Earlier this week Spain’s official State Gazette (the Boletín Oficial del Estado, or BOE) published a government order aimed at thwarting Catalonia’s “digital republic”. The new legislation, which had been approved days earlier in a cabinet meeting, included an unexpected addition: the Spanish government reserves the right to act without a court order against providers of digital services, including private businesses, in the event that “public order” is jeopardised. Last week caretaker Prime Minister Pedro Sánchez gave the excuse of stopping IdentiCat, a projected masterminded by the Catalan government to create an official Catalan identity online. A few days ago the Spanish PM claimed that “there will be no independence, neither online nor offline”. But this new law seems aimed at taking down websites such as Tsunami Democràtic’s, an organisation which Madrid’s Audiencia Nacional has decided to investigate over terrorism allegations (1).
Prior to this, the Spanish authorities already had similar powers, provided there were reasons of national security, but now they will enjoy much greater leeway in a scenario where “serious events have taken place in a Spanish region”, without mentioning Catalonia by name.
When she announced the new executive order, Spanish VP Carmen Calvo mentioned that it sought to prevent Spanish administrations from using computer servers outside the EU, but made no reference to shutting down websites. With this new legislation, the Spanish government is amending six acts and an earlier executive order. From now on, Spain’s ministry of economy will be allowed to suspend internet services “temporarily and exceptionally” in the event of “a major, present threat to public order, national or public security”. The text goes on to explain that these provisions “are not limited to a network or a telecommunications service”, but they include the elements that “accompany the set-up or deployment” of such services. Therefore, it also paves the way for seizing “infrastructures that might host electronic communication networks, their associated assets and any element […] required to preserve or restore public order and national or public security”.
Should internet service providers fail to cooperate, the State “may decide to take over the management of the service or to seize the services themselves”. The government body tasked with doing that would be Spain’s Centro Criptológico Nacional (CCN). The order also emphasises that only a Spanish ID will be a valid form of identification, excluding other methods of electronic ID, unless they are authorised by the Spanish government.
A new “Corcuera Act”
Catalonia’s minister for Digital Policies, Jordi Puigneró, complained that the new legislation has a “re-centralising” objective and accused the Spanish government of trying to “limit the free use of the internet”. He compared it to the so-called 1992 “Corcuera Act”, which allowed police to enter privately owned premises without a warrant. The Catalan government believes that PM Pedro Sánchez is looking to “end the digital version of Spain’s autonomous regions”, because the new legislation will also allow Madrid to block the use of blockchain technology in the design of a Catalan ID, to limit the ability of regional cybersecurity services to liaise with international bodies —Catalonia’s has just been rolled out— and monitor the laying of fibre optics cable. For all these reasons, the Catalan government has sounded the alarm and is weighing the odds of an appeal against the order with Spain’s Constitutional Court.
(1) Tsunami Democràtic is a non-violent Catalan protest group that advocates Catalan independence. It rallies supporters of the Catalan independence movement through the use of social media, apps and other online resources.