Panama Papers: An inside look at how the largest document leak in history was investigated

It started just over a year ago in the brightly-lit office of the Süddeutsche Zeitung newspaper, atop a building in Hultschiner street in Munich, . Two journalists, Bastian Obermayer and Frederik Obermaier, obtained millions of pages of leaked confidential documents from Mossack Fonseca, a little-known but influential law firm founded in Panama in the 1970's.

The Panamanian law firm, with 38 branches around the world from Hong Kong and Miami to Zurich, is one of the biggest architects of front companies and corporate structures that can hide the true owners of properties and fortunes.

The reporters had no personal with the source who provided the information. All communication was done via encrypted chats. Why did the person at the other end of the line want to make the information public? "I want to halt these crimes. They have to be stopped," the source replied.

The leak contained thousands of emails sent through the offices of the Panamanian firm. They came accompanied by millions of documents: legal files, bank certificates, copies of checks, ports, affidavits, identity cards, deeds, invoices and countless confidential correspondences, all revealing the complicated legal web used by thousands of people around the world to move or hide their money and goods through tax havens and paper companies.

Prior to Süddeutsche Zeitung obtaining the leak, tax authorities in had bought a small file of Mossack Fonseca documents from a confidential informant, sparking domestic raids in early 2015. Those files have been offered to authorities in the United Kingdom, the United States and other countries, according to a report by the International Consortium of Investigative Journalists (ICIJ).

A treasure trove of documents

In their initial review of the documents, the German journalists found stories about prominent world figures. It didn't take them long to realize that what they had in their hands was the biggest leak in whistleblowing history: a 2.6 terabyte database that holds at least 11.5 million documents, dated between 1977 and 2015.

The trove of information was 2,300 times larger than the package of U.S. diplomatic cables received by Wikileaks five years ago.

Since Süddeutsche Zeitung had worked with ICIJ Journalists on other projects involving large leaks, including the Offshore Leaks (2013) and Swiss Leaks (2015), they decided to share the information with the D.C.-based organization. Editing and structuring a database of this magnitude in a comprehensible way would be no easy task, and ICIJ had the experience.

The two reporters also relied on the fact that ICIJ works with journalists and news organizations who are recruited because of their renowned investigative journalism skills and independence.

"When we realized that we had found good international stories, we understood that they would not be told unless we shared the data," said Obermayer.

During a meeting in Munich, in April 2015, Süddeutsche Zeitung gave ICIJ the first CD’s with leaked information.

Then came the arduous work of structuring the database, turning it into something comprehensible and deg a secure platform that could be used by other journalists to explore and visualize the information. Three engineers took on that mission: Rigoberto Carvajal, Miguel Fiandor and Matthew Caruana Galizia, working remotely from Madrid and Costa Rica under the direction of the head of ICIJ’s Data Unit, journalist Mar Cabra.

They used up to 35 servers to extract and index the confidential information within the Mossack Fonseca files. That involved separating e-mails and attachments, scanning thousands of documents and processing them through word recognition software to make them searchable. Texts had to be extracted from documents that were in at least 11 different formats, including 3 million html files (the language that structures web page content), and almost 5 million Outlook emails.

The ICIJ team identified the countries related to each message and document, based on the addresses contained in them. Once they had the structured data, they converted it into a graph format that allowed them to explore the connections between people, companies, offices, documents and bank s, and visualize them using a platform called Linkurious.

By June 2015, the organization had created a robust and secure web application where journalists from around the world could share their findings and communicate effectively.

Meanwhile, a team led by Marina Walker Guevara, deputy director of the Consortium, had convened a first group of investigative journalists from different countries – including a team from Univision – to dig into the files.

The project was dubbed Prometheus, after the ship commanded by the Starfleet in the TV series Star Trek, a favorite of ICIJ engineer Rigoberto Carvajal. It was identified that way for nearly a year, to avoid any direct references to the Panamanian firm for security reasons.

The project expands

On June 30, around 30 reporters gathered in Washington D.C. For two days the group sat in the National Press Club lounge, overlooking the White House. They learned the details of the project and the first revelations from the Mossack Fonseca data, before agreeing upon a working agenda. They discussed publishing in November, but then chose February 2015. No one knew what was coming.

Over the next two months, they systematically searched for individuals, companies, countries and addresses in the database while more and more journalists ed the project. Careful examination of the documents gradually yielded extraordinary revelations: allies of President Vladimir Putin moving millions of dollars to tax havens from Russian state banks; corporations related to Lazaro Baez, an Argentine businessman currently on trial for money laundering; corporations and contracts that linked FIFA to corruption; and secret offshore companies linked to the prime minister of Iceland, Davíð Sigmundur Gunnlaugsson.

One of the main challenges was keeping the ICIJ information secure: coordinating the collaborative work of journalists around the world while keeping sensitive and confidential data safe from cyber attacks or leaks to third parties, which would have compromised the project.

A strict working plan was designed. The organization constantly monitored the access of journalists to the database and the number of documents they ed; held conversations through encrypted communications; and used the Google Authenticator identity system to provide access to the filtered files, among other measures.

Another meeting was held in early September, this time at the headquarters of Süddeutsche Zeitung in Munich. Over the course of three days, more than 70 journalists shared their main database findings, formed working groups, defined strategies and proposed possible stories.

Another secret meeting took place in Lillehammer, Norway, in early October, taking advantage of the presence of several Prometheus reporters at the Global Investigative Journalism Conference. In the meeting rooms of the Radisson Blu hotel, amid a large gathering of journalists from around the world, more doubts and investigative ideas were raised, and a publication date was discussed.

The work behind the investigation steadily increased as Süddeutsche Zeitung received more packages with confidential Mossack Fonseca data. In 10 months, ICIJ made five updates to the database – the last one in March, with 1.5 million new documents to be examined. It was then agreed that the simultaneous publication would take place April 3.

And here we are. This is the biggest journalistic collaboration ever ed, with 370 reporters from 109 media outlets working in more than 25 languages in 76 countries. For 10 months they dug around the innards of Mossack Fonseca, tracking down worldwide secret financial transactions from clients linked to 202 countries and territories.

The filtered files—some 11.5 million documents—cover a period of 40 years. So far ICIJ and its partners managed to identify 214,488 entities (including companies, foundations and trusts) and 14,153 of Mossack Fonseca's clients, most of them brokers acting on behalf of thousands more.

Global leaders and civil servants

So far, 12 presidents or former presidents from different countries have been identified in the files, as well as 61 of their relatives or direct associates. Up until now, records show 128 politicians or public servants using the law firm services, as well as 29 people from the list of Forbes Billionaires.

ICIJ’s analysis found that more than 500 banks—including their subsidiaries and branches—have worked with Mossack Fonseca from the early 1990s in order to help their clients establish some 15,779 offshore companies. For instance, the American bank USB incorporated more than 1,100 companies through the law firm, while HSBC bank and its s created more than 2,300 entities.

On March 16, a few days after ICIJ and its partners visited Mossack Fonseca’s headquarters in Panama and delivered questions to the firm, one of its founders, Ramón Fonseca Mora, requested a leave of absence from his position as minister-counselor of Panamanian President Juan Carlos Varela.

That same day, the law firm warned its clients that its servers had been compromised and that its data was in the hands of the global media. “They have already ed us in an effort to confirm their allegations and ask further questions. We have responded in a general manner and have not provided details that would further expose confidential information”, wrote Marketing and Sales Director Carlos Souza-Lennox in a message obtained by Univision.

Starting this week, you'll be able to read the major revelations of this journalistic investigation - dubbed the Panama Papers - through Univision Noticias, ICIJ’s website and dozens of other media outlets all over the world.