From Operation Condor to Pegasus – A History of Latin American Surveillance

In October 2024, Colombia’s President Gustavo Petro revealed that 11 million US dollars in cash had been flown out of Bogotá in 2021 to pay for Israeli spyware. This modern surveillance architecture echoes the secret networks of Operation Condor, which once linked intelligence regimes across South America. Just as in that Cold War era, the procurement involved foreign funding and a president who claimed total ignorance of the transaction.

Legacy of the Hagelin Compromise in South America

In 1970, Boris Hagelin sold Crypto AG to West Germany’s foreign intelligence service, the BND. Shortly afterwards, the United States Central Intelligence Agency bought a covert share of the company. To the regimes that purchased its cipher machines (devices that scramble messages into code so only the holder of the matching key can read them), Crypto AG still presented itself as a neutral Swiss manufacturer.

The buyers, by the mid-1970s, included the military governments of Argentina, Chile, Uruguay, Paraguay and Bolivia.

On 28 November 1975, intelligence officers from those five regimes signed a document in Santiago titled the ‘Closing Statement of the First Inter-American Meeting of National Intelligence‘. That text formally founded Operation Condor. A facsimile of the signed Acta de Clausura now sits inside the National Security Archive’s Chile Documentation file.

Then came a CIA cable dated 25 June 1976. It described the creation of a ‘computerised data bank’ designed to centralise intelligence registries across the Condor regimes.

A second cable, dated 12 August 1976, set out Brazil’s role inside the cooperative arrangement and discussed the dedicated Condor communications channel.

The hardware feeding that channel arrived from inside the network. In February 1977, CIA agents reported that the Brazilian military had supplied Hagelin CX52 machines to the Condor states. Later that year, the United States Defense Intelligence Agency noted that Argentina had handed over Hagelin Crypto H-4605 teletype equipment for the same circuit.

Both models were already inside the product line that the CIA and BND were quietly reading at source.

On 20 October 1978, United States Ambassador to Paraguay Robert White sent a report describing how Condor intelligence chiefs kept in contact through United States communications infrastructure. Our research pack identifies that infrastructure as the United States installation in the Panama Canal Zone. The cable excerpt available to us does not specify whether American operators decoded the traffic or simply routed it onwards.

That question has been live in the public file for forty-eight years.

Evolution of State Surveillance Infrastructure

By the time the Cold War surveillance networks had been formally dismantled, Colombia had a single lawful interception system called Esperanza, run by the Attorney General’s Office and supported by the United States Drug Enforcement Administration. Esperanza required a judicial warrant (a written order signed by a judge giving police formal legal permission to carry out a specific wiretap) for each target. That paperwork created friction.

In September 2005, Colombia’s Police Intelligence Directorate, known as DIPOL, began building a parallel platform called the Integrated Recording System using technology from the Israeli firm Verint Systems. By 2007, the police investigation unit DIJIN had set up its own equivalent, named PUMA, plugged directly into the backbone of Colombia’s telecommunications network.

Both new systems sat outside the warrant pipeline that governed Esperanza.

Privacy International’s 2017 ‘Shadow State’ report puts the collection capacity of the DIPOL Integrated Recording System at roughly 100 million call data records per day. That figure has never been confirmed by the Colombian government. Nor has it been formally denied.

Then came February 2009.

On 21 February, the Colombian newspaper El Espectador exposed the ‘chuzadas’ wiretapping scandal, revealing that the Administrative Department of Security (DAS) had illegally surveilled over 600 public figures using Esperanza. Among those public figures sat Supreme Court justices, opposition politicians and journalists.

Institutional response landed on DAS alone.

President Juan Manuel Santos dissolved the Administrative Department of Security through Decree 4179 of 3 November 2011. Decree 4179 did not touch DIPOL’s Integrated Recording System or DIJIN’s PUMA, both of which had already been operational for years.

Surveillance Technology and the Pegasus Deployment

On 22 October 2024, President Gustavo Petro held a press conference and stated that two private jets had carried 11 million US dollars in cash out of El Dorado International Airport in 2021. According to Petro, one flight left Bogotá on 26 June 2021 with 5.5 million US dollars on board. A second left on 18 September 2021 carrying an identical sum.

Petro named the destination as Tel Aviv and the recipient as the Israeli firm NSO Group, maker of the Pegasus spyware. Pegasus, in turn, runs through a ‘zero-click’ exploit (a method that infects a phone without the user clicking anything, usually delivered through a hidden message that triggers the install on arrival).

Petro’s statement gave the tail numbers M-ABGG and T7CPX, and the wire reporting that followed carried them forward. Neither shows up in the raw cable or court material available to us.

What is documented is the timing. Colombia’s National Police intelligence directorate, DIPOL, acquired and deployed Pegasus during the same months that mass protests were spreading across the country. Forensic analysis under the Pegasus Project investigation has subsequently shown that the spyware was used against journalists and opposition figures in several countries.

Petro went further. He alleged the cash was laundered money, possibly siphoned from drug-cartel seizures, and said NSO’s chief executive sat in the room when it changed hands. Washington tells the opposite story. White House officials confirmed in November 2024 that the cash came from authorised United States anti-narcotics assistance.

NSO supplies a buyer contract that permits use of Pegasus only for counter-terrorism and serious crime.

That permission did not match the operational record.

The most unusual feature of the 2021 procurement is the absent name at the top of it. Colombia’s sitting president, Iván Duque, has been confirmed through subsequent White House and ambassadorial statements to have had no knowledge of the purchase.

By the time the matter became public in October 2024, Pegasus had been operating inside Colombia for more than three years.

Divergent Accounts of Pegasus Funding

Two governments have given two completely different accounts of where the cash came from.

Petro spoke first. His October 2024 press conference framed the 11 million dollars as criminal cash, laundered through international channels and possibly siphoned from drug-cartel seizures. On Bogotá’s account, the 2021 procurement sits outside Colombia’s lawful budgetary process.

Washington answered the following month. White House officials said the funding had come from authorised anti-narcotics assistance, with the spending correctly logged on their side of the border.

Three years after the cash departed, neither side has produced a single document naming the federal agency that handed it over.

Regulatory Shifts in Argentine Intelligence

In Argentina, the friction comes from a different direction. National Intelligence Law 25.520 requires a judge’s signature before any state agency can gather intelligence on a citizen. That requirement was built specifically to prevent the political profiling that defined the dictatorship years.

Resolution 144/2020 hit the Boletín Oficial on 2 June 2020. Argentina’s Ministry of Security used it to authorise federal forces to carry out what they called ‘ciberpatrullaje’ (cyber patrolling) across open digital sources, including public social media accounts.

We knew it was near the end of May 2020, the Boletín Oficial’s stamp reads 2 June.

Relabelled as crime prevention rather than intelligence work, the activity now sat outside Law 25.520 entirely. On paper, the shift looked purely semantic. In operational reality, an algorithmic monitoring tool sitting inside the federal police could now run on civilian profiles without a judge signing anything.

Five years later, the decree itself arrived.

Decree 383/2025 appeared in the Boletín Oficial on 17 June 2025. It permits warrantless cyber patrolling and authorises identity-verification detentions of up to ten hours. A separate clause in the same decree bans profiling by political opinion or race. No enforcement language sits alongside that ban.

What ‘open source’ means in operational practice, and what ten hours of identity verification looks like at a police station, has yet to be reported in any public Argentine court filing.

Architecture of State Surveillance Networks

Two structural features carry across both eras.

In each case, the technical architecture came from outside the deploying state. Hagelin cipher machines arrived from Switzerland (where the brand was registered) via Brazil and Argentina in the 1970s. Verint Systems hardware and NSO Group spyware arrived from Israel from 2005 onwards.

End users never controlled the build of the platforms they were buying.

Across both eras, the elected executive lost sight of the operational reality. The Condor states believed they were transmitting through a neutral Swiss cipher; the records show their traffic was readable at source by Washington and Bonn. President Duque believed Colombian state procurement ran through his desk; an 11 million US dollar transaction completed without his signature.

No item in the documentary record proves that any supplier state or contractor intends the eventual diversion of these tools against political opponents. Crypto AG’s full project file remains classified above the level at which most cables cited in this investigation were declassified.

What we see in both eras is a structural pattern, not a directed one. Where the boundary of that finding sits, and what would push past it, is the subject of the next section.

Source

Sources include: declassified Central Intelligence Agency cables regarding the Condortel network (1976 to 1978); official statutory records from the ‘Boletín Oficial de la República Argentina’ (Decreto 383/2025 and Resolución 144/2020); civil society technical investigations from Privacy International including ‘Shadow State’ (2017); and public statements from the White House and Colombian President Gustavo Petro regarding the 2021 Pegasus spyware procurement.