MUMBAI: Rona Wilson, one of the accused in the Elgar Parishad case, on Wednesday urged the Bombay high court to quash his criminal prosecution by citing a US-based forensic lab’s report that indicated planting of evidence on his laptop. The evidence, he said, was subsequently relied by the National Investigation Agency to book him in the case.
Wilson, 42, a human rights activist lodged in Taloja jail since his arrest in June 2018, cited a February 8 digital forensics report from Arsenal Consulting which said his computer had been “compromised’’ for 22 months. He also urged the court to form an SIT to probe the alleged planting of evidence.
Mark Stevens, president of Arsenal Consulting, in a 16-page report, said Wilson’s was “one of the most serious cases involving evidence tampering’’ that the firm had encountered, “based on various metrics that include the vast time span between the delivery of the first and last incriminating documents”.
The report said, “The hidden documents… and the top 10 incriminating documents… were delivered to Wilson’s computer by NetWire (a malware) and not by any other means.’’ It said Wilson’s computer was first compromised on June 13, 2016 after a series of suspicious emails with someone using co-accused Varavara Rao’s email account.
Additional solicitor general Anil Singh, who appeared for NIA against the bail pleas of several accused, told TOI on Wednesday that he has not seen the forensic report but questioned its value at this juncture, saying “if at all, it can be tested or gone into during trial”.
Wilson’s petition described the report as “independent and unimpeachable expert analysis’’ and sought orders for an SIT to “probe to ascertain person/s behind such planting of fabricated documents in his electronic devices, to implicate him’’ and then prosecute those person/s. He also sought “monetary compensation’’ for “mental agony and harassment, violation of fundamental rights, loss to reputation” and a stay on all proceedings in the case and release on bail as interim relief till his petition is decided.
Wilson said he was all set to pursue his PhD at the University of Leicester or Surrey in 2018 after an MPhil from JNU.
The NIA has submitted a chargesheet against Wilson alleging Maoist links, a conspiracy to disrupt communal peace, waging war against the nation and several terror offences under the stringent Unlawful Activities (Prevention) Act (UAPA). His petition said he has been accused of hatching a conspiracy to “eliminate Prime Minister Narendra Modi in another Rajiv Gandhi-type incident.”
Wilson had sent cloned copies of the digital evidence “recovered’’ by police against him and others alleged to be Maoists for forensic analysis to the US firm last July. Police had cited “letters’’ found embedded in computers of some of the accused, including Wilson, as evidence to prosecute them under UAPA, meant to tackle terror.
His petition said the 22,000-page chargesheet showed the prosecution case against all 16 accused was “based entirely on electronic evidence”. The Centre had last January handed over the probe to the NIA. Originally, Pune police had probed the case.
Arsenal said it received “a hard drive on July 31, 2020 which contained forensic images and police work product related to… Wilson and other defendants accused of instigating violence”. Its report said, “The attacker responsible for compromising Mr Wilson’s computer had extensive resources (including time) and it is obvious that their primary goals were surveillance and incriminating document delivery’.’
The forensic consultant said it “has connected the same attacker to a significant malware infrastructure which has been deployed over the course of approximately four years to not only attack and compromise Wilson’s computer for 22 months but also to attack his co-defendants… and other defendants in other high-profile Indian cases as well.”
The report said, “During the course of the email conversation, the person using Varavara Rao’s email account made multiple attempts to get Mr Wilson to open a particular document — ‘another victory.rar’,” which he did. It “was a part of a chain of events that led to installation of NetWire remote access trojan (RAT) on Wilson’s computer’’, the report said, detailing steps taken to conduct the forensics and what the “attacker used’’ as a “staging area’’ “for file synchronisation’’.
Under a subheading called “Document delivery”, the report said it found no evidence, despite “searching aggressively”, to suggest MS Word 2010 or later versions existed on Wilson’s computer. “Nor are we aware’’ of him having another computer. The version installed on his computer was 2007. “This is relevant because some of the most incriminating documents on Mr Wilson’s computer, which he allegedly authored, were saved to PDFs by Word 2010 or Word 2013,” it noted.
The Washington Post in a report said it had asked “three experts on malware and digital forensics in North America to review Arsenal’s report and they said its findings were sound”. The newspaper said Arsenal “has performed digital forensics analysis in other high-profile cases, including the Boston Marathon bombing”.
While Arsenal has not identified the source of the alleged cyberattack, Spencer has called it “very organised” and “extremely dark” in intent.