The Gravediggers: How Eliminalia, a Spanish reputation management firm, buries the truth

In August 2018, Daniel Sánchez, a Mexican investigative journalist, began receiving peculiar calls and texts about a recent article he’d published. The messages, which according to Sánchez, came weekly, were from individuals claiming to be lawyers who asked him to take down his article.

Sánchez is a journalist at Página 66, a small investigative news outlet in Mexico’s southern Campeche state. In January 2018, Sánchez published an investigation into the bad track record of a video surveillance company, Interconecta, that the state’s governor had contracted. Sifting through financial audit records, Sánchez discovered that the company, a subsidiary of the tech multinational Grupo Altavista, had been linked to cases of corruption and tax fraud.

About two years after Sánchez’s article was published, he received an even stranger request. Sent by a supposed local marketing expert calling himself Humberto Herrera Rincon Gallardo, the email claimed Sanchez’s article infringed upon a European data law called GDPR and asked him to remove references to Grupo Altavista and its founder Ricardo Orrantia. The email was signed by the Compliance Department of the European Union.

Sánchez, perplexed, consulted Artículo 19, a press freedom organization, that advised him not to remove the piece.

But a month later, Gallardo was back. This time, he tried a new strategy: a copyright infringement claim. In January 2020, Gallardo filed a DMCA abuse claim with Digital Ocean, Pagina 66’s US-based hosting provider. The claim alleged that Sánchez had copied his content illegally. As proof of his claim, Gallardo linked to a third-party site that had published a replica of Sánchez’s piece, but with a falsified earlier publish date and fake author: Humberto Herrera Rincón Gallardo.

This time, the strategy worked. Digital Ocean ordered Sánchez to remove his article from Página 66’s site, or it would go black. He appealed to Digital Ocean but was unsuccessful. Finally, fearing he would lose his readership, and his livelihood as a journalist, he capitulated and removed the piece. (Digital Ocean did not respond to requests for comment.)

In Mexico, one of the most dangerous countries for journalists, copyright claims didn’t seem as drastic as the threats Sánchez’s colleagues had endured – but the result was the same, he said. “It means there is a form of subtle censorship,” Sanchez said in an interview with Forbidden Stories.

But this campaign, it turns out, wasn’t the work of local lawyers or marketing experts. According to documents obtained by Forbidden Stories, Grupo Altavista hired Eliminalia – a Spanish reputation management company that offers private clients content-deletion services – to remove dozens of articles linked to the company and founder’s name, including Sanchez’s.

Gallardo, the marketing expert whose name appears on the DMCA complaint, denied having ever been “an employee of Eliminalia or of any company related to Eliminalia.” He told Forbidden Stories, “the use of my name in the case brought against the Pagina66 portal was completely improper and without my knowledge or consent,” he said.

Sánchez was one of hundreds of journalists, bloggers and newsrooms worldwide whose work was deleted, modified or hidden from the internet between 2015 and 2021 by Eliminalia, Forbidden Stories and its partners found.

Eliminalia claims its services remove “unwanted and erroneous information” for clients with a “right to be forgotten,” but nearly 50,000 internal company documents leaked to Forbidden Stories contradict this narrative. The files show how Eliminalia worked for scammers, spyware companies, torturers, convicted criminals, corrupt politicians, and other members of the global underworld to hide public-interest information. Previous reporting, including by Rest of World, identified some of Eliminalia’s clients – but this leak, which also includes confidential emails, client names, contracts and other legal documents – gives a fuller understanding of the opaque company’s operations.

Eliminalia declined our requests for comment. In a letter to Forbidden Stories, a French law firm representing Eliminalia wrote that a one-week deadline to respond to our questions was “far too short for a real respect of the adversarial process,” and that most “questions demonstrate a partial and dishonorable approach,” and “concern business secrecy.” (Forbidden Stories extended the deadline by one week but did not hear back from the company.) Forbidden Stories and its partners also reached out to all of Eliminalia’s clients named in this piece, none of whom responded.

For six months, Forbidden Stories scrutinized the documents as part of the “Story Killers” project, a global investigation into disinformation mercenaries that stems from the work of assassinated Indian journalist Gauri Lankesh and involves 100 journalists from 30 media organizations. Through dozens of interviews with former employees, clients, data-protection experts and victims, Forbidden Stories and its partners investigated how this company manipulates online service providers, weaponizes copyright law to remove content, and in some cases threatens and abuses journalists, with one aim: burying the truth.

Forbidden Stories identified Eliminalia clients in 50 countries across five continents. The leak of around 1,500 current and former clients includes details of Eliminalia’s business dealings with a medical doctor who reportedly operated a torture center during Chile’s dictatorship and was found guilty of homicide; former bank officials at Banca Privada d’Andorra, accused of money laundering for corrupt Venezuelan officials; and a Brazilian businessman implicated in a global prostitution network, among others.

Forbidden Stories also investigated the sprawling business empire linked to Eliminalia’s founder Diego ‘Didac’ Sanchez. Spanish business records show that in 2020 and 2021, Eliminalia reported sales worth roughly €2.7 million. But our consortium found that Sanchez and his business partner José María Hill Prados also run some 90 companies globally, including a surrogacy company facing litigation for child trafficking.

A lucrative market

Back in Mexico, these documents show that in April 2019, Orrantia hired Eliminalia to request content removal in compliance with “current personal data protection legislation.” In total, Orrantia requested the removal of 13 news articles from Mexican outlets, including Sanchez’s, and three Google search result terms related to his and his wife’s names and Grupo Altavista. He paid more than €12,000 in four installments to Eliminalia.

Orrantia was one of over 150 Mexican clients in the leaked documents. Others include Pedro Miguel Haces Barba, a union leader who in 2019 was exposed for inking lucrative contracts with two governors later arrested for corruption, and Miguel Angel Colorado Cessa, brother of a Zetas Cartel drug trafficker.

Eliminalia’s clients paid handsomely to have their digital pasts removed. Haces Barba paid €110,000, requesting roughly 300 articles be removed from the internet. Romain Girbal, a French entrepreneur whose “responsible” mining company AMR Bauxite was accused of tax evasion in 2020, paid €155,000. Another client – an Israeli-Argentine banker accused of laundering money for Hugo Chávez’s regime – paid nearly €400,000.

Under Sanchez and Hill Prados, his business partner, Eliminalia also sought to establish itself in new markets. According to the company’s website, it has offices in more than a dozen countries, including Italy, Switzerland, Turkey and the US. In Latin America, Eliminalia has current or former offices in the Dominican Republic, Bolivia, Ecuador and Mexico.

Forbidden Stories identified multiple clients linked to organized crime, including Malchas Tetruashvili, who was convicted of laundering money on behalf of a member of the Russian mob, and José Mestré, a well-known Spanish businessman-turned-cocaine-trafficker.

“The legitimate uses for this kind of reputation management are few compared to the advantages for corrupt individuals,” Emma Briant, a research fellow at Bard College who studies information warfare, told Forbidden Stories. “There’s a lot of companies that specialize in that kind of thing. And I think it’s really damaging because very often it’s very difficult for people to actually locate reliable information because it’s just not visible anymore,” Briant said.

‘Chilling effect’

In November 2020, Tord Lundström, the technical director of Qurium, a Sweden-based nonprofit organization that provides security services, including web-hosting services for dozens of independent media outlets, opened an e-mail from a lawyer named Raul Soto. Soto claimed to represent the European Union Commission.

Lundström – a tech geek with a background in corporate data protection – found the email unusual and began inquiring. Conducting an internal investigation, Lundström traced the email to Eliminalia and mapped the company’s digital infrastructure. Soto, he found, was not a real person, but rather a pseudonym used by an Eliminalia employee based in Ukraine. “For us this was like, ‘Oh my God, this is a new power game because we cannot do anything about it,” he said, referring to the slippery tactics employed by this firm and others.

Lundström began to see a pattern emerge. At first, Eliminalia sent takedown requests to individual journalists. When journalists started pushing back, they went after hosting providers. If this didn’t work, they’d move to “deindexing,” a “black hat” marketing strategy aimed at fooling Google into hiding certain search terms from web results.

Data protection laws, Eliminalia and other firms realized, could be weaponized to remove content from the internet. Two data protection laws – the Digital Millennium Copyright Act (DMCA) and GDPR – were easily exploitable.

Passed in 1998, the DMCA revised US federal copyright law. A byproduct of the internet’s early days, its original intent was to facilitate the removal of copyrighted content that started appearing on torrent sites like The Pirate Bay and LimeWire in the years after, Adam Holland, Project Manager at Harvard’s Berkman Klein Center for Internet & Society, explained. The DMCA made it easier for companies like Disney to get copyright-infringing content taken down, Holland, speaking from a personal capacity, explained. They simply sent a copyright claim to the infringing website and requested it be deleted. If the offending site didn’t remove it, the company, as the rightful owner, could sue the website and the hosting provider of that website.

Reputation laundering firms like Eliminalia soon realized that this law could be advantageous. Their strategy was simple: copy an article, publish it on a third-party website – a blog or fake website – with a falsified earlier date than the original, and claim the original article infringed DMCA. “It’s much easier than going to court. It’s much easier than finding some [journalist] and hitting them with a wrench. We’ll just send a copyright notice,” Holland said.

In 2002, researchers, worried that the DMCA as it was written could be used to chill free speech, created a repository of DMCA takedowns, now the Lumen database. Lumen, which Holland runs, has amassed over 25 million takedown requests. They receive upwards of 7,000 per day, thanks to agreements with hosting providers.

Holland said the number of requests increased “rapidly and steadily” around 2012, for several reasons, including automation technologies that allowed for the mass filing of DMCA complaints. “I guarantee you that when they wrote the DMCA, they did not envision that there would be huge networks of eastern European bot armies creating fake newspaper websites to take down criticism,” he said.

According to Shreya Tewari, a research fellow at Harvard’s Berkman Klein Center who works on the Lumen project, fraudulent DMCAs are not always successful but are often used in combination with other threats to scare journalists into removing content. In one big-data study, she found that over 300 articles had been illegitimately removed from the internet using this tactic, which illustrates a “chilling effect.”

DMCA takedown requests were just one tool in a larger arsenal of tactics, Forbidden Stories found. Many leaked documents include takedown requests involving the GDPR. Eliminalia also attempted to hide information they couldn’t get deleted, like through deindexing.

“We actively fight fraudulent takedown attempts by using a combination of automated and human review to detect signals of abuse,” a Google spokesperson said, adding: “We provide extensive transparency about these removals to hold requesters accountable, and sites can file counter notifications for us to re-review if they believe content has been removed from our results in error.”

Typically, but not always, these DMCA and legal claims were sent by fake names, such as Raul Soto, and email addresses spoofing European or other legal institutions. (In a statement, a European Commission official said that “CERT-EU and the Commission are not aware of other domain names impersonating EU institutions and related to this particular case,” adding: “The existence of the domain name is not a violation, its use for false impersonation is.”)

New identities

In July 2022, the online message board for the Black Student Union at Quinsigamond Community College (QCC), in Massachusetts, started getting inundated with spam. Someone had posted a link with a brand logo on the forum’s open thread, and a guest account began replying to it erratically. In a matter of hours, the account had posted 7,000 comments.

These comments hid a digital atomic bomb. In each comment were hundreds of links known as “open redirects.” These links appear, at first sight, to drive traffic to legitimate websites, such as Stanford University or NASA. However, they are designed to instantly travel from these real sites to illegitimate sites, taking advantage of a flaw in website infrastructure.

It turns out, the thousands of comments in the Black Student Union forum were redirected to a network of fake websites created to launder the reputation of Eliminalia clients, Forbidden Stories found. In total, the guest account posted more than 2 million links. To Google’s algorithm, it would have appeared that the linked websites had suddenly received a spike in traffic. The algorithm, in turn, may have boosted them to the top of search results, which appears to have effectively hidden real results by pushing them lower in the rankings. (A Google spokesperson contended that generating backlinks did not guarantee improvement in search ranking.)

In October, QCC discovered and removed the rogue account and deleted the link from the message board, while also beefing up IT security. “It is incredibly disheartening that these online ‘fake actors’ can use reputable academic institutions such as QCC to help propagate misinformation. This goes against the essence of higher education, which values open dialogue, honesty, truth, and knowledge,” QCC President Luis G. Pedraja, Ph.D said in a statement to Forbidden Stories and its partners. “In today’s society, as technology gets more advanced, these nefarious companies find new ways to target the innocent.”

This strategy, at least for a time, worked. Suddenly, a search for Victor Bayona Viedma featured articles about his new poetry collection before accusations that he and another cop had allegedly tortured a detainee in Spain. Gabriel Hernan Westmann highlighted stories about a chihuahua expert, and not about a pilot accused of working with drug cartels. (All charges were later dropped). According to several highly-placed Google results, Andrea Formenti of the company Area S.P.A, invented a flip phone, not that this Italian company sold surveillance equipment to the Libyan government.

“If all you have to do is learn how to game Google and you can fix all of your reputation problems, that’s going to be a problem,” Katharine Trendacosta, associate director of policy and activism at the Electronic Frontier Foundation, said.

“While there are bad actors who attempt to manipulate search engine rankings, Google designs our systems to rank high-quality information at the top of search results and to fight spam and malicious behavior,” a Google spokesperson said in a statement to Forbidden Stories. “We go to great lengths to protect our search results from manipulation, and we’ve been successfully combating well-known spam tactics like link-spamming for years.”

Qurium’s research identified 622 websites that Eliminalia appeared to use to launder the reputation of its clients, which it shared exclusively with the consortium. These websites, with names like CNN News Today, London Uncensored, Mayday Washington and Taiwan Times, were set up by an offshore company called Communication Media Group. Qurium was able to link this company to Maidan Holdings, the Miami-based holding company that owns Eliminalia. (The websites share IP infrastructure and other technical elements, such as copyright pages, suggesting they were set up by the same individual or group.)

Analyzing the content of these websites, Qurium identified around 3,350 articles naming Eliminalia clients, typically portraying them positively. To make the websites appear authentic, Eliminalia also posted content that is copyrighted by legitimate media outlets. “It’s a bit despairing,” said Léna Corot, a former journalist at the French tech website Usine Digital, whose article was copied and published on one of these fake sites – lemonde-france.fr.

Qurium’s technical research aligns with the consortium’s reporting, which found that Eliminalia proposed fake article placement to clients.

In a 2019 email obtained by Forbidden Stories and its partners, an Eliminalia employee told a client that the firm planned to publish “neutral or positive” articles about an imagined persona — portrayed as distinguished in his profession — who had the same name as the client. The employee wrote that he expected the proposed articles would end up in the top search results for the client’s name.

“This is a nice new definition of censorship,” Lundström said.

Going global

In his 2016 autobiography, “Secret of Success,” Eliminalia founder Didac Sanchez recounts his mantra: “Think big and you will be big.”

In the years since he founded Eliminalia in 2013, Sanchez followed his own advice, establishing a web-like, global network of companies. Reviewing financial filings, Forbidden Stories and its partners identified roughly 90 companies across 9 jurisdictions connected to Sanchez and the family of his business partner Hill Prados. Most of these companies are registered under Maidan Holdings, the Miami holding company. Several Maidan companies, including World Intelligence Ltd and World Reputation, also offered political-consulting services, according to past reporting and archived web pages.

In an undercover operation, Colombian journalists at La FM – who are not a part of this project – found that Eliminalia was offering to run political campaigns in Colombia, Ecuador and the Dominican Republic through one of their subsidiaries. Several sources alleged to Forbidden Stories and its partners that Eliminalia had also engaged in hacking, but these claims could not be verified.

Not all of Sanchez and Hill Prados’s companies operated in the reputation management space. Subrogalia Ukraine and PP Interfiv Ltd., two surrogacy companies owned by Sanchez and Hill Prados, were investigated by authorities in Ukraine for child trafficking, Forbidden Stories found. Despite these allegations, Eliminalia continued to expand during the pandemic, opening operations in Ukraine. (When Russia invaded Ukraine in February 2022, the company moved its headquarters to Tbilisi, Georgia.)

Experts who spoke with Forbidden Stories said that while Eliminalia is not the only firm in the reputation management industry, it is perhaps one of the most established. “They’re clearly an old and sophisticated player in the space. They’ve been doing this for some time,” Holland, at Lumen, said.

But as Eliminalia has grown, so too has the market for reputation management. “You have a whole series of professional service industries, such as public relations agents, lobbyists, lawyers…who basically help in this rebranding of unsavory individuals and companies and governments, into internationally respected businesspeople and philanthropic cosmopolitans,” Tena Prelec, a researcher at Oxford University who studies reputation laundering, said.

For many journalists and press freedom advocates who spoke with Forbidden Stories, holding these actors accountable often felt like a Sisyphean task.

In the days after his article was taken down, Sánchez, at Página 66, investigated legal avenues to restore his content. He contacted Artículo 19 and Media Defence, a press freedom organization based in the UK.

Reversing a fraudulent DMCA is not easy, though. You first need to file a “counter-notice.” These claims can lead to protracted legal battles, which can be expensive and time-consuming. Sánchez would need to appear in a court in Arizona, a cost that neither he nor the organizations could afford. “If we had the legal support, we would go ahead,” Sánchez said. “That’s what we want: for the information to stay on the page.”

Even if he won the case and got the article back up, the only recompense he would receive for his lost time under the DMCA would be his legal fees.

A final disappearing act

Since Forbidden Stories reached out to Eliminalia for comment a few weeks ago, it seems to have deleted its own internet trail. In January, the same fake news sites Forbidden Stories and Qurium linked to Maidan Holdings–perhaps created to polish the reputation of Eliminalia’s clients–had been modified. Scouring the rebranded websites, though, we found a link: one of the new copyright pages was tied to Mariia Ladovchyna, Eliminalia’s technical manager. While this trace is insufficient to tie the entire network of fake sites to Eliminalia, it suggests the company may have played a role in their set-up.

Then, roughly a month before our publication, Eliminalia appears to have committed its final act – it, too, changed identities. Today, the door of the Barcelona coworking office that once hosted Eliminalia now reads “Idata Protection.” Company filings reviewed by Forbidden Stories confirm the rebrand, possibly resulting from investigations by journalists and researchers that generated negative press. But when two members of the consortium visited the office, an employee said, “the company is called Idata Protection, but we belong to Eliminalia.” Sanchez, the founder, was no longer in Barcelona, according to the employee.

The rebrand is consistent with the company’s history. Eliminalia is an expert in “creating problems and then solving them,” a source with knowledge of the company told a member of the consortium. – Rappler.com

Read Part 1 here.

Read Part 2 here.

Read Part 3 here.

Read Part 4 here.

Read Part 5 here.

This article has been republished from Forbidden Stories with permission.