Blue Wave: How Israel, Washington and a Guernsey Shell Company Stole Colombia’s Election

Freddie Ponton
21st Century Wire

On the night of June 21, 2026, as Colombia’s preliminary vote count rolled in showing far-right candidate Abelardo De La Espriella ahead of left-wing Iván Cepeda by less than one percentage point, the narrowest margin in any Colombian presidential runoff in recorded history, something happened that most international outlets buried under boilerplate electoral procedure. Colombia’s outgoing President Gustavo Petro went on the record, in public, with a specific technical claim concerning IP addresses of multiple servers belonging to Colombia’s National Registry, which he maintained had been changed mid-count. He accused external actors of having used that access to write results directly into polling station fields and named the entity he holds responsible. Not a rogue hacker. Not Russia. Not a domestic cartel, but the State of Israel.

IMAGE: Colombian President Gustavo Petro speaks during a press conference after casting his vote in congressional elections and party primaries for presidential candidate, in Bogota, Colombia, March 8, 2026. (Source: by Luisa Gonzalez/Reuters)

That accusation was processed by the global press as a conspiracy theory, a sore loser’s cry, an embarrassing parting shot from a leftist president on his way out the door. Reuters filed it under “Petro refuses to accept results.” El Colombiano ran the headline: “Petro, without arguments.” The story was managed, packaged, and shelved within 48 hours, precisely as AcidReport had documented that the three industrial conglomerates owning 57 percent of Colombia’s cross-media audience would inevitably do. Three conglomerates whose balance sheets depend on the stability of the financial and legal order that a De La Espriella government will now protect.

This article is not primarily about whether Petro can prove what happened to those servers on election night. That evidence is currently before the judges overseeing Colombia’s official judicial count. This article is about what does not require a single server log to demonstrate the documented, paper-trailed, government-confirmed infrastructure that Israel has built inside Colombia’s state apparatus over two decades; the pre-negotiated agreement struck in Buenos Aires six months before the election between the Israeli Foreign Minister and the winning candidate; the three coordinated disinformation operations that Colombia’s own financial intelligence unit confirmed on the record at a Cabinet meeting four days before the vote; the leaked audio vault of a convicted narco-trafficker, pardoned by Donald Trump, describing how Israel funded his release and how files were being prepared against Colombia; and the letter signed by 11 US members of Congress warning of brazen foreign interference that Rubio, Bessent, and the acting Attorney General never answered. The infrastructure was already there. The phone call on election night, if it happened, was optional.

KEY FINDINGS

1. The vote-counting machine is a Guernsey shell company. Thomas Greg & Sons, registered in a British Crown tax haven with no beneficial ownership disclosure requirements, has held uncontested control of Colombia’s electoral logistics chain since 2010. For 2026, it was awarded a $526 million contract with no competing bid. A Colombian court ordered its software replaced in 2018 after finding it “permeable from the outside and permeable from the inside.” The order was never complied with.

2. Juan Manuel Santos sat on the board of the company that counted the votes. The same man who flew to Tel Aviv in 2007 to sign Colombia’s foundational military dependency on Israel, 24 Kfir fighter jets, $333 million, AIPAC lobbying included,  sat on the TGS board from 2002 to 2006. He is the documented bridge between Colombia’s Israeli military infrastructure and its electoral machinery.

3. $11 million in cash flew from Bogotá to Tel Aviv on two private jets in 2021. Colombia’s police intelligence directorate DIPOL paid NSO Group for its Pegasus spyware in physical cash. Four named NSO executives collected the payments on documented flight numbers at a military hangar. The transaction was discovered not by Colombia but by Israel’s own banking system. US officials subsequently confirmed to Colombia’s ambassador that Washington provided the $11 million and maintained oversight of targeting.

4. Two sitting cabinet ministers confirmed their phones were actively hacked by Pegasus in December 2025 and January 2026, six months before the election, with forensic authentication. 2.3 gigabytes of government data were extracted from the Justice Minister’s device. The Attorney General has not requested their technical evidence.

5. Israel’s Foreign Minister flew to Buenos Aires in November 2025 to pre-negotiate the result. Seven months before the vote, Gideon Sa’ar met Abelardo De La Espriella and secured twelve specific policy commitments: embassy to Jerusalem, diplomatic relations restored, Pegasus reactivated, Kfir maintenance resumed, Hamas and Hezbollah designated, UN votes reversed, Colombia enrolled as Isaac Accords Phase 2. These are not campaign promises. They are a documented pre-agreed handover.

6. Colombia’s own financial intelligence unit confirmed three coordinated disinformation operations at Cabinet level, four days before the vote. Operación Ajax, Proyecto Júpiter, and HondurasGate were active simultaneously, coordinated, and aimed at the same target. This testimony came from the UIAF director under oath, not from Petro.

7. A forensically authenticated audio vault of 37 recordings verified by Phonexia Voice Inspector, identifies the voice of convicted narco-trafficker and Trump-pardoned former Honduran president Juan Orlando Hernández stating: “The pardon money didn’t come from you. It came from a board of rabbis and people who supported Israel” and “Netanyahu had everything to do with my release.” Roger Stone is identified as the Washington operative who organised the pardon meetings.

8. Eleven US members of Congress signed a formal letter to Rubio, Bessent, and Acting AG Blanche citing 14 Florida shell companies, FEC-flagged donations, ICC paramilitary charges, and “shameless interference of senior US officials” in Colombia’s election. Rubio called De La Espriella to congratulate him on election night. He never answered the letter.

9. A March 2026 Israeli government cybersecurity delegation, seven firms, coordinated by Israel’s Ministry of Economy, met Colombian “decision-makers” 90 days before the election. Israel’s national cyber chief had already mapped Colombia’s critical digital infrastructure inside the Defence Ministry in May 2021.

10. The result is formally contested. De La Espriella is president-elect by unofficial preliminary count only. Cepeda’s legal team has filed 57,189 formal challenges, more than one in four polling stations. The certified vote counting process (escrutinio) is not complete. His inauguration is scheduled for August 7, 2026.

The Machine That Counts

Before anything else, understand who runs Colombia’s elections, because this is where the story actually starts.

A company called Thomas Greg & Sons, registered not in Bogotá but in Guernsey, a British Crown dependency in the English Channel that levies zero corporate tax, maintains strict financial secrecy, and has no obligation to disclose beneficial ownership, has held effective control over the full Colombian electoral logistics chain since 2010. For the 2026 elections, TGS led a consortium awarded a contract worth 2.1 trillion Colombian pesos, roughly $526 million, to manage ballot printing, voting materials, the preliminary vote-counting software, the Divipol electoral census database, and the hardware on which mesa results are uploaded.

IMAGE: Aerial view of St Peter Port, capital of Guernsey, Channel Islands, cruise ship at anchor (Source: Via Getty Images)

There was only one bid submitted. The company that owns the counting machine did not face a competitor. TGS is owned by three brothers, namely, Felipe, Camilo, and Fernando Bautista, who are the heirs of founder Gregorio Bautista. In the late 1980s, Fernando and Camilo Bautista pleaded guilty in US federal court to defrauding more than 25 American banks through fictitious Colombian coffee export shipments totalling over $105 million. They served prison time in the United States. They returned to Colombia and proceeded to win the contracts that gave them control of the country’s passport system, national ID infrastructure, and electoral machinery. They are currently facing separate fraud charges in Mexico in relation to TGS operations there. And according to Petro, who gave specific timestamps, the brothers allegedly met with De La Espriella before the election to discuss the return of their passport contract, stripped from them under Petro’s government, in exchange for algorithmic manipulation of results.

Then look at the board. Former President Juan Manuel Santos, Nobel Peace Prize laureate, Álvaro Uribe’s Defence Minister, the man who in 2007 personally flew to Tel Aviv and signed the contract for 24 Kfir C10/C12 fighter jets with Israeli Defence Minister Ehud Barak and Prime Minister Ehud Olmert, while simultaneously using that arms deal to secure AIPAC lobbying support for Colombia’s pending Free Trade Agreement with the United States, and who personally invited retired Major General Yisrael Ziv, his “personal acquaintance”, to embed Israeli intelligence advisors inside the Colombian armed forces, directing 38% of Colombia’s entire foreign defence budget ($333 million) to Israel in 2007 alone—that man sat on the TGS board from 2002 to 2006. Former President Andrés Pastrana sat on it from 2011 to 2013. Former Foreign Minister and presidential candidate Noemí Sanín is currently on it. Former Ambassador to Venezuela Ricardo Lozano is on it. British Conservative ex-MP Charles Goodson-Wickes rounds out the international wing.

IMAGE: Former President of Colombia JUAN MANUEL SANTOS (Source: Colombian President’s Office)

Let that sink in for a moment. The man who personally signed Colombia’s foundational military dependency on Israel in Tel Aviv, who then helped build the Colombia-Israel Free Trade Agreement, who embedded Israeli military intelligence inside Colombian armed forces as a personal favour, that man sat on the board of the private offshore company that owns the software used to count the votes. Such knowledge forces us to see Santos, not as a footnote across two separate threads of this story, but as the bridge between them.

The Colombian Council of State figured out the problem with that software in 2018. After four years of investigation, magistrate Lucy Jeanette Bermúdez issued a ruling finding that the TGS electoral counting software was, in her exact words, permeable from the outside and permeable from the inside, and ordered it replaced with state-owned open-source software. That order was never complied with. The same proprietary TGS system ran the 2022 elections and the 2026 elections. Petro repeatedly demanded that Registrar Hernán Penagos hand over the source code for an independent expert audit before the vote. Penagos permanently refused.

The BGP/AS network record for Thomas Greg & Sons lists its legal domicile in Guernsey while its operational address sits in Bogotá. This offshore corporate architecture means TGS pays no Colombian corporate taxes on its billion-peso state contracts, its beneficial ownership and financial flows are shielded from Colombian transparency law, and there is no Colombian judicial mechanism to compel disclosure of its internal server communications or election-night logs. The machine that counts Colombia’s votes is owned by a tax haven shell run by convicted US bank fraudsters, with two ex-presidents on its board, operating a software system that a Colombian court already declared compromised and ordered replaced eight years ago.

Abelardo De La Espriella — Who He Actually Is

Understanding the candidate whom the media presents as the man who won this election requires going further back than his campaign, and further abroad than Bogotá. His father, Senator Miguel de la Espriella, signed the Pact of Ralito in 2001, the secret agreement between AUC paramilitary commanders and Colombian politicians committing to, in the document’s own language, “refound Colombia.” For this, the Inspector General subsequently barred him from holding public office for 20 years. Abelardo worked as a defence lawyer for AUC commanders during demobilisation proceedings, ran a foundation called FIPAZ that Cepeda documented received and disbursed AUC funds, and has minority shareholders in his rum, wine, and real estate businesses who include relatives of AUC commander Hugo Rodríguez Fuentes, known operationally as Comandante Barbie.

Cepeda filed criminal charges with Colombia’s Attorney General and with the International Criminal Court, accusing De La Espriella of being not merely a lawyer for the paramilitary structure but a direct operative of it.

IMAGE: Colombia’s opposition frontrunner Abelardo De La Espriella at an event in Bogotá in December 2025 (Source: Courtesy of Abelardo De La Espriella’s campaign)

Abelardo De La Espriella is also an American citizen. He was naturalised as a US national in 2023, after more than a decade living and practising law in Miami. The man who has just been declared Colombia’s president-elect holds the passport of the foreign power whose president personally called to congratulate him on election night. His campaign donated nearly $100,000 to Republican Congresswoman María Elvira Salazar, whose Florida district covers property De La Espriella and his wife have owned since at least 2014, a sum that exceeded legal limits and triggered flags from the Federal Election Commission.

Earlier this year, he attended the “Shield of the Americas” summit on March 7 at Trump National Doral, the same invitation-only event at which Secretary of State Marco Rubio served as co-host and keynote speaker, delivering remarks at the working lunch and personally hosting an evening reception for attendees. Colombia under Petro was pointedly excluded from the 12-nation guest list. De La Espriella photographed himself with Congresswoman Salazar and US Deputy Secretary of State Christopher Landau and posted to social media: “Fully restoring relations with the United States is fundamental for the future of our country.” Six weeks later, Rubio did not respond to 11 US Congress members’ letter asking him to investigate De La Espriella’s finances. On the same evening, the State Department published a formal readout confirming that Rubio personally called De La Espriella to congratulate him on his “electoral victory”, describing it as reflecting “the will of the Colombian people”, even though the vote counting process (escrutinio) had not yet begun and 57,189 mesas remained formally contested.

In May 2026, five weeks before the runoff, investigative journalist Daniel Coronell published “Los giros de Alex Saab” in Revista Cambio (Paywall), the results of his examination of a closed civil case in a US federal court in Florida. He found more than $370,000 in transfers made in 2014 from Hong Kong-registered companies Group Grand Limited and Consorcio Estructuras Metálicas, both flagged in international investigations for links to Alex Saab, Maduro’s convicted money laundering operative, to trust accounts administered by Miami attorney Timothy Richards, with paperwork bearing De La Espriella’s own signature, part of which was applied toward the purchase of a Miami apartment. The central letter, dated May 1, 2014, shows De La Espriella confirming he ordered three transfers totalling $374,850, with a handwritten note distributing $100,000 toward the apartment and the rest to a Rafael Mora.

Colombia’s Supreme Court had in fact already ordered a money laundering investigation of De La Espriella in 2014, two years before the Saab transfers, after testimony that he allegedly received narco proceeds to facilitate paramilitary commander “Tuso Sierra”‘s entry into the Justice and Peace process. That investigation was archived without charges

On April 29, 2015, Saab forwarded De La Espriella an email confirming two payments with an attached SWIFT confirmation for $200,000 routed under the concept “International Tax Advisory”, a description that contradicts the actual use of the funds. Coronell approached De La Espriella for comment. He received no response.

On June 16, 2026, five days before the election, Congressman Jesús “Chuy” García led 11 US Democratic members of Congress in signing a formal letter to Secretary of State Marco Rubio, Treasury Secretary Scott Bessent, and Acting Attorney General Todd Blanche. The letter cited 14 Florida shell companies and multiple real estate transactions with unexplained funding sources, called for a Department of Justice investigation, documented the FEC-flagged donation history with Salazar, raised the paramilitary charges Cepeda had brought before the ICC, and expressed, in their exact words, “grave concern about the shameless  interference of senior US officials, including the President, in another country’s presidential election.”

DOCUMENT: U.S. CSO Statement Denouncing U.S. Interference in Colombian Elections – June 17, 2026 (Source: Latin America Working Group)
CSO-Letter-Denouncing-US-Interference

Salazar’s own FEC record shows she accepted thousands of dollars in flagged contributions from a Maduro-connected attorney, the same attorney she was now helping elect a president on the basis of his anti-Maduro credentials.

On the same day the García letter landed on his desk, Secretary of State Marco Rubio personally signed a memorandum, obtained and published by the New York Times,  invoking a rarely-used 1952 immigration clause (INA 212(a)(3)(C)), to declare Colombian activist Beto Coral (Franklin Humberto Coral Garrido) a threat to US foreign policy interests. Rubio wrote that Coral had “used his time in the United States to carry out political activities in support of the Petro government” and that his presence “undermines US foreign policy interests in Colombia’s democratic processes.” ICE agents arrested Coral the same afternoon in Phoenix, Arizona, as he walked home with his 12-year-old son, despite Coral holding a valid federal work permit through 2028 and a pending asylum application filed in 2016. Hours before the arrest became public, De La Espriella posted on social media: “There will be good news for Colombia and for patriotic Colombians abroad. Dura lex, sed lex… Coming soon.” He has not publicly commented on the arrest. Rubio did not respond to the García letter

The Blue Wave Was Engineered

Call it what it is. The international right-wing coordination that congratulated De La Espriella within minutes of the preliminary result was not spontaneous. It was the visible surface of a project that had been running for at least two years, confirmed by Colombia’s own financial intelligence apparatus, captured on authenticated audio, and documented by multiple independent investigators before a single vote was counted on June 21.

Start in Jerusalem, April 19, 2026. Israeli Prime Minister Benjamin Netanyahu and Argentine President Javier Milei signed what they called the Isaac Accords, a formal bilateral framework for counterterrorism cooperation, AI partnership, and direct El Al flights between Buenos Aires and Tel Aviv. US Ambassador to Israel Mike Huckabee was present.

IMAGE: Signing of the Isaac Accords (Source: GPO/Kobi Gideon)

READ MORE: The Rise of the Isaac Accords: How Israel is Redrawing South America’s Political Landscape

Genesis Prize Foundation co-founder Stan Polovets stood at the signing. The full joint declaration is a PDF on the Israeli government’s official website, available to anyone. The text frames the entire project as uniting “nations of the Judeo-Christian tradition, in defense of freedom and democracy, and in the fight against terrorism, antisemitism, and drug trafficking.” That is the verbatim language from the declaration that Netanyahu and Milei signed. It maps exactly onto the rhetoric De La Espriella had been using in Colombia for months—joint US-Israeli military strikes on “narco-terrorist camps,” Israel as security partner, and Evangelical Christian Zionism as ideological glue. This was coordinated messaging.

The American Friends of Isaac Accords, incorporated in New York in August 2025 and trademarked with the USPTO the same month, was seeded with Milei’s $1 million Genesis Prize award redirected into its operating fund. Its managing director for Latin America is former US Ambassador to Costa Rica S. Fitzgerald “Fitz” Haney. In an October 2025 interview, Haney described how the operation measures success: UN votes shifting to greater support for Israel, embassy relocations to Jerusalem, and official designation of Hamas and Hezbollah as terrorist organisations by Latin American governments. These are precisely the three commitments De La Espriella made publicly and repeatedly during his campaign. AFOIA’s funding partners include Israel Allies Foundation, which mobilises pro-Israel legislators; The Philos Project, which builds Evangelical and Christian faith-based outreach; and StandWithUs, which engages students and grassroots networks.

IMAGE: The Congressional Israel Allies Caucus’s annual celebration of Jerusalem Day in Washington, D.C., June 4, 2025 (Source: Courtesy of the Congressional Israel Allies Caucus)

Colombia Justa Libres, the Evangelical Christian Zionist party that is De La Espriella’s primary coalition partner, is the exact demographic pipeline every one of those organisations targets. The money that seeded AFOIA traces back through the Genesis Prize Foundation, co-founded by Russian oligarchs Mikhail Fridman, Pyotr Aven, and German Khan. All three were subsequently sanctioned by the EU, UK, and Canada for their alleged ties to Vladimir Putin. They stepped down from the Genesis board in March 2022 under sanctions pressure. The funding infrastructure they built did not step down with them.

IMAGE: A far-right surge in Colombia: Colombia’s presidential candidate Abelardo de la Espriella, of the Defensores de la Patria party, speaks behind bulletproof glass during his closing campaign rally in Medellin, Colombia (Source: via Getty Images |Newarab)

There is something worth sitting with here: a project nominally about democracy promotion in Latin America was seeded by sanctioned Putin-linked oligarchs via an Israeli prize foundation via an Argentine president and a former US Ambassador, and the Western press found nothing in this worth a paragraph.

IMAGE: CAM Director of Hispanic Affairs Shay Salamon addresses the “Colombia Bless Israel” event, in Bogotá, July 14, 2024 (Source: combatantisemitism.org)

Colombia is formally named as a Phase 2 expansion target in AFOIA’s publicly available documents, with the organisation explicitly stating expansion would depend on “political developments” in each country. Haney said Phase 2 success means “political alignment”, getting the right government in office. Nine months later, the right government appears to be in office.

Four days before the vote, Colombia’s own financial intelligence unit, the UIAF, brought three interconnected covert operations to the Cabinet table. Director Wilmar de Jesús Mejía testified under oath that all three were active, coordinated, and aimed at the same target. This was not Petro speaking, but the state’s own money-tracking apparatus, at a Cabinet council meeting on June 17, 2026:

Operación Ajax ran from 2023 until January 2026, attacked Petro, Vice President Francia Márquez, and senior officials simultaneously in the United States, Colombia, Panama, Spain, and Italy, operated through a website called Petrolix, and was financed through triangulated flows from Colombian businesses with mirror operations in the US, structured to use US legal jurisdiction to avoid Colombian transparency law. Petro delivered the evidence file to the Attorney General, who confirmed a criminal complaint had been filed.

Proyecto Júpiter was designed by the political strategist who brought Álvaro Uribe to power in 2002, ran on a budget of approximately $2 million, trained 40,000 people in corporate workshops structured to generate fear and hatred of the Petro government, and seeded 1,730 individual pieces of disinformation content across TikTok and Meta platforms, reaching an estimated 17 million Colombians in the final months of the campaign.

HondurasGate is the international coordination layer, and it is where the audio vault comes in. Canal Red América Latina and Diario Red América Latina have published the complete vault of 37 audio recordings along with the forensic analysis conducted using the Phonexia Voice Inspector programme, at hondurasgate.com, publicly accessible to any reader who wants to verify the source material. The voice identified forensically as former Honduran President Juan Orlando Hernández, convicted in the United States to 45 years for narco-trafficking and cocaine distribution, and subsequently pardoned by Donald Trump, is heard in multiple recordings.

READ MORE: HONDURAS: The Dirty U.S.-Israeli Deal Behind Juan Orlando Hernández’s Return

In the recording that goes most directly to the question of who funded the pardon: “El dinero del indulto ni siquiera salió de ustedes. Salió de una junta de rabinos, y de una gente que apoyaba a Israel.” The pardon money didn’t even come from you. It came from a board of rabbis and people who supported Israel. On Netanyahu’s direct involvement:  [“Netanyahu] nos va a dar su apoyo. Tuvieron todo que ver con mi salida y las negociaciones. Netanyahu is going to give us support. They had everything to do with my release and the negotiations.

On the Colombia operation specifically: “La idea es crear unos expedientes contra Colombia y México”, the idea is to create files against Colombia and Mexico, through a digital media outlet to be based in Washington.

One recording features a voice identified as CNE electoral official Cosette López-Osorio referring to opposition figure Marlon Ochoa with the phrase: “Primero: cárcel o muerte.” Prison or death, first, and subsequently offering $110,000 of her own money to fund his congressional impeachment.

Roger Stone is identified in the forensic audio analysis as the Republican operative responsible for organising the key Washington meetings that secured the Trump pardon of a man serving 45 years for drug trafficking, a role Stone himself had publicly acknowledged lobbying for since 2024.

Colombia’s UIAF confirmed these operations at Cabinet level. Petro named the same network publicly the same week. The audio vault is publicly available. Four days later, the election supposedly went to De La Espriella.

Two Decades of Embedded State Infrastructure

Petro’s accusation on election night was not the beginning of Colombia’s relationship with Israeli intelligence. In fact, it was the terminus of a very long line.

Under President Álvaro Uribe, from 2002 to 2010, Israel became Colombia’s primary security partner. The foundational weapons transaction came in 2007, when Santos, then Uribe’s Defence Minister, flew to Tel Aviv and personally signed the contract for 24 Kfir C10/C12 fighter jets built by Israel Aerospace Industries with Ehud Barak and Ehud Olmert. The first thirteen were delivered in 2009 at a ceremony in IAI’s hangars at Tel Aviv’s Ben Gurion airport. The deal was structured partly to secure AIPAC lobbying support for Colombia’s pending US Free Trade Agreement, a three-way financial relationship between the Israeli defence industry, the US Congress lobby, and Colombian state contracts, closed in a single handshake in Tel Aviv.

IMAGE: Netanyahu walks with Colombia’s then-president, Juan Manuel Santos, in Bogota in 2017 (Source: AFP)

Additionally, WikiLeaks cables reveal that Santos personally invited retired Major General Yisrael Ziv, described in the cables as his “personal acquaintance”, to embed Israeli intelligence advisors inside the Colombian armed forces for high-value-target operations against the FARC, directing approximately 38% of Colombia’s entire foreign defence budget, an estimated $333 million, to Israel in 2007 alone. By contract terms, IAI is the sole authorised maintenance provider for the Kfir fleet, creating a structural military dependency on Israel that persists regardless of which government is in power.

Colombia did not stop with fighter jets. Rafael Spike anti-tank missiles were procured for the Black Hawk helicopter fleet. Python air-to-air missiles went onto the Kfir aircraft. INDUMIL, Colombia’s state arms manufacturer, produces the Galil SAR assault rifle under a perpetual, irrevocable licence from Israeli Military Industries. And on December 30, 2022, during Petro’s own presidency, while diplomatic relations were deteriorating, the Colombian Air Force signed a $131.2 million contract with IAI for two batteries of Barak MX anti-aircraft defence systems. As of June 21, 2026, election day itself, Colombia has begun the operational deployment of the first Barak MX battery. The armed forces signed that deal over Petro’s political objections. The system is arriving on schedule, greeted by a government that wanted it all along.

IMAGE: Colombian Air Force Kfir fighter jet in flight with landing gear down (Source: armyrecognition.com)

The full Israeli military footprint in Colombian service as of 2026: Kfir C10/C12 jet fighters, Barak MX air defence batteries, Galil SAR assault rifles produced domestically under perpetual licence, Spike anti-tank missiles, Python air-to-air missiles. Five separate Israeli weapons systems simultaneously embedded in Colombian armed forces. Petro could expel the diplomats. He could not expel the weapons. He could not cancel the maintenance contracts. He could not revoke the manufacturing licences.

A Mossad intelligence office was established inside the Colombian Defence Ministry during the Uribe years, normalised as routine bilateral security cooperation. The most recent documented instance of Mossad operational presence in Colombia came in November 2021, when three senior Mossad officials flew to Bogotá after discovering a Hezbollah assassination plot against a former Israeli intelligence operative running a surveillance camera business in the city.

Colombian Defence Minister Diego Molano confirmed the expulsion of two Hezbollah operatives as a result of that joint Mossad-Colombian military intelligence operation. This was not a theoretical relationship. Three senior Mossad officials on operational deployment in Bogotá, coordinating directly with Colombia’s Defence Ministry, eighteen months before Petro took office.

The digital infrastructure layer runs even deeper. In May 2021, the same month DIPOL began its cash payments to NSO Group, Israel’s National Information Security Agency chief Erez Kreiner and senior official Arik Biton attended a two-day cybersecurity seminar in Bogotá co-chaired by Colombian Deputy Defence Minister Jorge Enrique Bedoya. The topics on the table: identification, classification, and protection of Colombia’s critical digital infrastructure, telecommunications, banking, and finance. Israel’s national cyber chief was inside Colombia’s Defence Ministry mapping critical digital infrastructure in the same month DIPOL was handing over cash to NSO Group representatives in Tel Aviv.

Then, in March 2026, three months before the election, the Israel Export Institute, coordinated with Israel’s Foreign Trade Administration under the Ministry of Economy and Industry, sent a formal delegation of seven Israeli cybersecurity companies to Colombia for three days of meetings with Colombian “industry leaders and decision-makers.” The Israeli Export Institute documented this publicly on its own LinkedIn page, naming the companies and the officials involved. Seven Israeli cybersecurity firms, coordinated by a government trade ministry, meeting Colombian decision-makers 90 days before the election.

GRAPHIC 1 — BLUE WAVE COLOMBIA: KEY NETWORK MAP

What you are looking at: A four-cluster network map documenting every verified link between the Israeli state, its intelligence and defence apparatus, the international right-wing axis, and the Colombian political and military establishment. Blue edges trace Israeli state-to-entity ties, NSO Group, IAI, and the Isaac Accords all radiate from Jerusalem. Red edges map the political relationships: the November 2025 Sa’ar–De La Espriella pre-negotiation in Buenos Aires, the Uribista network underpinning the De La Espriella campaign, and the Christian Zionist doctrinal pipeline running through Colombia Justa Libres. Purple edges are the military and intelligence threads, the $11M DIPOL-NSO Pegasus cash purchase, the Kfir/IAI sole-maintenance dependency, the INDUMIL Galil perpetual licence, the Mossad office inside the Defence Ministry. Orange edges show the international coordination axis: Trump-Netanyahu, Milei’s Isaac Accords founding, and JOH Hernández’s HondurasGate role as regional fixer. The dashed purple lines are the three reactivations that follow automatically the moment De La Espriella is inaugurated: Pegasus back online through DIPOL, Kfir maintenance restored through IAI, Mossad channel reopened inside the Defence Ministry.

What it proves: Israel does not need to pick up a phone on election night. Every node on this map was built, funded, and maintained over two decades of Colombian state policy. It went dormant under Petro. The dashed lines show exactly what switches back on, and all of it was pre-negotiated in writing, in Buenos Aires, seven months before the election.

Eleven Million in Cash and the Officials Who Did It

In June and through September 2021, Colombia’s police intelligence directorate DIPOL paid $11 million in cash, physically bundled and flown from Bogotá to Tel Aviv aboard private jets, to NSO Group for its Pegasus spyware. The transaction was not a wire transfer. It was cash in a plane. And it was discovered not through Colombian oversight but through Israel’s own banking system: Bank Hapoalim, Israel’s largest bank, reported the $5.5 million cash deposit in NSO’s account to IMPA, Israel’s financial intelligence unit, which, through standard procedure, notified its Colombian counterpart, the UIAF.

Colombia’s own Attorney General investigation, confirmed by both the Colombian and Israeli financial intelligence units, identified four named NSO Group officials who personally collected the cash payments in Bogotá. On June 25–26, 2021, flight M-ABGG landed at the counternarcotics police hangar at El Dorado International Airport carrying Oded Gindi and Yehuda Lahav, NSO Group’s Business Director. They left with $5.5 million in cash. On September 17–18, 2021, flight T7CPX arrived from Tel Aviv carrying Moshe Sahar, a figure who had previously signed cyberdefence contracts with DIPOL as far back as 2013, and Ran Gonen, NSO Group’s Global Security Director, who collected the second $5.5 million.

IMAGE: Israeli cybersecurity firm NSO Group’s exhibition stand is seen at ISDEF 2019, an international defence and homeland security expo, in Tel Aviv, Israel, June 4, 2019 (Source: Keren Manor/Reuters)

Colombia’s migration authority independently confirmed that NSO executives travelled to Bogotá on private planes on both dates and that some listed their accommodation as the National Police Officers’ Club. These are named individuals, documented flight numbers, and confirmed locations. That is what happened.

A crucial development confirmed by Colombia Reports in April 2025: anonymous US Government officials told Colombia’s ambassador that Washington DC was responsible for financing the clandestine purchase, that the US gave DIPOL the $11 million to buy Pegasus, and that American intelligence officials maintained oversight of the targeting, supposedly limiting it to drug kingpins. “There was oversight by US authorities to supposedly ensure that it was only directed against these drug kingpins,” the ambassador reported, a framing that conveniently removes any accountability from both governments while confirming the entire transaction.

Colombia’s Attorney General, Luz Adriana Camargo, summoned the entire chain of command from the Duque police and defence structure for questioning: General (ret.) Jorge Luis Vargas, former Director General of the National Police; General Óscar Atehortúa, his predecessor; Víctor Manuel Muñoz, former director of the Administrative Department of the Presidency (DAPRE); General Jairo García Guerrero, former Deputy Defence Minister; and generals Juan Diego Sepúlveda and Carlos Iván Moreno. Their responses tell the story. Muñoz went on record with a denial worth quoting directly: “Neither President Duque nor the senior military and police command gave any instruction to purchase a platform like Pegasus.” That denial simultaneously confirms the purchase happened and that whoever authorised it acted covertly, leaving no official record.

When General Vargas finally appeared before prosecutors on November 7, 2024, he said nothing, invoking his right to silence. Camargo, meanwhile, confirmed to El Tiempo that she considers Pegasus “an instrument of war” and that the $11 million payment is fully documented, and sent a CTI forensic commission to Tel Aviv to collect evidence on-site. What she has not yet addressed publicly, but what Colombia’s own ambassador to Washington confirmed after an October 8, 2024 meeting at the Biden White House, is that the $11 million did not come from Colombian state coffers. It came from US intelligence cooperation funds, with American officials supervising which targets were selected. The spyware was US-funded, Israeli-executed, and aimed at a presidential candidate who is now the outgoing president, alleging that the same Israeli state apparatus manipulated the election that will determine his successor.

Colombia’s Defence Minister Iván Velásquez explicitly confirmed the authorisation was deliberately hidden, with no evidence in the official records.Petro alleges the system was used against his 2022 presidential campaign. In December 2025, six months before the election, Interior Minister Armando Benedetti confirmed his own phone had been actively hacked by Pegasus. The system was live. The operator had prior access to the political left’s communications. The $11 million in cash paid to Ran Gonen and Yehuda Lahav in 2021 bought more than surveillance capability. It brought intimate familiarity with the target architecture.

Is the IP Accusation Technically Possible — Yes

Petro’s specific claim is that IP addresses on multiple Registraduría servers were changed during the count, allowing external actors to overwrite the results into polling station data fields. The establishment press treated this as implausible on its face. It is not implausible. It is technically routine.

IMAGE: DNS is the internet’s phonebook, translating human-readable URLs into the IP addresses computers use to communicate, while DNS caching stores these translations in servers worldwide to keep lookups fast. When attackers corrupt that cache via DNS poisoning, every device querying the infected server is silently redirected to a malicious destination, leading users to believe they have reached the legitimate site. (Source: Varonis)

The attack vector Petro describes corresponds to well-documented cybersecurity categories. DNS hijacking involves gaining control of DNS server settings so that systems resolve domain queries to an attacker-controlled server rather than the legitimate one. DNS spoofing, or cache poisoning, injects forged records into a server’s DNS cache so that every system querying it receives the wrong IP address in response. Either attack, successfully executed against the Registraduría’s counting infrastructure during the period results were being uploaded from mesas to the central system, would allow result data to route through an attacker-controlled server before re-injection into the official system, with whatever modifications the attacker chose to apply.

What is not in dispute, because the Registrar confirmed it himself, is that Colombia’s electoral infrastructure faced cyberattacks of extraordinary and documented scale across both rounds of the 2026 elections. During the March legislative vote alone, Penagos confirmed between 100 and 300 million IP addresses attempting simultaneous access, requiring 5.2 million malicious IP blocks, at least 30 attempts to impersonate the official electoral website, and 60 coordinated internet profiles attempting to distort official results in real time, all confirmed in his own post-election statement. He simultaneously declared the entire process “absolutely efficient” and rejected all fraud allegations.

IMAGE: The National Registrar of Civil Status, Hernan Penagos, is responsible for organizing electoral processes in Colombia. (Source:: X: @Registraduria)

These are contradictory positions. The infrastructure was under a documented, massive, externally-sourced IP assault. Penagos said so. He then said nothing was wrong. Not one mainstream outlet asked him to reconcile the two statements. The question is why?

The IIDH/CAPEL pre-electoral audit delivered on May 29, 2026, two days before the first round, concluded that the source code “complied with established technical criteria” and that five reviewed components showed “no critical findings or medium or high residual risks.” This is being cited as proof of no manipulation. It is not. CAPEL audited the software design before the first round. Their own mandate explicitly stated the final technical verdict would be issued only once all electoral phases were complete, including post-election scrutiny. They did not conduct forensic analysis of live server behaviour on election night. They did not re-audit the second round software. And the same Infobae report that carries the CAPEL seal of approval also records Penagos admitting that “in recent elections they faced millions of cyberattack attempts and website impersonation cases”, simultaneously confirming the attack was real, sustained, and operating at scale.

The official rebuttal rests on the judges’ escrutinio confirming a 99.997 percent match between physical ballot papers and the preconteo software summary for the second round, and 99.94 percent for the first. This is presented as definitive. It is not. Judges counting physical ballots against the software summary can only verify that paper matches the summary they were given. If manipulation occurred upstream, at the server level, before results were committed to the official summary that the judges then verified against paper, the physical count matches a corrupted baseline, not the original votes. A near-perfect match between a potentially compromised preconteo and the physical count of ballots recorded against that same preconteo is precisely what you would expect if the intervention was upstream. The logical gap in the institutional response is structural, and no mainstream outlet has filled it.

IMAGE: Three Colombian election jurors (jurados de votación) sitting at a white table, focused on filling out forms, with a large stack of ballots/documents in front of them, in a concrete-walled polling station (Source: Razonpublica)

For a state-level actor with prior access to Colombia’s intelligence infrastructure, election night manipulation would not require hacking from scratch. If Pegasus had previously been deployed against Colombian electoral or intelligence officials, as Petro alleges, the attacker would already possess administrative credentials, server architecture maps, and IP topology for the target environment.

The fact that this is not merely theoretical is confirmed by Interior Minister Benedetti’s December 2025 forensic report finding Pegasus on his phone, by his January 2026 public statement that “the big question is whether men of the State are manipulating Pegasus,” and by Justice Minister Andrés Idárraga’s separate confirmation that 2.3 gigabytes of private data, including corruption investigation files and source identities, were extracted from his phone between August and November 2025. Two sitting cabinet ministers. Two forensic confirmations. The Fiscalía has not requested either minister’s technical evidence.

Erez Kreiner’s 2021 visit to Bogotá’s Defence Ministry to map critical digital infrastructure and the March 2026 Israeli cybersecurity delegation meeting Colombian decision-makers 90 days before the election are not abstract points about Israeli capability. They are documented moments at which Israeli state-affiliated actors had direct access to the people and institutions managing Colombia’s digital infrastructure.

Who Is Investigating, and For Whom

Crucially, the official vote certification process (escrutinio) is not yet complete. Iván Cepeda’s legal team filed formal legal challenges (impugnaciones) against 57,189 polling stations (mesas), more than one in four of all polling stations, on election night. These challenges must be examined individually before a final result can be declared. De La Espriella is currently president-elect based only on the unofficial preliminary count (preconteo), not on the certified escrutinio. His inauguration is scheduled for August 7, 2026.

IMAGE: Two Magistrates from the National Electoral Council (CNE) formally certified the results of the first round of the presidential election held on Sunday, May 31 – Cristian Quiroz, president of the CNE (left)(Source: Colombiao One)

The official escrutinio is conducted by judges of the Republic whose statutory function is to count physical ballots and certify that they match the software summaries. They cannot audit server infrastructure. They cannot conduct forensic software analysis. Their mandate does not include investigating whether the software summary they are certifying was itself generated from manipulated data.

The Consejo Nacional Electoral has nine magistrates elected by Congress through proportional representation, meaning its composition reflects the partisan balance of a Congress that is majority-right and produced the coalition that elected De La Espriella. An institution whose members are elected by Congress to investigate fraud by the candidate Congress supported is not an independent investigative body. It is an extension of the political apparatus it is nominally scrutinising.

The Registrar, who refused the source code audit, refused the pre-election expert review, denied the census modification, and confirmed massive coordinated cyberattacks on his own infrastructure in the same breath as denying any manipulation, is a political appointment confirmed by a right-majority Congress. His institutional survival depends on certifying the result.

CAPEL audited the first round’s source code design. The Registrar commissioned that audit and controlled the terms of reference. The OAS mission found no irregularities—the same OAS whose 2019 Bolivia electoral annulment preceded a coup against Evo Morales and was subsequently dismantled by MIT statisticians and confirmed flawed by the New York Times. Meanwhile, Colombia’s own Procuraduría, the constitutional watchdog, received 521 reports of irregular conduct on election day alone, from its own officials, citizens, the Foreign Ministry, and local ombudsmen. The OAS mentioned none of them. The EU-MOE is the most technically rigorous mission present, but it observes procedural compliance at polling stations. It does not audit server infrastructure.

Petro says he will deliver the server evidence to the judges. Whether judges with no forensic computing mandate, no independent technical staff, and no institutional incentive to find fraud against the winning candidate can do anything meaningful with server logs is a question that has not been answered publicly. The chain of custody is currently a black box.

This Is Not a New Pattern

The European Parliament spent a year investigating spyware abuse and published a 145-page report in March 2023, adopted by the full Parliament in June 2023. The PEGA Committee, the Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveillance Spyware, found that EU member state governments had deployed NSO’s technology for purely political purposes against critics, opposition figures, journalists, and anti-corruption investigators. Named: Poland, Hungary, Greece, Spain, Cyprus. The committee found that the illicit use of surveillance spyware had put “democracy itself at stake” and recommended a special task force involving national electoral commissions to protect elections from precisely this class of technology. This is not Petro. Not TeleSUR, but the European Parliament, after a formal year-long investigation using its full institutional powers.

IMAGE: A European Parliament member addresses the Strasbourg chamber on June 18, 2025, two years after the PEGA Committee first raised the alarm on state-sponsored spyware, with the flags of named member states visible behind her and the EU emblem on the podium (Source: Euperspectives)

Mexico is the Latin American reference case, and it is extensive. Citizen Lab documented Pegasus infections across the Peña Nieto government, targeting public health researchers who supported a soda tax he opposed, journalists and lawyers investigating presidential corruption and human rights abuses, opposition politicians and senior legislators, and the widow of a journalist assassinated while investigating cartels, targeted with fake messages about her husband’s murder one week after he was killed. Twenty-five confirmed targets in Mexico alone.

Cecilio Pineda Birto, a Mexican journalist investigating local corruption, was added to the Pegasus targeting list weeks before he was assassinated in March 2017. Previous Mexican governments signed at least 31 contracts with NSO Group worth $61 million, many routed through front companies. When AMLO took office pledging to end Pegasus use, new infections were documented in 2021, three human rights investigators, authenticated by Citizen Lab. Over 15,000 Mexican phone numbers appeared on the targeting list published by the Pegasus Project.

Amnesty International’s Security Lab published a forensic methodology report that systematically dismantled NSO’s public claim that Pegasus “leaves no traces whatsoever.” The lab showed exactly what traces it leaves and exactly how to find them. A year after the Pegasus Project revelations, Amnesty International found that the lack of a global moratorium on spyware sales had allowed the surveillance industry to continue operating without interruption, consequence, or effective accountability.

In Colombia specifically, the documented sequence goes like this: DIPOL paid $11 million cash to NSO representatives Ran Gonen and Yehuda Lahav in 2021. Under Duque, the purchase was deliberately hidden from official records before it was discovered only through a routine banking notification from Tel Aviv. The Attorney General summoned the entire police and defence command chain: Vargas, Muñoz, García, and received only blanket denials. The system was live and operational in Colombia. Petro alleges it was used against his 2022 campaign.

Interior Minister Benedetti confirmed his own phone was actively hacked in December 2025, six months before the election. The infrastructure was in place. The operator had prior access to the political left’s communications. And on election night, the Registraduría’s servers faced an attack the Registrar himself confirmed was massive, multi-vector, and coordinated.

The pattern did not stay in Latin America. In May 2026, French prosecutors opened a formal investigation into whether an Israeli firm called BlackCore, which describes itself as “an elite influence, cyber, and technology firm designed for the contemporary era of information warfare”, ran coordinated disinformation campaigns against three pro-Palestinian candidates from France Insoumise in March’s municipal elections. By June 11, France’s government disinformation agency Viginum confirmed BlackCore’s involvement and revealed the same operational pattern had been used in Scotland, New York City, Angola, and Togo. BlackCore cannot be found in Israeli corporate registries. No client has been identified. Colombia’s election was held ten days later.

READ MORE: BlackCore: Israel Runs Secret Avatar Army to Hijack Elections Worldwide

The Payoff Was Already Signed

The Geopolitical Payoff — Israel & Colombia

GRAPHIC 2 — THE GEOPOLITICAL PAYOFF TABLE
What you are looking at: A structured table mapping twelve specific policy commitments that Abelardo De La Espriella pre-negotiated with Israeli Foreign Minister Gideon Sa’ar at their November 25, 2025, meeting in Buenos Aires, seven months before a single vote was cast. Each row is a direct and documented reversal of Colombia’s post-2024 foreign policy posture: diplomatic relations restored, the embassy relocated to Jerusalem, the Free Trade Agreement reactivated, DIPOL-NSO Pegasus restarted, Kfir fleet maintenance resumed, the Mossad intelligence channel inside the Defence Ministry reopened, Hamas and Hezbollah designated as terrorist organisations, UN voting on Palestinian statehood reversed, Colombia enrolled as a Phase 2 Isaac Accords member state.

What it proves: Every row is a completed transaction, not a campaign promise. Each one has a known counterparty, a documented meeting, and a pre-agreed timeline. Most of it was locked in before election day. The question this table forces is not whether these commitments will be honoured, because it is clear they will be, but when exactly this stopped being an election and became a handover.

Read the AFOIA managing director Fitz Haney’s own words from October 2025: success is measured by UN votes shifting, embassy relocations to Jerusalem, and Hamas and Hezbollah designations. Every metric is a De La Espriella campaign pledge.

Read the Isaac Accords joint declaration signed April 19, 2026, on the Israeli government’s website: nations of the Judeo-Christian tradition, defence of freedom, fight against Iran’s terrorist networks in the Western Hemisphere. The language maps directly onto De La Espriella’s campaign rhetoric. The declaration was signed two months before the election by the same Netanyahu who, per the JOH audio, “had everything to do with” the pardon of the man coordinating the Latin American anti-left operation.

Read the Sa’ar meeting record from November 25, 2025 in Buenos Aires, confirmed by Semana on the day it happened: De La Espriella pledged to restore full diplomatic ties, relocate the embassy, rebuild the security partnership, and make Israel Colombia’s primary strategic ally. His full statement from the meeting: “A strategic alliance with the State of Israel and the US government will not only make us stronger, but will place us on the right side of history.” Sa’ar flew to Buenos Aires for this meeting while Israel was still formally expelled from Colombia. He did not meet with De La Espriella as a courtesy. He met with him as a counterparty to an agreement.

IMAGE: Israel’s Foreign Minister Gideon Saar met on Tuesday, November 25, 2025, with Argentine President Javier Milei at the Presidential Palace in Buenos Aires (Source: Argentinian Presidency)

The net result of a De La Espriella presidency is the simultaneous restoration of every strategic asset Israel lost when Petro took power. The Kfir jets return to IAI maintenance. DIPOL reconnects to NSO, to Ran Gonen’s organisation, for a surveillance system that already knows the Colombian left’s communications topology. The Mossad office in the Defence Ministry reopens. The FTA is restored. The embassy moves to Jerusalem. Colombia flips its UN votes. The Barak MX batteries are already being deployed, greeted by a government that wanted them all along. The Isaac Accords get their Phase 2 anchor in South America’s third-largest economy. And the man who personally signed Colombia’s foundational military dependency on Israel in Tel Aviv in 2007, who then sat on the board of the company that counted the votes in 2026, will watch all of it from a TGS boardroom in Bogotá.

IMAGE: Barak MX, an advanced, future-adaptible air defence system developed by Israel Aerospace Industries (Source: army-technology.com)

Petro named Israel on election night. He may or may not be able to prove what happened to those specific servers. But the picture assembled from the documents which includes the Israeli government’s own signed declaration, the AFOIA director’s own published interview, the UIAF Cabinet testimony, the Chuy García letter that 11 US Congress members signed and Rubio never answered, the Buenos Aires pre-negotiation with Sa’ar, the $11 million cash flight to Tel Aviv handed to Ran Gonen on two separate dates, the 37 audio recordings at hondurasgate.com, the March 2026 Israeli cybersecurity delegation meeting Colombian decision-makers 90 days before the vote, and Daniel Coronell’s investigation linking the president-elect to Alex Saab’s money flowst—that picture does not require the server evidence to be coherent.

It was coherent before election night. The servers are a thread inside a cloth that was woven over two decades, by hands that left receipts, and the cloth is now on display in the Nariño Palace.

READ MORE COLOMBIA NEWS AT: 21st Century Wire Colombia Files

SUPPORT OUR INDEPENDENT MEDIA PLATFORM – BECOME A MEMBER @21WIRE.TV

VISIT OUR TELEGRAM CHANNEL

21st Century Wire is an alternative news agency designed to enlighten, inform and educate readers about world events which are not always covered in the mainstream media.