One sleepy Sunday morning in May 2019, Glenn Greenwald was sitting in his home office in Rio de Janeiro when he received a phone call from a number he didn't recognize. He didn't answer. But 30 seconds later a WhatsApp message arrived from Manuela d'Ávila, a Brazilian leftist politician who had run for vice president the previous year alongside the center-left Workers' Party's candidate for president; their ticket had come in second to the far-right former military captain Jair Bolsonaro. “Glenn,” she wrote, “I need to speak to you about something urgent.”
Greenwald, the American journalist who broke the story of Edward Snowden's NSA leaks, didn't know d'Ávila well, so his interest was piqued by the weekend message. When she explained that she had stumbled into a huge potential story and wanted to talk on the phone, Greenwald rushed downstairs to the bedroom to wake his husband, the left-wing Brazilian politician David Miranda, who knew d'Ávila better.
When the two men put her on speakerphone, d'Ávila plunged into an odd tale: Someone had just hacked her Telegram account, then promised to send her evidence that would “save the country.” Greenwald had to ask her to slow down. “She was excited,” he says. D'Ávila explained that the hacker claimed to possess explosive material that implicated Bolsonaro's government, and in particular Brazil's Ministry of Justice and Public Security.
D'Ávila was calling to see if she could pass the source on to Greenwald. He agreed.
Right away, though, there was a problem. The hacker wanted to speak over Telegram, but Greenwald didn't have the app—for reasons the mysterious souce had just demonstrated. “The people I trust most, including Snowden, have been warning about its vulnerabilities for years,” Greenwald explains. Still, after hanging up with d'Ávila, Greenwald installed Telegram and warily made contact.
“Fortunately, I didn't need to say much of anything, because he was just off to the races,” Greenwald recalls. Messaging in Portuguese, the source claimed to possess a huge trove of material. He said he'd been going through it for months and had only managed to read about 10 percent of it, but he'd already found evidence of collusion that would set fire to Brazilian politics if revealed. The source started to send Greenwald examples—audio messages, some documents.
After a few minutes, the person asked if they could talk over the phone. This set off yet another alarm for Greenwald. Text exchanges can be disguised with proxies and encryption, but a voice would be easy to identify for anyone who might be surveilling them. “I didn't hear Snowden's voice until I went to Hong Kong,” Greenwald says.
Yet Greenwald pressed on. He took the call and let the source, who claimed to be living in the US and attending Harvard, do most of the talking. The source explained to Greenwald that a close friend at Telegram had introduced him to the Russian founders of the app, the Durov brothers, and through them he had gained access to people's Telegram accounts. “Which didn't make a lot of sense,” Greenwald says—why create a supposedly secure messaging app and give someone the keys to its back door? Greenwald also doubted the hacker's Harvard story.
“Are you being careful?” Greenwald recalls asking. “What you've done is pretty serious.”
“Oh yeah, don't worry about that. They'll never catch me,” the source boasted. He said he was using multiple proxies that made it nearly impossible for anyone to find him, and he was never going to set foot on Brazilian soil again. The call was about four minutes long—Greenwald kept it short, but said he wanted to see the documents. “OK, I'm gonna just start uploading them to your phone,” the source said. He told Greenwald it would take between 12 to 15 hours to finish uploading.
After the call, Greenwald began receiving files through his Telegram account—a huge number of them, one after another. Occasionally the source would interject, giddily telling Greenwald to look at a particular document.
When Greenwald went to bed that night, the files were still coming in; they hadn't finished when he woke up in the morning. “Every time I opened my Telegram app it was just going and going,” Greenwald says. “That's when I realized this archive was enormous. And I was pretty convinced it was real.”
From the start, Greenwald and Miranda discussed the dangers of working on the leaks. Unlike in the Snowden case, Greenwald would be living in the same country as the authorities he would be exposing. And Miranda had taken his seat in the National Congress after his predecessor, Jean Wyllys, from the same party, had fled Brazil and given up his seat over death threats and homophobic abuse. In 2018, a left-wing politician and close friend of Greenwald and Miranda named Marielle Franco had been assassinated in her car; two former policemen were charged with her murder.
Listen to the full story here or on the Curio app**.
That same Sunday, Greenwald called Leandro Demori, executive editor of the Intercept Brasil, part of the media group that Greenwald had cofounded after the Snowden leaks in 2014. Greenwald asked if Demori was sitting down. “It's serious,” he said. “You need to be sitting down right now.” Demori, who was packing for a vacation, plopped down on his bed. As he listened to Greenwald, his jaw dropped: “Oh my God,” he thought. “This is huge.” Once he had a sense of the material, Demori gave the project an enthusiastic green light. The Intercept's legal team did likewise.
The next step was to figure out a faster and more secure way to receive all the source's material, which was still trickling onto Greenwald's phone via Telegram eight or nine days after the hacker made contact. The journalists wanted to secure the archive outside Brazil as soon as possible, in case authorities tried to confiscate it. So the Intercept's security specialist, Micah Lee, began preparing to set up an end-to-end encrypted cloud storage platform to receive the material. But the source simply created a Dropbox and dumped it all there. “I was suspicious of his technical judgment,” Lee says. “He seemed overconfident.”
As Greenwald drafted the first set of articles, he stayed in regular contact with the hacker—or, rather, hackers. At some point, he got the impression that he was talking to at least two people. One of them seemed somewhat naive and idealistic, Greenwald says. “And then, suddenly, I felt like I was talking to somebody more jaded … a little bit more slippery, and a little bit more complicated.” Occasionally the source would also say “we” instead of “I.”
The hacker was, however, consistent about what he—or they—wanted. “I'm only doing this because I want to clean up my country,” Greenwald was told. And the source repeatedly insisted he had no financial interest. What mattered most, Greenwald thought, was that the material was genuine.
On the evening of Sunday, June 9, almost one month after Greenwald first spoke to the hacker, the Intercept Brasil got ready to run the leaks. Greenwald, who usually works from home, went to the newsroom in Rio. At almost 6 pm, the team published three articles, which they said drew on a vast archive of material supplied by an anonymous source.
The stories showed how a group of federal prosecutors had plotted to prevent the Workers' Party from winning the 2018 presidential elections. The prosecutors had been members of a sprawling anti-corruption task force called Operation Car Wash—Lava Jato in Portuguese. Their investigation claimed to have unearthed a vast system of money laundering and bribes between state-owned companies and major figures from Brazil's biggest political parties. Those revelations had led to hundreds of convictions, the most prominent being that of ex-president Luiz Inácio Lula da Silva, popularly known as Lula, who had left office in 2010 as one of the most popular political figures in the world.
The Car Wash prosecutors alleged that Lula had received a beachfront triplex as a kickback—and from there they depicted him as the “maximum leader” of a sprawling, corrupt web. In 2018, Lula was imprisoned and prevented from running (again) as the Workers' Party candidate in that year's presidential election. Lula had been the strong favorite to win, and his disqualification paved the way for Bolsonaro's shocking triumph at the polls. After Bolsonaro's victory, the judge who presided over the Car Wash cases, Sérgio Moro, was appointed minister of justice and public security. On the strength of his reputation as an anti-corruption crusader, Moro had become one of the most popular and powerful politicians in Brazil.
But now, the Intercept's leaks showed how Moro had colluded with the Car Wash prosecutors in the very cases he was supposed to adjudicate, including the one that convicted Lula.
Five minutes after the stories went live, their early readership on the Intercept's website was six or seven times higher than for any other story the site had published. Soon #VazaJato—roughly translating as “Car Wash Leaks”—was trending on social media. A couple of hours later, the Intercept's reporting was featured on the flagship news program of Brazil's biggest broadcaster, Globo.
Greenwald found the media explosion especially gratifying because he knew he could keep feeding the story. “I knew once that initial reaction happened that way, it was going to dominate politics and headlines for weeks, if not longer,” he says.
Left-wing parties were soon calling for Moro's resignation. He refused to step down, saying he had been the victim of a vicious, coordinated cyberattack by skilled and well-financed hackers. He also suggested there had been foreign involvement, referring pointedly to Telegram's Russian origins. Moro's insinuations hardly addressed the substance of the Intercept's reporting, but they did feed into a question that was on everyone's lips: Who was Greenwald's source?
Walter Delgatti Neto grew up in Araraquara, a four-hour drive inland from São Paulo. A small city of 200,000 people—about the same size as Boise, Idaho—Araraquara is a pleasant if unremarkable settlement of low-rise, flat-roofed buildings amid a smattering of incongruous tower blocks, surrounded by an expanse of green fields.
Delgatti lived in Araraquara with his parents until he was 7 years old, when they split up. He was then carted between grandparents: “My mother unfortunately left me on the sidewalk of my paternal grandmother's house, literally de mala e cuia”—an expression meaning “with all one's earthly belongings.” As a kid, Delgatti had a hard time making friends. Unusually for Brazilians, he had auburn hair, earning him the nickname Vermelho, meaning “red” in Portuguese. Delgatti also struggled with his weight. He was bullied.
According to Gustavo Henrique Elias Santos, who has known Delgatti since he was about 15 or 16, Delgatti was a complicated young man. “I always felt pity for him,” Santos says. “He had a strange family.” Santos' earliest memory of Delgatti is at a party in Araraquara, where Santos was playing a set as a DJ. Santos noticed Delgatti, the only face really watching him in the audience, grinning strangely from the crowd.
Although Delgatti managed to form a rare bond with him, Santos learned not to believe a lot of what Delgatti told him. “Walter is a great storyteller,” Santos says. “Not everything he says is a lie,” he adds, “but he doesn't know how to tell the whole truth. He writes a great script.”
Delgatti and Santos matured into petty but extravagant troublemakers. One morning in May 2013, Delgatti, 24 at the time, and Santos, then 22, were stopped by police on the highway leading out of Araraquara. In their silver Toyota, they were found in possession of false documents, stolen credit cards, 14 checks, and more than a thousand Brazilian reais in cash, along with a bank statement showing the sum of 1.8 million reais (roughly $900,000). The pair called Ariovaldo Moreira, a local lawyer they knew. When he arrived at the police station, the chief told Moreira that the youngsters had been unable to account for the cash or the funds in the bank account. When Moreira saw the bank statement, he noticed something the chief hadn't: It mentioned charges made on February 30 and 31. Delgatti had forged the statement, and the bank account didn't exist. He had likely done it to impress a girl, Moreira says: “He was born for forgery.”
Moreira describes Delgatti and Santos at the time as small-time crooks and scammers who were rarely involved with anything serious. They often had plenty of money, despite lacking jobs. They made videos that showed car trunks full of cash and gold chains. They were gun lovers. “Their lives were a film,” Moreira says. In his early twenties, Santos was convicted of possessing illegal firearms. Delgatti's longer rap sheet often blurred the line between pranks and petty scams. Moreira recalls how Delgatti booked stays at expensive hotels with counterfeit credit cards; he filled up at gas stations and drove off without paying. He skipped out on restaurant bills, despite having the cash to pay them—“only to say he did that,” Santos says. Delgatti denies that he did these things.
In 2015, when he was 26, Delgatti was caught flashing a fake police badge at a theme park, trying to cut in line for rides. When a real policeman apprehended him, Delgatti led the officer to a car where Santos and Santos' girlfriend were. The officer found a firearm in the trunk, and Santos was arrested. Those close to Delgatti would never know why he did some of the things he did. Moreira says Delgatti gets a kick out of tricking others. “He's indecipherable,” Santos says.
If anything, Delgatti seemed motivated chiefly by a desire for fame and notoriety. Along the way, though, he was accused of crimes that would haunt him. The same year as the theme park incident, police raided Delgatti's apartment in connection with a rape case. Delgatti denied the allegation, and the accuser later changed her testimony and dropped the charges, but during the raid the police found a forged ID that made it look like Delgatti was a medical student at the University of São Paulo. They also found a quantity of “restricted medication”—a handful of antidepressant pills, 84 tablets of clonazepam (which can treat seizures, panic disorder, alcohol withdrawal, or insomnia), a slightly larger quantity of antianxiety medicine similar to Xanax, and some weight-loss medicine. Delgatti was adamant that the medication was for his own personal use, but the local prosecutor, Marcel Zanin Bombardi, charged him with both drug trafficking and possession of false documents.
The drug charge ignited a vehement sense of injustice in Delgatti. “The false charges left me extremely outraged,” Delgatti says. “To this day I use those medicines.”
In the face of mounting legal troubles, Delgatti enrolled in school at a college in Araraquara, deciding to study the law even as he was being pursued by it. Once again, he didn't get along with many classmates. He seemed determined to conceal his legal baggage, but, as ever, he overplayed his hand. In his first year, he went so far as to file a police complaint against some of his fellow students for “slandering and defaming him” in the classroom. “They are saying I'm a hacker and that I divert money from the accounts of third parties,” Delgatti told police.
In June 2017, Delgatti's charges finally caught up with him. He was sentenced to two years in prison and spent six months behind bars before being released to serve out the remainder of his term in a semi-open facility, meaning he could go out by day but had to return every night. He had hit bottom. “Walter was fucked. He didn't even have 10 bucks to buy bread,” Santos says. “I know because I lent him 10 bucks.” In June 2018, Delgatti was absolved of his drug trafficking conviction, but he still had to serve the rest of his sentence for possession of false documents.
Sometime in 2018, Delgatti skipped town. He moved to a slightly larger city about 55 miles northeast of Araraquara called Ribeirão Preto and enrolled in another law school there. Desperate to flee his reputation, he befriended a much younger student named Luiz Henrique Molição, a budding political junkie who sympathized with the Brazilian left. Delgatti had little interest in politics himself, but he wanted to impress the teenaged Molição. He represented himself as the son of a deceased neurosurgeon and said that he was living off an inheritance from his late father. “I was afraid of him knowing my true identity,” Delgatti says. “I was on the run and living a double life.”
It was at some point around this time that Delgatti discovered a hacking technique that would further complicate that double life. The hack took advantage of a feature offered by a Brazilian voice-over-IP company that allowed account holders to alter their caller ID—the number that registers on the receiving end of a call. This feature, combined with the fact that many phone providers in Brazil allow people to access their voicemail by calling their own number, made for a handy virtual lock-picking device. If a hacker simply changed his caller ID to the number of someone he wanted to target, he could spoof their phone and access their voicemail.
A hacker with little technical skill and no specialized equipment could, it turned out, do quite a bit of damage with access to someone's voicemail. Delgatti, for instance, figured out he could use this VoIP spoofing technique to target Telegram accounts. At the time, when a Telegram user wanted to attach their account to a new device, they had the option of requesting a verification code via an automated voice call from Telegram. Delgatti realized that he could spoof a victim's phone to request that code. Then, if Telegram's automated voice call didn't get through—because Delgatti initiated the hack late at night while his victim slept, or kept the line busy by calling his victim at the same time—the code would be sent to the person's voicemail. He could then spoof the target's phone once again to gain access to their voicemail, retrieve the verification code, and then add the victim's Telegram to his own device. After that, he could download their entire chat history from the cloud.
Delgatti claims he chose Telegram because he had once noticed Bombardi, the local prosecutor who had pursued him, using the app during a court hearing. “He started this hacking because he wanted to fuck the prosecutor's life,” Moreira says.
True to form, Delgatti's attention for trouble did not stop there. Early in 2019, he hacked the Telegram account of his friend Gustavo Santos. The two stopped speaking. “I was pissed, really pissed,” Santos says. Delgatti's hack into Bombardi's Telegram account also gave him access to the local prosecutor's address book—and the contacts of several other public authorities. “And from there,” says Moreira, “it all began.”
In March 2019, Santos joined most of Brazil in celebrating Carnaval. At some point during the week-long festivities, he says, he received a cryptic message from his estranged friend Delgatti. The message said: “Here is a real hacker.” Santos says he didn't know what Delgatti was talking about and didn't give it much thought.
But Delgatti was not spinning one of his yarns. According to police investigators, at 3:34 am on March 2, the official start of Carnaval, Delgatti had hacked the phone of Eduardo Bolsonaro, a congressman and the third son of President Jair Bolsonaro. Forty-five minutes later, Delgatti hacked Carlos Bolsonaro, the president's second son, also a politician. Shortly afterward, Delgatti hacked the phone of the president himself, although he was apparently unable to download anything. And he kept going, making his way through a long list of powerful public figures—federal prosecutors, government ministers, and senior judges.
Delgatti told several acquaintances what he was doing, but like Santos, they had a hard time knowing what was real—which perhaps made it easier for Delgatti to entangle so many people in his hacking spree. He conducted some of his hacks, for instance, from Santos' VoIP account, making Santos look like an accomplice.
Another acquaintance from Araraquara, a sometime Uber driver named Danilo Marques, was similarly roped in: Over the years, Marques had allegedly allowed Delgatti to open several accounts under his name and helped him to launder money from Delgatti's various scams. Now, as Delgatti hacked his way through the federal government, he used an internet service and an IP address that was under Marques' name.
At the time, Delgatti was also in contact with a freelance computer programmer and restaurateur named Thiago Eliezer Martins dos Santos, who has gone by the nickname Chiclete—or bubblegum—since childhood. The two had met in 2018 when Eliezer sold Delgatti a Land Rover, according to both men. (“The impression I had was of a slick guy who talks a lot,” Eliezer says of their first meeting.) Eliezer admits he “made a program” for Delgatti—helping him set up a Private Internet Access VPN that let Delgatti mask his location. According to both men, Eliezer didn't play a part in hacking Telegram, though he did discuss it with Delgatti. At first, Delgatti described the hacks as a moneymaking scheme, Eliezer recalls, but then Delgatti started talking about fame and revolutionizing Brazil. “I never took it seriously,” Eliezer says.
Then there was Luiz Molição, the 18-year-old budding leftist that Delgatti knew from law school. Delgatti had heard Molição speak negatively about Operation Car Wash and the Bolsonaro government, which caught his attention because he needed someone familiar with politics to help him compile the material he had hacked. So he showed Molição the phone numbers he'd dredged up for various famous people, including supreme court minister Alexandre de Moraes and right-wing humorist Danilo Gentili, and asked for Molição's help with the next phase of his plan. The two went on to maintain a fervent online dialog.
On April 26, Delgatti hacked into the Telegram account of the lead prosecutor in Operation Car Wash, Deltan Dallagnol, who at the time was considered a national hero. Dallagnol says he quickly noticed that some Telegram messages he'd received were marked as read, even though he hadn't read them. He looked into his Telegram account's usage: “I saw that there were active sessions in other places and countries.” At first Dallagnol imagined that scammers were trying to get his credit card details, “but then we identified that the attack extended to other prosecutors,” he says. “We deleted messages and applications, changed passwords, and took precautions.”
But it was too late; Delgatti had already accessed and downloaded Dallagnol's chats and contacts. And a couple of weeks later—on Mother's Day, 2019—Delgatti initiated the hack that would reveal his discoveries to the world. That morning, Manuela d'Ávila received an alert from Telegram that someone in the US state of Virginia was trying to access her account. Then she received a second message from a Brazilian senator she knew. D'Ávila tried to call him, but the line was busy. Then another message pinged into her Telegram from the senator's account: “Do you trust me?”
“Of course!” d'Ávila responded, baffled.
“I have to tell you that this isn't the senator.” D'Ávila was startled. “I have information about crimes committed by the authorities in Brazil. And I'm going to hand you everything. You are the person that has to receive it.” As a leader of the Brazilian left, she was the person most likely to be able to “save the country,” the hacker said.
With that, the hacker left the senator's Telegram profile and messaged d'Ávila from another account. The person told d'Ávila that her own phone had been hacked, sending her screenshots of chats she'd had with another prominent left-wing politician. But the hacker reassured d'Ávila that she wasn't their target. D'Ávila promptly called her lawyers. In all likelihood, she feared, this was a plot to entrap her by political enemies. Her lawyers agreed.
Yet there was something about the way the person wrote that gave d'Ávila pause. The hacker's story seemed unreliable but also not malicious: “It was more like it was all a fantasy, you know?” she says. “He was saying these things that were so grandiose: ‘I am going to save the country! You are the person that's going to help me! We are going to change everything! Lula is going to leave prison!’” The hacker also invoked d'Ávila's election slogan, “Lute como uma garota!”—“Fight like a girl!” A particular psychological pattern was emerging from the messages; d'Ávila sensed a resemblance to a loved one (whom she prefers not to name) who is also given to grand leaps of the imagination. It was this, against her lawyers' advice, that made d'Ávila keep messaging with the person. And ultimately to believe that the exchange wasn't a trap.
The person wanted to entrust all the material to her, but d'Ávila, a former journalist, knew her standing as a politician would make people question the leaks—and that she'd be hard-pressed to evaluate the veracity of the material. “We have to think about how you're going to do it,” she told the hacker. He needed to speak to a journalist, she said.
The hacker was skeptical. He told d'Ávila he had uncovered evidence of corruption among Brazil's press. So d'Ávila suggested a prominent American reporter instead: “We have to speak to Glenn, the journalist from the Snowden case,” she told the source. “He is the best in the world.” D'Ávila suggested that Greenwald would also be uniquely able to ensure the security of the material and the source. “Because we're talking about very serious crimes by the authorities, about information that's very important for the country,” d'Ávila said. “If they kill you, where is that information going to be?”
The source, excited by the allusions to the Snowden case, agreed.
As it happened, Greenwald already had a somewhat complicated history with Operation Car Wash. From the very beginning, there had been critics who believed that the anti-corruption task force was colluding with Moro to target the Workers' Party and Lula. (Their suspicions had been aroused back in 2016, when then-judge Moro leaked secret wiretaps of a breathless, affectionate conversation between then-president Dilma Rousseff and Lula, which seemed to suggest the two were coordinating to shield Lula from prosecution.) But Greenwald wasn't among those critics. He says that he never felt “super antagonistic” toward the Car Wash task force. In fact, in a speech at a 2017 award ceremony for anti-corruption work in Vancouver, Greenwald had spoken positively about the Car Wash team. “I made a lot of people angry on the left in Brazil by defending them,” Greenwald says. “I kind of went out on a limb for them.”
But now, after the Mother's Day phone call from d'Ávila, as he began to dig into the avalanche of documents that slowly uploaded to his new Telegram account, Greenwald was astonished. “I actually kind of felt betrayed,” he says. The collusion between Moro and federal prosecutors against Lula and the Workers' Party, Greenwald learned, went deeper than even their fiercest critics had imagined.
Most explosively, the leaks demonstrated that Moro helped design the criminal cases that he would then adjudicate. In one instance, Moro offered to put Dallagnol in touch with a source who had possible evidence against one of Lula's sons. In messages dating back to Lula's trial, Dallagnol—the prosecutor in the case—also expressed deep worry to Moro and other colleagues about how flimsy his case was. Shortly before he accused Lula of accepting a beachside triplex as a bribe, Dallagnol wrote to colleagues: “They will say that we are accusing based on newspaper articles and fragile evidence.” When Dallagnol ultimately used that triplex allegation to depict Lula as the mastermind of a sprawling empire of corruption, his typo-ridden presentation indeed came under heavy fire in the press. But Moro sent a Telegram message reassuring him: “Definitely, the criticisms of your presentation are disproportionate. Stand firm,” he wrote. In July 2017, Moro sentenced Lula to nine years and six months in prison.
Once Greenwald and his colleagues had a solid understanding of what was most newsworthy, the Intercept team decided they would publish the first set of stories on June 11. But on June 5, something happened that threw them off: Sérgio Moro publicly announced he had just been hacked. His phone had received SMS messages from Telegram indicating that his account had been accessed by an unsolicited device. Moro claimed that the alleged invaders had not extracted any content, but the hack caused a media storm. Then a steady stream of famous people and political figures came forward to say their accounts had been invaded in the same way.
Greenwald, who had understood that his source's hacking spree was over, was taken aback. He immediately got in touch and asked if the source had been behind hacking Moro's phone. If so, it could make the Intercept look complicit in an ongoing cyberattack. The source vehemently denied it. “He even feigned being offended that I would think that they would do something that primitive,” Greenwald recalls.
Then, at around 8 pm on June 7, the hacker—once again putting Greenwald in an awkward position—called to ask for advice about what to do with all the Telegram accounts he still had access to. “As soon as you publish the articles,” the source said, “everyone is going to delete their chats, everyone is going to delete Telegram, so we wanted to know … what you recommend doing?” Basically, he was asking Greenwald if they should carry out a data export of the Telegram chats before victims potentially cut off access.
“It's difficult, because I can't give you advice,” Greenwald replied. “Obviously I need to be careful with all of what I am saying.”
Greenwald laid out a delicate response. “It's a certainty that they are going to accuse us of participating in the hack,” he said. He pointed out that the Intercept had stored all the material it received from the hacker in a “very safe” offshore location. “I think that there's no purpose, no reason for you to keep anything, right?” Greenwald said, while making it clear that the choice was up to the hackers. “Right, perfect,” the source said, thanking the journalist.
“Any doubts, call me, OK?” Greenwald said, according to an audio recording of the call that police later discovered on Delgatti's MacBook.
The Intercept Brasil went to press on June 9, two days ahead of schedule. (Greenwald says the decision had nothing to do with Moro's hacking claims.) The publication said its reports were based on a trove of unpublished files, including private messages, audio recordings, images, and judicial documents. Distancing itself from the alleged Moro phone hack, the Intercept wrote that it had received its material weeks earlier.
That same night, the Car Wash task force put out a statement condemning the “criminal action” of the hackers and suggested that the invasions could endanger the safety of the authorities and their families. Moro, meanwhile, said the messages didn't show any “abnormality” in his behavior; he also cast doubt on their authenticity. Neither the task force nor Moro admitted the messages were real. Still, there was an uproar. The legacy of the entire Car Wash anti-corruption operation was thrown into question. And there was still plenty more material to publish. As the Intercept Brasil drafted follow-up articles detailing ever deeper collusion and corruption, Greenwald broke off communications with his source.
As the nation roiled over the implications of the hacked material, the government and media also went into a frenzy of speculation about the origin of the leaks. And yet Delgatti did not try to cover his tracks. He kept hacking. He spent hours in front of his computer screen with multiple Telegram accounts open at once. He had set up more than a hundred hacked accounts to be monitored in real time. Delgatti says that at times he was awake for 48 hours straight.
Delgatti even took to taunting his most high-profile victims on Twitter. Replying to a tweet by Dallagnol, Delgatti claimed to have proof that the Car Wash leaks were authentic, citing the time and date of messages on Dallagnol's device three days before he was hacked. And on July 7, Delgatti tweeted at Moro: “Every day that passes your defense is becoming more ridiculous. The house has fallen, covering the sun with a sieve won't do any good.” He also criticized Bolsonaro on social media. But Delgatti's behavior—tweeting from his personal account, with a profile picture of himself smiling and wearing red sunglasses—was so brazen that it begged to be disbelieved.
Just after midnight on July 21, Delgatti hacked the Telegram account of Joice Hasselmann, a right-wing politician close to Bolsonaro and the leader of his far-right party in the lower house. The next day, Hasselmann posted a video on social media claiming her cell phone had been invaded. Undeterred, Delgatti proceeded to hack the Telegram account of a key Bolsonaro cabinet minister, economy czar Paulo Guedes. It would be his final hack.
On the morning of July 23, in Araraquara, Ariovaldo Moreira, Delgatti's onetime lawyer, woke up early feeling glum. Moreira's life had become stagnant; he had recently separated from his wife. His legal work had grown monotonous. After doing his morning stretches, Moreira abruptly fell to his knees and prayed to the Virgin Mary: “Help me, Santa Maria!” he pleaded. “I need a change, I need something in my life.”
As it would happen, a drastic change was descending on Araraquara that very morning, in the form of a tightly coordinated federal police crackdown dubbed Operation Spoofing. Early-rising locals had noticed police cordoning off several streets, a strange sight in their sleepy city. At around 8 am the officers entered Delgatti's grandmother's house but didn't find him there. Shortly afterward police burst into Delgatti's apartment in Ribeirão Preto, the city where he had been attending law school, and found him sleeping. Delgatti had been up for most of the past two days, poring through Telegram accounts on his computer. He had finally taken some sleeping pills and gone to bed around 3 am. He says he awoke with a gun to his face. When the operation commander asked if he knew why they were there, Delgatti says he replied: “Because of Minister Sérgio Moro.” And he added: “I've been waiting for you.”
Others who would receive a visit from police that morning were far less prepared.
In São Paulo, Delgatti's old friend Gustavo Santos was pinged awake by a cell phone alert. Santos, who now lived with his girlfriend in Brazil's largest city, had installed a network of cameras and sensors at the empty home he still maintained in Araraquara. The devices sent alerts to his phone when they were tripped. Sometimes the sensors were triggered by cats or bugs; this time they were being triggered by an early morning police raid, but Santos was oblivious. “I was really doped up from sleeping medicine,” he says. So he went back to sleep.
At around 8 am the buzzing of his apartment's intercom woke Santos again. He dragged himself up and answered. “Gustavo,” the intercom barked, “there is a Sedex here for you. You have to sign for it.”
Santos didn't recognize the doorman's voice. “Man, you can sign for me,” Santos said into the intercom, refusing to come down. But as he hung up, Santos thought: “Fuck, this does not smell good.”
Santos went to the window, parting the curtains a crack. He glimpsed several figures dressed in black approaching his apartment building. Now fully awake, he frantically started cleaning up his apartment—ripping up documents and flushing any potentially compromising material down the toilet. (Santos dealt extensively in cryptocurrency trades and other schemes.) Then, remembering the nearly 100,000 Brazilian reais in cash he had in the apartment—about $25,000—Santos went to the bedroom where his longtime girlfriend, Suelen Oliveira, was still sleeping; neither the buzzing intercom nor Santos' frenzied movements had woken her. “Su,” Santos whispered, waking her up. “You have to hide this for me, because the police are here.” She blinked at him, confused. “She didn't understand a thing,” Santos remembers.
The doorbell started ringing. There came a loud banging on the door. Then the door burst open.
Santos moved toward the police as they broke in and thrust a hand in front of them. At 6'3" and 340 pounds, with close-cropped hair and a tattooed neck and hands, Santos could strike an imposing figure. “Hold on, you're not coming in without a warrant,” he said, imagining that it was the regular civil police at his door. The operation commander stepped forward: “Young man, calm yourself. This is the federal police here. And yes, we have a warrant.”
Santos froze, and he says the police pushed his face against the wall. After reading him his rights, a policeman asked Santos a question that made little sense to him at first: “Aren't you the hacker?”
“You've got the wrong person,” exclaimed Oliveira, who had appeared in the bedroom doorway.
The federal police ransacked the apartment and found the 100,000 reais. Then the commander told the couple to collect some extra clothes. They were going to Brasilia, the nation's capital, more than 600 miles to the north.
At the airport, the couple were shocked again to see they were not taking a commercial flight but were being led toward a Brazilian air force jet. “What the fuck is all this?” Santos thought. After boarding the plane, the police cuffed Santos' hands and ankles to a chain wrapped around his waist. “We were treated like killers,” Oliveira says.
The jet took off and landed about an hour later in Ribeirão Preto. The couple were allowed to leave the plane to use the restroom. There, in the hangar of the airport, they spotted Delgatti standing between two federal police officers, wearing a suit and tie. “And I knew right there,” Santos says. Delgatti had dragged him into the biggest mess of his life.
“Keep him far from us, or there's going to be hell,” Oliveira told police.
When Santos caught his eye, Delgatti was grinning. Santos recognized the same strange smile Delgatti gave him all those years ago when he was DJing at the party, the earliest memory he had of his friend.
Santos also spotted Delgatti's friend Danilo Marques; he had been arrested in Araraquara while in class learning to be an electrician.
After he'd done his stretches and dropped to his knees in prayer, Moreira had gone to the gym in Araraquara, and then to his office. He was wearing Bermuda shorts—his usual attire when not expecting clients. At 10 am, sitting in front of his computer, Moreira got a call from Santos' mother. “Ari, it's full of police at the house,” she told him. The police were searching Santos' family home and Santos' own nearby house. “It's probably nothing,” Moreira assured her. “Santos gets himself in trouble all the time.” But soon Santos' sister was on the line saying Santos had been arrested in São Paulo. Moreira told her that the police needed a warrant. He went back to work.
Moments later a photo of the warrant landed in Moreira's WhatsApp. Sighing, he started to read it. His eyes latched on to a name: Sérgio Moro. He went back and read again. Santos, the warrant said, was wanted in connection with the hacking of Moro's phone. This, Moreira realized with shock, was linked to Vaza Jato, the Car Wash leaks. “Gustavo did this?” he thought. “It is not possible.” But there it was, in black and white.
Moreira ran to his son, a lawyer who worked with him in an adjoining room of the office. “Behold!” he cried, excitedly banging his desk. “The show is about to begin.” Moreira dashed for the elevator, a flash of Bermuda shorts, his son trailing after him. What had happened? “Turn on the TV, because you're going to see me there!” Moreira exclaimed and stepped into the elevator. He drove home, started packing, and got himself booked on the next flight to Brasilia.
On the evening of the arrests, Luis Flavio Zampronha de Oliveira, the federal police chief in command of Operation Spoofing, finally got to sit down with his chief suspect after weeks of hunting. It was almost anticlimactic. Delgatti admitted to the hacks right away. He said he had acted alone and that everything had started when he hacked Bombardi, the prosecutor in Araraquara who had pursued him for years. He described how the prosecutor's phone book had led him to other officials, and finally to Dallagnol. He admitted that he had, in fact, been the one who hacked Moro's Telegram account. He admitted to hacking Manuela d'Ávila—whose number he had gotten through the phone book of the impeached ex-president Dilma Rousseff. Delgatti also claimed to have hacked Lula's Telegram but said he possessed no record of that.
On the weekend after the arrests, Telegram rolled out a fix for the vulnerability Delgatti had exploited—not just for users in Brazil, but everywhere.
As the federal police scoured the 7 terabytes of information stored on devices they had seized in their raids, they found evidence of 6,508 calls made to 1,330 different numbers, resulting in 176 successful invasions. They also found that suspicious sums of money had circulated among their suspects in just the past few months. But a clear picture of the motives behind the hacking scheme never quite came together. Certain text exchanges between the suspects seemed to suggest a conspicuously timed change in financial fortunes; in April 2019, for instance, around the time Delgatti was hacking Dallagnol's phone, he had texted Marques to say “the storm is over” and the “bonanza has come.” And Santos was evasive under questioning about his sources of income and cryptocurrency trading, which made prosecutors wonder whether the suspects had been paid in cryptocurrency to conduct their hacks. But ultimately they found no evidence that Delgatti had carried out his hacking spree for money—only that their suspects had been separately involved in various petty financial frauds for years. For the police, as for everyone who knew Delgatti, the reasoning behind the hacks remained fundamentally mysterious. Zampronha, the federal police chief, kept asking Delgatti why he did it. There was no clear answer.
The first time Moreira was able to see Delgatti was at the suspects' preliminary hearings. The lawyer was in the waiting area with Santos and Oliveira—they were in handcuffs, alongside armed police—when Delgatti came in wearing a suit: “Hey, what's up Ari!” Delgatti cried when he saw Moreira. “Did you see what I did?”
Delgatti was charged with being the ringleader behind the hacks. Santos, Marques, and Oliveira were charged as accomplices; the main evidence against them appeared to be that some of the hacks were carried out from their IP addresses. All of them were accused on separate charges of being members of an organized crime ring.
On September 19, a second phase of Operation Spoofing went into action. The freelance computer programmer Thiago Eliezer was arrested in Brasilia. The 19-year-old law student Luiz Molição was arrested outside Ribeirão Preto. Eliezer was accused of developing techniques used in the crimes, while Molição, investigators alleged, had helped Delgatti compile the material and conduct some of his communications with Greenwald, and also participated in the hacking of Joice Hasselmann. As part of his defense, Molição claimed that Delgatti had manipulated him into helping; he described Delgatti as a “narcissistic sociopath.”
Greenwald was named in the charges too, for having “incentivized and directed the group during the period of the hacks.” The prosecutors' supposed smoking gun was Greenwald's cautious response when his source called him up for advice. But in August, Brazil's supreme court forbade Greenwald's prosecution, citing the constitution's articles on freedom of the press, and the federal police say he did not participate in the alleged crimes associated with the leaks. Even so, federal prosecutors have continued to pursue charges against Greenwald and have appealed the supreme court's decision. President Bolsonaro has publicly threatened the journalist: “Maybe he'll do jail time here in Brazil,” Bolsonaro said in one interview. Greenwald and his family have had round-the-clock security since the first stories were published. The Intercept, meanwhile, has kept publishing stories based on the leaks—more than 100 to date. (On October 29, Greenwald resigned from the Intercept over a disagreement with American editors there, but he went out of his way to voice his respect for the Intercept Brasil.)
On November 8, 2019, Lula was released from prison, just as Delgatti had boasted would happen when he first contacted Manuela d'Ávila. Lula went on to demand access to all the messages between Moro and the prosecutors in Operation Car Wash, citing their role in helping to clear his name.
As for the enormously popular justice minister and “anti-corruption” crusader Sérgio Moro, his credibility was badly damaged. He hadn't been hacked by a foreign intelligence operation, as he had strongly implied, but by small-time scammers. After the leaks, Moro kept a low profile, and in April 2020 he resigned from the government after coming into conflict with Bolsonaro. Moro has since accused the president of several crimes. But he says that ever since his messages were leaked to the Intercept, he has periodically deleted his chats, so he no longer has many of the messages between him and Bolsonaro that would have provided concrete proof. This is the closest Moro has come to admitting the veracity of the leaked messages. He declined to comment for this article.
In written responses to my questions, Dallagnol still affirms that the Intercept's leaks showed no evidence of “illicit activity” by public authorities or “any crime.” Dallagnol also dismisses the Intercept as biased, accusing its staff of “making terrorism and personal attacks on social media.” He adds, “It was militancy, not investigation or journalism.” Ultimately he is defiant: “Car Wash was and is the greatest anti-corruption work in Brazilian history,” he says. It was a “hundred times bigger than Watergate,” he adds, “which isn't something we should be proud of, because it shows just how far corruption can go. The investigation was an earthquake that shook the state of systemic corruption.”
Many people in Brazil remain incredulous that a fraudster from Araraquara was behind the biggest leaks in Brazilian history. Conspiracy theories have circulated linking the hackers to communists, the Workers' Party, or other wealthy financial backers. Some have even pointed to Delgatti's childhood nickname—Red—as a sign of his supposed hard-left politics. Speculation continues in some circles that the group was paid in cryptocurrencies, though Delgatti denies having ever used them.
According to Eliezer, Delgatti assured him in prison that they wouldn't be locked up for long, thanks to a tia—literally meaning aunt. He seemed to be alluding to some powerful contact: “He talked many times about a tia and that she would help us,” Eliezer tells me in written answers to my questions, provided through his lawyer. (Delgatti denies saying this.) But as the months rolled by and the other suspects were released pending trial, Delgatti remained in custody.
Delgatti was held for a year in Block F of the Papuda Penitentiary Complex in Brasilia, which was ravaged by Covid-19. More than 1,000 inmates contracted the disease. For many months, it was difficult for Moreira, who once again began representing Delgatti late last year, to speak with his client and old friend. But in May and June, Moreira was able to deliver questions to Delgatti for me.
In responses delivered through Moreira, Delgatti wrote that he did what he did both to save Brazil “and because I myself had been wronged.” He went on: “I never asked money from anyone, what I wanted was justice.” Since the media attention has died down, Delgatti has despaired at the lack of action against those exposed in the leaks. “I think that I should be free,” Delgatti wrote. “Without a doubt I could be helping justice with regards the crimes committed by the operators of Car Wash.”
In Delgatti's answers to my questions, there are hints of a motive. “I never felt so good in my whole life,” he wrote of the moment when the leaks first came out in the Intercept. “I was proud of my achievement—I'm a vain person, and I had the feeling of a mission accomplished.” He also seemed disappointed that he is not adored in Brazil the way he imagined he would be.
The commander of Operation Spoofing, Luis Zampronha, believes that Delgatti must be punished for his crimes. In the only interview about the case that he has given, Zampronha described Delgatti to WIRED as narcissistic and troubled but fit to stand trial, and certainly not worthy of adoration. In Zampronha's mind, Delgatti is a scam artist who managed to invade the private lives of authorities, and no grand ideological hacker. “He is not Snowden,” Zampronha says.
Most Brazilians would agree. The tale of a ne'er-do-well turned cyber-crusader simply doesn't fit anyone's script. Now an entire country is in much the same position that Delgatti's associates from Araraquara have often found themselves in, never knowing how seriously to take a serial fantasist.
On October 17, Delgatti was finally released from prison to await trial in Araraquara; he now wears an electronic ankle monitor. There was very little media comment on his release. Just before this magazine went to press, I spoke to him over a voice line, in the first and only interview he has given. He was audibly emotional about the injustice he feels he has been dealt. “In my opinion I should be honored as a hero, and not labeled a criminal,” he said. But he became somewhat evasive when I brought up something he'd written earlier. At one point in prison, Delgatti had told me that he only gave a portion of the material he had hacked to Greenwald. “It's only the tip of the iceberg,” he had said.
When I asked him on the call how much more material there was and what he planned to do with it, he chortled and said he'd better not answer that. “It affects my personal freedom,” he said. Maybe there is no other material. But if it exists, it could be a time bomb waiting to explode in Brazil, and Delgatti could yet receive the adulation he dreams of. Or it could detonate and leave him in yet another cloud of smoke.
Updated 11/13/2020 12:10 pm EST: The subheadline of this article has been updated to reflect that Walter Delgatti approached Glenn Greenwald last year, not last fall as previously stated.
DARREN LOUCAIDES (@darrenloucaides) wrote about Italy's techno-utopian Five Star Movement in issue 27.03.
This article appears in the December 2020/January 2021 issue. Subscribe now.
Let us know what you think about this article. Submit a letter to the editor at [email protected].
- 📩 Want the latest on tech, science, and more? Sign up for our newsletters!
- A Navy SEAL, a drone, and a quest to save lives in combat
- How to escape a sinking ship (like, say, the Titanic)
- One woman’s high-touch bid to upend the sex-toy industry
- “Wait, Sylvie’s dad plays?!” The joy of Fortnite parenting
- Do everything faster with these keyboard tricks
- 🎮 WIRED Games: Get the latest tips, reviews, and more
- 🏃🏽♀️ Want the best tools to get healthy? Check out our Gear team’s picks for the best fitness trackers, running gear (including shoes and socks), and best headphones
