In the investigation of the San Ginés Case, the Organized Crime Team (ECO) of the Civil Guard has had to face the difficulties of investigating an alleged criminal organization dedicated to appropriating public funds, such as the concealment of information.
As part of the actions ordered by the Investigating Judge, agents of the Central Operative Unit (UCO) of the Civil Guard proceeded to search the home of the lawyer, Ignacio Calatayud, in Madrid on March 28. The agents were authorized to proceed to the "access, viewing, inspection and downloading of email accounts, virtual data storage services and existing social network accounts...as well as online storage services, such as Icloud, Dropbox, Google Drive accounts. To this effect, in this case, it is expressly authorized to proceed to carry out the on-site dumping and cloning, during the practice of the entry and search, in whole or in part".
Thus, during the intervention process and with the collaboration and consent of Ignacio Calatayud, the agents obtained the access codes to his different accounts, including those of Google, proceeding to change the passwords to ensure that the data stored in them remained available to the investigation. In addition, the agents requested, from Calatayud's own computer and in his presence, the download of all personal information of the lawyer that could be found on Google's servers, which is known as information hosted in the cloud or virtual storage.
This request takes an indefinite time, which may exceed 24 hours, and upon completion Google services send an email with a link that allows you to download all the information stored in a single file, in a procedure known as Takeout.
The alarms went off when the investigation agents verified, after a few hours, that they could no longer access Ignacio Calatayud's Google account, as he had changed the password again, thus preventing the download of the Takeout file and being able to, in addition, alter the content stored in the Google cloud. Due to this, the agents went on March 30 to the Investigating Judge to urgently request the sending of a Rogatory Commission to Google Ireland Ltd. In response to the investigation's request, the magistrate immediately issued the corresponding Urgent Criminal International Cooperation Request to the Department of Justice and Law Reform of the Government of Ireland, headquarters of the technological multinational.
Calatayud's delaying maneuvers
After the opening of the secrecy of the summary, Calatayud had access to the investigators' report on the password changes in his account and to the Urgent Criminal International Cooperation Request, so he submitted a letter to the Court in which he offered "the greatest collaboration with the Court, in order to avoid unnecessary proceedings" stating that there could have been "an error in the assessment of what happened".
Calatayud explained in his letter that he had contacted the Civil Guard agents because he had learned that the Takeout had already been generated, requesting the agents to restore his account so that he could access his mail. Always according to Calatayud's version, it was the agents themselves who restored the account to him on March 29.
This version was flatly denied by the Civil Guard itself, which, in a report made on July 12 at the request of the Investigating Judge, stated "this Department does not provide the investigated with any password, mechanism or indication to carry out the recovery of the account, unaware of how the change of credentials and access to it has been carried out".
Thus, Calatayud's explanations, in the sense that there would have been "an error in the assessment of what happened" and indicating that the Urgent Criminal International Cooperation Request was unnecessary, can only be understood as an attempt to delay said request, since the facts radically deny his explanations.
A sophisticated maneuver only available to qualified hackers
As explained in the Civil Guard report, after requesting the Takeout from Google, the account was secured by changing passwords. In addition, in the account configuration, the data that would allow the recovery of the account was modified. Specifically, the recovery email (an alternative email address that would allow you to recover a forgotten password) and the contact phone number (a number in which to receive messages to reactivate the account) were replaced. The new data entered by the Civil Guard corresponded to a telephone terminal and an email account "controlled by the acting force".
Despite this, by methods that are unknown, Ignacio Calatayud managed to access his account and changed the password again as well as the recovery data (the email and mobile phone number that are used to send messages restoring the password). Given the extraordinary security measures implemented by Google to prevent unauthorized access, suspicions are oriented to the fact that Calatayud could have used the services of a specialized hacker, a very closed world that can only be accessed through contacts linked to computer crime.
This type of services are usually provided by unscrupulous private investigators who resort to hackers to violate the security mechanisms of email and storage accounts of individuals and companies.
As can be seen from the request made by the Investigating Judge at the request of the Civil Guard, the investigators are interested in the data stored by different Google services, among which the Access Log, the Calendar application, the Chrome browser, the Contact Book, the Mail, the Drive file storage system and the location history are specifically indicated.
Google Takeout
Google Takeout, also known as Download Your Data, is a Google data release tool that allows users of its products to export their data to a downloadable file. Thus, any user who intends to change service platforms can cancel their account with Google without losing the stored information. This tool is of enormous interest to the security forces as it allows, practically with a single click, to download not only the emails of the person under investigation, but also their agenda, their contacts, their browsing history and even their movements over the previous months.
The request for judicial assistance in criminal matters
The request of the Investigating Judge requires, in order to be attended to, that the applicant rigorously argue and justify the facts for which international cooperation is requested. To this end, the letter sent from the Investigating Court Number 2 has had to refer to the investigations carried out, detailing as key aspects the irregular hiring of Calatayud, the appropriation by him of the costs owned by the Water Consortium and Insular de Aguas de Lanzarote (INALSA) and the suspicions of a possible bribe in favor of San Ginés, through the transfer of a home for an amount significantly lower than its market value.
Finally, said request states that the investigation is carried out for alleged "crimes related to corruption" that at this time can be identified with "the crime of prevarication, the crime of bribery, the crime of embezzlement, the crime of fraud against the Administration, the crime of documentary falsification committed by a public official, the crime of money laundering, the crime of professional disloyalty committed by a lawyer or solicitor, the crime related to a group or criminal organization, without prejudice to a more exact and subsequent qualification".
