Hackers planted false files implicating Indian Jesuit who died in prison

NEW DELHI -- Catholic activists and priests want the Indian government to "take full responsibility" for the custodial death of Jesuit Father Stan Swamy after findings by U.S.-based digital forensic experts that false evidence was planted on the priest's computer.

In a recent report, Arsenal Consulting, a Massachusetts-based digital forensics firm, said the "digital evidence used to arrest senior human rights defender Father Swamy in the Bhima-Koregaon case was planted on his computer's hard drive."

The 84-year-old Jesuit, a rights activist based in eastern Jharkhand state, died in a hospital while imprisoned in Mumbai in July 2021 after being denied bail on medical grounds, despite suffering from multiple age-related ailments.

He was arrested Oct. 8, 2020, by India's anti-terror National Investigation Agency and accused of being party to a conspiracy allegedly hatched by outlawed Maoist rebels to unleash mob violence at Bhima-Koregaon, in the western state of Maharashtra, Jan. 1, 2018.

Ucanews.com reported Arsenal said "the attacker responsible for compromising Father Swamy's computer had extensive resources (including time), and it is obvious that the primary goals were surveillance and incriminating document delivery."

Disclosing details of the findings, Jesuit Father Joseph Xavier said in a statement that the hackers "first attacked Father Swamy's computer on Oct. 19, 2014, using a Remote Access Trojan (RAT) called Netwire."

"The report (by Arsenal) shows examples of the hackers being able to read his passwords as he was typing them, as well as other documents and emails," said Father Xavier, who is also a convener of the Father Stan Swamy Legacy Committee of the Jesuits.

The hacker also read as many as 24,000 files on Father Stan's device and planted files between July 2017 and June 2019, Father Xavier said, quoting from the report.

"Over 50 files were created on Father Swamy's hard drive, including incriminating documents that fabricated links between Father Stan and the Maoist insurgency. The final incriminating document was planted on Father Stan's computer on June 5, 2019, a week before the raid on him," he added.

It was on the basis of these planted documents that Father Swamy was first arrested, in spite of experts raising serious doubts about the authenticity of the documents, Father Xavier added.

Quoting Arsenal Consulting's President, Mark Spencer, Father Xavier's statement said: "The scale of what happened to Father Swamy and some of his co-defendants, in terms of the aggressive surveillance of their electronic devices which culminated in incriminating document deliveries over the course of years, is truly unprecedented."

Father Xavier, in the statement, said Arsenal has effectively caught the attacker red-handed, based on remnants of their activity left behind in file system transactions, application execution data and other things. However, it has not disclosed details of the hackers, who are believed to be connected with the state, he added.

Forensic analysis showed the hackers who attacked Father Swamy's computer are the same as those who hacked and planted digital evidence on the devices of co-defendants in the case, Rona Wilson and Surendra Gadling.

The statement further alleged that multiple findings link the suspected hackers to the Indian state.

"Cyber security firm Sentinel One has previously investigated the attackers and concluded that their 'activity aligns sharply with Indian state interests,'" the statement added.

Ucanews.com reported that Jesuit Father A. Santhanam, national convener of the National Lawyers Forum of Religious and Priests, said it had been proved that "Father Swamy was falsely implicated by the investigating agency by implanting fabricated evidence."

He wondered if the federal government would expose its own agencies involved in the case, but said the world has the right to know who hacked the computer of Father Swamy.

"As a first remedy, the government and its agency should submit an unconditional apology for the elderly Jesuit's death in custody," Father Santhanam said.

He said the government also must take full responsibility and compensate for the loss of life, besides releasing all those accused and imprisoned in the Bhima-Koregaon case.

Bhima-Koregaon is a village in Maharashtra that has come to symbolize the bravery of the Dalits or former untouchables, who gather there to commemorate a 200-year-old battle victory on Jan. 1 every year.

In 2018, violence erupted at Bhima-Koregaon when some groups carrying saffron flags entered the scene and attacked the Dalits gathered for the annual victory celebration.

However, investigators alleged the violence was the handiwork of Maoist rebels and arrested 16 activists, alleging they were directly involved in the conspiracy.

"The major evidence on which the NIA was relying was the so-called incriminating evidence found in the computers and laptops, including that of Father Swamy. Now the forensic report has shattered this lie," Father Santhanam said.

Father Swamy repeatedly denied any knowledge of the evidential material found inside his computer.

"Till his death, Father Swamy maintained he (was) innocent, but it's (too) late now," Father Santhanam said while appealing to the federal government and its probe agency to drop all charges against the others accused in the case and compensate them for the hardships and harassment caused to them and their families.