How Hackers Framed a Priest for Terrorism | Hacking Documentary

Summary

In Jharkhand, India, Catholic priest and human rights activist Stan Swamy was arrested in 2020 under anti-terror laws, accused of links to Maoist insurgents based on incriminating files on his computer. Despite his denials and poor health, he was denied bail and died in custody in 2021. Later, Arsenal Consulting revealed that hackers had framed Swamy, planting evidence and erasing their tracks in a conspiracy aligned with state interests. The report highlighted a sophisticated surveillance operation, with Swamy's computer infected by malware, including NetWire and Dark Comet, allowing remote control and file transfers. The planted files led to his terrorism charges. The case is part of a larger pattern of evidence tampering and surveillance targeting activists, journalists, and academics, with potential links to Pune City Police.

Takeaways

• 📅 Stan Swamy, a Catholic priest and human rights activist, was arrested on October 8, 2020, under India's anti-terror law based on incriminating files allegedly found on his computer.
• 🔗 The files linked Swamy to the Maoist insurgency, which aimed to establish communist rule in India through violent means, but he denied the allegations and claimed innocence.
• 🚫 Despite his old age and poor health, Swamy was denied bail and died in confinement on July 5, 2021, before his innocence could be proven.
• 🕵️‍♂️ Arsenal Consulting, an American digital forensics firm, discovered in late December 2022 that hackers had compromised Swamy's computer as part of a larger conspiracy.
• 💻 The hackers planted evidence on Swamy's computer to incriminate him and deleted files that would reveal their unauthorized access, making it one of the most serious cases of evidence tampering.
• 👨‍💻 Swamy was a long-time advocate for the rights of the Dalits, the lowest caste in India, and other marginalized groups, suggesting his arrest was related to his activism and dissent against government policies.
• 🐟 The hackers used a spear phishing attack to infect Swamy's computer with malware, granting them full remote control and access to his files.
• 🔍 Arsenal's investigation found that the planted files were never accessed by Swamy, and the hackers engaged in 'anti-forensics' to cover their tracks.
• 📱 Pegasus spyware, a tool sold exclusively to governments, was also found on Swamy's cell phone, capable of extensive surveillance without the user's knowledge.
• 🔎 Security researchers uncovered a potential link between the hacking campaign and the Pune City Police, with evidence suggesting police involvement in framing Swamy.
• 🌐 The case is part of a broader pattern of targeting activists, journalists, and academics in India, raising questions about the integrity of legal proceedings and the protection of human rights.

Q & A

Who was Stan Swamy and what was his role in India?

Stan Swamy was a prominent Catholic priest and human rights activist in India, advocating for the rights of the Dalits, previously known as the untouchables, who were the lowest in the caste system. He also worked to protect the rights of other marginalized groups in India.

What charges were brought against Stan Swamy under India's anti-terror law?

Stan Swamy was charged with terrorism and inciting a riot in 2018 under India's anti-terror law, based on incriminating documents allegedly found on his computer that linked him to the Maoist insurgency.

What was the significance of the files found on Swamy's computer?

The files found on Swamy's computer were used as evidence to link him to the Maoist insurgency and were crucial in his arrest. However, it was later discovered that these files were planted by hackers as part of a larger conspiracy.

How did the hackers gain control of Stan Swamy's computer?

The hackers gained control of Swamy's computer through a spear phishing attack, where they sent an email posing as part of the same activist group, with a PDF file attached that contained malware, infecting Swamy's computer when he downloaded it.

What was the role of the malware 'NetWire' and 'Dark Comet' in the case?

NetWire and Dark Comet were remote access trojans (RATs) hidden in the PDF file, which allowed the hackers to gain full admin privileges and remote control of Swamy's computer, enabling them to plant false evidence.

What is 'anti-forensics' as mentioned in the script?

Anti-forensics refers to the hackers' actions of deleting files that revealed their access to Swamy's machine, an attempt to cover their tracks and make it difficult to trace the planted evidence back to them.

What was the role of the Pegasus spyware found on Swamy's cell phone?

Pegasus spyware, found on Swamy's cell phone, is a powerful tool that can be secretly installed on most operating systems and is capable of reading texts, tracking calls, collecting passwords, location tracking, and accessing a phone's microphone and camera, indicating extensive surveillance.

What did Arsenal Consulting's report reveal about the case?

Arsenal Consulting's report revealed that hackers had gained control of Swamy's computer, planted evidence, and engaged in anti-forensics to cover their tracks, proving Swamy's innocence in a case that involved serious evidence tampering.

How were the hackers potentially linked to state interests?

The timeline of activity, extensive resources, and infrastructure dedicated to Swamy's surveillance, as well as the alignment of the hackers' actions with state interests, suggest a possible link to state actors.

What was the connection found between the Puna City Police and the hacking campaign?

Security researchers found that a recovery email and phone number linked to a police official in Puna, who was closely involved in the Bhima Koregaon riot, were used as backup for the compromised email accounts, suggesting a connection between the police and the hacking campaign.

What broader implications does this case have for human rights activists in India?

The case suggests a pattern of unlawful targeted surveillance and falsified evidence against human rights activists, journalists, and academics, raising concerns about the safety and rights of those who dissent against government policies in India.

Outlines

00:00

📜 Injustice to Activist Stan Swamy

In Jharkhand, India, on October 8, 2020, human rights activist and priest Stan Swamy was arrested under anti-terror laws, based on incriminating documents found on his computer. These documents were later revealed to be planted by hackers as part of a larger conspiracy aligned with state interests. Swamy, who advocated for the rights of marginalized Dalits and was critical of government policies, denied the allegations but was denied bail due to his age and health, leading to his death in confinement on July 5, 2021. It was only in December 2022 that his innocence was proven by Arsenal Consulting, an American digital forensics firm, which discovered evidence tampering and a sophisticated hacking campaign targeting Swamy's computer over nearly five years.

05:01

🔍 Uncovering the Hacking Conspiracy

The Arsenal report on Stan Swamy's case revealed a complex hacking operation that began with a spear phishing attack, infecting Swamy's computer with malware like NetWire and Dark Comet, giving hackers full remote access. The hackers planted files to incriminate Swamy and engaged in 'anti-forensics' to delete traces of their activity. The report also found Pegasus spyware on Swamy's phone, a tool available only to governments, capable of extensive surveillance without user interaction. Security researchers' global collaboration post-report release pointed to a potential link between the hacking campaign and the Pune City Police, with recovery emails and phone numbers tied to a police official involved in the Bhima Koregaon riot case. The findings suggest a widespread and ongoing campaign targeting activists, journalists, and academics, raising questions about the integrity of legal proceedings and the need for impartial investigations.

Keywords

💡Anti-terror law

Anti-terror laws are legislative measures enacted by governments to combat terrorism. In the context of the video, Stan Swamy was arrested under India's anti-terror law based on allegedly incriminating documents found on his computer, which he denied. The law's application in this case raises questions about its potential misuse against human rights activists, as it was used to justify his arrest and denial of bail.

💡Maoist insurgency

The Maoist insurgency refers to a communist revolutionary movement in India that seeks to overthrow the government through armed struggle. The video mentions that documents linking Swamy to this insurgency were found on his computer, which he vehemently denied. The connection, if true, would have been a serious charge, but the video suggests that this was a frame-up.

💡Digital forensics

Digital forensics is the use of scientific methods to collect, analyze, and report on digital evidence in a way that is legally admissible. Arsenal Consulting, an American digital forensics firm, discovered that hackers had compromised Swamy's computer, planting false evidence and covering their tracks. This highlights the importance of digital forensics in uncovering the truth behind digital evidence tampering.

💡Spear phishing attack

A spear phishing attack is a targeted form of phishing where an attacker poses as a trusted entity to deceive a specific individual into revealing sensitive information or downloading malware. In the video, Swamy was tricked into downloading a PDF containing malware from an email that appeared to be from an activist group, illustrating how such attacks can lead to serious consequences.

💡Remote Access Trojans (RATs)

Remote Access Trojans, or RATs, are a type of malware that allows an attacker to gain unauthorized access and control over a victim's computer. The video explains that two RATs, NetWire and Dark Comet, were used to infiltrate Swamy's computer, enabling the hackers to plant incriminating files and delete evidence of their intrusion.

💡Antiforensics

Antiforensics is the practice of manipulating or hiding digital evidence to prevent its discovery or to mislead investigators. The video describes how hackers deleted files that would have revealed their access to Swamy's computer, an act of antiforensics aimed at covering their tracks and ensuring the planted evidence would stand unchallenged.

💡Dalits

Dalits, previously known as 'untouchables,' are members of the lowest caste in India's traditional caste system. Swamy was a human rights activist who advocated for the rights of Dalits and other marginalized groups. His work in supporting these communities and his dissent against government policies may have contributed to his targeting by state actors.

💡Pegasus spyware

Pegasus is a sophisticated spyware tool that can be secretly installed on smartphones, allowing for extensive surveillance capabilities. The video mentions that Pegasus was found on Swamy's cell phone, suggesting that his surveillance was part of a larger, possibly state-sponsored, effort to monitor and suppress dissent.

💡Evidence tampering

Evidence tampering refers to the act of altering, fabricating, or concealing evidence to influence the outcome of a legal proceeding. The video emphasizes that the Arsenal report described the case as one of the most serious involving evidence tampering, indicating a deliberate effort to frame Swamy and others for crimes they did not commit.

💡Peaceful dissent

Peaceful dissent is the expression of disagreement or opposition to government policies or actions without resorting to violence. Swamy's advocacy work and his arrest are presented in the video as part of a broader pattern of suppressing peaceful dissent in India, highlighting the challenges faced by activists and the importance of protecting the right to dissent.

💡Impartial investigation

An impartial investigation is one that is conducted without bias or prejudice, ensuring a fair and objective examination of facts. The video concludes by questioning whether there will be an impartial investigation into the unlawful surveillance and falsified evidence against human rights activists in India, emphasizing the need for justice and accountability.

Highlights

Stan Swamy, a prominent priest and human rights activist, was arrested under India's anti-terror law on October 8, 2020.

Swamy was linked to the Maoist insurgency through 50 files allegedly found on his computer.

He denied the allegations, claiming innocence, but was denied bail due to his age and health.

Swamy died in confinement on July 5, 2021, less than a year after his arrest.

In December 2022, Arsenal Consulting revealed that hackers had framed Swamy, proving his innocence.

The hackers' activities indicated a large-scale conspiracy aligned with state interests.

Swamy was a Catholic priest advocating for the rights of Dalits and other marginalized groups in India.

He suggested his arrest was due to his activism and dissent against government policies.

Swamy was targeted by an extensive malware campaign for nearly 5 years.

A spear phishing attack led to the infection of Swamy's computer with malware.

The malware allowed hackers to plant incriminating files on Swamy's computer.

Hackers engaged in 'antiforensics' to cover their tracks by deleting evidence of their access.

Arsenal Consulting found that Swamy never interacted with the planted files.

Pegasus spyware, sold only to governments, was found on Swamy's cell phone.

Security researchers collaborated to uncover the identities of the hackers behind the framing.

A recovery email linked to a police official in Pune was found on compromised accounts.

There is evidence of a connection between the Pune City Police and the hacking campaign against Swamy.

Hundreds of activists, journalists, and academics have been targeted in similar hacking campaigns since 2012.

The findings raise questions about the potential for an impartial investigation into unlawful surveillance and evidence fabrication against human rights activists in India.

Transcripts

In the midst of racial and political division in the eastern state of jharkhand india

citizens were shocked to find out that on October 8, 2020 - that Stan swamy

a prominent priest and human rights activist - - had been arrested

under India's anti-terror law on the basis of 50 files found on his computer

incriminating documents that linked Swamy with the maoist insurgency,

which sought to establish communist rule in India through violent revolution.

Swamy denied the allegations and claimed he was innocent, and he was innocent.

But who would have the motive to frame an elderly human rights activist for terrorism?

Swamy would never find out, Because despite his old age and poor health, he was denied bail and would die after spending less than a year in confinement on July 5th 2021.

But it wouldn't be until late December of 2022 when the truth was uncovered and his innocence was proven.

An american digital forensics firm: arsenal consulting discovered that hackers had gained control of his computer and were part of a much larger conspiracy

with their actions aligning sharply with state interests.

The timeline of activity indicated that extensive time, resources, and infrastructure had been dedicated to his surveillance.

The hackers that compromised Swamy’s computer planted evidence that led to his arrest with several others

and covered their tracks by deleting files that revealed their access to his machine.

the Arsenal report stating "It should be noted that this is one of the most serious cases involving evidence tampering that we’ve ever encountered,"

the Arsenal report stating "It should be noted that this is one of the most serious cases involving evidence tampering that we’ve ever encountered,"

Stan Swamy, was a Catholic priest, and a human rights activist for several decades.

He advocated for the rights of a group of people known as the Dalits, previously called the untouchables

they were the lowest of the caste system in india. Swamy fought against the displacement of these communities

and worked to protect the rights of Dalits - along with other marginalized groups in India.

Swamy suggested his arrest was linked to his activism work, as it involved dissent against government policies.

He said “What is happening to me is not something unique happening to me alone. It is a broader process that is taking place all over the country.

We are all aware how prominent intellectuals, lawyers writers, poets, activists, students, leaders, they are all put into jail because they have expressed their dissent or raised questions about the ruling powers of India.“

But little did Swamy know the extent he was surveilled - he was the target of an extensive malware campaign that stretched close to 5 years.

It all started when Swamy had received an email from someone posing to be part of the same activist group as Swamy.

In reality, this email was sent by a hacker, and attached to the email was a pdf file that looked like any other, but actually contained malware which silently infected Swamys computer when he downloaded it.

This is known as a spear phishing attack, where hackers portray themselves as trusted people - with the intention of stealing private information - or in this case downloading malware.

There were two pieces of malware that was hidden in the pdf file: NetWire and Dark Comet - these are remote access trojans - or RATs for short.

this is a type of malware a hacker can use to gain full admin privileges and remote control of a victim's computer.

The malware installed allowed hackers to transfer a series of files to a hidden folder on Swamy's computer,

including one that listed weapons possessed by various units of a militant rebel group and another that seemed to suggest kidnapping members of India's ruling party, the BJP.

but Arsenal also found something else on Swamy's computer: The hackers seem to have begun what Arsenal calls "antiforensics"

where they deleted files that revealed access to Swamy's machine in an apparent attempt to cover their tracks, just a day before Puna Police seized Swamy's computer.

In other words, the hackers wanted to plant fake evidence that could be revealed to incriminate Swamy

while also deleting actual evidence of their fabrications that might be discovered in legal proceedings

Based on artifacts in the computer's memory and disk storage, it was found that Swamy never touched the files himself.

After his devices were seized by Puna City Police, the files planted by the hackers was the digital evidence used to frame him and charge him with terrorism

as well as inciting a riot in 2018 that led to two deaths.

This riot in 2018 was the result of Long-Standing racial and political tensions when critics of the government clashed with pro-government supporters near Bhima Koregaon.

The event led to subsequent protests, resulting in more violence, leaving more people dead.

In the following months, police linked the cause of the violence to the banned Maoist Communist party of India.

But Arsenal's findings, match earlier cases of evidence fabrication, seemingly carried out by the same hackers, that targeted two defendants' machines that Arsenal had previously examined.

pegasus spyware was also found on the Swamys cell phone, pegasus is a commercial product only sold to governments.

and can be secretly installed on cell phones running most popular operating systems.

Pegasus is able to use a zero-click exploit. This type of exploit doesn’t require any interaction with the person using the device.

Pegasus is capable of reading texts, tracking calls, collecting passwords, location tracking, and can access a phones microphone and camera,

After the public release of the arsenal report, security researchers around the world collaborated to try to uncover the identities of the hackers

and their findings were so shocking - that they had the potential to cause widespread revolt in india.

A security analyst who chose to remain anonymous — learned that three of the victim email accounts compromised by hackers had a recovery email and phone number added as a backup.

This was intended to allow the hacker to easily regain control of the accounts in case the passwords were changed.

That recovery email on all three accounts included the full name of a police official in Puna who was closely involved in the Bhima Koregaon riot.

John Scott-Railton, a security researcher at the University of Toronto's Lab, confirmed the link between the the Puna City Police and the recovery email and number .

John dug up entries in open source databases of Indian numbers and emails, looking for the recovery number that linked it to an email address ending in [email protected].

a suffix for other email addresses used by police in Pune.

phone calls and multiple emails were sent to the Puna City Police and their police official whose personal details were linked to the hacked accounts, but they received no reply.

There was now undeniable evidence the Puna police were tied to a hacking campaign that had framed and jailed swamy

a dying old man - due to his activist work and for exercising his right to peaceful dissent.

But Swamy was far from unique in being targeted by the officials who sought to frame him. Based on the details of the malware and hacking infrastructure described in Arsenal's report,

its clear that hundreds of activists, journalists, and academics have been targeted since as early as 2012.

Given how recent these events were, only time will tell whether we see an impartial investigation into the unlawful targeted surveillance and falsified evidence against human rights activists in india.