Russian hacking operations to support Catalonian independence are continuing and could intensify, according to a report published this week by the Center for Strategic and Defense Studies, CESEDEN, a Spanish Defense Ministry think tank.
The report claims Russia is destabilizing Spain as tensions escalate in the rebellious northeastern region.
"The Kremlin is taking advantage of the Catalan crisis to destabilize, employing a policy intended to generate confusion in the social media," the report said.
While Spanish Prime Minister Mariano Rajoy hoped the elections he called in the region last month would defuse tensions, they instead returned the pro-independence majority to the regional parliament. This week, the pro-independence majority continued to defy Madrid by nominating exiled leader Carles Puigdemont as president.
Suspicions of Russian meddling in Catalonia have been voiced by Spanish defense minister Maria Dolores Cospedal, as well as EU and NATO analysts.
Although Cospedal has been reluctant to blame Russia directly, she said last November that her government was analyzing how thousands of robot accounts supporting Catalonia’s independence operated from Russia.
Russian foreign minister Sergei Lavrov has accused Spain of trying to “blame Russia for its internal weaknesses.”
But a 2,000 percent increase in social media traffic has been detected since a referendum and subsequent declaration of independence by the Catalan parliament late last year. The moves triggered the imposition of direct rule by the Spanish government, which issued an order of arrest for Puigdemont.
Indirect target: NATO
Spain’s Defense Ministry has said it agrees with the CESEDEN report’s conclusions in a section titled “Impact of Geopolitical Dynamics on Spain.” The report's author, University of Barcelona political scientist Josep Basques, said Russia was using Spain’s unrest to weaken NATO.
“Moscow does not have specific interests in Spain, as it's too far from its area of influence. But Moscow aspires to foment problems in Catalonia as a way of debilitating a member of NATO,” he said. Basques warned that the strategy could be repeated in other European countries with secessionist minorities.
A NATO specialist in cyber warfare who testified before Spanish congressional hearings says the Kremlin's investment in cyber operations targeting Spain represent a tiny fraction of the estimated $1 billion Moscow spends in official and unofficial media outlets.
'Troll farm' at work
Much of the pro-secessionist social media traffic has been traced to a Russian “ troll farm” operating from a building on the outskirts of St. Petersburg. A company called Internet Research is housed in the building, which is owned by Evgeny Prigozhin, a close business associate of Russian president Vlaldimir Putin.
IR employs dozens of hackers, bloggers and writers to disseminate fake news and articles favorable to the Kremlin, according to former employees who have talked to the western press and describe an operation resembling a boiler-room scheme.
"They are capable of putting out any type of news, commentary and opinion extremely quickly,” said Spanish cybersecurity expert Manuel Huerta. “They try to create a trend by following each other and attracting real profiles, whose following they enhance for further impact.”
Ukranian cyberanalyst Katrin Palanska has said that IR also targets Ukraine and Baltic states where Moscow is supporting pro-Russian separatists. Russian cyberattacks have reached highly intense levels and have even involved attempts to commandeer Ukraine’s electrical grid and government records, according to Palanska.
Anti-independence journalists in Catalonia say their websites and email accounts have been systematically hacked from electronic dominions in Russia.
Eric Encinas, publisher of a digital magazine, showed VOA a Post Office Protocol (POP3) Google notification received last week of “unusual detected activity” in his hotmail account that was traced to a location in Russia. There was a similar attempt to hack his gmail account last month from Ekaterimburg, where the IR troll farm is located.
Venezuela involved
Over 30 percent of robot accounts supporting Catalonian independence also originated in Venezuela, according to Spanish defense spokesmen. Venezuelan president Nicolas Maduro, a close Russian ally, has attacked Rajoy for supporting opposition to his government.
Accounts such as #VenezuelaSalutesCatalunya have boosted messages calling Rajoy a “brutal dictator” and urging Catalans to “resist."
Social media narratives may yet have influence in Catalonia, where the exiled Puigdemont plans to govern “telematically.” His supporters in the Catalan parliament plan to inaugurate him by Skype.
Oriol Soler, a close media adviser to Puigdemont, has met with Wikileaks founder Julian Assange, whose Russian connections were highlighted by his role in the social media campaign against Hillary Clinton in the 2016 U.S. elections.
Assange has generated 40,000 tweets in support of Catalan independence since meeting with Soler last November.
Soler said he met Assange at Ecuador's embassy in London to discuss a digital publishing project.
