Watching the watchmen: police espionage on Nodo50 and the anti-globalisation movement

http://www.statewatch.org/news/2002/mar/08spain.htm

In this report we will explain how Nodo50 has been monitored by the Ministry of Internal Affairs in order to point out that the Government knows everything that the Antiglobalitation Movement thinks and discusses. Hence it is lying when it maintains that violent actions are being prepared from Nodo50 including production of a sabotage manual, urban guerrilla warfare etc.

"On December 11th, the Head Director of the Spanish Police, Juan Cotino, declared to the EFE news agency that the Anti-globalisation Movement represented a threat to national security on the occasion of the semester of the Spanish presidency of the EU, comparing it implicitly to terrorism. He also declared that the security forces are investigating the Anti-globalisation Movement"
(Source: El Mundo, http://www.el-mundo.es/2001/12/12/espana/1083326.html)

On January 25th 2002 we read in the Spanish mass media of the "fears" of the Spanish Internal Affairs Ministry. An unidentified spokesman alerted officials of the supposed arrival of "4,000 antisystem militants", gathering to demonstrate against the EU summits which will be celebrated during the first semester of this year. Of the many comments, we want to emphasize the following in particular:

"One and a half months ago, the police information services detected a meeting in Zaragoza of radical groups, anarchists, squatters and supporters of leftish "abertzale", at which they suspect protest actions were being prepared for the six months of the Spanish presidency".
(Source: El Mundo: http://www.elmundo.es/2002/01/25/espana/1097727.html)

This news and the nature of the information filtered from the police suggests that "something suspicious" was being prepared in Zaragoza. The news, gilded with violent shades, gives the impression that what was in reality a public and open meeting of the Antiglobalitation Movement, was little less than a clandestine meeting to destabilize the Spanish Presidency of the EU.

In this report we will explain how Nodo50 has been monitored by the Ministry of Internal Affairs in order to point out that the Government knows everything that the Antiglobalitation Movement thinks and discusses. Hence it is lying when it maintains that violent actions are being prepared from Nodo50 including production of a sabotage manual, urban guerrilla warfare etc. Most of the information included in this report is extracted from our server "logs". Neither special knowledge nor espionage skills has been necessary to collect this information: only the ability to read.

A clear example of what we considered media manipulation coordinated by the police is the note of the Colpisa Agency of January 13th 2002 which can be read at:
http://www.nodo50.org/criminalizacion_mov_sociales/nodo50/colpisa.html

The poisonous nature of this information demonstrates clearly that the Ministry of Internal Affairs has the objective of preparing the ground for repression of the organs of communication of the Anti-globalisation Movement. A previous campaign of criminalization as a basic tool and means for power control is well understood by Mr. Cotino. Indeed it was this news from Colpisa that encourage us to make this investigation.

HOW WE KNOW THAT THEY ARE WATCHING US

From the end of December 2001, the following IP addresses (the unique number that identifies computers on the Internet) have been making exhaustive surveillance of everything published on Nodo50:

[195.76.172.14,] belonging to the Main directorate of the Police
[194.179.107.29] and 194,179,107,131, belonging to the Main directorate of the Guardia Civil
[195.76.204.34,] belonging to the Ministry of Internal Affairs

The identity of the owners of these IP numbers can be verified by using:

http://www.ripe.net/ripencc/pub-services/db/whois/whois.html

In all cases, the IP addresses correspond to a set of proxy servers. We have determined that behind the proxy servers were: 8 computers in the case of the Police, 4 in the case of the Guardia Civil and 3 in the case of the Ministery of Interior.

WHAT ARE THEY DOING?

We have identified two main activities: A systematic tracking of all Nodo50's web pages and infiltration of different mailing lists.

WEB TRACKING

The activity of the National Police is daily. From 8.30 in the morning until 21.00 during working days, with brief pauses at 10:00hs. (the coffee break) and a break of one hour between 15:00 and 16:00 (lunch and change of agents). There is also activity on Sundays though for less hours. In the days prior to the Summit of Ministers of Interior and Defense of Santiago de Compostela the activity was more intense, from 7:30 to 23:30 almost without interruption.

The activity of the Guardia Civil is also daily. It normally begins in the morning around 10:00 and continues until 14:00. The pause for coffee is shorter and the activity in the evening is minimal.

The activity of the Ministry of Internal Affairs is far less. On many days there is no activity, and when active, only for an hour or two.

In any case, all of the monitoring is by human intervention. We are not aware of any massive downloads of web pages by means of software for later analysis.

INFILTRATION OF MAILING LISTS

The mailing list of most interest to the security agensies is the anti-ue@listas.nodo50.org, a private mailing list dedicated to coordination of the different antiglobalitation organizations.

We have ascertained that the following addresses have subscribed to the anti-ue list from Police computers:

– decancienes@xxxx.xx the 24/09/2001
– juanpedelucas@xxxx.xx the 25/09/2001
– pedritoanarka@xxxx.xx the 04/10/2001

From of the Guardia Civil the following:

– ferdihor@xxxx.xx the 27/09/2001
– moralespelo@xxxx.xx the 14/01/2002

Security Agencies have also tried to subscribe to the contrainf-antiue@listas.nodo50.org, a list dedicated to coordination of the thematic area of disinformation and communication of the campaign against the Spanish presidency of the EU.

The Police:

– decancienes@xxxx.xx the 24/09/2001
– pedritoanarka@xxxx.xx the 03/10/2001

The Guardia Civil:

– ferdihor@xxxx.xx the 25/09/2001

They were unable to subscribe to the moderated mailing list due to the requirement of a previous presentation for subscription approval.

Nevertheless, they have been reading the contents of the mailing list via the public web interface until the middle of January when access to these archives was restricted to the members of the list.

On 24/01/2002 there was an attempt by the Guardia Civil to subscribe to the cntweb@listas.nodo50.org list, a public list of news of the web of the CNT-AIT Union. The subscription was not successful because a non existent or non verifiable address was used. The address was xxxxxx@globalum.com and belongs to Repsol-YPF S.A..

Both security agencies are subscribed to the novedades@listas.nodo50.org list, a public list of news published by Nodo50 with the following addresses:

– rianomasy@xxxx.xx (Police) from the 11/01/2002
– sane@xxxx.xx (Guardia Civil) from the 14/01/2002

In all of the lists, the subscribers from security agencies have limited themselves to only reading messages, just as they do in meetings they attend to note and monitor everything discussed and those proposing. We are certain that no active intervention will take place.

WHAT INFORMATION ARE THEY LOOKING FOR?

The following key words were searched using our search engine: http://www.nodo50.org/busca.htm:

The Guardia Civil searched for the following words:

– Actividades+contra+la+Uni