Hackers Planted Evidence On Father Stan Swamy's Computer: US Report

An American digital forensics firm released a report, which shows that a hacker planted multiple incriminating documents in the computer of activist-priest Father Stan Swamy’s computer.

The 84-year-old Jharkhand-based Jesuit priest died in judicial custody last July, eight months after he was arrested for alleged terror links to the Bhima-Koregaon violence in January, 2018. The case pertains to allegations that provocative speeches about caste were made at an event, Elgar Parishad, on December 31, 2017 in Pune that sparked clashes in parts of Maharashtra the following day.

The report by Massachusetts-based digital forensics firm Arsenal Consulting examined an electronic copy of Swamy’s computer and found hacker activity.

The report blasts a hole in the National Investigation Agency (NIA)'s charges against Stan Swamy, which centre around alleged electronic correspondence between the priest and supposed Maoist leaders to make the case that he was part of an explosive Naxal conspiracy.

Based on documents retrieved from their computers, the NIA had also charged Swamy and the others—mainly left-leaning activists, academics, and human rights defenders - with plotting with Maoists to kill Prime Minister Narendra Modi. In a video recorded just before his arrest in 2020, Father Swamy had rubbished the purported Maoist letters found on his computer, saying he "denied and disowned every single extract that was put before me" by investigators.

Findings of the Arsenal report

The Arsenal report said that Swamy, who championed the rights of tribal youth, was “the target of an extensive malware campaign for nearly five years, the longest known for any defendant, right up until his device was seized by police in June 2019”. In this period, the hacker had complete control over Fr Stan's computer, dropping dozens of files into a hidden folder without his knowledge. Close to 44 documents, including the so-called Maoist letters, were planted by an unknown cyber attacker who gained access to Swamy's computer.

The hacker used a malware called NetWire to gain access to Father Swamy's computer on October 19, 2014, for both highly invasive surveillance and "document delivery".

According to Arsenal, one such document "delivered" by the attacker to Stan Swamy's computer and part of the NIA's chargesheet against the priest, was an alleged letter sent by one "SS"—presumed to be Father Stan Swamy—to a "Vijayan Dada" on October 2017. In the letter, "SS" asks "Vijayan" to take action "to capture senior leaders of ruling BJP in the state and demand that the oppressive laws be done with."

Another document in the NIA chargesheet against Swamy, detailing the manpower and weaponry of a Maoist outfit called People's Liberation Guerilla Army in different Indian states, is also among the planted documents, Arsenal says.

According to Arsenal, they "found no evidence which would suggest that the... documents were ever interacted with in any legitimate way on Fr Swamy's computer. More specifically, there is no evidence that suggests any of the (planted) documents, or the hidden 22 folders they were contained in, were ever opened" by Swamy.

Arsenal Consulting had also found proof of similar planting of evidence on the systems of at least two other co-accused in the Bhima Koregaon case, activists Rona Wilson and Surendra Gadling. The reports found an unknown hacker had planted over 30 documents on the computer belonging to Rona Wilson and at least 14 incriminating letters on Surendra Gadling's computer.

All three, Stan Swamy, Surendra Gadling and Rona Wilson, were targeted by the same hacker, according to Arsenal.