3 ms·

I don't really think we can blame IBM on this one. From what I can tell, they followed the specs. The problem was that the authority overseeing lots of very se

I don't really think we can blame IBM on this one. From what I can tell, they followed the specs. The problem was that the authority overseeing lots of very sensitive data forgot to specify that the individuals working on this project would need be a) swedish citizens, b) go through government level security clearance). So then when IBM came back with, "hey guys, here's our list of a dozen+ guys in Serbia who need read/write access to all of the data", the swedish agencency felt like they had no choice to grant access to extra-nationals, even though it was clearly against the law. Note: Serbia happens to be quite closely related to Russia, politically speaking. One of the admins who were granted read/write access had a ten year history in the serbian army...

dragandj 9y ago
Where did you get the information about dozen+ guys in _Serbia_? The article does not mention Serbia, but mentions Check Republic...
- sampo 9y ago
  Serbia (not necessarily dozen guys, though) has been mentioned in a lot of news articles in the Swedish press. It's now even on the Wikipedia page in the Swedish Wikipedia. https://www.google.com/search?q=Maria+%C3%85gren+serbien https://www.google.com/search?q=Maria+%C3%85gren+serbien
- rhblake 9y ago
  It was reported by DN who received a copy of the Swedish Security Service's (Säpo) preliminary investigation [0]. My translation of a few paragraphs from the article: "Swedish IBM used up to 11 subsidiaries and subcontractors in different countries, among them Romania, Croatia, Czech Republic and Serbia. ``But how the data would flow she did not understand'', witnesses a consultant who evaluated IBM's offer before the contract signing. The ones who got "the keys to the kingdom" where three IBM administrators in Czech Republic, with full access to all data and logs. It meant the possibility to copy and distribute data and then remove all traces. The computer systems' various firewalls and all communication were handled by a company in Serbia where 14 named persons became administrators, they, too, without a security check." [0] http://www.dn.se/nyheter/sverige/statliga-hemligheter-kunde-nas-av-frammande-makt/ http://www.dn.se/nyheter/sverige/statliga-hemligheter-kunde-...

dragandj 9y ago

Where did you get the information about dozen+ guys in _Serbia_? The article does not mention Serbia, but mentions Check Republic...

sampo 9y ago
Serbia (not necessarily dozen guys, though) has been mentioned in a lot of news articles in the Swedish press. It's now even on the Wikipedia page in the Swedish Wikipedia. https://www.google.com/search?q=Maria+%C3%85gren+serbien https://www.google.com/search?q=Maria+%C3%85gren+serbien
rhblake 9y ago
It was reported by DN who received a copy of the Swedish Security Service's (Säpo) preliminary investigation [0]. My translation of a few paragraphs from the article: "Swedish IBM used up to 11 subsidiaries and subcontractors in different countries, among them Romania, Croatia, Czech Republic and Serbia. ``But how the data would flow she did not understand'', witnesses a consultant who evaluated IBM's offer before the contract signing. The ones who got "the keys to the kingdom" where three IBM administrators in Czech Republic, with full access to all data and logs. It meant the possibility to copy and distribute data and then remove all traces. The computer systems' various firewalls and all communication were handled by a company in Serbia where 14 named persons became administrators, they, too, without a security check." [0] http://www.dn.se/nyheter/sverige/statliga-hemligheter-kunde-nas-av-frammande-makt/ http://www.dn.se/nyheter/sverige/statliga-hemligheter-kunde-...