MUMBAI, India — Two days earlier than police lastly got here to arrest him, the Rev. Stan Swamy recorded a video of himself talking immediately into the digital camera.
“They need to put me out of the best way,” the ailing 83-year-old Jesuit priest stated.
His voice sounded frail. However what he was saying was explosive.
The federal government of Prime Minister Narendra Modi, he stated, was focusing on him in retaliation for his advocacy on behalf of Indigenous folks in Indian jails. A sociologist in addition to a Roman Catholic clergyman, Swamy had just lately printed a research of three,000 folks jailed for being members of banned Maoist teams. He discovered that 97% of them had no such affiliation and that lots of their trials have been held with out attorneys, in a language they did not perceive. He’d filed a case on their behalf within the state courtroom of Jharkhand, the place he lived. All of this had embarrassed the federal government, he stated.
Swamy’s workplace had since been raided a number of instances. Police hauled away a loaner laptop computer he’d just lately began utilizing after which got here again for his previous desktop laptop. They interrogated him for 15 hours over 5 days, he stated, a few terrorism plot he knew nothing about.
“Allow us to hope that some human sense will prevail,” he stated. “And if it doesn’t, I’m prepared.”
That video was recorded on Oct. 6, 2020. Two days later, Swamy was arrested, then imprisoned and repeatedly denied bail. Lower than a 12 months later, he was useless.
Born Stanislaus Lourduswamy within the southern state of Tamil Nadu, the priest was one in every of 16 outspoken Modi critics who have been jailed, one after the other, within the aftermath of 2018 caste riots in western India. All have been charged with terrorism offenses and conspiracy towards the state, after police investigating the riots uncovered what they described as a brazen plot to assassinate the prime minister.
Swamy’s 15 fellow prisoners included professors, attorneys, commerce unionists and members of an improv theater troupe that carried out skits poking enjoyable on the authorities. All 16 denied the fees towards them.
Swamy was accused of membership within the banned Communist Social gathering of India (Maoist), the identical faction that a number of the Indigenous folks he helped have been accused of being in. For many years, Maoist guerrillas have recruited from India’s Indigenous tribes and waged an insurgency towards the Indian state and its representatives — safety forces and elected leaders — in tribal areas the place Swamy labored.
The proof gave the impression to be damning: Letters and minutes of alleged terrorist cell conferences have been discovered on Swamy’s and his co-defendants’ computer systems. One of many letters proposed a suicide assault towards Modi.
However the suspects, their attorneys and unbiased specialists who’ve reviewed the proof on this case say the prisoners have been framed. They are saying somebody hacked into the suspects’ telephones and laptops and planted pretend proof on them.
Digital forensics investigators hint the hack again to Modi’s authorities. Indian police and authorities officers deny that. However the case has drawn condemnation from Human Rights Watch, Amnesty Worldwide, Catholic cardinals and bishops, and lots of different teams — in addition to scrutiny from a U.S. authorities fee and the United Nations.
“There have been instances of recordsdata being planted, after which like the subsequent day, the arrests went down. You could possibly go your complete profession on this trade and by no means discover one thing that is as apparent,” says Tom Hegel, a Washington-based cybersecurity professional who reviewed proof on this case. “It is a slam-dunk. That is fabricated.”
Greater than six years after the beginning of this case, the 15 remaining suspects are nonetheless awaiting trial. Seven have been granted bail. Eight stay in jail. And Modi is anticipated to win a 3rd time period, when election outcomes come out this week.
Swamy could have been the oldest individual ever charged with terrorism in India. What occurred to him is emblematic of what’s taking place to India underneath a democratically elected chief with autocratic tendencies. Beneath Modi, India has not solely stripped away authorized protections for minorities and those that search to defend them. It has additionally allegedly used cyberwarfare to assault them and silence them — with impunity.
This story has percolated for greater than six years. A lot of the digital forensics proof obtained by NPR and printed right here has additionally appeared in Indian media. However regardless of outrage from human rights teams and criticism from the United Nations, the US and Catholic Church officers, there was no reexamination of this case by Indian authorities.
Erosion of democracy on this planet’s largest one
Authorities-sponsored cyberhacking could also be frequent in authoritarian international locations like China or Russia. However India is the world’s largest democracy.
Some within the West could have been shocked by allegations that Indian diplomats have been concerned within the homicide of a Sikh separatist chief in Canada final 12 months and that different Indian officers could have been concerned in making an attempt to commit the same crime on U.S. soil.
However Freedom Home, a Washington-based nonprofit that measures democratic decline, classifies India as solely “partly free.” It says these concerned in investigating human rights abuses “face threats, authorized harassment, extreme police pressure, and sometimes deadly violence” themselves. It additionally accuses Modi’s Hindu nationalist authorities of politicizing the judiciary and denying its opponents due course of.
In March, one in every of Modi’s prime rivals, Arvind Kejriwal, chief of the opposition Aam Aadmi Social gathering, was jailed on bribery allegations. The most important opposition occasion, the Indian Nationwide Congress, had its financial institution accounts frozen in a tax dispute. The timing of each, simply earlier than voting started within the present elections, prompted the U.S. State Division to name for “well timed authorized processes” for every. These financial institution accounts have since been unfrozen, and Kejriwal has since been freed on bail, after lacking a number of weeks of campaigning and voting, in elections that final six weeks and during which voting occurs in phases.
Years earlier than this, although, the case that ensnared Swamy was an earlier bellwether for India’s democratic decline underneath Modi, his critics say.
It started with riots on the 2 hundredth anniversary of a uncommon victory for Indian minorities
The defendants on this case labored with three Indian minority teams: Indigenous folks, or Adivasis, who comprise greater than 8% of the inhabitants, or greater than 100 million folks; India’s 200 million Muslims, the nation’s largest spiritual minority, more and more demonized and marginalized underneath Modi’s Hindu nationalist rule; and people on the decrease rungs of South Asia’s caste hierarchy, together with about 200 million Dalits, who was once known as “untouchable” and have lengthy been shunned by different castes as such.
On New Yr’s Eve 2017, tens of hundreds of members of minority teams who supported left-wing events gathered en masse on the banks of the Bhima River in western India’s Maharashtra state. They have been there to rejoice the 2 hundredth anniversary, the next day, of a uncommon battlefield victory for Dalits.
Within the 1818 Battle of Bhima Koregaon, a ragtag military of Dalits and different oppressed folks fought a military of upper-caste elites known as Peshwas — and received. Greater than a century later, the battle impressed the creator of India’s Structure, B.R. Ambedkar, on his campaign to abolish untouchability and to write down affirmative motion into Indian legislation.
However when minority members amassed on the riverbank on the final night time of 2017 and first day of 2018, there have been counterdemonstrations by members of upper-caste teams, most of whom supported Modi’s right-wing occasion. Violence erupted after hundreds of Dalits recited a pledge, in unison, vowing to not vote for Modi within the 2019 elections. They known as his political occasion — in energy on the time on the state and nationwide ranges — a Hindu supremacist group.
“On reflection, that pledge was essential, really. … The federal government was scared,” says Anuradha Sonule, 35, a member of a theater troupe that carried out on the anniversary celebrations. “We gathered folks in amount.”
Her theater troupe, known as Kabir Kala Manch, is notorious in India. Most of its members are Dalit or Muslim activists, and a number of other had been out and in of jail for alleged affiliation with banned communist teams — even earlier than the 2018 battle anniversary.
Indians have historically voted alongside caste and clan traces. However Modi has modified that. He has sought to unite all Hindu voters. He comes from a lower-caste group himself, despite the fact that his Bharatiya Janata Social gathering (BJP) has upper-caste roots.
So it will need to have rattled the BJP, Sonule says, to see tens of hundreds of members of minority teams denouncing the prime minister on reside TV. This, in addition to the presence on the rally of well-known Modi detractors and dissidents, could have set in movement what occurred subsequent, she says.
A day after that pledge, on Jan. 1, 2018, riots broke out between rival demonstrators in villages alongside the Bhima River. Automobiles have been burned. Neighbors attacked each other alongside caste traces. At the very least one individual was killed, and dozens have been injured. It was by no means clear who began it.
Who was behind the riots?
One of many politicians who led that anti-Modi pledge from a stage on the rally believes the violence was not spontaneous.
“This was preplanned, and the federal government was concerned in it,” insists Prakash Ambedkar, Dalit chief B.R. Ambedkar’s grandson. Prakash Ambedkar leads a Dalit political occasion and has served three phrases in India’s Parliament.
He accuses the Maharashtra state department of Modi’s BJP of instigating the violence on the Bhima River after which blaming it on left-wing opponents — to be able to silence them forward of the 2019 election.
The state department of the BJP didn’t reply to NPR’s request for remark. However in an affidavit filed in courtroom, it stated the violence was a part of a left-wing conspiracy to show Dalits — a gaggle the BJP had been making inroads with — towards the occasion.
Police initally arrested two upper-caste males within the days after the riots, for allegedly instigating them. However a few week later, they have been launched and the instances towards them dropped. Then police arrested three members of Sonule’s left-wing theater troupe, and a brand new concept emerged.
“Someplace alongside the best way, police stopped wanting into all the opposite complaints and focused on this one grievance that stated the violence was a results of an enormous conspiracy by underground left-wing components,” says Shalini Gera, a lawyer for one of many different defendants. “And that is when the police began including terror costs.”
The suspects have been charged underneath India’s Illegal Actions (Prevention) Act, which permits authorities to grab property and maintain terrorism suspects with out bail. The U.S. State Division has cited the legislation in annual studies on India’s “vital human rights points.”
Because the investigation handed from native to federal authorities, they solid a wider internet. They began arresting individuals who had previous contact with rally attendees however weren’t current themselves. These included a few of India’s most well-known human rights activists — now often called the BK-16.
Stan Swamy was one in every of them.
Swamy had by no means been to Bhima Koregaon. That did not matter
Greater than a 12 months after the 2018 riots, Swamy known as the Mumbai legislation places of work of an previous acquaintance, Mihir Desai. The 2 had met within the Eighties, engaged on lawsuits filed by the households of coal miners killed on the job in jap India.
“He requested me, ‘What is that this Bhima Koregaon factor?’ He had no clue about it,” Desai recollects. “However the police have been at his door, interrogating him about it.”
On the time of the January 2018 riots, Swamy was on the opposite aspect of the nation, at his house within the jap state of Jharkhand. However police have been investigating whether or not he — as a distinguished advocate for Indigenous folks — could have incited his followers to violence, even from afar. In the summertime of 2018, his title began popping up on nationalist TV channels. Information anchors known as him an enemy of the state.
In October 2020, Swamy made his selfie video, denouncing the allegations.
“What is occurring to me shouldn’t be distinctive. We’re all conscious how distinguished intellectuals, attorneys, writers, poets, activists, pupil leaders are all put into jail simply because they’ve expressed their dissent or raised questions in regards to the ruling powers of India,” he stated into the digital camera. “I’m a part of it, a part of the sport, and able to pay the worth.”
Two days later, on Oct. 8, 2020, he was arrested.
How the Indian authorities sees this
Native and state police and federal authorities didn’t reply to a number of NPR requests for remark over a interval of almost three years, between Swamy’s July 2021 loss of life and the time of this publication. Neither did the Indian equal of the FBI, the Nationwide Investigation Company. A BJP spokesperson declined to talk with NPR on the document. The occasion has publicly denied any wrongdoing.
To Indian authorities, the Bhima Koregaon riots have been a thread they pulled at, which unraveled and led them to what they declare was an even bigger plot by leftists to overthrow Modi’s authorities. Not solely have been Maoists waging guerrilla battle towards the Indian state within the jungle, as that they had for years, however they now additionally had sympathizers — sleeper cells — in academia and human rights circles.
It is potential — even perhaps possible — that Swamy did have contact with Maoists in the middle of his work with India’s Indigenous tribes, his former colleagues say.
“It is tough to inform who’s a Maoist! You manage a gathering of 30, 40, 50 folks, and somebody will later say one of many guys within the again was a Maoist,” says the Rev. Joe Xavier, a fellow Jesuit and longtime affiliate of Swamy. “But when or when he came upon, Stan would have reduce ties. He would by no means knowingly affiliate with them.”
Individuals near him say it is unlikely, although, that Swamy might have typed up notes for Maoists within the type of the alleged minutes of terrorist cell conferences discovered by police on his laptop. They are saying he did not have the dexterity. He had Parkinson’s illness.
“He was a one-finger, gradual typist,” his lawyer Desai says.
Digital forensics analysts outdoors India say the proof was planted by hackers
Swamy’s computer systems are nonetheless in Indian police custody. However cloned copies have been shared together with his attorneys, who then shared the information with Arsenal Consulting, a Massachusetts-based digital forensics agency that has executed evaluation in different high-profile instances, together with the 2013 Boston Marathon bombing. (The agency says Swamy’s loaner laptop computer was clear; that will clarify why, attorneys say, police returned to grab his desktop laptop, on which incriminating proof was ultimately discovered.)
Arsenal shared its professional bono evaluation of Swamy’s desktop laptop with NPR. (It was first shared with The Washington Submit in late 2022. Different studies have been shared with Wired journal.)
The Arsenal report about Swamy’s laptop is a 25-page technical doc that protection attorneys have submitted to the courtroom. It concludes: “This is likely one of the most critical instances involving proof tampering that Arsenal has ever encountered.”
Listed below are the report’s principal findings:
- It began as a phishing assault. On Oct. 19, 2014, Swamy opened a doc that had been weaponized with NetWire, a kind of malware. For almost 5 years after that, the hacker or hackers had entry to Swamy’s laptop.
- Beginning in July 2017, the hacker dropped dozens of recordsdata right into a hidden folder on Swamy’s machine. These are the alleged minutes of terrorist cell conferences that police later uncovered. Swamy by no means opened them and was most likely unaware they have been there.
- Whoever did that is most likely the identical hacker who infiltrated the computer systems of at the very least three of Swamy’s co-defendants. The hacker used the identical malware, linked to the identical servers. In Swamy’s case, although, the hacker inserted profanity — in English — into the coding.
- The night time earlier than Swamy’s computer systems have been confiscated by police, in June 2019, the hacker tried to cowl up his or her digital footprints — erasing malware and surveillance knowledge.
Desai, the lawyer, calls that timing “very, very, suspicious.”
“The one individuals who knew his home was going to be raided was the Nationwide Investiga[tion] Company,” he says. “So except they knowledgeable the hacker — or except they’re the hacker — this does not make sense some other method.”
The NIA didn’t reply to NPR’s request for remark. In courtroom paperwork, it alleges Swamy was extra laptop savvy than he appeared, and took steps to encrypt his personal messages. However the NIA has not publicly addressed the timing of its raids.
Arsenal was unable to establish the hacker or hackers. However another person would possibly.
The work of this hacker appeared acquainted
Tom Hegel, a Washington-based menace researcher with the cybersecurity agency SentinelOne, reviewed Arsenal’s evaluation of Swamy’s desktop laptop and stated the hacker appears acquainted. It appears like a “menace actor” — a person or a collective — he has tracked for years and given a reputation: ModifiedElephant.
“It is virtually like a safari. I pursue completely different species of hackers and categorize them,” Hegel explains. “We created the ModifiedElephant menace actor title to discuss with a decade of exercise towards 100 people in India, unfold throughout journalism, human rights defenders, academia — and even authorized professionals tied to the BK-16.”
Simply as with Swamy, the ModifiedElephant hacker usually makes use of phishing to plant malware on a sufferer’s machine. As soon as it will get entry, it operates like a distant administrator, taking up the pc, sending emails and planting recordsdata, or erasing current ones.
“Then the police arrest these people and do their quote-unquote ‘forensics’ on the units and say, ‘Hey, we discovered this Phrase doc that is a plot to assassinate PM Modi — you are responsible of that,'” Hegel says. “Nonetheless, you’ll be able to show that file got here by means of the session that was operated by this ModifiedElephant attacker. This might by no means be executed legitimately by a person.”
After monitoring a decade of ModifiedElephant’s conduct and contemplating the identities of its targets, Hegel says he thinks it is a group of hackers who’re both a part of the Indian authorities or third-party contractors employed by it.
“All of this does tie again, excessive confidence, to the Indian authorities,” he says.
The Indian authorities denies that. Officers from the BJP declined to talk on the document. However primarily based on background conversations with these aware of their considering, their view seems to be this: Even when Swamy was hacked, there isn’t any proof it got here from the prime minister, or that Modi even knew about it. It might have been some renegade hacker, unaffiliated with the occasion or authorities, whom authorities officers do not know.
Hegel is one in every of a number of cyberthreat specialists who’ve reviewed Arsenal’s findings, executed their very own professional bono evaluation of proof on this case and shared their conclusions with NPR. In addition they embody officers from the Citizen Lab, a nonprofit affiliated with the College of Toronto, and Amnesty Worldwide’s know-how department, known as Amnesty Tech.
Hegel, from SentinelOne, traced the malware discovered on Swamy’s desktop laptop to backup electronic mail addresses and restoration cellphone numbers related to the cops who arrested Swamy. The server and IP handle that these cops use was additionally utilized by the hacker, he says.
“That was the smoking gun,” Hegel says. “It is just like the crown jewel of examples of this operator having a way of impunity.”
Researchers from the Citizen Lab additionally matched a selfie used because the profile picture on the WhatsApp account for a kind of cellphone numbers to the face of a police officer who appeared at information conferences involving the BK-16 and in information footage of the arrest of one in every of Swamy’s co-defendants.
NPR has not been in a position to independently confirm the id of anybody who allegedly hacked Swamy.
In India, response has been muted
A lot of this has already been reported in India. However there hasn’t been a lot blowback. No one has resigned. Police haven’t been fired and even investigated. They have not responded to NPR’s interview requests about Swamy, going again to his 2021 loss of life, or in regards to the alleged hacking, going again to September 2023.
In the meantime, Indian attorneys and journalists wanting into this case are amongst dozens or tons of of folks in India who’ve discovered Pegasus adware on their units. It is a surveillance instrument that is made by an Israeli firm and used solely by governments. The Indian authorities has refused to substantiate or deny whether or not it makes use of Pegasus. (NPR has not but submitted its personal units for evaluation of whether or not they could have been contaminated with Pegasus throughout this reporting.)
At the very least one of many BK-16 defendants, activist Rona Wilson, had a smartphone that was contaminated with Pegasus earlier than his arrest, in response to a separate forensic evaluation by Amnesty Worldwide’s Safety Lab.
“There’s a actually worrying, disturbing sample of adware assaults in India,” says Becka White, a campaigner with Amnesty Tech. “It is a part of a broader sample of dissent being crushed, freedom of expression being stifled, folks talking fact to energy and being focused.”
NPR is quoting specialists outdoors India right here as a result of many within the nation stated they have been too scared to talk on the document.
Lately, Indian tax authorities have raided the BBC’s places of work in Delhi and Mumbai, frozen financial institution accounts for worldwide charities and pressured Amnesty Worldwide in another country. An Indian expatriate working in Europe for a giant human rights group declined to talk to NPR for the radio model of this story except their voice could possibly be disguised.
Swamy died earlier than he might clear his title. His co-defendants are nonetheless awaiting justice
In the summertime of 2021, one other of the BK-16, Sudha Bharadwaj — a mathematician turned lawyer who additionally labored with India’s Indigenous tribes — acquired a letter from Swamy, written in a shaky hand. They have been each incarcerated, at completely different prisons, the place letters arrived after an extended delay. Bharadwaj was launched on bail in December 2021 and confirmed the letter to NPR.
Swamy started the letter by asking in regards to the well being of his co-defendants. Indian prisons are notoriously overcrowded, and this was on the peak of the COVID-19 pandemic.
“Hoping each of you may be nicely quickly,” Swamy wrote, referring to Bharadwaj and Shoma Sen, one other of the BK-16 who was in the identical ladies’s jail. (Sen was freed on bail in April after almost six years behind bars.) “All of us should outlive the essential interval we’re going by means of. Lots of people are in solidarity with us. However lastly, we’re those to plough by means of the rugged subject.”
“Now we have to survive,” Bharadwaj repeats the phrases as she reads aloud Swamy’s final letter.
They have been a few of his final phrases.
Later that summer season, Swamy’s well being deteriorated. He was transferred out of jail and right into a Mumbai hospital. On July 5, he died of cardiac arrest, problems from COVID-19, Parkinson’s and, his attorneys say, dismal jail circumstances. He was 84.
His loss of life made headlines in India and overseas. His physique was cremated, in accordance with hospital guidelines throughout the pandemic. A few of his ashes have been taken on tour throughout India after which scattered at Bagaicha, a social motion middle for Indigenous folks in Jharkhand the place Swamy had lived. His Catholic order, the Jesuits, held a memorial ceremony in Rome.
Swamy’s loss of life “will eternally stay a stain on India’s human rights document,” Mary Lawlor, the U.N. particular rapporteur on human rights defenders, stated in a press release.
A few of Swamy’s ashes have been additionally buried in a small cemetery, ringed by vibrant pink bougainvillea flowers, outdoors a Jesuit chapel in northern Mumbai, close to the hospital the place he died. That is the place NPR met one of many final folks to see him alive.
Jail guards had been current in Swamy’s hospital room. However they allowed one in every of his fellow clergymen to enter. The Rev. Frazer Mascarenhas says he discovered Swamy calm and unafraid.
“He was completely assured of the legislation,” Mascarenhas recollects. “He was assured that the Indian judiciary and structure would see him and his folks by means of.”
Freelance producer Shweta Desai contributed to this story from Mumbai and Pune, India.