Like Rona Wilson, ‘evidence planted’ in Bhima Koregaon accused Surendra Gadling’s laptop: US firm

Arsenal Consulting's report claims 14 letters were planted on Gadling's laptop by same attacker who allegedly planted 30 files on Wilson’s laptop using malicious software NetWire.

Surendra Gadling, activist and an accused in Bhima Koregaon violence case | Image by Ramandeep Kaur | ThePrint

New Delhi: The laptop of lawyer and human rights activist Surendra Gadling, accused in the Bhima Koregaon case, was surveilled, attacked and incriminating documents planted on it for over a period of 20 months, an American digital forensics firm has claimed.

The firm also claimed that Gadling was targeted by the same attacker who allegedly planted evidence on the laptop of Rona Wilson, another accused in the same case.

A report by Arsenal Consulting, a Massachusetts-based digital forensics firm, claimed that Gadling, who was among the first of the 16 to be arrested in the case, was cyber attacked in February 2016, two years before he was arrested on 6 April 2018.

The claim was reported by The Washington Post, and comes a day after the death of Father Stan Swamy, another accused in the Bhima Koregaon case.

Arsenal Consulting’s report alleged that 14 incriminating letters — which form part of the body of evidence against Gadling — were planted on the laptop by the same attacker who allegedly planted 30 files, including 10 letters, on Wilson’s laptop using the malicious software NetWire.

The Bhima Koregaon case is being investigated by the National Investigation Agency (NIA), which had refuted Arsenal Consulting’s earlier claims about evidence being planted on Wilson’s laptop.

Citing the latest report, Gadling’s legal counsel Nihal Singh Rathod said they “stand vindicated”.

“We have said since day one that the police is upto mischief … this report confirms it all. They want to attack Gadling as he is a defender of tribal rights,” said Rathod.

The report is the third such report to be published by Arsenal Consulting this year. The previous two, published on 8 February and 27 March, looked into Wilson’s laptop, and alleged that the files were planted during the same period — between 2016 and 2018.

The findings relate to the violence that erupted in Bhima Koregaon on 1 January 2018, a day after a gathering in Maharashtra’s Pune sought to mark 200 years of a battle between the Peshwas and a British Army comprising Dalits, which was won by the latter. Those at the gathering were accused of making provocative speeches at the event, leading to the violence.

Initially investigated by the Pune Police, the case was taken over by the NIA, which alleged there was a larger plot to wage war against the country.

ThePrint reached NIA spokesperson Jaya Roy through multiple calls and messages, but didn’t receive a response till the time of publishing this report. The NIA had called Arsenal Consulting’s first report a “distortion of facts”.

“The matter is subjudice. So we will not comment on the matter for now,” a top NIA officer, requesting anonymity, told ThePrint.

‘Planted’ letters & laptops attacked 15 mins apart

The NIA had provided Gadling’s team with forensic images of the digital devices seized from him. These were then sent by Gadling’s team to the US firm for examination.

In its report, accessed by ThePrint, Arsenal claimed: “14 important documents were delivered to a hidden folder (named “Material”) on the tertiary volume of Mr. Gadling’s computer by NetWire and not by other means”.

The hidden ‘Material’ folder 9 was created on 4 December 2016, and the attacker delivered documents to it between that day and 22 October 2017, the report added.

The forensics firm further claimed: “It should be noted that this is one of the most serious cases involving evidence tampering that Arsenal has ever encountered, based on various metrics which include the vast timespan between the delivery of the first and last incriminating documents on multiple defendants computers”.

The report also found a significant connection between Gadling and Wilson’s laptops. According to it, on 22 July 2017, both laptops were meddled with just 15 minutes apart. The firm claimed that the attacker made several attempts to compromise Gadling’s laptop via emails, “sending him identical malware (but packaged differently)” in February 2016. “Ultimately, on February 29, 2016, Mr Gadling executed this malware,” the report states.

Malware (short for malicious software) is used by cyber criminals to gain unauthorised access to systems, typically in the guise of emails and attachments. The cyber forensics firm claimed that the malware was delivered to Gadling, packaged as emails with attachments from his acquaintances. Stan Swamy and Sudha Bharadwaj, another accused in the case, were also copied on these malware loaded emails, the report said.

The 14 letters on Gadling’s laptop appear to be communication between him and alleged Maoist leaders, including ‘Sudarshan’, and were a discussion about “fundings” and “operations”, according to the US firm.

The content of these letters form the core of the NIA’s case against those accused and arrested.

“By February 2016, the attacker had compromised the email accounts of multiple defendants in the Bhima Koregaon case, and had also used at least two different email spoofing services,” Arsenal said in its report.

With inputs from Ananya Bhardwaj

(Edited by Manasa Mohan)