Yesterday #StanSwamy died, after eight months in prison con…

2. After the first arrests in June of 2018, police began to leak sensational 'electronic evidence' – letters found on the activists' laptops, which showed their links to Maoist guerillas. The most shocking letter even proposed a plot to assassinate Prime Minister Modi.

3. The letters were strangely explicit: Conspirators used each others' real names, instead of aliases as Maoists typically do.
They openly detailed requirements for arms and planned attacks, without using code-words.

4. The correspondence also implicated “Congress friends” and leaders, and a range of civil-society groups and youth leaders, like Jignesh Mevani and Umar Khalid...

5. In short, the letters outlined an 'Urban Naxal' ecosystem, which neatly matched the right-wing's projection of the grand anti-national conspiracy: Armed guerillas, human rights activists, opposition parties, Dalit and Muslim student leaders – all in the bag.

6. The specific letter that plotted “another Rajiv Gandhi type incident” against the PM was leaked as an exclusive to #RepublicTV. According to the channel, this letter was recovered from the laptop of Rona Wilson, one of the first of the BK 16 to be arrested.

7. Using these letters, police imprisoned the rest of the accused.
Sudha Bharadwaj, who had to pass her lawyer a handwritten note, called the evidence against her "a totally concocted letter fabricated to criminalise me and other human rights lawyers, activists, organisations."

8. Some of the activists have suffered badly in jail.
Stan Swamy, aged 84, was reduced to agony by Parkinson's. Then he tested positive for Covid. He pled for bail, but the NIA relentlessly opposed it, saying there was no "conclusive proof" of his ailments.
Still, he died of them

9. The others have been in limbo, some for over three years.
Which is strange, given the flagrant plot: to assassinate! the Prime Minister!! And all the evidence, already splashed across national TV.
Yet instead of a swift conviction, the trial has not even begun.

10. No witness has been examined. The court hasn't even taken cognisance of the charge-sheet, which it has to do before charges are framed or the trial begins.

11. So here's what the legal defense team did, instead of waiting forever. In July 2020, they contacted Arsenal Consulting, a US digital forensics firm, which has done analyses for serious cases including the Boston Marathon bombing.

12. So here's what the legal defense team did, instead of waiting forever. In July 2020, they contacted Arsenal Consulting, a US digital forensics firm, which has done analyses for serious cases including the Boston Marathon bombing.

13. Mark Spencer, the director at the firm, was sceptical at first – a case with such a high profile wasn't likely to turn up evidence tampering. But they agreed to look into it.

14. The defense team put electronic copies of Rona Wilson and Surendra Gadling's devices & emails on hard drives, which were conveyed by a chain of safe custody to the American Bar Association, and by the ABA to Arsenal's headquarters near Boston.

15. Arsenal verified that the data were intact by matching “hash values” (digital fingerprints) on the forensic images of the laptop and thumbdrive – from when those images were first obtained, and when they reached the firm.
They then spent over 300 hours on Wilson's data alone

16. What they uncovered was “one of the most serious cases involving evidence tampering [they had] ever encountered”.
A nearly two-year timespan during which an attacker had access to the activists' laptops and used it "for surveillance and incriminating document delivery".

17. According to the report, Rona Wilson’s computer was compromised on June 13, 2016, after he opened an attachment sent by someone using VaraVara Rao’s email, which had also been compromised.

18. @ArsenalArmed: "Opening the document (a decoy within a RAR archive file named “another victory.rar”...) was part of a chain of events which led to the installation of the NetWire remote access Trojan (“RAT”) on Wilson’s computer.”

19. NetWire is a commercial malware / Trojan that allows attackers to log keystrokes, take screenshots – and to upload and download files.
Arsenal decrypted NetWire logs on Wilson’s computer, and found activity from 2016 until hours before Wilson’s computer was seized by police.

20. The attacker was making their last changes on Wilson's computer at 4:50 pm on April 16, 2018 – before the Pune police arrived to raid the house at 6am on the 17th.

21. TODAY, @ArsenalArmed released a new report on Surendra Gadling's computer. They concluded that the *same* attacker infiltrated Gadling using emailed malware on February 29, 2016 – after two failed attempts, when Gadling didn't open the attachment.

22. Arsenal could track precisely how the malware moved deep into the system, executing scripts and creating hidden folders – which held the incriminating emails recovered by Pune police. The report is emphatic: These documents were delivered "by NetWire and not by other means”

23. On Wilson's laptop, too, at least 10 incriminating letters were placed in a hidden folder – after which the attacker made changes to cover their footsteps. The Arsenal report says there is no indication these files, or the folder, had ever been opened on his laptop.

24. This is the nature of the evidence for which the state has imprisoned the #BhimaKoregaon 16. Including Stan Swamy.
In February, after Arsenal's first report debunked the 'evidence' on Wilson's computer, defense lawyers rushed to move the High Court – to no avail.

25. In the four months since then, #StanSwamy grew increasingly ill, contracted Covid in prison, begged the Court for interim bail so he could go home, had a heart attack, and was put on a ventilator. He died yesterday.
His next bail hearing was scheduled for July 6. //

I hope this thread is helpful at laying out the humane, judicial and technological stakes of this case. It draws on reporting by @thewire_in's @sukanyashantha, @LiveLawIndia, @scroll_in, and @NihaMasih at the @washingtonpost, apart from @ArsenalArmed's report.