Serious shortcomings in government agencies’ work on preventing infiltration

In recent years, there have been numerous reports of infiltration in public sector activities. Infiltration may have consequences such as divulging information that benefits serious crime, information tampered with or destroyed, financial irregularities and disruptions in security-sensitive activities – all of which result in high costs for society.

The Swedish National Audit Office has therefore examined work to combat infiltration at three central government agencies – the Swedish Defence Materiel Administration (FMV), the Legal, Financial and Administrative Services Agency and the Swedish Prison and Probation Service. These agencies were selected because their activities are deemed to be at high risk of infiltration, and the consequences are potentially severe.

The overall conclusion is that their work on the whole is not effective. This includes both processes aimed at preventing and stopping infiltration as well as detecting ongoing infiltration. The shortcomings are sometimes so extensive that they risk exposing critical security gaps.

“Our assessment is that the audited agencies have not attached sufficient importance to security work, which has led to extensive security deficiencies that, at worst, could lead to severe consequences,” says Auditor General Christina Gellerbrant Hagberg.

Progress on protection against infiltration varies across the three agencies. FMV has come farthest, with coherent processes, traceability and links between protective security analysis and agency-wide risk management. The Swedish Prison and Probation Service has critical deficiencies that undermine both prevention and detection, although it has recently taken several steps in the right direction. The Legal, Financial and Administrative Services Agency conducts fragmented security work, with unclear procedures for incident logging and management.

The Swedish National Audit Office notes that the agencies’ follow-on security vetting of staff has not been sufficiently effective. For example, all too rarely are important sensitive questions asked (about employees’ personal finances, social exposure, threats, vulnerabilities and dependencies) to detect vulnerabilities.

“Follow-on security vetting meetings are often difficult conversations, because managers have to ask their employees sensitive questions. However, it is too late to do so once suspicions have arisen,” says Per Dackenberg, Project Leader for the audit.

Another vulnerability is uncertainty among employees – particularly at the Swedish Prison and Probation Service but also at the Swedish Defence Materiel Administration – concerning whistleblowing possibilities. There is thus a risk that signals picked up on by staff will not reach agency management.