The Cybersecurity Coordination Unit of the Civil Guard produces a daily report on the activity it detects on the internet and social networks and which includes a section called “disinformation”. Inside there are two fixed epigraphs every day: “creation of a climate contrary to the current crisis management” and “generation of social stress in the population”. The reports are submitted to the Civil Guard General Staff and their content is incorporated into the daily news section that is disseminated internally and is also sent to the Ministry of the Interior.
In these subsections, content disseminated during the pandemic is attached to open sources, that is, content that is public, whether it is hoaxes through messaging systems, media information already denied by official organizations or comments on social networks critical of the action of the Security Forces and Bodies and with the central, autonomous and municipal Governments.
Among these latest social media contents appear in reports prepared in recent weeks tweets launched from official accounts of EH Bildu and Vox. Santiago Abascal’s party is also mentioned in another section, but this time as the victim of a supposed hoax, as in a case with Unidas Podemos.
The Cybersecurity Coordination Unit was created in June 2019 and reports to the Deputy Operational Directorate of the armed institute. It is an information gathering group that receives the data from the different commanders and investigation units, selects them and prepares reports. The Unit does not have operational capabilities and is made up of a dozen agents under the command of a lieutenant colonel. The works for its creation began as a result of the National Security Strategy that the Executive of Rajoy approved in December 2017 with the support of PSOE and Ciudadanos. Its implementation, like other cybersecurity projects derived from that Strategy, has been delayed until starting work just nine months ago during the previous Pedro Sánchez Government.
eldiario.es has accessed several reports from the Cybersecurity Coordination Unit, which are divided into four sections: “cybercrime, hacktivism, cyber attacks and disinformation”. This last section of “disinformation” is broken down into the two aforementioned subsections: “creation of a climate contrary to the current management of the crisis” and “generation of social stress in the population”. Depending on the content of one or the other links detected in the last hours in the networks by commanders and investigation units throughout Spain, the Coordination and Cybersecurity Unit fits them into the aforementioned epigraphs with an unclear criteria.
In recent days, the section “creating a climate contrary to the current crisis management” attached, as appears in the daily part of the Civil Guard, an “article from the digital newspaper Ok Diario ensuring that the European Parliament will investigate whether the state of alarm decreed by the Prime Minister violates fundamental rights. ” The following reads: “Later denied by the European Parliament on his Twitter account “ and the link to said official denial.
In a report from another day, the Civil Guard included in the “creation of the climate contrary to crisis management” a video of the feminist activist and collaborator of various media, Irantzu Varela, in which she asked not to applaud the Army or the Security Forces. Analysts from the armed institute write: “Online news item detailing how journalist Irantzu Varela Urrestizala has criticized through video the actions of the FFCCSS and the Armed Forces in the development of the current health crisis caused by COVID-19 accusing them of taking advantage of the situation to exercise violence illegitimately. “
Consulted by eldiario.es, the Ministry of the Interior has ensured that the Civil Guard Cybersecurity Coordination Unit “is not an operational unit, but rather a coordination unit, and is dedicated to preparing internal reports and promoting activities of the safety culture. ” In the same sense, an official spokesperson assures that the priority of the Security Forces are cybercrimes, such as scams, those of a sexual nature or terrorism. And that the work on “hoaxes and disinformation” is based, “mainly, on open sources.”
“It is about detecting those campaigns based on lies or montages that can generate serious stress or social alarm, especially those that have as a raw material such a sensitive element in these times, such as health,” they affirm from Interior. “A more detailed analysis is only carried out when there are signs of crime, such as insults, slander or threats. All this activity is carried out without affecting the right to freedom of expression and opinion,” he said. added the aforementioned spokesperson.
“A false news” about United We Can
In one of its reports, the Civil Guard refers to a publication on Facebook that supposes “a false news” about United Podemos, referring to that “it will take control of the Board of Directors of RTVE”. “This news would have been taken from a date of July 5, 2018 published in El País and has been circulated on a recurring basis since then” (capture that heads this information).
On a different day, but in the same subsection of “climate contrary to current crisis management”, five comments were reported from Twitter accounts whose messages are mostly written in Basque. All of them are related to the videos of the tribute that the Ertzaintza and the Municipal Police of San Sebastián paid before the Gipuzkoa Command for the death of an agent of the armed institute. “These videos have been disseminated through social networks accompanied by different messages against the Civil Guard,” says the report.
Among those comments included is one of the official EH Bildu account in Donosti that attaches the aforementioned video and writes in Basque: Who has decided that the San Sebastián City Council should participate in such an initiative? Has it been the decision of the Municipal Government @EnekoGoia? Is @DonostiaPNV a political decision? Agents on your own? We will officially ask for explanations.
Nork erabaki du Donostiako Udaltzaingoak horrelako ekimen bat part hartu behar hurts? Udal Gobernuaren erabakia izan al da @EnekoGoia ? @DonostiaPNV.ren erabaki politikoa da? Agent euren kabuz? Azalpenak eskatuko ditugu ofizialki. pic.twitter.com/o186y4qHwK
– EHBildu Donostia (@HiriBizia) April 5, 2020
More recently, in another of those daily reports, but also framed in the “disinformation” section and in the subsection “climate contrary to crisis management,” a comment is reported on Vox’s Twitter account. It refers to a tweet from the party to which the Civil Guard refers in the following way: “A large number of coffins are observed stacked in a parking lot, pointing out that they possibly belong to Spaniards who died of Covid-19, and affirming that the Government would be hiding those images so they don’t see the light. ” In reality, the tweet also said that public television had not reported those images when, three hours before the tweet was published, they had appeared in the TVE noon newscast. This denial does not appear in the Civil Guard report.
The images that the Government wants to hide and the government televisions do not broadcast.The result of their negligence, their concealments and their lies. ⚫ #D.E.P all the Spanish fallen in this tragedy. pic.twitter.com/fFbUvQRQTc
– vox_es (@vox_es) April 2, 2020
In that same report, the Civil Guard takes from the Cybercrime Unit its communication about the “diffusion through Telegram of a message with a video uploaded to YouTube in which the use of the control exercised by the State through the on the confinement of society, thanks to geolocation, questioning the anonymity of the data, based on the opinion of Vicente Botti, a supposed expert in artificial intelligence. ” Do not add more.
Corresponding to its report from another day, the Cybercrime Coordination Unit attaches the link to a blog that contains a “supposed survey carried out by the company JP Logística (apparently false, since they are the initials that coincide with the name of the author of the Blog, Juan Pardo), which shows the results of polls carried out on the occasion of the Covid-19 crisis, positioning the PP with almost an absolute majority for possible elections in 2020. “
This subsection of “climate contrary to crisis management” shows that the Cybercrime Unit also focuses on activity related to the Civil Guard itself. This is the case of the publication in a digital medium that 18 of the 78 civil guards who are assigned to the Herrera de la Mancha prison are admitted or quarantined, a fact that the medium attributes to the Unified Association of Civil Guards (AUGC) , majority in the Body. The Cybersecurity Unit frames this publication as “disinformation”.
“Generation of social stress in the population”
In the other subsection of “disinformation”, the one dedicated to “generating social stress in the population”, the Cybersecurity Coordination Unit attaches a website that denounces that “under the pretext of Covid-19, cases of police brutality they are more and more frequent “and that it offers a telephone number so that the citizens report in this type of practices. “The text is accompanied by an image in which the police officer can be seen and on them the acronym ACAB (All Cops Are Bastards”, adds the Unit before capturing the link of the aforementioned website.
The second example of the day in this subsection on alleged “generation of social stress” is a message on a Twitter account “of an anti-fascist group” that denounces that “the Police pervert the legislation on hate crimes and that several judges have overthrown several cases against it “, as well as the corresponding link.
Also in this section Vox appears, but this time as a victim of a hoax. “Publication on Twitter that shows images of a false newspaper clipping where it is exposed that VOX proposes to stop attending to homosexuals affected by COVID-19, to focus on the important ones,” says the daily report by the Civil Guard.
This same subsection serves for the Unit to attach in another report the publications in Vimeo and Superocho of the popularizer of pseudotherapies Josep Pamiés in which he “promotes MMS as a supposed cure for Covid-19”.
The phrase of the general with reference to the Royal Decree
General José Manuel Santiago assured on Sunday that the Civil Guard works to “minimize the climate contrary to the crisis management by the Government”. This phrase refers to one of the points of the Royal Decree of the state of alarm approved and published on March 14, as well as the terminology used in the reports that the Civil Guard Cybersecurity Coordination Unit is preparing.
However, neither the Royal Decree nor the reports of the Cybersecurity Unit allude to the “Government”, as General Santiago did in his speech in Moncloa, to which the Minister of the Interior, Fernando Grande-Marlaska, reacted, assuring that it would have been “a slip”.
Santiago also included the term “Government” in an email that he sent to all headquarters on April 15 requesting information on hoaxes that generate “disaffection to government institutions”. On Tuesday, 48 hours after his controversial intervention, the general rectified and said that he was referring to the institutions of the State and not the Government. He also stated that the Civil Guard only reports the hoaxes and “fake news” and does not act to eliminate them.
Furthermore, the Royal Decree on the state of alarm attributes the task of “minimizing” the effect of the hoaxes to the State Security Forces and Bodies while the state of alarm lasts in point 8 of its fourth section: “On the part of the acting police forces and the competent centers of the Secretary of State for Security will issue guidelines to prevent and minimize the effects of disinformation, limiting the vigilance and monitoring of networks and web pages where false messages and information are disseminated aimed at increasing social stress, and urging where appropriate the intervention measures provided for in the applicable legislation “. In his speech last Sunday, Santiago obviated that this work of countering the information would be done by adopting the measures provided by law, as indicated in the Royal Decree.
The brigadier general added that this function of “minimizing” is directed against the “climate contrary to the crisis management by the Government”. This last expression, “climate contrary to crisis management”, comes from the reports of the Security Coordination Unit, which, however, does not add “from the Government”.
A unit resulting from the Rajoy Government’s cybersecurity strategy
In the autumn of 2017, the then Government of the Popular Party detected the proliferation of false news on the Internet coinciding with the height of the sovereignist process in Catalonia. Although the Executive avoided publicly pointing to Russia, the Executive verified through the CNI that most of the “fake news” were hosted on servers in that country and that their public media served as a speaker for them. At the international level, the precedent of the alleged Russian interference in the elections that gave the United States Presidency to Donald Trump the year before weighed.
In December of that 2017, the PP Government, with the support of the PSOE and Citizens, approved the National Security Strategy, a document of main lines that marks the tendency to be followed by the Information and Intelligence services and other areas of the Administration in their task of protecting the State in the following years. The great novelty of the document was the concept of “cybersecurity”.
Without using the expressions “bulo” or “fake news”, a National Security Strategy speaks of “information manipulation”, “destabilization” and “polarization of public opinion”. It does this by describing “hybrid actions.” “They are combined actions that may include, along with the use of traditional military methods, cyber attacks, information manipulation operations, or elements of economic pressure, which have manifested themselves especially in electoral processes. The ultimate goal is to destabilize, encourage subversive movements and polarize public opinion, “says the document.
On December 13, 2017, the then Vice President of the Government, Soraya Sáenz de Santamaría, announced the creation of a security operations center, within the Ministry of Finance, to fight against “cyber threats”. When the press asked Santamaría, the vice president said that it was necessary “Anticipate and arm” before what he called “disinformation attempts” and he gave as an example the hoaxes that ran on the counting of votes in the Catalan elections that were going to be held on the 21st of that month. In May 2018, the idea of the new body was postponed and the task of monitoring was entrusted to the National Cybersecurity Council, created in 2013 and chaired by the director of the CNI.