The police operation against the Car Wash hackers, explained

. Jul 24, 2019
spoofing car wash the intercept

Since early June, news website The Intercept has published a series of private messages between the two main figures of Operation Car Wash: federal judge (now Justice Minister) Sergio Moro and lead prosecutor Deltan Dallagnol. The conversations showed a relationship between prosecution and judge that is far closer than Brazilian laws allow. 

Judges are supposed to be neutral umpires, but Mr. Moro appears on multiple occasions to be quarterbacking the prosecution’s work, counseling on how to present evidence and giving tips on witnesses who would be damning to defendants.


the leaks first emerged, both Mr. Moro and Mr. Dallagnol rushed to claim they are products of criminal misconduct. They claim to have had their cell phones hacked and their messages—exchanged through the Russian messaging app Telegram—stolen. Mr. Moro has also tried to cast doubt as to the authenticity of the messages. <em>The Intercept</em>, meanwhile, has continually refused to disclose any information regarding their source.</p> <p>Now, the Federal Police has arrested four men in the state of São Paulo suspected of being responsible for stealing the messages. The suspects were targeted by Operation Spoofing. Marshals named three of the four suspects: Walter Delgatti Netto, Gustavo Henrique Elias Santos and his wife, Suellen. They have been transferred to Brasília where they are currently giving depositions.</p> <p>Here we break down the main questions surrounding the case.</p> <h2><strong>How are the hacks supposed to have happened?</strong></h2> <p>In the leaked conversations, Mr. Moro, Mr. Dallagnol and other officials chatted through Telegram, which allows its users to access a browser version by providing an access code that can be delivered through an automated phone call. The police believe the suspects used a &#8220;Caller ID Spoofing&#8221; scam (hence the name of the operation) to access the chat logs through the browser version.</p> <p>Spoofing is a sort of identity theft—which doesn&#8217;t involve cracking any system. It consists of using a smartphone or computer connected to the telephone network and pretending to be a given number.&nbsp;</p> <p>Other public officials, including Economy Minister Paulo Guedes and Congressman Joice Hasselmann (the government&#8217;s whip in Congress) have reported <a href="">similar hacks on their phones</a>.</p> <h2><strong>What have the police found?</strong></h2> <p>While searching Mr. Santos’ apartment, police seized cell phones, a laptop, and BRL 100,000 in cash. Mr. Santos’ lawyer <a href="">said</a> that his client is a DJ and buys and sells bitcoin, which could explain the electronics and cash.</p> <p>Police also identified suspicious money transfers between two of the suspects. According to a report, they moved between themselves BRL 627,000 between March and June—an amount much larger than their monthly income, of BRL 2,800 and BRL 2,100, respectively.</p> <p>“Based on the drastic difference between the financial transactions and their monthly income… it will be necessary to track the money they received,” said Judge Vallisney de Oliveira, who is overseeing Operation Spoofing.</p> <p>Police also said that there is strong evidence that the suspects participated in organized crime and colluded to hack the authorities.</p> <p>Mr. Santos’ lawyer, Ariovaldo Moreira, confirmed that his client had access to Mr. Moro’s private conversations. He explained that Mr. Netto showed the leaks to Mr. Santos two months ago, but insists that Mr. Netto is also not in the center of any hacking scheme.</p> <p>“[Mr. Santos] told me he wasn’t involved with the hacks. He told me he saw the messages on [Mr. Netto’s] computer, but warned [Mr. Netto] that keeping those messages was dangerous,” said Mr. Moreira.</p> <h2><strong>Conservatives v. The Intercept</strong></h2> <p>Despite going after the hackers allegedly behind <em>The Intercept’s </em>information, police have confirmed that they are not currently investigating Glenn Greenwald, one of the reporters who published the leaks.</p> <p>Police declared that they will begin investigating a potential cyber attack against Economy Minister Paulo Guedes, who recently reported being hacked on June 22.</p> <hr class="wp-block-separator"/> <p><em><strong>Correction:</strong> A previous version of this article said that two of the suspects had moved between themselves BRL 627 million, instead of BRL 627,000. This information has been corrected. </em> 

Martha Castro

Martha Castro worked as an intern at The Brazilian Report in 2019. She is a Brazilian journalism and political science student at Northwestern University in Evanston, Illinois.

Our content is protected by copyright. Want to republish The Brazilian Report? Email us at