"Illegal" software and cybersecurity: why control of the CTTI decapitates the Generalitat
Editorial
"One of the next steps for the Spanish government to take after activating Clause 155 (of the Constitution) might be to take control of the CTTI and the Cesicat. They are the digital brain of the UDI (Unilateral Declaration of Independence) and there are several companies behind it" says Manuel Angel Méndez, in documented information published on October 28th by the magazine ‘El Confidencial’. Here is a summary.
"Disconnect the computer brain of the Generalitat and break down their defences. In a single line, this is the objective that the Government proposes with the intervention of the Centre of Telecommunications and Information Technologies (CTTI) and the Information Security Centre of Catalonia (Cesicat)", says Manuel Ángel Méndez. Civil Guard sources, responsible for the investigation into the Catalonian computer centre, quoted by the author, say that "we are prepared to act as and when required, but we will not take control of the CTTI.
The objective is to stop any attempt to create a parallel digital administration. The possibility has been detected that this has occurred and taking control of it is aimed at avoiding this".
With 240 employees, the CTTI, located in L'Hospitalet de Llobregat (Barcelona), manages a total of 1,700 computer applications used by the more than 165,000 Generalitat staff. From Health and Interior to the Tax Agency, its six data centres store all the information for the day-to-day working of the (now extinct) Catalan Government. In total, it connects more than 6,600 public buildings and also controls all the fixed and mobile communication lines (more than 85,000) used by the Generalitat members. Another decisive point is that it is the one in charge of giving the green light or not to all the technological projects tenders and contracts.
"A government has physical and digital assets, and the latter in Catalonia are housed in infrastructures controlled by the CTTI, from e-mail to telecommunications through databases, everything that has to do with the security of those infrastructures is the responsibility of the Cesicat. If at any time, undercover projects of technology creation aimed at launching a Catalan state were being carried out, these were being developed in the CTTI and the Cesicat. Controlling both bodies digitally beheads the Generalitat, explains a former high leader of Cesicat who prefers to remain anonymous.
Sources from the investigation into the CTTI confirm the existence of indications that the first steps towards the creation of a parallel digital administration, ready to take place in key areas such as Health Care and Tax Management, have been confirmed. "An example: on one hand, you have the individual health cards (TSI) and on the other hand, the idCAT is ready, a certificate that guarantees your identity on the Internet. Can this be converted into a citizen identification system, in a digital ID of its own? It is only a question of adding the rest of the seven million Catalan general public to the 400,000 people who are now using the system. We do not know that it has been done in Health Care, but we do have clear indications that that was already happening in Tax Management."
IBM'S "ILLEGAL" TAX SOFTWARE
Not even the Catalan Government tries to hide it. "Catalonia is ready to assume, when necessary, the taxes that still go through the Spanish Treasury".
This was announced by President Carles Puigdemont last July at an event in the Palau de la Generalitat. He highlighted the advanced degree of development of the Catalan Tax Agency (ATC) in recent years and gave the "first phase" of construction of the embryo of the future Treasury. A "state structure" declared illegal just one year earlier, in July 2016, when the Constitutional Court estimated the Government's appeal against the Law on Fiscal, Financial and Administrative Measures approved by the Catalan Executive in 2015 to create, among other things, a totally independent Tax Administration.
Sources involved in the investigation into the CTTI now point to the million-dollar contracts awarded to different technology companies, allegedly to covertly create this independent digital administration. Specifically, they point out the work that the multinational IBM has been doing for the Generalitat since 2015, when it signed one of the most substantial contracts for the "implementation of a first phase of a basic tax management system". Precisely it was this "first phase" that a year later Puigdemont pronounced as finished. The contract was awarded in March 2015 and was formalized only three weeks later for a total amount of Euros 2,146,237.
The objective of the project is explained quite well in the technical specifications: "Create a tax management system" that has to be integrated and function perfectly alongside the current one used by the Catalan Tax Agency ('ATC'), called 'Gaudí'. On paper, nothing suspicious. However, the document left many grey areas open that betrayed a possible secondary use of the project: to set up a digital tax office of its own, as the research sources point out to the CTTI.
"We have indications that top executives at IBM were aware that carrying out this project could constitute a crime," said the sources. Reading some clauses in the technical specification is not difficult to understand why. The document starts by explaining that the current system, 'Gaudí', manages the taxes transferred (heritage, gambling, large commercial establishments, estates and donations, tourism, and so on). but a new tax management system is needed on "the estate tax and tourist stays, but able to be generalised to any taxable figure... This technical-organizational solution will have to enable an integrated 360º view of taxpayers at all organizational levels."
"These euphemisms are being used all the time, which actually involve the covert creation of illegal software, and some executives at IBM knew it," police sources said. A complaint included in the summary of the investigation carried out by the Court No. 13 of Barcelona on the referendum of 1-O points in the same direction".
It is vox populi within the ITC providers working for the CTTI that IBM, directly or through one of its subsidiaries, is working on the future "Catalan Treasury".
Probably the Prosecutor's Office is already aware of this circumstance and even IBM is collaborating with the Prosecutor's Office".
SIGN HERE, AND YOU COULD BE COMMITTING A CRIME
Former employees of IBM have even contacted this newspaper to explain the practice allegedly carried out by the company:
Workers were required to sign clauses in which they recognized that they could be committing a crime if they worked on certain projects for the Generalitat.
To date, no documentary evidence of these clauses has been found. Luis J. González, head of the IBM Global Services trade union section of CC.OO. in Barcelona, acknowledges that he has no record of such documents, but neither does he put his head on the block: "I will not deny that there is an IBM manager who may have some strange story at hand," he says. IBM has been awarded more than 223 million Euros in contracts with the CTTI since 2012.
When asked by this newspaper about these signs, IBM is blunt. "We deny that there were clauses of this type signed by employees". On alleged 'grey areas' or ambiguity in contracts, we categorically affirm that all our activities are carried out within the current legal framework", a spokesman explained. It remains to be seen whether IBM will face the same fate as T-Systems, whose headquarters was searched on September 20th by the Guardia Civil for having participated in the creation of the computer systems used in the 9-N consultation.
One way or another, the reality is that since 2012, IBM has been awarded more than 223 million Euros in contracts with the CTTI, all for the creation of computer systems that extend the current capabilities of the digital Generalitat. It is now, during the first days of application of article 155, when the Spanish Government has to decide how to intervene and direct the CTTI and the Cesicat to dismantle a system almost as problematic as the real one: digital independence.
