10 ms·

Sweden Leaks the Personal Information of Millions of Its Own Citizens

175 points by brainpool 9y ago

ngneer 9y ago
This has happened in Israel in the past :(
- yuvadam 9y ago
  Correct, the entire Israeli census database has leaked and is now freely available for anyone who knows where to look for it. I gave a short talk about this leak at 28c3 [1], if anyone's interested in more details. [1] - https://www.youtube.com/watch?v=ow7cvZOzp6w https://www.youtube.com/watch?v=ow7cvZOzp6w
  - terminalcommand 9y ago
    Similar census leaks occured in Turkey and Mexico as far as I can remember. But this leak has classified info such as witness protection data.
  - mderazon 9y ago
    It's outrageous that the data was leaked over such a long period so many times. The new biometric law is just laughing in the face of the citizens.
  - pbhjpbhj 9y ago
    Aren't censuses usually published?
    - ngneer 9y ago
      This one had addresses, phone numbers and dates of birth.
jeremynixon 9y ago
> “Any governmental assurances to keep your data safe have as much value as a truckload of dead rats in a tampon factory.” Remember this. I expect every piece of data given out to the government or to private organizations to sit in the databases of every major intelligence agency, and will not be surprise if it's all exposed to the public domain through data aggregation companies in near future.
- HillaryBriss 9y ago
  also an aspect of a single-payer healthcare plan? i don't expect corporate databases to be secure. but, if/when single-payer healthcare is implemented in the US, data leaks and breaches will occur often. i guess the difference is optical: instead of blaming the evil corporations, we'll blame the evil government.
  - ende 9y ago
    One difference is that corporations can be more easily taken to court. It's more difficult to hold the 'government' accountable without it being political. I don't necessarily know how to remedy that, but it's a different class of problem. Maybe there should be more personal liability for the individuals in these agencies?
  - Panino 9y ago
    > also an aspect of a single-payer healthcare plan? Note: single payer healthcare systems are about who pays, not who provides -- it's even in the name. So here, hospitals and clinics provide healthcare while the government pays those hospitals and clinics. There's no reason for the government to know John Doe's enlarged prostate medication because that's between the doctor and patient. > if/when single-payer healthcare is implemented in the US, data leaks and breaches will occur often Can you provide numerous links to stories about Medicare and Medicaid personal data being exposed to the public? And if so, do those breaches outweigh the cost of (in the single payer case) millions of people without healthcare, increased costs, and worse health outcomes?
    - 9y ago
Entalpi 9y ago
TLDR: Databases shipped to foreign soil, used by consultants without security clearance. This seems to get a bit bigger by the day. We usually do not have scandals and such high profile activities but this is pretty huge tbh. :(
- kuschku 9y ago
  This is happening more and more recently, because the US is only signing treaties (even unrelated ones) if they require that countries allow governmental data to be outsourced into the US. This is getting very scary, and I’m starting to feel like we should stop doing any interaction with the US here in Europe.
danso 9y ago
Blog posts from Rick Falkvinge (Head of Privacy at Private Internet Access, and a founder of Sweden's first Pirate Party): - https://www.privateinternetaccess.com/blog/2017/07/swedish-administration-tried-glossing-leaking-eus-secure-stesta-intranet-russia/ https://www.privateinternetaccess.com/blog/2017/07/swedish-a... - https://www.privateinternetaccess.com/blog/2017/07/swedish-transport-agency-worst-known-governmental-leak-ever-is-slowly-coming-to-light/ https://www.privateinternetaccess.com/blog/2017/07/swedish-t... (edit: for some reason, the above blog post URLs weren't showing up for me...) If I'm reading his blog post correctly, Sweden's transport agency sloppily handled the nation's vehicle registry, which does contain data subject to freedom of information laws, but contains confidential data that is not supposed to be out in the wild: > Last March, the entire register of vehicles was sent to marketers subscribing to it. This is normal in itself, as the vehicle register is public information, and therefore subject to Freedom-of-Information excerpts. What was not normal were two things: first, that people in the witness protection program and similar programs were included in the register distributed outside the Agency, and second, when this fatal mistake was discovered, a new version without the sensitive identities was not distributed with instructions to destroy the old copy. Instead, the sensitive identities were pointed out and named in a second distribution with a request for all subscribers to remove these records themselves. This took place in open cleartext e-mail. Since Sweden is 10 million citizens, about the size of a U.S. state, this sounds like a state DMV (Department of Motor Vehicles) accidentally exposing the licensed drivers and registered vehicles database (part of which is public record). But the difference seems to be that Sweden's transport agency also handles aircraft and military vehicles using the same database, hence the exposure of secret military info? Ignoring the current fuckup, it seems like a bad idea to have one national data system for personal and govt/military vehicles, even if it is efficient for a nation of Sweden's size. The Gizmodo article notes that this database was accessible to all of the Sweden transport agency IT workers to access and download willy-nilly, which is a problem independent of the issue of it being accidentally leaked. In the United States, it's a common scandal for state law enforcement to lookup driver information without proper authorization, but at least it's just civilian driver information for their state, not the Humvees registered to SEAL Team 6: http://www.nbc-2.com/story/25334275/deputy-fired-for-improperly-accessing-info-about-governor-nbc2-anchors-others http://www.nbc-2.com/story/25334275/deputy-fired-for-imprope...
sedeki 9y ago
One guy working in IT at the department in question apparently lost his job for refusing to implement this. He was also the one whom informed SÄPO about this.
- brainpool 9y ago
  Would be really interesting to hear more about this. Without too much details of course.
- deleted 9y ago
  [deleted]
coldcode 9y ago
I think the US losing all the data for everyone who ever got a security clearance is worse (thankfully mine was before they were stored in a modern system). But this is pretty much beyond stupid. When you outsourced control of your information, assume it will become public.
- snerbles 9y ago
  Worse, but swept under the rug. I wasn't officially notified of the OPM breach until a year after it hit the news. https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
- anigbrowl 9y ago
  Yes, but there's value is persuading people that this latest things The Worst - commercial value in terms of selling the story, genuine news value for Swedes if it is in fact the worst breach of Swedish data, and political value in undermining the credibility of the Swedish government. You might like to consider this in the light of Sweden's recent decision to re-introduce military conscription and who the winners and losers from a stronger Swedish defensive posture would be.
danieka 9y ago
The thing that really gets to me is that I have no way of opting out of having my personal details in the governments databases. Compared to a private company which if I don't trust I simply avoid. It can't leak data it doesn't have. But I'm completetly defenseless against my goverment. And I know of no serious politician (I'm Swedish) that talks about these issues. Which means I can't vote for better policies. Society is so far behind on understanding privacy issues and the impact of these shoddy practices.
- AlexandrB 9y ago
  > Society is so far behind on understanding privacy issues and the impact of these shoddy practices. I am now of the opinion that it's going to take something tragic happening - aided by mass surveillance - for this to change.
- macintux 9y ago
  > Compared to a private company which if I don't trust I simply avoid. Good luck avoiding Google.
  - zwarag 9y ago
    Well thats not to difficult. And besides, the main point is that you can opt to not use Google services.
    - 3131s 9y ago
      Ever heard of DoubleClick? Google owns many ad networks.
    - macintux 9y ago
      I don't use most Google services, and when I do they're sandboxed, but Google cookies are omnipresent. I have no faith that my incognito efforts are all that incognito.
      - macintux 9y ago
baalimago 9y ago
No one has been reported of using the data, at least so far. The head of security went out and said this publicly, also that the military forces vehicles aren't registered there, just giving away even more information about national security for free. sigh Some more trivia: the one responsible for the leak didn't even tell the the prime minister for _over a year_. And the security issues weren't even discussed by the team who hired IBM, they got a report from some people (some sort of service desk or something, who have nothing to do with security) that this was a bad idea and that building a cloud in Sweden would be a lot safer, the report they gave "mysteriously disappeared"
sabujp 9y ago
no one ever got fired for hiring IBM
- lucasverra 9y ago
  https://news.ycombinator.com/item?id=14766793 https://news.ycombinator.com/item?id=14766793 last week debate about this quote :)
- kpil 9y ago
  No one is fired yet. Failed agency directors are traditionally sent to 'the elephant graveyard' ie doing some nonsense work in a government department. A fine has been handed out - the case was handled in a court without any fanfare and it must have been the smallest possible amount for a crime against the security of the state - half a month's salary. This can not be overruled. Due to the verdict, the employment status is now under consideration in a special governmental body - basically the HR department. If this seems like a banana republic without bananas but with a monarch, it's because it is.
deleted 9y ago
[deleted]
sexydefinesher 9y ago
Once again Sweden is leading in transparency
- sebleon 9y ago
  well played
- arossse 9y ago
  Best comment I read this year
basicplus2 9y ago
What is the point of a government if it outsources its own work, this is exactly the sort of work governments should be doing.
- mk89 9y ago
  I asked myself the same. Besides reduced costs, I can't see any real benefits...
synicalx 9y ago
Got one thing to say. I - I've B - Been M - Molested
throwawaymanbot 9y ago
we can assume that all data given over to the cloud has been copied and siphoned off to govt "intel" agencies. Welcome to the modern world. on one hand is digital services that deliver to people, the other hand is all your base belong to everyone.
baalimago 9y ago
UPDATE: The entire Swedish government has now been reorganized as a result of this IT-scandal.

175 points by brainpool 9y ago

ngneer 9y ago

This has happened in Israel in the past :(

yuvadam 9y ago
Correct, the entire Israeli census database has leaked and is now freely available for anyone who knows where to look for it. I gave a short talk about this leak at 28c3 [1], if anyone's interested in more details. [1] - https://www.youtube.com/watch?v=ow7cvZOzp6w https://www.youtube.com/watch?v=ow7cvZOzp6w
- terminalcommand 9y ago
  Similar census leaks occured in Turkey and Mexico as far as I can remember. But this leak has classified info such as witness protection data.
- mderazon 9y ago
  It's outrageous that the data was leaked over such a long period so many times. The new biometric law is just laughing in the face of the citizens.
- pbhjpbhj 9y ago
  Aren't censuses usually published?
  - ngneer 9y ago
    This one had addresses, phone numbers and dates of birth.

jeremynixon 9y ago

> “Any governmental assurances to keep your data safe have as much value as a truckload of dead rats in a tampon factory.” Remember this. I expect every piece of data given out to the government or to private organizations to sit in the databases of every major intelligence agency, and will not be surprise if it's all exposed to the public domain through data aggregation companies in near future.

HillaryBriss 9y ago
also an aspect of a single-payer healthcare plan? i don't expect corporate databases to be secure. but, if/when single-payer healthcare is implemented in the US, data leaks and breaches will occur often. i guess the difference is optical: instead of blaming the evil corporations, we'll blame the evil government.
- ende 9y ago
  One difference is that corporations can be more easily taken to court. It's more difficult to hold the 'government' accountable without it being political. I don't necessarily know how to remedy that, but it's a different class of problem. Maybe there should be more personal liability for the individuals in these agencies?
- Panino 9y ago
  > also an aspect of a single-payer healthcare plan? Note: single payer healthcare systems are about who pays, not who provides -- it's even in the name. So here, hospitals and clinics provide healthcare while the government pays those hospitals and clinics. There's no reason for the government to know John Doe's enlarged prostate medication because that's between the doctor and patient. > if/when single-payer healthcare is implemented in the US, data leaks and breaches will occur often Can you provide numerous links to stories about Medicare and Medicaid personal data being exposed to the public? And if so, do those breaches outweigh the cost of (in the single payer case) millions of people without healthcare, increased costs, and worse health outcomes?
  - 9y ago

Entalpi 9y ago

TLDR: Databases shipped to foreign soil, used by consultants without security clearance. This seems to get a bit bigger by the day. We usually do not have scandals and such high profile activities but this is pretty huge tbh. :(

kuschku 9y ago
This is happening more and more recently, because the US is only signing treaties (even unrelated ones) if they require that countries allow governmental data to be outsourced into the US. This is getting very scary, and I’m starting to feel like we should stop doing any interaction with the US here in Europe.

danso 9y ago

Blog posts from Rick Falkvinge (Head of Privacy at Private Internet Access, and a founder of Sweden's first Pirate Party): - https://www.privateinternetaccess.com/blog/2017/07/swedish-administration-tried-glossing-leaking-eus-secure-stesta-intranet-russia/ https://www.privateinternetaccess.com/blog/2017/07/swedish-a... - https://www.privateinternetaccess.com/blog/2017/07/swedish-transport-agency-worst-known-governmental-leak-ever-is-slowly-coming-to-light/ https://www.privateinternetaccess.com/blog/2017/07/swedish-t... (edit: for some reason, the above blog post URLs weren't showing up for me...) If I'm reading his blog post correctly, Sweden's transport agency sloppily handled the nation's vehicle registry, which does contain data subject to freedom of information laws, but contains confidential data that is not supposed to be out in the wild: > Last March, the entire register of vehicles was sent to marketers subscribing to it. This is normal in itself, as the vehicle register is public information, and therefore subject to Freedom-of-Information excerpts. What was not normal were two things: first, that people in the witness protection program and similar programs were included in the register distributed outside the Agency, and second, when this fatal mistake was discovered, a new version without the sensitive identities was not distributed with instructions to destroy the old copy. Instead, the sensitive identities were pointed out and named in a second distribution with a request for all subscribers to remove these records themselves. This took place in open cleartext e-mail. Since Sweden is 10 million citizens, about the size of a U.S. state, this sounds like a state DMV (Department of Motor Vehicles) accidentally exposing the licensed drivers and registered vehicles database (part of which is public record). But the difference seems to be that Sweden's transport agency also handles aircraft and military vehicles using the same database, hence the exposure of secret military info? Ignoring the current fuckup, it seems like a bad idea to have one national data system for personal and govt/military vehicles, even if it is efficient for a nation of Sweden's size. The Gizmodo article notes that this database was accessible to all of the Sweden transport agency IT workers to access and download willy-nilly, which is a problem independent of the issue of it being accidentally leaked. In the United States, it's a common scandal for state law enforcement to lookup driver information without proper authorization, but at least it's just civilian driver information for their state, not the Humvees registered to SEAL Team 6: http://www.nbc-2.com/story/25334275/deputy-fired-for-improperly-accessing-info-about-governor-nbc2-anchors-others http://www.nbc-2.com/story/25334275/deputy-fired-for-imprope...

sedeki 9y ago

One guy working in IT at the department in question apparently lost his job for refusing to implement this. He was also the one whom informed SÄPO about this.

brainpool 9y ago
Would be really interesting to hear more about this. Without too much details of course.
deleted 9y ago
[deleted]

coldcode 9y ago

I think the US losing all the data for everyone who ever got a security clearance is worse (thankfully mine was before they were stored in a modern system). But this is pretty much beyond stupid. When you outsourced control of your information, assume it will become public.

snerbles 9y ago
Worse, but swept under the rug. I wasn't officially notified of the OPM breach until a year after it hit the news. https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
anigbrowl 9y ago
Yes, but there's value is persuading people that this latest things The Worst - commercial value in terms of selling the story, genuine news value for Swedes if it is in fact the worst breach of Swedish data, and political value in undermining the credibility of the Swedish government. You might like to consider this in the light of Sweden's recent decision to re-introduce military conscription and who the winners and losers from a stronger Swedish defensive posture would be.

danieka 9y ago

The thing that really gets to me is that I have no way of opting out of having my personal details in the governments databases. Compared to a private company which if I don't trust I simply avoid. It can't leak data it doesn't have. But I'm completetly defenseless against my goverment. And I know of no serious politician (I'm Swedish) that talks about these issues. Which means I can't vote for better policies. Society is so far behind on understanding privacy issues and the impact of these shoddy practices.

AlexandrB 9y ago
> Society is so far behind on understanding privacy issues and the impact of these shoddy practices. I am now of the opinion that it's going to take something tragic happening - aided by mass surveillance - for this to change.
macintux 9y ago
> Compared to a private company which if I don't trust I simply avoid. Good luck avoiding Google.
- zwarag 9y ago
  Well thats not to difficult. And besides, the main point is that you can opt to not use Google services.
  - 3131s 9y ago
    Ever heard of DoubleClick? Google owns many ad networks.
  - macintux 9y ago
    I don't use most Google services, and when I do they're sandboxed, but Google cookies are omnipresent. I have no faith that my incognito efforts are all that incognito.
    - macintux 9y ago

baalimago 9y ago

No one has been reported of using the data, at least so far. The head of security went out and said this publicly, also that the military forces vehicles aren't registered there, just giving away even more information about national security for free. sigh Some more trivia: the one responsible for the leak didn't even tell the the prime minister for _over a year_. And the security issues weren't even discussed by the team who hired IBM, they got a report from some people (some sort of service desk or something, who have nothing to do with security) that this was a bad idea and that building a cloud in Sweden would be a lot safer, the report they gave "mysteriously disappeared"

sabujp 9y ago

no one ever got fired for hiring IBM

lucasverra 9y ago
https://news.ycombinator.com/item?id=14766793 https://news.ycombinator.com/item?id=14766793 last week debate about this quote :)
kpil 9y ago
No one is fired yet. Failed agency directors are traditionally sent to 'the elephant graveyard' ie doing some nonsense work in a government department. A fine has been handed out - the case was handled in a court without any fanfare and it must have been the smallest possible amount for a crime against the security of the state - half a month's salary. This can not be overruled. Due to the verdict, the employment status is now under consideration in a special governmental body - basically the HR department. If this seems like a banana republic without bananas but with a monarch, it's because it is.

deleted 9y ago

[deleted]

sexydefinesher 9y ago

Once again Sweden is leading in transparency

sebleon 9y ago
well played
arossse 9y ago
Best comment I read this year

basicplus2 9y ago

What is the point of a government if it outsources its own work, this is exactly the sort of work governments should be doing.

mk89 9y ago
I asked myself the same. Besides reduced costs, I can't see any real benefits...

synicalx 9y ago

Got one thing to say. I - I've B - Been M - Molested

throwawaymanbot 9y ago

we can assume that all data given over to the cloud has been copied and siphoned off to govt "intel" agencies. Welcome to the modern world. on one hand is digital services that deliver to people, the other hand is all your base belong to everyone.

baalimago 9y ago

UPDATE: The entire Swedish government has now been reorganized as a result of this IT-scandal.