Thread by @NihaMasih

THREAD on malware attacks in Bhima Koregaon:
1/Lawyer Surendra Gadling was sent three emails with malware in Feb 2016 from email IDs of people he knew that were either compromised or forged. washingtonpost.com/world/2021/07/…

2/Through the malware, the attacker had access to Gadling's computer, including sites he browsed, emails he composed & documents he edited.

3/One such malware email received by Gadling is marked to two other defendants – Stan Swamy and Sudha Bharadwaj. If they clicked on the attachment, similar malware would have been deployed on their devices.

4/In June 2016, activist Rona Wilson recd an email from co-defendant Varavara Rao. When he downloaded the attachment, it deployed the malware instead, giving the attacker comprehensive access to his device. More here washingtonpost.com/world/asia_pac…

5/After compromising the two computers, the attacker deposited dozens of documents in a hidden folder including the explosive letter discussing plot to kill PM Modi. None of the documents were created or opened on Wilson or Gadling’s computers.

6/The attacker in both instances is the same, experts conclude. Besides the same method of attacks via email, the hostnames, IP addresses and the password used by the attacker to log into his command and control server are the same.

7/Even more damning proof is from a day in July 2017. The attacker was active on Gadling and Wilson’s device within a period of 20 minutes and deposited the same document on both computers. The document is a purported account of the funding policy of Maoists.

8/The planted documents were later cited by investigators as evidence in the charging documents that tied the accused persons to the Maoists and say they plotted to overthrow the govt.

9/The accused deny the charges. Mihir Desai, a lawyer for the defense team said Arsenal’s findings “go a long way in exonerating” them and “destroying the prosecution’s case.”

10/The NIA declined to comment on the new report. Previously they told us that forensic analysis of Wilson’s laptop conducted by the police did not show any evidence of malware on the device.

11/Boston-based digital forensics firm @ArsenalArmed that did the analysis at the request of the defense team said “This is one of the most serious cases involving evidence tampering that Arsenal has ever encountered.” We asked three independent experts to review the findings.

12/The case against the accused in the Bhima Koregaon case has it’s origin in an event on Jan 1, 2018 when Hindu nationalist groups clashed with Dalits celebrating the anniversary of a colonial-era battle. Most of the accused were not present or associated with the event.

13/The law the accused are charged under has a poor conviction rate but makes it virtually impossible to secure bail. For some, it’s been three years in jail awaiting trial. In the case of Stan Swamy, he died after an 8-month stint in jail.

14/Arsenal’s findings raise doubts over the case that rights groups consider an attempt by the govt to crack down on critics of Narendra Modi. A petition to quash charges based on the first report is pending before the courts. ENDS