Researchers find a link between Indian police and hackers who planted evidence in 2018 on the PCs of human rights activists jailed on terrorism charges
New details connect police in India to a plot to plant evidence on victims' computers that led to their arrest.
Context & Ripple Effects
This finding extends a documented pattern of digital attacks on Indian dissent that began surfacing with the NSO malware infections found on opposition figures' phones in 2021. What makes the new research different is its target: not interception but fabrication — files planted on activists' computers in 2018 that became the basis for terrorism charges and jail time.
The attribution also lands inside a broader ecosystem: Reuters and the Bureau of Investigative Journalism have separately mapped an Indian hack-for-hire industry serving corporate intelligence clients, so the question raised here is whether the same mercenary capacity has been pulled into domestic policing.
First-order effects
- The arrested activists are directly affected: forensic work published after this report confirmed hackers planted files on at least three of them, yet 11 of the 16 remained jailed as of late 2022 — meaning the evidentiary basis of their detention is now publicly contested.
- The implicated police agency faces an attribution problem it cannot dismiss as foreign interference, since the researchers tied the planting operation to an arm of Indian law enforcement itself.
Second-order effects
- Device vendors get pulled into the political fight: by late 2023 India was pressing Apple to offer alternative explanations for state-sponsored-hack warnings shown to journalists and opposition politicians, showing how forensic disclosures force platform-level confrontations with the government.
- Independent forensics becomes the de facto check on official narratives — each researcher publication raises the cost for any future case built on digitally planted material, pushing investigators toward either cleaner operations or non-digital framing.
Third-order effects
- If the pattern holds, the line between commercial spyware suppliers, hack-for-hire contractors, and state institutions keeps dissolving into a single market where law enforcement is a customer — with accountability depending almost entirely on external researchers rather than domestic oversight.
- Sustained exposure of fabricated digital evidence points toward international pressure for norms or export controls on offensive hacking services sold into jurisdictions without independent judicial review, though whether that materializes remains genuinely open.
The trend: India's use of commercial hacking capacity is expanding from surveillance of opponents to the fabrication of criminal evidence, with independent forensic researchers emerging as the only functioning counterweight.