Like Rona’s, Gadling’s computer too attacked with malware: US lab report

MUMBAI: Over four months after its first cyber forensic report of alleged malware attack on Elgar Parishad case accused Rona Wilson’s laptop, a US-based consultant recently said the computer of co-accused Surendra Gadling was similarly “compromised”.
The June 21 report of Arsenal Consulting said a computer belonging to Gadling, a human rights lawyer from Nagpur, was attacked with NetWire, a “malware”, for nearly two years before his arrest on June 6, 2018. Accused of alleged Maoist links, Gadling was also charged under the stringent Unlawful Activities (Prevention) Act.
Gadling’s defence team had sent electronic evidence seized on April 17, 2018, from his home by Pune Police. According to his lawyers, his computer was “first compromised” on February 29, 2016. The report's ‘executive summary’ said “Gadling’s computer was compromised for just over 20 months by the same attacker identified in Reports I and II”. “It is obvious that their primary goals were surveillance and incriminating document delivery. Arsenal has effectively caught the attacker red-handed based on remnants of their activity left behind in file system,’’ it added.
Wilson, also a human rights activist, incarcerated since his arrest in June 2018, had in February approached the HC to quash the criminal prosecution against him citing the February 8 Arsenal report. The report had said his computer was “compromised’’ for 22 months and the “top 10 incriminating documents” delivered to it via malware. His petition is pending before the HC. Wilson said that the 22,000-page chargesheet shows that prosecution against 16 accused— now 15, following Fr Stan Swamy’s demise on Monday—is based “entirely on electronic evidence”. The case had been transferred to the NIA in January 2020.
The March 27 Arsenal report had said that Gadling’s computer was first compromised on February 29, 2016. The attacker made three particularly relevant attempts at compromising his computer via email, sending him identical malware, but packaged differently, on February 12 (two emails), and February 18, 2016, it had added.
In its June 21 report, the US-based consultant said, “Arsenal has connected the same attacker to a significant malware infrastructure which was deployed over the course of approximately four years to not only attack and compromise Gadling’s computer for 20 months, but to attack his co-defendants…and defendants in other high-profile Indian cases as well.”
Arsenal has also recovered communications with the attacker’s command and control server from Gadling’s computer.
In conclusion, it added: “It should be noted that this is one of the most serious cases involving evidence tampering that Arsenal has ever encountered, based on various metrics which include the vast timespan between the delivery of the first and last incriminating documents on multiple defendants computers.”
Gadling’s defence team had sent electronic evidence seized on April 17, 2018, from his home by Pune Police. The team informed Arsenal that “14 documents” from his computer were “particularly important in this case”. The Arsenal report said it “found no evidence which would suggest that the 14 important documents were ever interacted with in any legitimate way on Gadling’s computer, either in their original location on the tertiary volume or in their current location on the Windows volume.”
“Arsenal produced two reports in this case related to Wilson (Report I on February 8, 2021, and Report II on March 27, 2021) and was then asked by Gadling’s defence team to produce a report regarding our analysis of electronic evidence seized from his home,” said Mark Spencer, president of Arsenal in Chelsea, in the report.
Senior counsel Indira Jainsing, who appeared for Gadling in a matter on Tuesday, told TOI, “We have seen the Arsenal report. Legal action will be pursued on the basis of remedies available in law.” When contacted, additional solicitor general Anil Singh, who appears for NIA in the various petitions filed by Elgar Parishad case accused before the HC, told TOI, “I have not seen the US forensic report.” Questioning its value at this juncture, he added, “It can be tested or gone into during the trial.”