Another IBM stuff up... anyone remember the Australian Census screw up? http://www.abc.net.au/news/2016-11-25/ibm-to-pay-over-$30m-i...
http://www.abc.net.au/news/2012-06-06/qld-health-payroll-deb...
http://www.abc.net.au/news/2013-08-07/government-may-sack-bu...
- The Transport Agency decided to outsource operations, and IBM won the contract (April 2015)
- The following month, the head of the agency decided to ignore certain laws about privacy, secrecy, etc., as well as the agency's own requirements about information security
- The Swedish Security Service, Säpo (basically our FBI), immediately got wind of this and started investigating, ultimately recommending - in November 2015 - to put an immediate halt to the outsourcing
- The Transport Agency decided to ignore the advice of Säpo and handed over operations to IBM in December 2015
Here's a good timeline: http://www.dn.se/nyheter/sverige/detta-vet-vi-om-transportst...
But that timeline does seem quite ridiculous. To wilfully ignore the recommendations of you security services, seems almost Trumpesque.
The problem was that the authority overseeing lots of very sensitive data forgot to specify that the individuals working on this project would need be a) swedish citizens, b) go through government level security clearance).
So then when IBM came back with, "hey guys, here's our list of a dozen+ guys in Serbia who need read/write access to all of the data", the swedish agencency felt like they had no choice to grant access to extra-nationals, even though it was clearly against the law.
Note: Serbia happens to be quite closely related to Russia, politically speaking. One of the admins who were granted read/write access had a ten year history in the serbian army...
"Swedish IBM used up to 11 subsidiaries and subcontractors in different countries, among them Romania, Croatia, Czech Republic and Serbia. ``But how the data would flow she did not understand'', witnesses a consultant who evaluated IBM's offer before the contract signing.
The ones who got "the keys to the kingdom" where three IBM administrators in Czech Republic, with full access to all data and logs. It meant the possibility to copy and distribute data and then remove all traces.
The computer systems' various firewalls and all communication were handled by a company in Serbia where 14 named persons became administrators, they, too, without a security check."
[0] http://www.dn.se/nyheter/sverige/statliga-hemligheter-kunde-...