The TLDR: The explosive results of a highly respected US forensics firm show that Rona Wilson and sixteen others may have been framed in the Bhima Koregaon case. The digital evidence is damning and has been submitted to the Maharashtra High Court—and offers the first sign of hope that the likes of Stan Swamy and Varavara Rao may go free. We explain the case and the results of the investigation—with some details sacrificed for brevity.

The trigger

Bhima Koregaon: is a small village in the district of Pune, and it holds great significance for Dalits. On January 1, 1818, the British army comprised primarily of Dalit soldiers overcame an upper caste-dominated Peshwa troops in a battle that is celebrated to this day—at an annual event called Elgar Parishad. It is close to a memorial of a local hero Govind Gopal Mahar (Gaikwad) who is revered by Dalits.  

The violence: On December 29, 2017, Mahar’s memorial was vandalised—sparking inter-caste tension. According to the police, on December 31, a number of speakers cited the incident at the Elgar Parishad—attended by a number of prominent activists, former judges and politicians. The next day, a group of people carrying saffron flags burst in on the Dalit celebration—and one person was killed in the ensuing clash. 

The investigation

The day after the violence, an anti-caste activist filed an FIR accusing the mob of violence, and identifying them as supporters of local Hindutva leaders. No action was taken on this FIR. The Bhima Koregaon case is based on a second FIR.

The key FIR: was filed on January 8 by a person who claimed he attended the Elgar Parishad and witnessed “inflammatory speeches inciting hatred amongst society” and “inflammatory books” being sold. The charges cite Section 153A, 505(1)(b) and 117 of the Indian Penal Code—which include promoting enmity between different groups on grounds of religion; making statements with an intent to cause fear and incite violence; abetting offence committed by a group of 10 or more persons. 

Point to note: This FIR only named six members of the Kabir Kala Manch—Sudhir Dhawale, Sagar Gorkhe, Harshali Potdar, Ramesh Gaychor, Dipak Dhengale and Jyoti Jagtap.

The big sweep: Over the coming months, the Pune police launched a full-scale investigation across multiple cities including raids on the homes of activists—and expanded its scope to include “other destructive activities.” 

• Rona Wilson—an activist with the Committee for Release of Political Prisoners—was among the five activists to be arrested in June. 
• By this time, the charges had expanded way past the original FIR—and now included added charges under the extremely strict anti-terrorism law, Unlawful Activities (Prevention) Act (UAPA). 
• The chargesheet filed in November—in a special UAPA court—accused these people of hatching “a nationwide plot against the Indian state” with the financial assistance from a banned Maoist party. 
• And evidence for this plot was unearthed while investigating the original Pune FIR. We have more on this evidence below. 
• In August, the police arrested poet Varavara Rao and lawyer Sudha Bharadwaj along with activists Arun Fereira, Gautam Navlakha and Vernon Gonsalves.
• A supplementary chargesheet filed against them in February 2019 accused them of “waging war against the nation,” spreading Maoist ideology and creating caste conflict and hatred.
• It cited “evidence retrieved from electronic devices seized from the arrested activists”—which is the focus of the revelations made by the US firm.
• As of today, 16 people have been arrested in connection with this case—including elderly activists like Father Stan Swamy.

Key point to note: Most of these people were not named in the original FIR, and were not present at the Elgar Parishad event.

Also this: When the BJP government lost power in Maharashtra in 2020, the case was transferred from the Pune police to the National Intelligence Agency—which reports to the union government. 

The US investigation

It was conducted by Arsenal Consulting, a Massachusetts-based digital forensics firm—which looked at an electronic copy of Rona Wilson’s laptop at the request of his lawyers. And it casts serious doubt on the evidence used to build the case against the activists.

The evidence: When the Pune police raided Wilson’s home on April 17, 2018, they took away his laptop. They found 10 crucial documents—the most explosive of which was a letter to a Maoist militant referring to a plot to assassinate PM Modi. It said:

“We are thinking along the lines of another Rajiv Gandhi-type incident. It sounds suicidal and there is a good chance that we might fail, but we feel that the party PB/CC must deliberate over our proposal. Targeting his road-shows could be an effective strategy.”

This “digital evidence” was then used over the coming months and years to arrest all the others.

The investigation: shows that Wilson’s laptop was hacked back in 2016, and accessed multiple times over 22 months. During that period, 52 files were planted on Wilson’s computer. This is a timeline of how it happened:

• One afternoon in June 2016, Wilson received several emails that appeared to be from Varvara Rao’s account—who told him to click on a link to download a statement from a civil liberties group. 
• The malicious link instead deployed NetWire, a widely available form of malware that allowed the hacker to access Wilson’s laptop.
• In March 2018, the hacker loaded nine of the 10 incriminating documents onto Wilson’s thumb drive. He then moved the documents into a hidden folder on the laptop—that are buried out of sight.
• Point to note: These documents were created using a newer version of Microsoft Word—which did not exist on Wilson’s laptop. Also: Arsenal found no evidence that the documents or the hidden folder were ever opened by Wilson.
• The folder was last modified on April 16, 2018 at 16:50:41—a day prior to the raid on Wilson’s residence on April 17, and weeks before he was arrested on June 6, 2018.

Chain of ‘bad evidence’: These ‘planted’ documents were not an isolated case. According to the report, the same attacker used the same servers and IP addresses to target the others accused in the case over a period of four years.

A key point to note: The report does not identify the person or institution behind the attack. But Arsenal says it’s ”one of the most serious cases involving evidence tampering” it has ever encountered, calling it “unique and deeply disturbing.”

The NIA’s response: The agency has rejected the significance of Arsenal’s findings: 

“Jaya Roy, a spokeswoman for the National Investigation Agency, the anti-terrorism authority overseeing the cases against the activists, said that the forensic analysis of Wilson’s laptop conducted by law enforcement did not show any evidence of malware on the device. She added that there was ‘substantial documentary and oral evidence’ against the individuals charged in the case.”

Nevertheless, Wilson’s lawyers have petitioned the Bombay High Court to issue a stay on proceedings against him and his co-accused. They have separately requested a Special Investigation Team to inquire into the alleged tampering.

The bottomline: These are terrifying times we live in.

Reading list

• Read the Arsenal report in its entirety here.
• The Caravan was the first to report on the tampering of evidence and the suspicious malware on Rona Wilson’s hardisk.
• Last year, Amnesty International in partnership with Canada-based Citizen Lab exposed a systematic spyware campaign targeting nine other human rights activists.
• The Washington Post was the first to break the story, and offers an excellent overview.
• The Telegraph has a nice timeline of the hacking. 
• India Today explains why the 200-year-old Koregaon battle triggered caste clashes in Maharashtra.
• The Print explains why the 16 accused in the Koregaon case are still languishing in jail.
• The Hindu explains the political history and significance of Bhima Koregaon.