Jump to content
Greasy Lake Community

Football Leaks


Recommended Posts


How Football Leaks Is Exposing Corruption in European Soccer

While Rui Pinto sits in jail, his revelations are bringing down the sport’s most famous teams and players.

By Sam Knight

May 27, 2019

Rui Pinto leaked more than eighty-eight million documents from the sport’s insiders. He now faces charges of cyber crime.

The first person to receive an e-mail from the whistle-blowing organization Football Leaks was António Varela, a columnist at Record, one of Portugal’s three national sports newspapers. The message arrived early in the afternoon of September 29, 2015. Varela, a precise, watchful man in his early fifties, clicked on a link, which took him to a blog entry that had been created at 5:17 A.M. that day. “Welcome to Football Leaks,” it read, in Portuguese. “This project aims to show the hidden side of football. Unfortunately, the sport we love so much is rotten and it is time to say ‘enough.’ ” Below was a collection of previously unseen documents involving Sporting Lisbon, the eighteen-time winner of Portugal’s national league. “Contracts in Portuguese, contracts in English, contracts in French,” Varela told me recently, in Lisbon. “I had no doubts about it. They were real documents.”

European soccer, which reaches its annual climax this weekend, with the final of the Champions League, the game’s most prestigious club competition, is a wonder of the sporting world. Storied teams such as Liverpool and Barcelona, Bayern Munich and Juventus, rise and fall. Each year, the finest players and coaches conjure, in new forms, soccer’s essential, unthinking grace.

The business side of the sport, however, is more like a painting by Bruegel the Elder. Since 1955, the best teams from each country have played against one another, and that has given rise to a dense intermingling of tactics, feuds, and money. Money above all. “Money scores goals,” as the German saying goes. Unlike American sports, with their draft picks, salary caps, and collective-bargaining agreements, European soccer is a heedless, Darwinian affair. Spending rules are broken. Salaries are secrets. The best leagues are awash in Russian oligarchs, Middle Eastern sovereign-wealth funds, and Chinese conglomerates. Rumors fly. Middlemen thrive. “Between clubs, it’s not only that we don’t trust each other,” a director of a top European club told me. “We betray each other constantly.” Last season, according to the accounting firm Deloitte, European soccer had revenues of twenty-eight billion dollars, about the same as Major League Baseball, the National Hockey League, and the National Football League combined.

The first documents released by Football Leaks related to a controversial investment model known as third-party ownership. One of the ways that clubs make money is by buying and selling players. T.P.O., which originated in Latin America, allows external parties to buy a stake in promising young players, in the hope of profiting from a huge transfer deal one day. (In 2017, the Brazilian striker Neymar was sold by Barcelona to Paris Saint-Germain for around a quarter of a billion dollars.) Proponents of T.P.O. describe it as a form of lending, but many fans believe that it gives investors too much control over a club’s roster and the shape of players’ careers, by influencing when and where a player might be traded.

In Portugal, one of the most vehement critics of T.P.O. was Bruno de Carvalho, the president of Sporting Lisbon, who described it as “a monster coming to football.” FIFA, soccer’s global governing body, banned the practice in May, 2015. But the contracts that Varela read on Football Leaks showed that Sporting Lisbon had entered into a secret, T.P.O.-like arrangement with an Angolan club named Recreativo da Caála. “It was powerful,” Varela said. “People say one thing but they are doing something completely different.”

Varela’s story filled two pages of Record the following day. By the end of the week, Football Leaks had posted confidential contracts from F.C. Porto and Benfica, Portugal’s biggest teams; Olympique Marseilles, a leading French club; and F.C. Twente, of the Netherlands. Fans learned that Jorge Jesus, the coach of Sporting Lisbon, was earning five million euros a season—an extraordinary salary for the Portuguese league—while other files confirmed rumors and disclosed hidden investors. Together, they gave a sense of seeing the business of soccer for the first time.

Football Leaks was hosted by LiveJournal, a Russian blogging service, suggesting that it was the work of Russian hackers. But Varela was struck by the technical nature of the documents. He thought that a disaffected lawyer might be responsible. “They were framing the problems with too much accuracy,” Varela said. At the same time, he worried that the data might be stolen. In late November, after Football Leaks revealed that F.C. Twente had sold stakes in seven of its first-team players to a single investment fund, its president resigned. The club was fined a hundred and eighty thousand euros, and was banned from European competition for three years.

In mid-December, a spokesperson for Football Leaks, calling himself John, agreed to answer questions e-mailed by the Times. “People may think we are hackers, we are only regular computer users,” John said. He claimed that the organization had been given three hundred gigabytes of data by insiders, who were dismayed by soccer’s excesses, and that it was receiving more all the time. “The fight has been hard,” John wrote. “But we won’t stop.” The interview transfixed Rafael Buschmann, a thirty-three-year-old sports reporter at Der Spiegel, the German news magazine, who had covered organized crime and the financial side of soccer for ten years. “I was totally electrified to get a hand on this data,” he told me.

For all John’s bravado, it was clear that Football Leaks was having problems. The first blog was shut down by LiveJournal. So was a second. There were days when the documents were hard to access, or infected by malware, which suddenly filled the screen with pornography. Buschmann wrote to the site for weeks, but received no reply. On January 3, 2016, the group finally responded: “What is your problem with football? Kind regards, FL.” That evening, confidential contracts related to the image rights of Cristiano Ronaldo, at that time the star forward for Real Madrid, appeared on the blog.

Buschmann and John began exchanging messages every few hours. Six weeks later, Buschmann flew to Budapest to meet him. He expected to find a former senior employee of FIFA or UEFA, which administers European soccer, who had gone rogue. But, in a small hotel near the city center, he met Rui Pedro Gonçalves Pinto, a twenty-seven-year-old antique dealer with spiky hair, from northern Portugal. It was around 5 P.M. and Pinto hadn’t yet eaten breakfast. Real Madrid and A.S. Roma were playing that evening. Pinto took Buschmann to a Serbian restaurant to watch the game, and ordered a meat platter. They partied for two days. “I was nearly to death,” Buschmann told me. Before the reporter left, Pinto gave him two hard drives, containing eight hundred gigabytes of data. In the following three years, Pinto supplied Der Spiegel with four terabytes of confidential information, more than eighty-eight million documents—a leak almost twice the size of the Panama Papers and sixty times that of Edward Snowden’s.

The information provided by Pinto has led to the conviction of dozens of top soccer players for tax evasion. It has prompted the Las Vegas police department to investigate an allegation of rape against Ronaldo. It has also revealed likely rule-breaking by Manchester City, the all-conquering champions of the English game, and a plan by Europe’s leading teams to leave their national leagues and form their own competition. Since 2016, Der Spiegel has partnered with media organizations in thirteen European countries to publish hundreds of stories, rewriting much of what was known about the soccer business and changing it in the process. The scale of Football Leaks—its totalizing nature—has brought about a novel anxiety among the sport’s fixers and dealers. “People are going to think at least twice before they do something which is not a hundred per cent straight,” a Portuguese agent told me. Last November, in response to Der Spiegel’s stories about a breakaway league, fans in Germany mounted protests in stadiums across the country.

But Pinto is a confounding figure. With a high-school diploma and no formal I.T. training, he has managed to obtain, and interpret, information that European tax prosecutors and investigative journalists have sought for years. “For me, he is a genius,” Buschmann told me. “The question is, what is the other side of his personality?” As soon as Football Leaks appeared, it had the air of an illicit enterprise. For a long time, after Pinto was identified as the ringleader of the project, he denied his involvement and narrowly skirted arrest.

In January, Pinto was detained in Hungary, on charges of cyber crime and extortion. While he waited to be extradited to Portugal, where he faces up to ten years in prison, I spent two days talking to him in his apartment in Budapest. Pinto is now thirty, but his fresh face and adolescent haircut give him the look of a student who has missed his last deadline. Each day, I arrived at around 1 P.M., when Pinto had just got out of the shower. Many of his answers had an artful, knowing quality. At tense moments, his face broke into a disarming smile. “I really don’t consider myself as a hacker,” he told me.

Pinto prefers to talk about what he has uncovered, and to describe the evolution of European soccer from a varied and distinctive game to a corrupt playground for the international élite, in which only the richest, least scrupulous clubs can thrive. Pinto sees the future currently awaiting European soccer as bland and predictable. “It will be like plastic,” he said. “Everything would be like a plastic thing.” Pinto has studied the cases of celebrated leakers (his lawyer, William Bourdon, represented Snowden), and I often got the impression that he is trying to expand the definition of what a whistle-blower can be. In 2016, Buschmann asked Pinto where his information came from, and he replied, “Some of our sources do not realize that they are our sources.” One afternoon with me, Pinto mused out loud about why none of his insiders had gone public. He questioned whether Europe’s whistle-blowing protections were strong enough. I suggested that perhaps his sources hadn’t gone public because they didn’t exist and that Football Leaks was the result of Pinto’s hacking alone. “That would be a plot twist,” he said, flashing me his smile. “The biggest plot twist ever.”

Pinto grew up in a small, blue-tiled house on a hill in Vila Nova de Gaia, which faces Porto, Portugal’s second city, across the River Douro. On a dazzling morning in April, four of the eight newspapers on sale in town had stories about him on the front page. Pinto claims that he learned to read by listening to soccer commentators and matching the names that he heard against what was written on the players’ shirts. At the age of four, he began to stay up late on Sundays, to watch the highlights from the weekend’s games, and to keep notebooks, in which he would write down scores and players’ statistics.

“My father once said that football will destroy my life, because I was kind of a fanatic, actually,” he told me. Pinto’s father, Francisco, designed dress shoes at a local factory. His mother, Maria, looked after him and his sister, who is ten years older. Francisco dabbled in antiquities, and when Pinto was seven his father bought an Intel Pentium desktop computer with a dial-up Internet connection and installed it in the living room, to buy and sell ancient coins online. “EBay at that time was an extremely awesome opportunity,” Pinto recalled. “I learned everything sitting next to him.” Pinto became fascinated by the Phoenicians, and by the Iberian and Celtic tribes that settled in Portugal before the Romans came. He watched the History Channel and dreamed of becoming an archeologist.

When Pinto was eleven, his mother was given a diagnosis of advanced lymphoma. He visited her in the hospital every day after school. After she died, he resolved to tell no one. “I just pretended that nothing happened and that is all,” he said. He started skipping classes. He stayed up late, online. In school, Pinto was a quiet, distracted presence at the back of the class, who seemed to get his information from elsewhere. “It’s very, very difficult to characterize Rui,” Mario Falcão, Pinto’s high-school geography teacher, told me. “If he wanted it, he would probably be the best pupil from the class, but he was not.”

In 2004, when Pinto was fifteen, his team, F.C. Porto, won the Champions League, led by a brash, exacting coach named José Mourinho. Pinto was ecstatic. “He came very happy to class,” Falcão recalled. But most of the time he was not there. Pinto’s father often apologized for his son’s poor attendance. “What can a father do with a teen-ager who passes all the night with the computer?” Falcão said. Pinto digitized the records of the school library. When I asked Falcão whether he agreed with Pinto’s description of himself as a normal computer user, he said, “No,” and then repeated the word eight times.

Pinto enrolled at the University of Porto, to study history, in the fall of 2008. The following month, Banco Português de Negócios, a private bank, was nationalized amid allegations of fraud and money laundering, marking the start of the country’s financial crisis. Pinto became part of what is known as Portugal’s geração à rasca (“generation in trouble”). Unemployment among the young reached almost forty per cent. Hundreds of thousands of people emigrated. “These younger people, twenty-five years or less, have to tell themselves this is not going to work,” Filipe Carreira da Silva, a sociologist at the University of Lisbon, who has studied the economic crisis, told me. In 2009, the shoe factory where Francisco had worked went bankrupt. (He had taken early retirement, to concentrate on antique dealing.) In 2011, Portugal accepted a bailout from the International Monetary Fund. “I mostly lost my motivation to do anything,” Pinto said. “More and more events started to appear and to show everyone how doomed was Portugal.”

In 2013, Pinto took part in a study-abroad program in Budapest. “I am not a rich person, so I could not go to a city like London or Paris,” he told me. When he arrived at his student dorm—in a complex of large Soviet-era apartment buildings in the east of the city—he experienced a sense of release. Budapest was fun. He loved the light on the Danube and the cobbled streets. Mixing with students from across Europe, Pinto gained a broader sense of the Continent’s economic crisis. He read about attempts by the German tax authorities to trace money that had been moved offshore. When he considered Spain, Italy, and Greece, where painful austerity measures had led to widespread street protests and the rise of populist parties, Pinto was struck by the passivity of his home country. “If you look at the Portuguese people, most of the young people, they don’t want to get involved in any of this,” he said. “They accept everything so easily.”

In the fall, Pinto returned to Vila Nova de Gaia. He was in the sixth year of a three-year history degree. He helped his father with the antique dealing, but not much else was happening. On September 18th, Pinto had €31.67 in his checking account. The following day, he received a transfer of €34,627 from a client account at Caledonian Bank, a small private bank in the Cayman Islands. On Friday, October 11th, Pinto received a second windfall from Caledonian Bank—this time from an account belonging to NetJets, the private-jet-rental company—of €227,332.80. Two days later, he paid a cell-phone bill of fifteen euros.

The second transaction triggered an alert at the bank. The transfer was cancelled and the money was returned to NetJets. According to a criminal complaint, filed with Portuguese prosecutors the following week, someone had used a phishing attack to access Caledonian Bank’s backup e-mail servers. Equipped with usernames and passwords, the hacker had ordered the transfers to a Deutsche Bank account in Lisbon registered to Rui Pinto. The data from the first transaction were garbled, but the second transfer appeared to have been executed at 5:46 A.M. on October 10th, from a computer-science lab at the University of Porto.

Pinto hired a lawyer, Aníbal Pinto, who works out of a glass-walled office on the outskirts of town. (The two men are not related.) When I asked Rui why he had hacked into Caledonian Bank, he told me that he copied about a terabyte of data from the bank’s servers, which he intended to hand over to European tax investigators. “It was kind of interesting to find out what was going on,” he said. But he never followed through. Pinto’s account was frozen on November 6th. The police investigation was slow. The bank refused to name the victim of the first transaction and the lab at the university did not keep computer-use records for more than seven days. Pinto maintained that the second transfer was a banking error and that the money from the first one belonged to him.

During the summer of 2014, Aníbal Pinto reached a deal with Caledonian Bank, in which his client agreed to return half the first transaction and keep the rest, a total of €17,313.50. Pinto was never charged with a crime.

In February, 2015, Pinto moved to Hungary for good. “Portugal is a lovely country for a holiday,” he told me. “Just that.” His father now traded in old posters, photographs, railway maps, and flyers, mostly from the nineteenth century. Budapest was rich in ephemera from the industrial revolution and the early twentieth century, which the Pintos sold for ten or twenty euros per item online. In his first months in the city, Pinto went for interviews at a few call centers, where he could use his English and Portuguese.

But he was increasingly distracted by soccer. That spring, Swiss police, acting on instructions from the F.B.I., arrested nine FIFA officials at a meeting in Zurich, on corruption charges relating to the organization’s decision to award the upcoming soccer World Cups to Russia and Qatar. Pinto was also concerned about the fate of his home-town club. A week after F.C. Porto’s victory in the Champions League in 2004, Mourinho had left to manage Chelsea, a London club that the previous year had been bought by the Russian oligarch Roman Abramovich. During the intervening decade, Porto had found it impossible to match the spending of the biggest clubs, in Germany, Spain, and England, or of trophy assets, like Paris Saint-Germain, which had been acquired by the Emir of Qatar.

“Look, I’m bored, you’re bored—why don’t you let me go down there and shake things up a bit?”

Like other teams outside the gilded élite, Porto was taking ever-greater financial risks in order to compete. When Pinto was back in Vila Nova de Gaia, he had travelled to a few away matches with the team’s hard-core supporters’ club, the Super Dragons. At the games, he heard about a company named Doyen Sports Investments, backed by Kazakh money, which had been involved in several recent transfers. “Something was not O.K. with football,” Pinto said. “The fact that I got such a confirmation coming from so close to Porto make me decide to act.”

During the summer, Pinto acquired thousands of internal e-mails and contracts from Doyen. He would not tell me how. “What I can say about it is that it was surprising how confident these football entities are,” he said. “They think they are untouchable.” One transaction that Pinto pieced together—a loan deal between F.C. Porto and Real Madrid for a young Brazilian midfielder named Casemiro—appeared to include a seven-hundred-thousand-euro fee for the son of Porto’s club president. “I felt like they were stealing my football club,” Pinto told me. “And that no one in Portugal even cared about it.”

Doyen, which had offices in London and Malta, was run by Nélio Lucas, a charismatic Portuguese agent in his late thirties. Between 2011 and 2015, Doyen invested around three hundred million euros in T.P.O. deals. When Football Leaks went live, that fall, Doyen was the common thread in many of the stories. On October 3rd, four days after Pinto posted the first documents, Lucas received an e-mail in excellent Portuguese from someone calling himself Artem Lobuzov. (The name belongs to a Russian freestyle swimmer who competed in the 2012 Olympics.) Lobuzov threatened Lucas with more damaging disclosures. “The leak is worse than you can imagine,” he wrote. Lobuzov said that journalists were desperate for him to share what he had. “You certainly wouldn’t want that, right? But we can talk . . .”

Lucas reported the e-mail to the Portuguese police, who had already received a complaint about Football Leaks from Sporting Lisbon. In the following days, Lucas shared his conversation with Lobuzov with detectives from the country’s cyber-crime unit. On October 5th, Lobuzov said that a payment of between five hundred thousand and a million euros would be a “good donation” to make the material disappear. Lucas played along. Four days later, Lobuzov e-mailed to say that his lawyer was waiting for Lucas to make contact. The lawyer’s name was Aníbal Pinto.

A meeting was arranged for October 21st, near Lisbon. Aníbal Pinto flew south, from Porto. A driver picked him up from the airport and took him to a roadside café on the A5 highway, around ten miles west of the city. Pinto was uneasy. “Lawyers usually meet in their offices,” he told me. The location had been chosen by the police. A surveillance van was stationed out of sight. Pinto was joined by a lawyer for Doyen and by Lucas, who was wearing a wire. Two plainclothes officers sat at a nearby table.

The men discussed a possible contract between Doyen and Lobuzov, worth three hundred thousand euros over five years. Conscious that the police were listening in, Lucas floated the idea of Lobuzov coming to work for Doyen as an I.T. consultant. He asked Pinto about his client’s hacking abilities. “I immediately explained, this is a young Portuguese kid,” Pinto recalled. “Not a major criminal organization.” But Pinto described the Caledonian Bank case. “I already had something similar with him,” Pinto explained. Toward the end of the meeting, when Doyen’s lawyer was in the bathroom, Lucas offered Pinto a million euros to reveal his client’s name. Pinto refused.

Rui Pinto told me that he posed as Artem Lobuzov to check that the documents he was posting were real. “I wanted basically to see the reaction,” he said. “I know it was a naïve attitude.” In early November, Lobuzov announced that he was walking away. Lucas and Doyen ultimately came to suspect a different reason that Lobuzov had broken off contact. The company hired a Portuguese security firm to study its servers. The investigation showed that Doyen’s staff had been the victims of a phishing attack during the summer of 2015, in which they received replicas of Dropbox folders from contacts at various soccer clubs. On July 19th, Lucas had received a file named “Players,” supposedly from an official at F.C. Porto. When he attempted to open it, the file installed malware, which forwarded the contents of Doyen’s London servers to a Russian e-mail address. The hack raised the possibility that Lobuzov was able to read Doyen’s communications with the police in real time. (Pinto told me that this was not the case; he read the messages only months later.)

The end of 2015 was a heady, disorienting time for Pinto. Fresh documents were pouring into Football Leaks from law firms, clubs, and agents. There were thousands of PDFs and e-mails, which Pinto had no easy way of searching. He worked at night, combing through documents page by page. “It was extremely hard for me at that time to realize the extent of the wrongdoings,” he said.

Pinto sought to post at least two contracts every day. But he was often disappointed by the media coverage, which reduced Football Leaks to a source of gossip about famous players. On January 20, 2016, Pinto published the transfer contract of Gareth Bale, a Welsh winger who had moved to Real Madrid from Tottenham Hotspur, in the summer of 2013, for a little more than a hundred million euros. The contract was the seventy-seventh published by Football Leaks. It showed that Madrid had announced a fictitious, lower fee, in order not to offend Madrid’s star player, Ronaldo, who was acquired for ninety-four million euros. “It caused a kind of impact,” Pinto said. “But, yeah, it’s just nonsense.”

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...