← Investigations Boscán & La Moni
National Intelligence SecretariatRepublic of Ecuador · Vallejo era
Ref.UCSI-2018-06-25
RestrictedPublished on June 25, 2018
SubjectOperational structure of the SenainSourceUCSI agents, the Presidency's internal securityPeriod2013 - 2018ScopeEspionage, troll center, shock groups and infiltrationFolios4 chapters · 3 videos
La Posta · June 25, 2018 · The leadership of Rommy Vallejo's Senain

ConspiraIn: how the Senain worked

Rommy Vallejo, former intelligence secretary, in a cropped file photo
Annex 1 · Main subjectRommy VallejoIntelligence Secretary · 2014 to 2018File photo

Agents from the UCSI, the Presidency's internal security unit, contacted La Posta to explain how the National Intelligence Secretariat operated under Rommy Vallejo. La Posta named names: who handled the secret expense funds, who tapped phones and emails, who directed the shock groups that attacked Lourdes Tibán and Carlos Michelena, and how two cousins of a lieutenant hired by Vallejo got into the security details of Lenín Moreno and Eduardo Mangas to pass him information. The scheme came to light. No one answered for it in court.

Identified roster · 16 names
Rommy VallejoCarolina AndradePaulina VázquezSantiago OlmedoCarolina EspinozaFrancisco Saavedra, "the priest"Paúl LópezSantiago MenaAna ErazoEsteban BenítezGabriel RamosSilvia BurgosSantiago DíazVíctor Hugo BeltránFreddy Guzmán PepinosEsteban Guzmán Pepinos
Outlet La PostaPublished June 25, 2018
7phone interceptors that went missing after Vallejo's departure, according to an Interior Ministry memo
30people on Captain Gabriel Ramos's email and social media hacking team
$50,000+in secret expense funds paid to alias Ruso, a supposed Argentine who does not exist
2agents planted in the security details of President Moreno and Eduardo Mangas
A dimly lit operations table with a tapped phone, cables, an org chart with empty boxes and a cassock hanging from the chair; in the background, the silhouette of Carondelet Palace. AI-generated illustration.
In four sentences
  1. In June 2018, agents from the UCSI, the Presidency's internal security unit, approached La Posta with information on how the National Intelligence Secretariat worked during its harshest period, under Rommy Vallejo. The abuses were known. What was missing was a face of accountability beyond Vallejo's.
  2. On June 25, 2018, La Posta published ConspiraIn. Vallejo first set up a finance department with Paulina Vázquez and Santiago Olmedo, tasked with dressing up the secret expenses for the Comptroller General's Office, including the 40,000 dollars spent on the operation against Fernando Balda. A troll center attacked opposition figures and later President Moreno himself. Francisco Saavedra, known as "the priest," did the dirty work on the street.
  3. Paúl López was the link to the hackers. Under him, Captain Ana Erazo ran the wiretaps with eight agents and seven interceptors that later disappeared; Esteban Benítez paid alias Ruso, a supposed Argentine whose passport does not exist; Captain Gabriel Ramos used phishing to hack people close to Rodas, Nebot, Lasso and the Yasunidos collective. Silvia Burgos and Santiago Díaz coordinated the Barrigas and the Popeyes, Rafael Correa's parallel security and the shock groups.
  4. When Moreno was a candidate, Vallejo hired Lieutenant Jorge Pepinos. His cousins Freddy and Esteban Guzmán Pepinos joined the security details of the president and of Eduardo Mangas and passed information to Vallejo. Moreno detected the infiltration and removed them. The rest of the scheme, La Posta said, remained unpunished.
Chapter 1

Vallejo's inner circle

For years no one knew who really ran the state's intelligence apparatus. It was known that the National Intelligence Secretariat persecuted, harassed and spied, and its chief's name was known: Rommy Vallejo. Below him, the structure was a void: no one had a face, no one had a title, no one answered for anything. Weeks before the publication, agents from the UCSI, the Presidency's internal security unit, contacted La Posta. They wanted to hand over information on how the Senain operated in its harshest era. On June 25, 2018, La Posta published ConspiraIn, a ten-minute report that was the first time anyone put faces and names to that structure: who handled the secret expenses, who ran the wiretaps, who directed the shock groups and who had gotten inside the president's security detail.

The diagram of the intelligence structure, with every post and every nameReel 01
The diagram of the intelligence structure, with every post and every name

What we didn't know was a face of accountability beyond Rommy Vallejo's. Today La Posta tells you how the conspiracy worked.

Andersson Boscán, June 25, 2018

Vallejo, Rafael Correa's intelligence secretary, ran an espionage structure. His second-in-command was Carolina Andrade, the official tasked with making the Secretariat operational with a group of untouchables. Andrade stayed at the Senain after Vallejo left, when Jorge Costa replaced him. No one in that group had answered for anything in court.

The first thing Vallejo did when he arrived was set up a finance department. He hired Paulina Vázquez and Santiago Olmedo. Vázquez had previously managed the finances of the Ecuadorian Social Security Institute when it was headed by Ramiro González, now a fugitive. Olmedo was in charge of the secret expenses: presenting them polished to Carlos Pólit's Comptroller General's Office. Among those accounts were the 40,000 dollars for the kidnapping operation against Fernando Balda.

$40,000in Senain secret expense funds spent on the kidnapping operation against Fernando Balda, according to La Posta's report.
Andersson Boscán, host of ConspiraIn, facing the camera, cropped from a video still
Andersson Boscán in ConspiraIn, June 25, 2018. Still from the show

With the accounting sorted and a second-in-command in place, Vallejo put social media harassment into operation. The Alvarado brothers' troll center was replicated inside the Senain, this time run by an official identified in the intelligence reports La Posta obtained as Carolina Espinoza. The troll center attacked opposition politicians on the campaign trail. By 2018 it was attacking President Lenín Moreno, who signed the checks that paid its salaries.

Harassment outside the virtual world was handled by Francisco Saavedra, "the priest." He earned the nickname when he was caught dressed as a priest at an anti-Correa protest. He came from the General Intelligence Directorate and did the Senain's dirty work in the field: persecuting and harassing people in cities and also abroad, in Peru, targeting Ecuadorian citizens, according to chats La Posta obtained. Saavedra was on the verge of joining the Moreno government. The president himself blocked the move.

The Senain's org chart

Vallejo's inner circle, name by name

Level 01Leadership
Leadership

Rommy Vallejo

National Intelligence Secretary

Ran the espionage structure, Correa's parallel security and the internal conspiracy that reached all the way into Moreno's security detail.

Leadership

Carolina Andrade

Second-in-command

Made the Secretariat operational with a group of untouchables. Stayed at the Senain after Vallejo, under Jorge Costa.

Level 02Money and networks
Secret expenses

Paulina Vázquez

Finance

Had previously managed the IESS's finances when it was headed by Ramiro González, now a fugitive.

Secret expenses

Santiago Olmedo

Secret expenses

Presented the secret expenses polished to Carlos Pólit's Comptroller General's Office. Among those accounts were the payments to alias Ruso.

Troll center

Carolina Espinoza

Troll center

Replicated the Alvarado brothers' troll center inside the Senain. In 2018 it was attacking President Moreno.

Fieldwork

Francisco Saavedra, "the priest"

Fieldwork

Persecuted and harassed people in cities and in Peru. He was caught dressed as a priest at a protest.

Level 03Wiretaps
Link to the hackers

Paúl López

Link to the hackers

Boss of Mena, Erazo, Benítez, Ramos and Burgos. Vallejo asked him to identify someone who could infiltrate Moreno's security.

Surveillance

Santiago Mena

Surveillance

Coordinated with Saavedra, "the priest," on whom to follow and harass, based on their messages and communications.

Wiretaps

Ana Erazo

Captain · wiretaps

Eight agents and seven mobile interceptors. All seven disappeared after Vallejo's departure, according to an Interior Ministry memo.

Payments to alias Ruso

Esteban Benítez

Civilian

Contact with alias Ruso, a supposed Argentine paid more than 50,000 dollars from the secret expense funds.

Phishing and hacking

Gabriel Ramos

Captain · phishing

Thirty people hacking emails and social media accounts. He posed as César Monge to get into CREO; also targeted Rodas, Nebot, Lasso and Yasunidos.

Level 04Street and government
Shock groups

Silvia Burgos

Barrigas

Coordinated Correa's illegal security. Galo Lara attributes to her 200,000 dollars in travel expenses spent pursuing him in Panama.

Shock groups

Santiago Díaz

Popeyes

Ran the Popeyes under Vallejo's orders. His brother-in-law represented the company that owned the van used to move them around.

Shock groups

Víctor Hugo Beltrán

Leader of the Popeyes

Received the money: 15 dollars for food, 15 for lodging and 60 for transportation per day.

Moles

Freddy Guzmán Pepinos

Mole

Assigned to Moreno's security from the campaign onward. Passed inside information to Vallejo.

Moles

Esteban Guzmán Pepinos

Mole

Assigned to the security detail of Eduardo Mangas, the president's closest associate.

The names come from intelligence reports and from the UCSI agents who handed the information to La Posta. Publication of the full list of the 30 members of Ramos's team and of the Popeyes was made conditional on the authorities requesting it.

Chapter 2

The wiretaps

Vallejo's other key link was Paúl López, the connection to the world of hackers who tapped emails, calls and communications. He had a large team, and several of its heads had never come to light. The first was Santiago Mena, who coordinated with Saavedra, "the priest," on whom to follow, harass and persecute, based on monitoring their messages and communications.

Still from the ConspiraIn video with the Senain's full org chart drawn next to the host10:20
The full scheme at the close of ConspiraIn, each post with its name. Still from the Boscán & La Moni show

Two figures stand out in the wiretapping. Ana Erazo, a captain, had eight agents under her command for the phone interception system and seven interceptors, sophisticated mobile equipment. All seven disappeared after Vallejo left the Secretariat, according to an Interior Ministry memo La Posta learned of. Esteban Benítez, a civilian, helped with contact with the hackers. He was the link to alias Ruso, a supposedly Argentine citizen identified by a passport number and names that, according to the Argentine authorities' response to the Comptroller General's Office, do not match: they do not exist.

We took out more than 50 thousand dollars in secret expenses to constantly pay some guy alias Ruso, God knows who he is, and they never gave any answer about that.

Andersson Boscán, June 25, 2018
8agents under Captain Ana Erazo for phone wiretapping
7interceptors that disappeared after Vallejo's departure

Captain Gabriel Ramos was in charge of tapping emails and social media, with a team of 30 people. La Posta said it had all their names and offered to make them public if the authorities requested them. Ramos's technique was phishing. To get into the CREO movement's networks, he sent an email posing as César Monge, the party's director, to people within the movement, warning that one of them had been hacked. The technique was repeated with different parties at different times.

According to the intelligence reports, people close to Mauricio Rodas, Jaime Nebot and Guillermo Lasso were hacked, and especially the citizen collective Yasunidos.

30people on Captain Gabriel Ramos's team hacking emails and social media. La Posta said it had all the names.
Chapter 3

Barrigas, Popeyes and the Pepinos cousins

The last person under Paúl López was Silvia Burgos. With her, the scheme moved from espionage to crude, almost paramilitary action. Burgos coordinated the Barrigas: people assigned to Rafael Correa's security who were not part of his official detail. Correa kept his official security until May 24, 2018, but the Senain illegally provided him with a second security detail, a second ring, coordinated by Burgos.

A third ring was coordinated between Burgos and Santiago Díaz, under Vallejo's orders. Díaz ran the Popeyes. Many intelligence sources identify them as responsible for serious abuses in landmark cases: the assault on politician Lourdes Tibán, the assault on comedian Carlos Michelena and the assault on journalist Alfonso Pérez, of Ecuador en Vivo. La Posta said it could identify each of the Popeyes, singled out by their own intelligence colleagues, and present their names if the authorities requested them.

The Popeyes' money was handled by the Ramos brothers and received by the group's leader, Víctor Hugo Beltrán: 15 dollars a day for food, 15 for lodging and 60 for transportation, in a van with Pichincha plates belonging to a company represented by Rolando Pazmiño, Santiago Díaz's brother-in-law. In many cases the Popeyes were employees on the Senain payroll, paid for by Ecuadorians. Beltrán selected the Popeyes in direct coordination with Saavedra, "the priest."

$90a day per Popeye: 15 dollars for food, 15 for lodging and 60 for transportation, handed to Víctor Hugo Beltrán.

Controlling the opposition and setting up illegal protection for Correa was not enough for Vallejo. According to intelligence sources consulted by La Posta, he directed an internal conspiracy operation that reached the president of the Republic. When it was announced that Lenín Moreno would run for president, Vallejo asked Paúl López to identify someone capable of infiltrating the future president's security. The Senain then hired Lieutenant Jorge Pepinos. A minor hire, except for one detail: Pepinos was the cousin of two intelligence agents who could serve on the security details of two men who would soon wield enormous power.

From the campaign onward, Vallejo assigned Freddy Guzmán Pepinos and Esteban Guzmán Pepinos to the security of Moreno and of his closest associate, Eduardo Mangas. Once the president and the secretary general of the Presidency took office, the two agents supplied Vallejo with inside information. That way he had the opposition, the shock groups and the government itself under control. The president detected the infiltration in his security team, and Guzmán Pepinos was removed from it.

That's been dealt with. What hasn't been dealt with yet is that, even though this whole scheme of intelligence, abuse, persecution and espionage is known, it still goes unpunished.

Andersson Boscán, June 25, 2018
Chapter 4

How it ended

Three months before ConspiraIn, on March 26, 2018, La Posta had published a cartoon by Bonil, They Punished the Senain, about President Moreno's punishment of the Secretariat. The June 25 investigation put names to the structure. La Posta made publication of the full lists, the 30 on Ramos's team and the Popeyes, conditional on the authorities requesting them.

The Senain buildingReel 03
The Senain building

The follow-up came on October 30, 2018, on News and Coffee, with former assembly member Galo Lara, convicted in the Quinsaloma case. Lara said that seven days earlier he had filed a petition for review of his sentence with declassified documents from the Senain's secret archives. According to Lara, the declassification of the files on Fernando Balda, Galo Lara and David Romo was ordered by President Moreno.

Rafael Correa used the Senain as a criminal organization, and he was the boss of that criminal organization.

Galo Lara, former assembly member, News and Coffee, October 30, 2018

Lara said the documents show that the UCSI assigned 11 police officers to follow him from the time he began making allegations in the Constituent Assembly, in an operation called Desarme, before the Quinsaloma crimes; that they planted a secretary of his, who passed information to the government for four years, which is why official responses came out a minute after he finished his allegations; that Major Silvia Burgos, the same person ConspiraIn identified as coordinator of the Barrigas, used 200,000 dollars in travel expenses to pursue him in Panama during his exile, until his extradition; and that two police officers, Zapata and Nieto, forged the video used to accuse him, coercing the person who recorded it with a knife to his navel and a screwdriver to his ear. Zapata, he said, was later rewarded with a post as police attaché at the embassy in Spain. That happened, according to Lara, under the Senain administration before Vallejo's.

11UCSI police officers following Galo Lara, according to the declassified documents he cited
$200,000in travel expenses to pursue him in Panama, according to Lara

Lara said his lawyer Lourdes Tibán, one of those assaulted by the Popeyes according to ConspiraIn, had filed an addendum to the pardon request in which 130 current and former assembly members, five former presidents and four former vice presidents asked Moreno to pardon him based on the Ombudsman's Office report and the declassified documents. He asked that the files on everyone who had been persecuted also be declassified: those of Martha Roldós, Fernando Villavicencio, the Luluncoto 10 and Mery Zamora. And he maintained that Correa's people returned only four of six phone interception devices and that a parallel, clandestine wiretapping center exists. The interview recalled that the Senain's records had gone missing and that the Comptroller General's Office had struggled to put together the reports on secret expenses.

I was jailed for denouncing Rafael Correa's corruption, not for being a thief like the one who has inherited my cell in Latacunga.

Galo Lara, News and Coffee, October 30, 2018

The questions ConspiraIn raised in June remained open. Who alias Ruso is and where the more than 50,000 dollars went. Where the seven interceptors are. Why Carolina Andrade stayed at the Senain under Jorge Costa. And whether any of those named, from Vallejo down, would answer in court. What ConspiraIn put on the record was not a conviction but a census: for the first time, the state's intelligence apparatus stopped being an anonymous bloc and had an org chart with names, posts and duties. Eight years later, those names are still all that remains of the case.

Oct 30 · Lara and the declassified Senain files

News And Coffee: Galo Lara

30/10/2018 · 34:23Original on YouTube ↗
By the numbers

The numbers

$40,000in secret expenses for the kidnapping operation against Fernando Balda
$50,000+in secret expenses paid to alias Ruso, whose passport does not exist according to Argentina
8agents under Captain Ana Erazo for wiretapping, with 7 interceptors missing
$90a day per Popeye: food, lodging and van
$200,000in travel expenses to pursue Galo Lara in Panama, according to Lara
What the case left behind

A leadership with names, no one prosecuted

  • Rommy VallejoHead of the scheme; no known case against him at the time of publication
  • Infiltration of Moreno's securityDetected; Guzmán Pepinos removed
  • Alias Ruso and the $50,000Nonexistent passport; no answer
  • Seven interceptorsMissing since Vallejo's departure
  • Popeyes and BarrigasIdentified by La Posta; no prosecution
  • Galo LaraPetition for review with declassified files

Updated September 5, 2026

What's missing

Unanswered questions

  1. Who alias Ruso is and where the more than 50,000 dollars in secret expenses went
  2. Where the seven phone interceptors that disappeared when Vallejo left are
  3. Why Carolina Andrade stayed at the Senain under Jorge Costa
  4. Whether the Popeyes were prosecuted for the assaults on Lourdes Tibán, Carlos Michelena and Alfonso Pérez
Timeline

Step by step

  1. Vallejo era
    The structure

    Vallejo sets up the finance department with Vázquez and Olmedo; Paúl López links up with the hackers; Erazo, Benítez and Ramos run wiretaps and phishing; Burgos and Díaz coordinate the Barrigas and Popeyes.

  2. 2016-2017
    The Pepinos cousins

    Once Moreno's candidacy is announced, Vallejo hires Lieutenant Jorge Pepinos. His cousins Freddy and Esteban Guzmán Pepinos join the security details of Moreno and Mangas.

  3. 2017
    Information for the secretary

    After Moreno and Mangas take office, the Guzmán Pepinos cousins pass inside information to Vallejo. Jorge Costa replaces Vallejo; Carolina Andrade stays.

  4. Mar 26, 2018
    They Punished the Senain

    La Posta publishes Bonil's cartoon about Moreno's punishment of the Secretariat.

  5. May 24, 2018
    End of Correa's official security

    Correa keeps his official security until this date; the Senain also gave him a second, illegal security detail.

  6. Jun 2018
    The UCSI approaches La Posta

    Agents from the Presidency's internal security unit hand over information on Vallejo's Senain.

  7. Jun 25, 2018
    ConspiraIn

    La Posta publishes the names of the leadership: finance, troll center, "the priest," wiretaps, hackers, Barrigas, Popeyes and the infiltration of the president's security.

  8. Oct 2018
    Petition for review

    Galo Lara files a petition for review with declassified Senain documents, released, he says, on Moreno's orders.

  9. Oct 30, 2018
    Lara on News and Coffee

    Lara attributes to Silvia Burgos 200,000 dollars in travel expenses spent pursuing him in Panama and alleges a video was forged by police officers Zapata and Nieto.

The names

Who's who

RV
Named; no known prosecution

Rommy Vallejo

Rafael Correa's National Intelligence Secretary. Ran the espionage structure, Correa's parallel security and the infiltration of Moreno's security.

CA
Still in office in 2018

Carolina Andrade

Vallejo's second-in-command. Made the Senain operational with a group of untouchables and stayed at the Secretariat under Jorge Costa.

PV
Named

Paulina Vázquez and Santiago Olmedo

Finance department. Vázquez came from Ramiro González's IESS; Olmedo polished the secret expenses for the Comptroller General's Office.

FS
Blocked by Moreno when he tried to join the government

Francisco Saavedra, "the priest"

Fieldwork: persecuting and harassing people in cities and in Peru. Coordinated the selection of the Popeyes with Beltrán.

PL
Named

Paúl López

Link to the hackers. Boss of Mena, Erazo, Benítez, Ramos and Burgos.

AE
Named

Ana Erazo

Captain. Phone wiretaps with eight agents and seven interceptors, now missing.

EB
Named

Esteban Benítez

Civilian. Contact with alias Ruso, paid more than 50,000 dollars from the secret expense funds.

GR
Named

Gabriel Ramos

Captain. Phishing against CREO and people close to Rodas, Nebot, Lasso and Yasunidos, with 30 people.

SB
Named

Silvia Burgos

Coordinated the Barrigas, Correa's illegal security. Lara attributes to her 200,000 dollars in travel expenses spent pursuing him in Panama.

SD
Named

Santiago Díaz and Víctor Hugo Beltrán

Díaz coordinated the Popeyes under Vallejo's orders; Beltrán led them and received the money.

Fy
Removed from the presidential security detail

Freddy and Esteban Guzmán Pepinos

Agents on the security details of Moreno and Mangas. They passed information to Vallejo.

GL
Petition for review filed

Galo Lara

Former assembly member convicted in the Quinsaloma case. Sought review of his sentence with declassified Senain documents.

The other side

Responses and reactions

  • Office of the President

    According to La Posta's report, President Moreno detected the infiltration in his security team and Guzmán Pepinos was removed from it. Moreno also blocked Francisco Saavedra from joining the government.

  • Rommy Vallejo and the Senain

    The videos contain no response from Vallejo or from the officials named.

  • Argentine authorities

    They told the Comptroller General's Office that alias Ruso's passport number and names do not match any citizen.

  • Galo Lara

    He publicly thanked Moreno for declassifying the documents on Balda, Lara and Romo, and said they prove the Senain fabricated testimony, audio and video against him.

The pieces

The other videos

Mar 26 · Bonil cartoon, context

Bonil's Scribbles: They Punished the Senain

26/03/2018 · 0:29Original on YouTube ↗
What was said on air

The transcripts

ConspiraIn

06/25/2018 · 1,752 words

a few weeks ago la posta was contacted by agents of the ucs and the internal management and security unit of the presidency to hand over information about the workings of the national intelligence secretariat senna int in its harshest era that of rommy vallejo and although we all know the excesses the persecution the harassment and the espionage carried out from there and what we didn't know was …

Read the full transcript

News And Coffee: Galo Lara

10/30/2018 · 4,229 words

was talking now I'm going to meet up three because it's safer except from the malvina toward the 25 julio a little safer like minutes efe here I'm sitting comfortably at my house for 25 keita this is transport víctor this is real welcome to a new edition of news and coffee for the second day in a row in our new home el barista below the chamber of commerce in north quito specialty coffee on avenida repúb…

Read the full transcript

Transcripts from each show's automatic captions. They have not been corrected by hand: use them to find a phrase and jump to the exact minute in the video, not as verbatim quotes.

Afterward

What happened next

June 2018

The mole, out

The Presidency removed agent Guzmán Pepinos from Moreno's security. The rest of the scheme, La Posta said, remained unpunished.

October 2018

The declassified files

Galo Lara filed a petition for review of his sentence with secret Senain documents, and 130 current and former legislators asked for his pardon, as he recounted on News and Coffee.

Follow the thread

Other cases that intersect

Investigation (2018)
Andersson Boscán · La Posta
Original publication
La Posta, June 25, 2018
Surveillance
News and Coffee, October 30, 2018
Web edition 2026
Boscán & La Moni · Eureka Media EC
  1. La Posta · ConspiraIn (Jun 25, 2018)
  2. La Posta · Bonil's Scribbles: They Punished the Senain (Mar 26, 2018)
  3. News and Coffee · Galo Lara on the infiltration of the Senain (Oct 30, 2018)

Case file built from the ConspiraIn report (10:33) and the October 30, 2018, interview with Galo Lara, in which Andersson Boscán did not take part; what Lara says is attributed to Lara. Names taken from automatic captions: Carolina Andrade (Vallejo's second-in-command) and Carolina Espinoza (troll center) appear as two different people, which should be checked against the video; the captain's name is transcribed as Ana Erazo; the company that owned the Popeyes' van and the Peru case Boscán mentions are not intelligible in the audio and are omitted; the Senain administration under which Lara places the forged video is cited without names. Still to be expanded with that week's shows in June 2018 (reactions from Vallejo, the Senain and the Presidency) and with the full publication of the lists of Ramos's 30 and the Popeyes, and still to be verified outside the videos: the criminal case against Vallejo over the Balda case, the elimination of the Senain and the outcome of Galo Lara's petition for review and pardon request. Once confirmed, update status, aftermath and closing.