The Prison Kiosk Was Built for Untrusted Users. It Still Reached Government Data.
Prison terminals were deployed for people the system was explicitly expected not to trust. Investigators are now examining how three inmates used that environment to reach shared government folders containing personal and operational data.
The exposure appears broader than first reported
Three inmates at Puig de les Basses prison in Figueres have been identified in an investigation into unauthorised access from touchscreen terminals used for video calls. The Catalan government has said the investigation is continuing, while UGT has described findings that go beyond the narrower initial account of the incident.
According to information reported by El País from government and union briefings, the inmates reached 12 folders containing about 26,000 documents. Two shared folders were copied onto a computer available inside the prison. Reported material includes prison staff names, national identity numbers and email addresses, vehicle registrations, lists associated with electronic-signing cards, corporate telephone numbers and volunteer information.
Those figures should be treated as current investigative findings, not a final incident report. The Department of Justice says the number of affected people is still being established. It also says there is no indication that the information left the prison computer, but it does not yet know whether that occurred.
Untrusted users were part of the design assumption
The Generalitat’s Viu en digital programme gives inmates access to computers and interactive kiosks for video calls, training, approved communication and administrative tasks. The programme expanded to all Catalan prisons and juvenile justice centres in 2025, with 1,078 desktop computers and 576 kiosks across the estate.
That public-service goal is legitimate. Digital access can support family contact, education and reintegration. The security model, however, has to begin with the assumption that a local user may probe the terminal, escape the intended workflow or exploit any path exposed by the surrounding network.
This was not an employee laptop unexpectedly used by a hostile person. The endpoint was intended for restricted users from the beginning. If it could reach general departmental shares, the weakness was not merely a user-interface problem. It was a trust-boundary failure.
A restricted interface is not network segmentation
Kiosk mode can hide the operating system, limit applications and constrain navigation. Those controls reduce routine misuse, but they should not be the only barrier protecting sensitive systems. A user who breaks out of the intended interface should still encounter an endpoint with almost nothing useful to reach.
Shared drives are especially dangerous in that model. They often accumulate old documents, broad group permissions and data from adjacent departments. A terminal may need one tightly defined service, yet inherit access to a much wider network because routing and identity controls were built for convenience.
Design the environment for a successful kiosk escape
Operators of prison, hospital, school and public-access terminals should assume the local restriction will eventually fail. Controls should include:
- A dedicated network segment with default-deny routing and an allowlist of required services.
- Separate device and user identities that have no general access to departmental file shares.
- Application-layer gateways for approved functions instead of direct access to internal networks.
- No reusable administrative credentials, cached secrets or broadly trusted certificates on the endpoint.
- File-share reviews that remove inherited access and stale personal data.
- Monitoring for shell access, unexpected processes, removable media, network discovery and bulk file reads.
- Rapid reimaging and evidence-preservation procedures for terminals that behave unexpectedly.
The investigation also needs to establish which identity accessed the folders, whether files were modified, whether external media or unauthorised connectivity was available, and how long the access path existed. The absence of confirmed external exfiltration does not reduce the need to notify affected people once the scope is known.
The lesson extends beyond prisons
Any kiosk deployed in front of an untrusted user should be treated as a potentially hostile device attached to a narrowly defined service. The interface can improve safety and usability, but the network must remain secure when the interface fails.
Puig de les Basses is therefore not only a story about inmates finding a technical weakness. It is a test of whether the architecture reflected its stated operating model. A system built for untrusted users should never have relied on those users remaining inside the intended screen.
