How Spain is waging Internet war on Catalan separatists

BARCELONA—The cops smiled a lot at first. The six plainclothes officers from Spain’s civil guard arrived in the morning at the Barcelona offices of Fundació PuntCat, the Internet registry that manages the .cat extension, popular in Spain’s Catalonia region. Employees were politely told to unlock their computers and step away. A search warrant would arrive soon.

The mood darkened when a squad of riot police turned up, and executives learned that the police that morning had gone to the home of Josep “Pep” Masoliver, the group’s chief technology officer, and arrested him on charges that included perversion of justice.

This was September 20, fewer than two weeks before voters in Catalonia were scheduled to decide whether the region should declare independence from Spain. Responding to the country’s worst political crisis in a generation, the Spanish government declared Catalonia’s referendum on self-determination illegal. Many elsewhere in Spain considered the vote treason.

READ MORE ON GOVERNMENT SURVEILLANCE

Jennifer Granick on spying: ‘The more we collect, the less we know’ (Q&A)
‘State of Control’ explores harrowing consequences of surveillance
Garry Kasparov takes on the Russian surveillance state (Q&A)
Surveillance bill keeps U.S. search loophole open
How to strike a balance between security and privacy (Q&A)
New research explores how the Great Firewall of China works

As Catalan voters prepare for Thursday’s snap election to replace the regional government removed by Spain’s government for declaring independence, it remains to be seen whether Spain will continue its heavy-handed approach to the Web. Many privacy and online-rights advocates say Spain’s actions in Catalonia are unprecedented for a Western democracy.

The raids at PuntCat and Masoliver’s home came days after a Spanish court made several demands of the registry, including taking down a website that provided referendum materials and turning over information on the domain’s owner.

Another order stunned PuntCat’s leadership, registry lawyer Nacho Amadoz tells The Parallax. According to Amadoz, PuntCat was instructed to take offline all .cat websites that “may involve or point to any hosting of contents” related to Catalonia independence.

Like all Web registries, PuntCat has blocked sites accused of promoting terrorism or being connected to child pornography. In this case, it was being ordered to take down sites set up simply to help people vote.

“We understand that [site blocking] is a process that needs to be enforced sometimes,” Amadoz says. “Either with .cat, .es, or .com. It just happens. You receive the order, and you execute it. We have no problem with that. But the general obligation to actively censor content is not something [a domain registry] is supposed to do.”

Not only had the country’s government cut off public access to information and to dissenting opinion, but it threatened the backbone of the Internet in the region. Within a democracy, a registry manager shouldn’t fear being required to spy on or censor its customers.

“It’s quite remarkable that a European country would go to such lengths to stifle a political protest,” says Jeremy Malcolm, senior global policy analyst at the Electronic Frontier Foundation, an advocate for tech companies and Internet users. “This also sets a bad precedent because next, we’re going to see this happening in other countries that will feel licensed to behave similarly. This is dragging things down to the level of autocratic countries.”

As for how Spain might act in the future, the Spanish newspaper El Pais reported last week that the government has readied teams of cybercops to combat fake news, database attacks, or any other kind of interference that could taint the election. It didn’t outline how the government plans to ensure that it won’t stifle legitimate free speech.

The crisis in Spain has significance beyond a regional conflict, argues Simona Levi, founder of Xnet, a Barcelona-based digital-rights group. During previous grassroots political movements, such as those in Egypt and Tunisia in 2011, protesters seemed always to be a step ahead of the authorities in their use of technology to organize and communicate. But in Catalonia, the gap in tech savvy seems to have closed, she says.

“There are some years that the big doors open, in which the bad guys and the status quo are not prepared for [technological] disintermediation. And you have very few years in which you can get organized to open the possibility of democratization,” she says. “What is happening now is, this big window is getting narrow.”

On October 1, the day of the referendum, The Independent reported that the Internet connection at polling stations had been disabled, preventing workers from accessing census data. And on government orders, Spain’s big ISPs helped filter out sites connected to the Catalonia independence effort.

After separatist leaders either fled the country or were jailed on referendum day, supporters relied on one another to keep the vote going—the digital equivalent of throwing stones at tanks. They turned to the anonymizing service Tor and virtual private networks to protect their online communications. When the government ordered Google to remove an app that supplied referendum information from its online store, pro-independence coders used Google Play loopholes to release similar software.

“I’m not saying this is a police state. I can’t say that. I don’t believe that. But I think Spain is going backwards.”—Nacho Amadoz, attorney, Fundació puntCAT

Not only did the Spanish government block many of the sites that supplied voting information, such as the site Ref1oct.cat, but it reportedly tracked and arrested 13 of the people who hosted mirrors of those sites. According to a report in the newspaper El Confidential, PuntCat’s Masoliver was arrested for allegedly being part of a group that tried to circumvent Spain’s attempts to block the vote.

There are other signs that the Spanish government bested the separatists in the battle for the Web. In an October 9 story, Wired reported that activists were ready to launch a digital government if Mariano Rajoy, Spain’s prime minister, suspended Catalonia’s autonomy, which he did. This digital state was supposed to administer Catalonia while bypassing Spain.

“We will probably have a clandestine government,” Xnet’s Levi, whom Rolling Stone named as one of the top 25 people shaping the future, told Wired. “The Internet would be an important part of that.”

Leaders of the separatist movement weren’t exactly prepared for Spain’s response, she says.

“They had a legal plan, and they had quite good infrastructure in place to pay taxes, and that kind of thing,” Levi told The Parallax in a November conversation here. “So some of the work was done—but surely not enough to prevent them from going to jail and to keep up the government.”

It’s not clear, Amadoz says, that separatists—or those caught in the middle of the conflict, including PuntCat managers—have learned to be more careful with their communications and other online activities in the run-up to the vote this Thursday.

“We know it’s possible” that Spain could try to suppress voter turnout, he says. “I’m not saying this is a police state. I can’t say that. I don’t believe that. But I think Spain is going backwards. We are now considering that the situation in which we live is more threatening than before.”