The States do not collapse suddenly. They crumble from within, silently, while institutions continue to function in appearance and people keep voting in the hope that something will change. Colombia reached May 31, 2026, at that exact point: that of a country that still resembled a democracy but whose intelligence apparatus was being used, with surgical precision, to ensure that certain outcomes were impossible or, if they occurred, uncomfortable to maintain.
I do not say this as a hypothesis. I say this because the record already exists. A serving government minister presented a forensic report to the media certifying that his own State spied on him for months, extracted 2.3 gigabytes from his cellphone, and activated his camera and microphone 124 times while he investigated corruption within the Army. A former presidential candidate was pressured to publicly retract for daring to ask if there was a surveillance operation against the opposition. A female candidate had to hire criminal lawyers to defend her phone's privacy. And a Republican senator from Ohio flew to Bogotá, not as a political tourist, but as a formal electoral observer, to loudly warn that Washington might not recognize the result if the votes were counted under intimidation.
Each one of these facts, separately, would be serious. Together, they form something different: an architecture. And architectures do not build themselves. Someone designs them.
I read the complaint from Francisco Santos, reviewed the forensic report from Minister Andrés Idárraga, checked every available source and assessed the coherence of the whole. What I found requires no speculation. It requires someone to read it with open eyes and call each thing by its name.
The man who speaks and the reason to listen to him
Francisco "Pacho" Santos did not make this complaint from an analyst's desk. He was Vice President of Colombia for eight years under Álvaro Uribe. He was ambassador in Washington during the Duque administration. He has spent decades in the space where politics, intelligence, and national security intersect without warning. When he talks about covert operations, he speaks from within that world, not from outside.
What Santos publicly denounced, in the days leading up to May 31, 2026, has two axes that should be separated. The first: according to him, there is an active and ongoing operation to carry the Pacto Histórico candidate to the presidency by any available means, legal or not. The second, if that route fails: destabilize the institutions to make the possession of whoever wins impossible. It is not about an uncomfortable defeat or a difficult transition. It is about leaving the State without a foundation.
This is not said by someone looking for a headline. It is said by someone who has spent decades sitting in meetings where those words have real weight. My reading is that the complaint deserves to be taken as a serious starting point, not as a final proof, but neither as disposable political noise.
Cuba, Venezuela, and Russia: when allies become operators
What Santos describes about foreign presence in Bogotá has a level of specificity that sets it apart from usual rhetoric. He does not speak of diffuse influences or ideological sympathies. He speaks of two Cuban agents operating under the aliases Raúl and Ramón, with documented work meetings at the Isle Habana restaurant in the La Macarena neighborhood, in the Venezuelan embassy, and at other locations in the city. He describes them as active advisors, not passive observers.
The presence of Cuban intelligence on the margins of Colombian politics is not, by itself, a novelty. On June 18, 2022, Diario de Cuba published a report on the alleged penetration of Havana's intelligence apparatus in Gustavo Petro's campaign, identifying an agent linked to the Cuban embassy with documented operational history in several Latin American countries (Diario de Cuba, June 18, 2022). That does not validate what Santos says about the present but establishes that the pattern he describes did not arise from nothing.
The map that Santos draws goes further. Venezuelan SEBIN would have offered technical support to the operations. Russian intelligence services the military GRU and the civil SVR, direct heirs of the KGB, would appear as part of the broader machinery. And officials from the Colombian National Intelligence Directorate would have traveled for training in Russia under reserved identities, without official record, without institutional traceability. The plausibility of these claims exists. Public corroboration does not yet.
What is on public record is the Russian operational presence in Colombia in recent years. On May 22, 2021, El Espectador revealed that Colombia had expelled two Russian diplomats: Aleksandr Nikolayevich Belousov from the GRU and Aleksandr Paristov from the SVR, both accredited to the Bogotá embassy. They had been detected touring popular neighborhoods in the city, gathering strategic information with documented links to Venezuelan interests (El Espectador, May 22, 2021). That is a method precedent, not continuity. But it serves as context to evaluate what Santos describes.
Operation Greece: the State that watches its own citizens
To the operation that Santos describes, he gives a name: Operation Greece. According to him, it began in 2025 with a clear objective: to profile candidates and opposition leaders, anticipate their movements, and shape the electoral scenario before the campaign took its definitive form. Santos claims that within the DNI itself there were officials who refused to participate, but who know the scope of what was planned and executed.
This name did not reach the public debate solely through Santos. On April 6, 2026, Revista Semana, Infobae Colombia, and La FM reported that former presidential candidate David Luna filed a formal petition with the DNI and the National Protection Unit, demanding official confirmation or denial regarding the existence of that operation. Luna described it as a mechanism designed "to illegally intervene in communications and conduct surveillance and profiling of opposition members" (Revista Semana, April 6, 2026; Infobae Colombia, April 6, 2026; La FM, April 6, 2026). The institutional response was, in practice, silence.
But not only that. On March 21, 2026, Infobae Colombia published that the DNI not only ignored the petition but demanded that Luna publicly retract his statements. He responded in a video that he would not do so under any circumstances and announced that the case was being presented to the CIDH (Infobae Colombia, March 21, 2026).
> "Instead of clarifying the facts from the DNI, they activate pressure against those of us who denounce. That is called political persecution." David Luna
An institution that has nothing to hide responds with documentation. What the DNI did here was not deny with evidence. It was to try to silence the one who asked. That has a very specific logic, and it is not one of innocence.
Pegasus within the cabinet: when the spy does not distinguish enemy from ally
What transforms this set of complaints into something qualitatively different is the case of the acting Minister of Justice, Andrés Idárraga. Because Idárraga is not an opponent. He is an official of Petro's own government, the Secretary of Transparency of the Presidency, precisely in charge of investigating corruption within the State.
On January 13, 2026, Idárraga presented to the media a forensic report from the Forensic Strategic Group-Incoseg certifying the following: the spy software Pegasus was installed on his cellphone an iPhone 15 Pro Max on August 1, 2025, at 14:32:17. Between August and November of that year, the device was infiltrated more than 8,742 times. The camera and microphone were remotely activated at least 124 times. 2.3 gigabytes of private information were extracted, including confidential conversations with President Petro himself and data from sources reporting corruption cases in the military sector (Ministry of Justice of Colombia, Official Statement, January 13, 2026).
The precision of those figures is not rhetoric. A timestamp with hour, minute, and second is the kind of data that rigorous forensic analysis produces, not a political accusation. And the magnitude of the extraction—2.3 gigabytes, 8,742 infiltrations—describes a sustained and systematic surveillance, the type reserved in counterintelligence for someone considered an active first-level threat.
> "The infiltration would have been ordered from the Ministry of Defense, using reserved expenditures and Army counterintelligence structures to persecute me, due to the fact that I am advancing investigations related to corruption." Andrés Idárraga, Ministry of Justice, January 13, 2026
El País covered the complaint the same day it was made public (El País, January 13, 2026). On January 26, 2026, the same newspaper reported that Minister Armando Benedetti had also confirmed having his own evidence of surveillance with Pegasus, which expanded the case from one spied official to a pattern of friendly fire within the cabinet (El País, January 26, 2026).
The Ministry of Defense responded on January 17, 2026, denying any use of Pegasus, claiming that the software had ceased to be operational since 2022 (Infobae América, January 17, 2026). The forensic record places its activation in August 2025. One of the two statements is false.
Not very far from that case, in May 2026, presidential candidate Paloma Valencia publicly declared that someone had hacked her phone and that her private conversations were in the hands of unknown individuals. She authorized lawyer Jaime Lombana to file a criminal complaint with the Cybercrime Unit of the Prosecutor's Office. Caracol Radio, El Colombiano, and El Heraldo confirmed the formal filing (Caracol Radio, May 7, 2026; El Colombiano, May 7, 2026; El Heraldo, May 7, 2026).
The money, the vehicles, and the name that is not spoken aloud
Santos goes beyond the software. He describes the existence of mobile interception vehicles deployed in Bogotá with an investment that, according to him, exceeds 1.5 billion pesos. In the intelligence documents he claims to have reviewed, two names frequently appear: someone identified as Estrada, related to leaks to the National Electoral Council, and the former DNI director Carlos Ramón González, now in exile in Nicaragua, a fugitive from Colombian justice.
Parallel to this, Santos describes a deliberate campaign to install the narrative of electoral fraud before a single vote was cast. The center of that narrative is the company Thomas Greg & Sons, which operates the pre-count electoral software. The Prosecutor's Office reviewed thirteen thousand phone interceptions related to the case and found no support for the accusation. On May 29, 2026, ColombiaCheck published an investigation in which AFP experts rated that narrative as a myth, while the Registraduría defended the integrity of its manual counting process (ColombiaCheck, May 29, 2026).
What is striking is that on February 19, 2026, Infobae Colombia reported that President Petro himself had requested a review of the software of Thomas Greg & Sons, feeding from inside the government the very distrust that supposedly harmed him (Infobae Colombia, February 19, 2026). That contradiction does not have an easy innocent reading.
The script of the 28th and 29th: when violence is not spontaneous
Santos does not limit his complaint to espionage or fraud. He warns about something more immediate: a destabilization plan for after the polls. According to him, in the event of an electoral defeat, organized structures were set to paralyze Cali, Medellín, and Bogotá through blockades, disturbances, and coordinated street pressure—not a spontaneous reaction from supporters but an operation with name, date, and coordination.
On May 26, 2026, Senator Andrés Forero from the Centro Democrático was categorical in a public intervention spread by NTN24 on their YouTube channel: "We have intelligence information telling us they have everything prepared for May 28 and 29. The mingas, the urban commands, the helenos, the FARC bandits." Forero pointed directly at President Petro as the central factor of disturbance and warned about the risk of blockades on the Panamericana and in Buenaventura (NTN24, May 26, 2026).
The regional context did not help clear up those doubts. On May 20, 2026, Infobae América Latina reported that Petro had expressed public support for protests against Bolivian President Rodrigo Paz, which led to the expulsion of the Colombian ambassador in La Paz, accused of direct interference in Bolivia's internal affairs (Infobae América Latina, May 20, 2026). The signal that this sends—that the Colombian government tolerates and, in some cases, encourages street pressure as a political instrument—cannot be read in isolation when Santos warns about what could happen the day after the elections.
Washington sends a senator, not a statement
The international gaze on these elections was more intense than usual. Republican Senator Bernie Moreno of Ohio, one of the lawmakers closest to former President Donald Trump and a reference voice on Latin American issues within the Republican Party, traveled to Colombia as a formal electoral observer. Not as a political tourist. As an enrolled observer.
s words with surgical precision: "If they are going to count votes that are the result of clear intimidation, then they will not have elections that the international community, and certainly the United States of America, will consider free and fair" (El Colombiano, May 20, 2026).On May 21, 2026, La República expanded its statement: Moreno laid down the complete geopolitical line, warning that if Colombia takes "the wrong path," the same actors currently operating from Cuba, Venezuela, and Nicaragua will find a clear path to Bogotá (La República, May 21, 2026).
This is not a protocol statement. Washington does not send a senator from Ohio to Bogotá for electoral tourism. The presence of Moreno, combined with the language he used, is a warning with real consequences regarding international recognition, bilateral relations, and access to markets. Colombia understood it. Or should have understood it.
What remains standing when the cameras go off
Santos says it bluntly and deserves to be quoted without sweeteners: it is not about who wins on May 31. It is about whether Colombia has institutions strong enough for democracy to survive attempts to demolish it from within.
This phrase is not electoral hyperbole. It is supported by concrete facts. A minister from the government was spied on by his own state while investigating military corruption, and the forensic file proving it has a name, date, time, and company. A former candidate has been denouncing illegal surveillance for months, and the institutional response was to ask him to be silent. A candidate had to hire criminal lawyers to defend the privacy of her phone. A foreign senator had to come to say out loud what Colombian institutions have not dared to say among themselves.
What weighs most in all of this is not any element separately. It is the convergence. When a state intelligence apparatus spies on its own Minister of Justice, demands retractions from opponents who ask legitimate questions, and responds with silence to the requests of its own president, it is not failing due to negligence. It is functioning exactly as someone designed it to function.
This is what Colombia has on the table today. Not a scandal. A file.
Conclusion: What a ballot cannot resolve
On May 31, Colombians voted. However, what is at stake is not resolved at a ballot box. The surveillance files, the classified orders, the names of the executors, the forensic timestamps: all of that will continue to exist the next day, regardless of who wins. And what determines whether that file produces real consequences is not the solidity of the evidence, which already exists. It is the willingness of the institutions to act on it.
I have worked on cases of illegal state surveillance in different contexts: within the police structure in Internal Affairs, in undercover federal operations with the DEA and Marshals, and in criminal defense investigations where the goal was precisely to document the state's abuse against an individual. In all those contexts, the pattern that is most difficult to break is not the technical one. It is not the malware nor the chain of command. It is the institutional one: the willingness of the oversight agencies themselves to act with the urgency that the case demands, rather than waiting for the scandal to cool off on its own.
In Colombia, that is the real risk. Not Pegasus. The silence surrounding Pegasus. A state that can spy on its own Minister of Justice while investigating military corruption, publicly pressure anyone who dares to ask, and not respond to its own president when he requests explanations, is not failing due to negligence. It is functioning exactly as someone wanted it to function.
The difference between cases that end in accountability and those that end in impunity is not in the available evidence. It is whether someone, within that institutional chain, decides at some point that the truth weighs more than the cost of upholding it.
That moment has not yet arrived in Colombia. But the file is already on the table. And files, unlike scandals, do not disappear by themselves.
References
https://www.youtube.com/watch?v=KVn9A7XtGQI
Diario de Cuba. "A Cuban exile organization alerts about the alleged penetration of the regime in Colombian elections." June 18, 2022.
https://diariodecuba.com/cuba/1655558321_40316.html
El Espectador. "The story of two Russian spies in Colombia, what were they doing in popular neighborhoods of Bogotá?" May 22, 2021.
Revista Semana. "David Luna sent a petition to the DNI and the UNP regarding Operation Greece." April 6, 2026.
Infobae Colombia. "Operation Greece would be the basis for the illegal intervention against opposition figures." April 6, 2026.
La FM. "David Luna: petition to the DNI regarding Operation Greece and communication interception." April 6, 2026.
Infobae Colombia. "David Luna refuses to retract his statements regarding wiretapping and accuses the DNI of political persecution." March 21, 2026.
Caracol Radio. "Hacking of Paloma Valencia's phone: criminal complaint filed with the Prosecutor's Office." May 7, 2026.
El Colombiano. "Paloma Valencia reports the hacking of her phone." May 7, 2026.
El Heraldo. "Paloma Valencia: 'Here we are all wiretapped.'" May 7, 2026.
El País. "The Minister of Justice of Colombia reports being a victim of the spyware Pegasus operated by the state itself." January 13, 2026.
Ministry of Justice of Colombia. "A forensic report confirmed that Pegasus was used illegally to spy on me, Minister Andrés Idárraga." Official statement, January 13, 2026.
El País. "Colombia spies on itself: Pegasus reveals friendly fire in Petro's cabinet." January 26, 2026.
Infobae América. "Colombian Ministry of Defense denies the use of Pegasus and spying on the Minister of Justice." January 17, 2026.
ColombiaCheck. "The myth of cross-border electoral fraud and narratives against migration." May 29, 2026.
Infobae Colombia. "Petro questioned the electoral process again and requested a review of the software from Thomas Greg & Sons." February 19, 2026.
NTN24. "Alert on political violence in elections senator Forero on electoral disruption." YouTube, May 26, 2026.
https://www.youtube.com/watch?v=v3HwBKubtEo
Infobae Latin America. "Diplomatic crisis between Bolivia and Colombia: Petro supported the protests and Paz expelled his ambassador." May 20, 2026.
El Colombiano. "The U.S. may not recognize the results of elections in Colombia if there is intimidation against voters." May 20, 2026.
La República. "Bernie Moreno warns that the U.S. may not recognize the elections if there is intimidation." May 21, 2026.
About the Author:
William L. Acosta is a graduate of PWU and Alliance University. He is a retired police officer from the New York police department, a former U.S. Army veteran, and the founder and CEO of Equalizer Private Investigations & Security Services Inc., a licensed agency in New York and Florida,
con international projection. Since 1999, he has led investigations in drug cases, homicides, and missing persons, in addition to participating in criminal defense at both state and federal levels. A specialist in international and multijurisdictional cases, he has coordinated operations in North America, Europe, and Latin America and is the author of the book The Blue Mafia Criminals with a Badge
Comments