MUMBAI, India — Two days before police finally came to arrest him, the Rev. Stan Swamy recorded a video of himself speaking directly into the camera.
"They want to put me out of the way," the ailing 83-year-old Jesuit priest said.
His voice sounded frail. But what he was saying was explosive.
The government of Prime Minister Narendra Modi, he said, was targeting him in retaliation for his advocacy on behalf of Indigenous people in Indian jails. A sociologist as well as a Roman Catholic clergyman, Swamy had recently published a study of 3,000 people jailed for being members of banned Maoist groups. He found that 97% of them had no such affiliation and that many of their trials were held without lawyers, in a language they didn't understand. He'd filed a case on their behalf in the state court of Jharkhand, where he lived. All of this had embarrassed the government, he said.
Swamy's office had since been raided several times. Police hauled away a loaner laptop he'd recently started using and then came back for his old desktop computer. They interrogated him for 15 hours over five days, he said, about a terrorism plot he knew nothing about.
"Let us hope that some human sense will prevail," he said. "And if it does not, I am ready."
That video was recorded on Oct. 6, 2020. Two days later, Swamy was arrested, then imprisoned and repeatedly denied bail. Less than a year later, he was dead.
Born Stanislaus Lourduswamy in the southern state of Tamil Nadu, the priest was one of 16 outspoken Modi critics who were jailed, one by one, in the aftermath of 2018 caste riots in western India. All were charged with terrorism offenses and conspiracy against the state, after police investigating the riots uncovered what they described as a brazen plot to assassinate the prime minister.
Swamy's 15 fellow prisoners included professors, lawyers, trade unionists and members of an improv theater troupe that performed skits poking fun at the government. All 16 denied the charges against them.
Swamy was accused of membership in the banned Communist Party of India (Maoist), the same faction that some of the Indigenous people he helped were accused of being in. For decades, Maoist guerrillas have recruited from India's Indigenous tribes and waged an insurgency against the Indian state and its representatives — security forces and elected leaders — in tribal areas where Swamy worked.
The evidence appeared to be damning: Letters and minutes of alleged terrorist cell meetings were found on Swamy's and his co-defendants' computers. One of the letters proposed a suicide attack against Modi.
But the suspects, their lawyers and independent experts who've reviewed the evidence in this case say the prisoners were framed. They say someone hacked into the suspects' phones and laptops and planted fake evidence on them.
Digital forensics investigators trace the hack back to Modi's government. Indian police and government officials deny that. But the case has drawn condemnation from Human Rights Watch, Amnesty International, Catholic cardinals and bishops, and many other groups — as well as scrutiny from a U.S. government commission and the United Nations.
"There were cases of files being planted, and then like the next day, the arrests went down. You could go your whole career in this industry and never find something that's as obvious," says Tom Hegel, a Washington-based cybersecurity expert who reviewed evidence in this case. "It's a slam-dunk. This is fabricated."
More than six years after the start of this case, the 15 remaining suspects are still awaiting trial. Seven have been granted bail. Eight remain in prison. And Modi is expected to win a third term, when election results come out this week.
Swamy may have been the oldest person ever charged with terrorism in India. What happened to him is emblematic of what is happening to India under a democratically elected leader with autocratic tendencies. Under Modi, India has not only stripped away legal protections for minorities and those who seek to defend them. It has also allegedly used cyberwarfare to attack them and silence them — with impunity.
This story has percolated for more than six years. Most of the digital forensics evidence obtained by NPR and published here has also appeared in Indian media. But despite outrage from human rights groups and criticism from the United Nations, the United States and Catholic Church officials, there has been no reexamination of this case by Indian authorities.
Erosion of democracy in the world's largest one
Government-sponsored cyberhacking may be common in authoritarian countries like China or Russia. But India is the world's biggest democracy.
Some in the West may have been surprised by allegations that Indian diplomats were involved in the murder of a Sikh separatist leader in Canada last year and that other Indian officials may have been involved in trying to commit a similar crime on U.S. soil.
But Freedom House, a Washington-based nonprofit that measures democratic decline, classifies India as only "partly free." It says those involved in investigating human rights abuses "face threats, legal harassment, excessive police force, and occasionally lethal violence" themselves. It also accuses Modi's Hindu nationalist government of politicizing the judiciary and denying its opponents due process.
In March, one of Modi's top rivals, Arvind Kejriwal, leader of the opposition Aam Aadmi Party, was jailed on bribery allegations. The largest opposition party, the Indian National Congress, had its bank accounts frozen in a tax dispute. The timing of both, just before voting began in the current elections, prompted the U.S. State Department to call for "timely legal processes" for each. Those bank accounts have since been unfrozen, and Kejriwal has since been freed on bail, after missing several weeks of campaigning and voting, in elections that last six weeks and in which voting happens in stages.
Years before this, though, the case that ensnared Swamy was an earlier bellwether for India's democratic decline under Modi, his critics say.
It began with riots on the 200th anniversary of a rare victory for Indian minorities
The defendants in this case worked with three Indian minority groups: Indigenous people, or Adivasis, who comprise more than 8% of the population, or more than 100 million people; India's 200 million Muslims, the country's largest religious minority, increasingly demonized and marginalized under Modi's Hindu nationalist rule; and those on the lower rungs of South Asia's caste hierarchy, including about 200 million Dalits, who used to be called "untouchable" and have long been shunned by other castes as such.
On New Year's Eve 2017, tens of thousands of members of minority groups who supported left-wing parties gathered en masse on the banks of the Bhima River in western India's Maharashtra state. They were there to celebrate the 200th anniversary, the following day, of a rare battlefield victory for Dalits.
In the 1818 Battle of Bhima Koregaon, a ragtag army of Dalits and other oppressed people fought an army of upper-caste elites called Peshwas — and won. More than a century later, the battle inspired the author of India's Constitution, B.R. Ambedkar, on his crusade to abolish untouchability and to write affirmative action into Indian law.
But when minority members amassed on the riverbank on the last night of 2017 and first day of 2018, there were counterdemonstrations by members of upper-caste groups, most of whom supported Modi's right-wing party. Violence erupted after thousands of Dalits recited a pledge, in unison, vowing not to vote for Modi in the 2019 elections. They called his political party — in power at the time at the state and national levels — a Hindu supremacist group.
"In retrospect, that pledge was important, actually. ... The government was scared," says Anuradha Sonule, 35, a member of a theater troupe that performed at the anniversary celebrations. "We gathered people in quantity."
Her theater troupe, called Kabir Kala Manch, is infamous in India. Most of its members are Dalit or Muslim activists, and several had been in and out of jail for alleged affiliation with banned communist groups — even before the 2018 battle anniversary.
Indians have traditionally voted along caste and clan lines. But Modi has changed that. He has sought to unite all Hindu voters. He comes from a lower-caste community himself, even though his Bharatiya Janata Party (BJP) has upper-caste roots.
So it must have rattled the BJP, Sonule says, to see tens of thousands of members of minority groups denouncing the prime minister on live TV. This, as well as the presence at the rally of well-known Modi detractors and dissidents, may have set in motion what happened next, she says.
A day after that pledge, on Jan. 1, 2018, riots broke out between rival demonstrators in villages along the Bhima River. Cars were burned. Neighbors attacked one another along caste lines. At least one person was killed, and dozens were injured. It was never clear who started it.
Who was behind the riots?
One of the politicians who led that anti-Modi pledge from a stage at the rally believes the violence was not spontaneous.
"This was preplanned, and the government was involved in it," insists Prakash Ambedkar, Dalit leader B.R. Ambedkar's grandson. Prakash Ambedkar leads a Dalit political party and has served three terms in India's Parliament.
He accuses the Maharashtra state branch of Modi's BJP of instigating the violence at the Bhima River and then blaming it on left-wing opponents — in order to silence them ahead of the 2019 election.
The state branch of the BJP did not respond to NPR's request for comment. But in an affidavit filed in court, it said the violence was part of a left-wing conspiracy to turn Dalits — a group the BJP had been making inroads with — against the party.
Police initally arrested two upper-caste men in the days after the riots, for allegedly instigating them. But about a week later, they were released and the cases against them dropped. Then police arrested three members of Sonule's left-wing theater troupe, and a new theory emerged.
"Somewhere along the way, police stopped looking into all the other complaints and concentrated on this one complaint that said the violence was a result of a giant conspiracy by underground left-wing elements," says Shalini Gera, a lawyer for one of the other defendants. "And that's when the police started adding terror charges."
The suspects were charged under India's Unlawful Activities (Prevention) Act, which allows authorities to seize property and hold terrorism suspects without bail. The U.S. State Department has cited the law in annual reports on India's "significant human rights issues."
As the investigation passed from local to federal authorities, they cast a wider net. They started arresting people who had past contact with rally attendees but weren't present themselves. These included some of India's most famous human rights activists — now known as the BK-16.
Stan Swamy was one of them.
Swamy had never been to Bhima Koregaon. That didn't matter
More than a year after the 2018 riots, Swamy called the Mumbai law offices of an old acquaintance, Mihir Desai. The two had met in the 1980s, working on lawsuits filed by the families of coal miners killed on the job in eastern India.
"He asked me, 'What is this Bhima Koregaon thing?' He had no clue about it," Desai recalls. "But the police were at his door, interrogating him about it."
At the time of the January 2018 riots, Swamy was on the other side of the country, at his home in the eastern state of Jharkhand. But police were investigating whether he — as a prominent advocate for Indigenous people — may have incited his followers to violence, even from afar. In the summer of 2018, his name started popping up on nationalist TV channels. News anchors called him an enemy of the state.
In October 2020, Swamy made his selfie video, denouncing the allegations.
"What is happening to me is not unique. We are all aware how prominent intellectuals, lawyers, writers, poets, activists, student leaders are all put into jail just because they have expressed their dissent or raised questions about the ruling powers of India," he said into the camera. "I am part of it, part of the game, and ready to pay the price."
Two days later, on Oct. 8, 2020, he was arrested.
How the Indian government sees this
Local and state police and federal authorities did not respond to several NPR requests for comment over a period of nearly three years, between Swamy's July 2021 death and the time of this publication. Neither did the Indian equivalent of the FBI, the National Investigation Agency. A BJP spokesperson declined to speak with NPR on the record. The party has publicly denied any wrongdoing.
To Indian authorities, the Bhima Koregaon riots were a thread they pulled at, which unraveled and led them to what they claim was a bigger plot by leftists to overthrow Modi's government. Not only were Maoists waging guerrilla war against the Indian state in the jungle, as they had for years, but they now also had sympathizers — sleeper cells — in academia and human rights circles.
It's possible — perhaps even likely — that Swamy did have contact with Maoists in the course of his work with India's Indigenous tribes, his former colleagues say.
"It's difficult to tell who is a Maoist! You organize a meeting of 30, 40, 50 people, and someone will later say one of the guys in the back was a Maoist," says the Rev. Joe Xavier, a fellow Jesuit and longtime associate of Swamy. "But if or when he found out, Stan would have cut ties. He would never knowingly associate with them."
People close to him say it's unlikely, though, that Swamy could have typed up notes for Maoists in the form of the alleged minutes of terrorist cell meetings found by police on his computer. They say he didn't have the dexterity. He had Parkinson's disease.
"He was a one-finger, slow typist," his lawyer Desai says.
Digital forensics analysts outside India say the evidence was planted by hackers
Swamy's computers are still in Indian police custody. But cloned copies were shared with his lawyers, who then shared the data with Arsenal Consulting, a Massachusetts-based digital forensics firm that has done analysis in other high-profile cases, including the 2013 Boston Marathon bombing. (The firm says Swamy's loaner laptop was clean; that may explain why, lawyers say, police returned to seize his desktop computer, on which incriminating evidence was eventually found.)
Arsenal shared its pro bono analysis of Swamy's desktop computer with NPR. (It was first shared with The Washington Post in late 2022. Other reports have been shared with Wired magazine.)
The Arsenal report about Swamy's computer is a 25-page technical document that defense lawyers have submitted to the court. It concludes: "This is one of the most serious cases involving evidence tampering that Arsenal has ever encountered."
Here are the report's main findings:
- It started as a phishing attack. On Oct. 19, 2014, Swamy opened a document that had been weaponized with NetWire, a type of malware. For nearly five years after that, the hacker or hackers had access to Swamy's computer.
- Starting in July 2017, the hacker dropped dozens of files into a hidden folder on Swamy's machine. These are the alleged minutes of terrorist cell meetings that police later uncovered. Swamy never opened them and was probably unaware they were there.
- Whoever did this is probably the same hacker who infiltrated the computers of at least three of Swamy's co-defendants. The hacker used the same malware, linked to the same servers. In Swamy's case, though, the hacker inserted profanity — in English — into the coding.
- The night before Swamy's computers were confiscated by police, in June 2019, the hacker tried to cover up his or her digital footprints — erasing malware and surveillance data.
Desai, the lawyer, calls that timing "very, very, suspicious."
"The only people who knew his house was going to be raided was the National Investiga[tion] Agency," he says. "So unless they informed the hacker — or unless they are the hacker — this doesn't make sense any other way."
The NIA did not respond to NPR's request for comment. In court documents, it alleges Swamy was more computer savvy than he appeared, and took steps to encrypt his own messages. But the NIA has not publicly addressed the timing of its raids.
Arsenal was unable to identify the hacker or hackers. But someone else might.
The work of this hacker looked familiar
Tom Hegel, a Washington-based threat researcher with the cybersecurity firm SentinelOne, reviewed Arsenal's analysis of Swamy's desktop computer and said the hacker looks familiar. It looks like a "threat actor" — an individual or a collective — he has tracked for years and given a name: ModifiedElephant.
"It's almost like a safari. I pursue different species of hackers and categorize them," Hegel explains. "We created the ModifiedElephant threat actor name to refer to a decade of activity against 100 individuals in India, spread across journalism, human rights defenders, academia — and even legal professionals tied to the BK-16."
Just as with Swamy, the ModifiedElephant hacker often uses phishing to plant malware on a victim's device. Once it gets access, it operates like a remote administrator, taking over the computer, sending emails and planting files, or erasing existing ones.
"Then the police arrest these individuals and do their quote-unquote 'forensics' on the devices and say, 'Hey, we found this Word document that's a plot to assassinate PM Modi — you're guilty of that,'" Hegel says. "However, you can prove that file came through the session that was operated by this ModifiedElephant attacker. This would never be done legitimately by a user."
After monitoring a decade of ModifiedElephant's behavior and considering the identities of its targets, Hegel says he thinks it's a group of hackers who are either part of the Indian government or third-party contractors hired by it.
"All of this does tie back, high confidence, to the Indian government," he says.
The Indian government denies that. Officials from the BJP declined to speak on the record. But based on background conversations with those familiar with their thinking, their view appears to be this: Even if Swamy was hacked, there's no evidence it came from the prime minister, or that Modi even knew about it. It may have been some renegade hacker, unaffiliated with the party or government, whom government officials don't know.
Hegel is one of several cyberthreat experts who've reviewed Arsenal's findings, done their own pro bono analysis of evidence in this case and shared their conclusions with NPR. They also include officials from the Citizen Lab, a nonprofit affiliated with the University of Toronto, and Amnesty International's technology branch, called Amnesty Tech.
Hegel, from SentinelOne, traced the malware found on Swamy's desktop computer to backup email addresses and recovery phone numbers associated with the police officers who arrested Swamy. The server and IP address that those police officers use was also used by the hacker, he says.
"That was the smoking gun," Hegel says. "It's like the crown jewel of examples of this operator having a sense of impunity."
Researchers from the Citizen Lab also matched a selfie used as the profile image on the WhatsApp account for one of those phone numbers to the face of a police officer who appeared at news conferences involving the BK-16 and in news footage of the arrest of one of Swamy's co-defendants.
NPR has not been able to independently verify the identity of anyone who allegedly hacked Swamy.
In India, reaction has been muted
Much of this has already been reported in India. But there hasn't been much blowback. Nobody has resigned. Police have not been fired or even investigated. They haven't responded to NPR's interview requests about Swamy, going back to his 2021 death, or about the alleged hacking, going back to September 2023.
Meanwhile, Indian lawyers and journalists looking into this case are among dozens or hundreds of people in India who've found Pegasus spyware on their devices. It's a surveillance tool that's made by an Israeli company and used only by governments. The Indian government has refused to confirm or deny whether it uses Pegasus. (NPR has not yet submitted its own devices for analysis of whether they may have been infected with Pegasus during this reporting.)
At least one of the BK-16 defendants, activist Rona Wilson, had a smartphone that was infected with Pegasus before his arrest, according to a separate forensic analysis by Amnesty International's Security Lab.
"There is a really worrying, disturbing pattern of spyware attacks in India," says Becka White, a campaigner with Amnesty Tech. "It's part of a broader pattern of dissent being crushed, freedom of expression being stifled, people speaking truth to power and being targeted."
NPR is quoting experts outside India here because many in the country said they were too scared to speak on the record.
In recent years, Indian tax authorities have raided the BBC's offices in Delhi and Mumbai, frozen bank accounts for international charities and forced Amnesty International out of the country. An Indian expatriate working in Europe for a big human rights organization declined to speak to NPR for the radio version of this story unless their voice could be disguised.
Swamy died before he could clear his name. His co-defendants are still awaiting justice
In the summer of 2021, another of the BK-16, Sudha Bharadwaj — a mathematician turned lawyer who also worked with India's Indigenous tribes — received a letter from Swamy, written in a shaky hand. They were both incarcerated, at different prisons, where letters arrived after a long delay. Bharadwaj was released on bail in December 2021 and showed the letter to NPR.
Swamy began the letter by asking about the health of his co-defendants. Indian prisons are notoriously overcrowded, and this was at the height of the COVID-19 pandemic.
"Hoping both of you will be well soon," Swamy wrote, referring to Bharadwaj and Shoma Sen, another of the BK-16 who was in the same women's prison. (Sen was freed on bail in April after nearly six years behind bars.) "We all have to outlive the critical period we're going through. A lot of people are in solidarity with us. But finally, we are the ones to plough through the rugged field."
"We have to outlive," Bharadwaj repeats the words as she reads aloud Swamy's last letter.
They were some of his last words.
Later that summer, Swamy's health deteriorated. He was transferred out of prison and into a Mumbai hospital. On July 5, he died of cardiac arrest, complications from COVID-19, Parkinson's and, his lawyers say, dismal prison conditions. He was 84.
His death made headlines in India and abroad. His body was cremated, in accordance with hospital rules during the pandemic. Some of his ashes were taken on tour across India and then scattered at Bagaicha, a social action center for Indigenous people in Jharkhand where Swamy had lived. His Catholic order, the Jesuits, held a memorial ceremony in Rome.
Swamy's death "will forever remain a stain on India's human rights record," Mary Lawlor, the U.N. special rapporteur on human rights defenders, said in a statement.
Some of Swamy's ashes were also buried in a small cemetery, ringed by bright pink bougainvillea flowers, outside a Jesuit chapel in northern Mumbai, near the hospital where he died. That's where NPR met one of the last people to see him alive.
Prison guards had been present in Swamy's hospital room. But they allowed one of his fellow priests to enter. The Rev. Frazer Mascarenhas says he found Swamy calm and unafraid.
"He was totally confident of the law," Mascarenhas recalls. "He was confident that the Indian judiciary and constitution would see him and his people through."
Freelance producer Shweta Desai contributed to this story from Mumbai and Pune, India.
Copyright 2024 NPR
