A forensic investigation into evidence presented in court that resulted in the arrest and detention of the late Indian Jesuit priest Stan Swamy revealed that “digital evidence” used to arrest the priest “was planted on his computer’s hard drive.”
“Father Stan Swamy was arrested, incarcerated, and died based on fabricated evidence,” read a statement released to the media.
Arsenal Consulting, a US-based digital forensics firm, traced 44 documents entered by malware and used by Indian authorities as evidence of “terrorism” against the Jesuit priest who died in detention at the age of 84 in July 2021.
“We are not surprised by the reports … that files have been placed in [the priest’s computer],” said Father Frazer Mascarenhas, a friend of Father Swamy and appointed by the court as custodian in a lawsuit asking the court for an acquittal of the activist priest from the charges leveled against him.
“What is surprising are the dates indicated by the report: the hacker began to act in 2014, a few months after the change of government in New Delhi and in Maharashtra,” said Father Mascarehnad, adding that it “indicates deliberate long-term planning.”
The Arsenal Consulting report followed previous reports that documented the planting of digital evidence on the devices of Father Swamy’s co-defendants, Rona Wilson and Surendra Gadling.
“Forensic analysis has shown that the hackers who attacked Father [Swamy’s] computer are the same as those who attacked Wilson and Gadling,” read the report.
“Multiple findings link the Indian state to this hacking of human rights defenders,” it added.
Cybersecurity firm SentinelOne has previously investigated the attack and concluded that the “activity aligns sharply with Indian state interests.”
“The attacker responsible for compromising Father Swamy’s computer had extensive resources (including time) and it is obvious that their primary goals were surveillance and incriminating document delivery,” read the Arsenal report.
In June 2022, WIRED magazine reported that SentinelOne had found evidence linking the Pune police to the hackers.
Forensic findings also indicate that hackers had advance knowledge of the raid on Father Swamy’s residence conducted by the Pune police.
The report provides detailed evidence of hackers attempting to erase evidence of their activities on the night of June 11, 2019.
The Pune police seized Father Swamy’s computer the very next day, on June 12.
Hackers first attacked Father Swamy’s computer on October 19, 2014, using a Remote Access Trojan (RAT) called Netwire. RATs allow an attacker to both remotely surveil someone’s computer, and to transfer files from and to the computer.
In Father Swamy’s case, every single thing he typed was recorded using a process called “keylogging.”
The report shows examples of the hackers being able to read his passwords as he was typing them, as well as other documents and emails.
The hacker also surveilled as many as 24,000 files on Father Swamy’s device.
In addition to surveillance, digital files were planted on Father Swamy’s hard drive across two hacking campaigns starting in July 2017 and continuing till June 2019.
Over 50 files were created on Father Swamy’s hard drive, including incriminating documents that fabricated links between Father Swamy and the Maoist insurgency.
The final incriminating document was planted on Father Swamy’s computer on June 5, 2019, a week before the raid.
It was on the basis of these documents that Father Swamy was first arrested in the Bhima Koregaon case, in spite of experts raising serious doubts about the authenticity of the documents.
“The scale of what happened to Father Swamy and some of his co-defendants, in terms of the aggressive surveillance of their electronic devices which culminated in incriminating document deliveries over the course of years, is truly unprecedented,” said Arsenal Consulting’s president Mark Spencer.
Father Stan Swamy’s death in custody was roundly condemned worldwide, including in the British Parliament, by the US State Department, and the United Nations.
The UN Working Group on Arbitrary Detentions agreed that Father Swamy’s death in custody “will forever remain a stain on the human rights record of India.”
