Bhima Koregaon: Report Finds Rona Wilson’s Hard Disk was Allegedly Tampered

New Delhi: In an investigation that could change the way the Bhima Koregaon case is being looked at, The Caravan magazine has found that human rights activist Rona Wilson’s hard disk, part of evidence that allegedly incriminates him, was tampered with.

It is important to note that the report has been filed by Anjaneya Sivan, a software engineer with the organisation and Martand Kaushik, a senior assistant editor at the magazine.

In a 5,000-page charge sheet, the Pune Police had claimed that Wilson’s hard disk allegedly contained a letter that detailed a plot to assassinate Prime Minister Narendra Modi and that it had intentions of overthrowing the government.

The case relates to alleged inflammatory speeches delivered at the 'Elgar Parishad' conclave, held at Shaniwarwada in Pune on December 31, 2017, which police claimed, triggered violence near the Koregaon Bhima war memorial located on the city's outskirts the next day. The Pune police has claimed the conclave was backed by Maoists and all the activists have also been accused of having Maoist links.

According to The Caravan’s report, Wilson’s hard disk had been infected with a malware that allows for remote access to his computer amid other discrepancies that amount to manipulation of evidence in the case.

In December 2019, the magazine had also reported discrepancies found on the hard disk of Suresh Gadling, a human rights lawyer who is among the nine people arrested in connection with the case. There is a difference, however. While a perfect clone of Wilson’s hard disk was provided to the court by the police, only incriminating files from Gadling’s disk were presented as evidence, says the report.

Wilson’s hard disk reportedly contained an executable file (file extension: *.exe) that was infected with a Win32: Trojan-Gen, “malware that can allow stealing of information such as usernames and passwords and, more importantly, allow remote access to the computer, which can then be used to plant files on a system.” The malware reportedly began operation as soon as the computer boots up and the report mentions that it leaves little doubt that it was operational on Wilson’s computer before the police had it in their possession, the report claims.

The investigation also revealed that ShellBag information, which tracks information about when folders are visited via Windows Explorer. It could indicate how often Wilson visited which folder on his computer and when and about which file was created by the system administrator (Wilson) himself, or planted by an external source (the malware). The information has since been deleted from the disk.

In addition, a history of the executable commands which the computer puts into action using the ‘Run’ feature on Windows has reportedly been wiped out. The report also mentions that a history of recent documents which would indicate files recently accessed from the hard disk by the computer has also been wiped clean. The magazine also found that the allegedly incriminating letters were written on the 2010 version of Microsoft Word. However, Wilson’s computer has the 2007 version of the text editing software and that the computer’s history does not indicate that he ever used the former version of the software.

The nine accused, mostly human rights activists, arrested in the Elgar Parishad-Maoist links case, were on Friday produced in a special court here, days after the National Investigation Agency (NIA) took over probe into the matter.

Rona Wilson, an human rights activist who works for the release of political prisoners, was arrested around 10 months ago and is lodged in Arthur Road jail in Mumbai, along with other human rights activists, all of whom have been booked under the draconian Unlawful Activities Prevention Act (UAPA). The Centre has now transferred the case from the Maharashtra government to the National Investigation Agency (NIA).

On February 28, all the accused -- Surendra Gadling, Mahesh Raut, Rona Wilson, Sudhir Dhawale, Varavara Rao, Arun Ferreira, Sudha Bharadwaj, Shoma Sen and Vernon Gonsalves -- appeared before the special NIA court in Mumbai for the first time. The next hearing is slated for March 13.