While Rui Pinto sits in jail, his revelations are bringing down the sport’s most famous teams and players.
The first person to receive an e-mail from the whistle-blowing organization Football Leaks was António Varela, a columnist at Record, one of Portugal’s three national sports newspapers. The message arrived early in the afternoon of September 29, 2015. Varela, a precise, watchful man in his early fifties, clicked on a link, which took him to a blog entry that had been created at 5:17 A.M. that day. “Welcome to Football Leaks,” it read, in Portuguese. “This project aims to show the hidden side of football. Unfortunately, the sport we love so much is rotten and it is time to say ‘enough.’ ” Below was a collection of previously unseen documents involving Sporting Lisbon, the eighteen-time winner of Portugal’s national league. “Contracts in Portuguese, contracts in English, contracts in French,” Varela told me recently, in Lisbon. “I had no doubts about it. They were real documents.”
European soccer, which reaches its annual climax this weekend, with the final of the Champions League, the game’s most prestigious club competition, is a wonder of the sporting world. Storied teams such as Liverpool and Barcelona, Bayern Munich and Juventus, rise and fall. Each year, the finest players and coaches conjure, in new forms, soccer’s essential, unthinking grace.
The business side of the sport, however, is more like a painting by Bruegel the Elder. Since 1955, the best teams from each country have played against one another, and that has given rise to a dense intermingling of tactics, feuds, and money. Money above all. “Money scores goals,” as the German saying goes. Unlike American sports, with their draft picks, salary caps, and collective-bargaining agreements, European soccer is a heedless, Darwinian affair. Spending rules are broken. Salaries are secrets. The best leagues are awash in Russian oligarchs, Middle Eastern sovereign-wealth funds, and Chinese conglomerates. Rumors fly. Middlemen thrive. “Between clubs, it’s not only that we don’t trust each other,” a director of a top European club told me. “We betray each other constantly.” Last season, according to the accounting firm Deloitte, European soccer had revenues of twenty-eight billion dollars, about the same as Major League Baseball, the National Hockey League, and the National Football League combined.
The first documents released by Football Leaks related to a controversial investment model known as third-party ownership. One of the ways that clubs make money is by buying and selling players. T.P.O., which originated in Latin America, allows external parties to buy a stake in promising young players, in the hope of profiting from a huge transfer deal one day. (In 2017, the Brazilian striker Neymar was sold by Barcelona to Paris Saint-Germain for around a quarter of a billion dollars.) Proponents of T.P.O. describe it as a form of lending, but many fans believe that it gives investors too much control over a club’s roster and the shape of players’ careers, by influencing when and where a player might be traded.
In Portugal, one of the most vehement critics of T.P.O. was Bruno de Carvalho, the president of Sporting Lisbon, who described it as “a monster coming to football.” FIFA, soccer’s global governing body, banned the practice in May, 2015. But the contracts that Varela read on Football Leaks showed that Sporting Lisbon had entered into a secret, T.P.O.-like arrangement with an Angolan club named Recreativo da Caála. “It was powerful,” Varela said. “People say one thing but they are doing something completely different.”
Varela’s story filled two pages of Record the following day. By the end of the week, Football Leaks had posted confidential contracts from F.C. Porto and Benfica, Portugal’s biggest teams; Olympique Marseilles, a leading French club; and F.C. Twente, of the Netherlands. Fans learned that Jorge Jesus, the coach of Sporting Lisbon, was earning five million euros a season—an extraordinary salary for the Portuguese league—while other files confirmed rumors and disclosed hidden investors. Together, they gave a sense of seeing the business of soccer for the first time.
Football Leaks was hosted by LiveJournal, a Russian blogging service, suggesting that it was the work of Russian hackers. But Varela was struck by the technical nature of the documents. He thought that a disaffected lawyer might be responsible. “They were framing the problems with too much accuracy,” Varela said. At the same time, he worried that the data might be stolen. In late November, after Football Leaks revealed that F.C. Twente had sold stakes in seven of its first-team players to a single investment fund, its president resigned. The club was fined a hundred and eighty thousand euros, and was banned from European competition for three years.
In mid-December, a spokesperson for Football Leaks, calling himself John, agreed to answer questions e-mailed by the Times. “People may think we are hackers, we are only regular computer users,” John said. He claimed that the organization had been given three hundred gigabytes of data by insiders, who were dismayed by soccer’s excesses, and that it was receiving more all the time. “The fight has been hard,” John wrote. “But we won’t stop.” The interview transfixed Rafael Buschmann, a thirty-three-year-old sports reporter at Der Spiegel, the German news magazine, who had covered organized crime and the financial side of soccer for ten years. “I was totally electrified to get a hand on this data,” he told me.
For all John’s bravado, it was clear that Football Leaks was having problems. The first blog was shut down by LiveJournal. So was a second. There were days when the documents were hard to access, or infected by malware, which suddenly filled the screen with pornography. Buschmann wrote to the site for weeks, but received no reply. On January 3, 2016, the group finally responded: “What is your problem with football? Kind regards, FL.” That evening, confidential contracts related to the image rights of Cristiano Ronaldo, at that time the star forward for Real Madrid, appeared on the blog.
Buschmann and John began exchanging messages every few hours. Six weeks later, Buschmann flew to Budapest to meet him. He expected to find a former senior employee of FIFA or UEFA, which administers European soccer, who had gone rogue. But, in a small hotel near the city center, he met Rui Pedro Gonçalves Pinto, a twenty-seven-year-old antique dealer with spiky hair, from northern Portugal. It was around 5 P.M. and Pinto hadn’t yet eaten breakfast. Real Madrid and A.S. Roma were playing that evening. Pinto took Buschmann to a Serbian restaurant to watch the game, and ordered a meat platter. They partied for two days. “I was nearly to death,” Buschmann told me. Before the reporter left, Pinto gave him two hard drives, containing eight hundred gigabytes of data. In the following three years, Pinto supplied Der Spiegel with four terabytes of confidential information, more than eighty-eight million documents—a leak almost twice the size of the Panama Papers and sixty times that of Edward Snowden’s.
The information provided by Pinto has led to the conviction of dozens of top soccer players for tax evasion. It has prompted the Las Vegas police department to investigate an allegation of rape against Ronaldo. It has also revealed likely rule-breaking by Manchester City, the all-conquering champions of the English game, and a plan by Europe’s leading teams to leave their national leagues and form their own competition. Since 2016, Der Spiegel has partnered with media organizations in thirteen European countries to publish hundreds of stories, rewriting much of what was known about the soccer business and changing it in the process. The scale of Football Leaks—its totalizing nature—has brought about a novel anxiety among the sport’s fixers and dealers. “People are going to think at least twice before they do something which is not a hundred per cent straight,” a Portuguese agent told me. Last November, in response to Der Spiegel’s stories about a breakaway league, fans in Germany mounted protests in stadiums across the country.
But Pinto is a confounding figure. With a high-school diploma and no formal I.T. training, he has managed to obtain, and interpret, information that European tax prosecutors and investigative journalists have sought for years. “For me, he is a genius,” Buschmann told me. “The question is, what is the other side of his personality?” As soon as Football Leaks appeared, it had the air of an illicit enterprise. For a long time, after Pinto was identified as the ringleader of the project, he denied his involvement and narrowly skirted arrest.
In January, Pinto was detained in Hungary, on charges of cyber crime and extortion. While he waited to be extradited to Portugal, where he faces up to ten years in prison, I spent two days talking to him in his apartment in Budapest. Pinto is now thirty, but his fresh face and adolescent haircut give him the look of a student who has missed his last deadline. Each day, I arrived at around 1 P.M., when Pinto had just got out of the shower. Many of his answers had an artful, knowing quality. At tense moments, his face broke into a disarming smile. “I really don’t consider myself as a hacker,” he told me.
Pinto prefers to talk about what he has uncovered, and to describe the evolution of European soccer from a varied and distinctive game to a corrupt playground for the international élite, in which only the richest, least scrupulous clubs can thrive. Pinto sees the future currently awaiting European soccer as bland and predictable. “It will be like plastic,” he said. “Everything would be like a plastic thing.” Pinto has studied the cases of celebrated leakers (his lawyer, William Bourdon, represented Snowden), and I often got the impression that he is trying to expand the definition of what a whistle-blower can be. In 2016, Buschmann asked Pinto where his information came from, and he replied, “Some of our sources do not realize that they are our sources.” One afternoon with me, Pinto mused out loud about why none of his insiders had gone public. He questioned whether Europe’s whistle-blowing protections were strong enough. I suggested that perhaps his sources hadn’t gone public because they didn’t exist and that Football Leaks was the result of Pinto’s hacking alone. “That would be a plot twist,” he said, flashing me his smile. “The biggest plot twist ever.”
Pinto grew up in a small, blue-tiled house on a hill in Vila Nova de Gaia, which faces Porto, Portugal’s second city, across the River Douro. On a dazzling morning in April, four of the eight newspapers on sale in town had stories about him on the front page. Pinto claims that he learned to read by listening to soccer commentators and matching the names that he heard against what was written on the players’ shirts. At the age of four, he began to stay up late on Sundays, to watch the highlights from the weekend’s games, and to keep notebooks, in which he would write down scores and players’ statistics.
“My father once said that football will destroy my life, because I was kind of a fanatic, actually,” he told me. Pinto’s father, Francisco, designed dress shoes at a local factory. His mother, Maria, looked after him and his sister, who is ten years older. Francisco dabbled in antiquities, and when Pinto was seven his father bought an Intel Pentium desktop computer with a dial-up Internet connection and installed it in the living room, to buy and sell ancient coins online. “EBay at that time was an extremely awesome opportunity,” Pinto recalled. “I learned everything sitting next to him.” Pinto became fascinated by the Phoenicians, and by the Iberian and Celtic tribes that settled in Portugal before the Romans came. He watched the History Channel and dreamed of becoming an archeologist.
When Pinto was eleven, his mother was given a diagnosis of advanced lymphoma. He visited her in the hospital every day after school. After she died, he resolved to tell no one. “I just pretended that nothing happened and that is all,” he said. He started skipping classes. He stayed up late, online. In school, Pinto was a quiet, distracted presence at the back of the class, who seemed to get his information from elsewhere. “It’s very, very difficult to characterize Rui,” Mario Falcão, Pinto’s high-school geography teacher, told me. “If he wanted it, he would probably be the best pupil from the class, but he was not.”
In 2004, when Pinto was fifteen, his team, F.C. Porto, won the Champions League, led by a brash, exacting coach named José Mourinho. Pinto was ecstatic. “He came very happy to class,” Falcão recalled. But most of the time he was not there. Pinto’s father often apologized for his son’s poor attendance. “What can a father do with a teen-ager who passes all the night with the computer?” Falcão said. Pinto digitized the records of the school library. When I asked Falcão whether he agreed with Pinto’s description of himself as a normal computer user, he said, “No,” and then repeated the word eight times.
Pinto enrolled at the University of Porto, to study history, in the fall of 2008. The following month, Banco Português de Negócios, a private bank, was nationalized amid allegations of fraud and money laundering, marking the start of the country’s financial crisis. Pinto became part of what is known as Portugal’s geração à rasca (“generation in trouble”). Unemployment among the young reached almost forty per cent. Hundreds of thousands of people emigrated. “These younger people, twenty-five years or less, have to tell themselves this is not going to work,” Filipe Carreira da Silva, a sociologist at the University of Lisbon, who has studied the economic crisis, told me. In 2009, the shoe factory where Francisco had worked went bankrupt. (He had taken early retirement, to concentrate on antique dealing.) In 2011, Portugal accepted a bailout from the International Monetary Fund. “I mostly lost my motivation to do anything,” Pinto said. “More and more events started to appear and to show everyone how doomed was Portugal.”
In 2013, Pinto took part in a study-abroad program in Budapest. “I am not a rich person, so I could not go to a city like London or Paris,” he told me. When he arrived at his student dorm—in a complex of large Soviet-era apartment buildings in the east of the city—he experienced a sense of release. Budapest was fun. He loved the light on the Danube and the cobbled streets. Mixing with students from across Europe, Pinto gained a broader sense of the Continent’s economic crisis. He read about attempts by the German tax authorities to trace money that had been moved offshore. When he considered Spain, Italy, and Greece, where painful austerity measures had led to widespread street protests and the rise of populist parties, Pinto was struck by the passivity of his home country. “If you look at the Portuguese people, most of the young people, they don’t want to get involved in any of this,” he said. “They accept everything so easily.”
In the fall, Pinto returned to Vila Nova de Gaia. He was in the sixth year of a three-year history degree. He helped his father with the antique dealing, but not much else was happening. On September 18th, Pinto had €31.67 in his checking account. The following day, he received a transfer of €34,627 from a client account at Caledonian Bank, a small private bank in the Cayman Islands. On Friday, October 11th, Pinto received a second windfall from Caledonian Bank—this time from an account belonging to NetJets, the private-jet-rental company—of €227,332.80. Two days later, he paid a cell-phone bill of fifteen euros.
The second transaction triggered an alert at the bank. The transfer was cancelled and the money was returned to NetJets. According to a criminal complaint, filed with Portuguese prosecutors the following week, someone had used a phishing attack to access Caledonian Bank’s backup e-mail servers. Equipped with usernames and passwords, the hacker had ordered the transfers to a Deutsche Bank account in Lisbon registered to Rui Pinto. The data from the first transaction were garbled, but the second transfer appeared to have been executed at 5:46 A.M. on October 10th, from a computer-science lab at the University of Porto.
Pinto hired a lawyer, Aníbal Pinto, who works out of a glass-walled office on the outskirts of town. (The two men are not related.) When I asked Rui why he had hacked into Caledonian Bank, he told me that he copied about a terabyte of data from the bank’s servers, which he intended to hand over to European tax investigators. “It was kind of interesting to find out what was going on,” he said. But he never followed through. Pinto’s account was frozen on November 6th. The police investigation was slow. The bank refused to name the victim of the first transaction and the lab at the university did not keep computer-use records for more than seven days. Pinto maintained that the second transfer was a banking error and that the money from the first one belonged to him.
During the summer of 2014, Aníbal Pinto reached a deal with Caledonian Bank, in which his client agreed to return half the first transaction and keep the rest, a total of €17,313.50. Pinto was never charged with a crime.
In February, 2015, Pinto moved to Hungary for good. “Portugal is a lovely country for a holiday,” he told me. “Just that.” His father now traded in old posters, photographs, railway maps, and flyers, mostly from the nineteenth century. Budapest was rich in ephemera from the industrial revolution and the early twentieth century, which the Pintos sold for ten or twenty euros per item online. In his first months in the city, Pinto went for interviews at a few call centers, where he could use his English and Portuguese.
But he was increasingly distracted by soccer. That spring, Swiss police, acting on instructions from the F.B.I., arrested nine FIFA officials at a meeting in Zurich, on corruption charges relating to the organization’s decision to award the upcoming soccer World Cups to Russia and Qatar. Pinto was also concerned about the fate of his home-town club. A week after F.C. Porto’s victory in the Champions League in 2004, Mourinho had left to manage Chelsea, a London club that the previous year had been bought by the Russian oligarch Roman Abramovich. During the intervening decade, Porto had found it impossible to match the spending of the biggest clubs, in Germany, Spain, and England, or of trophy assets, like Paris Saint-Germain, which had been acquired by the Emir of Qatar.
Like other teams outside the gilded élite, Porto was taking ever-greater financial risks in order to compete. When Pinto was back in Vila Nova de Gaia, he had travelled to a few away matches with the team’s hard-core supporters’ club, the Super Dragons. At the games, he heard about a company named Doyen Sports Investments, backed by Kazakh money, which had been involved in several recent transfers. “Something was not O.K. with football,” Pinto said. “The fact that I got such a confirmation coming from so close to Porto make me decide to act.”
During the summer, Pinto acquired thousands of internal e-mails and contracts from Doyen. He would not tell me how. “What I can say about it is that it was surprising how confident these football entities are,” he said. “They think they are untouchable.” One transaction that Pinto pieced together—a loan deal between F.C. Porto and Real Madrid for a young Brazilian midfielder named Casemiro—appeared to include a seven-hundred-thousand-euro fee for the son of Porto’s club president. “I felt like they were stealing my football club,” Pinto told me. “And that no one in Portugal even cared about it.”
Doyen, which had offices in London and Malta, was run by Nélio Lucas, a charismatic Portuguese agent in his late thirties. Between 2011 and 2015, Doyen invested around three hundred million euros in T.P.O. deals. When Football Leaks went live, that fall, Doyen was the common thread in many of the stories. On October 3rd, four days after Pinto posted the first documents, Lucas received an e-mail in excellent Portuguese from someone calling himself Artem Lobuzov. (The name belongs to a Russian freestyle swimmer who competed in the 2012 Olympics.) Lobuzov threatened Lucas with more damaging disclosures. “The leak is worse than you can imagine,” he wrote. Lobuzov said that journalists were desperate for him to share what he had. “You certainly wouldn’t want that, right? But we can talk . . .”
Lucas reported the e-mail to the Portuguese police, who had already received a complaint about Football Leaks from Sporting Lisbon. In the following days, Lucas shared his conversation with Lobuzov with detectives from the country’s cyber-crime unit. On October 5th, Lobuzov said that a payment of between five hundred thousand and a million euros would be a “good donation” to make the material disappear. Lucas played along. Four days later, Lobuzov e-mailed to say that his lawyer was waiting for Lucas to make contact. The lawyer’s name was Aníbal Pinto.
A meeting was arranged for October 21st, near Lisbon. Aníbal Pinto flew south, from Porto. A driver picked him up from the airport and took him to a roadside café on the A5 highway, around ten miles west of the city. Pinto was uneasy. “Lawyers usually meet in their offices,” he told me. The location had been chosen by the police. A surveillance van was stationed out of sight. Pinto was joined by a lawyer for Doyen and by Lucas, who was wearing a wire. Two plainclothes officers sat at a nearby table.
The men discussed a possible contract between Doyen and Lobuzov, worth three hundred thousand euros over five years. Conscious that the police were listening in, Lucas floated the idea of Lobuzov coming to work for Doyen as an I.T. consultant. He asked Pinto about his client’s hacking abilities. “I immediately explained, this is a young Portuguese kid,” Pinto recalled. “Not a major criminal organization.” But Pinto described the Caledonian Bank case. “I already had something similar with him,” Pinto explained. Toward the end of the meeting, when Doyen’s lawyer was in the bathroom, Lucas offered Pinto a million euros to reveal his client’s name. Pinto refused.
Rui Pinto told me that he posed as Artem Lobuzov to check that the documents he was posting were real. “I wanted basically to see the reaction,” he said. “I know it was a naïve attitude.” In early November, Lobuzov announced that he was walking away. Lucas and Doyen ultimately came to suspect a different reason that Lobuzov had broken off contact. The company hired a Portuguese security firm to study its servers. The investigation showed that Doyen’s staff had been the victims of a phishing attack during the summer of 2015, in which they received replicas of Dropbox folders from contacts at various soccer clubs. On July 19th, Lucas had received a file named “Players,” supposedly from an official at F.C. Porto. When he attempted to open it, the file installed malware, which forwarded the contents of Doyen’s London servers to a Russian e-mail address. The hack raised the possibility that Lobuzov was able to read Doyen’s communications with the police in real time. (Pinto told me that this was not the case; he read the messages only months later.)
The end of 2015 was a heady, disorienting time for Pinto. Fresh documents were pouring into Football Leaks from law firms, clubs, and agents. There were thousands of PDFs and e-mails, which Pinto had no easy way of searching. He worked at night, combing through documents page by page. “It was extremely hard for me at that time to realize the extent of the wrongdoings,” he said.
Pinto sought to post at least two contracts every day. But he was often disappointed by the media coverage, which reduced Football Leaks to a source of gossip about famous players. On January 20, 2016, Pinto published the transfer contract of Gareth Bale, a Welsh winger who had moved to Real Madrid from Tottenham Hotspur, in the summer of 2013, for a little more than a hundred million euros. The contract was the seventy-seventh published by Football Leaks. It showed that Madrid had announced a fictitious, lower fee, in order not to offend Madrid’s star player, Ronaldo, who was acquired for ninety-four million euros. “It caused a kind of impact,” Pinto said. “But, yeah, it’s just nonsense.”
By the time Pinto met Buschmann, from Der Spiegel, a few weeks later, he was considering abandoning the project. “It was, like, messing up with my mind a bit,” he said. After the Lobuzov e-mails, Lucas had hired Marclay Associates, a London-based private intelligence firm, to unmask Football Leaks. By mentioning the bank hack, Aníbal Pinto had given the investigators a valuable clue. In March, 2016, a Web site called Football Leaks: Revealed briefly appeared, naming Rui Pinto as the source and publishing his photograph. The site was taken down, but Pinto was shaken. He finds Hungarian winters hard at the best of times. “It’s like an extra weight over my shoulders,” he told me. That spring, Pinto decided to pause Football Leaks for six months, to enable Der Spiegel to work through the data. But he would continue to look for secrets. “There was something in him,” Buschmann told me. “It was very powerful—to bring him to this point and not to let him stop.”
Since 2011, Der Spiegel has occupied an austere tower in Hamburg, overlooking the city’s former docks. The Football Leaks data are kept on the tenth floor, in an office labelled “Geräteraum,” or Equipment Room. On an overcast morning in March, I sat in the Geräteraum with Buschmann, his editor, Michael Wulzinger, and Nicola Naber, a researcher, who have been the principal custodians of Pinto’s data since the spring of 2016. They had tidied the office for my arrival, taking down diagrams and wall charts used to plot the latest wave of Football Leaks stories, which were published last November. Only a few pink Post-it notes remained on the glass wall next to Naber’s desk: “Write”; “Confront”; “Write”; “Confront.”
The first hard drives that Pinto gave to Buschmann contained around eighteen million files. Der Spiegel bought new servers and created a secure network to handle the data. “We went shopping,” Naber said. The magazine’s I.T. team converted PDFs and e-mails into searchable text, while the reporters worked on Intella, specialized software used by prosecutors in fraud cases, to make connections within the documents. When I visited, the Intella home screen showed some sixteen million e-mails, eighty-five thousand presentations, six hundred and eighty thousand spreadsheets, and a hundred and five thousand contacts in the Football Leaks database. I typed in the name Jordan Pickford, the current goalkeeper for the English national team. There were twenty-four hundred and twenty-four results. Mesut Özil, an ethereal German playmaker for Arsenal, the team that I support, generated eighty-six hundred and twenty-nine.
An early story that the Spiegel team worked on was about Ronaldo’s tax affairs. Ronaldo, a five-time winner of the Ballon d’Or, for the world’s best player, is a near-mythical figure in Portugal, and Pinto’s favorite player. In the spring of 2016, Pinto had discovered a company named Tollinn, in the British Virgin Islands, which Ronaldo might have been using to evade taxes that he owed in Spain. For weeks, Naber set about matching Ronaldo’s global assets—two hundred and twenty-seven million dollars in 2015—against his tax obligations and offshore income. It was all in the data. “You sit here thinking, What would I need to know?” Naber told me. “And then you think, I would need to know the raw income in Ireland. You look it up and it is there. It’s crazy.” (Last June, after pleading guilty to tax fraud in Madrid, Ronaldo was given a two-year suspended jail sentence and fined almost nineteen million euros.)
A few revelations leaped out. Wulzinger showed me the paperwork for the transfer of Paul Pogba, the midfielder for the World Cup-winning French national team, who moved from Juventus to Manchester United for a hundred and five million euros in the summer of 2016. The contracts promised forty-nine million euros to Pogba’s agent, Mino Raiola, who represented all three sides in the deal. More often, however, the Spiegel team chased tantalizing hints in a sea of information. They came to see the sport in another way. One evening in 2017, Buschmann was in a restaurant, watching Madrid’s two major clubs compete for a place in the Champions League final. At one point, his mind drifted to the various funds and middlemen implicated in the match. When Buschmann looked at the clock, twenty minutes had passed. “I have often had the feeling in the last months and years that I can’t watch the game like before,” he told me.
Pinto didn’t have that problem. During the summer of 2016, the European Championship was held in France. Pinto followed the Portuguese team, captained by Ronaldo, obsessively. “Most people, they don’t know how to separate things,” he told me. “Outside of the pitch, I don’t see Ronaldo the same way I see him inside the pitch.” Against the odds, Portugal reached the final, playing France, in Paris. Pinto watched the game in a pub in Budapest. Ronaldo left the field with a knee injury in the twenty-fifth minute, Portugal beat France in extra time, and Pinto burst into tears.
The reporters in the Geräteraum sought to observe clear boundaries with Pinto. There was a risk of inciting him to hack. “When I have a source where—maybe five or ten or fifty per cent—he could be a hacker, it is totally impossible for us to ask him about documents,” Buschmann said. But there were times when they needed him. In the fall of 2016, Der Spiegel and its partners in European Investigative Collaborations—the reporting consortium that has worked on Football Leaks—were approaching the deadline for their first set of stories. But there was a glitch: thousands of documents weren’t showing up in the Intella software. “Our I.T. team worked on this for weeks,” Buschmann said.
One weekend, Pinto flew to Hamburg. During the afternoon, he insisted that Buschmann take him to see Hamburger S.V., the local Bundesliga team, play a match. He drank a few beers. “For me, it was totally stressful,” Buschmann said. “The stadium was full of cameras.” In the evening, Buschmann took Pinto to the Geräteraum and showed him the problem. Pinto sat at a desk next to the window. It was the first time he had used Intella. Buschmann left the room to make coffee. “When I came back, he was ready,” Buschmann said. The problem was fixed.
That December, Der Spiegel and the E.I.C. published their first Football Leaks stories. The leading articles were about Ronaldo’s finances, Doyen’s aggressive T.P.O. deals, and a network of Argentine agents who used shell companies and straw men in the Netherlands to evade taxes. The first stories went live at nine on a Friday night. In Budapest, Pinto was madly scrolling Twitter. He messaged Buschmann, “This is the most important day of my life.”
In early 2017, Pinto came across a file that was labelled “Las Vegas.” “I was kind of curious about it,” he said. “Why ‘Las Vegas’? Let’s see what’s in here.” The file contained e-mails between U.S. and Portuguese lawyers about an alleged incident that had taken place at the Palms Place Hotel, in Las Vegas, on the night of June 12, 2009. “I got shocked,” Pinto told me. “It was a rape case.” The documents included a settlement agreement, signed on January 12, 2010, between a “Ms P” and “Mr D,” in which Ms P was paid three hundred and seventy-five thousand dollars. A confidential side letter identified Ms P as Kathryn Mayorga, a former model who was then working at an elementary school, and Mr D as Cristiano Ronaldo.
Pinto alerted Buschmann, who was at work on a book about Football Leaks with Wulzinger, and writing at home in Münster, a two-and-a-half-hour train ride from Hamburg. Clubs and companies implicated in the first wave of Spiegel stories had mostly reacted with silence, or with fury that the information had come to light. In late December, 2016, officials from Europe’s top leagues had written to fifa, saying that a breach of the Transfer Matching System—the global clearing house for soccer transfers—was the only plausible source of the leaks. More private investigators were hired to find out where the information was coming from.
One evening, taking the subway in Hamburg, Buschmann realized that he was standing on the wrong platform. As he ran to make his train, a wiry older man with a passing resemblance to Clint Eastwood switched platforms, too. The doors closed before the man got on. A few days later, Buschmann noticed the same man, in a heavy gray coat, entering a bookstore in Münster. “I thought, O.K. Be cool. It is maybe something paranoid,” he told me. It was only when the man sat near him in a restaurant in Berlin, three hundred miles east, that he was sure he was being followed. The rest of the Spiegel team believed that their e-mails and movements were being tracked, too. “They knew more than we would like,” Wulzinger said. When Buschmann travelled to Las Vegas to investigate the rape allegation, he saw the man again, watching from a parked Volvo.
The defensive response to Der Spiegel’s stories made Pinto question the appetite of soccer’s regulators to clean up the game. In interviews as John, he invited fifa and uefa officials to make contact with Football Leaks, but no one did. Pinto sees most soccer journalists as deferential to the sport’s powerful broadcasters and sponsors. “They don’t want the people to see the truth,” he told me. Pinto sometimes refers to “real fans,” who will demand a financial and moral overhaul of the sport, as the intended audience for Football Leaks. But it is not clear whom he means by this, or whether such a group exists.
On April 14, 2017, Der Spiegel revealed the rape allegation against Ronaldo without naming Mayorga. The timing was propitious. Ronaldo, then at Real Madrid, was playing in a two-match Champions League quarter-final against Bayern Munich, the country’s biggest club. But the story gained little traction. GestiFute, a Portuguese soccer agency that represents Ronaldo and Mourinho, and whose president, Jorge Mendes, is one of the most powerful figures in the game, dismissed the article as “a piece of journalistic fiction.” Ronaldo scored two goals in the first game against Munich and a hat trick in the second. “Our story nearly was atomized,” Wulzinger said. “The public did not take notice of it.”
In Portugal, too, interest in Football Leaks had fallen away. After the initial stories about Sporting Lisbon and F.C. Porto, the platform had focussed mainly on the sport’s larger leagues. But, on a Tuesday afternoon that April, Francisco Marques, the communications director for F.C. Porto, was leaving a restaurant near Porto’s stadium when he received a message from an encrypted e-mail platform called Tutanota. It appeared to include an internal media-briefing document belonging to Benfica, F.C. Porto’s archrival. Marques asked the sender how he could be sure that it was real. “I think the attached images will suffice,” the source wrote, including screenshots of three Benfica officials’ in-boxes. One image had been taken in the previous half hour. A few days later, Marques received about twenty gigabytes of internal Benfica e-mails.
The rivalry between Benfica and F.C. Porto contains multitudes. It is the south against the north; the capital against the rest; cosmopolitan glamour against honest toil. Between them, the clubs have won the Portuguese league sixty-five times. In a country of ten million people, Benfica claims to have six million supporters, an assertion that gives rise to the idea that it is the most powerful institution in the country. Supporters of other clubs refer to Benfica as the Octopus and to the supposed shadowy nature of its influence in Portuguese society as Benfiquistão, or Benficastan. When I asked Marques whether he considered returning the e-mails, he laughed. “No,” he said. “This is a war.”
Marques has a show on Porto’s TV channel, and in the weeks that followed he began to read the Benfica e-mails aloud on the air. He excluded personal gossip and salacious material, and focussed on evidence of Benfica’s attempts to control the Portuguese game. In one instance, he shared secret briefings distributed to pro-Benfica commentators on Portuguese TV. In another, he read an e-mail correspondence referring to the “priests”—a group of eight referees who could be relied on to favor Benfica at decisive moments—which ended, “Now delete everything.” There was a PowerPoint presentation, from June, 2012, in which Benfica officials mapped out a five-year plan to “dominate the external environment” and increase the club’s power over Portugal’s politicians, journalists, and justice system. “Now it is public,” Marques said. “It is not fair. The competition is not fair.”
In early June, Marques handed the Benfica e-mails to the police. He had wondered whether they were connected to Football Leaks in some way. The source described himself as a Porto fan but a critic of the club’s president. On the afternoon of July 12th, Marques received a Tutanota e-mail with four attachments, concerning a deal that Benfica had struck on land taxes around its stadium, in Lisbon. Marques never heard from the source again.
On October 19th, the police raided Benfica’s Estádio da Luz, in northern Lisbon. Six weeks later, the leaks started again. This time, the source simply posted the club’s e-mails, unedited, on a blog titled O Mercado do Benfica, or the Benfica Market. “There were many dirty things,” Marques told me. The e-mails contained medical records and conversations between club officials and their wives, along with player contracts, tactical reports, and the club’s internal finances. A senior Benfica official compared the leaks to being under a terrorist attack. “We don’t know when it comes, the next one, where it comes from, or what sort of missile it is,” he said. “We don’t know anything.” The police raided the club’s offices twice in the early months of 2018. That March, the head of Benfica’s legal department, Paulo Gonçalves, was arrested on suspicion of bribing three judicial officials to provide him with updates on the case.
The Benfica scandal, the biggest in Portuguese soccer in recent decades, has driven the enmity between the clubs to new heights. Benfica is currently suing F.C. Porto, seeking seventeen million euros in damages. When Marques dropped me off at my hotel in Porto, he showed me his phone, which each day is deluged with messages from Benfica fans, promising to kill him. “It changed my life,” he said, not entirely unhappily. “Now I can’t go to the south.”
Spurred by the Benfica leaks, prosecutors looked at other recent sports-related crimes in Portugal. These included the Doyen extortion case against Artem Lobuzov, which had been dormant for more than two years. A handwritten note in a Portuguese police file, dated April 27, 2018, said that the Doyen complaint had been investigated alongside the alleged hacking of Sporting Lisbon, in the early days of Football Leaks, in the fall of 2015. “A suspect has been identified,” the note read. “Rui Pinto.”
At the time, Der Spiegel and the E.I.C. were preparing their second wave of Football Leaks articles. At the beginning of 2018, Pinto had given Buschmann more hard drives, which brought the number of documents in the Intella database to more than seventy million. The team in the Geräteraum decided to pursue two stories that had eluded European soccer journalists for years. The first was about how the most profligate clubs—namely, the Qatar-backed Paris Saint-Germain and Manchester City, which is owned by Sheikh Mansour bin Zayed al-Nahyan, a member of Abu Dhabi’s royal family—had been able to defy the sport’s spending rules. Since 2013, under a set of regulations known as Financial Fair Play, European clubs have had to balance their expenditures against their income from soccer-related sources in order to take part in uefacompetitions. But, for years, the teams with the wealthiest owners seemed to benefit from suspiciously generous sponsorship and marketing deals, which helped to keep their finances in line.
The Football Leaks data showed that, in the summer of 2012, P.S.G. signed a five-page sponsorship contract with the Qatar Tourism Authority for more than a billion euros. (A uefa investigation later calculated its true market value to be around fifteen million.) Internal e-mails from Manchester City suggested that club officials were massaging deals and supplementing them with funds from Sheikh Mansour’s holding company, Abu Dhabi United Group. In the spring of 2013, Manchester City’s chief financial officer, Jorge Chumillas, e-mailed one of the club’s directors, Simon Pearce, to check that it was O.K. to alter a series of contracts, in order to comply with uefa’s rules. “Of course,” Pearce replied. “We can do what we want.” (Manchester City denies all allegations that have originated from the Football Leaks data, saying, “The attempt to damage the club’s reputation is organized and clear.”)
Der Spiegel also pursued a story about a long-rumored plan for Europe’s biggest clubs to leave their national leagues and form a closed, N.F.L.-style competition covering the Continent. The idea of a soccer “Super League” has been around since the late nineteen-eighties. It is the logical commercial end point for a sport in which a handful of teams currently dominate their domestic markets, but in many countries it would break more than a century of sporting tradition. By searching the e-mails of senior officials at Europe’s leading clubs, the reporters at Der Spiegel discovered detailed discussions about the formation of a Super League in early 2016. That February, Bayern Munich—the most successful team in the history of German soccer—explored the legal implications of withdrawing from the Bundesliga. In the following months, executives from seven powerful clubs, including Barcelona, Juventus, Manchester United, and A.C. Milan, met twice to discuss potential formats for the breakaway league. One presentation was called “A Super League Scenario for Top European Football.”
A club director involved in the discussions told me that the plan was a negotiating ploy. “It was no secret,” he said. But he didn’t make the idea sound entirely abstract, either. When I asked whether a Super League in European soccer was inevitable one day, the director replied, “In a certain form, yes.” He weighed the pros and the cons of the format. “You have to be careful,” he conceded. “There is the fact you are killing the rest of football in Europe.”
In the summer of 2018, the rape allegation against Ronaldo gained fresh impetus. Encouraged by the widespread reporting of sexual misconduct by powerful men and the use of nondisclosure agreements to silence victims, Mayorga hired a new lawyer, Les Stovall, who wrote to Pinto through an anonymous e-mail address, asking if he had any other documents. Pinto unearthed multiple versions of a twenty-seven-page transcript of an apparent interview of Ronaldo, identified as X, conducted by a member of his legal team, Paulo Rendeiro, about the alleged attack. Answers in the earliest version of the document appeared to corroborate Mayorga’s account:
X: She said that she didn’t want to, but she made herself available. The whole time it was rough, I turned her onto her side, and it was fast. Maybe she got some bruises when I grabbed her. . . . She didn’t want to “give it to me,” instead she jerked me off. I don’t know any more exactly what she said when she was jerking me off. But she kept saying no. “Don’t do it”—“I’m not like the others.” I apologized afterward.
In the transcript, Mayorga was identified as Ms C:
Question: Did Ms C ever raise her voice, scream, or yell?
X: She said no and stop several times.
Pinto sent the transcript to Stovall, who forwarded it, with other information from Football Leaks, to the Las Vegas police on August 25th last year. In September, in an interview with Der Spiegel, Mayorga accused Ronaldo of raping her, and the Las Vegas police opened an investigation. Ronaldo has protested his innocence throughout. In an Instagram video posted two days after the story appeared, he described the reporting as fake news. “It’s normal,” Ronaldo said. “They want to be famous to say my name. But it’s part of the job. I’m happy man, and all good.”
On September 13th last year, two weeks before Mayorga’s interview appeared, Sábado, a Portuguese magazine, named Pinto as the source behind Football Leaks and the prime suspect in the release of the Benfica e-mails. Pinto’s face was on the cover. The Portuguese media harried him, and his Facebook page rapidly filled with threats from Benfica fans. Pinto had worried about being publicly identified, and about how best to defend himself, for some time. In 2017, prosecutors from France’s Parquet National Financier, an anti-corruption unit, had made contact with Football Leaks, inviting John to share his data. (France has some of the strongest whistle-blowing protections in Europe.) The following summer, Pinto approached William Bourdon, who specializes in whistle-blower cases, and asked him to broker a meeting.
In late November, Pinto travelled to Paris to meet with the P.N.F. “I spoke as a witness,” he recalled. “Basically said what kind of data I have, how I got the data, and that is all.” Pinto told me that he also met with officers from France’s witness-protection program, who gave him a secure phone with which to contact them in case of an emergency. “They considered that my situation was quite alarming,” he said. After he returned to Budapest, Pinto resolved to move to France in February. “All this situation was a bit stressful,” he told me. Pinto confided in Buschmann. “He said often to me, ‘I will have a family, I will have kids,’ ” Buschmann said. “ ‘I will have a normal life.’ ”
In the middle of January, 2019, Pinto’s father and his stepmother, Elizabeth, visited him. “They suspected that something was going on,” Pinto said. When they arrived at Pinto’s apartment, on a quiet, residential street in Budapest’s seventh district, they couldn’t open their luggage. Their suitcases had combination locks, which seemed to have been tampered with. The following evening, Pinto and his father went to the supermarket. When they returned to Pinto’s street, there were police cars and men in uniform. “I realized, O.K., they are coming for me,” he said. Upstairs, the police seized Pinto’s laptop, three cell phones—including the one belonging to the French authorities—three USB sticks, and fourteen hard drives, containing twenty-nine terabytes of data. Pinto was taken to a detention center, where he asked to call his lawyer. The police said no. “They said, ‘This is not an American movie,’ ” Pinto recalled.
Pinto was released under house arrest. When I visited him, in late February, he wore a Levi’s T-shirt, jeans, and an electronic tag on his left ankle. His parents had stayed in Hungary, but his apartment felt spare, as if he had recently moved in. There was a double bed in the living room, where his parents slept, a table with a brown synthetic tablecloth, and some small, gaudy landscapes on the walls. The police had taken his DVR.
Pinto was spending most of his time thinking about his case. According to the arrest warrant issued by the Portuguese authorities, he was being held on six charges, relating to the alleged blackmailing of Doyen and the hacking of Sporting Lisbon contracts in the fall of 2015. The warrant made no mention of the Benfica e-mails and the subsequent embarrassment for Portugal’s biggest soccer club, which Pinto was convinced were the real reasons for his arrest. “Politicians, prosecutors—even police detectives—they lose their focus when it comes to football,” he said.
When I asked Pinto if he had anything to do with the Benfica scandal, he denied it, in Pintoesque fashion: “I’ve never seen a statement from the police or the Portuguese authorities linking me to this.” He worried that his gargantuan data set, of which Der Spiegel possesses only around fourteen per cent, might be lost or destroyed if it were handed over to the Portuguese police. He was also afraid of being attacked by Benfica’s most notorious supporters, a group called the No Name Boys. I asked Pinto if he was aware of the irony of being killed by soccer fans. “Yeah,” he replied. “I’m aware of that.”
The following week, Pinto had an extradition hearing at Budapest’s central courthouse. I arrived early, with Buschmann. The corridor outside the courtroom filled with news crews and lawyers. Bourdon was there, wearing a long green overcoat. Pinto is five feet six inches tall. When he appeared, led by two thickset Hungarian police officers, he looked like a student on a Eurail trip gone wrong. “He is a cat,” Bourdon murmured. “A poor, fragile cat.” Extraditions between E.U. member states are almost always routine affairs. When the judge ordered that Pinto and his data be handed over to the Portuguese authorities, Bourdon slapped his rollerboard suitcase in frustration. After the hearing, Pinto sat on a bench in the corridor in handcuffs and gave an impromptu news conference to some Portuguese journalists. “I did this for the public,” he said. “I did this for all football fans.” The journalists wanted more, but Pinto seemed to dry up. “What else can I say?” he added. “I have to go to a Hungarian prison.”
Pinto was extradited to Lisbon on March 21st. Three days before he was handed over to the Portuguese police, Belgian prosecutors came to Budapest and copied all his data. Pinto’s hard drives, which are heavily encrypted, are what he hopes will eventually secure his freedom. “It is one thing to copy them—it is another thing to have access to them,” a member of his legal team told me. In February, prosecutors from Eurojust, the E.U.’s judicial-coöperation unit, met in Brussels to discuss how to analyze the Football Leaks data in a systematic way. Jean-Yves Lourgouilloux, of the P.N.F., described Pinto as a whistle-blower and confirmed that the French authorities had looked at twelve million documents so far. The following month, uefa announced that, as a result of the Spiegel coverage, it was investigating Manchester City, the newly crowned English Premier League champions, for breaking its financial rules. The club faces a potential ban from the Champions League. “You don’t have to convince me that Pinto is at risk of one day being convicted as a hacker and for stealing information. It’s true, there is a risk. But Snowden did the same,” Bourdon told me. “There is a principle of proportionality—of the violation of the law compared to the services rendered. Pinto came from nowhere and he opened the eyes of millions and millions of citizens.”
In Portugal, Pinto’s return was front-page news. When I was in Lisbon last month, an impersonator was playing him on Portuguese late-night TV. The name of the character was Rui Pinto, the Hacker. In the last months of the Benfica Market, which has gone quiet since Pinto’s arrest, the blog took on a broader, anarchic quality, posting e-mails from one of Portugal’s largest law firms, and also secret judicial documents. Although Pinto denies any involvement, he is widely seen as a figure of general, youthful rebellion in a country where other forms of activism have been absent. “Rui is literally one in a million,” Carreira da Silva, the sociologist, told me. He is also a hero to everyone who hates Benfica. During my conversation with Marques, F.C. Porto’s communications director, we discussed the greatest recent figures in Portuguese soccer: Mendes, the agent; Mourinho; Ronaldo. “Now we have four,” Marques said. “Football after Rui Pinto is better.”
While Pinto awaits his trial, he is being held at a prison next to police headquarters, in central Lisbon. Francisco Teixeira da Mota, Pinto’s Portuguese lawyer, told me that he expected prosecutors to try to add the theft of Benfica’s e-mails to the case. “That is a risk that can happen at any moment,” he said. Pinto is being kept away from the other prisoners, for his own protection, but when he is allowed to exercise or to venture outside his cell he sometimes hears them yell his name, in what he takes to be encouragement. To pass the time, he has been reading a book about espionage during the Second World War. I once asked Pinto whether he was an idealist, and he surprised me by seeming not to know the word. We were in his apartment in Budapest. He opened a laptop and looked it up. “A person who is guided more by ideals than by practical considerations,” Pinto read from the screen. “Utopian, visionary, wishful thinker, fantasist, fantasizer, romantic, romanticist, dreamer.” It was enough. “Maybe this word applies to me. Maybe, yes.”
♦This article appears in the print edition of the June 3, 2019, issue, with the headline “The Final Whistle.”
Sam Knight is a staff writer at The New Yorker based in London.
