SPAIN: RESPONSE TO S/CT REQUEST FOR INFORMATION ON

C O N F I D E N T I A L SECTION 01 OF 05 MADRID 002055

SIPDIS

SIPDIS

FOR S/CT (MCKUNE),NCTC AND DHS

E.O. 12958: DECL: 10/30/2017
TAGS: KVPR PTER PREL PGOV PINR CIVS ASEC KHLS SP
SUBJECT: SPAIN: RESPONSE TO S/CT REQUEST FOR INFORMATION ON
HOST GOVERNMENT PRACTICES - INFORMATION COLLECTION,
SCREENING, AND SHARING

REF: STATE 133921

MADRID 00002055 001.2 OF 005


Classified By: DCM Hugo Llorens for Reasons 1.4 (b) and (c)


1. (SBU) Embassy Madrid offers the following responses to
REFTEL request for information on the government of Spain's
policies toward and capabilities for collection of biographic
and biometric data for terrorist screening purposes. For
ease of reading, we have opted to rewrite each question set
above the appropriate responses in the body of the report.
The below information represents the current understanding of
our Mission interagency team, both what we already knew
before the S/CT request came in, and what we were able to
collect and learn during the reporting period. We have noted
that some gaps still remain and will make it a priority to
fill in the blanks as we continue to engage with a Spanish
government that has become one of the USG's key partners in
the fight against terrorism.


2. (C) A. Watchlisting: If host government maintains a
"watchlist," how many records does the watchlist contain, and
how many are terrorist-related? Which ministry or office
maintains the watchlist?

-- The GOS does not currently maintain a separate terrorist
watchlist at the border, but Spain is part of the Schengen
Information System (SIS),and has access to EU holdings. The
GOS has plans to implement the SIS at ports of entry
beginning in 2009. On September 17, the U.S. and Spain
signed a cutting-edge bilateral information sharing agreement
covering known and suspected terrorists as envisioned under
HSPD-6. Under this agreement, the Spanish Ministry of
Interior will be responsible for supplying Spanish data into
the U.S. Terrorist Screening Center database/watchlist, and
will conversely be the recipient of TSC data.


3. (C) B. Traveler Information Collection: What are the
country's policies (legislation, mandates, etc.) on
collecting information from travelers arriving in the
country? Are there different policies for air, sea, and land
entry and for domestic flights? Who collects traveler
information? What are the policies of the collecting agency
to share that information with foreign governments? Does the
host government collect Passenger Name Record (PNR) data on
incoming commercial flights or vessels? Is this data used
for intelligence or law enforcement purposes to screen
travelers? Does host government have any existing treaties
to share PNR data? If applicable, have advance passenger
information systems (APIS),interactive advanced passenger
information systems (IAPIS),or electronic travel authority
systems been effective at detecting other national security
threats, such as wanted criminals?

-- Currently, Spain only collects the limited information
requested on arrival cards, but this information is not
entered into a computer database. What information is
gathered and kept is shared within the EU and the SIS.
Passports are scanned upon arrival (this is still a test
project) to verify if there has been any alteration or
forgery. As Spain is a part of the Schengen agreement, it
does not maintain any type of passport controls upon entry or
exit for all domestic travel to EU member countries (except
the United Kingdom). Spain does not maintain any type of
passport controls upon entry and exit, and does not maintain
any type of travel records. Persons traveling to and from
the UK are required to be screened at passport control in
Spain, but Spain does not maintain these travel records. In
regards to international travel, persons departing and
entering Spain are required to be screened at passport
control. It is our experience that Spain has not readily
automated this type of information, thus making any retrieval
of international travel data almost impossible. Spain on
occasion maintains data if the border official encountering
the traveler physically loads the traveler's information, but
this is rare. Spain does not collect traveler data for
persons entering Spain on land via France or Portugal, and
there are no longer checks at border crossings between the
countries. Persons entering Spain via Gibraltar are required
to be screened at passport control, but Spain does not
maintain this data. The collection of traveler information
is the responsibility of the Spanish National Police, and the
SNP is very willing to share this type of information.
However, for the reasons enumerated above, the SNP has very

MADRID 00002055 002.2 OF 005


limited data available, and what exists is usually of little
value. Spain does not have an Advanced Passenger Information
System (APIS). On November 6, the EU Commission plans to
approve a project whereby data relative to passengers
arriving by air will be stored and reviewed by each member
state. The proposed system will use the same fields as that
used by the U.S. system. The objective of this program is to
use it for both intelligence and law enforcement purposes.
Spanish law enforcement implements a mechanism by which they
are able to effectively detect the travel of passengers with
warrants for arrest. In relation to terrorists, the
mechanism is not yet in place, but is forthcoming.


4. (C) C. Border Control and Screening: Does the host
government employ software to screen travelers of security
interest? Are all travelers tracked electronically, or only
non-host-country nationals? What is the frequency of
travelers being "waived through" because they hold up what
appears to be an appropriate document, but whose information
is not actually recorded electronically? What is the
estimated percentage of non-recorded crossings, entries and
exits? Do host government border control officials have the
authority to use other criminal data when making decisions on
who can enter the country? If so, please describe this
authority (legislation, mandates, etc. What are the host
government's policies on questioning, detaining and denying
entry to individuals presenting themselves at a point of
entry into the country? Which agency would question, detain,
or deny entry? How well does information sharing function
within the host government, e.g., if there is a determination
that someone with a valid host-government visa is later
identified with terrorism, how is this communicated and
resolved internally?

-- Spanish authorities use what they call a "Verifier." The
SNP officer at the POE decides who will be "verified" to see
whether they are under an arrest warrant of a "No-entry" into
the Schengen area. This database is shared with the Civil
Guard. Spanish border control systems are being developed
further under Schengen and are scheduled for implementation
in 2009. Spain does not currently possess border control
software. Very few travelers are tracked electronically as
they enter Spain. Documents are visually checked, with more
intense screening possible and done randomly and on certain
flights. We estimate that fewer than 10 percent of entries
and exits into Spain are recorded. Spanish border control
are sworn officers of the Spanish National Police, and they
are not restricted in using criminal data when making
decisions on who can enter the country. However, it has been
the experience of our Legatt that the principal decisonmaking
factor for allowing or disallowing entry into Spain is
whether or not the traveler possesses proper travel
documentation. Spanish immigration, however, can and does
deny entry into the country. The sharing of information
between the Spanish National Police and the Spanish Civil
Guard, Spain's two national law enforcement services, is
problematic. The two services have strong CT missions, but
generally work independent of each other and rarely share
information. When the two services do share information, it
is normally conducted via informal channels. Spain created
the National Center for Counterterrorism Coordination in
2005, a CT collection, analysis, and dissemination hub, which
serves as a terrorism coordination center for Spanish law
enforcement and intelligence agencies. However, the center
is still in its infancy, and the sharing of information
through the center continues to be a work in progress.


5. (C) D. Biometric Collection: Are biometric systems
integrated for all active POEs? What are the systems and
models used? Are all passengers screened for the biometric
or does the host government target a specific population for
collection (i.e. host country nationals)? Do the biometric
collection systems look for a one to one comparison (ensure
the biometric presented matches the one stored on the
e-Passport) or one to many comparison (checking the biometric
presented against a database of known biometrics)? If
biometric systems are in place, does the host government know
of any countermeasures that have been used or attempted to
defeat biometric checkpoints? What are the host government's
policies on collecting the fingerprints of travelers coming
into the country? Which agency is responsible for the host
government's fingerprint system? Are the fingerprint
programs in place NIST, INT-I, EFTS, UK1 or RTID compliant?

MADRID 00002055 003.2 OF 005


Are the fingerprints collected as flats or rolled? Which
agency collects the fingerprints?

-- Biometric systems are not yet integrated into the Ports of
Entry (POEs),although "Poto" biometric is used. Spain
maintains biometrics (photo/fingerprint) for all Spanish
nationals and holders of Spanish identity documents. The GOS
plans to take fingerprints with the implementation of the SIS
border controls in 2009. The Spanish National Police is
responsible for managing Spain's national fingerprint system.
This system is known as "SAID," and "SAID II" will soon be
implemented. SAID II is meant to be more compatible with
other international law enforcement partners and should
greatly increase Spain's power to process raw fingerprint
data. According to Legatt records, the SAID is currently
NIST and INT-I compliant. The SAID II is supposed to be EFTS
and, more importantly, ANSI/NIST-ITL-1-2007 compliant.
Fingerprints collected are always rolled, but Spain will soon
be collecting digital flats. Print data is collected by all
of the various law enforcement agencies within Spain, but the
SNP is responsible for serving as the central repository for
fingerprint data.


6. (C) E. Passports: If the host government issues a
machine-readable passport containing biometric information,
does the host government share the public key required to
read the biometric information with any other governments?
If so, which governments? Does the host government issue
replacement passports for full or limited validity (e.g. the
time remaining on the original passports, fixed validity for
a replacement, etc.)? Does the host government have special
regulations/procedures for dealing with "habitual" losers of
passports or bearers who have reported their passports stolen
multiple times? Are replacement passports of the same or
different appearance and page length as regular passports (do
they have something along the lines of our emergency partial
duration passports)? Do emergency replacement passports
contain the same or fewer biometric fields as regular-issue
passports? Where applicable, has Post noticed any increase
in the number of replacement or "clean" (i.e. no evidence of
prior travel) passports used to apply for U.S. visas? Are
replacement passports assigned a characteristic number series
or otherwise identified?

-- Spain's public key system is shared within the SIS and
with others. All full-validity passports are issued in Spain
under a system very similar to ours, and Spanish Embassies
and Consulates can issue a limited-validity emergency
passport which, like ours, is not an e-passport. Replacement
passports are recognizable because they are not issued for
the full 10-year validity; they are issued for a limited
validity that coincides with the validity of the passports
being replaced. Spain does have procedures for dealing with
habitual losers of passports, and can include significant
fines. Emergency and replacement passports contain the same
information as regular passports.


7. (C) F. Fraud Detection: How robust is fraud detection
and how actively are instances of fraud involving documents
followed up? How are potentially fraudulently issued
documents taken out of circulation, or made harder to use?

-- Spain has robust fraud detection and follows up
expeditiously on all known or suspected cases. Spain has a
system very similar to ours to deal with fraudulently issued
documents and to get them out of circulation. Spanish
national identity documents contain fingerprints and are thus
hard to illegally manufacture.


8. (C) G. Privacy and Data Security: What are the country's
policies on records related to the questioning, detention or
removal of individuals encountered at points of entry into
the country? How are those records stored,
and for how long? What are the country's restrictions on the
collection or use of sensitive data? What are the
requirements to provide notice to the public on the
implementation of new databases of records? Are there any
laws relating to security features for government computer
systems that hold personally identifying information? What
are the rules on an individual's ability to access data that
homeland security agencies hold about them? Are there
different rules for raw data (name, date of birth, etc.)
versus case files (for example, records about enforcement

MADRID 00002055 004.2 OF 005


actions)? Does a non-citizen/resident have the right to sue
the government to obtain these types of data?

-- Spain's privacy rules track with those of the EU. Removal
and deportation records are maintained in the SIS for periods
of 3 to 10 years or longer. Spain has rules in place for the
collection and use of sensitive data that closely mirror our
own. Generally, all of this data can be collected with or
without a court order. Embassy Legatt is unaware of any type
of data that is completely off-limits to the government. As
in the U.S., data that is obtained via the legal process
(i.e. subscriber data from Internet service providers or
telecommunications companies, data intercepts, telephone
intercepts, etc. is "owned" by the investigative magistrate
that issued the order to obtain the data, not the law
enforcement agency that is conducting the investigation.
This investigative magistrate decides how the data can be
used as well as who it can be shared with. Data that is
collected exclusively by law enforcement can be released by
that service at their own discretion. However, when an
investigative magistrate directs Spanish law enforcement to
collect this type of data (i.e. voluntary interviews of
persons, etc.),this information is once again "owned" by the
investigative magistrate. The magistrate decides how the
data can be used and with whom it can be shared. We are
aware of one restriction pertaining to the use of sensitive
data, specifically as it relates to national identity cards.
Persons who obtain Spanish national ID cards, or what are
commonly referred to as "DNI" or "NIE" cards, are required to
provide personal identifying information, a photograph, and
one fingerprint (right index finger). This print is supposed
to be completely off-limits for general law enforcement use,
and its use is supposed to be only for elimination purposes
to ensure persons do not have more than one national ID card
issued to them. The SNP is responsible for issuing DNI/NIE
cards. In Spain, individuals can ask for police records, and
non Spanish citizens have the right to sue for police records.


9. (C) H. Immigration Data Bases: What computerized
immigration databases are used to track entries and exits?
Is the immigration database available at all ports of entry
(POEs)? If immigration databases are available at some POEs,
but not all, how does the host government decide which POEs
will receive the tool? What problems, if any, limit the
effectiveness of the systems? For example, limited training,
power brownouts, budgetary restraints, corruption, etc.?
How often are national immigration databases updated?

-- Spain currently lacks immigration databases that track
entry and exit records, but entry forms are collected at all
POEs. Such systems are envisioned for implementation in 2009
as part of the SIS. SNP officers at the POEs do not know if
a person has been into Spain previously unless there are
entry stamps in the passport presented. If the passport is
new, this information would not be known.


10. (C) I. Watchlist and Information Sharing: Is there a
name-based watchlist system used to screen travelers at POEs?
What domestic sources of information populate the name-based
watchlist, i.e. names of deported persons, terrorist
lookouts, criminal wants/warrants? What international
watchlists do the host government use for screening
individuals, e.g. Interpol or TSA No Fly lists, UN, etc.?
What bilateral/multilateral watchlist agreements exist
between host government and its neighbors?

-- Although Spain does not currently utilize any type of
watchlist, name-based information is available at its POEs.
However, this information is not readily-available to
inspectors at primary entry points. Spain has access to SIS
and Interpol information. As part of HSPD-6, the U.S. and
Spain signed a bilateral agreement in Madrid on September 17
to share screening data on known or suspected terrorists.
The U.S. Terrorist Screening Center and Spain's NCTC
equivalent are working through a 90-day implementation period.


11. (C) J. Biometrics: Are biometric systems in place at
ports of entry (air, land, sea)? If no, does host government
have plans to install such a system? If biometric systems
are available at some POEs, but not all, how does the host
government decide which POEs will receive the tool? What
biometric technologies, if any, does the host government use,
i.e. fingerprint identification, facial recognition, iris

MADRID 00002055 005.2 OF 005


recognition, hand geometry, retinal identification, DNA-based
identification, keystroke dynamics, gait analysis? Are the
systems ICAO compliant? Does the host government issue a
machine-readable passport containing biometric information?
If e-Passports are issued, what biometric information is
included on the document, i.e. fingerprint, iris, facial
recognition, etc. If not, does host government plan to issue
a biometric document in the future? When?

-- Biometrics are not yet in place at Spain's POEs, but are
slated to be implemented in 2009. Spanish law enforcement
regularly utilizes fingerprint identification and DNA-based
identification to conduct its mission. The Spanish
e-passport contains computer chip technology with a digital
photo and plans are to add fingerprints in 2009.


12. (C) K. Identifying Appropriate Partners:

-- Spain has been, is, and will continue to be a committed
ally in the fight against terrorism and we have established
relatively good channels of information sharing. Any
watchlists that Spain currently has or may maintain in the
future would not include political dissidents. Spain
understands our rules on information sharing and would not
share or use U.S. watchlist data inappropriately. As
mentioned previously, we have already entered into a
data-sharing agreement as envisioned under HSPD-6 and we will
look to strengthen our bilateral cooperation through other
appropriate agreements. Spain has a modern, competent, and
independent judiciary system that is developed to adequately
provide safeguards for the protection and nondisclosure of
U.S. information. Spain's internal services do have a
problem with sharing among themselves, but they are aware of
their problems with stovepiping and are taking steps to
streamline the flow of information across national services.
Spain has numerous legal statutes that define terrorism much
as we do, and even have laws on the books that are more
relaxed than ours in terms of charging individuals with
membership in a terrorist organization, support for a
terrorist organization, and even positive comments made about
a terrorist organization. The GOS has dealt with the Basque
terrorist group ETA for more than 40 years and in recent
years has focused on the threat from Islamic extremist
terrorism in the wake of the March 11, 2004 Madrid train
bombings. The fight against terrorism is the number one
priority of this Mission and we will continue to engage with
the GOS to improve on already excellent cooperation.
AGUIRRE