© 21st Century Wire
That accusation was processed by the global press as a conspiracy theory, a sore loser's cry, an embarrassing parting shot from a leftist president on his way out the door. Reuters filed it under "Petro refuses to accept results." El Colombiano ran the headline: "Petro, without arguments." The story was managed, packaged, and shelved within 48 hours, precisely as AcidReport had documented that the three industrial conglomerates owning 57 percent of Colombia's cross-media audience would inevitably do. Three conglomerates whose balance sheets depend on the stability of the financial and legal order that a big corporate De La Espriella government will now protect.
© Luisa Gonzalez/ReutersColombian President Gustavo Petro speaks during a press conference after casting his vote in congressional elections and party primaries for presidential candidate, in Bogota, Colombia, March 8, 2026
Make no mistake about: this was a high-tech coup d'etat.
KEY FINDINGSThe Machine That Counts
- The vote-counting machine is a Guernsey shell company. Thomas Greg & Sons, registered in a British Crown tax haven with no beneficial ownership disclosure requirements, has held uncontested control of Colombia's electoral logistics chain since 2010. For 2026, it was awarded a $526 million contract with no competing bid. A Colombian court ordered its software replaced in 2018 after finding it "permeable from the outside and permeable from the inside." The order was never complied with.
- Juan Manuel Santos sat on the board of the company that counted the votes. The same man who flew to Tel Aviv in 2007 to sign Colombia's foundational military dependency on Israel, 24 Kfir fighter jets, $333 million, AIPAC lobbying included, sat on the TGS board from 2002 to 2006. He is the documented bridge between Colombia's Israeli military infrastructure and its electoral machinery.
- $11 million in cash flew from Bogotá to Tel Aviv on two private jets in 2021. Colombia's police intelligence directorate DIPOL paid NSO Group for its Pegasus spyware in physical cash. Four named NSO executives collected the payments on documented flight numbers at a military hangar. The transaction was discovered not by Colombia but by Israel's own banking system. US officials subsequently confirmed to Colombia's ambassador that Washington provided the $11 million and maintained oversight of targeting.
- Two sitting cabinet ministers confirmed their phones were actively hacked by Pegasus in December 2025 and January 2026, six months before the election, with forensic authentication. 2.3 gigabytes of government data were extracted from the Justice Minister's device. The Attorney General has not requested their technical evidence.
- Israel's Foreign Minister flew to Buenos Aires in November 2025 to pre-negotiate the result. Seven months before the vote, Gideon Sa'ar met Abelardo De La Espriella and secured twelve specific policy commitments: embassy to Jerusalem, diplomatic relations restored, Pegasus reactivated, Kfir maintenance resumed, Hamas and Hezbollah designated, UN votes reversed, Colombia enrolled as Isaac Accords Phase 2. These are not campaign promises. They are a documented pre-agreed handover.
- Colombia's own financial intelligence unit confirmed three coordinated disinformation operations at Cabinet level, four days before the vote. Operación Ajax, Proyecto Júpiter, and HondurasGate were active simultaneously, coordinated, and aimed at the same target. This testimony came from the UIAF director under oath, not from Petro.
- A forensically authenticated audio vault of 37 recordings verified by Phonexia Voice Inspector, identifies the voice of convicted narco-trafficker and Trump-pardoned former Honduran president Juan Orlando Hernández stating: "The pardon money didn't come from you. It came from a board of rabbis and people who supported Israel" and "Netanyahu had everything to do with my release." Roger Stone is identified as the Washington operative who organised the pardon meetings.
- Eleven US members of Congress signed a formal letter to Rubio, Bessent, and Acting AG Blanche citing 14 Florida shell companies, FEC-flagged donations, ICC paramilitary charges, and "shameless interference of senior US officials" in Colombia's election. Rubio called De La Espriella to congratulate him on election night. He never answered the letter.
- A March 2026 Israeli government cybersecurity delegation, seven firms, coordinated by Israel's Ministry of Economy, met Colombian "decision-makers" 90 days before the election. Israel's national cyber chief had already mapped Colombia's critical digital infrastructure inside the Defence Ministry in May 2021.
- The result is formally contested. De La Espriella is president-elect by unofficial preliminary count only. Cepeda's legal team has filed 57,189 formal challenges, more than one in four polling stations. The certified vote counting process (escrutinio) is not complete. His inauguration is scheduled for August 7, 2026.
Before anything else, understand who runs Colombia's elections, because this is where the story actually starts.
A company called Thomas Greg & Sons, registered not in Bogotá but in Guernsey, a British Crown dependency in the English Channel that levies zero corporate tax, maintains strict financial secrecy, and has no obligation to disclose beneficial ownership, has held effective control over the full Colombian electoral logistics chain since 2010. For the 2026 elections, TGS led a consortium awarded a contract worth 2.1 trillion Colombian pesos, roughly $526 million, to manage ballot printing, voting materials, the preliminary vote-counting software, the Divipol electoral census database, and the hardware on which mesa results are uploaded.
© Via Getty ImagesAerial view of St Peter Port, capital of Guernsey, Channel Islands, cruise ship at anchor
© JULIO CÉSAR HERRERA Y CORTESÍACamilo, Felipe, and Fernando Bautista are the largest shareholders of Thomas Greg & Sons
© SOUTHCOM admiralsColombian President Juan Manuel Santos, flanked by SOUTHCOM admirals, arrives at SOUTHCOM’s Colombia military headquarters
The Colombian Council of State figured out the problem with that software in 2018. After four years of investigation, magistrate Lucy Jeanette Bermúdez issued a ruling finding that the TGS electoral counting software was, in her exact words, permeable from the outside and permeable from the inside, and ordered it replaced with state-owned open-source software. That order was never complied with. The same proprietary TGS system ran the 2022 elections and the 2026 elections. Petro repeatedly demanded that Registrar Hernán Penagos hand over the source code for an independent expert audit before the vote. Penagos permanently refused.
The BGP/AS network record for Thomas Greg & Sons lists its legal domicile in Guernsey while its operational address sits in Bogotá. This offshore corporate architecture means TGS pays no Colombian corporate taxes on its billion-peso state contracts, its beneficial ownership and financial flows are shielded from Colombian transparency law, and there is no Colombian judicial mechanism to compel disclosure of its internal server communications or election-night logs. The machine that counts Colombia's votes is owned by a tax haven shell run by convicted US bank fraudsters, with two ex-presidents on its board, operating a software system that a Colombian court already declared compromised and ordered replaced eight years ago.
Abelardo De La Espriella — Who He Actually Is
Understanding the candidate whom the media presents as the man who won this election requires going further back than his campaign, and further abroad than Bogotá. His father, Senator Miguel de la Espriella, signed the Pact of Ralito in 2001, the secret agreement between AUC paramilitary commanders and Colombian politicians committing to, in the document's own language, "refound Colombia." For this, the Inspector General subsequently barred him from holding public office for 20 years. Abelardo worked as a defence lawyer for AUC commanders during demobilisation proceedings, ran a foundation called FIPAZ that Cepeda documented received and disbursed AUC funds, and has minority shareholders in his rum, wine, and real estate businesses who include relatives of AUC commander Hugo Rodríguez Fuentes, known operationally as Comandante Barbie.
Cepeda filed criminal charges with Colombia's Attorney General and with the International Criminal Court, accusing De La Espriella of being not merely a lawyer for the paramilitary structure but a direct operative of it.
© Sebastian Marmolejo / Long Visual Press / Universal Images Group / Gettyimages.ruPresidential candidate Abelardo de la Espriella in Cali, Colombia, on March 13, 2026
© YouTube UnivisiónRepublican Congresswoman María Elvira Salaza received illegal campaign donations from Colombia's president-elect's campaign organization.
In May 2026, five weeks before the runoff, investigative journalist Daniel Coronell published "Los giros de Alex Saab" in Revista Cambio (Paywall), the results of his examination of a closed civil case in a US federal court in Florida. He found more than $370,000 in transfers made in 2014 from Hong Kong-registered companies Group Grand Limited and Consorcio Estructuras Metálicas, both flagged in international investigations for links to Alex Saab, Maduro's convicted money laundering operative, to trust accounts administered by Miami attorney Timothy Richards, with paperwork bearing De La Espriella's own signature, part of which was applied toward the purchase of a Miami apartment. The central letter, dated May 1, 2014, shows De La Espriella confirming he ordered three transfers totalling $374,850, with a handwritten note distributing $100,000 toward the apartment and the rest to a Rafael Mora.
Colombia's Supreme Court had in fact already ordered a money laundering investigation of De La Espriella in 2014, two years before the Saab transfers, after testimony that he allegedly received narco proceeds to facilitate paramilitary commander "Tuso Sierra"'s entry into the Justice and Peace process. That investigation was archived without charges
On April 29, 2015, Saab forwarded De La Espriella an email confirming two payments with an attached SWIFT confirmation for $200,000 routed under the concept "International Tax Advisory", a description that contradicts the actual use of the funds. Coronell approached De La Espriella for comment. He received no response.
On June 16, 2026, five days before the election, Congressman Jesús "Chuy" García led 11 US Democratic members of Congress in signing a formal letter to Secretary of State Marco Rubio, Treasury Secretary Scott Bessent, and Acting Attorney General Todd Blanche. The letter cited 14 Florida shell companies and multiple real estate transactions with unexplained funding sources, called for a Department of Justice investigation, documented the FEC-flagged donation history with Salazar, raised the paramilitary charges Cepeda had brought before the ICC, and expressed, in their exact words, "grave concern about the shameless interference of senior US officials, including the President, in another country's presidential election."
© Latin America Working GroupPage 1 of the U.S. CSO Statement Denouncing U.S. Interference in Colombian Elections – June 17, 2026
On the same day the García letter landed on his desk, Secretary of State Marco Rubio personally signed a memorandum, obtained and published by the New York Times, invoking a rarely-used 1952 immigration clause (INA 212(a)(3)(C)), to declare Colombian activist Beto Coral (Franklin Humberto Coral Garrido) a threat to US foreign policy interests. Rubio wrote that Coral had "used his time in the United States to carry out political activities in support of the Petro government" and that his presence "undermines US foreign policy interests in Colombia's democratic processes." ICE agents arrested Coral the same afternoon in Phoenix, Arizona, as he walked home with his 12-year-old son, despite Coral holding a valid federal work permit through 2028 and a pending asylum application filed in 2016. Hours before the arrest became public, De La Espriella posted on social media: "There will be good news for Colombia and for patriotic Colombians abroad. Dura lex, sed lex... Coming soon." He has not publicly commented on the arrest. Rubio did not respond to the García letter
The Blue Wave Was Engineered
Call it what it is. The international right-wing coordination that congratulated De La Espriella within minutes of the preliminary result was not spontaneous. It was the visible surface of a project that had been running for at least two years, confirmed by Colombia's own financial intelligence apparatus, captured on authenticated audio, and documented by multiple independent investigators before a single vote was counted on June 21.
Start in Jerusalem, April 19, 2026. Israeli Prime Minister Benjamin Netanyahu and Argentine President Javier Milei signed what they called the Isaac Accords, a formal bilateral framework for counterterrorism cooperation, AI partnership, and direct El Al flights between Buenos Aires and Tel Aviv. US Ambassador to Israel Mike Huckabee was present.
© GPO/Kobi GideonSigning of the Isaac Accords
© Alberto Font/The Tico TimesS. Fitzgerald "Fitz" Haney, American Friends of Isaac Accords director and former US Ambassador to Costa Rica
© Courtesy of the Congressional Israel Allies CaucusThe Congressional Israel Allies Caucus’s annual celebration of Jerusalem Day in Washington, D.C., June 4, 2025
There is something worth sitting with here: a project nominally about democracy promotion in Latin America was seeded by sanctioned Putin-linked oligarchs via an Israeli prize foundation via an Argentine president and a former US Ambassador, and the Western press found nothing in this worth a paragraph.
© combatantisemitism.orgCAM Director of Hispanic Affairs Shay Salamon addresses the "Colombia Bless Israel" event, in Bogotá, July 14, 2024
Four days before the vote, Colombia's own financial intelligence unit, the UIAF, brought three interconnected covert operations to the Cabinet table. Director Wilmar de Jesús Mejía testified under oath that all three were active, coordinated, and aimed at the same target. This was not Petro speaking, but the state's own money-tracking apparatus, at a Cabinet council meeting on June 17, 2026:
Operación Ajax ran from 2023 until January 2026, attacked Petro, Vice President Francia Márquez, and senior officials simultaneously in the United States, Colombia, Panama, Spain, and Italy, operated through a website called Petrolix, and was financed through triangulated flows from Colombian businesses with mirror operations in the US, structured to use US legal jurisdiction to avoid Colombian transparency law. Petro delivered the evidence file to the Attorney General, who confirmed a criminal complaint had been filed.
Proyecto Júpiter was designed by the political strategist who brought Álvaro Uribe to power in 2002, ran on a budget of approximately $2 million, trained 40,000 people in corporate workshops structured to generate fear and hatred of the Petro government, and seeded 1,730 individual pieces of disinformation content across TikTok and Meta platforms, reaching an estimated 17 million Colombians in the final months of the campaign.
HondurasGate is the international coordination layer, and it is where the audio vault comes in. Canal Red América Latina and Diario Red América Latina have published the complete vault of 37 audio recordings along with the forensic analysis conducted using the Phonexia Voice Inspector programme, at hondurasgate.com, publicly accessible to any reader who wants to verify the source material. The voice identified forensically as former Honduran President Juan Orlando Hernández, convicted in the United States to 45 years for narco-trafficking and cocaine distribution, and subsequently pardoned by Donald Trump, is heard in multiple recordings.
In the recording that goes most directly to the question of who funded the pardon: "El dinero del indulto ni siquiera salió de ustedes. Salió de una junta de rabinos, y de una gente que apoyaba a Israel." ("The pardon money didn't even come from you. It came from a board of rabbis and people who supported Israel.")
On Netanyahu's direct involvement: ["Netanyahu] nos va a dar su apoyo. Tuvieron todo que ver con mi salida y las negociaciones. ("Netanyahu is going to give us support. They had everything to do with my release and the negotiations.")
On the Colombia operation specifically: "La idea es crear unos expedientes contra Colombia y México", "the idea is to create files against Colombia and Mexico," through a digital media outlet to be based in Washington.
One recording features a voice identified as CNE electoral official Cosette López-Osorio referring to opposition figure Marlon Ochoa with the phrase: "Primero: cárcel o muerte." "Prison or death," first, and subsequently offering $110,000 of her own money to fund his congressional impeachment.
Roger Stone is identified in the forensic audio analysis as the Republican operative responsible for organising the key Washington meetings that secured the Trump pardon of a man serving 45 years for drug trafficking, a role Stone himself had publicly acknowledged lobbying for since 2024.
Colombia's UIAF confirmed these operations at Cabinet level. Petro named the same network publicly the same week. The audio vault is publicly available. Four days later, the election supposedly went to De La Espriella.
Two Decades of Embedded State Infrastructure
Petro's accusation on election night was not the beginning of Colombia's relationship with Israeli intelligence. In fact, it was the terminus of a very long line.
Under President Álvaro Uribe, from 2002 to 2010, Israel became Colombia's primary security partner. The foundational weapons transaction came in 2007, when Santos, then Uribe's Defence Minister, flew to Tel Aviv and personally signed the contract for 24 Kfir C10/C12 fighter jets built by Israel Aerospace Industries with Ehud Barak and Ehud Olmert. The first thirteen were delivered in 2009 at a ceremony in IAI's hangars at Tel Aviv's Ben Gurion airport. The deal was structured partly to secure AIPAC lobbying support for Colombia's pending US Free Trade Agreement, a three-way financial relationship between the Israeli defence industry, the US Congress lobby, and Colombian state contracts, closed in a single handshake in Tel Aviv.
© GettyNetanyahu walks with Colombia's then-president, Juan Manuel Santos, in Bogota in 2017
© REUTERS/Tsafrir Abayov/File PhotoBrigadier-General Yisrael Ziv, commander of Israeli forces in Gaza, speaks at a news conference in Gaza September 3, 2002.
© armyrecognition.comColombian Air Force Kfir fighter jet in flight with landing gear down
A Mossad intelligence office was established inside the Colombian Defence Ministry during the Uribe years, normalised as routine bilateral security cooperation. The most recent documented instance of Mossad operational presence in Colombia came in November 2021, when three senior Mossad officials flew to Bogotá after discovering a Hezbollah assassination plot against a former Israeli intelligence operative running a surveillance camera business in the city.
Colombian Defence Minister Diego Molano confirmed the expulsion of two Hezbollah operatives as a result of that joint Mossad-Colombian military intelligence operation. This was not a theoretical relationship. Three senior Mossad officials on operational deployment in Bogotá, coordinating directly with Colombia's Defence Ministry, eighteen months before Petro took office.
The digital infrastructure layer runs even deeper. In May 2021, the same month DIPOL began its cash payments to NSO Group, Israel's National Information Security Agency chief Erez Kreiner and senior official Arik Biton attended a two-day cybersecurity seminar in Bogotá co-chaired by Colombian Deputy Defence Minister Jorge Enrique Bedoya. The topics on the table: identification, classification, and protection of Colombia's critical digital infrastructure, telecommunications, banking, and finance. Israel's national cyber chief was inside Colombia's Defence Ministry mapping critical digital infrastructure in the same month DIPOL was handing over cash to NSO Group representatives in Tel Aviv.
Then, in March 2026, three months before the election, the Israel Export Institute, coordinated with Israel's Foreign Trade Administration under the Ministry of Economy and Industry, sent a formal delegation of seven Israeli cybersecurity companies to Colombia for three days of meetings with Colombian "industry leaders and decision-makers." The Israeli Export Institute documented this publicly on its own LinkedIn page, naming the companies and the officials involved. Seven Israeli cybersecurity firms, coordinated by a government trade ministry, meeting Colombian decision-makers 90 days before the election.
© 21st Century WireGRAPHIC 1 — BLUE WAVE COLOMBIA: KEY NETWORK MAP (interactive graphic here)
- Blue edges trace Israeli state-to-entity ties, NSO Group, IAI, and the Isaac Accords all radiate from Jerusalem.
- Red edges map the political relationships: the November 2025 Sa'ar-De La Espriella pre-negotiation in Buenos Aires, the Uribista network underpinning the De La Espriella campaign, and the Christian Zionist doctrinal pipeline running through Colombia Justa Libres.
- Purple edges are the military and intelligence threads, the $11M DIPOL-NSO Pegasus cash purchase, the Kfir/IAI sole-maintenance dependency, the INDUMIL Galil perpetual licence, the Mossad office inside the Defence Ministry.
- Orange edges show the international coordination axis: Trump-Netanyahu, Milei's Isaac Accords founding, and JOH Hernández's HondurasGate role as regional fixer.
- The dashed purple lines are the three reactivations that follow automatically the moment De La Espriella is inaugurated: Pegasus back online through DIPOL, Kfir maintenance restored through IAI, Mossad channel reopened inside the Defence Ministry.
Eleven Million in Cash and the Officials Who Did It
In June and through September 2021, Colombia's police intelligence directorate DIPOL paid $11 million in cash, physically bundled and flown from Bogotá to Tel Aviv aboard private jets, to NSO Group for its Pegasus spyware. The transaction was not a wire transfer. It was cash in a plane. And it was discovered not through Colombian oversight but through Israel's own banking system: Bank Hapoalim, Israel's largest bank, reported the $5.5 million cash deposit in NSO's account to IMPA, Israel's financial intelligence unit, which, through standard procedure, notified its Colombian counterpart, the UIAF.
Colombia's own Attorney General investigation, confirmed by both the Colombian and Israeli financial intelligence units, identified four named NSO Group officials who personally collected the cash payments in Bogotá. On June 25-26, 2021, flight M-ABGG landed at the counternarcotics police hangar at El Dorado International Airport carrying Oded Gindi and Yehuda Lahav, NSO Group's Business Director. They left with $5.5 million in cash. On September 17-18, 2021, flight T7CPX arrived from Tel Aviv carrying Moshe Sahar, a figure who had previously signed cyberdefence contracts with DIPOL as far back as 2013, and Ran Gonen, NSO Group's Global Security Director, who collected the second $5.5 million.
© Keren Manor/ReutersIsraeli cybersecurity firm NSO Group's exhibition stand is seen at ISDEF 2019, an international defence and homeland security expo, in Tel Aviv, Israel, June 4, 2019
A crucial development confirmed by Colombia Reports in April 2025: anonymous US Government officials told Colombia's ambassador that Washington DC was responsible for financing the clandestine purchase, that the US gave DIPOL the $11 million to buy Pegasus, and that American intelligence officials maintained oversight of the targeting, supposedly limiting it to drug kingpins. "There was oversight by US authorities to supposedly ensure that it was only directed against these drug kingpins," the ambassador reported, a framing that conveniently removes any accountability from both governments while confirming the entire transaction.
Colombia's Attorney General, Luz Adriana Camargo, summoned the entire chain of command from the Duque police and defence structure for questioning: General (ret.) Jorge Luis Vargas, former Director General of the National Police; General Óscar Atehortúa, his predecessor; Víctor Manuel Muñoz, former director of the Administrative Department of the Presidency (DAPRE); General Jairo García Guerrero, former Deputy Defence Minister; and generals Juan Diego Sepúlveda and Carlos Iván Moreno. Their responses tell the story. Muñoz went on record with a denial worth quoting directly: "Neither President Duque nor the senior military and police command gave any instruction to purchase a platform like Pegasus." That denial simultaneously confirms the purchase happened and that whoever authorised it acted covertly, leaving no official record.
When General Vargas finally appeared before prosecutors on November 7, 2024, he said nothing, invoking his right to silence. Camargo, meanwhile, confirmed to El Tiempo that she considers Pegasus "an instrument of war" and that the $11 million payment is fully documented, and sent a CTI forensic commission to Tel Aviv to collect evidence on-site. What she has not yet addressed publicly, but what Colombia's own ambassador to Washington confirmed after an October 8, 2024 meeting at the Biden White House, is that the $11 million did not come from Colombian state coffers. It came from US intelligence cooperation funds, with American officials supervising which targets were selected. The spyware was US-funded, Israeli-executed, and aimed at a presidential candidate who is now the outgoing president, alleging that the same Israeli state apparatus manipulated the election that will determine his successor.
Colombia's Defence Minister Iván Velásquez explicitly confirmed the authorisation was deliberately hidden, with no evidence in the official records.Petro alleges the system was used against his 2022 presidential campaign. In December 2025, six months before the election, Interior Minister Armando Benedetti confirmed his own phone had been actively hacked by Pegasus. The system was live. The operator had prior access to the political left's communications. The $11 million in cash paid to Ran Gonen and Yehuda Lahav in 2021 bought more than surveillance capability. It brought intimate familiarity with the target architecture.
Is the IP Accusation Technically Possible — Yes
Petro's specific claim is that IP addresses on multiple Registraduría servers were changed during the count, allowing external actors to overwrite the results into polling station data fields. The establishment press treated this as implausible on its face. It is not implausible. It is technically routine.
© VaronisDNS is the internet's phonebook, translating human-readable URLs into the IP addresses computers use to communicate, while DNS caching stores these translations in servers worldwide to keep lookups fast. When attackers corrupt that cache via DNS poisoning, every device querying the infected server is silently redirected to a malicious destination, leading users to believe they have reached the legitimate site.
What is not in dispute, because the Registrar confirmed it himself, is that Colombia's electoral infrastructure faced cyberattacks of extraordinary and documented scale across both rounds of the 2026 elections. During the March legislative vote alone, Penagos confirmed between 100 and 300 million IP addresses attempting simultaneous access, requiring 5.2 million malicious IP blocks, at least 30 attempts to impersonate the official electoral website, and 60 coordinated internet profiles attempting to distort official results in real time, all confirmed in his own post-election statement. He simultaneously declared the entire process "absolutely efficient" and rejected all fraud allegations.
© @Registraduria/XThe National Registrar of Civil Status, Hernan Penagos, is responsible for organizing electoral processes in Colombia.
The IIDH/CAPEL pre-electoral audit delivered on May 29, 2026, two days before the first round, concluded that the source code "complied with established technical criteria" and that five reviewed components showed "no critical findings or medium or high residual risks." This is being cited as proof of no manipulation. It is not. CAPEL audited the software design before the first round. Their own mandate explicitly stated the final technical verdict would be issued only once all electoral phases were complete, including post-election scrutiny. They did not conduct forensic analysis of live server behaviour on election night. They did not re-audit the second round software. And the same Infobae report that carries the CAPEL seal of approval also records Penagos admitting that "in recent elections they faced millions of cyberattack attempts and website impersonation cases", simultaneously confirming the attack was real, sustained, and operating at scale.
The official rebuttal rests on the judges' escrutinio confirming a 99.997 percent match between physical ballot papers and the preconteo software summary for the second round, and 99.94 percent for the first. This is presented as definitive. It is not. Judges counting physical ballots against the software summary can only verify that paper matches the summary they were given. If manipulation occurred upstream, at the server level, before results were committed to the official summary that the judges then verified against paper, the physical count matches a corrupted baseline, not the original votes. A near-perfect match between a potentially compromised preconteo and the physical count of ballots recorded against that same preconteo is precisely what you would expect if the intervention was upstream. The logical gap in the institutional response is structural, and no mainstream outlet has filled it.
© RazonpublicaThree Colombian election jurors (jurados de votación) sitting at a white table, focused on filling out forms, with a large stack of ballots/documents in front of them, in a concrete-walled polling station
The fact that this is not merely theoretical is confirmed by Interior Minister Benedetti's December 2025 forensic report finding Pegasus on his phone, by his January 2026 public statement that "the big question is whether men of the State are manipulating Pegasus," and by Justice Minister Andrés Idárraga's separate confirmation that 2.3 gigabytes of private data, including corruption investigation files and source identities, were extracted from his phone between August and November 2025. Two sitting cabinet ministers. Two forensic confirmations. The Fiscalía has not requested either minister's technical evidence.
Erez Kreiner's 2021 visit to Bogotá's Defence Ministry to map critical digital infrastructure and the March 2026 Israeli cybersecurity delegation meeting Colombian decision-makers 90 days before the election are not abstract points about Israeli capability. They are documented moments at which Israeli state-affiliated actors had direct access to the people and institutions managing Colombia's digital infrastructure.
Who Is Investigating, and For Whom
Crucially, the official vote certification process (escrutinio) is not yet complete. Iván Cepeda's legal team filed formal legal challenges (impugnaciones) against 57,189 polling stations (mesas), more than one in four of all polling stations, on election night. These challenges must be examined individually before a final result can be declared. De La Espriella is currently president-elect based only on the unofficial preliminary count (preconteo), not on the certified escrutinio. His inauguration is scheduled for August 7, 2026.
The official escrutinio is conducted by judges of the Republic whose statutory function is to count physical ballots and certify that they match the software summaries. They cannot audit server infrastructure. They cannot conduct forensic software analysis. Their mandate does not include investigating whether the software summary they are certifying was itself generated from manipulated data.
The Consejo Nacional Electoral has nine magistrates elected by Congress through proportional representation, meaning its composition reflects the partisan balance of a Congress that is majority-right and produced the coalition that elected De La Espriella. An institution whose members are elected by Congress to investigate fraud by the candidate Congress supported is not an independent investigative body. It is an extension of the political apparatus it is nominally scrutinising.
The Registrar, who refused the source code audit, refused the pre-election expert review, denied the census modification, and confirmed massive coordinated cyberattacks on his own infrastructure in the same breath as denying any manipulation, is a political appointment confirmed by a right-majority Congress. His institutional survival depends on certifying the result.
CAPEL audited the first round's source code design. The Registrar commissioned that audit and controlled the terms of reference. The OAS mission found no irregularities — the same OAS whose 2019 Bolivia electoral annulment preceded a coup against Evo Morales and was subsequently dismantled by MIT statisticians and confirmed flawed by the New York Times. Meanwhile, Colombia's own Procuraduría, the constitutional watchdog, received 521 reports of irregular conduct on election day alone, from its own officials, citizens, the Foreign Ministry, and local ombudsmen. The OAS mentioned none of them. The EU-MOE is the most technically rigorous mission present, but it observes procedural compliance at polling stations. It does not audit server infrastructure.
Petro says he will deliver the server evidence to the judges. Whether judges with no forensic computing mandate, no independent technical staff, and no institutional incentive to find fraud against the winning candidate can do anything meaningful with server logs is a question that has not been answered publicly. The chain of custody is currently a black box.
This Is Not a New Pattern
The European Parliament spent a year investigating spyware abuse and published a 145-page report in March 2023, adopted by the full Parliament in June 2023. The PEGA Committee, the Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveillance Spyware, found that EU member state governments had deployed NSO's technology for purely political purposes against critics, opposition figures, journalists, and anti-corruption investigators. Named: Poland, Hungary, Greece, Spain, Cyprus. The committee found that the illicit use of surveillance spyware had put "democracy itself at stake" and recommended a special task force involving national electoral commissions to protect elections from precisely this class of technology. This is not Petro. Not TeleSUR, but the European Parliament, after a formal year-long investigation using its full institutional powers.
Mexico is the Latin American reference case, and it is extensive. Citizen Lab documented Pegasus infections across the Peña Nieto government, targeting public health researchers who supported a soda tax he opposed, journalists and lawyers investigating presidential corruption and human rights abuses, opposition politicians and senior legislators, and the widow of a journalist assassinated while investigating cartels, targeted with fake messages about her husband's murder one week after he was killed. Twenty-five confirmed targets in Mexico alone.
Cecilio Pineda Birto, a Mexican journalist investigating local corruption, was added to the Pegasus targeting list weeks before he was assassinated in March 2017. Previous Mexican governments signed at least 31 contracts with NSO Group worth $61 million, many routed through front companies. When AMLO took office pledging to end Pegasus use, new infections were documented in 2021, three human rights investigators, authenticated by Citizen Lab. Over 15,000 Mexican phone numbers appeared on the targeting list published by the Pegasus Project.
Amnesty International's Security Lab published a forensic methodology report that systematically dismantled NSO's public claim that Pegasus "leaves no traces whatsoever." The lab showed exactly what traces it leaves and exactly how to find them. A year after the Pegasus Project revelations, Amnesty International found that the lack of a global moratorium on spyware sales had allowed the surveillance industry to continue operating without interruption, consequence, or effective accountability.
In Colombia specifically, the documented sequence goes like this: DIPOL paid $11 million cash to NSO representatives Ran Gonen and Yehuda Lahav in 2021. Under Duque, the purchase was deliberately hidden from official records before it was discovered only through a routine banking notification from Tel Aviv. The Attorney General summoned the entire police and defence command chain: Vargas, Muñoz, García, and received only blanket denials. The system was live and operational in Colombia. Petro alleges it was used against his 2022 campaign.
Interior Minister Benedetti confirmed his own phone was actively hacked in December 2025, six months before the election. The infrastructure was in place. The operator had prior access to the political left's communications. And on election night, the Registraduría's servers faced an attack the Registrar himself confirmed was massive, multi-vector, and coordinated.
The pattern did not stay in Latin America. In May 2026, French prosecutors opened a formal investigation into whether an Israeli firm called BlackCore, which describes itself as "an elite influence, cyber, and technology firm designed for the contemporary era of information warfare", ran coordinated disinformation campaigns against three pro-Palestinian candidates from France Insoumise in March's municipal elections. By June 11, France's government disinformation agency Viginum confirmed BlackCore's involvement and revealed the same operational pattern had been used in Scotland, New York City, Angola, and Togo. BlackCore cannot be found in Israeli corporate registries. No client has been identified. Colombia's election was held ten days later.
The Payoff Was Already Signed
© CopyrightGRAPHIC 2 — THE GEOPOLITICAL PAYOFF TABLE - Page 1 of 3 (view rest here)
What it proves: Every row is a completed transaction, not a campaign promise. Each one has a known counterparty, a documented meeting, and a pre-agreed timeline. Most of it was locked in before election day. The question this table forces is not whether these commitments will be honoured, because it is clear they will be, but when exactly this stopped being an election and became a handover.
Read the AFOIA managing director Fitz Haney's own words from October 2025: success is measured by UN votes shifting, embassy relocations to Jerusalem, and Hamas and Hezbollah designations. Every metric is a De La Espriella campaign pledge.
Read the Isaac Accords joint declaration signed April 19, 2026, on the Israeli government's website: nations of the Judeo-Christian tradition, defence of freedom, fight against Iran's terrorist networks in the Western Hemisphere. The language maps directly onto De La Espriella's campaign rhetoric. The declaration was signed two months before the election by the same Netanyahu who, per the JOH audio, "had everything to do with" the pardon of the man coordinating the Latin American anti-left operation.
Read the Sa'ar meeting record from November 25, 2025 in Buenos Aires, confirmed by Semana on the day it happened: De La Espriella pledged to restore full diplomatic ties, relocate the embassy, rebuild the security partnership, and make Israel Colombia's primary strategic ally. His full statement from the meeting: "A strategic alliance with the State of Israel and the US government will not only make us stronger, but will place us on the right side of history." Sa'ar flew to Buenos Aires for this meeting while Israel was still formally expelled from Colombia. He did not meet with De La Espriella as a courtesy. He met with him as a counterparty to an agreement.
© Argentinian PresidencyIsrael's Foreign Minister Gideon Saar met on Tuesday, November 25, 2025, with Argentine President Javier Milei at the Presidential Palace in Buenos Aires
Petro named Israel on election night. He may or may not be able to prove what happened to those specific servers. But the picture assembled from the documents which includes the Israeli government's own signed declaration, the AFOIA director's own published interview, the UIAF Cabinet testimony, the Chuy García letter that 11 US Congress members signed and Rubio never answered, the Buenos Aires pre-negotiation with Sa'ar, the $11 million cash flight to Tel Aviv handed to Ran Gonen on two separate dates, the 37 audio recordings at hondurasgate.com, the March 2026 Israeli cybersecurity delegation meeting Colombian decision-makers 90 days before the vote, and Daniel Coronell's investigation linking the president-elect to Alex Saab's money flows — that picture does not require the server evidence to be coherent.
It was coherent before election night. The servers are a thread inside a cloth that was woven over two decades, by hands that left receipts, and the cloth is now on display in the Nariño Palace.
Reader Comments
to our Newsletter