Der Spiegel and other newspapers hail him as an important whistleblower, but five years ago Rui Pinto obtained 268,000 euro from two bank accounts in the Cayman Islands through hacking. Then he turned to football.
By Nuno Tiago Pinto
In late 2013 the world had never heard of Rui Pinto. Back then he was just a graduate history student at the Universidade do Porto, having finished a semester through the Erasmus exchange programme at the university in Budapest. He lived with his father, stepmother and sister in Vila Nova de Gaia, the neighbouring town of Porto, Portugal’s second largest city. Today he is known as “John”, the man behind Football Leaks, the website that from late 2015 revealed some of football best kept secrets.
Before he decided to target football clubs, international sports funds, agents and law firms, he used his computer skills to his own benefit. According to a criminal complaint filed in Portugal by the Caledonian Bank, an offshore company registered in the Cayman Islands, on 13 September 2013, someone managed to access the server that stored all the bank’s emails. Commercially known as Mimecast, the server was located on the island of Jersey. And among the information available in those emails were the usernames and passwords who allowed anyone who had them to enter the Caledonian Bank’s back office website with administrator privileges – and access to all the bank’s client accounts.
According to the criminal complaint, that’s exactly what happened on 18 September 2013: Someone accessed one account and ordered an international transfer of 46,857,26 dollars (34,627 euro) to a Deutsche Bank Lisbon account. At the time, no one noticed. But less than one month later, on 10 October, the same person hacked another account and ordered a transfer, this time of 310,000 dollars (229,748,76 euro), to the same Deutsche Bank Lisbon account. Its owner was unknown at the time: His name was Rui Pedro Gonçalves Pinto.
Once it detected that more than 300,000 dollars had disappeared, the company that owned the account alerted the Caledonian Bank that it hadn’t ordered such a transfer. It was only then that the bank became aware that something was going on. To avoid reputational damages, the Caledonian Bank immediately returned the money to the client. Then the bank ordered an IT analysis of its system. The investigation that followed was able to determine that the IP address used to order the last transfer belonged to the Universidade do Porto. It was then that, through the law firm Morais Leitão, Galvão Teles, Soares da Silva & Associados, the bank filed the criminal complaint alleging that several crimes were at stake: correspondence fraud, computer fraud, illegitimate access and illegitimate interception.
According to the judicial documents available for consultation at the public prosecutor’s office in Porto, while it filed the criminal complaint, the Caledonian Bank’s lawyers also warned Deutsche Bank Lisbon that both transfers were not legitimate. The goal was to identify who received the money, something Deutsche Bank Lisbon refused alleging bank secrecy. Yet, the German bank contacted its client who, according to the correspondence available in the judicial file, immediately accepted to return the 310,000 dollars improperly received. “Regarding the higher transfer our client didn’t recognise it and we received instructions to return it. Regarding the lower transfer dated September this year, our client told us that it is due to him and consequently did not authorise its return,” wrote a Deutsche Bank official. According to that same official, it was up to the Caledonian Bank to ask the authorities for an investigation.
While the judicial files don’t give any explanation why Rui Pinto considered that the transfer of 46,857,26 dollars (34,627 euro) was due to him, the fact was that he had spent parts of it. His bank statements available in the judicial file reveal that before he received the first transfer he only had 31,67 euro in his account. In the weeks after 18 September 2013, he made several withdrawals of 20 and 40 euro, ordered two bank transfers (one of 981 euro, another of 109 euro) and paid 15 euro to Vodafone. When in early November the state attorney froze his bank account, he had 33,671,67 euro available.
The settlement
At the time the investigation wasn’t considered a high priority. The judiciary police department in charge of computer crimes lacked resources and the investigation came to a halt. It was Rui Pinto himself who in early January 2014 decided to contact the criminal court saying that the bank informed him that he was “involved in a judicial investigation that motivated the apprehension of his bank account” for reasons he was not aware of. “This entire situation is new to me and I don’t know who to turn to in order to clarify everything. I would like to be informed where I might access this investigation and if I have to travel to Lisbon for that (something that would make me spend a lot of money) or if I can have access to it in my area of residence, namely Vila Nova de Gaia,” he wrote.
He received no answer to his request. But in February 2014 the judiciary police asked the Caledonian Bank to provide something that could alter the fate of the investigation: the account owner’s identity and their bank statements. Something the Caledonian Bank refused, alleging legal constraints and bank secrecy. “The disclosure of our client’s identity, who is not indicted, would jeopardise their privacy, something that doesn’t appear indispensable for the discovery of the truth,” the bank’s lawyers replied.
On 27 August 2014, Rui Pinto was summoned to the judiciary police to be heard. By his side was a lawyer, Anibal Pinto (the two are not related), and he chose not to answer any questions, a legal right all suspects have.
During the weeks that followed, both sides met through their lawyers. And on 23 September, the Caledonian Bank informed the public prosecutor’s office that it had reached an agreement with Rui Pinto to “end the existing dispute.” According to the settlement that was sent to the authorities, Rui Pinto agreed to “return 17,313,50 euro,” half the amount transferred on 18 September 2013. In return, the bank agreed to drop the complaint.
Several sources involved in the process reveal that the Caledonian Bank decided to reach an agreement to avoid public disclosure, not only of the client’s identity, but also of the fact that their system could be easily hacked (in 2015 the bank went into bankruptcy following a lawsuit filed by the U.S. Securities and Exchange Commission in connection to a fraud scheme worth 75 million dollars). An attachment to that agreement includes an irrevocable order signed by Rui Pinto sent to Deutsche Bank Lisbon in which he orders two actions: the first is the transfer of the agreed amount to an account in the Cayman Islands; the second the transfer of the “remaining amount” in his bank account to the client account of Anibal Pinto & Associados, his lawyer’s office, in total 16,358 euro.
Questioned about his intervention in the judicial investigation and the amount he received, Anibal Pinto declined to comment: “All I can say is that the bank filed a complaint and then withdrew it. Rui Pinto was never charged or tried. Regarding the money, I’m obliged to professional secrecy.”
The hacker
In a recent interview he gave to Der Spiegel, MediaPart and NDR, Rui Pinto talked about his history with the Caledonian Bank saying: “In the end I haven’t received any money from that bank. I did not steal the money, that’s not the real story.” Questioned about the real story, the Portuguese replied that he can’t talk about it because he “signed a non-disclosure agreement with the bank.” But the documents available in the judicial investigation don’t mention any non-disclosure clause or agreement. Questioned about these inconsistencies, Rui Pinto’s current lawyer, William Bourdon, opted not to comment.
In the year that followed his agreement with the Caledonian Bank, Rui Pinto went unnoticed. With a clean criminal record in Portugal, he moved to Budapest. And without anyone knowing, he was about the change the football world. According to the Portuguese judiciary police investigation, in late September 2015 he hacked Sporting Clube de Portugal’s board of directors and legal department email accounts. He also accessed Doyen Sports Investments Limited servers. Then he began to publish documents on the website Football Leaks – Livejournal.
Regarding Sporting, he revealed several contracts, including the one of defender Marcos Rojo (currently at Manchester United) and the manager Jorge Jesus, who had left Benfica on what was that summer surprise transfer. It was then that Portuguese fans became aware that Jesus received five million euro per year that would rise to seven million if he won the national championship. Regarding Doyen Sports, the website revealed confidential documents signed between the fund and football clubs. Those included, among others, the agreements with FC Porto (the club Rui Pinto supports) regarding midfielder Giannelli Imbula and defender Eliaquim Mangala.
The blackmail
On 30 September, Sporting CP filed a criminal complaint for illegal access of their servers. One week later, Doyen followed. That same day, 7 October 2015, Nélio Lucas, Doyen Sports Investments Limited founder, travelled from London to Lisbon to attend a meeting at judiciary police headquarters. That afternoon, at 16:15, he told investigators that four days before, he had received an email, written in Portuguese, from someone who presented himself as “Artem Lubozov” and who claimed to be in possession of confidential information about Doyen Group and its relations with other companies around the world.
In the emails that followed, “Artem Lubozov” said he was willing to keep the information private, in exchange of a “generous donation.” That donation, Nélio Lucas told the authorities, was between 500,000 and 1,000,000 euros. During that email exchange, “Artem Lubozov” suggested that the negotiations should go forward between lawyers and he mentioned that he was ready to remove part of the Doyen related documents from the Football Leaks website – something that indeed happened.
According to what Nelio Lucas told the authorities, “Artem Lubozov” guaranteed him, that after receiving the money, he would “put an end to the ongoing communication interceptions and that he would deliver the entire Doyen documentation in his possession,” whether on paper or in digital files stored on a hard drive. On that occasion, the Doyen CEO agreed to give the police access his mobile phone, so that the investigators could do a digital copy of the emails. At the same time, he accepted to be part of an undercover operation destined to identify the then mysterious hacker. From that moment on, every email he sent to “Artem Lubozov” was following judiciary police instructions.
The first step was to schedule the proposed meeting with “Artem Lubozov” representative: the lawyer Anibal Pinto. According to the European arrest warrant (EAW) issued 15 January 2019 by the Portuguese public prosecutor’s office, that meeting took place on 21 October 2015. Following judiciary police instructions, Nelio Lucas and his lawyer, Pedro Henriques, scheduled the meeting to a petrol station located on the motorway between Lisbon and Cascais. Lucas booked a flight so that Anibal Pinto could travel from Porto to Lisbon and he hired a car to be at his disposal while in the Portuguese capital.
Wearing a listening device, Nelio Lucas was there with his lawyer Pedro Henriques. According to the EAW, judiciary police investigators were also at the scene. On the other side of the table, Anibal Pinto told them that his client was the author and the person responsible for Football Leaks and that he was there to negotiate an agreement that would “reconcile both parties.” The lawyer said that his client “was willing to receive the agreed amount in annual instalments (for three to five years) ensuring the agreement full confidentiality.”
To the Portuguese police, that meeting’s main goal was to obtain the hacker’s identity. But Anibal Pinto never revealed his client’s name. However, according to several sources with knowledge of the conversation, at a certain point he said that his client’s skills were so good that in the past he had been able to divert money from a Cayman Islands bank.
It was a small detail, but enough for the investigators. After the meeting, which ended without any agreement, they were able to track down Anibal Pinto’s past cases and quickly found that, one year before, he had represented a young man that had supposedly hacked the Caledonian Bank and later reached an agreement: Rui Pinto.
Rui Pinto’s confession
On the weeks that followed, “Artem Lubozov” sent several emails to Nelio Lucas saying that everything was a “mistake” because he did not know that he might be committing a crime – something he became aware through his lawyer, he claimed. Recently, Anibal Pinto publicly acknowledged having been present a the motorway meeting, but when he had “doubts regarding the legality” of what was going on he turned away from the case.
In that final email exchange, “Artem Lubozov” stated he didn’t want to receive one cent and that he wasn’t the author of Football Leaks. Portuguese authorities believe that this change of speech happened because they (Rui Pinto and his lawyer) realised that they had been trapped.
In his recent interview with Der Spiegel, Rui Pinto indirectly acknowledged he was in fact “Artem Lubozov” and spoke about his attempt to blackmail Doyen Sports. “The only reason I contacted Doyen was to confirm the wrongfulness of its actions, based on the amount of money they were ready to pay to make the revelations go away,” he said. “I just wanted to see how valuable it was, how important the documents and the information were to Doyen. I thought I could find that out by learning how much Doyen was prepared to pay for my silence. I never had the intention to take the money. I only wanted to expose Doyen.”
Regarding the lawyer’s meeting with Nelio Lucas, Rui Pinto said: “I wanted to see what they would offer him. While he was negotiating, I continued to read the documents. As I did so, I told myself: If I allow them to buy me out now, I am no better than this whole business. So, I wrote to Doyen and told them to keep their money. Not a single cent was paid. What I did, was very naive. Looking back now, I regret it. But I repeat that I deny having committed any criminal offence.”
After his contacts with “Artem Lubozov” ceased, Doyen Sports contracted a private investigators firm that includes former British intelligence officers. They were able to track down the hacker’s digital footprint and locate him in Budapest. They shared that information with the judiciary police, and they also tried to expose Rui Pinto as the man behind Football Leaks through a website called Football Leaks Revealed that was online for a short period. At the time, March 2016, Rui Pinto publicly denied all accusations.
In the meantime, Football Leaks continued to publish information regarding players, managers, agents and clubs. Rui Pinto established a partnership with Der Spiegel, who shared the material with the network European Investigative Collaborations (EIC), and gave the German news magazine access to 70 million documents. Some of them were the basis of journalistic investigations that revealed, among others schemes of fiscal fraud involving players and managers like José Mourinho, Angel Di María or Cristiano Ronaldo – who is also involved in an alleged rape attempt in Las Vegas, which is currently under investigation.
Due to the lack of cooperation from Hungarian authorities, the Portuguese investigation came to a standstill. It was only after the disclosure of several cache of emails of Sport Lisboa e Benfica and the revelation that Rui Pinto was the main suspect of being the man behind it – something he denies – that the investigation gained a new life.
In January, once they got confirmation that Rui Pinto was in Budapest, the Portuguese public prosecutor issued a European arrest warrant against Rui Pedro Gonçalves Pinto. On the following day he was arrested in the Hungarian capital while leaving his apartment with his father. The EAW mentions six crimes allegedly committed by Rui Pinto: two of illegitimate access; two of secrecy violation; one of offence to a collective entity (Doyen); and one of extortion attempt. All related to Sporting CP and Doyen Sports Investments.
In court Rui Pinto opposed the extradition to Portugal and is currently under house arrest in his Budapest apartment, waiting for the court’s final decision. His lawyers argue that he is not a criminal, but a whistleblower that revealed public interest information and is currently cooperating with European authorities. Something he should be protected for. This is an argument that the Portuguese authorities don’t agree with – and they want him back in Portugal.
*Nuno Tiago Pinto is a Portuguese reporter working for the news magazine Sabado.
