Press archive

In this Espejo Público report on the black market for medical records, within just a few minutes I reached an advert selling data recently stolen from a hospital in Dubai. When I'm asked what a patient can do to prevent that theft, the answer is a hard one: unfortunately, nothing. The guarantor of that data is whoever holds it, hospitals, clinics and health systems, and as end users we depend on what they do with our information.

Data protection in critical sectors →

Twenty-five years after the 'I love you' virus, which spread by email to millions of computers in May 2000, I recall on laSexta that IT security was then in its infancy and in many countries was not even regulated by law. Today the picture is very different: cybercrime now moves more money than drug trafficking and arms trafficking combined.

Cybersecurity risk →

On La Hora de La 1, the day after Spain's blackout, I explain that not enough time had passed to know what happened and that we had to follow the technical channels. I describe how an intrusion into an industrial system is investigated: the affected company's teams, helped by law enforcement in advanced cases, contain the attack, clean the network and restore it through public-private collaboration. I warn that attributing an attack is always complex and that many people take advantage of the confusion, and I recall precedents such as the 2010 attack on nuclear facilities and the 2016 attack on Ukraine's power companies.

Critical infrastructure and cyber risk →

It all started with some friendly rivalry with my colleague Roberto Fernández, whom I know from the bug bounty world: who would be first to find a flaw on NASA's website. Two weeks later we had both done it, a vulnerability that allowed NASA employees' credentials to be stolen and access gained to private systems and information, so a technical draw, and the agency recognised us with a letter. On my wall, instead of diplomas, hang the acknowledgements from Google, Facebook, Twitter and the US Department of Defense, plus the Dutch government's T-shirt, and I encourage young people to get into bug bounty to gain experience and build their CV.

Ethical hacking and bug bounty →

In this Informativos Telecinco piece on the facial-recognition boarding that Vueling is rolling out at airports such as Barcelona and Madrid, I explain how biometrics works: the algorithms look for the features that set your face apart, so your face becomes like your ID card, because there's no other one like it. And I point out that in Spain we're lucky to have the Spanish Data Protection Agency, which ensures personal data isn't misused.

Privacy and biometric data →

On TVG's A Revista I start with a clarification: those who attack companies are not hackers but cybercriminals, mafias that also traffic weapons or drugs, and cybercrime already makes more money than drug trafficking. I mention the intrusion at Spain's General Council of the Judiciary and one at a clinical system in Catalonia, explain the fake boss scam demanding an urgent, secret transfer, and recount how a Tesla employee was offered a million dollars to plug a USB stick into its network. To protect themselves, companies must first look inward and have a head of cybersecurity, a role I doubt even 10 or 15 people hold in Galicia, and if they lack the maturity to have one in house, turn to Galicia's cybersecurity SMEs.

Cybersecurity for businesses →

On Radio Galega's Galicia por diante I explain what Pegasus is: spyware from an Israeli company, NSO Group, sold to states and police forces, which in its newest versions gets into a phone with no interaction from the user, for instance just by receiving a video on WhatsApp, and gives access to the microphone, camera, documents and location. It relies on exploits only they know about, which is why my advice is to always keep the system and apps up to date, and anyone with suspicions can check using Amnesty International's toolkit, which investigated the case with Citizen Lab. I give figures such as 500,000 euros to sign up for the service and another 650,000 for ten attempts, I recall Hacking Team, whose client list published by WikiLeaks included Spain's CNI, and I repeat that we have been in a kind of cyber cold war for years.

Geopolitical risk and cyber espionage →

On TVG's Bos Días I talk about Ciber.gal, the cybersecurity gathering held on 10 and 11 November at the Cidade da Cultura in Santiago, aimed at businesses, public administration and citizens. I argue that the awareness companies already promote has to become everyday cyber hygiene: don't reuse passwords, because when one service's passwords leak the crooks try them everywhere, rely on tools that generate long passwords, and switch on two-factor authentication. And above all, common sense: many scams are the old ones, like the classic confidence trick, brought into the digital world with cryptocurrencies that promise to make you a millionaire; when in doubt, ask your trusted IT person.

Cybersecurity outreach →

On Radio Galega's Galicia por diante fin de semana, following DarkSide's cyberattack on the major pipeline on the US east coast, for which a ransom of almost five million dollars was paid, I explain that those behind it are not hackers but mafias coming from human trafficking or drug dealing, and how data ransom has evolved: first encrypting, then threatening to publish and now extorting customers and suppliers. I explain that targeted attackers have their own market research department, go after the companies with the highest turnover, profile their employees and, if they cannot get in, jump across from suppliers, and I recommend a password used only for work and two-factor authentication. I argue that we have been in a kind of cyber cold war for some years, with Russia, China, the United States and North Korea constantly attacking each other, and that Spain is targeted to destabilise it with fake news and attacks on ministries.

Geopolitical risk and ransomware →