Petro’s Political Police Kept a Wanted Hacker Employed

This post is also available in:

A fugitive on the spy agency’s payroll

On Friday, November 6, the Gaula Militar (the army anti-extortion unit) and the CTI (Cuerpo Técnico de Investigación) of the Fiscalía (Attorney General’s Office) arrested Carlos Andrés Oyola Tovar, 36, a systems engineer, in Neiva.

Oyola had been a fugitive for six months. He was still an active official of the Dirección Nacional de Inteligencia (DNI), Colombia’s civilian intelligence agency, with the rank of “gestor de inteligencia máster” (senior intelligence officer).

The warrant was for a fraud case at the Open and Distance National University (UNAD, from its initials in Spanish), not for the elections.

But the arrest came while his name was circulating in the gravest allegation of the year: that from inside the DNI, Oyola led a network meant to change the result of the June 21 presidential runoff.

The charges he faces are conspiracy, abusive access to computer systems, forgery of public documents and procedural fraud. At his first hearing, on November 9, he did not accept them.

Two definitions before the story.

The DNI was created in 2011 to replace the DAS (Departamento Administrativo de Seguridad), the agency dissolved after the wiretapping scandal of the Uribe years. It is an administrative department attached to the Presidency, and its director answers directly to the president.

The Colombian DNI shares its initials with the U.S. Director of National Intelligence and nothing else. They are not to be confused with each other.

The Registraduría Nacional del Estado Civil (National Civil Registry) issues the identity cards, organizes the elections, counts the votes and publishes the preliminary count that the country sees on election night.

An attack on the Registraduría is an attack on the count itself.

What the DNI’s own papers say

The accusation does not come from the opposition. It comes from the agency itself.

On Sunday, November 8, the investigative unit of Noticias Caracol revealed two internal documents: a 26-page transition report dated July 2026, addressed to the incoming director and built on information from DNI officials and a human source, and a report sent by the DNI to the Presidency in September 2026.

About Oyola, the transition report says: “He leads the network that would do the work to change the results of the June 21 vote; with other members they would carry out the [hacker] attacks against the Registraduría.”

Read that sentence twice. It was not written by a journalist or by the opposition; it was written inside the DNI, and the newspapers El Tiempo and El País and the magazine Semana have each reproduced it word for word. Everything that follows in this article depends on it.

The same papers say he coordinated “digital activists, bodegueros and hackers.” Bodegas are the paid social-media networks that push a government’s message and attack its critics.

These very same papers also say he broke into the systems of other state entities so that the DNI’s counterintelligence area could consult their databases, stored that information in a cloud and then lost it.

They describe Decree 0563 of June 3, 2026, signed by Petro’s government less than three weeks before the runoff, which put the DNI in charge of assigning the protection vehicles of former presidents and vice presidents; a human source told the agency the purpose was to fit those cars with microphones and GPS.

These internal documents also mention a house near the U.S. Embassy that operated as an unregistered DNI facility and was emptied after the election, and devices brought back from a training trip to Moscow with Russia’s foreign intelligence service, the SVR, that may carry malware.

Every one of these items is an allegation written by intelligence officers; none is a court finding.

Caracol asked the former presidents and the last two DNI directors under Petro, that is, René Guarín and Jorge Lemus, for comment before airing, and got none.

Since then Lemus has told El Tiempo that Oyola was hired in February 2024 under director Manuel Alberto Casanova, that he was already there when Lemus took over, and that he had no part in Decree 0563.

Attorney General Luz Adriana Camargo has answered Caracol about a note in the report that mentions meetings with Oyola.

And finally an “unnamed” official of the Petro government has also spoken to El Tiempo; we return to him below.

The audit that found a political police

The Caracol papers confirmed a pattern already documented.

On October 3, 2026, the Colombian magazine Semana published the findings of a forensic audit ordered by President Abelardo de la Espriella in his first days in office. The auditors reviewed 147 terabytes of information, plus computers and phones, now under chain of custody for the Fiscalía.

Their conclusion gave this article its name: under Petro the DNI “became a political police.”

The audit found interceptions of opposition communications, surveillance of opponents, journalists and officials, and a pattern in which a false threat was invented to assign a protection detail to the supposed victim and collect information about that person.

It found that at least half of the people hired by the agency during the previous government lacked the qualifications for the job.

And it also found that much of the agency’s reserved spending, the secret funds that intelligence services use without normal controls, could not be traced; at least 350 million pesos, about 108,000 dollars, went to missions unrelated to the agency’s purpose.

The political reaction followed the facts.

Former senator María Fernanda Cabal wrote that they “put intelligence at the service of power.”

Senator Juan Caicedo of Centro Democrático said on November 9 that the puzzle was nearly complete: they “turned the DNI into a political police, typical of the worst dictatorships,” he wrote.

Juan Carlos Restrepo, a former national security adviser and former inspector of the DNI, told Caracol that DNI officials were “clearly acting outside the framework of competences and outside the field of action of the DNI.”

The transition report itself says that an intelligence agency “has no technical reason to assign protection vehicles, unless the objective is control and intelligence over the people protected.”

Former president Álvaro Uribe called the investigation “very serious.”

Who hired Oyola, and who kept him

His record was public before the DNI hired him.

In 2018 he was a legislative aide to Rodrigo Villalba, today the governor of Huila.

In 2022 he and his twin brother, Cristian, were reported to the Fiscalía in Neiva for an attempted computer fraud; the case did not advance.

In October 2022 he signed a contract with the Contraloría (Comptroller General’s Office) using a specialization whose degree is dated November 25, 2022, one month after the signature.

In June 2023 the UNAD found that his academic record had been altered to obtain that specialization and to advance in a master’s degree.

In February 2024 the DNI hired him anyway, under director Manuel Alberto Casanova, as Lemus himself told El Tiempo. According to the agency’s own report, the director of counterintelligence later placed him at the disposal of Lemus, who moved him to the technology group.

An honest man does not hack his own university. Whether or not the DNI knew that in February 2024, it is clear now that he should not have been hired, and his case gives weight to the audit’s finding that at least half of the agency’s hires lacked the qualifications for their jobs.

If qualifications were not the criterion, what was? We do not know, and we will not guess, but the question is still legitimate.

On May 7, 2026, a judge ordered his arrest.

Hours before the first round on May 31, 2026, the CTI raided an apartment that served as a covert DNI workplace; Oyola left before the agents arrived and abandoned computers and phones there.

Nobody has established who warned him.

For six more months the agency kept him employed.

El Colombiano counted five occasions on which the Petro government allegedly protected him: he was moved instead of fired after losing the databases, he was then trusted with the new version of the agency’s most sensitive system (the SIIC), he stayed on the payroll after the warrant, he was gone before the raid, and he kept working through the election while wanted.

The SIIC, the Integrated Intelligence and Counterintelligence System (Sistema Integrado de Inteligencia y Contrainteligencia), is the platform where every mission of the agency should be recorded, and only the president, the vice president, the defense minister, the intelligence chiefs and the agency’s inspector may see it in full.

In September, already under the new government, the DNI reported to President De la Espriella’s office that Oyola had been developing version 2 of the system, that he never delivered it, and that the computer he used “was stolen.”

No denuncia was filed with the Fiscalía, which in Colombia is where a theft is reported. In plain words, there is no police report for a computer that held the development of the state’s most restricted intelligence system.

El Tiempo, citing reserved documents and forensic audits, reported that he allegedly extracted a mirror copy of that system. The “unnamed” official of the Petro government conceded to El Tiempo that Oyola “did have access to the secret missions of the DNI.”

That concession sharpens three questions.

Why would a man who already held credentials inside the agency need to break or hack into anything, instead of requesting data through the proper channels?

Why was no denuncia filed for a stolen computer holding top national security material?

And why did a recent hire with a hacking complaint and a fraud case receive access to a system that only the president and a handful of the highest officials of the state may see in full?

Here we offer a reasonable inference, not a fact.

An agency that wants data from another agency asks for it, and the request leaves a record. Breaking in leaves none, and in this case the data “got lost,” the system was “never delivered,” and the computer “was stolen.”

Three missing pieces make a pattern.

The allegations that remain allegations

Honesty requires a clear limit here.

On November 8 the portal Chivas y Crónicas, run by the veteran journalist Melquisedec Torres, published what he described as the account of an intelligence source: that the plan was to alter figures in favor of Iván Cepeda, that Oyola had access to Registraduría systems since 2022, and that the Barranquilla businessman Euclides Torres was a possible financier.

In his own post, Melquisedec Torres added that the work would be done “with the support of a Cuban, Russian and Venezuelan team” and that someone called “alias Aureliano” coordinated the strategy “from the Casa de Nariño” (Colombia’s presidential palace).

Two facts around that account can be safely stated.

Aureliano was Petro’s alias in the M-19, the guerrilla group that stormed Colombia’s Palace of Justice in 1985, an attack that left more than 90 dead, including 11 Supreme Court justices. The group demobilized in 1990.

Euclides Torres is under investigation for the irregular financing of Petro’s 2022 campaign, and the United States revoked his visa on September 28, 2026.

Everything else in that account rests on a single anonymous source and must be read as such.

Reports also differ on a Madrid connection, so we leave it out. And nobody, including the authors of the DNI report, claims that the vote was actually changed. The allegation is about a plan.

The reactions, and one silence

Iván Cepeda, the Pacto Histórico senator and Petro’s ally who lost the June 21 runoff to De la Espriella, answered on November 9.

The accusations, he wrote, “seek to disqualify the result” and to cast doubt on the large vote of the Pacto Histórico; there is “no evidentiary support” that a DNI official took part in a plan to manipulate the election; and the Registraduría “has ruled out, again and again, any intrusion or hacking that manipulated the electoral result.”

The last point is true and does not answer the accusation: nobody says the hack succeeded. The documents say it was planned.

Petro had said nothing as of the date of this publication.

The “unnamed” official of the Petro government told El Tiempo that the DNI “did not buy a single vehicle” for former presidents, because “there was neither time nor money.”

Nobody said it had. The report says the decree placed the DNI in charge of assigning existing vehicles, and that the plan was to fit them. On the microphones and the GPS, as far as El Tiempo reports, he said nothing.

Vice President José Manuel Restrepo asked for a full investigation.

Centro Democrático wrote: “Nothing surprises anymore about the degradation of the Petro government.”

Congressman Daniel Briceño chose sarcasm: Cepeda, he wrote, “is so bad that not even with all the power of the State,” the contractors, the public money and “a hacker from the DNI ready to manipulate the Registraduría’s software” could he manage to win.

Senator Andrés Forero asked Attorney General Luz Adriana Camargo to explain the meetings with Oyola that the DNI report records, and El Tiempo reports an inquiry into whether someone inside the Fiscalía leaked reserved data to him.

The Contraloría ordered a priority review of five DNI contracts worth 20,783 million pesos, about 6.4 million dollars, among them a 9,000 million peso unmanned helicopter, about 2.8 million dollars, that crashed in March.

The Procuraduría (Inspector General’s Office) is also investigating Lemus separately.

What the facts allow us to conclude

In our view, three things are established by the state’s own papers.

First, Petro’s political police, as the audit called it, hired a man with a fraud record, gave him access to its most sensitive system and kept him employed for six months while a judge wanted him in jail.

Second, that agency’s own staff wrote that he led a network to change the result of the runoff. Of everything in this story, that is the part that should frighten every Colombian, whatever his politics, because a government that will tamper with the vote count will tamper with anything.

Third, an audit ordered by the new government found the same agency spying on the opposition.

Yet, to be clear, two things are not established: that Petro gave an order, and that a single vote was altered.

It did not happen. The votes were counted, the result stood, and Cepeda conceded before the official count ended.

Why we believe the plan failed: the May warrant and the May 31 raid scattered the network before the runoff, the Registraduría’s systems held, and Colombia’s legal result rests on paper tally sheets recounted by judges, not on election-night software.

Perhaps other nations have one or two things to learn from Colombia about counting votes.

And yet, the danger was there. A plan that fails is still a plan, and between what is established and what is not sits political responsibility.

The DNI answered to Petro. Decree 0563 was his government’s. Six months of protection for a fugitive are not a clerical accident; they are decisions, taken by people who answer to the director, who answers to the president.

Readers may judge the decree for themselves: whether a president who treated his predecessors as enemies suddenly wanted them safer, or wanted to listen in on them.

And there is June 1, 2026. The morning after the first round, Petro refused to accept the preliminary count: “As president I do not accept the preconteo (preliminary count) results of the private firm of the Bautista brothers.”

He was accusing the Registraduría of unreliable software while, according to his own agency’s papers, that agency was planning to attack the same software.

For years the Left wrote one question as graffiti on Colombia’s walls about the Uribe years: “¿Quién dio la orden?”, who gave the order. The question now belongs to Petro.

Scripture warned every government that keeps files: “For there is nothing covered, that shall not be revealed; neither hid, that shall not be known” (Luke 12:2, KJV).

Reports written for the next director have a way of becoming exactly that.

Why this matters in the United States

For American conservatives the integrity of a vote count is not an abstraction.

Since 2020, documented irregularities and individual fraud convictions have kept election integrity at the center of the conservative agenda, whatever one concludes about their scale.

Petro’s political police is what that concern looks like when the state itself runs the operation: a hacker hired by the government and aimed at the agency that counts the votes.

Colombia is also one of the closest security partners the United States has in South America, and the president in the Casa de Nariño decides how much cooperation the U.S. government gets on trade, on extraditions and on the war against drugs.

The Trump administration decertified Colombia as a drug-war partner in September 2025, revoked Petro’s visa that same month after he urged American soldiers to disobey their commander in chief, and sanctioned him through the Treasury in October 2025.

The DNI papers now suggest that the same government was sending its spies to be trained by Russia’s SVR and bringing back suspect devices.

Critics called Washington’s hard line on Petro a personal grudge. The DNI papers make it look like good judgment.

De la Espriella ordered the audit in his first days in office and placed 147 terabytes under chain of custody for the prosecutors. That is the partner the United States has now.

Truth is patient, and it always arrives.

Stay connected via Google News

Follow us for the latest travel updates and guides.