Unravelling the Killing of Colombian Protester Lucas Villa

In the moments before he was fatally shot, Lucas Villa could be heard shouting “the ignorant, the stubborn, those who are asleep. Wake up!”

The 37-year-old student had been an active participant in street protests against unpopular tax reforms put forward by the Colombian government earlier this year. His story has come to symbolise the violence meted out to protesters who took to the streets across the country during this period.

With his vibrant personality and displays of colourful dancing, Villa was a visible and energetic presence at protests in the city of Pereira, which lies roughly 300 kilometres west of the capital Bogota, in late April and early May.

Although Colombia’s President, Iván Duque, withdrew the tax reform proposals on May 2, protests continued over the initial violent police response and an array of other underlying grievances. 

During the afternoon of May 5, Villa was pictured shaking hands with riot police and dancing among protestors. He was also seen talking to bus passengers about the likely negative impacts of the tax reform. 

There seemed to be little sign of the chaos that had marred earlier protests in Pereira, or any hint at what was to come. 

Later that evening, however, Lucas Villa would be shot while present at a small gathering at the César Gaviria Trujillo viaduct which had been the scene of protests on previous days.

Two others suffered gunshot wounds in the same incident. But while they would recover, Villa would die in hospital five days later on May 10.

In the aftermath of his death, President Duque tweeted a message to Villa’s family calling for justice. General Jorge Luis Vargas, the Director of National Police, said that Villa was a symbol of peaceful demonstrations in Colombia. The newspaper El Clarin, meanwhile, wrote that he was loved by all.

Speculation that police and local drug gangs were involved in Villa’s death, or that security cameras and lights at the viaduct were switched off in the moments before he was shot have been aired in Colombian media. Many suspected police involvement due to their violent response to street protests over the past year. Just last week, two officers were reportedly charged over the death of protesters in Cali, while Bellingcat and Cerosetenta have been mapping instances of police violence at protests in Colombia since 2020.

Police have denied any involvement and stated that there is no evidence to suspect any officers in the case of Lucas Villa. They have instead stated they suspect the involvement of a local criminal gang known as La Cordillera. 

Pereira’s mayor, who had initially appeared to call for citizens to join forces with the police and military to tackle the chaos in the streets, stated afterwards that “if there is anyone responsible under my office or within the security forces, they should be prosecuted with the full force of the law.”

But seven months on, who killed Lucas Villa and why remains a mystery. With little information made public in the intervening period, questions about whether the authorities have done enough to investigate the killing have also been asked.

A new investigation by Bellingcat and partners Forensic Architecture, Cerosetenta and Baudo AP has sought to fill in the gaps of what happened on the evening of May 5. Further analysis by Bellingcat has also disproved disinformation around the killing and identified possible new leads for exploration.

The investigation examined hours of social media footage from the scene as well as the official autopsy of Lucas Villa to create a timeline and 3D model of exactly what happened at the César Gaviria Trujillo viaduct. 

The investigative group also received and analysed private CCTV footage obtained and shared by Colombia’s Truth Commission, an extrajudicial body that seeks to clarify the patterns and explanatory causes of the internal armed conflict in Colombia.

The findings of this joint investigation show that:

• The attack on Lucas Villa appears to have been premeditated with the killers seen circling the scene before carrying out the shooting
• Eight shots were fired with Villa being hit three times, including once in the head from close range
• The wound to Villa’s head displayed abrasions from gunpowder, suggesting the weapon was fired execution-style from a short distance away
• The perpetrators arrived on two motorbikes. A gunman who was a passenger on the back of one bike disembarked, approached Villa and fired before getting back on the bike as it made a getaway
• Police officers on a motorbike passed a bridge overlooking the scene minutes later, appearing to stop and engage with people observing the crime scene before moving on. Another police vehicle passed by without stopping shortly after

Further analysis by Bellingcat has revealed that:

• Police failed to secure the scene of the crime for at least 46 minutes despite there seeming to be multiple opportunities to do so. This contradicts claims made by the Director of Colombia’s Directorate of Criminal Investigation and Interpol (DIJIN) who said that officers arrived immediately. 
• Witnesses appear to have left the scene without  being questioned
• Physical evidence was most likely moved or lost in the time before police arrived

At the very least, the results of this investigation provide clarity around how the killing of Lucas Villa transpired on the evening of May 5.

It also appears to raise serious questions as to the competence of the police, as well as the investigating authorities, in the aftermath of Lucas Villa’s death. 

Bellingcat sought to reach out to Colombian police to ask about the details in this investigation, contacting several police addresses by email, but was not able to obtain a response before publication.

(Update: Pereira Metropolitan Police responded to Bellingcat’s request for comment in the days after publication, providing an emailed statement by Chief of Strategic Communications, Subteniente Luisa Maria Mora Rincon. Although the statement did not answer specific questions about police actions nor their response on the night of May 5, it noted that these events were being investigated by the Attorney General’s office. Rincon added that “Pereira Metropolitan Police support the investigative work that may be in place according to the guidelines established by the Criminal Investigation Directorate of the National Police, all in order to clarify the facts under investigation and provide transparency to police procedures.”)

What Happened on May 5, 2021?

Lucas Villa was part of a peaceful crowd which moved north through Pereira on May 5, ending up at one of the city’s principal traffic arteries: The César Gaviria Trujillo Viaduct.

The map below shows his movements throughout the day.

At around 19:30 local time on the north side of the bridge, an individual opened fire with bullets striking Villa and two others.

Panic ensued, with the scene captured on social media videos that have been shown widely in the Colombian press.

Warning: This video contains the sound of gunshots and screaming that could be distressing to some readers.

#AsíVaElParo5M Este video registra el momento en que se inician los disparos y el intento de huida de quienes estaban allí. Hasta ahora se ha identificado a uno de los heridos, su nombre es Lucas Villa Velásquez y su estado es crítico. #CuestiónPoder pic.twitter.com/GyKWmtaCuB

— Cuestión Pública (@cuestion_p) May 6, 2021

Bellingcat synchronised this and other social media videos using key visual and audio references such as voices and words heard at the scene, the sound and frequency of an ambulance siren, as well as the relative position and movement of people.

Only one of the videos used in this analysis was a livestream that had metadata available that detailed the time of broadcast.

Using this information, it was possible to calculate that the first gunshot was fired at 19:31:44.

Social media messages, footage and images provided a great deal of useful information in piecing events together and establishing a timeline. 

Yet other video from the scene, that was not posted online, also provided vital evidence.

Private CCTV Footage Analysis

Security camera footage obtained by the aforementioned Truth Commission shows the scene at the viaduct between 19:00 and 20:00, revealing the clearest and most complete version of events currently available.

While there is a police CCTV camera located closer to the crime scene, it appears to have been out of service the day of the incident (as will be detailed later).

The footage provided by the Truth Commission has not been published until now. 

Bellingcat analysed this video independently and submitted findings to the investigative group.

A reconstruction of events prepared by Forensic Architecture can be seen in the below video.

Over the course of the first 30 minutes of the CCTV footage, Lucas Villa can be seen talking with fellow protestors and wandering around what is a peaceful gathering. 

The relative calm is in stark contrast to previous evenings at the viaduct which was a point of confrontation between some protesters and police.

At 19:31:27 what appear to be two motorised bikes can be seen approaching the scene.

They stop as they reach a slip road close to Lucas and other protesters.

One individual can be seen alighting from the bike closest to the crowd before moving quickly towards where Lucas is situated.

Eight shots are fired and the crowd scatters. The gunman then returns to the bike he stepped off moments prior as it makes a getaway.

CCTV Analysis Part I – Surveilling the Scene

The suspects can be seen escaping at 19:31:55. This tallies with social media footage taken at the scene in which a motorised bike can be seen and heard in the seconds after the shooting.

Bellingcat enhanced a frame from that social media video where the vehicle can be seen to try and reveal more details about the suspects. This process uses artificial intelligence to split and adjust the colour channels, increasing the contrast of the frames in the video. It showed that the suspects appeared to be on a scooter with the headlights switched on when arriving and leaving the scene.

The CCTV footage provided by the Truth Commission shows a similar scooter carrying two people driving west and then east across a nearby overpass at 19:29:44 and 19:30:58 respectively.

Zooming in on the CCTV footage of the scooter and comparing it to the frame of the scooter from the social media video depicted above — taking into account the lighting conditions as well as the speed they were travelling at in the CCTV film — allows a number of similarities to be observed. 

These include the shape of the scooters, the body shape of those on the scooter as well as a similar colour distribution in terms of the clothes they are wearing, in particular the back passenger’s trousers.

Based on the observed timings in the video, speed the vehicle was travelling at, traffic conditions, distances and road layout; the subjects most likely performed a U-turn at a nearby petrol station before re-crossing the overpass and taking the slip road that merged into the viaduct where Lucas was standing. 

This would explain why the scooter appeared twice in the video, on opposite sides of the road, within a period of one minute and 14 seconds.

This route is depicted in the below image.

Once on the viaduct, the scooter headed south towards the area where Lucas was located with the shooting beginning at 19:31:44.

The CCTV footage also shows that the two subjects on the scooter were being followed by a bigger motorbike. This vehicle had its headlights switched off as it followed the scooter west and east across the overpass and as it approached the crime scene.

This matches what eyewitnesses mentioned in social media videos about the involvement of a second motorbike, possibly a Yamaha RX.

Further analysis showed what appeared to be the scooter crossing the overpass at 19:20:10 and 19:20:59, moving west and east respectively at those times. 

It can again be spotted going west across the overpass at 19:22:37 and east at 19:23:11. In these clips, the scooter has its headlights switched off.

Although the CCTV footage does not allow for a continued monitoring of the bridge to observe if there were further instances of the same subjects crossing, we can at the very least observe a repetitive pattern of travel prior to the shooting. 

The killers appear to have circled the scene a number of times in preparation.

A third bike, piloted by an individual with a distinctive red helmet, could also be seen circling with what appears to be the same scooter and motorbike at 19:04:47, once more at 19:09:30, again at 19:12:24 and one final time at 19:15:17. However, this bike is not seen again after that or when the other scooter and motorbike approach the crime scene.

A targeted or an indiscriminate attack?

The position of Lucas Villa just eight seconds before the first shot is fired is clear. He can be seen in his distinctive blue t-shirt standing beside a group of protesters.

As the gunman alights from the scooter, he begins to shoot as he runs towards Lucas’ position. A representation of the gunman’s trajectory (as analysed and depicted by Forensic Architecture below) shows his position relative to Lucas as every shot is fired. The red dots detail each shot.

Taking the above trajectory into account, all eight gunshots took place within a radius of a maximum of 7.5 metres from Lucas’ final position.

The gunman also appeared to show a clear directionality towards Lucas with every shot.

The Autopsy

Baudó AP obtained Lucas Villa’s autopsy and shared it with the investigative group. The report specifies that Lucas suffered the impact of three gunshots which inflicted a total of seven wounds. It details:

1. One entry in his left ear, exit and re-entry at the base of the neck (right side)
2. One entry his left buttock, exit through upper back side of right thigh 
3. One entry in the back part of the right thigh, exit via upper front side of right knee

Videos circulating on the night of the shooting claimed to show a man at a hospital being treated by medical staff. We verified the victim in the footage was Lucas Villa by matching the tattoos on his body to previous images he had posted. We have chosen not to show these images due to their graphic detail.

The location of the wounds shown in the hospital video also match the injuries described in the autopsy.

The autopsy indicates that the bullet travelled downwards from his left ear moving diagonally and exiting through the right side of his neck, before re-entering his body and ending in the soft tissues of his torso.

According to the autopsy report, this injury is believed to be the principal cause of Lucas Villa’s death.

The angle of entry described in the autopsy suggests Lucas may have been bending, falling or already on the ground when this shot was fired.

At the entrance of this wound, there were also signs of what is known as “tattooing ”. 

This is a term used to describe the punctate abrasions observed when epithelial tissue comes into contact with partially burned or unburned grains of gunpowder.

Punctate abrasions from unburned gunpowder have been known to occur within distances as close as one cm and as far away as 100 cm, depending on the type of gun and cartridge used.

This means Lucas Villa was most likely shot at least once from close range. 

Given the proximity and location of the wound, this suggests the gun could have been aimed at Lucas execution-style for at least one of the shots.

CCTV Analysis Part II – Police and the Crime Scene

In the CCTV footage provided by the Truth Commission, a police motorbike and a pick-up truck can be seen crossing the bridge at 19:39 and 19:44, roughly eight and 13 minutes respectively after Lucas Villa had been shot.

The motorbike stopped briefly to survey what was going on. However, both patrols continued their journeys and cannot be seen again anywhere in or around the crime scene for the remainder of the footage which finishes at 19:59, 28 minutes after Lucas Villa was shot.

A Facebook Live video that began at 20:11 and continued until 20:18 showed that police had still not arrived at the scene at that time. Cars and motorbikes can be seen speeding through the area with the road open to traffic once all protesters had dispersed.

The next live footage posted online from the scene began at 21:10 and shows police in attendance, although it is not clear exactly when they got there.

What can be stated from the available video evidence is that at least 46 minutes after Lucas Villa was fatally shot, police had still not sealed off the crime scene. Vehicles were driving through the spot where Lucas had been shot and all witnesses seem to have left.

This appears to contradict the words of General Fernando Murillo, Director of the DIJIN, who said that officers arrived “immediately” and began the “urgent tasks” of securing and analysing the crime scene.

Villa’s autopsy from May 11, six days after the shooting, states there was no information available at the time of the examination as to whether or not ballistic material was collected from the scene. 

The report also mentioned there was no record of the whereabouts of Lucas Villa’s clothing.

Analysis of social media posts and videos shows that in the time between the shooting and police arriving on the scene, materials including cartridge casings had been moved by potential witnesses and other passers by.

A Facebook Live video posted from the scene at 19:48 shows that bullet casings had been picked up and placed together to be filmed and photographed by passers by. It is not clear if the casings were later removed from the scene prior to the arrival of the police.

 

The CCTV footage provided by the Truth Commission shows people walking through and around the area where the shooting had taken place.

The same footage also shows that the number of people at the crime scene gradually decreased in the 30 minutes after the shooting until few were left.

Many eyewitnesses, it appears, left the area without being questioned by police. It is not known if any later contacted the authorities themselves

Video footage shows that one emergency service vehicle passed through the scene in the seconds after the shooting. An ambulance can be seen approaching the crowd in both the CCTV and social media footage. It slows down as protesters look to alert medics inside the ambulance that the shooting had just occurred.

In social media footage from the scene protesters can be heard saying that the ambulance is occupied before it travels on.

A registration plate on the side of the ambulance matches that shown in online images and confirms it belongs to Santa Monica Hospital, located 1.2 kilometres north of the scene on the viaduct.

It is unclear if this ambulance reported the incident to the integrated emergency lines — although communication records from that evening could shed further light on this question. No other units can be seen attending the scene in the remaining 28 minutes of CCTV footage. Lucas Villa, and the two other individuals who suffered bullet wounds, were transported to hospital in civilian vehicles.

It is also unclear if the hospitals that accepted the wounded after the incident notified law enforcement as they would have been obliged to do under the code for chain of custody established by the General Attorney’s office.

Known Unknowns

CCTV footage provided by the Truth Commission has proven illuminating in clarifying the circumstances around Lucas Villa’s killing. It has also helped clear some of the confusion that followed.

This revolves around claims that the lighting system of the viaduct was switched off just in time for the shooting and turned on again afterwards. 

In the hour of CCTV footage, there is no indication of interruption, failure or reduction of brightness in the lighting system. The darkness observed in the social media video which captured the shooting could be a result of the device properties used to record the incident.

But what other potential CCTV footage could be out there that has yet to be made public?

On Colombia’s national platform for state tenders, Bellingcat found publicly available files in which the head of Metropolitan Police of Pereira wrote a letter on May 2 to the city’s mayor requesting the repair and maintenance of 297 CCTV cameras due to alleged vandalism during the demonstrations.

The files also indicate the coordinates for each CCTV station with a description of their working status.

We plotted this information on a map and found that rotating pan–tilt–zoom (PTZ) cameras around the viaduct were working, as were several others south of the river.

Crucially, however, the camera closest to the viaduct and which would have had a clear view of the shooting was registered as non-functioning.

Yet a selection of others could still have proven useful.

The suspects escaped the scene using the slip road exit of the viaduct which merges into the southbound lane of Via La Popa (depicted in blue on the below map). But it is unclear in which direction they headed afterwards. 

Going south would have avoided oncoming traffic. If they took this direction they would have used the Via la Popa route (highlighted blue below) or Antigua Carretera (highlighted green).

The south end of Via La Popa hosts a CCTV station called P77. 

This station is fitted with one rotating PTZ camera and one fixed Licence Plate Recognition Camera (LPR) system. According to the documentation consulted, they were both working as of three days before the shooting.

This is the visual P77 would have when pointing north-east. 

The street lights running along these roads are visible in the background. If the suspect motorbikes were moving with the headlights on they could also have been captured by the camera.

Similarly, other cameras such as P51, P69, P68 and P23 would be cameras of interest too.

A video synchronisation and triangulation of all the cameras discussed could potentially provide more details about the suspects. 

However, if the suspects headed north, against traffic, or east after the shooting there would be less security camera coverage. 

If camera P69 in particular was operational, it would also raise questions about when police knew there had been an incident at the viaduct. CCTV footage provided by the Truth Commission shows some bystanders scattered south towards camera P69 after the shooting.

Social media video also shows people congregating close to camera P69 at around 19:40 with another shooting victim having their wounds tended to nearby until 19:53.

At time of publication, the investigating authorities in Colombia have not released any further information about CCTV camera footage in or around the crime scene.

The Killing of Lucas Villa

This investigation, while complex, has shown the killing of Lucas Villa was carried out by an individual who approached him after stepping off the back of a scooter.

This individual fired eight shots, striking Villa three times, including once in the head from close range.

The gunman was not acting alone and escaped on a scooter driven by an accomplice who waited close to the scene.

CCTV footage of the viaduct shows that the killers circled the scene in the minutes before the shooting.

Another motorbike could be seen following the scooter suggesting more people were involved in scoping out and planning the attack.

Although the head of Colombia’s Directorate of Criminal Investigation and Interpol (DIJIN) said that the crime scene had been immediately attended to by police, this does not appear to have been the case.

CCTV footage provided to Bellingcat and partners by the Truth Commission shows people walking through the crime scene and picking up items before police arrived. Social media videos tell a similar story.

The police did not seal off the scene until at least 46 minutes after the shooting — that’s despite one police motorbike and another patrol vehicle crossing a nearby overpass just minutes after the attack. 

By the time police did arrive, most of the witnesses to the shooting appeared to have left and vehicles were passing through the crime scene which was located on a busy thoroughfare.

While a CCTV camera was situated close to the shooting, it appears to have been out of operation.

But others situated nearby could have captured the killers as they made their getaway.

Bellingcat sought to reach out to Colombian police to ask about the details in this investigation, contacting several police addresses by email, but was not able to obtain a response before publication.

(Update: Pereira Metropolitan Police responded to Bellingcat’s request for comment in the days after publication, providing an emailed statement by Chief of Strategic Communications, Subteniente Luisa Maria Mora Rincon. Although the statement did not answer specific questions about police actions nor their response on the night of May 5, it noted that these events were being investigated by the Attorney General’s office. Rincon added that “Pereira Metropolitan Police support the investigative work that may be in place according to the guidelines established by the Criminal Investigation Directorate of the National Police, all in order to clarify the facts under investigation and provide transparency to police procedures.”)

---

Editor’s note: This story was updated on Wednesday 8 December 2021 to include a response from Pereira Metropolitan Police.

Logan Williams, Timmi Allen and Eoghan Macguire contributed to this story.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here.