On May 2, the Mexican government arrested Dámaso López Núñez, the purported heir to the Sinaloa cartel, one of the world's most powerful organized crime groups. Authorities hadn't seen so much as a picture of López Núñez in 15 years, but were able to track down and arrest him after seeing him in a video captured secretly by a man using a rigged Android smartphone.
Mexican media has since reported that the man, who has been described as a "hacker" and risked his life by betraying López Núñez, is "being protected" in the United States. In reality, the hacker is not in the US, but rather still in Mexico.
Speaking from an undisclosed location, which he claims he hasn't left in days, the hacker told Motherboard he's worried about the cartel trying to avenge the arrest of López Núñez—his one-time employer. He also feels abandoned by the Mexican government. Last year, according to the hacker, officials offered him protection and $1.5 million USD—the same bounty Mexico put on infamous Sinaloa boss Joaquín "El Chapo" Guzmán—if he helped nab López Núñez. But he says he's stuck in a sort of purgatory, in light of unfulfilled promises of protection Mexican officials made to him in exchange for providing the video.
"They didn't catch [López Núñez]," the man, who requested anonymity to protect his safety, said in a video call. "I caught him. I cornered him, exposed him and I recorded his face, otherwise they had no idea who they were going after."
US federal prosecutors indicted López Núñez on drug trafficking and money laundering charges in 2013, alleging his criminal activities under Chapo amounted to proceeds of $280 million. Also known as "El Licenciado" or the Graduate, an apparent nod to a law background that includes a stint working for the Sinaloa state prosecutor's office, López Núñez was set to take the reins of one of the largest drug cartels in the world. In February, he allegedly carried out an unsuccessful attempt at killing two of Chapo's sons and Ismael "El Mayo" Zambada, the leader of another faction of the Sinaloa cartel.
"They didn't catch him. I caught him. I cornered him, exposed him and I recorded his face."
The first photograph of López Núñez came out that month, when a Mexican journalist published a screengrab from the then-unpublished video. Then, on April 24, just eight days before the arrest, another reporter published the leaked video. According to the reporter who obtained the footage, it was recorded by "a hacker" who's now living in the United States, under government protection.
"The Mexican government offered him protection and a reward," an agent who works closely with the Mexican government forces that organize high-profile arrests and investigations told Motherboard. "A very good one," added the agent, who requested anonymity due to the sensitivity of the matter.
But now the hacker feels the Mexican government isn't doing enough to help him.
"That's how the [Mexican] federal government works," he said. "They use people and then they let them die, or they kill them, or they disappear."
Motherboard reviewed the whole, unedited version of the video, which was recorded in July of 2016, and includes several clear shots of the face of the man who was holding the phone. Motherboard conducted multiple video calls with the hacker and was able to visually confirm he was the same person who appeared in the video. We also verified that he is indeed still in Mexico.
Reached by phone on Wednesday, a representative in the Mexican Office of the Attorney General (PGR) said he wasn't authorized to answers questions or release a statement on the record, and asked Motherboard to send questions electronically. The PGR did not immediately respond to a series of detailed questions sent over email.
The hacker claims the López Núñez family reached out to him in 2014, asking for help in trying to figure out if there was a way to hack into the networks of the high-security Altiplano Federal Penitentiary, where Guzmán was being held at the time, and later escaped.
In June of 2016, the hacker says López Núñez asked him to mount a fake viral social media campaign to discredit the "Chapitos"—Guzmán's four sons. The Mexican government source who spoke anonymously with Motherboard confirmed that the hacker was hired to manage what he defined as "a dirty campaign against the Chapo family." The hacker also provided some evidence supporting this claim, such as screenshots of fake blog posts spread through Facebook, including one showing the Facebook admin console of the page.
"The Mexican government offered him protection and a reward. A very good one."
The Chapitos were then feuding with López Núñez in a Game of Thrones-style power struggle for the control of the cartel. But, unbeknownst to the cartel boss, the hacker says he was working with the Mexican government on a secret mission to help capture López Núñez, who was quickly becoming a prominent figure in Mexico's criminal underworld after Guzmán's re-arrest and extradition to the US.
On June 16, 2016, the hacker sent an email to the PGR offering "fresh and important information to capture Dámaso López Núñez alias el Licenciado." The hacker later sent an attachment titled "Damaso Data," which he says contained screenshots of the social media campaign he was running for López Núñez, as well as GPS data about his own whereabouts. And, a day later, a PGR employee responded saying they acknowledged receipt, according to copies of the emails provided by the hacker to Motherboard.
Less than a month later, on July 14, 2016, the hacker says he was able to arrange a meeting with López Núñez at a seafood restaurant in Mexico City. During the meal, the man showed López Núñez some pictures on his phone. In the 32-second long video, López Núñez can be seen eating a tortilla, glancing at the phone, and at the hacker.
In the meantime, according to the hacker, a spyware app called Spy Camera OS was recording from the cell phone's front-facing camera, capturing López Núñez's face.
The hacker didn't just record video of the lunch meeting though. After walking out with López Núñez, the hacker took note of their exact location, in an attempt to help authorities find security camera footage. In a video file the hacker shared with Motherboard, he can be heard explaining to the authorities where López Núñez's car was parked. According to the Mexican government source who spoke with Motherboard, in addition to providing the video, the hacker also helped find López Núñez's vehicle.
A week later, on July 21, the hacker says he sent the video to the authorities over the encrypted file-sharing service Mega.
Nine months later, after the video leaked, those shots of the boss' face splashed across Mexican media. López Núñez again ended up in the news a few days later, this time looking a tad more worn-down, with a scruff, and in handcuffs.
"That video was extremely important to capture Dámaso [López Núñez]," the Mexican government agent said. "I would go as far as to say that was vital."
The agent added that it would have been "impossible" to arrest the boss without the picture and a description of the kind of car López Núñez used to go to the restaurant. "We needed that picture," added the agent.
In the deadly, shifting patchwork of Mexican organized crime, hackers and other information technology specialists working on behalf of cartels are increasingly taking a larger, more significant role. It's the cyber-militarization of the drug wars. In northeastern Mexico in 2015, for example, a cartel kidnapped an IT specialist and forced him to help run the gang's hidden radio network.
The Mexican government is no stranger to hacking either. Mexican law enforcement and intelligence agencies have spent millions of dollars on hacking and surveillance tools from private contractors such as Hacking Team and NSO Group, targeting criminals as well as journalists. And it's not just spyware. Twitter bots, trolls, and social media disinformation campaigns have taken a prominent role in Mexico's democratic process.
In this case, a computer geek who used to do IT work for the cartels played a key role in the government's capture of a drug kingpin. The exact nature of his collaboration with the Mexican government, as well as the status of the deal he made with the authorities for providing the video is still unclear. We will update the story if and when we hear back from the authorities.
"You don't know how corrupt the federal government is and how many people they have killed to get what they want," he said.
These aren't baseless suspicions in a country where 98 percent of murders go unresolved—and where protected witnesses have been killed. In 2011, a Mexican federal judge found two PGR agents guilty of killing Enrique Bayardo del Villar, a high-profile protected witness who was collaborating in an investigation into alleged ties between the Sinaloa cartel and high-ranking officials with the PGR's organized-crime division. Del Villar was gunned down in broad daylight in a Mexico City cafe.
For now, the hacker hopes that by shining a light on his story, and his current predicament, he will get the reward and the protection he says he was promised. Or, at the very least, someone will start looking out for him and his loved ones.
"The only thing I'm looking for is for some way to save my family," he said. "I'm doing it for the life of my family."
Oscar Balderas and Laura Woldenberg contributed reporting from Mexico City. Camilo Salas contributed research.