Catalonia: Contested Data and the Catalan Independence Referendum

The Catalan independence movement made international headlines in the fall of 2017 when the Spanish authorities clashed with citizens in an effort to block the vote on a referendum to create an independent republic. The confrontation was the culmination of years of conflict between the government of Spain and pro-independence governments and groups in Catalonia.

In the wake of the UK’s EU referendum and Scottish Independence Referendum, the events surrounding the Catalan vote were cited as further evidence of crumbling confidence in the European Union's political status-quo.

Tactical Tech partnered with the Eticas Foundation to look behind the headlines and clarify the role that personal data played during the climactic events of the independence referendum, in which there was never a definitive majority for either side of the debate, and in which personal data and digital strategies played a surprisingly prominent role.

Below is a brief summary of some of the notable events and trends discovered by our partners at Eticas Foundation. The full report can be accessed here.

Voter data was a highly contested asset throughout the course of the referendum

• On 1 October 2017, the day of the independence referendum, the Catalan Government decided to create a new universal census to track voter participation, rather than basing voter verification on local districts usually administered by the Spanish national Statistics Institute. This meant that voters could vote in any district, regardless of where they were registered. The Catalan government used an encrypted app to ensure voters didn't vote more than once.
• The personal data used to create the new alternative census became highly contested, with the Spanish government accusing the Catalan government of accessing the data illegally and possibly exposing it to security risks.
• This led to a protracted dispute between pro-independence and anti-secessionist forces and between the Spanish Data Protection Agency (AEPD) and the Catalan Data Protection Agency (APDCAT), with accusations of breaches of data protection laws at the forefront of the disagreements.
• The conflict resulted in the Spanish National Police raiding the offices of the Catalan Statistics Institute (Idescat) and arresting and detaining senior figures and technologists at Idescat and the Catalan Ministry of Economics.
• A number of civil society organisations have criticised the Spanish government’s alarmist intervention in the Catalan referendum on the grounds of data protection of citizens, stating that, in fact, the security of the census was cryptographically sound and that the risks to the implemented personal data was low.

Along with legal battles and physical clashes, the struggle between the two sides of the debate erupted into the digital space, in what Eticas Foundation's report speculates may have been "Europe's first civil cyberwar."

• Information communication technologies became a battleground between Spanish security forces and hackers on both the pro-independence and anti-secessionist sides. The Spanish government employed aggressive tactics to suppress data and digital information about the independence movement.
• Spanish security forces shut down the official website of the Catalan referendum and several other sites affiliated with the movement, as well as compelling Internet service providers, the .cat domain registry and major telecom operators to monitor and block all web presence related to the referendum – a move that was criticised for its suppression of freedom of information and speech.
• In response, several opposition activists established mirror sites to circumvent these outages, for which they were subsequently arrested.
• The day before the referendum, Spanish military police occupied the office of the Catalan Telecommunications and IT Center (CTTI) to block and suspend all information services which could be used to facilitate the referendum, as well as arresting and detaining strategists and technologists.
• In a game of cat-and-mouse, members of the pro-independence movement fought back by continuing to mirror websites and using VPNs to access blocked sites, while using the WhatsApp and Telegram messaging platforms to organise and share information.
• Hackers from both sides also traded blows via numerous DDoS and other cyber-attacks on each others web infrastructures and information outlets.

More details on the legal battle over personal data and the universal census, the digital warfare between the competing positions and an assessment of the role of fake news and disinformation can be found in Eticas Foundation's full report here.

An introduction to the Influence Industry project can be found at The Influence Industry: The Global Business of Using Your Data in Elections and an introduction to the methods used by the political data industry can be found at Tools of the Influence Industry. Similar, country-specific studies on the uses of personal data in elections can be found here, with more to be added each week.

Gary Wright is a researcher and project coordinator at Tactical Technology Collective with a history in technology & innovation in international development cooperation, as well as digital and privacy rights.

Thank you to Christy Lange, Stephanie Hankey, Raquel Renno, Safa Ghnaim, and Varoon Bashyakarla for their comments and assistance with posting this piece online.

_{Published September 11, 2018.}