Exposed documents reveal how the powerful clean up their digital past using a reputation laundering firm

In February 2021, Qurium, an organization that provides secure web hosting services for human rights organizations and independent news outlets, received a rambling message from someone whose email signature indicated they were in the legal department of the European Commission. 

Writing in dense legalese, the representative, “Raúl Soto,” demanded that Qurium take action on articles from a Kenyan-based investigative journalism website that it hosts, The Elephant. The articles in question included an investigation into alleged corruption, but Soto’s email wasn’t about the allegations. Rather, he claimed that the piece had infringed the European Union’s General Data Protection Regulation (GDPR), which governs personal data collection and storage in Europe. 

Qurium’s staff were suspicious. A brief investigation revealed that the street address in Soto’s signature was not, in fact, that of the European Commission; rather, it was a rented office space in Brussels. Using a publicly available database, they found that complaints were filed to search engines around the same time, claiming that The Elephant article was plagiarized and requesting that the piece be removed and de-indexed from searches — meaning it wouldn’t show up on the first few pages of search engine results. 

Qurium traced the domain used in Soto’s email to a reputation management company called Eliminalia, registered in 2013 by a Spanish entrepreneur named Diego “Dídac” Sánchez and headquartered in Barcelona and Kyiv. Eliminalia specializes in removing information from the internet; its tagline is “We Erase Your Past, We Help You Build Your Future” and it promises “100% confidentiality.”

Now, documents viewed by Rest of World shed light on the reputation management industry, revealing how Eliminalia and companies like it may use spurious copyright claims and fake legal notices to remove and obscure articles linking clients to allegations of tax avoidance, corruption, and drug trafficking. The Elephant case may be one of thousands just like it. 

Metadata, file names, and the inclusion of internal company information, including contact details and references to company policies, suggest the documents originated from within Eliminalia. Alongside names referred to as clients, the documents include URLs that were to be removed or de-indexed on their behalf. Rest of World spoke to several people and media organizations who ran websites listed in the documents and confirmed that they had been approached by people linked to, or directly employed by, Eliminalia. 

Among the thousands of names listed as clients in the documents are the former foreign minister of the Dominican Republic, an individual indicted in Argentina for his role in a cryptocurrency pyramid scheme, and people accused of corruption worldwide, all apparently looking to erase information about themselves from the internet. There are 17,000 URLs that were apparently targeted on clients’ behalf between 2015 and 2019. In at least one case, it appears that Eliminalia may have been hired by a third party reputation managment firm on behalf of a client. It is unclear whether the list represents the entirety of the company’s clients, but it includes individuals and companies from Latin America, Europe, the Middle East, and Africa, and shows the extent to which services of this kind have become a way for wealthy and powerful individuals to control information on the internet.

Magalis Camellón, head of Eliminalia’s legal department, said in an email that the company had “no contractual relationship” with any of the people named in this story, and that “Unfortunately, competitors carry out incorrect actions (DMCA) on behalf of Eliminalia and thus try to tarnish the reputation of our company.”  The Digital Millennium Copyright Act, or DMCA, is a piece of U.S. legislation designed to prevent copyright theft online which can be used to issue takedown requests. Camellón declined to provide further details. 

Some of the people who appeared in the documents are private individuals who apparently sought to have explicit videos removed from pornographic websites. But the most prolific users of the service appear to be businesspeople and politicians targeting critical articles. 

An Eliminalia client agreement from 2021, seen by Rest of World, shows that the company charged 2,500 euros ($2,800) for the removal or de-indexing of each link. In a 2016 interview, Sánchez said that his firm charges some high-profile clients and businesses a premium rate of around $20,000-$30,000. The documents apparently show some clients targeting hundreds of articles and pages.

Among the names listed in the documents is “Miguel Octavio Vargas Maldonado,” who appears to be the former foreign affairs minister of the Dominican Republic. His name is listed next to more than 500 links to news articles, blogs, social media posts, and YouTube videos apparently targeted for removal or de-indexing. Many are articles referring to questions over his political fundraising practices. They include accusations that Vargas had received donations from an individual who would later be convicted of drug trafficking. Some of the targeted links remain active, while others now return 404 errors or “file not found.” Maldonado could not be reached for comment. Emails to his political party bounced back, and its website is currently down. He has previously denied all wrongdoing while in office.

The documents also include an individual referred to as “José Antonio Gordo Valero,” who apparently targeted several articles for removal or de-indexing which refer to the collapse of OneCoin, a Bulgaria-based company later revealed to be an illicit investment scheme. OneCoin drew in investors by pretending to offer them access to a high-return cryptocurrency, reportedly raising $4 billion before being exposed as a fraud. The company’s founder, Ruja Ignatova, disappeared sometime around 2017 but was charged in absentia for money laundering, wire fraud, and conspiracy to commit securities fraud in the U.S.

An entrepreneur named José Gordo joined OneCoin in 2015 and has been named in an indictment for the OneCoin scam in Argentina. The articles listed next to Gordo’s name in the documents reviewed by Rest of World include references to his role at the company. Gordo did not respond to multiple requests for comment.

Other names in the documents include “Diego Adolfo Marynberg,” who appears to be the same Marynberg connected to funding right-wing causes, including settlement efforts in Israel. Reports also alleged that his company received preferential treatment in the acquisition of Argentinian bonds worth millions of dollars. More than 70 URLs appear next to Marynberg’s name in the documents, including pages from the Israeli newspapers The Times of Israel and Haaretz as well as Clarin, one of Argentina’s biggest news sites. Marynberg did not respond to a request for comment, and a message sent to one of his funds, headquartered in the Cayman Islands, went unanswered.

The documents also include many links related to stories about Venezuela. Among the names in the documents was “Majed Khalid Majzoub.” Based on analysis of the stories that were targeted, this appears to be a misspelling of Majed Khalil Majzoub, an influential businessman with close ties to several governments, including the administration of Venezuelan president Nicolás Maduro. Majzoub’s name appears next to more than 180 URLs, mostly from independent outlets. Of the two URLs that pointed to articles from Germany’s Der Spiegel, one now returns an error message; the other, which appears to refer to relations between Venezuela and Colombia, directs to an unrelated story about Brexit. Majzoub could not be reached for comment. Der Spiegel did not respond to a request for comment.

One outlet targeted repeatedly according to the documents is Infodio.com, a site run by the London-based Venezuelan investigative journalist Alek Boyd. Boyd told Rest of World that he has on several occasions been targeted by false claims under the DMCA and received messages from PR and public affairs companies threatening him with legal action. He told Rest of World that he has been contacted on at least two occasions by people using Eliminalia email addresses and identifying themselves as employees of the firm, who attempted to get him to take down content. 

Eliminalia’s presence in Venezuela has previously raised concerns among free expression organizations. Freedom House’s 2017 Freedom on the Net report for the country warned that Eliminalia had been implicated in trying to “clean up the reputation” of local politicians and businesspeople, citing reporting by Lisseth Boon of Runrun.es.

Boyd said he’d reached out to social media companies, law enforcement agencies, and regulators to try to alert them to the practice, without success. He admitted to a degree of fatalism about powerful people’s use of reputation management services. 

“If anyone can, with a little bit of money, modify their reality, and the reality that the world can access, then what’s the fucking point?” he said.

Several of the clients listed in the documents appear to have used the service to try to limit the damage to their reputations caused by the release of the so-called Panama Papers, which exposed the widespread use of offshore financial centers by politicians and public figures around the world. 

The documents show that several people listed as clients may have been channeled to Eliminalia — knowingly or not —  by another reputation management agency, ReputationUp, which is registered in Spain and has operations in Latin America. The CEO of ReputationUp, Andrea Baggio, told Rest of World that his company had a “collaboration” with Eliminalia that it had “abruptly interrupted.” 

“We decided to block any type of relationship as soon as we realized that their operating method was not congruent with our ideas and with our ethical code,” Baggio said. He declined to provide a date for the termination of the arrangement.

The documents contain a particularly large list of names from Mexico — more than 2,000 of the links listed were apparently targeted by clients based in the country. That includes businesspeople and politically connected individuals wanting articles removed from major news outlets, such as La Jornada and Proceso. 

According to the Mexican news outlet Animal Politico, Eliminalia launched operations in Mexico in 2015. The following year, Sánchez boasted in an interview that he already had 400 clients.

The takedown of an investigation by Mexican outlet Página 66 illustrates how reputation management firms like Eliminalia may be behind a pattern of journalistic investigations in the country that were suddenly deleted with no explanation.

In January 2018, Página 66 published a story about deals between a local government agency and a subsidiary of Grupo Altavista, a conglomerate with interests in infrastructure, cybersecurity, and surveillance technology. Months later, Página 66 received a notice from its hosting provider informing them that, because of the story, the outlet had been reported for breach of intellectual property. More notices followed, along with legal-sounding emails, threatening messages on social media, and more attempts, using DMCA reports, to get the content removed. The story is currently down. Página 66 did not respond to a request for comment.

The URL of the original Página 66 story is in the documents reviewed by Rest of World, as is a link to a statement by transparency advocacy group Article 19 discussing the case, which remains online at the time of writing. The name associated with the takedown request is listed as Humberto Herrera Rincón Gallardo. Herrera is a so-called personal branding expert whose website shows he’s been widely quoted in the Mexican business press on the subject of reputation management. Hererra is also listed as having requested the removal of several articles relating to the Altavista Group, among other stories. His name also appears on a copyright complaint made to Página 66.

Herrera and Altavista did not respond to multiple requests for comment.

Priscilla Ruiz, legal coordinator for digital rights at Article 19 in Mexico, laughed when told that the organization’s page appeared in the documents, but appeared resigned. “That’s how things happen here,” she said.

Ruiz said that the apparently widespread use of services like Eliminalia in Mexico is concerning. Corruption and organized crime have held sway over politics in the country for decades. Using this technique, powerful people can secretly pay to try to hide their past scandals and gloss their reputations, making it harder for the electorate to punish corruption and bad behavior. “The only source [of information] that we have is what the journalists are doing,” she said. “A piece of information like [Página 66] published is important to us to see how businesses are involved in political decisions.”

Eliminalia was founded in Spain by Sánchez and is now part of Maidan Holding, a Kyiv- and Barcelona-based umbrella group for Sánchez’s business interests. 

On the Maidan website, Sánchez is described as a self-made man who broke out of a difficult early life as a ward of the state in Barcelona, overcoming his lack of formal education, to build his first company in his early 20s. “In a short time frame and at the age of 25, “Dídac” Sánchez became a paradigm among young entrepreneurs,” the site reads. His private Instagram account has more than 40,000 followers. 

Maidan’s site is speckled with inspirational sayings, including “Responsibility is not given, it is taken” and “Small things nourish big things.” Sánchez also runs his own foundation, working on poverty and social exclusion in Spain.

Maidan’s other businesses include a reproductive medical clinic that offers surrogacy for hire, plans for a cosmetic surgery clinic, a payments business, and several public relations and reputation management companies, including Eliminalia.

The reputation management industry has expanded dramatically over the past decade, taking advantage of “right to be forgotten” laws — such as GDPR, which gives users some control over their data and information published about them online — and an enormous demand for ridding the internet of past indiscretions. The industry has thrived, in part thanks to the effectiveness, ease, and low cost of making complaints using the DMCA. Hosting providers often lack the capacity or interest to investigate every complaint, and, under the law they can be held liable for contributing to the infringement of copyright, if it’s later proven, which can be very costly. Often, they simply comply with these requests.

“The almost magical piece is that once they do that, [the host] is done. They’re clean, under no circumstances can they be held liable,” Adam Holland, manager of the Lumen database, a project at the Berkman Klein Center for Internet & Society at Harvard University that tracks DMCA requests, told Rest of World. “All the incentives are toward taking it down. Because why would you push back? You might incur legal liability, whether it’s right or wrong.” While some search engines and bigger hosting companies do occasionally push back on requests, “the vast, vast majority, still are honored almost instantly,” Holland said.

While there are legitimate uses for the DMCA complaint process and third-party reputation management services, they can also be used to obscure evidence of past wrongdoing.

Qurium’s earlier investigation seems to demonstrate how Eliminalia attempts to substantiate DMCA complaints. To back up the plagiarism claims against The Elephant, Qurium found that the article in question was copied and pasted to several different websites, all with domains that made them sound like African news outlets. The duplicate articles were given timestamps that made them look like they’d been published before the original. Those websites were hosted on the servers of a company called World Intelligence Limited, based in Manchester, U.K. Companies House, the U.K.’s register of businesses, lists Sánchez as World Intelligence Limited’s sole director.

John Githongo, a veteran anti-corruption campaigner and the publisher of The Elephant, told Rest of World that the cost in time and money of resisting takedown requests can be substantial for small organizations like his — which he thinks is the point. “Success for them is keeping you busy and spending money you don’t have,” he said. Githongo said that reputation management companies and the practices they use give the impression that they’re “basically shakedown artists, who pretend to use Western laws to essentially get you to stop publishing.”

Tord Lundström, Qurium’s digital forensics technical director, said that since its investigation into The Elephant case, Qurium has seen attempts to create fake websites to claim copyright become more sophisticated and harder to trace. It has identified more than 200 new domains that it believes to have been created by companies linked to Eliminalia, for the purpose of backing up DMCA claims or to manipulate search results. Eliminalia did not respond to requests for comment on the new website network, nor on allegations of misuse of the DMCA process.

Lundström said that the reputation management industry urgently needs regulation. DMCA and GDPR weren’t designed to be used in this way, but, so far, policymakers and courts in the U.S. and Europe haven’t taken any significant steps to address the industry. 

“Impersonation, fake DMCAs, removing content: The right to be forgotten is not used properly. … It has to be a court that says that the right to be forgotten is not intended for cleaning the image of [corrupt] people,” he said. Right now, he said, the ability to scrub your past from the internet can feel as if it’s reserved for the wealthy few. “It depends on how much money you have. If you have enough money, you have the right to be forgotten.”