie true”, which means that the court can base its conclusions only on the case diary or the chargesheet, and cannot look into any evidence produced by the defense, which is also because going into the quality of evidence would tantamount to conducting a mini-trial at the stage of bail, which is impermissible in law.

In fact, during the bail hearing of Stan Swamy, the attention of the Special Court was drawn by the defence to the abovementioned report by The Carvan about the infiltration of Wilson’s hard disk, but the court said, “making any comments as to the evidence to be placed before the Court would amount to interference in the administration of justice”, and while, referring to the article, it did say that “such act is required to be deprecated”, the Court did not accede to the demand of the prosecution to initiate contempt proceedings against the author and publisher of the article. Again, the court did nothing questionable although it could refrain from commenting upon the article.

So far, no witnesses have been examined in the case and the evidence is yet to be judicially tested, but whatever has come to light has raised the disturbing possibility of evidence planting and tampering on the part of the investigation agencies in order to target the activists and lawyers who fight for the rights of the tribals.

What makes things a shade darker is that the Bhima Koregaon incident took place on January 1, 2018, and the investigation was conducted by Pune Rural Police for over two years until January 24, 2020, when the case was transferred to the centrally controlled NIA by the Central Government without the consent of the State government, three months after the State government in Maharastra changed after the October 2019 elections.

On September 13, 2021, the Union of India refused to share information regarding the spyware Pegasus with the Supreme Court, stating that “the information could not be made a matter of public debate as the same could be used by terror groups to hamper national security” despite the assurance by the Supreme Court that any information pertaining to “national security” could be excluded from the detailed affidavit, and despite the submissions on behalf of the affected journalists and human rights activists that the software was capable of taking control of the devices and storing incriminating information, which could be subsequently used to selectively implicate them in false cases. The Supreme Court was thus forced to constitute a committee of independent technical experts to look into the use of Pegasus, especially by the government agencies because the creators of Pegasus claim to sell the software only to “vetted government” clients.

The Bhima Koregaon case raises chilling questions regarding the willingness of the state to not only surveil its own citizens outside the framework of the law but also to prosecute as “terrorists” those who take upon themselves to criticize the government and stand for the downtrodden and marginalized, who cannot stand for themselves. Just because Maoist guerillas claim to be fighting for the cause of the tribals, it does not follow that everybody espousing the cause of the tribals is a Maoist guerilla or a supporter of violent uprising. The oneness of objective is not the oneness of means, and “terrorism” is by definition about violent means, the nobility or unworthiness of the objective notwithstanding.

The disturbing question, therefore, is: if you are a vocal dissenter — activist, lawyer, journalist, intellectual — who publicly criticizes the government, how likely are you to be prosecuted as a “terrorist” with “evidence” sufficient to keep you locked up for many, many years until the court, hopefully, exonerates you? And what effect would the possibility of such dreadful consequences have on the informed democratic debate necessary to sustain any democracy in any form? The Bhima Koregaon case is indeed a tale of conspiracy, either against or by the government. Who plotted against whom is the only question waiting to be answered.

Leave a Comment