Slashdot Mirror
Sweden Accidentally Leaks Personal Details of Nearly All Citizens (thehackernews.com)
An anonymous reader quotes a report from The Hacker News: Swedish media is reporting of a massive data breach in the Swedish Transport Agency (Transportstyrelsen) after the agency mishandled an outsourcing deal with IBM, which led to the leak of the private data about every vehicle in the country, including those used by both police and military. The data breach exposed the names, photos and home addresses of millions of Swedish citizen, including fighter pilots of Swedish air force, members of the military's most secretive units, police suspects, people under the witness relocation program, the weight capacity of all roads and bridges, and much more. The incident is believed to be one of the worst government information security disasters ever.
In 2015, the Swedish Transport Agency hand over IBM an IT maintenance contract to manage its databases and networks. However, the Swedish Transport Agency uploaded IBM's entire database onto cloud servers, which covered details on every vehicle in the country, including police and military registrations, and individuals on witness protection programs. The transport agency then emailed the entire database in messages to marketers that subscribe to it. And what's terrible is that the messages were sent in clear text. When the error was discovered, the transport agency merely thought of sending a new list in another email, asking the subscribers to delete the old list themselves.
In 2015, the Swedish Transport Agency hand over IBM an IT maintenance contract to manage its databases and networks. However, the Swedish Transport Agency uploaded IBM's entire database onto cloud servers, which covered details on every vehicle in the country, including police and military registrations, and individuals on witness protection programs. The transport agency then emailed the entire database in messages to marketers that subscribe to it. And what's terrible is that the messages were sent in clear text. When the error was discovered, the transport agency merely thought of sending a new list in another email, asking the subscribers to delete the old list themselves.
The government shouldn't be releasing the personal details of citizens. That's a job for corporations.
Since I've had to comply with them for years, it appears they are working fantastic
This story is more fun if, in your head, you read the summary using a Swedish accent.
#DeleteChrome
Nonsense! cloud is the future, not the issue.
Swedish Transport Agency uploaded IBM's entire database onto cloud servers
The transport agency then emailed the entire database in messages to marketers that subscribe to it.
were sent in clear text
error was discovered, the transport agency merely thought of sending a new list in another email, asking the subscribers to delete the old list
every conceivable top secret database: fighter pilots, SEAL team operators, police suspects, people under witness relocation.
One of the multiple questions coming to my mind after reading all this is: why are so different types of top-level secret information of a country being stored in the same database?!
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
switch cars with your neighbors.
Russian spies just got accepted their requests for a couple of years of sabbatical, because there's no more work to do.
> ..the transport agency then emailed the entire database in messages to marketers that subscribe to it.
This sentence makes no sense. What did the marketers subscribe to? The top secret database??!! This must have been quite a large database, I doubt that you can attach and mail it. Who mailed what to whom?
The whole article reads like something Google translate did on a day when the server was drunk or half asleep.
The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
It's wide open there. And slightly windy as well. But not windy enough for the responsible people to care.
For as long as I could remember, Sweden was portrayed as one of the best places to live, and one of the most capable of nations. It had prosperity, almost non-existent crime, and despite having a relatively small population it punched far above its weight in many scientific, technological and artistic fields.
When the name "Sweden" appeared in a news article's headline, chances are whatever the article was focusing on was going to be extremely positive.
But that has all changed.
Now the name "Sweden" has become associated with "no-go zones" like the Rinkeby district and the Husby district, a huge increase in grenade attacks, the 2013 Stockholm riots, and the 7 April 2017 truck attack in Stockholm.
Now there is this incident.
What's happening to Sweden? Is it a prime example of what happens when political and social leftism runs rampant, destroying the institutions and culture of a nation? Is what's happening in Sweden the fate of any nation that brings in people from the worst of the worst third-world nations?
Because More Power = Bigger SNAFUs.
I hope they can sue IBM / jail someone for this.
Funny this, yesterday, we were discussing the Norwegian story about how everybody has access to everyone else's income, and it's no big deal, since they have a sense of community & everyone trusts each other. Now, I know that Sweden is not Norway, but culturally, from what I understand, very similar. In which case, this accidental leak should be no issue at all, since all Scandinavians are perfectly honest people who wouldn't dream of even SCANNING other people's personal data, let alone steal from them, just b'cos they can. So this story is essentially much ado about nothing
"When the error was discovered, the transport agency merely thought of sending a new list in another email, asking the subscribers to delete the old list themselves." Hey guys, yeah, could you just ignore that last email we sent? That would be great, thanks. I'm surprised they didn't just try an Exchange "recall message". Is this their actual policy for data leaks?
Does that include chest size for the women? We need to know!
#DeleteFacebook
Although the data breach happened in 2015, Swedish Secret Service discovered it in 2016 and started investigating the incident, which led to the fire of STA director-general Maria Ågren in January 2017.
Holy shit. I have a hard time wrapping my head around how massive of a fuckup this is.
Ågren was also fined half a month's pay (70,000 Swedish krona which equals to $8,500)
Oh. Well hell, that ought to teach her.
Don't worry this only affects natural born citizens of Sweden. Immigrants have not had their personal details released.
Why would a transport agency have any access to witness relocation data?
Just look at this photo showing the Stockholm telephone tower in year 1890. It had one cable going directly from a central location all the way to each household. Seriously. Not a joke: https://upload.wikimedia.org/wikipedia/commons/9/93/Telefontornet_1890.jpg
The piece written by the Indian bloggers is inaccurate in some parts. There's a Bleeping Computer report, which I presume the Indian bloggers inaccurately copied, from a day prior: https://www.bleepingcomputer.com/news/security/biggest-data-leak-in-swedens-history-punished-with-half-a-months-paycheck/
This piece includes links to Swedish media, where you can read more about each case.
The data breach exposed the names, photos and home addresses of millions of Swedish citizen, including fighter pilots of Swedish air force, members of the military's most secretive units, police suspects, people under the witness relocation program, the weight capacity of all roads and bridges, and much more.
Oh yeah, and it also reveals the names of catholic priests, pedophiles, skull-fuckers, rapists, and community leaders. Which, as anyone knows, are all the same people. And fuck, they also reveal who knows about Area 51, alien invaders, and [enter your tinfoil here].
In all seriousness though, wtf is the spin in TFS. It reads as if it was a national security issue, whereas TFS holds that it's about names, photos and home addresses. Not activity.
Fuck you Slashdot editors. You're worthless.
Article is bullshit and bad translation. It is explained better here Transportstyrelsens IT-upphandling (in swedish, do your own translation)
Jag Ãr Brian och sa Ãr min fru!
once again, slashdot continues to FAIL IT with unicode
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
"...The transport agency then emailed the entire database in messages to marketers that subscribe to it."
Darn tiny dbase, if the entirety fits into one email.
Yes, so long as you aren't simultaneously sustaining any other thing. Like a day job.
I'm joking just a bit, but the word "sustain" is commonly abused in exactly this way.
Weakly sustainable: when just this one thing can be sustained.
Strongly sustainable: a member of the set such that all strongly sustainable things can be sustained at the same time without surpassing the labours of Hercules.
Whenever someone says to me "sustainable" regarding a personal resolution, my first (usually silent) question is: have you ever given one hour notice at work, and then set foot in Tibet the very next day?
Because, if so, that's just a steaming pile of dedication porn.
... right after I copy it to safe harbour.
It little behooves the best of us to comment on the rest of us.
I get Sweden messed up but, dear whatever god you believe in... wtf IBM?
I'm not surprised, most their software has hardly any security. When I was leaving they were trying to fix passwords being available in plan text in files... it was a disaster.
https://slashdot.org/comments....
But ran into a case of communism. Anyway, my comments about the current situation of Sweden still holds:
https://slashdot.org/comments....
https://slashdot.org/comments....
https://slashdot.org/comments....
Though totally unrelated to the leak and 100% about the only party which was voting against letting foreign companies handle this information and the current threats of democracy of Sweden and so on.
What do you expect when your country is run by SJWs?
Seriously, Russia had been trying to do this for a year, and then Sweden goes and does it for them.
All those wasted hacker hours.
Sigh.
-- Tigger warning: This post may contain tiggers! --
Seriously, while the agency has f*cked up big time, this article is actually spinning it in a manner worse than any tabloid. It's completely mixing up two completely unrelated incidents:
1. The mass e-mailing of sensitive data - some companies are subscribing to list of car registration details (i.e. addresses of car owners). These lists are supposed to be filtered to not contain anyone with "hidden identities", but for some reason they were not. (Sadly, the agency tried to mitigate this by sending a followup list of ONLY those people that should have been removed from the previous list....)
2. When outsourcing to IBM, handover to IBM staff outside of Sweden was done without doing proper background checks, willfully ignoring multiple laws and going against the recommendation of the police (Säpo). Whether any data actually has leaked is not publically known as of today - the police has withheld this information.
So it's okay when Sweden "Leaks" but it's not okay when Assange does it.
This will be small potatoes compared to the leaks of private financial and medical data we can expect from the CFPB and the reporting required by ACA.
Oh well, not like someone has already filtered them out [link elided].
Does anyone know the original source of the claim below? Can't find anything about it in the references, including their subrefs.
"The transport agency then emailed the entire database in messages to marketers that subscribe to it. And what's terrible is that the messages were sent in clear text. When the error was discovered, the transport agency merely thought of sending a new list in another email, asking the subscribers to delete the old list themselves."
Thank goodness this was a singular event
It was a singular event, being the only nuclear power plant accident which caused a verifiable radiologically induced human death. Thus see for instance Fukushima Daiichi where no death due to radioactive materials can be established, and where, perversely (and at great cost), one outcome will be vastly lowered rates of thyroid cancer mortality.
Moreover the dozens of confirmed, and hundreds of potential, deaths due to Chernobyl need to be weighed against the 1.8million lives saved by nuclear energy that would otherwise have been lost due to burning fossil fuels.
Hate to spoil your narrative, but I'm not from Sweden.
Il n'y a pas de Planet B.
I presume people in Sweden pay taxes to fund government services... why is the government selling personal information of citizens to marketers?
And why the fuck do they have witness protection program , military personnel , inmates , and government officials in a single archive ??? I'm guessing it's multiple databases but clearly was single access for all of it with no controls.
Max Payne 3 Pc Game Download
and now for something completely different:
http://www.slate.com/blogs/browbeat/2012/08/28/what_is_the_swedish_chef_actually_saying_one_swede_translates_.html
"A government big enough to give you everything you want, is a government big enough to take away everything that you have."
- Thomas Jefferson
This should be a reminder that an omnipresent government like the Swedish government has some inherent risks.
"..the transport agency then emailed the entire database in messages to marketers that subscribe to it."
This sentence makes no sense. What did the marketers subscribe to? The top secret database??!! This must have been quite a large database, I doubt that you can attach and mail it. Who mailed what to whom?
The whole database WAS indeed leaked. In clear text. To former Soviet countries. And also by mail. As decided by a senior official(!).
Most content of the DB is official data under the the freedom of information act (Offentlighetsprincipen), so it does make sense to supply that information to any commercial subscriber, such insurance companies etc., but from a military standpoint, this leak is the most severe leak since 1980's, when russian spy Stig Bergling stole enormous amounts of top secret information.
A government database like containing things like names, street-names, car make and models contains mostly repeating information, very easily compressed to mailable size using zip. The "funny" thing is that the officials confirm the database was leaked, "but any villain do not have the correct interface, so they cannot read it". Well, is not a problem for any scriptkiddie to google an appropriate extraction tools, don't you think? The only exaggeration in the post, is that minors and adults without a drivers license isn't included in the database, which still means that ~75% of the entire population is included.
So this story is essentially much ado about nothing
So while some 90% of the database is official, it DOES contain secret military information without any marking of that, or at least that wasn't removed prior to publishing the database.
From a military perspective, this is the largest leak since the 1980's, when Russian spy Stig Bergling stole huge amounts of even more dangerous information, which basically forced a complete(!) re-organization of the whole military.
Leak happened in 2015!
Turning one sheet of paper every day, it takes some time for any information of the leaks to be published under the freedom of information act ("Offentlighetsprincipen"). If you're in a hurry. Otherwise, they'll only do it on Friday afternoons. If there's any spare time...
If you are interested there is a Q&A at Transportstyrelsen's site
http://www.transportstyrelsen.se/sv/Om-transportstyrelsen/fragor-och-svar/
It's in Swedish so you need Google translate. It is of course subjective statements. Still it should clear some misunderstandings. That is not to say that the breach is bad -- it is, and it is unfortunately a sign of general incompetence and naivety when it comes to IT security as highlighted by another Swedish agency (http://www.fra.se/snabblankar/english.10.html).
Not really, no. The water levels are low for reasons other than global warming. The aquifer is nearly depleted due to overuse and drought. None of those is directly related to climate change. The depletion is definitely due to humans, however. The river should also be fed be aquifer. It isn't. We used the water to grow food and lawns.
"So long and thanks for all the fish."
Stupid privatization, outsourcing combined with the EU and massive immigration. Billions of tax payers money lost in shady deals.
My nation has deteriorated ever since Prime Minister Olof Palme got murdered.
Accountability with ministers and governmental departments in Sweden is nearly nonexistant.
(English is not my native language and Google Translate felt really erratic, so this is what you get /. )
The title says it was an "accident" which is incorrect. This was done with open eyes all the while security responsible protested and a lot of other IT people.
The director ordered this outsourcing project to continue and give access to the IBM contractors before they had been given security clearance. IBM's personnel are located in different countries such as Serbia, Poland, etc. The access is (still) administrative access to databases and data shares.
It's of course not just one big database but many. What's also not in the summary is that an encrypted inter-agency network was also exposed. Oops.
The motive of the (now ex) director's order was to speed up the project, because the transport agency otherwise would have issues with their daily work (issue driver licenses, etc.). The government has also been breathing down their necks to save money, hence this outsourcing (short-sighted madness).
It's a trainwreck from beginning to end, really. Heads will roll.
IAAS (I Am A Swede) as well..
Fight for your digital freedom, join the EFF *now*: http://www.eff.org/support/
"The transport agency then emailed the entire database in messages to marketers that subscribe to it."
What? No...
If you want to know what ACTUALLY happned do a Google translate of this;
http://www.breakit.se/artikel/8326/jag-laste-sapos-granskning-av-it-skandalen-i-transportstyrelsen-sa-du-slipper
Sound like BS to me.
Where I work, emails are limited to 10MB in size. We have a n email application that allows for large file transfer, up to 150MB. I'm sure most governments and corporations have similar restrictions, or at least *some*.
I'm not sure what size the Transportation database would be for an entire country, but I am thinking it would be large enough that no email system anywhere of any type is going to be very successful at moving it.
What is more likely is that the data was on the cloud, and that the location was sent out beyond what they were supposed to. However one would think that said cloud would have the appropriate security setup for it, which is more concerning if it was not. Indeed that would be just as much the contractor's fault (unless specifically told not to, also unlikely) as the government if it was simply left open for anyone to access.
Bottom line is I work with a lot of large databases, and none of them would likely rival the size of an entire transportation DB, and I don't think I could even come close to "emailing" them to anyone no mater what I tried to do...
hitta.se has basic license plate -> name & phone number data. It's intentionally public in Sweden, and breathless melodramatic questions like, "how did you get this number? / using a phone book," aren't as normal in Sweden as they are in the US.
Don't blame Sweden, they thought the cloud was wearing a condom.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
Take your meds mentalcase https://slashdot.org/comments....
&
You're also a druggie too https://slashdot.org/comments....
Going to make more sockpuppets to stalk & troll me with you loon https://slashdot.org/comments.... ?
+
Sending me postcards with threats too https://slashdot.org/comments.... ??
* You're a butthurt loon freak, plain & simple - you did it to yourself, loser... see below for proof.
APK
P.S.=> 1st of all you use a FAKE NAME (for your FAKE LIFE) - right there, you show in that alone, nobody can believe a thing you say here... apk
> Although the data breach happened in 2015, Swedish Secret Service discovered it in 2016 and started investigating the incident, which led to the fire of STA director-general Maria Ågren in January 2017.
> Ågren was also fined half a month's pay (70,000 Swedish krona which equals to $8,500) after finding her guilty of being "careless with secret information," according to the publication.
So much for hiring women.
The first article linked says that the Swedish Transportation Agency allowed IBM to proceed without background checks and security clearances. Some of the IBM personnel were located in other countries. It does not say that anyone outside of IBM had any inappropriate access. The second article linked, from which the summary paragraph above is drawn, seems a bit sensational in extrapolating this as having been a huge data leak -- "...emailed the entire database...".
Börk, Börk, Börked!
They are so proud of being cashless, and likely will be the first country to use implantable rfid chips in their citizens. Will be interesting to see the sheeples response when their rfid keys or biometric markers are accidently uploaded online and some enterprising hacker does a mass I'd theft and transfers all their government crypto coins (naturally linked to their rfid tags) to a bank in eastern europe. Science fiction? Give it 20 years.
"A government big enough to give you everything you want, is a government big enough to take away everything that you have."
- Thomas Jefferson
This is a cute turn of phrase, but a government gets to the "can take everything you have" size long before it reaches the "give you everything you want" level.* Most (all?) of the planet's population lives under governments that have reached one mark but not the other.
* For sane definitions of "everything you want" and "everything you have." Clearly, if one of the things I want is a government that can't take anything from me, the premise itself is flawed.