From a data security breach at the Colombian Public Prosecutor's Office came "the largest investigative project on organized crime originating in Latin America." NarcoFiles, which launched on Nov. 6, brought together more than 70 journalists and 40 news outlets from 23 countries to explore a data leak that highlights new strategies and global configurations of drug trafficking.
The project was led by the OCCRP (Organized Crime and Corruption Reporting Project) in partnership with CLIP (Latin American Center for Investigative Journalism, by its Spanish acronym) and has media partners in nine countries in the region: Brazil, Colombia, Ecuador, Guatemala, Honduras, Mexico, Panama, Peru, and Venezuela. In addition to its Latin American partners, media from the United States and 13 European countries are also part of the consortium.
The investigation was based on a leak, published in October 2022, of more than five terabytes of data from the federal Colombian Public Prosecutor's Office. By way of comparison, the leak on which the Pandora Papers investigation was based consisted of 2.9 terabytes, while the Panama Papers project began from a leak of 2.6 terabytes of data.
The leak was claimed by the hackactivist organization Guacamaya, which in 2022 also hacked state institutions in Chile, El Salvador, Mexico, and Peru. The organization allegedly took advantage of a vulnerability in the Microsoft Exchange email server to access the data.
Following the disclosure of the leak, in November 2022 the Colombian Public Prosecutor’s Office stated that it had opened “a criminal investigation to clarify the alleged occurrence of the security event.”
Among the data leaked from the Public Prosecutor's Office were more than seven million emails exchanged by the agency's employees, as well as PDF documents, spreadsheets, and audio clips, among other files. The information in the emails and documents concerned investigations by the public prosecutor’s office into organized crime, including operations in partnership with other countries.
“This is definitely one of the largest leaks we worked with,” said Paul Radu, co-founder and director of innovation at OCCRP, to LatAm Journalism Review (LJR). The organization has been carrying out and coordinating transnational collaborative investigations since 2007 and, according to him, this is the largest project of its kind to have originated in Latin America.
Paul Radu, from OCCRP: "We have worked on organized crime for a long time and have done many projects, but never on this scale." (Photo: Courtesy OCCRP)
“Post-Panama Papers and our ‘Laundromat’ investigations, everybody was focused on financial crime: offshores, enablers, and this type of financial structures that are behind a lot of the corruption in the world. But there weren't large-scale investigations of organized crime. We have worked on organized crime for a long time and have done many projects, but never on this scale,” Radu said.
At the time of the leak, the data was shared with the OCCRP and some Colombian news outlets, including Cerosetenta and Vorágine, which are part of the NarcoFiles project. Although some Colombian media published feature stories based on the data immediately after the leak, OCCRP, CLIP, Cerosetenta, and Vorágine decided to dive into the data together and carry out a transnational collaborative investigation based on clues in the leaked documents.
“Our view was that this can't be just another story about cocaine and Colombians and Mexicans, because we're tired of that,” Teresa Ronderos, CLIP’s director, told LJR. “We had to really show how organized crime operates, not only looking at the origin, as always, but rather we had to look at the whole picture. As they [OCCRP] have a lot of allies in Europe, they went out looking for them, because we found that a lot of the cocaine and the routes and everything we found was going to Europe.”
OCCRP and CLIP also began to invite their partners in Latin America – media and journalists with whom the two organizations had already worked on other investigations.
“We put together a very large group of highly selected journalists in Latin America, because we wanted serious, investigative, [and] responsible people. Having access to that implies a gigantic responsibility, because there was quite sensitive information about ongoing investigations, telephone numbers, emails, names of investigators, agents.... We could only work with the best people. Certainly, there are very serious people on the continent, but especially for this, we chose people we already knew for their seriousness,” Ronderos said.
One of these partners was Ojo Público, whose team dedicated to the project was led by Nelly Luna Amancio, the Peruvian outlet's journalistic director. She also highlighted the importance of mutual trust between the partners in dealing with the sensitive data contained in the Colombian Public Prosecutor's Office leak.
“Not all of the information contained in the leak carries the weight of public relevance,” Amancio told LJR. “The idea was to work with partners with whom there was already a certain kind of trust, and as with many other collaborative projects, trust was also the basis for why we share information with so many partners and, at the same time, honesty in approaching the documents and then doing further research on them with traditional reporting.”
Faced with this "monumental leak," as Ronderos described it, it was essential to create a methodology to access the data and make it easier for the journalists involved in the investigation to work with it. This work was carried out by the OCCRP team, she said.
“You can't go into something like this and search document by document because you go crazy. So we had to systematize, classify, sort by subject, so that it would be easier for people to find the documents they needed,” said Ronderos, who stressed that the leak was only "the basis" of the investigations carried out for the project.
Maria Teresa Ronderos, from CLIP: "We gathered a lot of information far beyond what was in the leaks." (Photo: Courtesy)
Radu expressed the same idea. “The leak is just an excuse for this collaboration,” he said. “It gave us an entry point, but then we used a lot more data sets from all over the place and that gave us access to more stories.”
In almost a year of work, the journalists started with the information contained in the leak and consulted various databases and documents, filed requests for access to information in various countries, and interviewed hundreds of people.
“In some stories people went to two, three, four countries. In other words, there were people who went to many countries in order to document a story well,” Ronderos said. “We investigated, we talked to experts, we talked to the police, we talked to organizations and security entities from several countries, we even talked in some cases with some of the criminals (...). In this way, we gathered a lot of information far beyond what was in the leaks.”
This work has resulted in "more than 50 stories," Ronderos said, which have been published in partner media, and on the OCCRP and CLIP websites. These articles tell the story of the movement of cocaine production from Colombia, Peru and Bolivia to Central and North America - Honduras, Guatemala, and Mexico; new cocaine production laboratories in countries such as the Netherlands and Belgium; the export of Colombian "expertise" in the production of the drug, sending Colombian cocaine "cooks" to Europe, among dozens of other topics that speak of the global and coordinated presence of organized crime.
For Amancio, the NarcoFiles stories make it possible “to understand a form of urban organized crime, which is highly capable to adapt to new forms of prosecution by the authorities and, above all, that has a wide range of weapons and economic power.”
Moreover, “It is also a new way that journalists teach us how we can incorporate new methodologies to understand these organizations that are increasingly multinational and more sophisticated in their actions. Although they continue to use urban violence or murder for hire, those old-school crimes, the structure that protects these crimes is now much more complex, sophisticated and violent,” she said.
And given the complexity, sophistication and violence of organized crime, one of the lessons learned from this collaboration was the importance of journalist safety, Amancio said.
“We’ve had many conversations with the team about how to protect ourselves digitally and physically, because we’re talking about very powerful organizations. Part of the lessons, when you approach these issues, is to take care of the team, to take care of yourself, to rethink our defense mechanisms when we are on the streets, to not assume that because we are publishing together there is only one way to protect ourselves. In this incredible capacity of adaptation that crime has, we are the enemies in trying to expose them,” she said.
As in other transnational projects carried out by the OCCRP and CLIP, collaboration between journalists from different countries took place mostly remotely. In this project, however, there was a face-to-face meeting in Panama with around 20 journalists, mostly from Latin America, who came together at the beginning of the year for a kind of "express newsroom" dedicated to NarcoFiles. During the days they spent together, the journalists shared their findings to date and forged collaborations.
“That's when the stories began to emerge, and obviously when people meet in person, if they had not met before, collaboration arises. People began to collaborate, to exchange stories, and from there alliances emerged. You will see that several of the stories are signed by someone from CLIP, someone from OCCRP, someone from Quinto Elemento in Mexico, someone from who knows where... We all began to collaborate with each other,” Ronderos said.
Coordinating the collaborative investigations came next, carried out primarily by OCCRP with the support of CLIP. Ronderos believes that the first challenge in a project of this magnitude is precisely coordination: “coordinating all these people so that they have the freedom to work as they wish, under the own parameters of their editors and their outlet, but at the same time supporting them, being on the lookout, knowing how they’re doing and how they’re making progress in a story.”
Another challenge, according to her, is communication, crisscrossed by cultural differences that are already pronounced among Latin Americans from different countries, and even more so among journalists from different continents. Coordinators also need “to keep an eye on everyone, keep everyone on the radar,” and foster the team's enthusiasm for the project, Ronderos said.
“There were people who started out, who were enthusiastic, who participated at the beginning and then did not continue, because, I imagine, of their own personal and editorial needs (...) It’s difficult, because people also get discouraged, they forget [about the investigation]. In such a long-term project, you have to keep the project alive, and keep people informed and enthusiastic,” she said.
The last big challenge of managing such a project, according to Ronderos, is to bring the investigations and stories to a close.
“Each article could be edited 150,000 times and improved indefinitely. So, you also have to put an end to it and say 'if this can be done by that date, let's close it,' she said. And that's because once the stories have been finalized, there are still the editing, the legal review and graphic production stages, for example," Ronderos said.
According to Radu, the OCCRP has been working for 15 years on the development of “technology for collaboration.”
“I'm speaking about technological platforms that help collaborations, but most importantly: people. Investigative editors who know how to run a collaboration and inspire people in a collaboration,” he said, highlighting the work of the OCCRP team in Latin America, led by Colombia-based journalist Nathan Jaccard.
Coordination must respond to all the needs of the journalists involved in the collaboration “in a very timely manner,” Radu said.
“During the development of the project, during publication, and then post-publication, you make sure the partners are safe and that they can continue working. So it's not just a one-time hit, to do this and then let everyone hang out there afterward on their own. It's really about the spirit of collaboration, where you take care of the collaboration even after you publish it. (...) The collaboration is not just a one-time game. It's really playing for the longer term,” he said.
Radu hopes that investigative journalists around the world will choose to investigate transnational organized crime from their localities, making connections with the global movements mapped by NarcoFiles.
The journalists also hope that this spirit of collaboration will inspire authorities in different countries to cooperate in the fight against organized crime on a regional and global scale.
“What journalism is doing now is approaching these issues from a Latin American narrative, from a cross-border perspective, because these criminals have a much better understanding of the economic flows and the operation of their illegal businesses than States,” Amancio said.
“There is no real dialogue on how to confront the fight against drugs in the world. Nobody wants to accept that it’s evident that the strategy as it has been promoted up to now has not worked. I think [NarcoFiles] opens the door to the need for a more regional response to cross-border organizations, because the police or the military, with their territorial approach, are not going to be able to defeat them, because they move very quickly and have a capacity to move around that had not been seen before.”
