A Case Study in Colombian Government Cybersecurity Failures

Introduction
In October 2025, the US Treasury sanctioned Colombian President Gustavo Petro under OFAC's narcotics trafficking designation. The former M-19 guerrilla member became one of the few sitting heads of state on the Specially Designated Nationals list. President Trump called him an "illegal drug dealer." Secretary Rubio deployed the USS Gerald R. Ford to the Caribbean. Petro responded: "Want to put me in an orange jumpsuit? Try it."

While this diplomatic crisis unfolded, I conducted a comprehensive OSINT analysis of Colombian government digital infrastructure. What I found was remarkable: the presidential office was running a completely unauthenticated ArcGIS server containing military intelligence maps, armed group territorial data, and the GPS coordinates of 24 FARC reintegration camps.

The Colombian National Police had built an AI platform on AWS with exposed account credentials. Military subdomains numbered over 400. Intelligence agency codename servers were discoverable through basic DNS enumeration.

2 gigabytes of sensitive government data, accessible to anyone who knew where to look.


The ArcGIS Problem
The Colombian presidency operates an ArcGIS Enterprise server at ergit.presidencia.gov.co. ArcGIS is Esri's geographic information system platform, commonly used for mapping and spatial analysis.

The problem: the REST API requires no authentication.

URL: https://ergit.presidencia.gov.co/server/rest/services
Status: PUBLICLY ACCESSIBLE - NO AUTHENTICATION REQUIRED
Version: ArcGIS Enterprise 11.3.0 (Build 51575)
Services: 300+ across 26 folders

I enumerated the entire service catalog:

Root folder: 33 services (military maps, judicial data)

Hosted folder: 240+ services (armed groups, violence, coca cultivation)

DDHH folder: 22 services (human rights, protection routes)

UnidadCumplimiento: 8 services (compliance tracking)

aicma: 4 services (landmine data)

FondoPaz: 2 services (peace fund projects)

The "Hosted" folder alone contained 240+ feature services with live operational data. Military maps were tagged with "MIL1" suffixes. Armed group territories were mapped by organization: ELN, Clan del Golfo (AGC), EMC-FARC dissidents, Segunda Marquetalia.

These weren't historical archives. The September 2025 military operational map was 156 megabytes of current intelligence.


Military Intelligence Maps
Four military maps were publicly accessible in the ArcGIS gallery:

CNR_SEP_2025_MIL1: September 2025 operational map (156 MB)

CNR_julio_2025_MIL1: July 2025 operational map

Mapa_AT_MIL1: AT zone military map

Mapa_Caso_03_MIL1: Case 03 investigation map

Each map contained multiple layers with polygon geometries defining armed group areas of operation, military response zones, critical infrastructure locations, and investigation case boundaries.

The maps were not just accessible through the API. They were visible in the public ArcGIS gallery. Anyone browsing the portal could view them.


Armed Group Territorial Data
I downloaded complete territorial datasets for Colombia's major armed groups:

ELN (National Liberation Army): 11 zones + critical zones data (21 MB)

Clan del Golfo (AGC): 22 zones + presence data (1.9 MB)

Disidencias EMC: 22 zones + critical zones (97 MB)

Segunda Marquetalia: 21 zones (December 2024 data)

Disidencias EMBF: 11 zones

TOTAL: 87+ armed group zones mapped with precise polygon boundaries.

This data shows exactly where each armed group operates, their territorial boundaries, and areas of conflict overlap. For anyone tracking Colombia's internal conflict, this is primary source intelligence.

For the armed groups themselves, it's a map of what the government knows.


Peace Signatory Exposure
The 2016 peace agreement between the Colombian government and FARC created Territorial Spaces for Training and Reintegration (AETCR), camps where former combatants would demobilize and reintegrate into society.

The ArcGIS server exposed:

163 MB of signatory location data (Firmantes mayo 2025)

37.7 MB of attack data (110 incidents in H1 2025)

24 AETCR camp locations with GPS coordinates

Individual attack records: 29 homicides, 9 disappearances, 68 threats

The peace signatory data included precise coordinates for reintegration camps and incident locations. For former combatants facing ongoing violence from armed groups, this exposure creates direct physical risk.

110 attacks on peace signatories in the first half of 2025. Their locations are now public.


The Police AI Platform
The Colombian National Police operates an AI platform at ia.policia.gov.co built on AWS infrastructure.

Through subdomain enumeration, I discovered 20+ services:

app.ia.policia.gov.co - Main application (Next.js, CloudFront)

nadia.ia.policia.gov.co - NADIA AI assistant (Amazon Bedrock)

aisearchengine.ia.policia.gov.co - AI-powered search

houndoc.ia.policia.gov.co - Document analysis AI

aitranscribe.ia.policia.gov.co - Audio/video transcription

anticipacion.ia.policia.gov.co - Predictive analytics

maps.analytics.ia.policia.gov.co - Crime mapping

iam.ia.policia.gov.co - Identity and access management

The NADIA assistant uses Amazon Bedrock, Amazon's enterprise AI service. The platform represents significant investment in AI-powered law enforcement.

Critical AWS Exposure:

S3 Bucket: pon-prod-ai-platform-926162397524.s3.amazonaws.com

AWS Account ID: 926162397524

Region: us-east-1

Pre-signed URLs in the application exposed temporary AWS credentials:

X-Amz-Credential: ASIA5PI4UVFKHTDCT3EL/20260105/us-east-1/s3/aws4_request

These credentials are time-limited (15 minutes) but reveal the AWS infrastructure architecture and account structure.

Session cookies were also captured from forms.ia.policia.gov.co with 10-year expiration dates.


Military Infrastructure Enumeration
Colombian military domains revealed extensive subdomain sprawl:

ejercito.mil.co (Army): 147 subdomains

armada.mil.co (Navy): 94 subdomains

fac.mil.co (Air Force): 79 subdomains

cgfm.mil.co (Joint Forces): 41 subdomains

TOTAL: 421+ military subdomains

Notable discoveries:

Army: Oracle servers exposed, internal IP ranges (200.122.226.0/24)

Navy: Secondary ArcGIS server

Air Force: GitLab instance discovered

Joint Forces: Multiple collaboration platforms


Intelligence Agencies
Colombian intelligence agencies showed mixed operational security:

DNI (National Intelligence Directorate) - 15 subdomains discovered

Codename servers found:

birmania.dni.gov.co

denver.dni.gov.co

kuwait.dni.gov.co

correocifrado.dni.gov.co (encrypted email)

The geographic codenames (Burma, Denver, Kuwait) suggest operational naming conventions. The encrypted email subdomain indicates secure communications infrastructure.

Fiscalia (Prosecutor's Office) - 30+ subdomains including GIS applications, payroll systems, recording systems, and case management.

DIJIN (Criminal Investigation) - 5+ subdomains including Pandora case management system and INTERPOL integration.


Exposed Credentials
The ArcGIS feature data contained embedded contact information:

Total emails extracted: 494

Government emails (.gov.co): 113

Usernames: 3

Hashes/GUIDs: 103

Government emails included:

PRESIDENCIA.GOV.CO: alejandrazuleta@, fernandoguevara@, jaidycaro@

MUNICIPAL GOVERNMENT: 109 personeria and local government emails from Antioquia, Arauca, and other departments

These emails came from human rights data, protection requests, and municipal government submissions. Government employees submitting data to the platform had their contact information exposed in the public API.


Violence and Crime Statistics
The ArcGIS server contained comprehensive violence data spanning 2010-2025:

Homicides: 1,822 records (2016-2025)

Massacres: 490 incidents

Femicides: Multi-year tracking

Kidnappings: By municipality

Extortion: Regional data

Human trafficking: Case records

Displacement: Population movement

Indigenous reserves: 785 territories mapped

This represents Colombia's internal conflict documentation, the official government record of violence, casualties, and displacement.


Complete Infrastructure Summary
Government:

ergit.presidencia.gov.co: ArcGIS Enterprise 11.3.0 (300+ services, NO AUTH)

ia.policia.gov.co: Police AI Platform (AWS, 20+ subdomains)

dni.gov.co: National Intelligence (15 subdomains, codename servers)

fiscalia.gov.co: Prosecutor's Office (30+ subdomains)

mininterior.gov.co: Interior Ministry (27 subdomains)

Military:

ejercito.mil.co: Army (147 subdomains, Oracle exposed)

armada.mil.co: Navy (94 subdomains, ArcGIS)

fac.mil.co: Air Force (79 subdomains, GitLab)

cgfm.mil.co: Joint Forces (41 subdomains)

Political Party:

colombiahumana.co: Petro's party (54 subdomains)

pactohistorico.co: Coalition party (12 subdomains)

TOTAL SUBDOMAINS: 513+

TOTAL DATA: 2.0 GB

Full dataset + interactive maps: github.com/Ringmast4r/Colombia


The US-Colombia Crisis Context
This exposure occurred during an unprecedented diplomatic crisis:

September 2025: US revokes Petro's visa after UN speech calling on soldiers to disobey Trump

October 2025: Treasury sanctions Petro and family under OFAC narcotics designation

November 2025: Petro challenges Rubio, USS Gerald R. Ford deploys to Caribbean

January 2026: After Maduro's capture in Venezuela, Petro condemns US intervention and deploys troops to the border

Colombia halted intelligence sharing with the United States. Yet the same government left 2 gigabytes of military intelligence accessible to anyone on the internet.


What This Reveals About Colombian Cybersecurity
The Colombian case demonstrates systemic failures in government cybersecurity:

1. Unauthenticated APIs
The ArcGIS REST API required no credentials. 300+ services were publicly enumerable. This is a configuration choice, not a vulnerability.

2. Sensitive Data in Public Systems
Military maps, armed group territories, peace signatory locations, all stored in a system accessible without authentication.

3. Cloud Infrastructure Exposure
AWS account IDs, S3 bucket names, and temporary credentials exposed through pre-signed URLs. The infrastructure architecture is now known.

4. Subdomain Sprawl
513+ subdomains across government and military domains. Each represents an attack surface. Many were discoverable through basic certificate transparency queries.

5. Contact Information Leakage
494 emails embedded in feature data, including 113 government employees. Human rights submissions exposed the people seeking protection.


The Broader Implications
Colombia's government spent resources building sophisticated AI platforms and geographic intelligence systems. That same government:

Left 300+ map services accessible without authentication

Exposed 24 FARC reintegration camp GPS coordinates

Published armed group territorial boundaries

Leaked 494 email addresses including 113 government employees

Revealed AWS infrastructure credentials

The agencies responsible for tracking armed groups and protecting peace signatories exposed the very data that could endanger those individuals.

Open source investigators can now correlate:

Armed group territories from ArcGIS feature data

Peace signatory locations from reintegration camp coordinates

Government contacts from embedded email addresses

Infrastructure architecture from AWS credentials

All without touching anything that wasn't publicly accessible.


Remediation (What Should Have Been Done)
Enable authentication on ArcGIS REST services

Separate classified and public data infrastructure

Audit AWS pre-signed URL configurations

Inventory and secure 513+ subdomains

Sanitize contact information from feature data

Regular security assessments


Conclusion
The Colombian presidency operates comprehensive geographic intelligence systems. Military maps track armed group territories. Police AI platforms predict crime patterns. Human rights databases document ongoing violence.

All of this was publicly accessible.

2 gigabytes of data including:

300+ ArcGIS services with military intelligence

87+ armed group territorial zones

24 FARC reintegration camp coordinates

494 exposed email addresses

AWS infrastructure credentials

513+ enumerable subdomains

The tools used were standard OSINT methodology:

Certificate transparency (crt.sh)

DNS enumeration

ArcGIS REST API queries

HTTP header analysis

No exploitation. No authentication bypass. Just publicly accessible infrastructure and basic reconnaissance.

While Colombia's president faced US sanctions and challenged American foreign policy, his government's digital infrastructure stood open. A regime focused on external threats while ignoring internal security failures.

---

Colombia OSINT Project - January 2026

All data collected from publicly accessible sources without authentication bypass or system compromise.

Full dataset + interactive maps: github.com/Ringmast4r/Colombia