Néstor, A Journalist Uncovering Colombian Crisis and Corruption

Where transparency and accountability are scarce, Colombia’s ‘watchdog journalists’ are a last line of defense.

‘Journalism as the eyes and ears of a society’s citizens, checking for and warning of potential danger. This idea of the journalist as watchdog is inextricably linked to… democracy.’ - ‘The Watchdog Role’, Oxford Dictionary of Journalism [Source: OUP]

Colombia is a country in crisis for journalists - but their work is more vital than ever. Most democratic societies think of journalists as brave ‘watchdogs’: digging up what the powerful keep hidden and exposing it to the light of public scrutiny. The current Colombian regime, however, pushes a different, particularly toxic conception of journalists: ‘liars’ and ‘scumbags’, contributing to the ‘stupidification’ of Colombian society.

Meanwhile multiple intertwined stresses affect the region. Illegal armed groups, including remnants of the FARC and the ELN, still undermine peace efforts.  Environmental degradation, including deforestation and climate change, increases the pain and strain of displacement and migrant struggles - including human trafficking. Drug trafficking still fuels corruption and insecurity; many in Colombia face high inequality, unemployment, and inflation that only worsens as global markets fluctuate.

This is not the time for Colombia’s ‘watchdogs’ to be subject to violence - ideological or even physical. Yet as tension between the State and media grows, Reuters and RSF (Reporters Without Borders) have designated Colombia as a nation in journalistic crisis, where ‘alarm bells are ringing for freedom of expression’.

‘In 2022, 218 threats to the press were reported, the highest number in the past 15 years. Two journalists were murdered.’ - Víctor García-Perdomo, Reuters Institute for the Study of Journalism [Source: Reuters]

‍

Meet Néstor

Colombian newspaper El Colombiano has been a bastion of Latin American journalism since its inception as a three-centavo one-page sheet in 1912. For a hundred years, the paper has committed itself to ‘la verdad, la independencia y la responsabilidad social’ (lit. ‘truth, independence and social responsibility’) from its headquarters in Medellin. 

OSINT Industries user Néstor Espinosa Robledo is one of Colombia’s ‘watchdogs’. He’s an investigative journalist and data analyst for El Colombiano, interrogating government propaganda, the corruption of the ‘Petrist’ regime, and humanitarian scandals across Colombia.

Néstor and OSINT Industries share the belief that the truth is sacred; where journalists find their practice threatened by a repressive information culture, OSINT is an ideal way to keep up their good work.

Many of Néstor’s successes have been assisted by our platform’s provision for investigative journalists. He reached out to us to share how our platform has been key in four of his vital investigations: a representative spread of successes in fighting corruption, fake news, suspicious government contracting, and - crucially - humanitarian crisis in the Darién Gap. 

‍

Vulnerable Data

‘It was almost midnight when a lot of text messages came into my cell phone with approved transactions for $50,000, $100,000, $300,000 from my credit card assigned to Rappi and Davivienda… I called the bank and said I wasn’t making those purchases.’ - An Anonymous Victim, quoted by Néstor. [Source: El Colombiano, Translation: OSINT Industries]

On the trail of a story, Néstor was exploring Telegram groups notorious for illegal activities - when he stumbled upon something astonishing: several channels dedicated to trading stolen credit card information. 

Known as ‘carding groups’, these illegal social media channels are a worldwide phenomenon, operating on multiple platforms besides Telegram. Cards and card numbers will be hacked, cloned or stolen, and used to buy items on online marketplaces - or to buy prepaid gift cards that transfer currencies, or cover the origin of the stolen funds. 

Groups can even collect personal data from leaks to expand their reach: from paid websites, banks or most shockingly, public data sold or shared by companies such as Google, Facebook or X (Twitter) in a frustrating abuse of OSINT.

Néstor immediately saw a Colombian connection. He found these groups contained thousands of leaked credit card details attributable to numerous Colombian users and banks. One group alone, ‘Bineros CCS’, had exploited data from 5,000 Bancolombia, Nubank, Colpatria, Banco de Bogotá and Davivienda customers.

This group was quickly terminated by Telegram for violating community rules - but it was too late. The data was out, and hundreds more channels existed.

‘According to the social tool Listening YouScan, there are more than 143,700 users on Telegram who used the messaging app to share sensitive card data with security codes, expiration dates, cardholder names and issuing banks in the last month.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

To break the story, Néstor had to verify the stolen data was real. He selected a random Bancolombia customer. The Bancolombia customer used Mastercard, which Néstor found to be the second most common service among ‘carded’ users. These cybercriminals had acquired a security code, expiration date, residential address in Miami - and a Hotmail email address. 

Néstor immediately ran this email address through OSINT Industries. What this search revealed was the vulnerability of Colombian bank customers’ personal data.

OSINT Industries quickly revealed that the Bancolombia user’s stolen information was not only valid, but had been leaked 15 times between 2015 and 2021. The breach had first occurred during a leak of 15 million users’ data from experian.com, and again during correspondence with T-Mobile USA. The 14 other breaches were mostly from trusted eCommerce sites like US parking app ParkMobile. Each leak added additional data; that time a license plate and driver's license.

With the intel the ‘carders’ had, Néstor could see via OSINT Industries that the Bancolombia customer had traveled to Boston in 2018, leaving the Consumer Credit Counseling Services Agency Office a 5-star review on Google Maps. Néstor could see the customer wears glasses for shortsightedness, is a fan of Los Cafeteros, visits theme parks, logs runs on Nike Run Club, is a Christian and speaks Spanish as a first language. He had recently bought - and rated 5-star - a Mercedes C300, with a price tag of over two hundred million pesos. 

Other users had been exposed this way without credit card details, just to exploit their identities: full names, physical addresses and more

In the wrong hands, all this information could be devastating. 

‘We found his credit history, date of birth, email, ethnicity, family structure, gender, businesses he owns, credit score, money in bank accounts, IP address and location... All of it was a lethal weapon to damage a life.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

OSINT Industries had revealed the vulnerability of Colombian customers’ data, and now Néstor’s voice as a journalist could prevent future ‘carding’ victims. He published his findings in El Colombiano, warning Colombians of the rising threat to their data integrity - and financial security.

‍

Information Disorder

In Néstor’s region of Colombia, rumour had it that the Colombian government was receiving money from the Mafia. If this rumour had come from thin air, why was it so quickly gaining traction? When whispers of corruption began to spread throughout the country, journalists like Néstor understood the need to confirm or deny the allegations.

But as soon as Colombia’s ‘watchdogs’ began to track down the truth, the response from certain quarters of the internet was swift, highly coordinated and poisonous to Colombia’s freedom of information.

Daily news program Noticias Caracol revealed that the wife of a drug trafficker from Casanare - a ‘Mafia boss’ - had genuinely played a part in current President Gustavo Petro's election campaign. Suddenly, a suspicious disinformation offensive maligning the news media began on Twitter (X) and Facebook. 

‘What @NoticiasCaracol is doing is incredible, they lie shamelessly, they invent places and names @petrogustavo asks them to rectify the information and they don’t. But they come out and say that the president is attacking the press, THIS IS NOT POSSIBLE!!!’ - Historic Pact influencer Daniela Beltrán, or ‘Lalis’ (@smilelalis) [Source: El Colombiano, Translation: OSINT Industries]

Whenever the government’s Mafia ties were questioned, suspicious accounts spread hashtags intended to discredit journalists: ‘#CaracolMiente’ (lit.’#CaracolLie’), ‘#SemanaMiente’, ‘#RCNMiente’, ‘#ElTiempoMiente’ and even ‘#ElColombianoMiente’. These trended for days on Twitter (X), reaching TikTok, Instagram and even VK. 

Using OSINT social listening tools, Néstor tracked these hashtag’s mentions, detecting 3,107,200 between August 13 and August 21; filtering Colombia only, Néstor found only 1,022,200. El Colombiano had been attatcked in 20,900 mentions, but only 10,000 came from Colombia. The hashtag ‘#SemanaMiente’ had 1,800 mentions in Vietnam and 200 mentions in Tanzania. 

This geographical scatter meant that more than half of hashtag activity came from bot accounts, recently created and using VPNs to spoof their location. They appeared ‘to be coordinated by several influencers from the Historic Pact’, deploying bots to bolster their toxic, anti-journalist viewpoint.

‘It was not citizens who were behind it but computer programs… ​​We are witnessing the democracy of robots, where the supposed opinion on social networks seems to be the reflection of a mirror that in reality says nothing or, worse, tells lies.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

Now OSINT had given him proof, it was vital for Néstor to call this out. Writing a piece for El Colombiano, Néstor used this OSINT-backed evidence to empower his warning to the Colombian people.

Néstor flagged that pro-government influencers ‘using bots, trolls, spamming, disinformation, fake reviews, advertising, cyber attacks’ to hide the truth about Mafia links were employing Coordinated Influence Operations: an ‘influence operation’ or ‘organized attempt to achieve a specific effect among a target audience… with coordinated inauthentic behavior’, according to the Carnegie Endowment for International Peace. This is the same information disorder technique utilized by the Chinese regime to silence dissent - and it was happening here in Colombia.

Meanwhile, Colombian and international journalists continued to verify the ‘Mafia’ rumors about the Petro campaign’s links to a drug-trafficker’s wife. Now President Petro’s recent comments appear extremely ironic - mere months ago he denigrated female journalists as ‘mafia dolls’.

‍

‘Little Tricks’: The Medellín Election

CAPTION: The Monumento a la Raza (lit. ‘Monument to the Race’) at La Alpujarra, Medellín’s most important administrative complex. [Source: Sajor/Wikimedia]

‘The race to reach the 12th floor of La Alpujarra is going through its most heated moment, and has unleashed "jugaditas" (lit. ‘little tricks’) as candidates toe the so-called ethical line…’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

Keeping an eye on the election landscape in Medellín, Néstor and other ‘watchdogs’ noticed an increasingly tricksy atmosphere. The competition was getting intense. It seemed that cases of political chicanery - what Néstor termed ‘jugaditas’ - were at play. 

These ‘jugaditas’ are small but powerful manipulations. Seemingly minor, they’re capable of altering voter perceptions - and therefore election outcomes. They evidence a lax attitude to corrupt tactics in Colombian politics, and are precisely the unethical preactices that ‘watchdogs’ need to expose.

The best way for Néstor to expose them? OSINT Industries.

‍

Social Media 

Néstor used OSINT Industries to uncover social media manipulation, including Coordinated Influence Operations by election candidates in Medellín.

Of the 24 mayoral and gubernatorial candidates, he isolated the five investing more than 100 million pesos in their digital strategy: former Mayor Daniel Quintero, Juan Carlos Upegui, Esteban Restrepo, Mauricio Tobón and Juan Diego Gómez. The last, Albert Corredor, spent 94 million pesos. 

Using OSINT analysis, their ‘jugaditas’ were revealed. Néstor found Upegui, Restrepo, and others made use of tools like Wappid to disseminate mass (and often disinformative) political messaging. Candidates were paying substantial sums for targeted ads that made ridiculous, ‘clickbaity’ promises to force engagement. They boasted impossible promises of free Metro services to hoodwink young people, ‘as happens in Iceland and Malta… where there is no metro’. Worst of all, they invented false infrastructure projects, including paving the Darién Gap. The latter, from Néstor’s experience, was a particularly unethical trick to play. 

Moreover, affiliated accounts not only promoted candidates with lies and trickery, but engaged in tactics amounting to ‘dirty war’ - attacking opponents, and denigrating media outlets such as Caracol Noticias and El Colombiano itself.

Néstor recognised their tricks. Using OSINT Industries, he tracked the trending ‘#UpeguiAlcalde’ and ‘#EstebanRestrepoGobernador’ hashtags to paid bots in warehouses outside Medellín: in Bogotá, Antioquia and Valle del Cauca. Once again, candidates were faking organic support with overseas influence campaigns.

One candidate - trending the most after the mayoral debate - did not use overseas warehouses. Albert Corredor, who split ties with Daniel Quintero while campaigning, had paid 94 million pesos to run 80 ads on Facebook and Instagram.

Néstor still knew something was up. 

Investigating with OSINT Industries, he discovered Corredor's Meta (Facebook) ads were funded by Santiago Botero: a contractor between 2020 and 2022 for the Medellín Mayor's Office, via the Pascual Bravo Institution and ITM. From these contracts, Botero had earned 141 million pesos. Currently, Néstor flagged, Botero is ‘under investigation by the Attorney General's Office for pressuring officials of the Ministry of Education to support his candidate on social media.’ Corredor was the only candidate who declared his expenses, and this was the true source.

Corrupt ‘jugaditas’ had overrun the Medellín election; Néstor used OSINT Industries to call them out. 

‘Here we present the candidates who are spending the most money on advertising and who, strangely, have the support of the departments of the Mayor's Office that was led for 3 years and 9 months by Daniel Quintero: a great friend of Esteban Restrepo and Albert Corredor, and almost brother-in-law of Juan Carlos Upegui... It is no secret that [ex-Mayor Quintero’s] “vicars” are there, the men who would protect his interests.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

‍

Government Contracts

The corruption didn’t stop with the Botero revelation. Accessing government contract records, Néstor became aware that certain individuals were receiving an unbalanced number of government contracts.

Accounts posting pro-government and anti-journalist material were being utilized by the Historic Pact, the Independents party, and other parties close to Gustavo Petro's government. These were accounts for influencers, wineries and, surprisingly, the ‘Center for Innovation and Technological Development’ - ‘@PaisDelConocimiento’ - a supposed scientific organization.

Néstor’s quick OSINT analysis of the ‘@PaisDelConocimiento’ account linked it to the winery account, an account that had ‘distort[ed] the present with… unviable and even false proposals.’ Claiming to be a government-endorsed scientific body, the ‘@PaisDelConocimiento’ account had become a pro-regime mouthpiece. It echoed false information, supporting Quintero-linked candidates’ lies, and promoting pro-Petro talking points.

‘This account… constantly seeks to improve the image of the head of state, in addition to covering up the discontent of his voters over various problems.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

But who was behind this account? Néstor linked the @PaisDelConocimiento handle to an email address: ‘frajaro@paisdelconocimiento.org’. OSINT Industries showed Néstor this belonged to Francisco Javier Roldán Velásquez - current legal representative of the ‘Centro Innovación’, operational until 2019. Roldán Velásquez’s address was registered on LinkedIn and Uber, and on Gravatar as ‘paisdelsaber’ - the same as his Twitter (X) account.

Roldán Velásquez was appointed by former Governor Luis Pérez as Director of Projects for the Secretariat of Education in the Government of Antioquia.

The ‘Innovation Center’s’ Twitter (X) account boasts recognition by Colombia’s Ministry of Science as a legitimate ‘research center’. It’s listed on InstituLAC, Colombia’s official research directory. They claim to provide consulting services, supervision, and software solutions… as an ‘allied organization’ of the Antioquia Governorate's Practice Center .

Their most recent contract? In 2021, Mayor Daniel Quintero had paid 28 million pesos for consulting on ‘smart city projects.’ This happened via Pascual Bravo, a Quintero-affiliated university institution that had assigned multiple contracts by direct debit; subject to investigation by the Attorney General's Office and the Prosecutor's Office.

Francisco Javier Roldán Velásquez, our platform also showed, hasn’t cleaned up his act. He appears, Néstor found, to live between Medellín and Accra, Ghana: working for Fox Africa Investments, he deals with Busscar, manufacturer of buses in Bogotá, Cali and Cartagena. 

With one OSINT Industries email search, Néstor uncovered large-scale corruption. He contacted the ‘Innovation Center’, but got no response when he published the truth.

‍

Crisis in The Darién Gap

‘Beneath a canoe—which was used to fish for snapper, sea bass, sierra, corvina, and bocachico—lives Javier Hernández and a family of three girls and their parents. They are waiting to collect the $300 that the boatmen ask for to take them across the gulf to Capurganá, where they will finally pack their way through the Darién jungle… The canoe, placed on the sand like the shell of a prehistoric turtle, is divided inside with a dark cloth that insulates the heat, thus simulating a house… They use cardboard and plastic as a floor and a mattress…’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

Located at the Colombia-Panama border is a strip of inhospitable jungle known as the Darién Gap. This South American land bridge is a “no-man’s-land” of hellish heat, life-threatening wildlife and impenetrable vegetation. 

Nobody would attempt to cross it by choice. Yet every year, migrants and refugees from South America are forced to traverse the Darién Gap by necessity, to reach the United States. This has made the region a center of humanitarian crisis; according to our source, smugglers demand approximately $400-500US to embark on this life-threatening crossing. 

Since 2021, over 130 people (and rising) have lost their lives in the attempt.

Before making the possibly-fatal journey, those hoping to cross the border are stuck in a dockside limbo, living like Javier Hernández and his young family in makeshift shelters as they scrape together the trafficker’s fee. As one of the thousands of migrants who pass through Urabá in Antioquia every day, luxuries like a solid roof and a change of clothes will be nonexistent. Javier, Néstor wrote, ‘eats very little, not because of a lack of appetite, but because of a lack of money.’ 

With no police or immigration officers in this improvised settlement - only private company guards - migrants like Javier are constantly at risk of crime; that’s if they don’t succumb to horrific disease, ‘pollution, a lot of garbage… fever with flu that makes children's skin peel and a strange fungus grows.’

A life-saving area of Néstor’s watchdog journalism has been powered by OSINT Industries: investigating the trafficking “businesses” facilitating this humanitarian disaster. By putting the email addresses of suspected people-traffickers through OSINT Industries, Néstor found accounts linked to organised crime gangs, narco groups, and even terrorist associates. These were the beneficiaries of migrants’ suffering.

‘In the canoe house, the girls play with their dolls, while the mother combs one of their hair, looking for lice, passing the comb from top to bottom without too much force, because the hair is curly and gets tangled more easily…’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

The profit model in Darien Gap smuggling is extortionate: the $3-400USD advance to cross does not include $80 for a guide, and $50 for extras, not to mention arbitrary $10-plus charges along the way. Next to a permanent Red Cross station a teenager sells these ‘extras’ - ‘survival weapons’ for 35,000 pesos, or band-aids for 1,000. The dedicated taxi to the dock from the airport costs 1-2 million pesos. When migrants finally manage to shoulder the financial burden, the payment – ​​always in cash – is logged on a hotel lobby computer, while a woman writes down on a sheet of paper the names of those ready to make the passage. 

At the entrance to the beach, there is an advertisement for Katamaranes del Darién.

‘There are two companies that sell tickets during the day, as if it were a bingo game… Families eagerly await the call of their last name, “Luton”, “Cesaire” are some of the Haitian surnames that can be heard through the megaphone, held by a man with dark glasses…’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

Beginning during an influx of migration in 2016, Katamaranes del Darién (‘KdD’) is registered for ‘the transportation of maritime passengers, cargo and tourist activities’. Using OSINT, Néstor set about uncovering who was behind the business. 

Néstor found ‘KdD’ held 742 million pesos divided among two partners. However, despite the massive amount of trade in migrant transport, the company had not reported any change in its assets - loss or growth - since its foundation. It was ‘always the same value’, Néstor wrote in El Colombiano, ‘as if camouflaging the real values.’

It’s unlikely this was the case to freeze out competition. The company’s sole competitor? Maritime and river trading company El Caribe, established on August 17, 2016. Néstor found revenues of 7.3 billion pesos, starting with a capital of 1 billion pesos divided between two partners.

‘In other words’, Néstor summarised, his OSINT research had shown ‘the two companies that transport migrants have assets of 2 million dollars.’

The shock came when Néstor used OSINT to discover the ‘partners’ identities.

One partner, Juan Carlos Valderrama Cano, is a relative of Asdrúbal Yamid Valderrama Cano, alias ‘Montesco’.* ‘Montesco’ is a notorious player in a cocaine-supply network serving Mexican cartels from Urabá, captured in a 2010 operation by the Colombian Police Anti-Narcotics Directorate. This investigation found a ‘relation’ to the Clan del Golfo - the most powerful criminal organisation in Colombia. 

Invoking the Clan del Golfo’s name is enough to shock El Colombiano readers. Emerging from the paramilitary groups that laid waste to Colombia in the past, the Clan del Golfo operates transnationally, funding their violent rise via cocaine-smuggling, extortion, illegal mining, and armed attacks. Led by powerful cartel bosses - described by US prosecutors as ‘the most violent and significant’ since Pablo Escobar - the Clan poses a massive threat to Colombia's security, even after government crackdowns and arrests.

‘Just like in an airport where they restrict the weight of suitcases… Here the migrant must leave their “stuff”, as a kind of inheritance, those who arrive will find a lifeline among the abandoned items…’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

Néstor had found with OSINT that migrants’ and refugees’ desperation was fuelled by interests connected to Colombia’s most notorious criminals. As more migrants suffered, more money was being made - and continues to be made today. 

What his work also highlighted was the lack of action by Colombian authorities to prevent the trafficking of people: the way that people seeking refuge in inhumane conditions had become as common as people experiencing homelessness. Yet this time, their pain is hugely lucrative for those willing to exploit it. In Colombia, Néstor raised, these people are no more than numbers.

‘The figure is already 80,000 people who transit the jungle, the data is offered from Panama… here there are only numbers of profits and assets.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

‍

#OSINT4Good in Action

As an investigative journalist, Néstor Espinosa Robledo was provided with free access to OSINT Industries. 

We think his story demonstrates the unique way OSINT can empower journalists under threat. Néstor could follow links between email addresses, phone numbers, and online accounts; he could see details on account existence, profile information, and even location-based data from public sources. Open-source intelligence is democratic by design: it can’t be restricted. 

OSINT Industries was key in exposing serious corruption at the highest level of government, providing details on Mafia-connections, illicit contract awarding, and campaigns of propaganda masquerading as legitimate support.

Néstor used our platform to help to save migrant and refugee lives, demonstrating that the internationally-observed process of people-smuggling in the Darien Gap is only possible when facilitated by significant organised crime entities.

Importantly also, in a world increasingly hostile to those seeking refuge, Néstor’s work humanizes the migrant experience, allowing his readers to see stories amongst the statistics. This is something OSINT Industries is proud to support.

‘The traveler or migrant only lives on one thing: cunning and, perhaps, imagination.’ - Néstor [Source: El Colombiano, Translation: OSINT Industries]

Thanks to our platform, Néstor is giving Colombians and the world better access to the truth.

‍

For more details of Néstor’s work, or to contact him, visit:

El Colombiano: https://www.elcolombiano.com/cronologia/noticias/meta/Néstor-espinosa-robledo

Twitter (X): https://twitter.com/nesthora_