++FOOTBALL’S MOST+++ WANTED MEN
Criminal records, drink, drugs and shadowy lifestyles. But these geeks have men of power running scared by exposing the game’s dirty secrets
THE search for an answer to football’s most compelling mystery stretches from Budapest to Hamburg, Lisbon to Moscow, though the individual at the heart of it is a seemingly shambolic figure, who lives in seedy flats, frequents eastern European nightclubs until daybreak and consumes little more than lemonade and chocolate cake.
To the very few he has agreed to speak, he is known simply as ‘John’ — a common nom de plume of anonymous whistleblowers.
The reasons for a cloak-anddagger lifestyle which, he claims, keep him on the move virtually every three days, are clear.
He is the individual behind the Football Leaks organisation which, having revealed many of the sport’s dirty little secrets — Cristiano Ronaldo’s tax avoidance, agent Mino Raiola’s £41million cut of Paul Pogba’s move to Manchester United — last week exposed the breathtaking way in which Manchester City allegedly manipulated their accounts to dodge a breach of UEFA’s Financial Fair Play rules.
The embarrassing stream of allegations began appearing long before ‘John’ did. Football Leaks initially materialised as a small, unsophisticated web page in September 2015 — a repository for a cache of eye-watering contracts that revealed kickbacks for agents and tax avoidance for players. Initially it focused on the Portuguese clubs Benfica, Sporting Lisbon and Porto.
In time, the leaks would be linked to Rui Pinto, a gregarious 25-yearold history graduate with red dyed hair from Porto, on Portugal’s west coast. But when the disseminator of the information was persuaded to meet a German journalist, five months after the first cache was released, it was on condition of strict anonymity. Only his nationality – Portuguese – could be identified. The location of the meeting could only be reported as ‘an eastern European city.’
In many ways, he fits the stereotype of a goofy hacker. During the three bitterly cold February days the journalist, Rafael Buschmann, was with him, ‘John’ wore the same clothes – thin denim jacket, T-shirt featuring a picture of a half-naked woman and scruffy shoes. There were grey bags under his eyes. He consumed the lemonade and cake, he said, because his blood sugar levels were low. He wasn’t sleeping for fear of being unmasked by the sport whose vested interests he was blowing apart.
‘John’ wasn’t so fretful when spending the following evening in a windowless underground nightclub, drinking beer and shots, dancing until 5am on a night that he began watching Real Madrid v Roma in a bar. He was popular. He seemed to have a way with girls.
He made his money trading antique books and ornaments, though the flat he occupied, in a large, grey office building, was more akin to a student’s. Minimal furniture, no plants or adornments and no TV. Just piles of newspapers, a white laptop on a desk and beneath it, boxes that blinked and looked like routers. ‘John’ brought hard drives in from another room, attached them to the computer and, as Buschman describes it, ‘documents appeared on the screen. Thousands of them.’ He implied that he did not work alone. ‘All we have is a good network of sources. We get this material but I’m not going to tell you where from.’
This individual’s ways of evading identification include a facility on his phone which gives his coordinates as somewhere near the North Pole. But football’s collective financial power and influence has seen the game throw the full weight of cyber security into unmasking him.
The only breakthrough in three years of hunting came from something far more prosaic than professional expertise. In January 2016, a month before ‘John’ agreed to the meeting in eastern Europe, a name was posted in the comments beneath an online article about Football Leaks in the Portuguese title, Correiro da Manha.
The ‘suspect’ was Pinto, the Porto historian, who also had a specialist qualification in technology and computer engineering from the Politecnico de Braganca, in north east Portugal. Since 2012, Pinto has been living and studying at the Eötvös Loránd University in the Hungarian capital Budapest.
There wasn’t initially a great deal of information about Pinto — just a name and basic biographical details — but news travelled fast. Spanish sports paper Marca picked it up. This led Pinto to meet a journalist from the 888 sports website, in Budapest, to deny that he was Mr Football Leaks. Pinto told the journalist – whom he met in the same month that ‘John’ met Buschmann – that he had received a series of disturbing anonymous emails in which it was made clear that the sender knew who he was and where he lived. ‘[They] had all of my data,’ said Pinto. ‘Those who wrote it said they knew I had something to do with Football Leaks.’
A Hungarian former police officer has told Sportsmail that Pinto was investigated by Interpol and local detectives as the possible source of Football Leaks.
‘He operated from various internet cafes, many of them closed since,’ said the officer. ‘Before enough evidence could be gathered about him and his team, he switched methods of operation, hiding out on public servers, like libraries and university IP addresses.’
The local authorities did not get very far. Soma Csécsi, spokesperson for Hungarian police, confirmed that Interpol had also been involved but that the investigation had been closed.
If Pinto has been involved in Football Leaks, it calls the enterprise’s high-minded motives into question. Portuguese court papers show that he left the country after being found guilty of securing enough information about the Caledonian Bank, in the Cayman Islands, to transfer £230,000 from it. He was caught out, arrested and convicted.
Marca has published unsubstantiated claims that Pinto operated
with a lawyer to extort money from clubs on the threat of publishing Football Leaks evidence.
Pinto does have some of the characteristics of ‘John’. He, too, frequents sports bars, moving from room to room in flats occupied by students, in an east European city. He, too, is the life and soul, popular with girls and fond of nightlife. He, like ‘John’, likes to travel. He spent some of this summer in Berlin.
But his spiky red hair does not tally with the ‘John’ description. Nor the brown leather jacket he always wears. Nor the active student life, which includes involvement with the student council.
Pinto freely associated with a journalist while ‘John’ was obsessive — to the point of paranoia — about not being identified, even checking that the identity card of a taxi driver matched the individual behind the wheel. Those who know Pinto also describe an individual whose chaotic lifestyle of drugs and drink would make him incapable of forming and maintaining the kind of relationship with Der Spiegel that ‘John’ has.
‘He is smart enough to get the information but not to communicate and establish relationships to get it into the public domain,’ says one source in Budapest. If he is a part of Football Leaks, then Pinto is more likely to be one of a number.
The popular notion of a solitary computer-literate geek stealing into the mainframes of football clubs in the dead of night is improbable — not least because extracting this information is less complicated than it might seem. Senior British investigators have told Sportsmail that it almost certainly has not involved hacking at all.
Investigators believe it is more likely that employees at a club or governing bodies have responded to spam emails, requesting a password, or been fooled by a hoax call, telling them that a password is required to fix the computer system.
It is equally possible information has been passed to Football Leaks by disgruntled staff working in the game. The two classic scenarios are what investigators call ‘noble cause corruption’ — whistleblowers deeply unhappy about corruption in the game — or a disgruntled employee looking for payback.
‘The phone call often works because talking creates a relationship,’ says one investigator. ‘For all the talk of cyber security, the most basic strategies still work.’
Football Leaks may be a repository into which leaks from many sources with varying motives are feeding. It has formed a collection of international news organisations, called the European Investigative Collaborations, who provide the expertise to analyse documents and publish significant details.
Investigators say the hand of the Russian state – master practitioners in the illicit extraction of documents – should not be overlooked.
Fancy Bears, who operate through password blagging, not hacking, to open the lid on corruption in sport, are widely believed to have been operating for Russian military intelligence. Yandex, Russia’s biggest internet firm, provided a server for Football Leaks when it first seemed that its account would be closed down. All Yandex traffic is monitored by the Russia’s FSB, formerly the KGB. There have also been allegations of other malign forces at work.
Five days after Football Leaks first went public, the CEO of the Portuguese Doyen Sports agency, a focus of early revelations, was emailed from a Moscow-based Yandex account by an Artem Lobuzov, who sought to extort money in return for no further compromising information being published.
It is thought that information included a cache of excruciating emails sent by David Beckham. In one, he branded Britain’s honours committee a ‘bunch of c **** ’ for not knighting him. Another had Beckham saying: ‘Katherine Jenkins OBE for what? Singing at the rugby and going to see the troops plus taking coke. F***ing joke.’
A meeting between the two sides allegedly took place at a motorway service station outside of Lisbon. It has been reported — though never confirmed — that Doyen refused to pay a sum of £1m before the emails were eventually published. This sub-plot contributed to the mystery about where truth ends and myths start where the Football Leaks story is concerned. Doyen insist they were not blackmailed.
In an environment where news is quickly devoured by supporters of clubs who do not want to believe what Football Leaks reveals, a concerted attempt to discredit the operation is conceivable. The Lobuzov story may be a deliberate attempt to damage. It may also explain why some in Portugal and Spain are so keen to link Pinto, a convicted fraudster, to Football Leaks. But the so-called extortion may have been an opportunistic attempt to capitalize on the documents in circulation. ‘John’ has denied any attempt to blackmail.
Last week showed that the concerted attempt to get behind the shadowy world of football will not be derailed. When details of alleged Manchester City accounting practices were published 18 months ago, the club threatened to sue and force the writer to tweet out an apology. Allegedly, the same practice was used in full on Tuesday. City had no comment to make.
The last reported sighting of ‘John’ was in Hamburg SV’s Volksparkstadion stadium, swaying to the home team’s theme song. He seemed to have emerged from the paranoia about being unmasked. He still emails, signing himself ‘FL’.
‘There needs to be a public debate about the sport in order to clear it of this secretiveness,’ he wrote in an early encrypted email exchange with Buschmann. ‘A business that lacks transparency the way football does is a paradise for corruption. Secrecy about contracts and secret clauses is killing this sport.’
The website — footballleaks2015. wordpress.com — is still there, still basic and unsophisticated. How long would it go on publishing?
‘John’ was asked. ‘As long as we have documents,’ he replied.