Glenn Greenwald was sitting in his home office in Rio de Janeiro one sleepy Sunday morning in May 2019, when he received a phone call from a number he did not know. He hasn't replied. But a WhatsApp message arrived 30 seconds later from Manuela d'Ávila, a Brazilian leftist politician who had run for vice president next to the center-left Workers' Party presidential candidate the previous year; their ticket came second to far-right former military captain Jair Bolsonaro. "Glenn," she wrote, "I have something urgent I need to talk to you about."
D'Ávila was not well known to Greenwald, the American journalist who broke the news of Edward Snowden's NSA leaks, so his interest was piqued by the weekend post. Greenwald hurried downstairs to the bedroom to wake his husband, the left-wing Brazilian politician David Miranda, who knew d'Ávila better, when she explained that she had stumbled into an enormous possible story and wanted to speak on the phone.
D'Ávila plunged into a strange story when the two men put her on the speakerphone: Someone had just hacked her Telegram account, then offered to give her evidence that would "save the country." Greenwald had to ask her to slow down. "She was thrilled," he says. D'Ávila clarified that the hacker claimed to possess explosive material that implicated Bolsonaro's government, and in particular Brazil's Ministry of Justice and Public Security.
D'Ávila called to see if she would be able to pass on the source to Greenwald. He consented.
There was an issue right away, though. The hacker wanted to talk about Telegram, but for reasons the mysterious souce had just revealed, Greenwald didn't have the app. "For years, the people I trust most, including Snowden, have warned against their vulnerabilities," Greenwald says. Still, Greenwald mounted Telegram, after hanging up with d'Ávila, and made contact warily.
Fortunately," Greenwald recalls, "I didn't need to say much of anything because he was just off for the races. Messaging in Portuguese, the source claimed to own an enormous amount of content. He said he had been working through it for months and had only managed to read about 10% of it, but had already uncovered signs of conspiracy that, if disclosed, would set Brazilian politics on fire. The source began to submit samples of Greenwald: audio messages, several papers.
The individual asked after a few minutes if they could speak over the phone. For Greenwald, this set off yet another warning. With proxies and encryption, text exchanges can be disguised, but for someone who could track them, a voice will be easy to recognise. "Until I went to Hong Kong, I did not hear Snowden's voice," Greenwald says.
Yet he pushed on with Greenwald. He took the call and let most of the talk be done by the source, who claimed to be living in the US and attending Harvard. The source explained to Greenwald that a close friend at Telegram had introduced him to the app's Russian owners, the Durov brothers, and had gained access to the Telegram accounts of people through them. What didn't make a lot of sense," Greenwald says, "Why build a supposedly safe messaging app and give someone the keys to their back door? Greenwald doubted the Harvard story of the hacker as well.
Are you being cautious? "Greenwald remembers having asked. "What you've done is pretty serious."
Don't think about that, oh right. They'll never catch me,' boasted the source. He said that he was using several proxies that made it almost impossible for someone to track him, and never again would he set foot on Brazilian soil. Greenwald kept it short, but said he needed to see the papers. The call was about four minutes long. "OK, I'm just going to start uploading them to your phone," said the source. He told Greenwald that it would take 12 to 15 hours for the upload to be completed.
Greenwald started receiving files from his Telegram account after the call, a large number of them, one after another. The source would periodically interject, giddily asking Greenwald to look at a specific text.
The files were still coming in when Greenwald went to bed that night; they had not stopped when he woke up in the morning. "It was just going and going every time I opened up my Telegram app," Greenwald says. "That's when I knew this was a massive archive. And I was very persuaded that it was true.
Greenwald and Miranda addressed the risks of reporting on leaks from the beginning. Unlike in the case of Snowden, Greenwald will remain in the same nation as the officials he would reveal. And after his predecessor, Jean Wyllys, of the same party, fled Brazil and gave up his seat over death threats and homophobic violence, Miranda took his seat in the National Congress. In 2018, Marielle Franco, a left-wing politician and close associate of Greenwald and Miranda's, was murdered in her car; two former policemen were charged with her murder.
The same Sunday, Greenwald called Intercept Brasil's executive editor, Leandro Demori, part of the media collective that Greenwald co-founded after the 2014 Snowden leaks. If Demori was sitting down, Greenwald asked. "It's serious," he said. Demori, who was packing for a holiday, plopped down on his bunk. "You need to sit down right now." His mouth dropped as he listened to Greenwald: 'Oh my God,' he thought. "This is huge." Demori gave the project an enthusiastic green light once he had a sense of the content. The legal staff of The Intercept did likewise.
The next step was to find an easier and safer way to obtain all the material from the source, which was already trickling into Greenwald's phone via Telegram eight or nine days after contact was made by the hacker. As soon as possible, the journalists decided to protect the archive outside Brazil, in case authorities tried to confiscate it. So the security specialist of Intercept, Micah Lee, started planning to set up an end-to-end encrypted cloud storage platform to receive the content. The source, however, simply produced a Dropbox and dumped it all there. "His technical judgment was suspicious of me," Lee says. "He appeared overconfident."
As Greenwald drafted the first series of posts, he remained in constant touch with the hacker—or, rather, hackers. He got the feeling at some point that he was talking to at least two people. One of them seemed, Greenwald says, somewhat naive and idealistic. "And then, all of a sudden, I felt like I was talking to someone more jaded... a bit more slippery, and a bit more complicated." Sometimes, instead of "I," the source would also say "we"
However, the hacker was compliant with what he, or they, wanted. Greenwald was told, "I'm only doing this because I want to clean my country up." And the source consistently insisted that he was not involved financially. What mattered most was that the content was authentic, Greenwald thought.
The Intercept Brasil got ready for the leaks on the evening of Sunday, June 9, almost a month after Greenwald first talked to the hacker. Greenwald, who normally works from home, went to Rio's newsroom. The team published three papers at nearly 6 pm, which they said relied on a large repository of information provided by an anonymous source.
The reports revealed how a group of federal prosecutors had planned to prevent the presidential elections of 2018 from being won by the Workers' Party. In Portuguese, the prosecutors were part of a sprawling anti-corruption task force called Operation Car Wash-Lava Jato. Their inquiry reported that a massive web of money laundering and bribery between state-owned corporations and major figures from the biggest political parties in Brazil had been discovered. These revelations have led to hundreds of prosecutions, the most notable of which was that of former President Luiz Inácio Lula da Silva, known as Lula, who left office as one of the world's most influential political figures in 2010.
The prosecutors for Car Wash argued that as a kickback, Lula had earned a beachfront triplex, and from there they described him as the "maximum leader" of a sprawling, corrupt network. Lula was imprisoned in 2018 and stopped from running (again) as the candidate of the Workers' Party in the presidential election of that year. Lula was a clear favorite to win, and his disqualification paved the way for the stunning victory of Bolsonaro in the polls. Sérgio Moro, the judge who presided over the Car Wash proceedings, was named Minister of Justice and Public Security after Bolsonaro's victory. Moro became one of the most famous and influential, based on his popularity as an anti-corruption crusader.
But now, in the very cases he was expected to adjudicate, including the one that convicted Lula, the Intercept's leaks revealed how Moro had colluded with the Car Wash prosecutors.
Their early readership on the Intercept's website was six or seven times higher than for any other story the site had written, five minutes after the stories went live. "Soon #VazaJato was trending on social media, roughly translating to "Car Wash Leaks. The Intercept report was featured on the flagship news program of Brazil's biggest broadcaster, Globo, a few hours later.
The media explosion was particularly gratifying to Greenwald because he knew he could continue feeding the story. "I knew it was going to dominate politics and headlines for weeks, if not longer, once that initial reaction occurred that way," he says.
Left-wing parties soon called for the resignation of Moro. He refused to step down, alleging that he had been the target of a brutal, orchestrated cyberattack by experienced and well-financed hackers. He also indicated that there had been international participation, referring pointedly to the Russian roots of Telegram. Moro's insinuations barely answered the content of the news of the Intercept, but they fed into a query that was on the lips of everyone: Who was the source of Greenwald?
A four-hour drive inland from São Paulo, Walter Delgatti Neto grew up in Araraquara. Araraquara is a friendly if unremarkable settlement of low-rise, flat-roofed buildings among a smattering of incongruous tower blocks, surrounded by an expanse of green fields, a small town of 200,000 inhabitants, around the same size as Boise, Idaho.
Delgatti lived with his parents in Araraquara until he was 7 years old, when they broke up. He was then carted between grandparents: "My mother unfortunately left me on the sidewalk of my paternal grandmother's house, literally de mala e cuia "—an expression meaning "with all one's earthly belongings." As a child, Delgatti had a hard time making friends. He had auburn hair, unusually for Brazilians, earning him the nickname Vermelho, which in Portuguese means "red." Delgatti struggled with his weight as well. He'd been bullied.
"Delgatti was a complicated young man, according to Gustavo Henrique Elias Santos, who has known Delgatti since he was about 15 or 16. Santos says, "I always felt pity for him. "He had a strange family." Delgatti's earliest recollection of Santos is at an Araraquara gathering, where Santos played a set as a DJ. Santos noticed Delgatti, the only face in the audience who was really watching him, grinning oddly from the crowd.
Though Delgatti had succeeded in establishing a rare bond with him, Santos had learned not to believe any of what Delgatti had told him. Santos says, "Walter is a great storyteller." He adds, "Not all he says is a lie," but he doesn't know how to tell the whole truth. He writes a terrific script.
Delgatti and Santos were maturing into tiny but extravagant troublemakers. One morning in May 2013, the police stopped Delgatti, 24 at the time, and Santos, 22 at the time, on the highway leading out of Araraquara. They were found carrying fake papers, stolen credit cards, 14 checks, and more than a thousand Brazilian reais in cash in their silver Toyota, along with a bank statement showing the amount of 1.8 million reais (approximately $900,000). Ariovaldo Moreira, a local lawyer they met, called the couple. The chief told Moreira when he arrived at the police station that the youngsters were unable to account for the cash or the funds in the bank account. When the bank statement was seen by Moreira,
Delgatti and Santos were identified by Moreira at the time as small-time crooks and scammers who were rarely associated with something significant. Despite lacking employment, they often had plenty of cash. They made videos showing car trunks full of chains of cash and gold. They were lovers of weapons. "Their lives were like a film," says Moreira. Santos was convicted in his early twenties of carrying illegal weapons. The line between pranks and petty scams was also blurred by Delgatti's longer rap sheet. Moreira remembers how Delgatti booked stays with bogus credit cards at luxury hotels; he filled in at gas stations and sped off without paying. Despite having the cash to pay the money, he missed out on restaurant bills.
Delgatti was caught flashing a fake police badge at an amusement park in 2015, when he was 26, attempting to cut a queue for rides. Delgatti led the officer to the car where Santos and Santos' girlfriend were, where a real policeman apprehended him. In the trunk, the officer found a weapon, and Santos was arrested. Never will those close to Delgatti know why he did any of the stuff he did. Delgatti gets a kick out of tricking others, Moreira says. "He is undecipherable," says Santos.
Delgatti seemed driven, if anything, principally by a desire for fame and notoriety. On the way, though, he was charged with crimes that would haunt him. The same year as the theme park incident, in connection with a rape investigation, police raided Delgatti's apartment. Delgatti denied the accusation, and her testimony was later revised by the accuser and the charges were dropped, but the police discovered a forged ID during the raid that made it look like Delgatti was a medical student at the University of São Paulo. A handful of antidepressant pills, 84 clonazepam tablets (which can treat seizures, panic disorder, alcohol withdrawal, or insomnia), and a slightly limited amount of "restricted medication" were also identified.
A vehement sense of injustice in Delgatti was sparked by the drug charges. Delgatti says, "The false charges left me extremely outraged." "I use those drugs to this day."
Delgatti enrolled in school at a college in Araraquara in the face of mounting legal problems, choosing to study the law even as he was being followed by it. Once again, like several classmates, he didn't get along. He appeared determined to cover his legal baggage, but he was overplaying his hand, as ever. He went so far as to file a police report for "slandering and defaming him" in the classroom in his first year against some of his fellow students. "They're saying that I'm a hacker and that I'm diverting money from third party accounts," Delgatti told the police.
Delgatti's charges eventually caught up with him in June, 2017. He was sentenced to two years in jail and spent six months behind bars before being released to work in a semi-open prison for the rest of his term, ensuring he was allowed to go out by day but had to return at night. He was hitting bottom. "They fucked Walter. He didn't even have ten dollars to buy bread,' says Santos. "I know because I lent him 10 bucks." Delgatti was cleared of his conviction for drug trafficking in June 2018, but he still had to serve the remainder of his term for possession of false papers.
Delgatti missed town at some point in 2018. He relocated to a slightly larger city named Ribeirão Preto, about 55 miles northeast of Araraquara, and enrolled in another law school there. Desperate to avoid his legacy, Luiz Henrique Molição, a budding political junkie who sympathized with the Brazilian left, befriended a much younger classmate. Delgatti himself had no interest in politics, but he wanted to impress Molição, who was a teenager. He described himself as the son of a deceased neurosurgeon and said that his late father was living off an inheritance. Delgatti says, "I was afraid of him knowing my true identity." "I've been on the run, living a double life."
It was about this time at some stage that Delgatti discovered a hacking method that would further complicate that double life. The hack took advantage of a function provided by a Brazilian voice-over-IP company that allowed account holders to change their caller ID, the number registered at the end of a call received. This function is made for a convenient virtual lock-picking system, coupled with the fact that many telephone providers in Brazil allow individuals to access their voicemail by calling their own number. He could spoof their telephone and access their voicemail if a hacker simply changed his caller ID to the number of someone he wanted to target.
With access to someone's voicemail, a hacker with little technical expertise and no specialized equipment could, it turned out, do quite a bit of harm. For example, Delgatti found out that he could use this VoIP spoofing method to attack Telegram accounts. They had the option of requesting a verification code via an automated voice call from Telegram at a time when a Telegram user decided to connect their account to a new computer. Delgatti discovered that he was able to spoof the phone of a victim to request the code. Then, if the automatic voice call from Telegram did not move, because Delgatti launched the hack late at night while his victim slept, or kept the line occupied by calling his victim to the sam at night.
Delgatti says he chose Telegram because, during a court hearing, he had once seen Bombardi, the local prosecutor who had pursued him, using the app. "Because he wanted to fuck the life of the prosecutor, he started this hacking," Moreira says.
True to form, there was no stopping Delgatti's commitment to trouble. Early in 2019, he hacked the Telegram account of his friend Gustavo Santos. Both stopped talking. Santos says, "I was pissed, really pissed." The hacking of Delgatti into the Telegram account of Bombardi also gave him access to the address book of the local prosecutor and the contacts of several other public authorities. "And from there," Moreira says, "everything began."
Santos joined much of Brazil in celebrating the Carnaval in March 2019. At some point, he says, he got a cryptic message from his estranged friend Delgatti during the week-long festivities. Here's a real hacker," the message said. Santos said he didn't know what Delgatti was talking about, and didn't think much about it."
But one of Delgatti's yarns wasn't spinning. According to police investigators, Delgatti had hacked the phone of Eduardo Bolsonaro, a congressman and the third son of President Jair Bolsonaro, at 3:34 a.m. on March 2, the official start of Carnival. Forty-five minutes later, Carlos Bolsonaro, the second son of the President, also a politician, was hacked by Delgatti. Shortly afterwards, Delgatti himself hacked the president's computer, although he obviously was unable to download anything. And he kept going, working his way through a long list of strong public figures, including federal prosecutors, members of government, and senior judges.
Delgatti said what he was doing to many friends, but like Santos, they had a difficult time understanding what was true, which may have made it easier for Delgatti to include so many people in his hacking spree. For instance, he carried out some of his hacks from the VoIP account of Santos, making Santos look like an accomplice.
Similarly, another Araraquara acquaintance, a former Uber driver named Danilo Marques, was roped in: Marques allegedly allowed Delgatti to open multiple accounts under his name over the years and helped him launder money from Delgatti's various scams. Now, he used an internet connection and an IP address that was under the name of Marques, as Delgatti hacked his way into the federal government.
Delgatti also had contact at the time with a freelance computer programmer and restaurateur called Thiago Eliezer Martins dos Santos, who since childhood has gone by the nickname Chiclete or bubblegum. The two met in 2018, according to both men, when Eliezer sold a Land Rover to Delgatti. "("I had the impression of a slick man who talks a lot," says Eliezer of their first meeting.) Eliezer admits that he "made a program" for Delgatti, helping him set up a VPN for private internet access that allowed Delgatti to mask his position. Eliezer did not play a role in Telegram hacking, according to both men, although he did discuss it with Delgatti. Delgatti described the hacks as a money-making scheme at first,
Then there was an 18-year-old budding socialist, Luiz Molição, whom Delgatti knew from law school. Molição had heard Delgatti talk critically about Operation Car Wash and the government of Bolsonaro, which attracted his attention because he wanted someone familiar with politics to assist him in gathering the information he had hacked. So he showed Molição the phone numbers he had drawn up for various famous people, including Alexandre de Moraes, the minister of the supreme court, and Danilo Gentili, the right-wing humorist, and asked for Molição's help with the next step of his scheme. The two went on to build an online dialog that was fervent.
On April 26, Delgatti hacked Deltan Dallagnol, who was then considered a national hero, into the Telegram account of the lead prosecutor in Operation Car Wash. Dallagnol says he soon found that, although he hadn't read them, several telegram messages he had received were marked as read. "He looked at the use of his Telegram account: "I saw that in other locations and countries there were active sessions." Dallagnol initially imagined that scammers were trying to get his credit card information, "but then we recognized that the assault spread to other prosecutors," he says. "We have been deleting messages and apps, changing passwords, and taking precautions."
But it was too late; Delgatti had already accessed Dallagnol's chats and contacts and downloaded them. And a few weeks later, on Mother's Day, 2019, Delgatti launched the hack that would open to the world his findings. Manuela d'Ávila got a Telegram warning that morning that someone was trying to reach her account in the US state of Virginia. Then a second message was sent to her from a Brazilian senator she met. D'Ávila tried calling him, but there was a busy line. Then another message from the senator's account pinged into her telegram: "Do you trust me?" ”
"Of course! Of course! "Responded d'Ávila, puzzled.
"This is not the senator, I have to tell you." D'Ávila was surprised. "I have information on crimes committed in Brazil by the authorities. And I will hand over to you. "You are the person who has to receive it." She was the person most likely to be able to "save the country," the hacker said, as a leader of the Brazilian left.
With that, the hacker left the profile of Senator Telegram and emailed d'Ávila from another account. The person told d'Ávila that she had hacked her own phone, giving her screenshots of conversations she had with another influential leftist politician. But d'Ávila was reassured by a hacker that she was not their target. D'Ávila contacted her attorneys promptly. She feared, in all probability, that this was a scheme to trap her with political enemies. Her attorneys agreed.
Yet there was something that gave d'Ávila pause about the way the individual wrote. "The story of the hacker seemed unreliable but not malicious either: "It was more like it was a dream, you know? "She's telling. "These were the things he said that were so grandiose: 'I will save the land! You are the one who can help me! We are going to make everything change! Lula's going to escape jail! " The hacker also invoked the election slogan of d'Ávila, 'Lute como uma garota! -"Fight as a girl!" Out of the texts, a clear psychological trend emerged; d'Ávila felt a similarity to a loved one (who she chooses not to name) who is often prone to great leaps of imagination. It's been t
The individual wanted to entrust all the information to her, but d'Ávila, a former journalist, realized that her status as a politician would make people doubt the leaks, and that she would be hard pressed to determine the material's veracity. "She told the hacker, "We have to think about how you are going to do it. She said he wanted to talk to a journalist.
Skeptical, the hacker was. He told d'Ávila that he had found evidence in the Brazilian press of corruption. So d'Ávila instead proposed to a famous American reporter: "We have to speak to Glenn, the Snowden case reporter," she told the source. He is the best in the world." D'Ávila suggested that the security of the material and the source would also be uniquely capable of ensuring Greenwald." "Because the authorities are talking about very serious crimes, about information that is very important to the country," said d'Ávila. If they're going to kill you, where would that knowledge be? ”
The source agreed, delighted by the allusions to the case of Snowden.
As it happens, with Operation Car Wash, Greenwald had a very complicated past already. There had been critics from the very beginning who thought the anti-corruption task force was colluding with Moro to threaten the Workers' Party and Lula. (In 2016, when then-judge Moro leaked hidden wiretaps of a breathless, affectionate conversation between then-president Dilma Rousseff and Lula, their suspicions were aroused, which seemed to indicate that the two were coordinating to protect Lula from prosecution.) But among those critics, Greenwald was not. He says that the Car Wash task force never felt "super antagonistic" towards him. In fact, in a speech at a 2017 award ceremony for anti-c
But now, after the Mother's Day phone call from d'Ávila, Greenwald was shocked as he started digging through the avalanche of documents that were slowly being uploaded to his new Telegram account. "I kind of felt betrayed, actually," he says. Greenwald learned that the conspiracy between Moro and federal prosecutors against Lula and the Workers' Party went deeper than even their most fierce opponents had expected.
The leaks revealed, most explosively, that Moro helped design the criminal cases he would then adjudicate. Moro offered, in one case, to bring Dallagnol in contact with a source who had potential proof against one of the sons of Lula. Dallagnol, the prosecutor in the case, also expressed deep concern to Moro and other colleagues about how flimsy his case was in messages that date back to Lula's trial. Dallagnol wrote to colleagues shortly before he accused Lula of taking a beachside triplex as a bribe: "They will say that we are accusing based on newspaper articles and fragile evidence." When Dallagnol eventually used the triplex accusation to portray Lula as the mastermind of a sprawling proof.
The Intercept team determined that the first collection of stories would be released on June 11 until Greenwald and his colleagues had a solid understanding of what was most newsworthy. But something happened on the 5th of June that threw them away: Sérgio Moro publicly revealed that he had just been hacked. His phone had received SMS messages from Telegram, suggesting that an unsolicited computer had accessed his account. Moro asserted that no content had been extracted by the suspected invaders, but the hack created a media storm. Then a steady stream of prominent individuals and political figures came forward to say they had invaded their accounts in the same way.
Greenwald, who had known that the hacking spree from his source was over, was taken aback. He got in touch immediately and asked if the source had been behind the hacking of Moro's phone. If so, in an on-going cyber assault, it might make the Intercept appear complicit. The source denied it vehemently. Greenwald recalls, "He even feigned being offended that I would think that they would do something so primitive."
Then, on June 7, at around 8 pm, the hacker called to ask for advice about what to do with all the Telegram accounts he still had access to, once again placing Greenwald in an uncomfortable role. As soon as the articles are written," said the source, "they're all going to delete their chats, they're all going to delete Telegram, so we wanted to know... what do you suggest doing? In essence, he asked Greenwald if they could carry out the Telegram chat data export before the victims could actually cut off access.
"It's hard, because I can't give you advice," answered Greenwald. "I obviously need to be cautious about all that I'm saying."
A delicate response was set out by Greenwald. "It's certain they're going to accuse us of being involved in the hack," he said. He pointed out that in a "very safe" offshore spot, the Intercept had stored all the material it obtained from the hacker. There is no intent, no excuse for you to keep something, I think, right? Although making it clear that the option was up to the hackers, Greenwald said. "Right, perfect," said the source, thanking the journalist.
You have any questions, call me, OK? "According to an audio recording of the call that police later found on Delgatti's MacBook, Greenwald said.
On June 9, two days ahead of time, The Intercept Brasil went to print. (Greenwald says that Moro's hacking allegations have nothing to do with the decision.) The publication said its findings were focused on a trove of secret files, including private messages, audio recordings, photographs, and judicial records. The Intercept wrote, distancing itself from the suspected Moro phone hack, that it had obtained its material weeks ago.
That same night, a statement condemning the hackers' "criminal action" was released by the Car Wash task force and indicated that the invasions could threaten the protection of the authorities and their families. Moro, meanwhile, said that the messages in his conduct did not indicate any "abnormality"; he also cast doubt on their validity. Neither the task force nor Moro agreed that the messages were accurate. Even then, there was an outcry. The legacy of the whole anti-corruption operation of Car Wash was put into doubt. And there was plenty of content still to write. As Intercept Brasil drafted follow-up articles describing ever deeper collusion and corruption, Greenwald broke off communications with respect to
The government and media also went into a whirlwind of speculation about the sources of the leaks as the nation roared over the consequences of the hacked content. And yet there was no effort by Delgatti to cover his tracks. He continued to hack. He spent hours keeping numerous Telegram accounts open at once in front of his computer screen. He had more than a hundred compromised accounts set up to be tracked in real time. Delgatti claims that at times, for 48 hours straight, he was awake.
Delgatti also took to Twitter to mock his most high-profile victims. Replying to a Dallagnol tweet, Delgatti claimed to have evidence that the Car Wash leaks were genuine, three days before he was hacked, citing the time and date of messages on Dallagnol's computer. "And Delgatti tweeted to Moro on July 7: "Every day that your protection passes is getting more insane. "The house has fallen, it won't do any good to cover the sun with a sieve." On social media, he even criticised Bolsonaro. Yet Delgatti's conduct was so blatant that it begged to be disbelieved, tweeting from his personal account, with a profile picture of himself laughing and wearing red sunglasses.
Delgatti hacked Joice Hasselmann, a right-wing politician close to Bolsonaro and the leader of his far-right faction in the lower house, into the Telegram account just after midnight on July 21. Hasselmann posted on social media the next day a video saying that her mobile phone had been invaded. Undeterred, Delgatti continued to hack a key Bolsonaro cabinet minister, Economy Czar Paulo Guedes, into the Telegram account. That would be his ultimate hack.
Ariovaldo Moreira, Delgatti's former lawyer, woke up early on the morning of July 23rd in Araraquara, feeling glum. Life had become stagnant for Moreira; he had recently separated from his wife. His legal practices had become monotonous. Moreira immediately dropped to his knees after his morning stretches and prayed to the Virgin Mary: 'Help me, Santa Maria! "He was begging. "I need a change. In my life, I need something."
As it would happen, a drastic change was descending on Araraquara that very morning, in the form of a tightly coordinated federal police crackdown dubbed Operation Spoofing. Early-rising locals had noticed police cordoning off several streets, a strange sight in their sleepy city. At around 8 am the officers entered Delgatti's grandmother's house but didn't find him there. Shortly afterward police burst into Delgatti's apartment in Ribeirão Preto, the city where he had been attending law school, and found him sleeping. Delgatti had been up for most of the past two days, poring through Telegram accounts on his computer. He had finally taken some sleeping pills and gone to bed around 3 am. He
Others who would receive a visit from police that morning were far less prepared.
In São Paulo, Delgatti's old friend Gustavo Santos was pinged awake by a cell phone alert. Santos, who now lived with his girlfriend in Brazil's largest city, had installed a network of cameras and sensors at the empty home he still maintained in Araraquara. The devices sent alerts to his phone when they were tripped. Sometimes the sensors were triggered by cats or bugs; this time they were being triggered by an early morning police raid, but Santos was oblivious. “I was really doped up from sleeping medicine,” he says. So he went back to sleep.
At around 8 am the buzzing of his apartment's intercom woke Santos again. He dragged himself up and answered. “Gustavo,” the intercom barked, “there is a Sedex here for you. You have to sign for it.”
Santos didn't recognize the doorman's voice. “Man, you can sign for me,” Santos said into the intercom, refusing to come down. But as he hung up, Santos thought: “Fuck, this does not smell good.”
Santos went to the window, parting the curtains a crack. He glimpsed several figures dressed in black approaching his apartment building. Now fully awake, he frantically started cleaning up his apartment—ripping up documents and flushing any potentially compromising material down the toilet. (Santos dealt extensively in cryptocurrency trades and other schemes.) Then, remembering the nearly 100,000 Brazilian reais in cash he had in the apartment—about $25,000—Santos went to the bedroom where his longtime girlfriend, Suelen Oliveira, was still sleeping; neither the buzzing intercom nor Santos' frenzied movements had woken her. “Su,” Santos whispered, waking her up. “You have to hide this for me, because the police are here.” She blinked at him, confused. “She didn't understand a thing,” Santos remembers.
The doorbell started ringing. There came a loud banging on the door. Then the door burst open.
Santos moved toward the police as they broke in and thrust a hand in front of them. At 6'3" and 340 pounds, with close-cropped hair and a tattooed neck and hands, Santos could strike an imposing figure. “Hold on, you're not coming in without a warrant,” he said, imagining that it was the regular civil police at his door. The operation commander stepped forward: “Young man, calm yourself. This is the federal police here. And yes, we have a warrant.”
Santos froze, and he says the police pushed his face against the wall. After reading him his rights, a policeman asked Santos a question that made little sense to him at first: “Aren't you the hacker?”
“You've got the wrong person,” exclaimed Oliveira, who had appeared in the bedroom doorway.
The federal police ransacked the apartment and found the 100,000 reais. Then the commander told the couple to collect some extra clothes. They were going to Brasilia, the nation's capital, more than 600 miles to the north.
At the airport, the couple were shocked again to see they were not taking a commercial flight but were being led toward a Brazilian air force jet. “What the fuck is all this?” Santos thought. After boarding the plane, the police cuffed Santos' hands and ankles to a chain wrapped around his waist. “We were treated like killers,” Oliveira says.
The jet took off and landed about an hour later in Ribeirão Preto. The couple were allowed to leave the plane to use the restroom. There, in the hangar of the airport, they spotted Delgatti standing between two federal police officers, wearing a suit and tie. “And I knew right there,” Santos says. Delgatti had dragged him into the biggest mess of his life.
“Keep him far from us, or there's going to be hell,” Oliveira told police.
When Santos caught his eye, Delgatti was grinning. Santos recognized the same strange smile Delgatti gave him all those years ago when he was DJing at the party, the earliest memory he had of his friend.
Santos also spotted Delgatti's friend Danilo Marques; he had been arrested in Araraquara while in class learning to be an electrician.
After he'd done his stretches and dropped to his knees in prayer, Moreira had gone to the gym in Araraquara, and then to his office. He was wearing Bermuda shorts—his usual attire when not expecting clients. At 10 am, sitting in front of his computer, Moreira got a call from Santos' mother. “Ari, it's full of police at the house,” she told him. The police were searching Santos' family home and Santos' own nearby house. “It's probably nothing,” Moreira assured her. “Santos gets himself in trouble all the time.” But soon Santos' sister was on the line saying Santos had been arrested in São Paulo. Moreira told her that the police needed a warrant. He went back to work.
Moments later a photo of the warrant landed in Moreira's WhatsApp. Sighing, he started to read it. His eyes latched on to a name: Sérgio Moro. He went back and read again. Santos, the warrant said, was wanted in connection with the hacking of Moro's phone. This, Moreira realized with shock, was linked to Vaza Jato, the Car Wash leaks. “Gustavo did this?” he thought. “It is not possible.” But there it was, in black and white.
Moreira ran to his son, a lawyer who worked with him in an adjoining room of the office. “Behold!” he cried, excitedly banging his desk. “The show is about to begin.” Moreira dashed for the elevator, a flash of Bermuda shorts, his son trailing after him. What had happened? “Turn on the TV, because you're going to see me there!” Moreira exclaimed and stepped into the elevator. He drove home, started packing, and got himself booked on the next flight to Brasilia.
On the evening of the arrests, Luis Flavio Zampronha de Oliveira, the federal police chief in command of Operation Spoofing, finally got to sit down with his chief suspect after weeks of hunting. It was almost anticlimactic. Delgatti admitted to the hacks right away. He said he had acted alone and that everything had started when he hacked Bombardi, the prosecutor in Araraquara who had pursued him for years. He described how the prosecutor's phone book had led him to other officials, and finally to Dallagnol. He admitted that he had, in fact, been the one who hacked Moro's Telegram account. He admitted to hacking Manuela d'Ávila—whose number he had gotten through the phone book of the impeached ex-president Dilma Rousseff. Delgatti also claimed to have hacked Lula's Telegram but said he possessed no record of that.
As it happened, in the form of a tightly orchestrated federal police crackdown called Operation Spoofing, a dramatic shift descended on Araraquara that very morning. Early-rising locals had observed police cordoning off many avenues, a strange sight in their sleepy community. The officers entered Delgatti's grandmother's house at around 8 am, but they did not find him there. Shortly afterwards, the police broke into Delgatti's apartment in Ribeirão Preto, the town where he attended law school, and found him asleep. For most of the past two days, Delgatti was up, poring through Telegram accounts on his machine. Finally, he took some sleeping pills and went to bed at around 3 am. He
As the federal police scoured the 7 terabytes of information stored on devices they had seized in their raids, they found evidence of 6,508 calls made to 1,330 different numbers, resulting in 176 successful invasions. They also found that suspicious sums of money had circulated among their suspects in just the past few months. But a clear picture of the motives behind the hacking scheme never quite came together. Certain text exchanges between the suspects seemed to suggest a conspicuously timed change in financial fortunes; in April 2019, for instance, around the time Delgatti was hacking Dallagnol's phone, he had texted Marques to say “the storm is over” and the “bonanza has come.” And Santos was evasive under questioning about his sources of income and cryptocurrency trading, which made prosecutors wonder whether the suspects had been paid in cryptocurrency to conduct their hacks. But ultimately they found no evidence that Delgatti had carried out his hacking spree for money—only that their suspects had been separately involved in various petty financial frauds for years. For the police, as for everyone who knew Delgatti, the reasoning behind the hacks remained fundamentally mysterious. Zampronha, the federal police chief, kept asking Delgatti why he did it. There was no clear answer.
The first time Moreira was able to see Delgatti was at the suspects' preliminary hearings. The lawyer was in the waiting area with Santos and Oliveira—they were in handcuffs, alongside armed police—when Delgatti came in wearing a suit: “Hey, what's up Ari!” Delgatti cried when he saw Moreira. “Did you see what I did?”
Delgatti was charged with being the ringleader behind the hacks. Santos, Marques, and Oliveira were charged as accomplices; the main evidence against them appeared to be that some of the hacks were carried out from their IP addresses. All of them were accused on separate charges of being members of an organized crime ring.
On September 19, a second phase of Operation Spoofing went into action. The freelance computer programmer Thiago Eliezer was arrested in Brasilia. The 19-year-old law student Luiz Molição was arrested outside Ribeirão Preto. Eliezer was accused of developing techniques used in the crimes, while Molição, investigators alleged, had helped Delgatti compile the material and conduct some of his communications with Greenwald, and also participated in the hacking of Joice Hasselmann. As part of his defense, Molição claimed that Delgatti had manipulated him into helping; he described Delgatti as a “narcissistic sociopath.”
Greenwald was named in the charges too, for having “incentivized and directed the group during the period of the hacks.” The prosecutors' supposed smoking gun was Greenwald's cautious response when his source called him up for advice. But in August, Brazil's supreme court forbade Greenwald's prosecution, citing the constitution's articles on freedom of the press, and the federal police say he did not participate in the alleged crimes associated with the leaks. Even so, federal prosecutors have continued to pursue charges against Greenwald and have appealed the supreme court's decision. President Bolsonaro has publicly threatened the journalist: “Maybe he'll do jail time here in Brazil,” Bolsonaro said in one interview. Greenwald and his family have had round-the-clock security since the first stories were published. The Intercept, meanwhile, has kept publishing stories based on the leaks—more than 100 to date. (On October 29, Greenwald resigned from the Intercept over a disagreement with American editors there, but he went out of his way to voice his respect for the Intercept Brasil.)
On November 8, 2019, Lula was released from prison, just as Delgatti had boasted would happen when he first contacted Manuela d'Ávila. Lula went on to demand access to all the messages between Moro and the prosecutors in Operation Car Wash, citing their role in helping to clear his name.
As for the enormously popular justice minister and “anti-corruption” crusader Sérgio Moro, his credibility was badly damaged. He hadn't been hacked by a foreign intelligence operation, as he had strongly implied, but by small-time scammers. After the leaks, Moro kept a low profile, and in April 2020 he resigned from the government after coming into conflict with Bolsonaro. Moro has since accused the president of several crimes. But he says that ever since his messages were leaked to the Intercept, he has periodically deleted his chats, so he no longer has many of the messages between him and Bolsonaro that would have provided concrete proof. This is the closest Moro has come to admitting the veracity of the leaked messages. He declined to comment for this article.
In written responses to my questions, Dallagnol still affirms that the Intercept's leaks showed no evidence of “illicit activity” by public authorities or “any crime.” Dallagnol also dismisses the Intercept as biased, accusing its staff of “making terrorism and personal attacks on social media.” He adds, “It was militancy, not investigation or journalism.” Ultimately he is defiant: “Car Wash was and is the greatest anti-corruption work in Brazilian history,” he says. It was a “hundred times bigger than Watergate,” he adds, “which isn't something we should be proud of, because it shows just how far corruption can go. The investigation was an earthquake that shook the state of systemic corruption.”
Many people in Brazil remain incredulous that a fraudster from Araraquara was behind the biggest leaks in Brazilian history. Conspiracy theories have circulated linking the hackers to communists, the Workers' Party, or other wealthy financial backers. Some have even pointed to Delgatti's childhood nickname—Red—as a sign of his supposed hard-left politics. Speculation continues in some circles that the group was paid in cryptocurrencies, though Delgatti denies having ever used them.
According to Eliezer, Delgatti assured him in prison that they wouldn't be locked up for long, thanks to a tia—literally meaning aunt. He seemed to be alluding to some powerful contact: “He talked many times about a tia and that she would help us,” Eliezer tells me in written answers to my questions, provided through his lawyer. (Delgatti denies saying this.) But as the months rolled by and the other suspects were released pending trial, Delgatti remained in custody.
Delgatti was held for a year in Block F of the Papuda Penitentiary Complex in Brasilia, which was ravaged by Covid-19. More than 1,000 inmates contracted the disease. For many months, it was difficult for Moreira, who once again began representing Delgatti late last year, to speak with his client and old friend. But in May and June, Moreira was able to deliver questions to Delgatti for me.
In responses delivered through Moreira, Delgatti wrote that he did what he did both to save Brazil “and because I myself had been wronged.” He went on: “I never asked money from anyone, what I wanted was justice.” Since the media attention has died down, Delgatti has despaired at the lack of action against those exposed in the leaks. “I think that I should be free,” Delgatti wrote. “Without a doubt I could be helping justice with regards the crimes committed by the operators of Car Wash.”
In Delgatti's answers to my questions, there are hints of a motive. “I never felt so good in my whole life,” he wrote of the moment when the leaks first came out in the Intercept. “I was proud of my achievement—I'm a vain person, and I had the feeling of a mission accomplished.” He also seemed disappointed that he is not adored in Brazil the way he imagined he would be.
The commander of Operation Spoofing, Luis Zampronha, believes that Delgatti must be punished for his crimes. In the only interview about the case that he has given, Zampronha described Delgatti to Quiziosity as narcissistic and troubled but fit to stand trial, and certainly not worthy of adoration. In Zampronha's mind, Delgatti is a scam artist who managed to invade the private lives of authorities, and no grand ideological hacker. “He is not Snowden,” Zampronha says.
Most Brazilians would agree. The tale of a ne'er-do-well turned cyber-crusader simply doesn't fit anyone's script. Now an entire country is in much the same position that Delgatti's associates from Araraquara have often found themselves in, never knowing how seriously to take a serial fantasist.
On October 17, Delgatti was finally released from prison to await trial in Araraquara; he now wears an electronic ankle monitor. There was very little media comment on his release. Just before this magazine went to press, I spoke to him over a voice line, in the first and only interview he has given. He was audibly emotional about the injustice he feels he has been dealt. “In my opinion I should be honored as a hero, and not labeled a criminal,” he said. But he became somewhat evasive when I brought up something he'd written earlier. At one point in prison, Delgatti had told me that he only gave a portion of the material he had hacked to Greenwald. “It's only the tip of the iceberg,” he had said.
When I asked him on the call how much more material there was and what he planned to do with it, he chortled and said he'd better not answer that. “It affects my personal freedom,” he said. Maybe there is no other material. But if it exists, it could be a time bomb waiting to explode in Brazil, and Delgatti could yet receive the adulation he dreams of. Or it could detonate and leave him in yet another cloud of smoke.
Updated 11/13/2020 12:10 pm EST: The subheadline of this article has been updated to reflect that Walter Delgatti approached Glenn Greenwald last year, not last fall as previously stated.
DARREN LOUCAIDES (@darrenloucaides) wrote about Italy's techno-utopian Five Star Movement in issue 27.03.
This article appears in the December 2020/January 2021 issue. Subscribe now.
Let us know what you think about this article. Submit a letter to the editor at mail@Quiziosity.com.
