Prime Minister: Transport Agency data breach is a "train wreck"

The Transport Agency data breach scandal continues. More details have emerged concerning what kind of classified data was released. Opposition parties have condemned the government and Prime Minister Stefan Löfven has branded the situation a "train wreck".

"There has been a train wreck at the Transport Agency. This is why the government has replaced the people in charge and ensured that the authorities have taken measures to limit the extent of the damages," Lövfen wrote.

Last week, the Swedish Security Services released a report with the preliminary findings on the case.

One interviewee explained that there is a lot of data which should be protected in the IT system, such as driver's license photos and administration logs.

There are also details about armoured vehicles as well as "huge amounts" of company secrets in the systems.

This same person said that there has only been a minimal interest in data protection at the Transport Agency and that people in senior positions lack basic knowledge about protective security.

When the protective security deals took a long time to draw up, the Agency chose to outsource the IT systems oversight without waiting for security clearances to be approved. 

The contract was with IBM Sweden, which had moved some servers to IBM in the Czech Republic. IBM has also subcontracted to another company in Serbia to operate communications networks and firewalls.

On Friday, Swedish newspaper Dagens Nyheter revealed that staffers without security clearances gained access to details about criminal records, criminal suspects, and an encrypted communications system used by thirty Swedish authorities to transmit private information.

In making classified information available to outsourced companies without safety clearances, the Transport Agency violated its own guidelines as well as the Personal Data Act, the Public Access to Information and Secrecy Act, and the Protective Security Act.

These violations were internally noted at the Transport Agency in June 2015. The board was informed of the violations in August but failed to take any action.

Maria Ågren, the then director general of the Agency, left her job in 2017. Last month, she was received a fine of 70,000 SEK for releasing information that could threaten Sweden's national security.

Last week, Sweden's infrastructure minister, Anna Johansson, announced that the president of the Agency would be stepping down.

After the scandal, no opposition party has ruled out tabling a motion of no confidence towards one or more ministers.

Minister for Home Affairs Anders Ygeman has been criticised for not acting on information he received last January confirming that the Swedish Security Services were investigating this case.

Yesterday, Sweden’s infrastructure minister Anna Johansson, who is ultimately responsible for the Transport Agency, told Swedish news agency TT that her secretary was informed about the situation three times last spring, but that this information was not made available to her.

Today, details emerged finding that the defence minister Peter Hultqvist was also previously aware of the Transport Agency's failings.

This afternoon, Stefan Löfven will hold a press conference to provide information to the public on the scandal, together with:

  • Jonas Bjelfvenstam, the new director general of the Transport Agency
  • Anders Thornberg, the director general of the Swedish Security Services
  • Micael Bydén, the Supreme Commander of the Swedish Armed Forces