Rui Pinto witness protection in Portugal will end on 10 October after the authorities decided to withdraw it. Pinto is the hacker whose leaks helped start the Premier League's case against Manchester City. The decision was taken on Wednesday, according to documents seen by the Guardian.
Days earlier, an independent commission found City guilty of 114 charges spanning nine seasons. The 37-year-old says he has received "multiple death threats" and now faces "the serious risk of an assassination attempt". He says he has no alternative but to move to an undisclosed location for an indefinite period.
Rui Pinto witness protection ends on 10 October, against a 'low' risk rating
The official assessment is short. Portuguese police have judged the risk to Pinto's safety to be low, the Guardian reported. Pinto has been in the programme since August 2020.
That rating stands despite an assault on Pinto in Lisbon in April. He was left with a bruised eyebrow. Police were informed, but no complaint was filed.
Pinto has not been left without instructions. He has been advised to "exercise caution with family contacts" and to avoid social media. He spent the previous week posting heavily on social media about the City verdict.
The practical consequences were set out in a statement from his legal team: Francisco Teixeira da Mota, Luísa Teixeira da Mota, Vincent Brengarth and William Bourdon. They said Pinto would lose "the protected, confidential residence assigned to him" and be "forced to find new housing urgently, with no guarantee that police protection will continue".
They also object to how the decision was made. The lawyers say it was taken "without being heard beforehand, as required by law". They have urged the Portuguese authorities to reconsider.
BBC Sport has approached Portugal's Commission for the Protection of Victims of Crimes for comment. No public explanation of the decision has been reported.
Death threats, an assault and a fundraising appeal
The two sides disagree sharply about the threat Pinto faces.
Pinto wrote on X on Friday that ending his protection had put him in a "life-threatening situation". His lawyers said the threats "are not merely theoretical" and pointed to the April assault. They also cited the reach of the people his disclosures named.
"His revelations implicated powerful figures with vast resources, and many resulting legal proceedings are still ongoing," the statement said. It cited the Premier League commission's ruling on City as one example. The lawyers concluded that Pinto, "abruptly deprived of his protected housing and plunged into a state of extreme precariousness", would be "more vulnerable now than at any time since 2020".
Security has been part of Pinto's legal story from the beginning. He wore a bulletproof vest during his first trial in 2020, and that hearing ran under heightened security measures.
Pinto has also opened a fundraising page to help him "survive this serious situation", which he says was "created by the Portuguese State". Reports differ on the target amount, and the figure has drawn some scepticism in online discussion of the story.
The police assessment and Pinto's own account cannot be reconciled from the public record alone. The police rating rests on information that has not been disclosed. Pinto's claims of death threats have not been independently detailed. What is documented is the April assault, the end date and the loss of his protected housing.
From 70 million documents to 114 guilty findings
The timing matters because of what Pinto's archive set in motion.
Football Leaks gathered more than 70 million documents, according to European Business Magazine. The material went well beyond one club. It included Manchester City's internal emails and financial records, which Pinto shared with the German magazine Der Spiegel in 2018. Der Spiegel and its partners in the European Investigative Collaborations network began publishing in November that year.
City never disputed that the emails were authentic. At the time, the club said it would not comment on "out-of-context materials purportedly hacked or stolen". It called the publication an "organised and clear" attempt to damage its reputation.
The case then took two separate routes:
- Uefa (2019–20): a formal investigation opened in March 2019. In February 2020 City received a two-season Champions League ban and a €30m fine.
- Court of Arbitration for Sport (July 2020): the ban was overturned. CAS found most of Uefa's charges "either not established or time-barred" and cut the fine to €10m.
- Premier League (February 2023): City were charged with 115 breaches of financial rules covering 2009–10 to 2017–18. A three-person independent commission heard the case between September and December 2024.
- The verdict (late September 2026): City were found guilty of all 80 financial charges and 34 of 35 charges of failing to cooperate with the league.
City have confirmed an appeal. If it fails, the possible sanctions include fines, a points deduction large enough to relegate the club, and expulsion from the Premier League. The verdict is the reason Pinto's lawyers argue the threat to him is current rather than historic. In their view, the most consequential stage of the case is still to come.
Pinto has welcomed the ruling openly. He called it a "historic decision for English football" and said City's executives had "acted with complete impunity, challenging everyone and everything". In another post he wrote: "Years and years of cheating, lying and manipulation will finally have consequences."
Hours before news of the protection decision emerged, he turned on Gianni Infantino. Pinto said the Fifa president had "become a cancer on football" and should "have no place in the future of the game". He repeated allegations from 2018 that Infantino, while Uefa general secretary, did "everything in his power" to ensure City and Paris Saint-Germain were only fined for breaching financial fair play rules. Those are Pinto's allegations, not findings of any tribunal. They come as Infantino faces pressure over plans to sell stakes in Fifa competitions, including the World Cup, to private investors.
A convicted hacker who won his second trial
Pinto calls himself a whistleblower. Portuguese courts have treated him as both a defendant and a cooperating witness, sometimes in the same period.
He was arrested in Budapest in 2019 and spent about a year in pre-trial detention. He then agreed to give Portuguese investigators access to his files, which is how he entered the protection programme and its safe houses.
His legal record now looks like this:
- September 2023, Lisbon: convicted of nine crimes, including attempted extortion, unauthorised access to computer systems and interception of correspondence. He received a four-year suspended sentence.
- France: a six-month suspended sentence for hacking Paris Saint-Germain emails, which remains in force.
- 29 April 2026, Lisbon: acquitted of all 241 counts in a second trial. The charges were 201 counts of qualified illegal access, 22 of aggravated correspondence violation and 18 of computer damage. They related to email systems at Benfica, the Portuguese football league, law firms, judges, prosecutors and the tax authority.
- Pending: a third investigation into similar allegations remains open.
Pinto's lawyers make a related argument now. They say the state relied on his cooperation and is withdrawing its side of the arrangement while cases built partly on his material are still running. The police point to their own risk assessment. Pinto remains divisive in Portugal, where some see him as a whistleblower and others as a criminal. That divide is unlikely to affect whether the 10 October deadline holds. Unless the authorities respond to his lawyers' request to reconsider, his protected residence will end on that date, while City's appeal on the case his files helped build is still pending.
Reddit
