Sweden scrambles to tighten data security as scandal claims two ministers
Sweden’s government has sought urgent assurances on data security from national agencies including the health, education and pensions services after a huge leak of private and sensitive information that has cost two ministers their jobs.
Amid reports by the Dagens Nyheter newspaper that confidential medical details were being handled by unscreened IT workers in Romania, the national broadcaster SVT said data outsourcing arrangements at six state agencies were being checked.
The checks follow a cabinet reshuffle last week in which interior minister Anders Ygeman and infrastructure minister Anna Johansson both stepped down after what the prime minister, Stefan Löfven, called an “extremely serious” security breach.
Several ministers had known about the breach, which followed a botched 2015 data outsourcing contract between the national transport agency and IBM Sweden, for at least 18 months but failed to inform the prime minister, media reported.
The former head of the agency, Maria Ågren, was fired in January and fined after security police found she had waived security clearance requirements for foreign IT workers when signing the agreement, in breach of privacy and data protection laws.
One transport agency official told police the data that IT workers in the Czech Republic, Serbia and Romania were processing without security clearance under the agreement was equivalent to “the keys to the kingdom”, Dagens Nyheter said.
Besides the entire national driver’s licence database, the records potentially included information on intelligence agents, military and police transport and personnel, people with criminal records and those in witness protection programmes, Swedish media have reported.
The Swedish military confirmed that details of its staff, vehicles, and defence and contingency planning could have been included in the breach, although the transport agency insisted it held no military data and there was no indication that any of the data had been “spread in an improper way”.
Although there is no evidence of actual harm being caused, Löfven said the incident was a “disaster” that had “exposed both Sweden and Swedish citizens to risks”. IBM Sweden has consistently said it does not discuss its dealings with clients.
But after opposition parties threatened the coalition with a vote of no confidence, Löfven promised to “take responsibility” and stay on at the head of his minority left-green government rather than call snap elections.
“I have no intention of plunging Sweden into political crisis,” the prime minister said, adding the country faced “formidable challenges” including Brexit, mounting tensions in the Baltic region and much-needed economic and social reforms. Sweden’s next general election is due in 2018.
Löfven resisted calls for the resignation of defence minister Peter Hultqvist, who has admitted knowing of the scandal since 2016, noting that he was not responsible for the transport agency and the army took protective steps early on.
Swedish IT experts told SVT the incident showed the government’s ignorance of how state agencies handle confidential and sensitive information. “This really shows their low level of expertise on how IT security is handled by the authorities,” said one consultant, Lars Mårelius.
Another, Anne-Marie Eklund Löwinder of the Internet Foundation, said agencies that handle citizens’ data should be subject to strict transparency and reporting requirements on all their data protection measures.