Swedish Government Scrambles to Contain Damage from Data Breach

http://faculty.up.edu/lulay/failure/vasacasestudy.pdf [pdf]

Thank you for reminding me about the Vasa!

You'd think someone would come in an consult on this, however, and setup basic protocols. A PM isn't expected to be a security expert -- that's what security experts are for.

- identities of undercover operatives - personal identity data of everyone with a driver's licence - people with protected identities - location of all army vehicles - money transport vehicles - classified infrastructure information

Even worse: when they realized they'd leaked photos, home addresses and SSNs of protected identities, they sent a clear text email asking the contractor to clear them from the database manually.

My country is a joke.

SÄPO knew about this in 2015, and recommended against it, but the Transport Agency still went through with the deal. How they could even be allowed to do that is beyond me.

The director general of the Transport Agency, and the person ultimately responsible for the leak, was fined a mere $8500 (which is half of what she allegedly would earn in a _month_) for leaking highly classified information to foreign powers - an act that would be punished as high treason in any sane country. Either she knew exactly what she was doing, meaning the Russians paid a meagre $8500 for full access to a database containing top secret information, or (more likely) she was just that stupid, meaning possibly hostile powers got this information for free.

But hey, that's Sweden, where incompetent people become director generals of big government agencies, and any screw up they get caught with is excused by saying that you didn't know better.

Here, Swedes believe that Trump is such a catastrophe, and wonder why Americans could vote for him. We should instead look at our own pathetic "feminist" government, and ask ourselves how and why we got here.

But hey, luckily for everyone we don't have nukes. We'd probably accidentally give the launch codes to Saudi Arabia/Palestine, and respond by giving the person responsible for the leak a small fine while the rest of the world burned in the war that erupted after Israel got nuked.

I've seen this time and again not just in outsourcing but also in regime change at companies where employees and management turn over.

Pretty soon you've got a whole host of legal contracts with customers and regulatory promises saying you provide X, Y, Z encryption, data redundancy, offsite backups, support contracts, and so on -- but you're doing none of it.

I wonder to what extent outsourcing ends up being cheaper precisely because they're not following the framework that the in-house crew implemented and hopefully stuck with.