Have you heard of these “reputation management” firms? Here in Orange County they advertise on the radio. The basic idea is that if you own company which has received some sort of negative attention on the internet, these companies will help make it disappear. That’s what they promise but I’ve always wondered how it actually works. After all, if someone writes a negative review online about their experience with some company or individual it’s not likely they’re going to just remove it at the request of the company, not without some inducement to do so.

Last week a site called Forbidden Stories, which is focused on threats to journalists, published a story about one such firm and how they (allegedly) operate.

In August 2018, Daniel Sánchez, a Mexican investigative journalist, began receiving peculiar calls and texts about a recent article he’d published. The messages, which according to Sánchez, came weekly, were from individuals claiming to be lawyers who asked him to take down his article.

Sánchez is a journalist at Página 66, a small investigative news outlet in Mexico’s southern Campeche state. In January 2018, Sánchez published an investigation into the bad track record of a video surveillance company, Interconecta, that the state’s governor had contracted. Sifting through financial audit records, Sánchez discovered that the company, a subsidiary of the tech multinational Grupo Altavista, had been linked to cases of corruption and tax fraud.

About two years after Sánchez’s article was published, he received an even stranger request. Sent by a supposed local marketing expert calling himself Humberto Herrera Rincón Gallardo, the email claimed Sánchez’s article infringed upon a European data law called GDPR and asked him to remove references to Grupo Altavista and its founder Ricardo Orrantia. The email was signed by the “Compliance Department” of the European Union.

Sanchez checked with a press freedom group which told he didn’t need to remove the story. One month later someone accused him of copyright infringement. The claim was filed with his hosting provider and, as proof, linked his story to a paraphrased version of his own story which had been published by another site and backdated so it appeared to have been published prior to his. The author of the backdated story was listed as Humberto Herrera Rincón Gallardo, the same name that appeared on the previous request.

Unfortunately, the copyright claim worked and Sanchez was ordered to remove his article or risk losing his entire site.

It turns out both efforts to remove the story were organized by a Spanish reputation management company called Eliminalia. As for Humberto Herrera Rincón Gallardo, he’s a real person but claims he never worked for Eliminalia and that his named was used without his “knowledge or consent.”

Forbidden Stories own story is based on a document leak (50,000 pages) showing details of Eliminalia’s clients between 2015 and 2021. After reviewing the documents for six months, they found some interesting characters who were paying the firm to restore their reputations.

Forbidden Stories identified Eliminalia clients in 50 countries across five continents. The leak of around 1,500 current and former clients includes details of Eliminalia’s business dealings with a medical doctor who reportedly operated a torture center during Chile’s dictatorship and was found guilty of homicide; former bank officials at Banca Privada d’Andorra, accused of money laundering for corrupt Venezuelan officials; and a Brazilian businessman implicated in a global prostitution network, among others…

Others include Pedro Miguel Haces Barba, a union leader who in 2019 was exposed for inking lucrative contracts with two governors later arrested for corruption, and Miguel Angel Colorado Cessa, brother of a Zetas Cartel drug trafficker…

Eliminalia’s clients paid handsomely to have their digital pasts removed. Haces Barba paid €110,000, requesting roughly 300 articles be removed from the internet. AMR Bauxite, a French “responsible” mining company accused of tax evasion in 2020, paid €155,000. Adar Capital Partners, a company founded by Zev Marynberg, an Israeli-Argentine banker accused of laundering money for Hugo Chávez’s regime, hired an Eliminalia partner, paying nearly €400,000.

The group seems to follow a pretty standard script, starting with legal-sounding takedown requests and then upping the ante to copyright claims under the Digital Millennium Copyright Act (DMCA) like the one used against Sanchez. In fact, Eliminalia appears to have done this many, many times.

Qurium identified 3,350 articles naming Eliminalia clients, typically portraying them positively. To make the websites appear authentic, Eliminalia also posted content copyrighted by legitimate media outlets.

Adam Holland from Harvard’s Berkman Klein Center for Internet & Society told Forbidden Stories, “I guarantee you that when they wrote the DMCA, they did not envision that there would be huge networks of eastern European bot armies creating fake newspaper websites to take down criticism.”

Eliminalia seems to have used it’s own expertise in light of negative stories about their work. The company itself rebranded. The offices that used to belong to Eliminalia in Barcelona now belong to a new entity called Idata Protection. Reporters who visited the office were told that Idata Protection was owned by Eliminalia.