Russian “hackers” help keep banned Catalan referendum census site online

For the government of Catalonia, it is crucial that it appears to have a valid electoral roll in the lead-up to the illegal referendum on the issue of independence from Spain planned for this Sunday, October 1.

However, now that judicial authorities have blocked logistical preparations for the vote, pro-independence forces have only been left with the support of hackers to maintain websites containing the electoral roll and and information on where to vote.

Civil Guard investigators are always a step behind the hackers as they must wait until they see sites before they can request they be shut down 

In fact, according to Spain’s Civil Guard, a group of hackers based in Russia and satellite countries is permanently creating new links in order to have so many copies of the census site that it will be impossible for the Spanish judiciary and police to shut them down.

In terms of digital technology, pro-independence forces face two serious obstacles: any website based in the European Union is liable to be shut down by authorities relatively quickly, and any hacker that operates within EU territory could be accused of a crime. This is why those in favor of independence for Catalonia are using computer programmers based in Russia, which has no legal agreements with the EU when it comes to digital legislation.

After the official referendum website (referendum.cat) was shut down, The regional premier of Catalonia, Carles Puigdemont, tweeted two new addresses for the site: ref1oct.cat and ref1oct.eu, based in the UK and Luxembourg. Both were immediately shut down by judicial order. They were then cloned with new addresses activated across Europe. As a result, sites including referendum.ninja were subsequently shut down. Now supporters of the independence process have moved their focus to Russia and Central Asia.

Many of the sites closed thus far remain accessible from abroad and can be accessed from Spain if a virtual private network (VPN) or a proxy server is used. Puigdemont and other members of the Catalan executive have spread information on how to make use of these tricks, which give users the appearance of accessing a site from another country.

Hackers based in Russia and satellite countries are permanently creating new links to the census site, according to the Civil Guard

On Monday, 15 alleged Spanish hackers were called to appear in court, accused of cloning the referendum website. Given the ease of locating Spanish hackers, independence activists have moved their attention abroad.

A team of IT investigators with the Civil Guard is now working to identify cloned versions of the independence website, with 144 closed to date, including the home page of the pro-independence civic association Catalan National Assembly (ANC).

“The structure is simple,” said one investigator with the Guardia Civil of the cloning process. “Once a website is created, with the appropriate domain and fees, it is hosted in Russia or another Asian country in the former Soviet Union, with whom it is almost impossible to create an order to shut down the site because there are no collaboration agreements, and because our letters rogatory are not worth the paper they are written on. From that moment on, it’s all about creating redirection links to these pages: it is not even necessary to recreate the website,” the investigator adds.

Civil Guard investigators are always a step behind the hackers. Required to wait until they see links before requesting sites be shut down, they often find those requests ignored in countries like Russia. Russia has traditionally been a source of cyberattacks like those the FBI is investigating in relation to the US election last year. Russian authorities have blocked all attempts to investigate those attacks.

The choice of Russia as a host for the Catalan referendum site is no coincidence. In recent weeks, various social media profiles associated with the country’s political system have turned the Catalan crisis into a trending topic in a bid to create division not just within Spain but in the EU as a whole.

One of the domains hosting the census site is backed by Peter Sunde, a co-founder of Pirate Bay, one of the largest piracy portals in the world. Sunde offered to help publish more copies of the Catalan site. The Catalan government took him up on the offer and used the services of a Caribbean-based company called Njalla that boasts of “acting as a privacy shield.”

WikiLeaks founder Julian Assange has also aided the Catalan government, including making unfounded claims that the Spanish government is considering blocking access to the internet in the region. The WikiLeaks portal houses a copy of the supposed Catalan census page which is simply a guide on where to vote and very similar to the 2016 census.