I don't really think we can blame IBM on this one. From what I can tell, they followed the specs.

The problem was that the authority overseeing lots of very sensitive data forgot to specify that the individuals working on this project would need be a) swedish citizens, b) go through government level security clearance).

So then when IBM came back with, "hey guys, here's our list of a dozen+ guys in Serbia who need read/write access to all of the data", the swedish agencency felt like they had no choice to grant access to extra-nationals, even though it was clearly against the law.

Note: Serbia happens to be quite closely related to Russia, politically speaking. One of the admins who were granted read/write access had a ten year history in the serbian army...