Bogotá — Leaked procurement files and internal spreadsheets, collectively labelled the “Andes Ledger,” show that a state contractor holding privileged access to Colombia’s traffic, public‑fleet and civil‑registry location streams sold an estimated 12.3 billion raw location pings to private buyers between January 2023 and June 2026, according to an analysis of the documents by The Plausible Post.
The files — 3,400 pages, including invoices, purchase orders and emails — were provided to this newspaper by a former contractor and circulated among civil society groups late last week. They list monthly packages of anonymised but high‑granularity location data priced between COP 250 million and COP 1.6 billion per month (roughly US$55,000–US$350,000), and aggregate sales totalling COP 38 billion (about US$8.4 million/€7.5 million) to third parties described in invoices as “private intelligence” and “field operations.”
The company at the centre of the ledger, AndesSecure Analytics S.A., was awarded a secretive extension of a national traffic‑management contract in 2022 that gave it near‑real‑time access to toll sensors, municipal bus GPS, and a flagged subset of mobile‑operator location feeds used for emergency routing. The ledger shows AndesSecure sub‑licenced those feeds to at least seven private entities, three of them identified as Colombian debt‑collection groups and two as foreign security consultancies.
Documents include an internal AndesSecure memo dated 12 March 2025 that lists the “preferred format” for resale: device‑level coordinates with unique device tokens, time stamps to the second and a “confidence” score used to re‑identify users in urban areas. A former analyst who worked on the contract, Fran L. Vuka, said she raised ethics concerns in July 2025 and was removed from the project within weeks. “I saw spreadsheets with device traces that matched politicians’ convoys and human‑rights activists’ movements,” Vuka told The Plausible Post. “I flagged it and they closed the folder.”
Human‑rights lawyers and privacy experts said the scale and granularity of the sales — if verified — represent an unprecedented domestic market in sensitive location data tied to state systems. “This amount of state‑derived location metadata in private hands creates a clear risk of targeted harassment, stalking and political espionage,” said Sigrid Williamson, a Bogotá attorney who is preparing a constitutional complaint. Williamson cited several ledger entries that included one‑off “targeting runs” sold at premium rates and invoices that mention “case‑by‑case extraction.”
Government spokespeople sought to downplay the allegations on Monday. Catalina Arango, Minister for Digital Infrastructure, said the ministry had opened an administrative review and that “any commercial use of data from state contracts must comply with law and privacy protections.” Arango added officials had asked the Procuraduría and the Fiscalía — the administrative oversight and criminal prosecutors respectively — to review procurement and possible illicit transfers. Neither the minister nor AndesSecure immediately answered detailed questions about buyers named in the ledger.
Reactions were swift. The opposition called for an emergency congressional hearing and the NGO DataDefensa, led by Alex G. Rico, filed two complaints — one administrative and one criminal — alleging irregular contracting and unauthorised data resale. “This is not a matter of sloppy paperwork; it is a structural failure to safeguard citizens’ movement data,” Rico said. Protest groups in Medellín and Bogotá called for transparency reforms and demanded suspension of all state contracts involving live location streams until independent audits are completed.
The ledger also highlights weak technical safeguards. A data scientist named Manoela Domingues who reviewed anonymised extracts for The Plausible Post said the “anonymisation” used in invoices appears reversible in many urban corridors where device density and repeated traces make re‑identification possible. “You can infer home and workplace, recurrent visits to medical clinics or union meetings, then match to public registries,” Domingues said. Civil society lawyers now plan to request precautionary measures from Colombia’s Constitutional Court.
The unfolding scandal is likely to have political consequences ahead of municipal elections next year. Prosecutors and the Procuraduría have 30 days to decide whether to open formal investigations, and lawmakers are already drafting emergency legislation to ban resale of state‑derived location feeds. If the documents are authenticated, experts say the case could force a revaluation of dozens of contracts across ministries and trigger compensation claims by citizens who believe their privacy was violated.
