Egmont Group Suspends Colombia’s Access to Secure Web

Politics Over Security

Courtesy of Wikimedia Commons

Most people didn’t hear the news this week. Heck, most people don’t even know what the Egmont Group of Financial Intelligence Units (FIUs) is.

But many have tracked the anti-Semitic rants of Colombia’s president Gustavo Petro, and his decision in May to end diplomatic relations with Israel over its actions in Gaza. To those tracking the issue, the decision is unsurprising. Petro has failed to condemn the HAMAS terrorist attacks on Israel last October. He instead accused Israel of genocide and compared the tiny country to the Nazis.

Source: screen capture on X from 1 November 2023

I’m not here to discuss the politics of HAMAS vs. Israel. I’m not here to debate whether or not Petro is a terrorist-supporting, leftist nut, who may be cuddling up to Iran, Russia, and other bad actors.

But I am here to talk about the consequences of Petro’s actions, which have consequences not just for his country, but also the region.

Economic effects would probably impact Colombia more than Israel. A free trade agreement between Colombia and Israel went into effect in August 2020, and Israel’s trade constitutes about 1 percent of Colombia’s total exports, including coal, coffee, and flowers.

Colombia, however, imports electrical equipment, plastics, and fertilizers from Israel. But worse yet, Colombia has military contracts with Israel, and the Petro administration claims they will be fulfilled, although there will be no new ones and the country will seek to “diversify” its military suppliers, which most likely will allow the Russians’ noses under the tent flap.

Israel in October - a few days after the savage HAMAS attacks - suspended security exports to Colombia, because Petro didn’t hesitate to condemn Israel’s actions in Gaza, while remaining notably silent on the savagery of HAMAS’s terrorist raids and abuse of civilians.

Let’s remember that Colombia uses Israeli-made aircraft and weapons in its fight against the drug cartels.

Colombia’s fighter jets are all Israeli-built. The more than 20 Kfir Israeli-made fighter jets were used by its air force in numerous attacks on remote guerrilla camps that debilitated the Revolutionary Armed Forces of Colombia. The attacks helped push the rebel group into peace talks that resulted in its disarmament in 2016.

But the fleet, purchased in the late 1980s, is aging and requires maintenance, which can only be carried out by an Israeli firm. Manufacturers in France, Sweden and the United States have approached Colombia’s government with replacement options, but the spending priorities of Petro’s administration are elsewhere.

Colombia’s military also uses Galil rifles, which were designed in Israel and for which Colombia acquired the rights to manufacture and sell. Israel also assists the South American country with its cybersecurity needs.

And speaking of cybersecurity…

Colombia’s ejection from the Egmont Group’s Secure Web is related to the subject.

But first, some background.

The Egmont Group of FIUs is a global organization, which facilitates the exchange of information, knowledge, and cooperation among its members. Egmont provides FIUs with a platform to securely exchange expertise and financial intelligence to combat money laundering, terrorist financing, and associated predicate crimes.

I emphasize the word “securely,” because it’s relevant here, and I’ll explain shortly. Egmont connects its member FIUs, allowing them to cooperate and share information to combat money laundering, the financing of terrorism, and other financial crimes.

The international network provides a forum for its member FIUs by helping them expand and systematize the exchange of financial intelligence and information, improve expertise and capabilities of personnel, and enable secure communication with one another. The heads of the member FIUs communicate regularly through the Egmont Secure Web. The Secure Web aims to secure security and reliability in information sharing and limits access to authorized personnel.

FIUs should be aware of the standards of security, reliability, efficiency and effectiveness applied in the use of the Egmont Secure Web or other appropriate channels, Egmont flags.

Courtesy of Wikimedia Commons

What did Petro do?

On September 23, the Egmont Group announced that Colombia’s FIU would no longer have access to Secure Web because Petro decided to “declassify” the information he received from his FIU (just by thinking about it), and announced publicly that the previous administration of President Iván Duque paid an Israeli company $11 million in cash to acquire Pegasus spyware. Petro read out the information from a document obtained through the Egmont Group.

That’s a no-go. The information exchanged through Egmont is supposed to be secure, and it’s sensitive. I would imagine that makes the rest of the members a bit nervous about sharing sensitive financial information through the forum.

In addition, the venue during which Petro spilled the sensitive information was a nationally televised speech in which he was expected to address a truckers’ strike. Instead, he proceeded to publicly “declassify” sensitive information that did not belong to him. Petro claimed that Pegasus was used by Duque's administration to spy on activists and members of left-wing parties that opposed his government, including Petro himself.

The Duque administration denies the charges, but Pegasus software has been used to target political opposition, journalists, human rights activists, and others.

What is Pegasus?

Pegasus was made by Israel’s NSO Group. The software is supposedly designed to track terrorists and criminals, but as I said, the software has been used by governments to target many more people.

The Commerce Department’s Bureau of Industry and Security (BIS) in November 2021 included Pegasus developer NSO Group on its Entity List, restricting the company’s access to US-origin technologies. In a statement, BIS clarified.

NSO Group and Candiru (Israel) were added to the Entity List based on evidence that these entities developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.  These tools have also enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent.  Such practices threaten the rules-based international order.  

In addition, the media in February 2022 that according to a whistleblower, an executive at NSO Group offered a US-based mobile security company “bags of cash” in exchange for access to a global signalling network used to track individuals through their mobile phones.

The allegation, which dates back to 2017 and was made by a former mobile security executive named Gary Miller, was disclosed to federal authorities and to the US congressman Ted Lieu, who said he conducted his own due diligence on the claim and found it “highly disturbing”.

Details of the allegation by Miller were then sent in a letter by Lieu to the Department of Justice.

So if the Duque administration did pay cash to NSO Group for Pegasus software and then abused the software to track those opposing the administration, this is a bad look. And if it violated Colombia’s laws to do so, that’s even worse, and heads need to roll.

The problem, however, is not with Duque per se. That’s a separate issue.

Petro spilled sensitive information his country and its FIU were expected to safeguard for ostensibly political reasons at a completely inappropriate forum, wildly straying from the purpose of his address.

1. NSO Group is an Israeli company, and it’s quite obvious that Petro has nothing but disdain for Israel.

2. Petro has also accused Duque of targeting him and suggested that Duque should stand trial for police brutality committed during the 2021 Colombian protests. Duque is a conservative. Petro… is not.

So Petro ostensibly violated Egmont rules to target not just his political opponents, but also a country he obviously hates, with little regard for the security of the information to which he was privy.

This is why the Egmont group suspended Colombia’s access to Egmont Secure Web.

Such events highlight the importance of maintaining a firm position on protecting the security of the information of our members in the ESW. The autonomy and operational independence of FIUs, as well as the principles for data protection and confidentiality, are essential and our collective security and the integrity of information exchange rely on this commitment. The Egmont Group will continue its engagement with FIU Colombia under our current internal procedures so there is confidence among our members that their information is fully protected in compliance with these principles.

Petro read information from a document obtained through the Egmont Group, putting politics above his country’s commitment to the fellow members of Egmont.

In addition, Petro is now endangering his own country’s national security, weakening Colombia’s ability to detect and deter illicit transactions made by drug trafficking organizations, and other criminal actors. Egmont members overwhelmingly voted to suspend Colombia’s access to sensitive information shared in the system, limiting the country’s access to possibly critical intelligence about money laundering and the financing of terrorism and making the country just a little bit safer for illicit financial actors, which also impacts the security of its neighbors.

And even if Colombia’s FIU is eventually allowed access again, other Egmont members may be reluctant to share information, knowing that it’s not secure and may be disclosed for political ends.

And then there’s the reputational damage Colombia could suffer. Colombia made some progress in countering drug cartels that have operated in the country for decates. Cartel leaders were tracked down and arrested, with the help of the United States, although authorities believe there are still numerous drug trafficking organizations operating there. The United States and European countries have provided financial, logistical, tactical, and military aid to Colombia, to help counter the drug trade. If Colombia’s ability to use sensitive financial intelligence to detect and deter transactions linked to the drug trade is degraded, will foreign aid to help it battle the narcos dry up?

Will compliance officers at financial institutions still be required to report suspicious transactions, and will they be willing to do so, knowing the information is not secure and could be used for political ends?

How will the reputation of Colombia’s FIU be impacted?

And how will foreign direct investment be affected by Colombia’s reduced ability to enforce AML laws and global standards?

The director of Colombia’s FIU, Luis Eduardo Llinas, said that investigations into the purchase of Pegasus began in March, and that Petro and the Attorney General’s Office were informed about the investigation and the information as soon as it became aware of an Israeli document showing that Colombia purchased the spyware. Llinas also apparently told Petro that the information was confidential, but said Colombia’s law authorizes the president to disclose it. Llinas claims the disclosure of sensitive information is not the issue, but the fact that Duque’s administration purchased the tool is.

But I would submit these are separate issues. The investigation began in March, and the FIU was using the information properly, without disclosing it to the public, to find out whether Duque’s administration purchased the Pegasus software and used it to target political opponents. There was no need to expose confidential information in a public forum, violating Egmont’s confidentiality rules.

Had the investigation uncovered illegal behavior by the Duque administration, the announcement could have been tailored to ensure that confidential sources were protected, and those responsible could have been prosecuted. The financial intelligence shared with Egmont partners helps FIUs investigate illicit behavior. It’s not meant to be a political tool.

But Petro didn’t care about that. He obviously despises Israel and obviously wants to stick it to the previous administration, so he disclosed the sensitive information without regard to Egmont rules, which will almost certainly impact the intelligence shared between the members of the group.

So Petro not only potentially screwed the members of the Egmont group, but also his own country, which is still dealing with drug gangs, and which AML operations work to target.

This is not about Israel. This is not about right vs. left. This is about the battle every country is doing against illicit financial actors. And Petro—almost certainly to vent his political spleen—endangered that battle.