Activist Rona Wilson on Wednesday moved the Bombay High Court seeking the formation of a Special Investigation Team to inquire into the alleged planting of fabricated documents in his computer over a course of about 22 months. Wilson was the first person to be arrested in the Bhima Koregaon case.

According to a report from Arsenal Consulting, a Massachusetts-based digital forensics firm, key evidence against activists and intellectuals, who have been arrested in the Bhima Koregaon case, was planted using a malware on a laptop seized by the police.

Arsenal had examined an electronic copy of the laptop at the request of Wilson’s lawyers. On Wednesday, Wilson’s lawyers included the report in a petition filed in the Bombay High Court, urging judges to dismiss the case against their client.

Several activists and academics have been accused of making inflammatory speeches at the Elgar Parishad conclave held at Shaniwar Wada in Pune on December 31, 2017, which the authorities claim triggered violence at Bhima-Koregaon war memorial the next day.

In his petition, Wilson has sought his immediate release and a stay on proceedings related to the arrest of the activists in the case.

It added:

“It is therefore just and necessary, that this Hon’ble Court does enquire into the fraud committed on the Petitioner [Wilson] in order to frame him and his co-accused with the aim of keeping them behind bars for an indefinite period of time. The said planting and framing amounts to false prosecution with malice in fact and in law as is obvious for the selective prosecution of the accused while ignoring to prosecute the real culprits of the violence that took place on 1.1.2018…This requires a thorough enquiry by this Hon’ble Court in order to ensure that the fair name of justice is not sullied.”

— Rona Wilson's petition

The petition has also sought quashing the order of sanction to prosecute all the accused. It said that the Special Investigation Team should include digital forensic analysis experts and should be led by a retired judge of the High Court or the Supreme Court or other appropriate persons empowered to probe into the alleged planting of fabricated documents.

The activist sought monetary compensation befitting to the “agony, harassment, violation of fundamental rights, defamation, loss to reputation, incarceration, inhuman treatment” suffered by the accused in the case.

Wilson said the actions against the accused activists amounts to “targeted and selective persecution”, which is in violation of their fundamental rights granted under Article 14 (equality before law) and Article 15 (prohibition of discrimination on the basis of religion, race, caste, sex, place of birth).

“No effort was made by the sanctioning authority to satisfy itself even prima facie that the device of the petitioner had not been compromised prior to giving sanction as they were bound in law to do,” he said.

Wilson said that his arguments are not just dependent on the report but also on the “facts and circumstances” that show the case is an “absolute creation of fabrication, biased, grossly disturbing and by exceptional misuse of power”.

The petition pointed out that no arms or ammunition were seized from any of the accused, including Wilson, or any deaths happened on account of the actions of the accused as stated in the chargesheet. Besides the “planted evidence”, no acts of violence were attributed to the accused to show their involvement in the crime or justify the invocation of the Unlawful Activities (Prevention) Act, it added.

“The respondents wish to make an example of the petitioner and the accused to prevent them from raising a voice of dissent against any ruling establishment,” the petition alleged.

Wilson said that he was targeted because he has been a vocal critic of the government, its pro-corporate policies that were against ordinary people, and the usage of anti-terror laws.

The petition said:

“A perusal of the chargesheet in totality will bear out that the case against petitioner as also the co-accused, now numbering 16 in total, is based entirely on electronic evidence. Although the chargesheets run into more than 22,000 pages, there are not more than 50 odd documents which the prosecution bases its case upon. A sizeable chunk of the alleged incriminating evidence is seized from the laptop of petitioner, and also from the desktop computer of his co-accused Surendra Gadling, advocate.”

— Rona Wilson's petition

The digital forensic report


Arsenal’s report found that an attacker used malware to infiltrate a laptop belonging to Wilson before his arrest and deposited at least 10 incriminating letters on his computer. The Pune Police used letters it found on the laptop as its primary evidence in the chargesheet they filed in the Bhima Koregaon case.

Among these was a letter that the police claimed Wilson had written to a Maoist militant, discussing the need for guns and ammunition as part of an intricate Maoist conspiracy, and even urging the banned group to assassinate Prime Minister Narendra Modi. The report found the letters had been planted in a hidden folder on Wilson’s laptop.

“This is one of the most serious cases involving evidence tampering that Arsenal has ever encountered,” the report said, citing the vast time span between the time the laptop was first compromised and the moment the attacker planted the last incriminating document.

The Arsenal report said that Wilson’s laptop was compromised in June 2016, after a series of suspicious emails from someone using Telugu activist and co-accused Varavara Rao’s account. During the course of the conversation, the person using Rao’s account made multiple attempts to get Wilson to open a particular document, which was a link to download a statement from a civil liberties group.

When Wilson complied, the link deployed NetWire, a commercially available form of malicious software that allowed a hacker remote access to Wilson’s device, which can then be used to plant files on a system, the report said. Arsenal discovered records of the malware logging Wilson’s keystrokes, passwords and browsing activity.

It also recovered file system information showing the attacker creating the hidden folder to which at least 10 incriminating letters were planted. The letters were created using a newer version of Microsoft Word that did not exist on Wilson’s computer, the cyber-forensic examination revealed.

Additionally, Arsenal said it found no evidence that the documents or the hidden folder were ever opened.

Also read:

  1. 13 letters leaked by Pune police show why it’s hard to believe claims about a Maoist conspiracy
  2. Bhima Koregaon: Spyware attacks on rights defenders show continuing attempt to fix case