On the eve of his trial in Lisbon, the man behind Football Leaks admitted he illegally hacked dozens of email accounts. Rui Pinto argued that he had a noble purpose: to reveal serious crimes. That’s why, he says, he should be considered a whistleblower, not a hacker.
By Nuno Tiago Pinto , staff writer at Sábado magazine in Portugal
From the moment Football Leaks was created on 29 September 2015, the man behind the website that exposed football industry’s best kept secrets always gave the same answer every time he was questioned about how he had obtained the cache of documents he revealed: he guaranteed that he received them from multiple sources and that he was no hacker.
The first time he stated it was in December 2015 in an email exchange with The New York Times, under the alias “John”: While “people may think we are hackers, we are only regular computer users”, he said.
In February 2016, during a meeting with Der Spiegel in an unidentified town in Eastern Europe, he repeated he was no hacker, cryptically adding: “We have very serious, secure sources. However, some of our sources do not realize that they are our sources. The important thing is that all our documents are genuine”.
Later that year, when questioned by Der Spiegel if he was a hacker, “John” replied: “We never hacked anyone, and like we always stated, we are not hackers. All we have is a good network of sources. All those ridiculous allegations are coming only from a criminal organisation. That is what Doyen is for us, a mafia organisation.”
In the next two years, Football Leaks continued to publish public interest information about the football industry. But all came to a halt following “John’s” detention in Budapest by the Hungarian police when he was about to leave his apartment. It was there, while in house arrest, that Rui Pinto, a 31 years old Portuguese citizen, admitted he was John, the creator of Football Leaks said in an interview with Der Spiegel, the French site Mediapart and German public television NDR.
In that same interview, asked again if he was a hacker, he kept his previous version: “I don’t consider myself as a hacker, but as a citizen who acted in the public interest. My sole intention was to reveal illicit practices that affect the world of football.” He also added: “I do not consider myself a hacker, just as a normal computer user. In addition, I don’t think it makes any difference whether someone passes on incriminating documents from within a company to the public, or whether they do so with material they receive from outside.”
Months later, when Rui Pinto arrived in Lisbon, he was questioned by a judge on 22 May 2019. For more than an hour he answered part of the questions posed to him. He denied being the sole responsible for Football Leaks website and stated “there was no unauthorised intrusion in computer systems of national or international entities.”
That same judge sent him to pre-trial detention. And it was in prison, following his prosecution for extortion attempt, illegitimate and improper accesses, computer sabotage and correspondence violation, that he gave a new interview to Der Spiegel repeating, with a slightly twist, that he was no computer pirate: “I fully accept that, from the standpoint of Portuguese law, some of my acts may be considered illegal and I will speak out on that. I maintain that many things that are mentioned were not illegally done. And I don’t consider myself a hacker.”
But now, nine months later, that has changed: on the eve of his trial, that started on 4 September, Rui Pinto’s lawyers presented the court a document, contesting the charges for which he is currently under trial and giving his version of the facts, in which they admitted he illegally hacked dozens of email accounts and explain how “easily” he did it with the help of the email account owners. But they also stated that he did it with a noble intention: to reveal serious crimes. A reason why, they believe, he should be considered a whistleblower and his actions be viewed as such.
According to Rui Pinto defence lawyers, the court should take into account that his “motivation to the practice of illicit actions was his desire to publicly denounce serious crimes.” They go on mentioning that it was Football Leaks that allowed European authorities identify criminal practices that otherwise would last indefinitely and that his actions had an international repercussion, not only in the football industry but also recently with the Luanda Leaks scandal – the reason why, they believe, his actions should be analysed according with the European legislation that protect whistleblowers, even though they recognise that Rui Pinto had no professional relation with his targets.
The origins of Football Leaks and the extortion attempt
But before they dug into the details, the lawyers Francisco and Luisa Teixeira da Mota went back in time to remember how Rui Pinto got interested in the football business. According to the document, around 2010, as a fan, he started to closely follow the millionaire transfers of players and tried to understand the accounts of football clubs. In those reports he found mentions to offshore companies that were regularly beneficiaries of millionaire commissions and transfer fees. But no one knew who was behind those societies.
That was why, they stated, he decided to create Football Leaks, a place where he would publish original documents so that the average citizen could understand how football businesses work. According to that same document, Rui Pinto wasn’t alone in his project. But to protect his unknown associates not only will he maintain their identity secret but he will also assume the responsibility for “facts he didn’t commit, information he didn’t personally access and posts he didn’t publish.” According to Rui Pinto’s lawyers, a “substantial portion of the published documents were sent by anonymous sources to football leaks email” and those documents were “hugely important to European judicial authorities and football regulation entities to initiate their inquiries.” They mention, among others, the case of FC Twente and Manchester City FC.
Then, the lawyer went on the offensive classifying it Doyen’s attempt to give Rui Pinto “moral and ethics lessons,” as “disgusting” – given the fact that, according to them, Doyen is a company “with a heavy criminal record.” They argue that, contrary to what the prosecution states, Rui Pinto never hacked Doyen Sports Investments (DSI) servers, for the simple reason that the company was based in Malta, formally had no office in London and no connection to Doyen Capital – the true victim of illegal access. For that reason, they argue, Rui Pinto can never be considered guilty of those charges.
Regarding the extortion attempt of which he is accused, the document presented to the court states that Rui Pinto contacted Nélio Lucas in September 2015 using the alias Artem Lobuzov with the goal of trying to confirm the crimes he discovered and to see how valuable that information was to the then Doyen Sports Investments CEO. During that email exchange he asked for a donation of between 500 000 and 1 million euro to make everything disappear. Rui Pinto eventually contacted the lawyer Anibal Pinto to represent him in what he calls negotiations to sign a services contract agreement. Following the meeting between lawyers on 21 October 2015, Rui Pinto’s defence reveals that he “admitted” the possibility of “working” for Doyen as a technician with the annual salary of 25 000 euro. According to an email exchange with Anibal Pinto, Rui Pinto even considered the creation of an offshore company in Malta to pay “virtually” no taxes while working for Doyen. However, according to his defence argument, he quickly realised his mistake, stopped all negotiations and voluntarily and sincerely gave up the extortion attempt – a reason why, according to Portuguese law, he shouldn’t be found guilty for the extortion attempt.
The hacking admission
Besides the extortion attempt, Rui Pinto is on trial for hacking the systems of Doyen Sports Investments – which he denies – Sporting Clube de Portugal, the Portuguese Football Federation (PFF), the Score Platform, the Portuguese General Attorney’s office and the law firm PLMJ.
In the case of Sporting, he is accused of launching such a massive attack on 22 September 2015, that the club’s email servers were paralysed for three days. According to his defence, he never had the “intention” of causing such damage and never admitted that possibility “acting like he did” because any updated computer system would never collapse while receiving a “large influx of communications from a single IP address.” “Surprisingly, Sporting didn’t have” what they refer to as a “common anti-DOS software” that would protect the club servers.
Regarding the Portuguese Football Federation, Rui Pinto’s lawyers mention that its interest in the organisation was related to the “impunity” he observed in several questions related to “corruption” in sports. Facts that he himself denounced between 2015 and 2018. “Those were the motives that led” Rui Pinto to “become aware of information that existed in PFF.”
Rui Pinto’s defence goes on saying that contrary to what the prosecution states, his interest in PLMJ didn’t originate in that lawyer’s office relation with Benfica or with information related to some of the biggest judicial investigations in Portugal in recent years.
They state that in 2017/18 Rui Pinto had accessed several amounts of information related to the company Fidequity and several suspect financial operations related to Isabel dos Santos, the daughter of former Angolan president, José Eduardo dos Santos. As he read those documents, he says he realised that some of PLMJ lawyers, such as Inês Pinto da Costa, were “key elements in facilitating the money laundering” on behalf of Isabel dos Santos. He then decided to investigate her suspicious businesses because it was clear to him that her money “originated in corruption in Angola”. To clarify what they call “shady deals” he needed to obtain documents from the PLMJ office. “The defendant recognises that the documents found in Inês Pinto da Costa email inbox allowed him to complete the puzzle that originated Luanda Leaks,” they write. “The information from PLMJ together with information from other sources allowed the defendant to give PLAAF (Platform to Protect Whistleblowers in Africa) the material that originated the so-called Luanda Leaks” revealed by an International Investigative Journalism Consortium. “It should be noted that the defendant never obtained any economic advantage from any of his actions described in the indictment / accusation,” they stated.
The defence also recognises that the forensic report elaborated by the Judiciary Police accurately describes his activity between 2015 and 2019. “The defendant analysed documents and informations related to a certain entity, he found connections with other entities and when he located the email addresses of the ones involved, he analysed infrastructures and access points, mainly electronic mail platforms, identifying their fragilities and creating a kind of form” that he would later send to his targets who “inserted their credentials, giving the defendant access” to those credentials and their IT systems.
He denies he ever sent malware or virus and stresses that it was the email owner who, not realising that the web page he was accessing was not reliable, inserted his credentials. “The ease with which he entered the systems combined with the access to information that, in part, reflected the unlawful actions the defendant understood should be of public knowledge gave him the conviction, on one hand, of impunity and, on the other hand conferred him a sense of ‘fairness’ of those actions,” the lawyers write. For that reason, they stress, Rui Pinto conduct presents a “diminished fault” taking into account “the reasons for the practice of the facts: looking for proof of the practice of serious crimes and publicly disclosing them.”
Finally, the lawyers state that Rui Pinto “regrets that in order to obtain the data he was looking for he ended up practicing criminal acts.”
Rui Pinto goes on trial
Even though Rui Pinto admitted that he practised “criminal acts” while accessing other people’s emails, in the opening session of his trial in Lisbon he stated again that he doesn’t consider himself a hacker. In a written statement prepared by his lawyers, Rui Pinto told the court that in the document presented by his defence he tried to transmit “everything he considered relevant to the discovery of the truth.” He stressed that he was there in a strange position: on one hand he is facing trial while on the other hand he is a protected witness, integrated on a Portuguese State Protection Program. Due to that condition his trial had extreme security measures with heavily armed police officers patrolling the streets and the court and he even used a bullet proof vest.
That condition as a witness originated in an agreement he made with the authorities: in exchange for his freedom and the guarantee that the information kept in the hard drives that were apprehended to him in Budapest could never be used against him, he agreed to open those same hard drives and cooperate with the authorities in the investigation of serious crimes.
“As I always said, I don’t consider myself a hacker. I am a whistleblower because I have made public, in total good faith, a lot of information of manifest national and international public interest that otherwise would never be known,” he said. “I was surprised and indignant with what I found and understood I should reveal. Initially through the Football Leaks website, but also through collaboration with media outlets worldwide. My own work of document analysis and direct assistance to journalists is, in my opinion, a work that has contributed to strengthening freedom of expression.”
He moved on saying that his revelations are “a source of pride not of shame. I see today that there are important criminal investigations that have been initiated due to these revelations and I trust that there will be many more”. “At this point I just want to reaffirm that nothing I did was for money and that I never received any money for the information I revealed.”
Depending on the course of the trial, he then reserved for him the right to address the court on a later stage. His case will be decided in the next couple of months.
