On the corner of a block in Sauces 4, a neighborhood in the north of Guayaquil, there is a sign with the legend “TRAMITES LICENCIAS,” offering which the issuance of driving. Other copies of the sheet with black letters have also been taped or glued to the walls of nearby cantons, such as El Triunfo, Milagro and Durán.
“It makes me angry to see this type of advertising in Durán. When you approach the public entity, there are no shifts, you have to wait two months, and they (those who manage illegally) will process it for you the same day,” says Juan José Munizaga, a young man who encountered this publicity a few weeks ago during his morning exercise.
A few months ago, he managed to qualify for his driving license. In his visit to an ANT agency, he says, the presence of processors asking for up to $120 for a license renewal was evident. “It is an evil that will never end in Ecuador,” he says.
The phone number of the pamphlet that Juan José saw does work, in fact they answer by text messages to questions about how to process a driving license.
“We do the paperwork, but you have to go to the agency to take your picture and sign. The professional license has a cost of $1,300.”
Offerings of first-time license issuance, duplicates, or renewals of this and other documents are also common among items offered on the OLX e-commerce site or the Facebook store.
This type of illegal work is not only carried out by people independently, but also by criminal organizations that have issued these permits irregularly on a daily basis. According to the data and testimonies obtained for this investigation, the dynamics are recurrent and involve ANT officials who take advantage of their position and the weaknesses of the computer system to benefit from a parallel business for almost a decade.
This means that for 10 years, this illegal issuing of licenses operates outside of the official data handled by the transit entity, whose most complete and recent records date from 2015. The statistics of services related to driving licenses of previous years is incomplete or does not exist, according to the ANT.
In the data obtained for this report, from January 2015 to August 2021, the provinces of Pichincha, Guayas, Manabí, Azuay and El Oro were identified as having the highest number of transactions; the five account for 63% of these services. In those provinces, the operation of processors or networks of irregular procedures has also been evidenced, in accordance with judicial monitoring.
A vulnerable computer system
The transactions of issuing licenses, modifications of driving license points, registration of fines, vehicle registration, among other services, are carried out in the AXIS 4.0 computer system, the software that the ANT acquired to improve the administration of registration records. It was chosen because of its features and the handling of its users’ data. On December 13, 2012, the institution signed contract No. 058DE-DCP-ANT-2012 for the acquisition of a single integrated transit system at the national level with the company Yoveri SA -which was directly invited in a contractual process under the modality special regime – for an amount of $1.1 million.
However, the implementation of this digital platform was not the solution that the institution expected, since it experienced failures and unauthorized access to the database that have compromised services and records on several occasions, according to an audit report from the Comptroller General of the State and of investigations of the Intelligence service.
In the report on the availability and operability of the Single Integrated Transit System, approved on April 11, 2019, it is stated that the ANT signed the final delivery-receipt act of the contract with Yoveri on April 15, 2015, and just weeks later, the system problems in vehicle domain transfer procedures, errors in the printing of stickers, in the values to pay, and the allocation of vehicle registration shifts, among other problems.
“The inconveniences persisted, with 4,048 incidents related to vehicle registration procedures being reported as of April 12, 2017,” says the report. On December 31, 2017 – the audit cutoff date – the problems continued.
The guarantees to access the ANT’s unique database were also observed by the audit team.
In the analysis, it was determined that the servers where the Single Integrated Transit System database are hosted, could be accessed from any internet connection, without restrictions, with the possibility of having available methods to interact or update vehicle information, owners, locks, among others.
Another weakness that was identified was related to the lack of a list of database users that were used by the municipalities, nor the permits, if they were granted. For example, the user of the database used by the Machala Municipal Public Mobility Company had free access to read 22 data tables and 27 database views, update databases, without these actions having the authorization of the transit agency, according to the report of the control body.
These weaknesses in the technological infrastructure were added to the threats that the former National Intelligence Secretariat (Senain) had identified in 2016, which carried out an analysis of the equipment used by officials of the transit agency and the information traffic of the state network. Based on these expert opinions, the ANT filed a complaint on May 2, 2016, but it did not appear in the public consultation records of the Prosecutor’s Office, on December 7th.
The researchers reviewed the incoming and outgoing connections of the ANT network and detected that there was an external IP address (unique address to identify a device on the internet), that is foreign to its systems, which had frequent connections to internal computers of the ANT. That external IP registered an address from Orlando, Florida, United States.
“They hired a server, a computing device that stores, distributes and supplies information, with complex encryption security. Those who connected to the server did so with a device where they opened Linux, an alternative operating system that can be run from a USB memory stick. There they had the entire operating system (virtual machine) and it was difficult to capture that traffic or its origin,” explained a source experienced in digital forensic analysis.
With this mobile device, for example, the carrier could connect from Quito to the server in the United States and, from there, enter the ANT system where the database was hosted. “(With additional help) we identified that he was moving to Guayaquil, Quito, Cuenca. It was multipoint, but the range was too wide to establish an exact location,” explined the IT specialist.
As part of the forensic analysis, the researchers identified a malware (malicious program) on the institution’s computer equipment, which was activated through a Windows application to circumvent any antivirus.
“In order for the virus to enter the institution, a person had to have been manipulated or deceived by sending him an email or a flash memory that, when connected, an AutoRun (executable program) could be activated, which could be a virus. Or there is the other option, which could have been deliberately executed by someone from the institution,” explained Fernando Illescas, a computer expert consulted on the report. Illescas believes that within public institutions, especially when handling sensitive information, there should be a permanent video recording system.
In the audits that were carried out between June and October 2016, modifications to the driver’s license databases and elimination of fines were identified, for example. Passwords of ANT employees were used from unauthorized computers to have this type of access. And collaborator users who should not have permissions to manipulate the records were identified, according to the Intelligence report, which reveals “illegitimate changes in the database of the driver’s license system and malware detected on the computers.”
In the final part of the analysis, the researchers reported another anomaly in the information traffic. In an IP address used by the Yoveri company “to support the entire ANT system,” text strings were identified that were related to a user and name of the computer equipment with which irregular modifications were made to the database of the transit agency.
The source that had access to the investigation says that the activity of external agents was stronger when they were located in Guayas, that is, that more illegal transactions were made to the ANT system, particularly in Guayaquil and Samborondón. “They knew exactly the code of the AXIS system, of its base,” he adds.
Processor networks, a long-standing evil
Citizens who go to the illegal processors risk receiving documents that could be false, although in several operations that the Police have carried out, original papers have also been found, that is, documents that have been acquired by the institution in its normal supply, but which have allegedly been diverted by officials of the entity.
There are more complex structures that participate in this black market of traffic procedures and that operate as circuits in several cities where there are ANT offices, says the source who had access to the intelligence investigation carried out in 2016.
One of these criminal structures operated with people who performed different roles: the processor captured the clients, he handed over the money to another person who was responsible for collecting the money and ordering procedures for the day from one or more agencies. The collector took the money to the head of the operation, who gave a part of the money to the public official with whom they worked, according to the informant. If it was a professional license, they charged about $500, which was divided between the links of the operation, for example.
“There were about ten people who were rotating (…). This system shielded the organization if the lowest members fell,” the source explained.
If the Police managed to arrest the processor, he was unaware of the organization’s sensitive information because he only had contact with the collector, to whom he gave the money and the identification number of the person interested in acquiring the document. In eight days, the organization delivered the driver’s licenses. The person delivering the document met with the processor at a different location from the initial contact. There the processor gave the difference of the amount agreed for the driving license.
These organizations take advantage of the need of hundreds of users of transit services who do not obtain a solution despite the long waiting time, such as Fabián Rodríguez, a citizen who since last year formally requested a permit from the ANT to install polarized sheets in the windows and windshield of your car, to protect yourself from the sun due to a health problem in the skin.
“I asked the ANT to give me the green light to install the sheets, for safety, and I have my certificate from my dermatologist that says that I cannot walk in the sun, but the ANT has denied me and no longer even responds, but I go to social networks and I tell a man to help me get the polarized permit and he says, ‘Now, no problem, it’s $75 and I’ll give him an original certificate, it took me 15 days,” says Rodríguez, who says that he reported this to the agency, although he has not received a response either.
According to the director of the ANT, Adrián Castro, improvements are made in computer security and in the attention protocols of the entity’s offices, such as the process to protect the shift allocation system, which presented constant problems due to the actions of processors who managed to capture the quotas with the help of certain public officials.
“At this moment we have a blocking system, the appointment negotiation is over. Come to the agency to see how comfortable the appointment is. We have appointments in all the agencies for December, we have a lot. Before we had appointments available for August 2022,″ says Castro, who warns citizens not to be fooled by the offers of appointments that still persist on social networks.
According to Castro, the processors – who took advantage of the fragility of the scheduling system – sold the same appointment to several people who went to the businesses where they operated, many times, around the ANT agencies or through social networks. Once they sold an appointment, they canceled it and offered it again. This generated a problem of lack of availability of spaces thru April of the following year.
Openly flaunting access
There are dozens of ads on Facebook that offer transit procedures. In one of the publications, a person says that he has appointments in exchange for a payment of $15, which is made through digital means after receiving an alleged screenshot of the system.
In other cities, such as Santo Domingo, the cost of the alleged shifts, until a few weeks ago, came to $100, according to a source who requested that his identity be hidden. That value, he says, is distributed supposed public officials who operate in coordination through WhatsApp messages.
The province of Santo Domingo de los Tsáchilas is one of the main jurisdictions that concentrate the origin of most of the 35,000 driver’s licenses with irregularities that the ANT cancelled more than two months ago. Similarly, Guayas, Pichincha and Azuay have a large participation in that record. A few days ago the transit entity reported that another 50,999 permits also have anomalies and will be removed from the system.
The economic damage to the State of the first group of irregular documents amounts to more than $2 million, said the director of the ANT.
However, the amount of money that has stopped entering the state coffers due to the operation of a parallel system of procedures would be much higher. “It is estimated that the economic losses of the National Transit Agency, caused by the attackers, is around $20 million, approximately,” according to the Intelligence report of the analysis that was made between September 2016 and January of 2017.
The records of the 35,000 driver’s licenses with anomalies that were annulled by the ANT, show that type B and E licenses were more in demand and that a part of the beneficiaries of the documents is originally from provinces other than the agencies where the procedures were carried out.
How has justice acted to combat corruption?
The illegal offer of transit procedures, which is public and with greater notoriety in recent years due to the proliferation of advertisements on social networks, has not been unrelated to the eyes of the authorities on duty and the justice system.
The problem has persisted without a clear solution. The Prosecutor’s Office has received 103 complaints or news of the crime related to the irregular issuance of driver’s licenses and violation of the ANT’s computer system, from January 1, 2010, to October 22, 2021. Only 8% of the investigations reached trial and recorded convictions.
In the Synergy III operation, which was carried out at dawn on December 13, 2017, the Police detained more than 50 people in ten provinces. Two years later, twelve people were sentenced for the crime of organized crime: seven received three years in prison and five, one year of deprivation of liberty.
Among those convicted were an active-duty police officer and at that time a former director of the ANT General Secretariat, according to court records.
“It was established within the investigation that Mr. Richard Jara used the telephone number 0999338XXX and communicated with Mr. Víctor Salazar who had the number 0984284XXX, which from the conversations it emerged that they dealt with aspects of frequency changes of transport cooperatives such as the Homeland-Putumayo and for that reason they charged large sums of money,” reads the judicial process that includes the activities carried out by the defendants. They operated in independent groups to offer certain services, such as issuance of professional licenses, change of license type, recovery of license points, elimination of fines, among others, for which they were charged between $125 and $30,000, according to court documents.
According to the investigation, the convicts, who were members of various groups that operated in Quito, Guayaquil and Babahoyo, carried out illegal procedures using digital logins that had been assigned to ANT officials. With those credentials they modified records in the AXIS 4.0 system.
The prosecutor Giancarlo Almeida explained that the investigations of these types of cases take time due to the complexity of finding the evidence of the links, charges and way of operating of the members of the organizations involved in those events.
“By the fact that I meet with a person, I cannot prove that there is an illicit association. The record of that meeting will serve me together with another element to support an accusation. For example, wiretapping. The law even provides for undercover agents to help identify who the people are who are engaged in this type of activity,” said Almeida, who has investigated similar cases.
He added that investigations also depend on the collaboration of the public, because on many occasions the complaint is not presented, or the calls of the proceedings are not attended.
A new system to manage ANT services
Almost ten years after the ANT contracted a technological solution that registered failures and presented vulnerabilities in its security, according to official reports, the entity is preparing a contractual process to seek new software to manage transit services with efficiency and transparency.
Currently, the National Telecommunications Corporation (CNT) supports the ANT’s electronic communications, subcontracting Yoveri.
While it is technologically shielding itself, the transit agency also supervises the actions of the officials, says Castro, because he is “convinced that there is complicity with people from within” of the entity. However, he comments that it is not easy to purify the institution when there are servants with permanent appointments, who cannot be dismissed without due judicial and administrative process.
The official insists that he has filed several complaints and that the Prosecutor’s Office will have to investigate to determine responsibilities in a judicial process.
The business that revolves around the irregular issuance of driver’s licenses, vehicle registration, recovery of points, elimination of fines, among other procedures, has revealed that the presence of mafias is registered in almost all the provinces of the country and that its power has permeated at different levels of the governing institution of transit. Faced with this problem, users of the entity and citizens who travel through the streets and highways of the nation hope that a true purification will be carried out.