Hacker-for-hire gang with links to Pune police planted emails on the computers of Bhima Koregaon accused: new book

The mercenary hacker gang, headquartered in India, remotely implanted evidence, according to LSE professor’s book; cites cybersecurity researchers to claim gang’s connection to a Pune police officer

The evidence used to allegedly incarcerate the 16 persons in the Bhima Koregaon case was “likely to have been implanted remotely through a hacker-for-hire mercenary gang infrastructure that has clients all over the world, but whose epicentre is in India, a new book has claimed. | Photo Credit: Special Arrangement

The alleged evidence used to incarcerate 16 people in the Bhima Koregaon case was “likely to have been implanted remotely through a hacker-for-hire mercenary gang infrastructure that has clients all over the world, but whose epicentre is in India,” according to claims made in a new book.

In her book, The Incarcerations: Bhima Koregaon And The Search For Democracy In India, London School of Economics anthropology professor Alpa Shah draws from interviews with cyber security analysts and researchers to allege that the hacker gang was connected to a Pune police officer. In the book, she elaborates on the role of the police in hacking into the computers of at least three of the accused at Bhima Koregaon, and planting the emails and files that were used to implicate them.

Ms. Shah says that the 16 arrests were used to divert attention away from the Hindutva instigators of a communal riot targeting Dalits, which took place on January 1, 2018 at Bhima Koregaon in Maharashtra.

‘Hackers linked to police’

As reported earlier by The Hindu in December 2022, U.S.-based digital forensics firm Arsenal Consulting had found that the computers belonging to the late Father Stan Swamy, and his co-accused Rona Wilson and Surendra Gadling in the Bhima Koregaon caste violence case, were compromised by the same attacker. On February 10, 2021, the same consultancy had found that a hacker had controlled Mr. Wilson’s computer for a period of 22 months to plant documents, which led to an investigation that supposedly unravelled a Communist Party of India (Maoist) conspiracy to eliminate Prime Minister Narendra Modi “in another Rajiv Gandhi type incident”.

Ms. Shah writes that a security analyst working with an e-mail provider enabled Andy Greenberg, a U.S.-based cyber security journalist, to connect the hackers to an officer in Pune’s police force. In June 2022, Mr. Greenberg had published new research by SentinelOne, a California based cyber security company, on a long-running hacking campaign which targeted hundreds of activists, journalists, academics and lawyers in India from as far back as 2012. Those associated with the Bhima Koregaon case were notable targets.

‘Shockingly brazen’

“These guys are not going after terrorists. They’re going after human rights defenders and journalists. And it’s not right,” the security analyst is quoted as saying.

The book also quotes Mr. Greenberg as saying, “I cover a ton of state-sponsored hacking stories and usually figuring out who did it incredibly complex. The actual identity of a hacker, figuring out which government agency is tied to a hacking operation, is like a Holy Grail. It’s a very difficult thing to prove. To see this person just put their name and contact information in the backup for these email accounts, it was so bizarre. It was such a shockingly brazen thing to do.”

‘Targeting custodians of democracy’

Ms. Shah writes that sixteen largely unconnected people from different parts of India found themselves thrown into jail between 2018 and 2020, accused of being Maoist terrorists and ‘urban naxals’. She notes that they are all custodians of democracy; people who had persistently supported grassroots social movements against rising inequality, land grabs, and State atrocities; and protectors of environmental, land, and forest rights.

In 2018, the Pune police arrested Sudha Bharadwaj, Shoma Sen, Surendra Gadling, Mahesh Raut, Arun Ferreira, Sudhir Dhawale, Rona Wilson, Vernon Gonsalves, and Varavara Rao, for their alleged involvement in the Bhima Koregaon riots, based on a complaint lodged by a local builder, Tushar Damgude.

He alleged that members of the CPI (Maoist) and the Kabir Kala Manch spread hatred through provocative songs, plays, and speeches delivered at the Elgar Parishad held at Shaniwar Wada in Pune on December 31, 2017. The police claimed that the event triggered violence the next day near the Koregaon Bhima war memorial located on the outskirts of Pune.

The case, initially investigated by the Pune police, was transferred to the National Investigation Agency on January 24, 2020.

After NIA took over the investigation, it also arrested civil rights campaigner Gautam Navlakh; Anand Teltumbde, an engineer and IIM graduate who taught at IIT Kharagpur; Hany Babu, an associate professor at Delhi University; and Jyoti Jagtap, Sagar Gorkhe, and Ramesh Gaichor, all members of the Kabir Kala Manch, a cultural organisation.