Worst known governmental leak ever is slowly coming to light: Agency moved nation’s secret data to “The Cloud”

Posted on Jul 21, 2017 by Rick Falkvinge

Sweden’s Transport Agency moved all of its data to “the cloud”, apparently unaware that there is no cloud, only somebody else’s computer. In doing so, it exposed and leaked every conceivable top secret database: fighter pilots, SEAL team operators, police suspects, people under witness relocation. Names, photos, and home addresses: the list is just getting started. The responsible director has been found guilty in criminal court of the whole affair, and sentenced to the harshest sentence ever seen in Swedish government: she was docked half a month’s paycheck.

Many governments have had partial leaks in terms of method (Snowden) or relations (Manning) lately, but this is the first time I’m aware that the full treasure chest of every single top-secret governmental individual with photo, name, and home address has leaked. It goes to show, again, that governments can’t even keep their most secret data under wraps — so any governmental assurances to keep your data safe have as much value as a truckload of dead rats in a tampon factory.

It started out with a very speedy trial where a Director General in Sweden was fined half a month’s pay. Given how much the establishment has got each other’s backs, this sentence was roughly equivalent to life in prison for a common person on the street, meaning they must have done something really awful to get not just a guilty verdict, but actually be fined half a month’s salary.

On digging, it turns out the Swedish Transport Agency moved all its data to “the cloud”, as managed by IBM, two years ago. Something was found amiss when the Director General of the Transport Agency, Maria Ågren, was quickly retired from her position this January — but it was only on July 6 that it became known that she was found guilty of exposing classified information in a criminal court of law. The scandal quickly escalated from there.

There’s an enormous amount of data in Swedish about the overall leak scandal, but among all that data, one piece bears mentioning just to highlight the generally sloppy, negligent, and indeed criminal, attitude toward sensitive information:

Last March, the entire register of vehicles was sent to marketers subscribing to it. This is normal in itself, as the vehicle register is public information, and therefore subject to Freedom-of-Information excerpts. What was not normal were two things: first, that people in the witness protection program and similar programs were included in the register distributed outside the Agency, and second, when this fatal mistake was discovered, a new version without the sensitive identities was not distributed with instructions to destroy the old copy. Instead, the sensitive identities were pointed out and named in a second distribution with a request for all subscribers to remove these records themselves. This took place in open cleartext e-mail.

Take this incident and scale it up to everyday behavior at a whole agency with key responsibility for safeguarding national secrets.

At present, these databases are known to have been exposed, by moving them to “The Cloud” as if it were just a random buzzword:

The weight capacity of all roads and bridges (which is crucial for warfare, and says a lot about what roads are intended to be used as wartime airfields);

Names, photos, and home addresses of fighter pilots in the Air Force;

Names, photos, and home addresses of everybody and anybody in a police register, all of which are classified;

Names, photos, and home addresses of all operators in the military’s most secret units – equivalent to the SAS or SEAL teams;

Names, photos, and home addresses of everybody in a witness relocation program or who has been given protected identity for other reasons;

Type, model, weight, and any defects of any and all government and military vehicles, including their operator, which says a ton about the structure of military support units;

the list goes on.

All of this was not just outside the proper agencies, but outside the European Union, in the hands of people who had absolutely no security clearance. All of this data can be expected to have been permanently exposed.

Let’s be clear: if a common mortal had leaked this data through this kind of negligence, the penalty would be life in prison. But not when done by the government themselves. Half a month’s pay was the harshest conceivable sentence.

The leak is still ongoing (!!) and can be expected to be fixed “maybe this fall, perhaps”. Much of the available analysis of the leak is still in the form of fully-redacted documents from the Security Police and similar agencies.

Privacy really really really remains your own responsibility.

Also read the followup article with more, and worse, information: How the Swedish government leaked the secure EU Intranet to Russia, and tried glossing it over.

Comments are closed.

24 Comments

  1. OllieJones

    Their vendor was IBM. There MUST be a backstory about whether IBM had any influence on the technical missteps that led to the security breach.

    A large organization, such as a sovereign government, might choose to retain a well-known vendor with a deep technical bench in order to avoid the obvious missteps, and deep pockets to assume some liability for errors and omissions.

    Did the transport ministry just sign up for a “cloud” account online and pay with a visa card? Or did they work with the vendor to plan security and migration?

    Mr. Falkvinge, if you know anything about the vendor situation here I hope you will write another news story.

    In the meantime, maybe the government should engage Troy Hunt and/or Bruce Schneier to educate them on threat assessment, mitigation, and incident response.

    (I’ve worked in health care IT in the US, and I would expect a stiff fine and a jail term if I were responsible for such leaks.)

    7 years ago
    1. Wayne

      The IBM of today is sadly not the storied IBM of yesteryear. They are now more than capable of screwups like this. Whenever management talks about putting information “in the cloud”, I argue vociferously against it, and I pretty much invariably lose.

      One of my favorite IBM stories was my community college where I first started studying computer programming in the ’70s. They approached numerous computer vendors with requests for information to buy systems. Every vendor sent them information about their systems. IBM sent them the full set of OS manuals for JCL and COBOL, some 5′ of shelf space. While they ended up buying a Hitachi clone for the hardware, they bought the IBM software and printers.

      Data like this should never have been hosted outside. But this is what happens when “do more with less” becomes the ruling mantra.

      7 years ago
  2. AngryNotSoOldHippy .

    Ha! Another dumbfuck agency which does not understand what “the cloud” means managed to release information on every person under witness protection status to “just anybody,” including information held in “the cloud” generated by Sweden’s military and intelligence agencies.

    Woops! But to make matters worse, the dumbfucks did not recall the first release containing secrets, instead they issued a request that people delete the “following list of inadvertently released information” then went on to LIST THE SECRET INFORMATION AGAIN! that they wanted people to delete.

    Derp!

    7 years ago