National Intelligence Centre: Spain’s Intelligence Service

1.0 Introduction 

The National Intelligence Centre (in Spanish: Centro Nacional de Inteligencia or CNI), known colloquially as “La Casa” (The House), is Spain’s main foreign and domestic intelligence service. CNI was created in 2002 as the successor to the Centro Superior de Información de la Defensa (CESID), Spain’s prior intelligence agency. 

The CNI is integrated into the Ministry of Defence as a public body with functional autonomy.  It has legal personhood and full capacity to act. CNI is also a “top advisor” to the Spanish Government in matters of national security and intelligence.

The CNI collaborates with Spain’s other intelligence agencies, including the Armed Forces Intelligence Centre (military intelligence) and the Intelligence Center for Counter-Terrorism and Organized Crime or CITCO (Ministry of the Interior). It also collaborates with foreign intelligence counterparts to address transnational threats and contribute to global security efforts. This includes working with the EU Intelligence and Situation Centre (EU INTCEN).

In this article, we analyse the history, functions, structure and key operations of the CNI.

2.0 History 

2.1 Origins

The Government of the Second Republic created Spain’s first intelligence service in 1935 when it considered the advisability of setting up an Information Service under the Ministry of War. The life of this Service was very short and its activity practically non-existent, as the outbreak of the Spanish Civil War (1936-1939) put an end to this first experience. 

During the civil war, both sides organised intelligence services. This resulted in the creation of a multitude of information bodies that attempted to fulfil their missions independently. In the years that followed, there were as many as eight different Information Services in Spain, with poorly defined roles and frequent duplication of effort. Some of these services, which were mainly concerned with domestic intelligence, were:

• The Movement Information Service was responsible for political information throughout Spain.
• The Information Service of the General Directorate of Security, dealt with the investigation of so-called political-social crimes, in collaboration with the Information Service of the Guardia Civil.
• The Information Services of the Army, Navy and Air Force, were attached to the second sections (Intelligence) of their respective headquarters.
• The Foreign Intelligence and Counterintelligence Services, attached to the Third Section (Operations) of the High General Staff.
  
  (Source)

2.2 Intelligence under Franco and Transition

During the Franco dictatorship, the 1968 National Counter-Subversive Organization (OCN) laid the groundwork for the current CNI. The organization actively operated within the university environment and served as the foundation for the establishment of the Central Documentation Service (SECED) in 1972. The Ministry of the Presidency governed SECED, which primarily focused on “counter-subversion” – the neutralization of those opposing the Francoist regime in various ways. Additionally, it concentrated on counter-terrorism, largely driven by ETA at the time. SECED was active until the arrival of the Transition to democracy in 1977.

In June 1977, Spain held democratic elections in what the country called the “Transition”. In July 1977, President Adolfo Suárez and Vice-President for Defence Affairs, Manuel Gutiérrez Mellado, dissolved the previous bodies and created the Defence Information Centre (CESID). The new democratic Government created CESID through the merger of SECED, the Third Information Section of the High General Staff (SIAEM), and later on the Information Service of the Presidency of the Government (SIPG). With its creation, Spain was on par with other Western countries, which already had institutions with similar characteristics.

(Source), (source), (source), (source), (source)

2.2 CESID

In the early years, the CESID mission was to serve the Joint Chiefs of Staff (JUJEM). CESID was hierarchically and administratively dependent on the Ministry of Defence. The Royal Decree of January 1984 legally defined CESID as the intelligence agency that reported to the Presidency of the Government and the Minister of Defence. However, it retained a fundamentally military character. It employed between 2,000 and 3,000 people, mostly military personnel and members of the Guardia Civil. About 30 per cent of the staff were civilians.

The main operational units of the CESID were Internal Intelligence, External Intelligence and Technical Intelligence. However, there are two stages, from 1971 to 1982, and from 1983 to 2002. In the first stage, its activities focused on internal intelligence, especially within the army, to prevent military actions that could endanger the democratic transition process. The service called this “involutionism”, that is, attempts by elements of the military to return to the old regime. During the second stage, from 1982 onwards, CESID developed its counter-terrorism area, especially against ETA terrorism, and its counter-intelligence. CESID strengthened its institutional relations with other intelligence services, achieving permanent cooperation in a world still dominated by the Cold War.

The Service’s attention focused mainly on Mediterranean stability, transforming it into one of the best intelligence specialists in the Middle East and North Africa (MENA). As a result, there was a quantitative and qualitative leap in the interest and resources of the Foreign Intelligence Division.

The Government eliminated CESID in 2002 and replaced it with the current National Intelligence Centre (CNI).

(Source), (source), (source)

2.3 The CNI Today

In 2001, the Popular Party government sought consensus with other political groups represented in the Congress of Deputies, in particular with the Spanish Socialist Workers’ Party, to regulate the intelligence services in Spain. The aim was to reach the broadest possible agreement on the existence, organisation, and function of Spain’s security institutions to prevent politicisation. 

In 2002, the Government enacted the present legal framework for the National Intelligence Centre (CNI), giving it a new name that emphasized the CNI’s mission. Later, in March 2004, a royal decree established the National Cryptologic Centre (CCN), a body attached to the CNI for the security of information technologies and classified information.

In 2011, PM Mariano Rajoy undertook a ministerial reform, moving the CNI under the Ministry of the Presidency. Following the change of government in 2018, President Pedro Sánchez re-attached it to the Ministry of Defence.

(Source), (source)

3.0 Organisation

The CNI is headed by the National Intelligence and Counterintelligence Authority, or director of the CNI, officially called the Secretary of State Director of the CNI (SED). The SED reports to the President of the Government and is attached to the Ministry of Defence (source). The SED is appointed by Royal Decree and has been held by Esperanza Casteleiro Llamazares since 2022 (source). The term of office of the director of the CNI is for five years. Under the SED is the General Secretariat, which is headed by a Secretary General and reports directly to the Director. The position is currently held by Arturo Relanzón Sánchez-Gabriel since 2020 (source).

The SED has several support bodies:

• Cabinet of the Secretary of State Director. 
• Technical Office of the Secretary of State Director.
• Legal Adviser’s Office.
• Office of Prior Judicial Control.
• Prospective Centre.

The SED is also supported by the General Secretariat. The Secretary-General controls the Security Service and the three technical directorates.

3.1 Directorates

The CNI consists of three technical directorates under the General Secretariat: 

• Technical Directorate of Intelligence. This is further divided into five sub-directorates:
  • Foreign Intelligence Sub-Directorate.
  • Counterintelligence Sub-Directorate.
  • Counter-Terrorism Sub-Directorate.
  • Technical Sub-Directorate.
  • Operational Support Sub-Directorate.
• Technical Directorate of Resources. It is divided into four sections:
  • Administration.
  • Services.
  • Personnel management.
  • Training School.
• Technical Support Directorate. It is divided into two sections:
  • Operations Sub-Directorate.
  • Logistics Sub-Directorate.

(Source), (source)

3.2 Dependent Bodies

The CNI is also made up of three dependent bodies: 

• National Security Office (ONS).
• Office of Intelligence and Counterintelligence (ONIC).
• National Cryptologic Centre (CCN).

3.2.1 ONS

Created in 1983, the National Security Office (ONS) is in charge of compliance with the regulations on the protection of classified information, whether it is the CNI’s own or that which is handed over to the Administration or companies. In addition, ONS represents Spain, on behalf of the Delegated Authority, in the NATO, EU and ESA Classified Information security committees and the various international classified programmes. It reports directly to the Secretary of State Director (source).

3.2.2 ONIC

Created in 2022, the National Office of Intelligence and Counterintelligence (ONIC) is a support agency to the director of the CNI and acts as the national authority on intelligence and counterintelligence. The ONIC’s responsibility is to maintain and develop collaboration with the intelligence services of the State Security Forces and Corps and the bodies of the civil and military administration. The ONIC’s leadership consists of the director of the CNI (Secretary) and the heads of the General Intelligence Commissariat and the Guardia Civil’s Intelligence Service, who have the rank of under-secretary (source). 

3.2.3 CCN

Created in 2004, the National Cryptologic Centre (CCN) is responsible for guaranteeing the security of the information and communications systems (ANS-D) of the Public Administrations and those that process, store or transmit classified information. It reports directly to the SED (source).

There are two integrated entities within the CCN:

• The Certification Body (OC) of the National Scheme for the Evaluation and Certification of Information Technology Security (ENECSTI).
• The National Cryptologic Centre Computer Emergency Response Team (CCN-CERT).

3.3 Recruitment 

3.3.1 Requirements 

To be able to participate in the selection processes of the National Intelligence Centre, applicants  must meet the following minimum requirements:

• Over 18 and Spanish citizenship. 
• Possess the qualifications required for the subgroup or group for which you are applying.
• Not have been dismissed from any of the Public Administrations, nor be disqualified from the exercise of public functions, nor deprived of the exercise of civil rights.
• Do not suffer from any illness or physical defect that disqualifies you from performing the duties of the post.
• Possess or be in a position to obtain a favourable safety report following the characteristics of the post to be occupied.

(Source), (source)

3.3.2 Selection

The selection processes to enter the CNI have a variable duration, depending on the position chosen. As a general rule, selection usually lasts between 3 and 6 months. The Selection Department contacts candidates whose CV fits the profiles they need. Then, they evaluate the candidates; personalities and competencies. In addition, they will have to pass a technical phase related to the job and at least one personal interview. Candidates also need to obtain a security clearance. For certain positions, candidates are required to pass psychophysical tests (source).

3.3.3 Specializations

Members of the institution have jobs that are classified according to their nature (source). These are:

• Intelligence: Dedicated to obtaining, processing and interpreting information. They are also responsible for detecting and preventing threats against Spain.
• Language: Language specialists are in charge of translating and interpreting the languages that are of information interest to the CNI.
• Information and Communication Technologies: In charge of administering and managing the security of the CNI’s computer systems, as well as ensuring their proper functioning.
• Operational: These include members specialised in obtaining information employing special means, procedures or techniques.
• Security: The members of this classification ensure the physical security of the facilities, materials, information and organisation members. Their function is to prevent and neutralise possible threats to the intelligence community and its members.
• Corporate Services: Jobs that cannot be classified under any of the above are found in this section.  These are specialists in the fields of infrastructure, law, administration, finance and health.

3.3.4 Connections to other important organisations

The CNI works closely with other agencies of the Spanish intelligence community. The main ones are the Armed Forces Intelligence Centre (CIFAS), the Centre for Intelligence against Terrorism and Organised Crime (CITCO), the intelligence agencies of the Guardia Civil and the National Police (Ministry of the Interior), as well as those of the autonomous police and the Tax Agency.

Through the National Security Office (ONS), the CNI collaborates with NATO, the EU and the European Space Agency. The CNI also has contacts with the various European intelligence services, as well as with other allied countries (source). For example, the CNI has a framework agreement between Germany, Spain, Italy, Sweden and the UK (EDIR/FA or LOI), and it is part of the Organisation for Joint Armament Cooperation (OCCAR) (source). The CNI also has bilateral agreements with more than 50 countries (source). The CNI also contributes to the EU Intelligence and Situation Centre (EU INTCEN).

4.0 Equipment 

CNI operatives are armed mostly with light weapons, even when deployed in hostile territory. This is because, when they are in hostile territory, CNI agents are usually accompanied by military operatives, mainly special operations. Some of the weapons they carry or have been seen carrying are CZ 75 and Glock 29 semi-automatic pistols of 9 mm calibre, HK 9 mm submachine guns, and AK  pattern rifles. 

Traditionally, CNI agents use civilian vehicles with little or no armour on low-risk missions. On dangerous missions, they usually travel in military vehicles.

(Source), (source)

5.0 Tactical-Operational Information 

5.1 Operations

The CNI has been deployed in conflicts within Spain, especially in the fight against ETA, and in international scenarios such as Bosnia, Iraq and Afghanistan. Given the classified nature of their missions, it is difficult to know where they are or have been deployed. Some cases are:

The Fight against ETA

The CNI and its predecessors have been highly involved in the fight against the terrorist group ETA. In 2008, the Civil Guard and the French gendarmerie were captured, in an operation orchestrated by the CNI, the leader of the military apparatus of ETA, Garikoitz Aspiazu Rubina, alias Txeroki. Using a complex computer system, the agency identified a large number of emails sent from a series of Internet cafes located in the south of France (source).

The Rescue of the Alakrana

Another important operation was the 2009 rescue of the Alakrana, a Spanish tuna boat hijacked in the waters of Somalia with 36 sailors on board, 16 of them Spanish. CNI agents participated in the negotiations and managed to return the entire crew safely to Spain (source).

Afghanistan

In 2002, Spain sent CNI agents to Afghanistan to assist its military personnel. In the first years, until 2005, the agents acted alone, but later they formed mixed teams with Special Operations soldiers. From 2005 to 2015, some 200 men and women of the CNI were in Afghanistan as part of fifty teams. The CNI deployed two operational teams in Qala i Now and Herat, a third team in Herat was dedicated to capturing satellite information and a fourth team served as liaison in Kabul. 

In 2011, CNI operatives obtained information that insurgent groups were going to launch rockets at the Qala i Now base. Knowing when the launch was going to be, they prevented it from causing personal injury among the Spanish troops (source).

Iraq

The CNI was deployed in Iraq to support the Spanish troops deployed there. The best-known moment there was the catastrophic “Latifiya ambush”. This was an attack with firearms and grenades perpetrated in 2003 by the Iraqi insurgency in Latifiya. The insurgents attacked a convoy transporting a group of eight CNI operatives. The agents were ambushed at a point on the highway near the town in the Baghdad governorate. Seven intelligence agents were killed and one was seriously injured, in what was the deadliest attack against the Spanish presence during the Iraq war.

(Source), (source), (source)

5.2 Controversies

The CNI has also been in the spotlight on several occasions due to malpractice.

WikiLeaks

In 2015, WikiLeaks revealed that the CNI purchased the surveillance software “Galileo RCS” from the Italian company Hacking Team. The CNI used this software to infect computers remotely in control operations and monitoring of suspects (source).

Pegasus

In 2022 it was revealed that the CNI had spied on at least 18 phones of Catalan separatist politicians. The CNI infected the devices of Catalan separatists with the help of Israeli spyware Pegasus. In May 2022, the head of the CNI, Paz Esteban López, was dismissed due to this (source).

Foreign Espionage Against the CNI

The CNI has had two important cases of foreign espionage targeting its information. The first was the case of Roberto Flórez. In 2010, Agent Flores was charged with treason for having provided classified and top-secret information to Russia. The CNI found numerous classified service documents in his house, which he was suspected of selling to Russia’s Foreign Intelligence Service (SVR) (source).

In December 2023, authorities arrested two CNI agents, accusing them of leaking classified information to the United States’ intelligence agencies. A few months before it was detected that these agents had accessed files for which they did not have permission. The CNI considers their capture a “success” as it shows that the routine checks on CNI staff following the Flores case are working (source). This event has somewhat strained intelligence relations between the two countries, with Spain having already expelled three American spies from the country and requested the departure of a fourth (source).

5.3 Core Purpose 

Overall, the CNI is responsible for providing the President of the Government and the Government with information, analysis, studies or proposals that allow the prevention and avoidance of any danger, threat or aggression against the independence or territorial integrity of Spain, national interests and the stability of the rule of law and its institutions (source).

More specifically, the CNI is entrusted with the following functions (source):

• Obtain, evaluate and interpret information and disseminate the Intelligence necessary to protect and promote the interests of Spain.
• Prevent, detect and enable the neutralisation of the activities of foreign services, groups or people that put at risk, threaten or attack national interests.
• Promote relations of cooperation and collaboration with other Intelligence Services.
• Obtain, evaluate and interpret traffic signals of a strategic nature.
• Coordinate the action of Administration bodies that use encryption means or procedures, guaranteeing the security of information technologies.
• Ensure compliance with regulations relating to the protection of classified information.
• Guarantee the security and protection of its facilities, information and material and personal means.

The CNI works based on objectives “defined by the Government and approved annually by the Council of Ministers.” These goals are reflected in the Intelligence Directive, a secret document that the Executive must approve each year (source).

5.4 Tactics 

The CNI’s tactics are secretive, but its participation in Iraq and Afghanistan sheds some light on how they act abroad. In Baghdad, the CNI deployed “antennas”, that is, infiltrated teams to obtain information. The CNI agents deployed were from the Operational Support Division (DAO), the elite of the service. The strategy consisted mainly of setting up safe houses, going unnoticed and then introducing themselves into Iraqi society to capture information. 

In Afghanistan, agents also had to identify “key people”, that is, useful locals. They also had to detect threats against Spanish and allied troops like the attacks against the Qala i Now base. The agents often used Afghan clothes and grew long beards to camouflage among the locals.

After Iraq and the Latifiya attack, the CNI modified its protocols and in missions abroad, the agents worked in joint teams with the Army, specifically the GOE. That is, it was the Special Operations military who guaranteed their safety. This was the case until 2013 when the CNI was taken over by the CIFAS (Intelligence Center of the Armed Forces), which started deploying its men in the conflict zones where Spain operates.

(Source), (source)

5.4.1 Intelligence Gathering

The CNI obtains information in four ways: 

• Human sources (HUMINT).
• Technical sources (SIGINT).
• Images and geographic information (GEOINT).
• Open sources (OSINT). 

Agents must comply with a Code of Ethics that establishes in its fifth article their “duty of confidentiality”, among other obligations (source).

5.5 Personnel Size and Budget

The CNI currently employs around 3,000 professionals (source). About 76% come from the civilian world, 18 % from the Armed Forces and 6% from the State Security Forces (source). The annual budget of the CNI is €337.1 million as of 2023 (source).

6.0 The Future

The CNI has proven to be an effective and necessary intelligence service for the internal and external security of Spain. The CNI is an organisation highly prepared in the anti-terrorist fight given its experience first against ETA and later jihadism. Its modernization and internalisation process of past decades has managed to create and establish a modern and efficient intelligence service capable of neutralising a wide variety of dangers. This is due to his experience and lessons learned in Afghanistan and especially Iraq. This is added to the close collaboration between allied agencies and their participation in organisations such as NATO and the EU. The CNI will continue to be a flexible agency, capable of adapting to new challenges, including the cyber world.

However, the CNI faces several problems, especially domestically. The growing political instability in Spain has created an atmosphere of concern in the CNI for its future. The different political parties do not agree on which Ministry belongs, whether to the Presidency or Defense. There also does not seem to be a fixed long-term strategy, at a time of tension due to the situation in Ukraine and the Sahel (source). This creates doubts at a time of internal restructuring. The CNI is reorganising its structure, just as other Intelligence Services of allied countries are doing (source). The change of Directors and the latest controversies do not help the service either.

Therefore, the future of the CNI is unclear. While the agency will continue to fight effectively against terrorism and foreign interference, it is unlikely that, due to political instability, it will have a stable long-term strategy.

7.0 Conclusion

The CNI has proven to be an effective, flexible and necessary intelligence service for the internal and external security of Spain. The CNI is an agency highly prepared for the fight against terrorism as well as counterintelligence. Its modernization and internalisation have managed to create and establish a modern and efficient intelligence service capable of neutralising a wide variety of dangers. Although the CNI is experiencing a time of instability and uncertainty, it will likely continue at the forefront of the fight against crime and foreign interference. The CNI has demonstrated for decades its competence and adaptability in all types of scenarios, as well as its resilience and power to neutralise Spain’s enemies. It is therefore very likely that successive Spanish Governments will continue to attribute great powers and responsibilities to it.