Thursday, November 20, 2014

Catholic sexual abuse finally gets investigated in Spain

Given how the Catholic church has sexually abused kids at a massive scale in just about every country in the world, it was always surprising to me that Spain hasn’t yet joined this list.

Given the history of corrupt practices of the Catholic church in Spain, my guess this has more to do with better cover-ups than anything else.

A group of pedophile priests is finally being investigated by a judge Granada, which seems to have finally moved the church to actually do something.

Maybe the church can bring back excommunication and burning-at-the-stake, and then perhaps I’d take their efforts seriously.

Monday, November 17, 2014

IdCAT: an insecure digital certificate for foreigner in living Catalunya

More and more government services in Spain ask for a electronic DNI in order to authenticate access to services or sign documents. As a foreigner, you obviously don’t have a DNI, and even the residency cards don’t have chips.

Luckily the Catalans have a solution for this called idCAT. It not only works for Catalan stuff, but also with Agencia Tributaria and Seguridad Social.

I tried getting one today and it was actually quite easy:

  1. Go to and fill in the requested information (sol·licitud)
  2. Don’t be surprised if you don’t get a receipt or anything, the information is in there somewhere.
  3. Go to one of the municipal government offices listed with together with your passport/ID and NIE certificate.
  4. You give them a four digit PIN
  5. They will print out a piece of paper
  6. Go home and use the information on paper to download the certificate onto your computer

What no smartcard? If you are worried about security at this point, you should be. By default the private key for your certificate gets installed on your computer without any protection whatsoever. Anyone can copy this key off your computer and use it to impersonate you without you even knowing.

Allegedly you can revoke your key, but keep in mind that the infrastructure for revoking digital certificates has always been a bit broken, and I wouldn’t be surprised if half the sites that accept them don’t check for revocation.

If you want to be a bit more secure, what I would do is:

  1. Run “Manage User Certificates”
  2. Click on “Personal”, “Certificates”
  3. Right click on the certificate with your name on it issued by “EC-IDCat”
  4. Click “All tasks”/“Export…”
  5. Say “Yes export private key”
  6. Select “.PFX”
  7. Select all the options (include certificates, delete private key, export all extended properties)
  8. Save it on a file and give it a secure password
  9. Re-import with “All tasks”/”Import”
  10. Disable export, and keep the password as “high security”

Now whenever you hit a site that wants the certificate, it will also ask you for your password. This isn’t totally secure, since the web browser still loads the private key at some point. The best solution would be to load the key onto a smartcard, but I haven’t gotten around to figuring that out.

PP caught cheating at its own “honor test”

Our friend Esperanza Aguirre organized a bizarre show trial in Madrid of the mayoral candidates in which all candidates were unsurprisingly found to be innocent of corruption.

Now it turns out that not only was the event organized by Jorge Rabago, implicated in the “black card” scandal at Caja Madrid, but now it turns out that the whole thing was staged, and the answers had been rehearsed beforehand. It took a couple takes for newly selected Valdemoro mayor David Conde to come up with a reasonable sounding answer to whether he had any Swiss bank accounts and why he had invited (recently indicted) Francisco Granados to his wedding.

The mayor initially denied that he had been coached beforehand, but later admitted it after the organizer confessed.

Supposedly this whole thing was based on some weird impression that Aguirre had about US congressional hearings.

Wednesday, November 12, 2014

Lesson from LuxLeaks: don’t sign tax treaties with tax havens

The outrage against Luxemburg for their tax antics leaves out one important factor: the degree to which anything done in Luxemburg affects tax collections in Spain is purely determined by Spain’s willingness to recognize them.

A simplified explanation of how this works:

Company imports widget into Spain and sell it 100 euros. Actual cost to produce/sell/market/transport said widget is 50 euros. If the company were completely honest, it would have to pay taxes on the profit of 50 euros in Spain.

Why Luxemburg is useful here is basically to inflate the cost of the product, by paying essentially fictitious interest, royalties etc to a Luxemburg company and then deducting these costs from profits in Spain.

This only works because Spain and Luxemburg have a tax treaty that recognizes costs and taxes paid in one country against the taxes to pay in another. It does require a certain level of honesty from the partner country.

The key piece that is missing to make this work is exchange of information. If Spain does not know the overall picture of all the subsidiaries in all countries, then it is impossible to know if a company is complying with even existing tax rules. This is why the fact that these tax deals in Luxemburg were secret is such a big deal.

One alternative would be to say: “Fine, you can only get relief from double taxation if you provide a complete picture of your corporate matrix”.

Of course, this only works if a large enough set of countries all agree, which Luxemburg, Holland and Ireland have been sabotaging at every opportunity.

Why the rush for unilateral Catalan independence?

Given that the elections of 2015 are just around the corner, that PP is going to lose horribly, and that a Podemos/PSOE government would be at least somewhat supportive of the right for a referendum, why the big rush to do something crazy now?

The Catalan independence movement has the idea that Spain = PP, but if that isn’t true, is it worth doing something crazy now, or wait until there is a real negotiating partner in power?

Perhaps this is more about ERC seeing its chance for a power-grab, since they are never going to win an election based on its policies, but perhaps they see a chance to win on independence, and without the PP in Madrid, the lack of an effective bogeyman would make things much more difficult…

Monday, November 10, 2014

Confidence gap comparing Spain and the US

From Cassandra Does Tokyo:

Workers at the Spanish plant had a reasonably low opinion of their work, which was at odds with the high quality of their efforts evidenced by a low defect rate. This was an interesting result - probably one there company would prefer to keep hidden from their Spanish workers. 

At the American plant, survey results showed workers had a very high opinion of the quality of their work, completely at odds with the relatively high objective defect rates of the output of the plant.

This is especially obvious if you go to any tech startup presentation in Barcelona. Instead of telling us why we should invest in your startup, the presentations sound more like “why my startup sucks and is unlikely to succeed”.

Maybe it’s a wider social problem… it seems to me like the only socially acceptable thing to be amazing at in Spain is soccer. Anything else you need to keep it to yourself, lest people think you are too good and should be brought down a couple pegs.

Sunday, October 26, 2014

Will the stress tests be another European own-goal?

European regulators can’t seem to make up its mind what to do about its zombie banks. Should we be honest about how deep in shit they are, bail in the creditors and get on with life? Or should we just lie and how that the banks can somehow magically raise equity and fix things themselves (or at least be someone else’s problem)?

Perhaps part of the conundrum is that the politicians want to win the next election (being Europe, there are important elections all the time, especially in Germany) and thus want to keep the status quo. Newly (unelected) ECB regulators probably want things to get fixed sooner rather than later, so better put out the dirty laundry now before they can get blamed for it.

The problem with the semi-honest approach is that it has all the downsides of a real stress test, but none of the upsides of just covering things up.

Once you separate the weak banks from the herd, the wolves will be out and governments will be forced to bail them out. Essentially information from ECB gives a playbook to hedge fund to get this process started.

Then we’re back to 2012, and everyone will be shocked that no one bothered to fix anything when we had the chance.