[Bhima Koregaon case] Computer of Rona Wilson was compromised, malware planted from outside: US Forensic Firm report

A US-based forensic consulting firm has prepared a report in connection with the Bhima Koregaon case, stating that the computer which was seized from one of the accused, Rona Wilson, was compromised due to an attack from a significant malware infrastructure deployed over a period of almost two years.

. Wilson is accused of instigating violence that marred the 2018 celebrations of the Battle of Koregaon. The Battle that took place in 1818 had resulted in the victory of the East India Company's regiment - which contained members of the Mahar caste - over the Peshwa faction of the Maratha confederacy.

Wilson, who was arrested in June 2018, has also been accused of participating in a conspiracy to assassinate Prime Minister Narendra Modi and to overthrow the government. This case is currently being investigated by the National Investigation Agency (NIA).

. Massachusetts-based firm Arsenal Consulting was appointed by Wilson's lawyers to analyse the electronic evidence seized from his home by the Pune Police in 2018.

It received a hard drive on July 31, 2020 containing several forensic images and police work related to Wilson and the co-accused in the case.

. The Arsenal report states that the malware was deployed not only to attack and compromise Wilson's computer for twenty-two months, but also to attack his co-defendants in the Bhima Koregaon case.

. "It should be noted that this is one of the most serious cases involving evidence tampering that Arsenal has ever encountered, based on various metrics which include the vast timespan between the delivery of the first and the last incriminating documents," the report reads. . According to the report, Wilson's computer was compromised after a series of suspicious emails sent by someone using Dr. Varavara Rao's email account. 82-year-old Rao is a co-accused in the case.

. The emails contained a particular document, which once opened by Wilson, planted a trojan (digital malware) on his computer. Five such trojan samples were found by Arsenal on Wilson's computer, the report has said.

. Importantly, the report claims that while looking for various documents created on Wilson's computer through Microsoft Word, Arsenal found that Wilson's computer had the 2007 version of Microsoft word and there was no evidence to suggest that Wilson's computer had the 2010 or 2013 version of Microsoft Word.

. This was important since most of the incriminating documents alleged to have been recovered from Wilson's computer was saved as Portable Document Format documents (PDFs) from Microsoft Word 2010 and 2013.

. Arsenal also found nothing on the computer to suggest that the top ten most important documents used by the NIA against Wilson were ever integrated with in any legitimate way on Wilson's computer.

"There is no evidence which would suggest any of the top ten documents, or the hidden folder they were contained in, were ever opened."

. Arsenal has concluded the report by stating that with more time and resources, they could possibly track down what were the exact actions that the attacker took on the computer.

They have also submitted that they could perform a more thorough analysis of forensic images and other data related to the co-accused in the Bhima Koregaon case.

. [Read Arsenal report here]

[Bhima Koregaon case] Computer of Rona Wilson was compromised, malware planted from outside: US Forensic Firm report

Neha Joshi

Related Stories