MUMBAI, India — Two days earlier than police lastly got here to arrest him, the Rev. Stan Swamy recorded a video of himself talking immediately into the digicam.
“They need to put me out of the best way,” the ailing 83-year-old Jesuit priest stated.
His voice sounded frail. However what he was saying was explosive.
The federal government of Prime Minister Narendra Modi, he stated, was focusing on him in retaliation for his advocacy on behalf of Indigenous individuals in Indian jails. A sociologist in addition to a Roman Catholic clergyman, Swamy had lately revealed a research of three,000 individuals jailed for being members of banned Maoist teams. He discovered that 97% of them had no such affiliation and that a lot of their trials have been held with out attorneys, in a language they did not perceive. He’d filed a case on their behalf within the state court docket of Jharkhand, the place he lived. All of this had embarrassed the federal government, he stated.
Swamy’s workplace had since been raided a number of occasions. Police hauled away a loaner laptop computer he’d lately began utilizing after which got here again for his previous desktop laptop. They interrogated him for 15 hours over 5 days, he stated, a few terrorism plot he knew nothing about.
“Allow us to hope that some human sense will prevail,” he stated. “And if it doesn’t, I’m prepared.”
That video was recorded on Oct. 6, 2020. Two days later, Swamy was arrested, then imprisoned and repeatedly denied bail. Lower than a 12 months later, he was useless.
Born Stanislaus Lourduswamy within the southern state of Tamil Nadu, the priest was one in all 16 outspoken Modi critics who have been jailed, one after the other, within the aftermath of 2018 caste riots in western India. All have been charged with terrorism offenses and conspiracy in opposition to the state, after police investigating the riots uncovered what they described as a brazen plot to assassinate the prime minister.
Swamy’s 15 fellow prisoners included professors, attorneys, commerce unionists and members of an improv theater troupe that carried out skits poking enjoyable on the authorities. All 16 denied the fees in opposition to them.
Swamy was accused of membership within the banned Communist Celebration of India (Maoist), the identical faction that among the Indigenous individuals he helped have been accused of being in. For many years, Maoist guerrillas have recruited from India’s Indigenous tribes and waged an insurgency in opposition to the Indian state and its representatives — safety forces and elected leaders — in tribal areas the place Swamy labored.
The proof seemed to be damning: Letters and minutes of alleged terrorist cell conferences have been discovered on Swamy’s and his co-defendants’ computer systems. One of many letters proposed a suicide assault in opposition to Modi.
However the suspects, their attorneys and unbiased specialists who’ve reviewed the proof on this case say the prisoners have been framed. They are saying somebody hacked into the suspects’ telephones and laptops and planted faux proof on them.
Digital forensics investigators hint the hack again to Modi’s authorities. Indian police and authorities officers deny that. However the case has drawn condemnation from Human Rights Watch, Amnesty Worldwide, Catholic cardinals and bishops, and lots of different teams — in addition to scrutiny from a U.S. authorities fee and the United Nations.
“There have been circumstances of information being planted, after which like the following day, the arrests went down. You possibly can go your entire profession on this business and by no means discover one thing that is as apparent,” says Tom Hegel, a Washington-based cybersecurity professional who reviewed proof on this case. “It is a slam-dunk. That is fabricated.”
Greater than six years after the beginning of this case, the 15 remaining suspects are nonetheless awaiting trial. Seven have been granted bail. Eight stay in jail. And Modi is predicted to win a 3rd time period, when election outcomes come out this week.
Swamy could have been the oldest particular person ever charged with terrorism in India. What occurred to him is emblematic of what’s occurring to India underneath a democratically elected chief with autocratic tendencies. Underneath Modi, India has not solely stripped away authorized protections for minorities and those that search to defend them. It has additionally allegedly used cyberwarfare to assault them and silence them — with impunity.
This story has percolated for greater than six years. Many of the digital forensics proof obtained by NPR and revealed right here has additionally appeared in Indian media. However regardless of outrage from human rights teams and criticism from the United Nations, the USA and Catholic Church officers, there was no reexamination of this case by Indian authorities.
Erosion of democracy on the planet’s largest one
Authorities-sponsored cyberhacking could also be frequent in authoritarian nations like China or Russia. However India is the world’s greatest democracy.
Some within the West could have been shocked by allegations that Indian diplomats have been concerned within the homicide of a Sikh separatist chief in Canada final 12 months and that different Indian officers could have been concerned in making an attempt to commit an identical crime on U.S. soil.
However Freedom Home, a Washington-based nonprofit that measures democratic decline, classifies India as solely “partly free.” It says these concerned in investigating human rights abuses “face threats, authorized harassment, extreme police power, and sometimes deadly violence” themselves. It additionally accuses Modi’s Hindu nationalist authorities of politicizing the judiciary and denying its opponents due course of.
In March, one in all Modi’s high rivals, Arvind Kejriwal, chief of the opposition Aam Aadmi Celebration, was jailed on bribery allegations. The most important opposition occasion, the Indian Nationwide Congress, had its financial institution accounts frozen in a tax dispute. The timing of each, simply earlier than voting started within the present elections, prompted the U.S. State Division to name for “well timed authorized processes” for every. These financial institution accounts have since been unfrozen, and Kejriwal has since been freed on bail, after lacking a number of weeks of campaigning and voting, in elections that final six weeks and wherein voting occurs in phases.
Years earlier than this, although, the case that ensnared Swamy was an earlier bellwether for India’s democratic decline underneath Modi, his critics say.
It started with riots on the 2 hundredth anniversary of a uncommon victory for Indian minorities
The defendants on this case labored with three Indian minority teams: Indigenous individuals, or Adivasis, who comprise greater than 8% of the inhabitants, or greater than 100 million individuals; India’s 200 million Muslims, the nation’s largest non secular minority, more and more demonized and marginalized underneath Modi’s Hindu nationalist rule; and people on the decrease rungs of South Asia’s caste hierarchy, together with about 200 million Dalits, who was known as “untouchable” and have lengthy been shunned by different castes as such.
On New 12 months’s Eve 2017, tens of hundreds of members of minority teams who supported left-wing events gathered en masse on the banks of the Bhima River in western India’s Maharashtra state. They have been there to have a good time the 2 hundredth anniversary, the next day, of a uncommon battlefield victory for Dalits.
Within the 1818 Battle of Bhima Koregaon, a ragtag military of Dalits and different oppressed individuals fought a military of upper-caste elites known as Peshwas — and received. Greater than a century later, the battle impressed the creator of India’s Structure, B.R. Ambedkar, on his campaign to abolish untouchability and to jot down affirmative motion into Indian regulation.
However when minority members amassed on the riverbank on the final evening of 2017 and first day of 2018, there have been counterdemonstrations by members of upper-caste teams, most of whom supported Modi’s right-wing occasion. Violence erupted after hundreds of Dalits recited a pledge, in unison, vowing to not vote for Modi within the 2019 elections. They known as his political occasion — in energy on the time on the state and nationwide ranges — a Hindu supremacist group.
“Looking back, that pledge was vital, really. … The federal government was scared,” says Anuradha Sonule, 35, a member of a theater troupe that carried out on the anniversary celebrations. “We gathered individuals in amount.”
Her theater troupe, known as Kabir Kala Manch, is notorious in India. Most of its members are Dalit or Muslim activists, and a number of other had been out and in of jail for alleged affiliation with banned communist teams — even earlier than the 2018 battle anniversary.
Indians have historically voted alongside caste and clan traces. However Modi has modified that. He has sought to unite all Hindu voters. He comes from a lower-caste neighborhood himself, though his Bharatiya Janata Celebration (BJP) has upper-caste roots.
So it should have rattled the BJP, Sonule says, to see tens of hundreds of members of minority teams denouncing the prime minister on stay TV. This, in addition to the presence on the rally of well-known Modi detractors and dissidents, could have set in movement what occurred subsequent, she says.
A day after that pledge, on Jan. 1, 2018, riots broke out between rival demonstrators in villages alongside the Bhima River. Automobiles have been burned. Neighbors attacked each other alongside caste traces. Not less than one particular person was killed, and dozens have been injured. It was by no means clear who began it.
Who was behind the riots?
One of many politicians who led that anti-Modi pledge from a stage on the rally believes the violence was not spontaneous.
“This was preplanned, and the federal government was concerned in it,” insists Prakash Ambedkar, Dalit chief B.R. Ambedkar’s grandson. Prakash Ambedkar leads a Dalit political occasion and has served three phrases in India’s Parliament.
He accuses the Maharashtra state department of Modi’s BJP of instigating the violence on the Bhima River after which blaming it on left-wing opponents — with the intention to silence them forward of the 2019 election.
The state department of the BJP didn’t reply to NPR’s request for remark. However in an affidavit filed in court docket, it stated the violence was a part of a left-wing conspiracy to show Dalits — a bunch the BJP had been making inroads with — in opposition to the occasion.
Police initally arrested two upper-caste males within the days after the riots, for allegedly instigating them. However a few week later, they have been launched and the circumstances in opposition to them dropped. Then police arrested three members of Sonule’s left-wing theater troupe, and a brand new concept emerged.
“Someplace alongside the best way, police stopped trying into all the opposite complaints and focused on this one grievance that stated the violence was a results of a large conspiracy by underground left-wing components,” says Shalini Gera, a lawyer for one of many different defendants. “And that is when the police began including terror expenses.”
The suspects have been charged underneath India’s Illegal Actions (Prevention) Act, which permits authorities to grab property and maintain terrorism suspects with out bail. The U.S. State Division has cited the regulation in annual reviews on India’s “vital human rights points.”
Because the investigation handed from native to federal authorities, they solid a wider web. They began arresting individuals who had previous contact with rally attendees however weren’t current themselves. These included a few of India’s most well-known human rights activists — now often known as the BK-16.
Stan Swamy was one in all them.
Swamy had by no means been to Bhima Koregaon. That did not matter
Greater than a 12 months after the 2018 riots, Swamy known as the Mumbai regulation places of work of an previous acquaintance, Mihir Desai. The 2 had met within the Eighties, engaged on lawsuits filed by the households of coal miners killed on the job in jap India.
“He requested me, ‘What is that this Bhima Koregaon factor?’ He had no clue about it,” Desai recollects. “However the police have been at his door, interrogating him about it.”
On the time of the January 2018 riots, Swamy was on the opposite facet of the nation, at his residence within the jap state of Jharkhand. However police have been investigating whether or not he — as a outstanding advocate for Indigenous individuals — could have incited his followers to violence, even from afar. In the summertime of 2018, his title began popping up on nationalist TV channels. Information anchors known as him an enemy of the state.
In October 2020, Swamy made his selfie video, denouncing the allegations.
“What is going on to me isn’t distinctive. We’re all conscious how outstanding intellectuals, attorneys, writers, poets, activists, pupil leaders are all put into jail simply because they’ve expressed their dissent or raised questions concerning the ruling powers of India,” he stated into the digicam. “I’m a part of it, a part of the sport, and able to pay the value.”
Two days later, on Oct. 8, 2020, he was arrested.
How the Indian authorities sees this
Native and state police and federal authorities didn’t reply to a number of NPR requests for remark over a interval of almost three years, between Swamy’s July 2021 demise and the time of this publication. Neither did the Indian equal of the FBI, the Nationwide Investigation Company. A BJP spokesperson declined to talk with NPR on the document. The occasion has publicly denied any wrongdoing.
To Indian authorities, the Bhima Koregaon riots have been a thread they pulled at, which unraveled and led them to what they declare was an even bigger plot by leftists to overthrow Modi’s authorities. Not solely have been Maoists waging guerrilla conflict in opposition to the Indian state within the jungle, as that they had for years, however they now additionally had sympathizers — sleeper cells — in academia and human rights circles.
It is attainable — maybe even probably — that Swamy did have contact with Maoists in the middle of his work with India’s Indigenous tribes, his former colleagues say.
“It is tough to inform who’s a Maoist! You set up a gathering of 30, 40, 50 individuals, and somebody will later say one of many guys within the again was a Maoist,” says the Rev. Joe Xavier, a fellow Jesuit and longtime affiliate of Swamy. “But when or when he came upon, Stan would have lower ties. He would by no means knowingly affiliate with them.”
Individuals near him say it is unlikely, although, that Swamy might have typed up notes for Maoists within the type of the alleged minutes of terrorist cell conferences discovered by police on his laptop. They are saying he did not have the dexterity. He had Parkinson’s illness.
“He was a one-finger, sluggish typist,” his lawyer Desai says.
Digital forensics analysts exterior India say the proof was planted by hackers
Swamy’s computer systems are nonetheless in Indian police custody. However cloned copies have been shared along with his attorneys, who then shared the info with Arsenal Consulting, a Massachusetts-based digital forensics agency that has accomplished evaluation in different high-profile circumstances, together with the 2013 Boston Marathon bombing. (The agency says Swamy’s loaner laptop computer was clear; that will clarify why, attorneys say, police returned to grab his desktop laptop, on which incriminating proof was ultimately discovered.)
Arsenal shared its professional bono evaluation of Swamy’s desktop laptop with NPR. (It was first shared with The Washington Publish in late 2022. Different reviews have been shared with Wired journal.)
The Arsenal report about Swamy’s laptop is a 25-page technical doc that protection attorneys have submitted to the court docket. It concludes: “This is without doubt one of the most critical circumstances involving proof tampering that Arsenal has ever encountered.”
Listed here are the report’s fundamental findings:
- It began as a phishing assault. On Oct. 19, 2014, Swamy opened a doc that had been weaponized with NetWire, a kind of malware. For almost 5 years after that, the hacker or hackers had entry to Swamy’s laptop.
- Beginning in July 2017, the hacker dropped dozens of information right into a hidden folder on Swamy’s machine. These are the alleged minutes of terrorist cell conferences that police later uncovered. Swamy by no means opened them and was in all probability unaware they have been there.
- Whoever did that is in all probability the identical hacker who infiltrated the computer systems of at the very least three of Swamy’s co-defendants. The hacker used the identical malware, linked to the identical servers. In Swamy’s case, although, the hacker inserted profanity — in English — into the coding.
- The evening earlier than Swamy’s computer systems have been confiscated by police, in June 2019, the hacker tried to cowl up his or her digital footprints — erasing malware and surveillance knowledge.
Desai, the lawyer, calls that timing “very, very, suspicious.”
“The one individuals who knew his home was going to be raided was the Nationwide Investiga[tion] Company,” he says. “So until they knowledgeable the hacker — or until they’re the hacker — this does not make sense some other method.”
The NIA didn’t reply to NPR’s request for remark. In court docket paperwork, it alleges Swamy was extra laptop savvy than he appeared, and took steps to encrypt his personal messages. However the NIA has not publicly addressed the timing of its raids.
Arsenal was unable to determine the hacker or hackers. However another person may.
The work of this hacker seemed acquainted
Tom Hegel, a Washington-based menace researcher with the cybersecurity agency SentinelOne, reviewed Arsenal’s evaluation of Swamy’s desktop laptop and stated the hacker seems acquainted. It seems like a “menace actor” — a person or a collective — he has tracked for years and given a reputation: ModifiedElephant.
“It is nearly like a safari. I pursue totally different species of hackers and categorize them,” Hegel explains. “We created the ModifiedElephant menace actor title to discuss with a decade of exercise in opposition to 100 people in India, unfold throughout journalism, human rights defenders, academia — and even authorized professionals tied to the BK-16.”
Simply as with Swamy, the ModifiedElephant hacker typically makes use of phishing to plant malware on a sufferer’s gadget. As soon as it will get entry, it operates like a distant administrator, taking up the pc, sending emails and planting information, or erasing present ones.
“Then the police arrest these people and do their quote-unquote ‘forensics’ on the units and say, ‘Hey, we discovered this Phrase doc that is a plot to assassinate PM Modi — you are responsible of that,'” Hegel says. “Nevertheless, you possibly can show that file got here by the session that was operated by this ModifiedElephant attacker. This might by no means be accomplished legitimately by a person.”
After monitoring a decade of ModifiedElephant’s habits and contemplating the identities of its targets, Hegel says he thinks it is a group of hackers who’re both a part of the Indian authorities or third-party contractors employed by it.
“All of this does tie again, excessive confidence, to the Indian authorities,” he says.
The Indian authorities denies that. Officers from the BJP declined to talk on the document. However primarily based on background conversations with these accustomed to their pondering, their view seems to be this: Even when Swamy was hacked, there isn’t any proof it got here from the prime minister, or that Modi even knew about it. It might have been some renegade hacker, unaffiliated with the occasion or authorities, whom authorities officers do not know.
Hegel is one in all a number of cyberthreat specialists who’ve reviewed Arsenal’s findings, accomplished their very own professional bono evaluation of proof on this case and shared their conclusions with NPR. In addition they embrace officers from the Citizen Lab, a nonprofit affiliated with the College of Toronto, and Amnesty Worldwide’s know-how department, known as Amnesty Tech.
Hegel, from SentinelOne, traced the malware discovered on Swamy’s desktop laptop to backup e-mail addresses and restoration telephone numbers related to the law enforcement officials who arrested Swamy. The server and IP handle that these law enforcement officials use was additionally utilized by the hacker, he says.
“That was the smoking gun,” Hegel says. “It is just like the crown jewel of examples of this operator having a way of impunity.”
Researchers from the Citizen Lab additionally matched a selfie used because the profile picture on the WhatsApp account for a kind of telephone numbers to the face of a police officer who appeared at information conferences involving the BK-16 and in information footage of the arrest of one in all Swamy’s co-defendants.
NPR has not been in a position to independently confirm the identification of anybody who allegedly hacked Swamy.
In India, response has been muted
A lot of this has already been reported in India. However there hasn’t been a lot blowback. No person has resigned. Police haven’t been fired and even investigated. They have not responded to NPR’s interview requests about Swamy, going again to his 2021 demise, or concerning the alleged hacking, going again to September 2023.
In the meantime, Indian attorneys and journalists trying into this case are amongst dozens or lots of of individuals in India who’ve discovered Pegasus spy ware on their units. It is a surveillance instrument that is made by an Israeli firm and used solely by governments. The Indian authorities has refused to verify or deny whether or not it makes use of Pegasus. (NPR has not but submitted its personal units for evaluation of whether or not they might have been contaminated with Pegasus throughout this reporting.)
Not less than one of many BK-16 defendants, activist Rona Wilson, had a smartphone that was contaminated with Pegasus earlier than his arrest, based on a separate forensic evaluation by Amnesty Worldwide’s Safety Lab.
“There’s a actually worrying, disturbing sample of spy ware assaults in India,” says Becka White, a campaigner with Amnesty Tech. “It is a part of a broader sample of dissent being crushed, freedom of expression being stifled, individuals talking reality to energy and being focused.”
NPR is quoting specialists exterior India right here as a result of many within the nation stated they have been too scared to talk on the document.
In recent times, Indian tax authorities have raided the BBC’s places of work in Delhi and Mumbai, frozen financial institution accounts for worldwide charities and compelled Amnesty Worldwide in another country. An Indian expatriate working in Europe for a giant human rights group declined to talk to NPR for the radio model of this story until their voice might be disguised.
Swamy died earlier than he might clear his title. His co-defendants are nonetheless awaiting justice
In the summertime of 2021, one other of the BK-16, Sudha Bharadwaj — a mathematician turned lawyer who additionally labored with India’s Indigenous tribes — obtained a letter from Swamy, written in a shaky hand. They have been each incarcerated, at totally different prisons, the place letters arrived after a protracted delay. Bharadwaj was launched on bail in December 2021 and confirmed the letter to NPR.
Swamy started the letter by asking concerning the well being of his co-defendants. Indian prisons are notoriously overcrowded, and this was on the peak of the COVID-19 pandemic.
“Hoping each of you may be effectively quickly,” Swamy wrote, referring to Bharadwaj and Shoma Sen, one other of the BK-16 who was in the identical girls’s jail. (Sen was freed on bail in April after almost six years behind bars.) “All of us must outlive the essential interval we’re going by. Lots of people are in solidarity with us. However lastly, we’re those to plough by the rugged discipline.”
“Now we have to survive,” Bharadwaj repeats the phrases as she reads aloud Swamy’s final letter.
They have been a few of his final phrases.
Later that summer season, Swamy’s well being deteriorated. He was transferred out of jail and right into a Mumbai hospital. On July 5, he died of cardiac arrest, problems from COVID-19, Parkinson’s and, his attorneys say, dismal jail circumstances. He was 84.
His demise made headlines in India and overseas. His physique was cremated, in accordance with hospital guidelines through the pandemic. A few of his ashes have been taken on tour throughout India after which scattered at Bagaicha, a social motion middle for Indigenous individuals in Jharkhand the place Swamy had lived. His Catholic order, the Jesuits, held a memorial ceremony in Rome.
Swamy’s demise “will endlessly stay a stain on India’s human rights document,” Mary Lawlor, the U.N. particular rapporteur on human rights defenders, stated in a press release.
A few of Swamy’s ashes have been additionally buried in a small cemetery, ringed by brilliant pink bougainvillea flowers, exterior a Jesuit chapel in northern Mumbai, close to the hospital the place he died. That is the place NPR met one of many final individuals to see him alive.
Jail guards had been current in Swamy’s hospital room. However they allowed one in all his fellow monks to enter. The Rev. Frazer Mascarenhas says he discovered Swamy calm and unafraid.
“He was completely assured of the regulation,” Mascarenhas recollects. “He was assured that the Indian judiciary and structure would see him and his individuals by.”
Freelance producer Shweta Desai contributed to this story from Mumbai and Pune, India.