Lucas Villa: Cell Phone Data Gives New Insight into Unsolved Case of Colombian Protestor’s Killing

Almost two years since the death of student protester Lucas Villa in the Colombian city of Pereira, no arrests have been made and there has been little public sign of progress in the investigation into his killing. This is despite a national outcry and international media coverage after the 37-year-old was shot eight times at point-blank range in front of dozens of people.

However, investigative documents pertaining to the case seen by Bellingcat and its Colombian partners provide new insight, showing that at least one investigator from the General Prosecutor’s Office (Fiscalia General de la Nación) was in contact with individuals suspected of Villa’s killing in the days before, during and weeks after his death.

The contents of the files raise questions about the investigation, the actions of the aforementioned investigator as well as the apparent lack of progress over the last two years.

Artwork courtesy of Ann Kiernan.

Bellingcat carried out an open source survey of available evidence contained within the files and provided further analysis to Colombian outlets Cerosetenta and CLIP who we collaborated with to report on some of the contents of the documents. Cerosetenta’s publication can be seen here and CLIP’s can be seen here.

Bellingcat has not named the investigators or suspects detailed in the case which remains active and ongoing. While the details within the documents are revealing, it is possible there is other information pertaining to the case not included in the files and case data seen by Bellingcat, Cerosetenta and CLIP.

Bellingcat reached out to the Prosecutor’s Office to ask about the details of this story and about whether their investigator had reason to be in such close contact with individuals apparently identified as suspects. At the time of publication Bellingcat had not received a response. Separately, CLIP and Cerosetenta reached out to the Colombian National Army, Police and the Prosecutor’s Office at various points over recent months. Only the Prosecutor’s Office responded in January 2023 to state that the case of Lucas Villa had been transferred to Colombia’s Specialised Directorate on Human Rights Violations (DECVDH). More recent requests for comment from Cerosetenta and CLIP to the army and Prosecutors Office did not receive an official response. 

Who was Lucas Villa?

Lucas Villa was shot dead in May 2021 while participating in street protests that were part of widespread demonstrations against unpopular tax reforms. A joint investigation by Bellingcat, Cerosetenta Baudo AP and Forensic Architecture reconstructed the killing of Villa later that year. 

Bellingcat analysed dozens of videos from social media and private CCTV cameras, uncovering evidence that the killing appeared to have been premeditated. This included footage that appeared to show the attackers surveying the area several minutes before the shooting. Further analysis showed that Villa was shot execution-style from a short distance away.

An individual steps off the back of one of the bikes, runs towards Lucas Villa and fires eight times. The path of the gunman is tracked in the moving red line and the red dots depict the points at which bullets were fired. (c) Forensic Architecture, 2021.

Bellingcat’s joint investigation also raised several questions about the actions of police who failed to secure the crime scene immediately after the killing. As the investigation found, some physical evidence was moved or lost before police arrived.

Speculation that police and local drug gangs were involved in Villa’s death aired in Colombian media in the days after he was killed. 

At the time, Pereira Metropolitan Police did not answer Bellingcat’s specific questions about the killing or police actions, stating only that the events were being investigated by the Prosecutor’s Office.

As yet, no charges have been made in the killing of Villa. 

National Police have also publicly denied any involvement and stated that there is no evidence to suspect any police officers. They have also publicly stated that they suspected the involvement of a local criminal gang known as La Cordillera in the killing.

Call Detail Records

According to the official investigative files seen by Bellingcat, authorities started to dig into Call Detail Records or CDRs in the weeks after Villa’s death. This type of analysis looks at telephone metadata, which is created when voice calls are initiated. It is obtained from cell phone carriers and details the rough location where a call was made from, the length of the call as well as the other numbers involved . 

After cross referencing phone data, investigators focused on a group of individuals they suspected could have been involved with the death of Villa. Documents detail how they examined both the call patterns of these individuals as well as location information of where they were in the weeks before, during and after the killing of Lucas Villa. 

However, this course of action soon led investigators to an interesting discovery.

Four months after Villa’s death, in September 2021, a technical report contained within the documents seen by Bellingcat and its Colombian partners concluded that one number that had been in contact with the suspects in the months prior belonged to a CTI Investigator who was actively working on Lucas Villa’s case. The CTI or Cuerpo Técnico de Investigación is the Technical Investigation Team that is part of the Prosecutor’s Office. 

Available evidence from files shows that at 9am on May 5, 2021, the day Lucas Villa was shot, this number contacted one of the main suspects identified by investigators in the case. 

According to the data, the CTI investigator and this suspect contacted each other a total of five times in the hours before the shooting. What they discussed is not known. Bellingcat asked the Prosecutor’s Office about the nature of this communication as well as whether it was aware of it but did not receive a response before publication.

Copy of a section of the CDR data. The document shows the time and date of a call or data transfer made by a subscriber and the corresponding cell phone tower identification used for each register. The tower identification details were used to geolocate the approximate area of origin of the call/data.

Bellingcat further analysed the data contained within the files and geolocated the phone tower where at least one of the May 5 the calls pinged using a publicly available database called OpencellID. This cell tower was located approximately 300 metres from the General Prosecutor’s Office building in Pereira.

Caption: Using https://opencellid.org, a database of cellphone towers, Bellingcat could verify the location of the cell phone tower used by the telephone of the CTI investigator. The Antenna is approximately 300 metres away from the General Prosecutor’s office in Pereira.

Bellingcat also identified through the documents it obtained that this CTI investigator continued to have contact with other telephone numbers investigators believed were being used by people suspected of being involved in the killing. At the same time documents also show the CTI investigator was apparently able to request, access, investigate and produce reports related to Lucas Villa’s’ case and the principal suspects.

Despite concluding in September 2021 that the phone in question belonged to a CTI Investigator, the aforementioned technical report noted that communications between the CTI investigator were just of “personal y laboral” (“personal and work” ) nature and the interception was cancelled. It is not clear from the documents and correspondence what that personal and work communications were and the prosecutor’s office did not respond to questions around this.

Bottom of table reads: Summary of Communication : the user of this cell number can be identified as [redacted] CTI Investigator

Among other documents, Bellingcat found evidence that suggests that after the investigator’s phone was intercepted as part of the Lucas Villa case, they started to work on a new case related to a motorbike scam. The key suspect in this new case was also the person identified as the primary suspect in the Lucas Villa case. Documents show the CTI investigator requesting access to all forensic evidence related to the Lucas Villa case, in particular the recordings of all conversations that could relate to the prime suspect.

Bellingcat found examples of other files accessed or requested by the CTI investigator in the days immediately after Villa was shot. These included License Plate recognition (LPR) data from the Police, interviews, CCTV footage and recorded communications from an individual identified as Alias Calollero, a potential member of La Cordillera gang, who was also a suspect in Lucas Villa’s case but was killed in October 2021. Documents show Calollero’s cell phone was under surveillance at the time of his death.

A Closer Look at the Network of Calls

In November 2021, the files show that the General Prosecutor’s Office also ordered the interception of a phone number possessed by an unidentified person. Upon entering this number into the TrueCaller app, which gathers data from the phone books of people who sign up to its caller ID service, investigators found the individual was referred to by a name (which Bellingcat is referring to as Z) and GAULA in at least one instance. 

GAULA is the acronym of Colombia’s anti-extortion and kidnapping force, Grupos de Acción Unificada por la Libertad Personal.

Cell phone data analysed by the prosecutor’s office showed Z-GAULA and the CTI Investigator whose phone was also intercepted had telephone conversations with each other, as well as a network of other individuals who were detailed in the documents as suspects in Lucas Villa’s case. 

Although there is no information about the nature of these calls, there is a pattern of continuous contact between April 2 and June 18, as detailed in the below graphic.

Bellingcat was able to analyse Call Detail Records  associated with telephone numbers investigated by the prosecution. There is a relatively high volume of calls exchanged between the CTI Investigator, Z-GAULA and the person identified by the Prosecutor’s Office as the primary suspect (Suspect #1 in image). It is not possible to know the details of these conversations or the reasons for these calls from metadata alone, just that they happened.

In total, Z-GAULA exchanged calls with the CTI investigator at least five times between April 29 and May 12, 2021.

Z-GAULA and the CTI investigator also exchanged 62 calls with the principal suspect (suspect#1 in the above graphic) in the weeks before, during and after the killing of Lucas Villa. They also both exchanged calls with another individual identified as the other key suspect in the case (suspect#2 in the above graphic), although less frequently.

Documents also show prosecutors’ initial attempts to intercept Z-GAULA’s phone were unsuccessful apparently due to the wrong cell network being linked to the number. 

The interception of Z-GAULA’s phone was eventually carried out in December 2021, but it only lasted for a period of two weeks. The documents seen by Bellingcat show that investigators concluded the line did not generate relevant information for the case and the interception was cancelled. It appears from the available documents that investigators did not identify who the person described as Z-GAULA was and proceeded to refer to him as “unknown individual”.

However, Bellingcat was able to discover that this phone number could indeed have belonged to a GAULA member. Using open sources we were able to link the number to a picture of this individual wearing a military uniform outside the GAULA Unit in Pereira. But it was not possible to date this image or verify when he would have been a GAULA member.

The National Army, within which the GAULA operates, did not provide an official response to Cerosetenta or CLIP.

CCTV Footage

Other evidence contained within the files corroborated previous reporting by Bellingcat, particularly pertaining to CCTV cameras in use in the neighbourhoods close to where Lucas Villa was killed and where his killers likely made their getaway. 

Bellingcat previously found official documents from the local government specifying the operating status of cameras around the viaduct where Villa was shot two days before the incident. Our analysis showed that cameras P77, located here, were of great interest given their possible angle of vision versus the likely route of escape taken by the perpetrators.

A potential view from a security camera known as P77. (c) Logan Williams/Bellingcat

Data contained in the file surveyed by Bellingcat seems to indicate that indeed cameras P77 were active during and after the shooting. The analysts reported several observations moments before and after Lucas was shot in intervals of one to 10 minutes. However, in the immediate 20 minute period after he was shot, no observations were recorded.

The following are the timestamps where the observations were made by the analysts:

• 2021-05-05 18:03:38
• 2021-05-05 18:40:05 
• 2021-05-05 18:40:45 
• 2021-05-05 18:40:47 
• 2021-05-05 18:42:06 
• 2021-05-05 18:47:24 
• 2021-05-05 18:52:02 
• 2021-05-05 18:52:03
• 2021-05-05 18:53:21 
• 2021-05-05 18:53:49 
• 2021-05-05 18:54:52 
• 2021-05-05 19:03:13
• 2021-05-05 19:03:19 
• 2021-05-05 19:06:50 
• 2021-05-05 19:13:02
• 2021-05-05 19:21:55 
• 2021-05-05 19:21:58 
• 2021-05-05 19:28:27 
• Lucas is shot 19:31
• 2021-05-05 19:47:19 
• 2021-05-05 19:47:25

The documents state that investigators cross-referenced cell phone tower data to estimate the potential route the suspects fleeing the scene took. However, footage from camera P77 could have provided further important evidence. It is unclear from the data seen by Bellingcat why the gap in the timestamps is wider than the rest of the observations around the time Villa was killed. 

The documents seen by Bellingcat also state that camera P26, located close by to camera P77, seemed to be faulty inoperable in the 20 minutes before the killing took place.

The documents state: “Video has damaged index, but plays from 2021-05-05 18:59:59 to 2021-05-05 19:10:51, does not let go forward and stops at the first 00:10:51 minutes of playback”.

A view of CCTV camera status near the area where Lucas Villa was killed. (c) Logan Williams/Bellingcat

Bellingcat put the details about the call data and the actions of the investigator to the Prosecutor’s Office by email, but at time of publication had not received a response.

In response to a previous request for comment from Cerosetenta and CLIP, the Prosecutor’s Office stated that the investigation into the killing of Lucas Villa had been reassigned the Specialised Directorate on Human Rights Violations (“DECVDH”) 

The Colombian National Army, within which the GAULA operates, did not respond to official request for comment from Cerosetenta and CLIP.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

Source: Bellingcat*

*СМИ, выполняющее в России функции иностранного агента и признано нежелательной организацией