Investigations
Contents
When Brazilian police pulled over a nondescript passenger car on a sun-baked highway in February 2008, the panic inside the vehicle unfolded in a matter of seconds[3]. One of the passengers, a Lebanese-Brazilian named Farouk Sadek Abdou, frantically began crumpling and tearing a scrap of paper, desperately attempting to swallow or shred it before the officers reached the window[3]. When federal agents pieced the torn fragments back together, they found seventeen telephone numbers—a cryptic sequence of contacts that would later form the evidentiary foundation of an explosive intelligence hypothesis[3]. Six years later, when veteran investigative journalist Francisco Leali broke the story in O Globo, those seventeen numbers were revealed to link South America’s most disciplined and lethal prison syndicate, the Primeiro Comando da Capital (PCC), directly to facilitators associated with Hezbollah[1],[3]. The alleged arrangement was as transactional as it was dangerous: the Lebanese network offered the prison gang access to sophisticated international black-market weapons and military-grade explosives stolen in Paraguay; in exchange, the PCC’s ironclad prison command guaranteed physical protection for Lebanese inmates held across Brazil’s penitentiary system[1],[3]. Yet as cocaine pipelines expanded across the Atlantic and Rio de Janeiro prosecutors unsealed sweeping money-laundering indictments in July 2026, the critical question facing counterterrorism investigators was whether they were looking at a formal, ideological alliance—or something far more elusive: a pragmatic marketplace where prison gangs, commercial middlemen, and global terror brokers quietly trade access, logistics, and survival[1],[4].
The initial intelligence documents, synthesized in InSight Crime’s reporting, traced the genesis of this contact to roughly 2006, crystallizing under federal surveillance in 2008[1]. In addition to reciprocal protection, the reporting cited suspected trafficking in military explosives, tentatively identified as C4, allegedly sourced from Paraguayan arsenals[1],[3]. Over the intervening years, the PCC’s hegemony exploded beyond the prison walls into a corporate-style transnational narcotics conglomerate moving hundreds of tons of cocaine toward European and African shores, while financial investigators steadily uncovered shadow service providers laundering capital for multiple rival underworlds simultaneously[9],[10]. The widening commercial map gave the historical allegation immense weight, but it also introduced a persistent analytical hazard: the temptation to conflate shared physical terrain, commercial brokers, and shared smuggling corridors with a singular, unified conspiracy[4],[27].
In July 2026, prosecutors and civil police in Rio de Janeiro demonstrated the complexity of this underworld during Operation Hawala[4]. Targeting a multi-layered money-laundering network servicing Brazil’s three foremost warring factions—the PCC, the Comando Vermelho (CV), and the Terceiro Comando Puro (TCP)—investigators disclosed that the financial wires contained explicit references to Hezbollah[4]. Crucially, the authorities drew a careful line: while one financial transaction involved an individual sanctioned for alleged links to Al-Qaeda, the references to Hezbollah belonged to a distinct, nascent investigative track that required further verification[4]. The entire trajectory of the PCC–Hezbollah inquiry exists between those two moments: an enigmatic slip of paper recovered on a highway, and an international financial probe unraveling the multi-client brokers of the modern underworld[3],[4].
The protection that prisoners could trade
The PCC’s origins lie in the blood-soaked cells of São Paulo’s Casa de Detenção in 1993, formed in the traumatic wake of the Carandiru massacre[2]. InSight Crime’s institutional profile traces how state correctional policies inadvertently catalyzed the gang’s expansion: by transferring charismatic leaders to disparate state facilities in an attempt to fragment their influence, the penal apparatus essentially built the PCC’s national communication grid[2]. By February 2001, the syndicate demonstrated its terrifying reach by orchestrating coordinated, simultaneous uprisings across twenty-nine penitentiaries[2]. The state had moved the prisoners, but the command had learned to govern the space behind the bars[2].
Within this grim environment, physical safety and order became commodities of supreme value[20]. A comprehensive joint study by InSight Crime and American University’s Center for Latin American and Latino Studies (CLALS) outlines the social compact forged by the command: legal assistance for incarcerated brothers, monthly stipends and welfare for their families, strict internal behavioral codes, and an omnipresent network of smuggled mobile phones[20]. Drawing on extensive fieldwork inside prisons and interviews with judicial officials, wardens, social workers, and journalists, the study presents an organization that functioned less like a street gang and more like a criminal cooperative, balancing collective governance with significant autonomy for individual commercial enterprise[20].
Criminologists Benjamin Lessing and Graham Denyer Willis dissected the inner workings of this governance through hundreds of seized accounting ledgers, disciplinary minutes, and trial records[19]. They documented a consignment-based drug wholesale system, rigorous internal bookkeeping, and an insurance-like redistribution of capital to sustain incarcerated members[19]. Notably, within the disciplinary archives they analyzed, punishments for financial delinquency or infractions were overwhelmingly bureaucratic and nonviolent—demotions, fines, or exclusion from trade routes[19]. This insight illuminated the PCC’s power: it operated through structured legitimacy and market exclusion rather than constant terror[19].
This internal architecture explains why an outsider, particularly a foreign detainee facing the brutal conditions of Brazilian prisons, would seek a formal arrangement with the command[19],[20]. A prisoner’s need for physical survival is immediate, requiring local pacts rather than grand strategic treaties[19]. For a smuggler or arms broker, securing the physical safety of associates in São Paulo’s maximum-security wards like Presidente Venceslau required trading the only assets they possessed: external procurement channels[1],[3].
Yet the police intelligence dossiers reviewed by Leali noted that this mutual arrangement was inherently asymmetric[3]. A 2009 Brazilian intelligence assessment concluded that the transaction tilted heavily in favor of the PCC, which leveraged the relationship to expand its military firepower, while the foreign detainees received localized protection[3]. Furthermore, the intelligence files reflected genuine investigative ambiguity regarding the explosives, noting that while the material appeared to be C4, laboratory confirmation was absent[3]. The portrait that emerged was not an ideological brotherhood, but a gritty prison transaction born of operational expediency[1],[3].
An allegation acquires a longer life
Once leaked, the story of the prison-yard pact took on an expansive life of its own in international security debates[11],[18]. In testimony before the U.S. House Committee on Homeland Security in April 2018, senior fellow Emanuele Ottolenghi cited the 2014 O Globo disclosures, positing that transatlantic cocaine trafficking and trade-based laundering served as the underlying commercial currency uniting the PCC and Hezbollah[11]. This analytical leap was significant: it grafted a sophisticated, macro-level narco-terror financing theory onto what had originally been documented as a localized prison-defense arrangement, without citing newly uncovered direct transactions between the groups[3],[11].
Conversely, political scientist José Pedro Zúquete, in a 2017 study on Brazilian counterterrorism policy, offered a far more skeptical assessment[18]. Analyzing Brazilian security perspectives, Zúquete noted that domestic intelligence analysts viewed the contacts as episodic, ad-hoc underworld encounters rather than a structural, enduring partnership[18]. His analysis highlighted the broader geopolitical friction surrounding the Tri-Border Area (TBA), where Brazilian authorities repeatedly pushed back against Washington-driven narratives that they felt stigmatized the sizable, prosperous Lebanese-descendant diaspora in Foz do Iguaçu[18].
These divergent viewpoints framed the real investigative challenge[11],[18]. Discarding the intelligence outright would ignore documented channels through which lethal weapons entered South American cities; yet elevating transactional encounters into a permanent geopolitical axis risked misunderstanding how the PCC actually operated[1],[3],[18]. The PCC’s commercial machinery did not require ideological affinity; it was a market-driven behemoth that partnered with anyone who could guarantee transit, supply weapons, or move wholesale product[20].
From the prison connection to the port
The transformation of the PCC from an incarcerated mutual-aid union into an international narcotics exporter fundamentally reshaped Atlantic trade[8],[9]. The United Nations Office on Drugs and Crime (UNODC) 2023 Global Report on Cocaine details a segmented logistics architecture in which the PCC rarely commanded the entire supply chain directly[8]. At the Port of Santos, Latin America’s largest container hub, independent criminal logistics groups paid the PCC a toll or percentage to utilize export streams[8]. Abroad, the PCC acted as an investor and wholesaler, financing massive maritime loads while subcontracting reception and distribution to European and African syndicates[8],[10].
A joint analysis by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) and Europol corroborated this decentralized model[10]. Latin American cartels deployed trusted emissaries to European and West African transit hubs to negotiate transactions, while local cells handled extraction from container ships, bonded warehouses, and wholesale cash collection[10]. This fragmented chain was further explored in ground-breaking research by Gabriel Feltran, Isabela Vianna Pinho, and Lucia Bird for the Global Initiative Against Transnational Organized Crime (GI-TOC)[9]. Examining maritime routes from Brazilian docks, they observed that by 2019, West African hubs—specifically Nigeria, Ghana, and Sierra Leone, alongside historical transit routes through Senegal—became primary maritime destinations for cocaine concealed in cargo ships departing Santos and Paranaguá[9]. In these West African coastal cities, the PCC’s wholesale shipments directly entered markets where Lebanese trading networks had been entrenched for generations[9].
Different specialists handle different legs
The segmented logistics described in UNODC and European research.
Wholesale investment and access to export streams. [8]
Local partners handle extraction, distribution and collection. [10]
The industrial magnitude of this commerce was laid bare in November 2020 by Brazil’s Federal Police during Operation Enterprise[6],[17]. Initiated after a routine 2017 seizure at the Port of Paranaguá, the multi-year investigation pieced together wiretaps and international banking records to dismantle a sophisticated trafficking network headed by a former Brazilian military police officer residing in Europe[6]. The operation exposed an intercontinental enterprise utilizing maritime cargo, modified private jets, ocean-going fishing vessels, and commercial fruit shipments[6]. The assets seized by Brazilian and European authorities were staggering: luxury real estate, dozens of aircraft, commercial fleets, and a van discovered in a Lisbon suburb stuffed with over €11 million in cash[6].
Yet even as Enterprise showcased unprecedented international coordination supported by Europol and the EncroChat decryption, law enforcement leaders acknowledged the systemic resilience of the network[7],[17]. In a candid interview, Elvis Secco, head of the Federal Police’s organized crime division, observed that even seizing fifty tons of cocaine barely scratched the surface of the PCC’s operational capacity[7]. Roberto Blonski of the Federal Revenue Service emphasized that the syndicate had engineered an elastic supply chain where compromised routes were instantly replaced[7]. The legal challenges surrounding the operation persisted for years; in December 2025, Brazil’s Superior Court of Justice (STJ) formally rejected an appeal challenging the chain of custody and sharing of tax data in the Enterprise proceedings[12]. Yet across the massive court files of Enterprise, one finding was clear: the case established monumental corporate-style narcotics trafficking, but it contained no judicial proof of a command relationship with Hezbollah[12].
A broker can serve more than one customer
When financial trails are followed, the inquiry shifts from monolithic alliances to specific questions: who moved the cash, whose accounts received it, and what fees were deducted along the way?[25] The U.S. Treasury’s April 2019 sanctions against money broker Kassem Chams provide a vivid case study in how these specialized conduits function[25]. Treasury alleged that Chams moved tens of millions of dollars in narcotics proceeds across South America, specifically including Brazil, while simultaneously coordinating financial transfers for Hezbollah[25]. The formal designation tied Chams to major Colombian cartels like La Oficina de Envigado and the Ayman Joumaa network, operating beneath the legitimate veneer of Chams Exchange, an entity licensed by the Central Bank of Lebanon[25].
Treasury’s action did not accuse Chams’s various clients of conspiring with one another; rather, it demonstrated that an international broker can provide specialized settlement services to Colombian cartels, Middle Eastern networks, and Brazilian entities without those clients forming a unified entity[25]. This structural nuance was reinforced in FinCEN’s October 2024 advisory regarding Hezbollah’s global illicit financing[24]. The advisory made a vital distinction between an organization centrally managing a criminal venture and individuals or brokers donating a percentage of illicit revenues[24]. FinCEN explicitly reminded financial institutions that no single red flag establishes terrorist financing; transactions must be evaluated through the broader prism of commercial counterparties and systemic patterns[24].
A parallel dynamic emerged inside Brazil’s formal banking and fintech sector[30]. In a September 2025 analysis of Operation Carbono Oculto published by the Getulio Vargas Foundation (FGV), legal scholars Antônio José Maristrello Porto and Paula da Cunha Duarte examined how modern criminal networks exploit pooled payment accounts (contas gráficas)[30]. These accounts, commonly used by legitimate payment processing institutions and fintechs, allow funds from thousands of distinct end-users to be commingled within a single omnibus banking registry[30]. By funneling proceeds through these digital escrow layers, criminal syndicates effectively blinded traditional anti-money laundering monitors, necessitating urgent regulatory overhauls by the Central Bank of Brazil[30]. For an investigator, finding a financial node shared by different criminal groups does not prove that those groups share a bank account; it proves they have discovered the same regulatory blind spots[25],[30].
The border cases have their own names
When looking at the Tri-Border Area, documented counterterrorism actions are anchored to specific individuals and enterprises rather than generic gang networks[21],[22]. In July 2018, FinCEN Director Kenneth Blanco publicly applauded Argentina’s Financial Information Unit (UIF) for freezing assets tied to the Barakat network, an enterprise long designated by Washington for funneling commercial revenue from Ciudad del Este and Puerto Iguazú to Hezbollah[21].
Two months later, the long-running pursuit reached a physical climax when Brazilian Federal Police arrested clan leader Assad Ahmad Barakat in Foz do Iguaçu on 21 September 2018[23]. As reported by Gil Alessi in El País, the legal mechanism that secured his detention was not a terrorism warrant, but an extradition request from Paraguay charging him with using fraudulent documents to obtain a passport[23]. Barakat had consistently denied financing terrorism, claiming his charitable remittances supported Lebanese orphans[23]. On 4 July 2019, an Argentine federal court in Eldorado formally reaffirmed the asset freeze against fourteen members of the Barakat clan, citing illicit casino transactions and financial ties to Hezbollah[22]. This was an undeniable enforcement action against a documented network, but the case files revolved around falsified registries, currency smuggling, and casino laundering—not a joint operational venture with the PCC[22],[23].
The broader geopolitical currents surrounding Brazil also shaped the prism through which these cases were viewed[5]. In an August 2024 analysis for INSS, Danny Citrinowicz examined Brazil’s pivotal role in Iran’s diplomatic and economic outreach across South America, pointing to bilateral overtures, trade corridors, and the docking of Iranian warships in Rio[5]. Citrinowicz argued that thwarted intelligence operations in Brazil indicated Tehran’s intent to build asymmetric deterrence on the continent[5]. Yet while geopolitical alignments provided strategic background, criminal prosecutions still required evidence that could withstand a courtroom[5].
A seized phone, a different investigation
In November 2023, the question of Hezbollah’s presence in Brazil abruptly shifted from commercial ledgers to active operational planning with the launch of Operation Trapiche[9],[29]. Federal Police executed warrants against a network suspected of recruiting Brazilian citizens for terrorist operations[9]. As revealed in court documents reported by Ricardo Brito for Reuters, forensic analysis of the phone seized from suspect Lucas Passos Lima uncovered detailed reconnaissance videos and photographs of two synagogues and the Jewish cemetery in Brasília[29]. The initial tip, originated by the FBI, pointed toward operational planning directed by Hezbollah operatives abroad[29].
A political dispute quickly complicated the investigation[26]. After the Israeli Prime Minister’s Office issued an extraordinary public statement praising the Mossad for assisting in thwarting a Hezbollah attack in Brazil, Brazilian Justice Minister Flávio Dino responded with indignation[26]. Dino insisted that Brazil was a sovereign nation whose Federal Police acted strictly within domestic legal protocols, emphasizing that the investigation had been initiated well before the outbreak of the Gaza war[26]. While Dino firmly defended Brazilian institutional autonomy, Reuters noted that he did not refute the substantive details of the intelligence shared[26].
In The National Interest, analysts Ottolenghi and Citrinowicz seized upon Trapiche to argue that Brazil’s legal framework remained dangerously archaic, urging Brasília to officially designate Hezbollah as a terrorist organization and dismantle its commercial hubs[28]. Conversely, RAND analyst Marzia Giambertoni, in a March 2025 assessment, highlighted the risks of analytical overextension[27]. Giambertoni warned that the chronic scarcity of declassified primary data frequently produced two flawed extremes: either breathless sensationalism that saw Hezbollah behind every criminal transaction, or dangerous complacency that dismissed genuine operational plots[27]. The rigorous path required following each specific strand to its verifiable origin[27].
What the newer money cases change
The contemporary evolution of Brazilian illicit finance underscores this reality[14],[13]. In March 2024, the U.S. Treasury sanctioned prominent PCC figure Diego Macedo Gonçalves do Carmo, noting that despite serving a lengthy prison sentence in Brazil, he continued to direct multi-million-dollar transnational narcotics consignments to Europe from his cell[14]. In July 2026, Treasury delivered another blow, sanctioning a sophisticated PCC financial network operating between São Paulo and Florida that utilized commercial cash couriers and cryptocurrency conversions[13]. The legal action applied both counter-narcotics and counter-terrorism executive orders, reflecting Washington’s designation toolkit rather than establishing that Hezbollah was the recipient of the funds[13].
This financial picture was reaffirmed in an American courtroom on 16 October 2026, when Brazilian national Ygor Fokin Saviolli was sentenced to twelve years in federal prison in the Southern District of Florida[15]. Saviolli admitted to directing an organization that laundered over $30 million in narcotics proceeds, coordinating bulk cash drops via encrypted WhatsApp chats, dispatching couriers to make structured bank deposits, and feeding criminal capital into the international financial system[15]. Like the Treasury designations, the prosecution dismantled a vital commercial artery without asserting that the laundered millions went to Middle Eastern militants[13],[15].
This nuanced institutional landscape was captured by FATF and GAFILAT in their December 2023 mutual evaluation of Brazil[16]. While praising the sophistication of Brazil’s financial intelligence units and cross-border police cooperation, the report identified gaps in beneficial-ownership transparency and non-financial sector supervision, characterizing the overall risk of domestic terrorist financing as low while urging heightened vigilance[16].
These systemic dynamics collided in July 2026 with Rio de Janeiro’s Operation Hawala[4]. Rooted in a local investigation of the TCP in the Complexo de São Carlos, the probe uncovered a laundering ring that processed millions for the TCP, the CV, and the PCC through shell companies, smurfing, and layered transfers[4]. The multi-faction service demonstrated that Brazil’s warring syndicates utilized the exact same financial middlemen[4]. Addressing the references to Hezbollah and the separate transaction tied to an Al-Qaeda-sanctioned individual, investigating officer Pedro Brasil maintained a disciplined stance: the terrorism leads were present in the financial intercepts, but verifying whether they represented active operational financing required rigorous, continuing inquiry[4].
Rival gangs can buy the same service
The multi-client network alleged in Operation Hawala.
Eighteen years after Farouk Sadek Abdou attempted to swallow seventeen phone numbers in a roadside ditch, the trail connecting Brazilian prison gangs to Middle Eastern networks has migrated from torn scraps of paper to encrypted ledgers, shell companies, and pooled fintech accounts[3],[4],[30]. The real danger is rarely a grand, formal treaty signed between commanders; it is the enduring presence of opportunistic middlemen who stand at the crossroads of crime and terror, ready to broker the next deal[1],[4]. To truly map that underworld, law enforcement cannot simply rely on familiar labels—they must follow the transaction to its final, verified destination[4],[27].
Sources
- Kyra Gurney, InSight Crime,10November2014
- InSight Crime, PCC profile, updated2026
- Francisco Leali, O Globo,9November2014, attributed reproduction by DefesaNet
- UOL, Operation Hawala,15July2026
- Danny Citrinowicz, INSS Insight1885, Iran in Latin America,7August2024
- Rayssa Motta, Estado via UOL, Enterprise assets,23November2020
- Luis Adorno, UOL interview report,23November2020
- UNODC Global Report on Cocaine2023
- Feltran,Pinho,Bird, GI-TOC Atlantic Connections, August2023
- EMCDDA and Europol, Cocaine criminal networks,6May2022
- Emanuele Ottolenghi congressional testimony,17April2018
- STJ, AgRg RHC212988 PR,17December2025, published19December
- Treasury, PCC financial network sanctions,1July2026
- Treasury, PCC operative Diego Macedo Goncalves do Carmo,14March2024
- DOJ, Ygor Fokin Saviolli sentenced,16October2026; updated21October
- FATF/GAFILAT, Brazil mutual evaluation overview,21December2023
- Europol, Brazil-Europe crackdown,27November2020
- J.P.Zuquete, Counterterrorism in Brazil: From Dictatorship to Democratic Times,2017
- Lessing and Denyer Willis, Legitimacy in Criminal Governance,2019
- InSight Crime and American University CLALS,The Rise of the PCC,December2020
- FinCEN director statement on Argentina action,14July2018
- Argentina UIF asset-freeze announcement,18July2019
- Gil Alessi,ElPais,Barakat arrest,21September2018
- FinCEN FIN2024Alert003,23October2024
- Treasury Kassem Chams designation,11April2019
- Reuters,Stargardter and Paraguassu,Dino response,9November2023
- Marzia Giambertoni,RAND Hezbollah Networks inLatinAmerica,March2025
- Ottolenghi and Citrinowicz,Latin Americas Hezbollah Problem,2December2023
- Ricardo Brito,Reuters,Trapiche court documents,6December2023
- Porto and Duarte,Regulatory gaps and fintechs,FGV25September2025; originallyConjur18September
