[HN Gopher] Source code of Swedish e-government services has bee...
___________________________________________________________________
Source code of Swedish e-government services has been leaked
Author : tavro
Score : 187 points
Date : 2026-03-13 09:45 UTC (13 hours ago)
(HTM) web link (darkwebinformer.com)
(TXT) w3m dump (darkwebinformer.com)
| robertlagrant wrote:
| The source code is the least of it! From the article:
|
| > citizen PII databases and electronic signing documents were
| also collected but are being sold separately
| simonklitj wrote:
| Man, you've got to be a real low-life to sell all of that.
| blell wrote:
| You've got to be a real low-life to collect all of that and
| put it in a database that is not air-gapped.
| xorcist wrote:
| It's something akin to a service provider in SAML parlance,
| if we are to believe reporting. How can it be air-gapped?
|
| And if we are to believe the hacked company, it is a
| development environment with test data in it. That remains
| to be seen, but is a risky thing to lie about. If there is
| production data in the leak, we will surely know about it.
| UltraSane wrote:
| At the high end you can use data diodes to isolate
| critical data.
| lukan wrote:
| If you need the data, you cannot have it air gapped. And if
| it is air gapped, it is still easy to make misstakes.
| dns_snek wrote:
| > it is still easy to make misstakes.
|
| That's not an excuse though, any system handling data
| like that should be continuously reviewed and pentested
| by professionals. Hopefully they can show that this has
| been done otherwise it's just negligence.
| lukan wrote:
| It was mainly an explanation, that "airgapping" does not
| magically provides better security, or is required (or
| possible) to use at all here.
| dns_snek wrote:
| And it's pretty clear to me that they were criticizing
| storage of sensitive data in a database that isn't
| properly secured and they simply misused the term
| "airgapped". The database in question was easily
| accessible from poorly maintained development
| infrastructure.
|
| > Please respond to the strongest plausible
| interpretation of what someone says, not a weaker one
| that's easier to criticize
| fc417fc802 wrote:
| Imagine if the bank took such a cavalier attitude with
| the contents of my account.
| jjgreen wrote:
| "misstakes", love it, almost peotic
| dijit wrote:
| The point of a system like this is specifically that it's
| accessible and not air gapped.
|
| Being able to validate that a citizen is a citizen and
| their ID is valid inherently requires the system be
| accessible
| fc417fc802 wrote:
| If you can't implement it securely then perhaps such an
| undertaking wasn't a good idea? In the vast majority of
| cases I don't see why PII ever needs to be available over
| the network for remote queries. For the purpose of
| verification isn't it sufficient to verify hashes or
| better yet to attest via smartcard?
| dijit wrote:
| You _can_ , they _didn 't_; big difference.
| fc417fc802 wrote:
| By "can't" I mean "not capable" or "not going to in
| practice".
| AdamN wrote:
| Yeah the source code isn't really such a big deal aside from
| helping to find vulnerabilities. The PII is a real disgrace.
| embedding-shape wrote:
| Seeming by other sources, it wasn't really information
| considered PII in Sweden (but would in other places), I'm not
| sure this is as a big deal as people try to make it out to
| be.
| worldsayshi wrote:
| I wonder if the focus on source code makes Swedish news slower
| to jump on this. I haven't seen it in domestic news yet.
| (Haven't looked too wide though)
| ACS_Solver wrote:
| I saw it on SVT a few hours ago. DN and Expressen have also
| reported. The details about what exactly it is that got
| leaked are unclear (some report it's basically the code and
| certs responsible for BankID SSO) but this is certainly being
| reported domestically.
| worldsayshi wrote:
| In Aftonbladet comments from CGI they seem to think that no
| production related data has been leaked:
|
| https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-
| uppg...
| yaris wrote:
| As if it ever happened that a breached company admitted
| immediately that they've just been fucked.
| zyberzero wrote:
| But a copy of production data in the test environment
| isn't production data... It's test data! :)
| einr wrote:
| _some report it 's basically the code and certs responsible
| for BankID SSO_
|
| No. CGI has nothing to do with BankID.
|
| IMO the most credible reports suggest that the source code
| and data involved are related to these four services:
|
| https://www.cgi.com/se/sv/business-process-
| services/e-tjanst... "Mina engagemang offers a user-
| friendly and flexible solution that allows your customers
| to manage their cases directly through a personal portal.
| Here, users can view, track, and interact with their
| ongoing cases, which enhances both transparency and
| efficiency in the communication process." -- some kind of
| ticket/case management system for gov't agencies
|
| https://www.cgi.com/se/sv/business-process-
| services/elektron... "With our secure end-to-end e-ID and
| eSign services, we can help you streamline document and
| contract management, gain access to all desired e-ID
| issuers, and improve cost efficiency." -- this sounds like
| a bad thing to compromise, but is to the best of my
| understanding a system for digital signatures on documents,
| and has no relation to BankID
|
| https://www.cgi.com/se/sv/business-process-
| services/e-tjanst... "Gain better control over your
| organization's representatives with our easy-to-use
| representative registry. By automating the identification
| and verification of representatives, you'll gain a clear
| overview and enhance the security of your processes." --
| sounds like some bullshit CRUD app for managing who can
| "represent" a gov't agency
|
| https://www.cgi.com/se/sv/business-process-
| services/e-tjanst... "SHS is Sweden's common standard for
| information exchange, enabling secure and efficient
| communication between government agencies, businesses, and
| organizations." -- this might be bad if real data was
| leaked
|
| These are _services used by various Swedish government
| agencies_ and it 's pretty bad to have even a test instance
| of them hacked, but let's calm down. The entire Swedish
| state has not been compromised here.
| jonashus wrote:
| > CGI has nothing to do with BankID
|
| That's incorrect. Skatteverket used CGI for BankID-login,
| I don't know if they still do. I have personal experience
| working on a BankID-login using CGI for another company
| and it is still active.
|
| Edit: I just confirmed Skatteverket still uses CGI for
| BankID-auth. "funktionstjanster" is CGI.
| einr wrote:
| OK, let me rephrase that: CGI, while they may "have
| something to do" with BankID in the sense that they have
| developed systems that integrate with it, does not itself
| develop BankID and does not hold any private keys for
| BankID.
| jetsetman192 wrote:
| Encryption keys are mentioned as well.
| ptx wrote:
| What does "electronic signing documents" mean? Keys used for
| signing? Or merely some documents that were signed with
| electronic signing?
| nunobrito wrote:
| If that is case, then it would have been wrong from the
| beginning for any government to keep hold of the private keys
| for the signature on my citizen card.
|
| Because in that case they can sign documents on my behalf
| without my permission. In a court case, it would be near
| impossible for me to prove that the government gave my
| private key to someone else and that it wasn't me signing an
| incriminating document.
| ptx wrote:
| I apparently didn't phrase that very well. If what is the
| case? I was trying to ask which case was the case, not
| trying to claim that something specific was the case.
|
| I'm familiar with electronic signatures, and I know what
| documents are, but I have never heard the phrase
| "electronic signing documents" and don't know what that is
| supposed to mean. What kind of documents? Documents _about_
| signing, documents that _were signed_ , documents in the
| sense that files containing keys could be considered
| documents, or what?
| nunobrito wrote:
| In Portugal we were early adopters for digital signatures
| on citizen cards.
|
| You use the card reader, insert your gov-issued
| identification and can sign PDF papers which have legal
| validity since the private key from the citizen card was
| used.
|
| Now imagine someone signing random legal documents with
| your ID for things like debts, opening companies or
| subscritions to whatever.
| pastage wrote:
| Signed documents can be as simple as an ID of the
| transaction, a statement in text, PII data that identify
| what you sign, or a store of larger PDF files for
| download and verification. We do not know. I base this on
| how signing works technically in Sweden.
|
| CGI is not the only supplier of these services.
| whizzter wrote:
| We might've lucked out here, there is some signature data
| on ID cards today and official _plans_ to make a government
| backed signing service, but practically _nobody_ uses them
| in practice to just revoking all those keys will be a minor
| issue.
|
| Currently most Swede's use a private bank consortisum
| controlled ID solution for most logins and signatures.
| einr wrote:
| To the best of my understanding it means that a system made
| by CGI for digital signing of documents (as in: you get
| something like a PDF from a government agency and need to
| digitally sign it and send it back) has had its source code
| and/or some data belonging to it leaked.
|
| Skatteverket, the Swedish tax authority, has been quoted in
| media as confirming that they use CGI's system for digital
| document signing but that none of their data nor that of any
| citizens has been leaked.
|
| https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-
| inform...
|
| "One of the government agencies that uses CGI's services is
| the Swedish Tax Agency, which was notified of the incident by
| the company. However, according to the Swedish Tax Agency,
| its users have nothing to worry about.
|
| "Neither our data nor our users' data has been leaked. It is
| a service we use for e-signatures that has been affected, but
| there is no data from us or our users there," says Peder
| Sjolander, IT Director at the Swedish Tax Agency."
| ptx wrote:
| So if no data was leaked from the tax agency or from the
| users, then the leaked "digital signing documents" must
| have belonged to the only remaining party, which is CGI, so
| perhaps they were just some marketing documents about the
| benefits of their digital signing service?
| einr wrote:
| The original phrasing from the attacker, from the website
| that put the data up for download/sale, was "documents
| (for electronic signing)" which implies that they're
| documents that would be signed in said system. I would
| take all of this with a large helping of salt though. CGI
| claims it's not real production data anyway; maybe it is
| and maybe it's not.
|
| The best case scenario is in line with what CGI claims:
| these are lorem ipsum fake docs from an old git repo for
| a test instance of the system.
| teroshan wrote:
| Does anyone know if there is the source code for the Swedish
| Armed Forces - Team Test [1] in the leak? It was a really fun
| collaborative flash-style game that got popular in my circle of
| friends for some reason back then.
|
| [1] https://flashism.wordpress.com/2010/03/09/swedish-armed-
| forc...
| steve1977 wrote:
| Is this the open source stuff everyone is talking about?
| rebolek wrote:
| Maybe they should go open source from the start, then there's
| nothing to leak.
|
| P.S.: And strangers will sometimes help you find vulnerabilities
| (and sometimes be very obnoxious but that's not open source's
| fault).
| ZaoLahma wrote:
| Yeah. In these cases it's not like anyone is going to spin up
| their own instance and start competing with you.
|
| Government / handles society-critical things code should really
| be public unless there are _really_ good reasons for it not to
| be, where those reasons are never "we're just not very good at
| what we're doing and we don't want anyone to find out".
| matsemann wrote:
| When I worked for the government in Norway, it slowly changed
| to all code being developed in the open. 3k repos here now:
| https://github.com/orgs/navikt/repositories
|
| When I started it was a big security theater. Had to develop on
| thin clients with no external internet access, for instance.
| Then they got some great people in charge that modernized
| everything.
|
| Only drawback is when you quit, you have to make sure to
| unsubscribe from everything, hehe. When quitting a private
| company I was just removed from the github org. Here I was as
| well, but I was still subscribed to lots of repos, issues,
| PRs,heh.
| jmusall wrote:
| Very cool! Do they accept external contributions, e.g. from
| Norwegian citizens? Also, was there any thought given to
| "digital souvereignty" (wondering because the repos are
| hosted on a US service)?
|
| I'm also surprised that you were able to (or expected to?)
| use your private GitHub account for your work.
| matsemann wrote:
| Not sure how it is now, but when I worked there ~8 years
| ago we weren't really equipped to accept contributions.
| Both from a licensing perspective (CLA), but also that we
| had our own timelines, projects and prioritizations in the
| team. So most applications were open source more in the
| sense of source available. Some utils (like generators for
| Norwegian mock data, or libraries handling Norwegian
| addresses or whatever) that were actively used by other
| companies could get some proper contributions once in a
| while, though.
| Lionga wrote:
| How much GDPR fine will they pay? Oh wait it's gov so nothing /
| does no matter even if.
|
| Who will take responsibility and get fired and lose all pension
| etc.? Oh wait no one.
|
| Well the citizens need to suck it up.
| Habgdnv wrote:
| Few years ago a huge NRA database was left public with
| admin/1234 or similar by the Bulgarian NRA. They government
| fined itself some non-trivial amount, then in the
| source/destination IBAN they put the same value and paid the
| fine. They managed to find someone to blame and it was not the
| person who left the database but the person who found it. Turns
| out that if you leave the PII of a whole country open to the
| public it is not your fault and you get to keep your cozy job.
| It is already unlawful to access that, so if someone access it
| - it is his fault - he broke the law.
|
| Edit, i checked the facts: The Bulgarian government said that
| the it should pay too much to itself, and appealed the fine for
| few years until it somehow expired. And the guy (20 year at
| that time) they accused was later acquitted after they tried to
| ruin his life.
| the_other wrote:
| As the attack actor now has the data, they're liable for
| ongoing GDPR failures, on top of the theft. Then anyone they
| sell the data to becomes liable (on top of handling stolen
| goods). Could be a money-earner for the EU if they pursue it
| properly.
| noosphr wrote:
| I like paper documents for this very reason.
|
| It's very hard to steal everyone's documents when they weight
| about the same as a train.
| latexr wrote:
| But it's also very easy to lose all of them in a fire or flood.
| Different tradeoffs.
| HelloUsername wrote:
| > it's easy to lose all of them in a fire or flood
|
| Wouldn't a fire or flood affect everything? Both data stored
| on paper and hard disks?
| jagged-chisel wrote:
| The good news is you can keep offline, offsite digital
| copies, which is much more convenient than offsite paper
| copies.
| Gabrys1 wrote:
| I think what the comment meant was that it's harder for an
| individual to lose their paper documents compared to losing
| the electronic ones. It just shifts who's responsible for
| keeping them safe
| bell-cot wrote:
| Problems with well-known solutions 100 years ago:
|
| "Fireproof file rooms and cabinets in the 1920s were crucial
| for protecting business and government records during the
| rapid expansion of the industrial era. The era saw a massive
| shift from flammable wooden office furniture to robust,
| steel-based storage designed to resist both fire and water
| damage."
|
| That's a Google AI summary - but I've been in a fair number
| of buildings with such rooms. Thick concrete walls, heavy
| steel fire doors, no other openings, _nothing_ but steel file
| cabinets in 'em, sealed electric light fixtures that look
| like they belong in a powder magazine (where one spark could
| kill everyone) - it's really simple tech.
|
| And "high ground" was a reliable flood protection tech
| several centuries before that.
| latexr wrote:
| Then add "earthquake" to the list, or "domestic terrorists
| or foreign country bombing the building". Steelman the
| argument. The point isn't "just fire and water
| specifically", we're not playing Pokemon.
|
| We have several historic examples of records being lost in
| disasters, and way more recent than 100 years ago.
|
| https://en.wikipedia.org/wiki/National_Personnel_Records_Ce
| n...
|
| It makes no difference that we could've prevented that with
| better building construction. We didn't, and hindsight does
| not bring the records back. We should plan for the world we
| want but cannot ignore the world we have.
|
| I'm not defending digital as always better or criticising
| physical. Like I said, _different tradeoffs_ , meaning
| there are advantages and disadvantages to both, there's no
| solution which is better in all situations.
| bell-cot wrote:
| I stuck to the threats you mentioned. Paper in a file
| room is more slightly more quake-resistant and bomb-
| resistant than digital. But slower to move to safety if
| the threat is large volcanic eruptions.
|
| I am not saying that paper is magically perfect. Nor
| better in every situation. I am saying that paper is far
| easier (than digital) to do well _for use cases like a
| national records collection_. "Correctly" may include
| off-site backups - whether or not your threat model
| includes massive earthquakes, volcanoes, bombs, special
| forces, EMP weapons, biological agents, civil war,
| radioactive fallout, or enemy occupation. Or "Management
| wouldn't pay for a done-right facility".
|
| As I noted in another comment, the largest downside to
| paper ( _within_ such use cases), is that it is far more
| difficult to get political support for old-fashioned
| stuff that just works, compared to anything that can be
| sold as cool /new/high-tech. Especially when the
| taxpayer-funded revenue streams from
| selling/installing/supporting the tech create incentives
| clearly contrary to the taxpaper's long-term interests.
| noosphr wrote:
| This is a feature not a bug.
| latexr wrote:
| That depends entirely on what the records hold and who is
| interpreting the event.
| noosphr wrote:
| Yes, who could ever care about German birth records from
| the 1700s in 1933?
| bell-cot wrote:
| No politician ever got elected by supporting simple, old-
| fashioned stuff that just worked.
| JensRantil wrote:
| I am a Swedish citizen. Lived here for almost 40 years. It is a
| bit unclear to be what the "the Swedish e-government platform"
| is. Would have been great if they at least could have published
| which domain name the service has.
| yaris wrote:
| I would guess that skatteverket.se, polisen.se, kronofogden.se
| are among those affected by the leak.
| brabel wrote:
| Some other comments mention BankID private keys . That would
| be the biggest disaster as that's what everyone uses to
| identify themselves "securely" on all government services.
| mrkickling wrote:
| The private keys in BankID are stored in users phones, not
| centrally.
| fmbb wrote:
| Well doesn't Relying Parties using the BankID API for
| signatures and authentication have private keys to start
| the flows for users scanning QR codes etc?
|
| Could you, having the right private keys, impersonate
| some company soliciting a BankID signature?
|
| I'm not sure what you can do with that though. You cannot
| steal some other ongoing signature I guess.
| pastage wrote:
| You can start a signing process saying you are who ever
| owned that certificate. E.g. if you call someone. You can
| not use those signatures to gain access, and it is rather
| in phishing.
| einr wrote:
| That's an interesting _guess_ that I assume is based on
| absolutely nothing?
| yaris wrote:
| Yes, nothing and the facts that these are government
| services, they use BankID and they updated their websites
| with "maintenance work" announcements for tomorrow,
| Saturday. For kronofogden.se there was no maintenance
| planned just half an hour ago. Knowing swedish tendency to
| plan things months ahead I would _guess_ that this
| maintenance work has been rushed due to some circumstances.
| einr wrote:
| It's quite possible that the maintenance is related, but
| I can nearly 100% assure you this has absolutely nothing
| to do with BankID. I don't know who suggested that but
| they are either poorly informed or actively trying to sow
| FUD.
| reliablereason wrote:
| Nothing in particular, based on my understanding CGI a Swedish
| IT consultant company was hacked, they have contracts for and
| are the maintainers and developers of a bunch of various
| government departments IT services.
| einr wrote:
| It's not going to be a specific service or agency with a domain
| name, it's going to be services that are either internal and
| used by employees only, or that are integrated into other
| systems that you may be interacting with without knowing it.
| lysace wrote:
| There is no such thing according to Peder Sjolander, IT
| Director at the Swedish Tax Agency:
|
| https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
|
| _- Neither our data nor our users ' data has been leaked. It
| is a service we use for e-signatures that has been affected,
| but there is no data from us or our users there, says_
|
| _The information that source code was leaked from a joint
| government e-platform is not true, according to Peder
| Sjolander._
|
| _- There is no such platform. I think the perpetrators in this
| want people to feel insecure. We feel confident that our data
| is safe and we have the situation under control before the tax
| return period opens next week._
| corroclaro wrote:
| This keeps happening in Europe with these mega-IT suppliers
| repeatedly getting exposed using very bad development practices.
| Sweden most recently had a major breach back in 2024 when the
| other large IT services supplier TietoEvry had their data centres
| breached and claimed "not actually an issue of security".
|
| Several government organisations / regional authorities and
| companies were down. Last I heard several medical journals for
| whole municipalities were just destroyed.
|
| Unfortunately, the public tender process encourages awarding
| contracts to these giants that repeatedly fail to deliver on even
| basic opsec and still believe in security-by-obscurity, are
| suspicious of things like zero-trust, follow outdated engineering
| practices. Sigh.
| bengale wrote:
| The tender process is what they are optimised for. They are
| professional project bidders with a bit of outsourced software
| development bolted on the back.
| Maxion wrote:
| A lot of outsourced development.
|
| The tender process + clueless buyers + tender process law(s)
| cause this. Whole process needs a revamp for this to not be a
| problem.
| vladms wrote:
| > Unfortunately, the public tender process encourages awarding
| contracts to these giants that repeatedly fail to deliver on
| even basic opsec and still believe in security-by-obscurity
|
| So what you think would be the solution ? From what I see (both
| public tender or not), I would claim that "any large IT
| project/company will suffer from security issues", so not sure
| what is the added value to single out a process (the tender) or
| a region (Europe) if there is no obvious alternative.
| xorcist wrote:
| I have (the start of a) solution, but it's a boring one:
|
| You have to have people who care about this stuff.
|
| If you don't care, the rest does not matter. It does not
| matter if, when and how you outsource if you don't care about
| the outcome. You can't just pay someone a salary, nor a
| consulting bill, check the box and say you've done your part.
|
| And the other way around: These huge consulting conglomerates
| would get very few jobs if purchasers cared about the
| details, and not just that all the boxes are checked.
| dns_snek wrote:
| I don't think that's a particularly novel idea, the
| question is how do you get people who care in an
| organization that has hundreds of thousands of employees
| (the public sector)?
| xorcist wrote:
| You may not like the trivial answer: The same way as we
| do everything else. How do we get people to show up for
| work? How do we get people to respect data security
| boundaries? None of these are questions of technology.
| The answer is culture. We need to create a strong shared
| culture of caring, by hiring people that care and putting
| them in an environment where caring is appreciated.
| latexr wrote:
| > You have to have people who care about this stuff.
|
| What?! Preposterous! How could you even make money out of
| that? No no no, that will not do. You will ask your AI
| agent some vague question, commit the result without review
| and push it to the client. And you'll like it. If there's
| any trouble, call Timothy, he'll be on vacation with his
| family in Thailand. Some resort, "Lotus" something or
| other.
| mvdwoord wrote:
| Germany has iirc liability for the entire chain (engineers to
| upper management) in case of data breaches. I remember having
| to sign for that when I did a project in Germany. Would that
| help? I would not mind if the CEO/CTO of Odido would spend a
| couple of years in a federal pound them in the ass prison if
| it is found out the leak was due to malpractice.
| ExoticPearTree wrote:
| Split giant projects into small ones, award it to better
| smaller companies, require interoperability via API that is
| clearly documented and ask for around the clock security
| monitoring and patching. The last things being the same thing
| you do at any decent private company.
|
| IBM or Accenture or whoever don't need to be the only ones
| winning tenders.
| vladms wrote:
| The total number of people working on the project might
| remain similar no matter if it's one company or many
| smaller companies. Writing clear documentation and API,
| well thought from the start is harder the larger the
| project.
|
| Maybe there would be a benefit from having less layers of
| management, but multiple small companies or one big could
| have the same structure.
| corroclaro wrote:
| Absolutely. One of the root causes for these terrible tender
| processes is a fear of in-housing competence and skill for
| systems.
|
| It's the same reason major govt. IT orgs keep pushing for
| closed source (recently the Swedish Tax Authority was in the
| media for _pushing for Office 365_ as necessary for
| operations), out-sourced designs, big firm purchases over
| FOSS or real standards.
|
| You need people that care (and they exist, even in the
| gigantic state orgs.) in positions to make good decisions.
| Right now, everything is up in the hands of nebulously
| defined managerial staff with none-to-doubtful technical
| competence.
|
| Another recent case: the Swedish digital exams platform
| flopped at a rough cost of a billion SEK. Can't sustain 150K
| concurrent users, despite paying a "large company". Like,
| come on.
| ExoticPearTree wrote:
| The probleme here is that what tends to happen is that the
| security requirements are relatively vague and once the
| customer has signed the acceptance, good luck.
|
| And signing up with a big company is good way to cover your
| behind, because "if they with all their people and knowledge
| could not do it...". Basically the mantra or "Nobody was ever
| fired for buying Cisco".
| blin2h wrote:
| What forum is the original screenshot from? It reminds me of
| cs.rin.ru
| agluszak wrote:
| e-government services should be open-sources by default!
| nunobrito wrote:
| Now there is an additional reason for that.
|
| Public money, public code.
| wasmitnetzen wrote:
| Swedish news has some quotes from authorities that nothing of
| value has been leaked, and a quote from the service CGI that it
| only concerns test servers.[1][2]
|
| [1]: https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-
| inform...
|
| [2]: https://www.cgi.com/se/sv/news/cybersakerhet/cgi-
| informerar-...
| whizzter wrote:
| As a Swede this is giving me shudders, the statements reeks of
| paper-pushers and certification-chasers that don't seem to
| understand fundamental risks of how how threat actors can move
| around once having established footholds, hopefully there's
| more competent people down in the trenches.
| cactusplant7374 wrote:
| Are we allowed to vibe code some positive changes and submit
| them for review?
| sandos wrote:
| I dont know nothing about this particular leak, but I have
| worked at Skatteverket.
|
| Let me just say, the likelihood that CGI would have any
| _actual_ real personal data is close to 0%, at least on servers
| outside of Skatteverket. I had access to absolutely nothing
| even working inside. I have never worked in a more closed-down
| system, maybe excepting the swedish military "complex". No,
| actually that was less locked down in a way, at least once you
| were "inside" the system.
| yaris wrote:
| Knowing swedish people's mindset I'm not surprised at all by the
| breach. What can be mildly surprising is that no major e-gov
| service has expressed concerns on their websites. Only on
| skatteverket.se, which is Swedish Tax Service website, there is a
| vague note on "maintenance work" planned for coming Saturday.
| Maybe totally unrelated though.
| queuep wrote:
| Interesting, care to elaborate?
| corroclaro wrote:
| I'm pretty sure they did an internal analysis by 8 AM at all
| these places and came to the conclusion that they're OK.
|
| Of course, they might be wrong!
| WhereIsTheTruth wrote:
| As long as cronyism remains the primary qualification for
| leadership, nothing will ever change, worse, it's only going to
| get worse
|
| Accountability now, send these people to prison
| elwebmaster wrote:
| Anything taxpayer funded should be open source to begin with.
| fsflover wrote:
| https://publiccode.eu
| teroshan wrote:
| Similarly taxpayer funded contracts for any type of
| infrastructure (obviously I have digital infrastructure powered
| by proprietary solutions in mind) should only be awarded if
| interoperability is guaranteed to prevent lock-in and abuse.
| wayfwdmachine wrote:
| Ok, some important context for non-Swedes. Anyone can get access
| to all Swedish (non-protected but those are a very VERY small
| subset) personal identification numbers by simply signing an
| agreement with SPAR[1] (the Swedish national people database).
| Identification numbers per se are not particularly useful or hard
| to get, they are effectively public information. Using SPAR you
| can also get the home (and any additional) addresses of
| individuals
|
| A Swedish citizen database is... you know. fun. But not exactly
| hard to get hold of.
|
| [1]
| https://www.statenspersonadressregister.se/master/start/engl...
| petcat wrote:
| > by simply signing an agreement with SPAR
|
| But that seems like a completely different thing than a
| nefarious and anonymous person or group having access to the
| entire database.
| wayfwdmachine wrote:
| Yeah, nefarious or anonymous people have never used the
| internet so they could never find out that this was all
| public information.
| petcat wrote:
| public information if they signed an agreement with the
| Swedish government?
| einr wrote:
| No, public information for anyone. You realize that if
| it's public information, then it's public, and anyone can
| re-publish it online? There are websites for that. I can
| get the complete identification number, home address,
| phone number, etc for any Swedish citizen (that does not
| have a protected identity) in less than a minute.
| petcat wrote:
| You can get all of that one-by-one? Or can you get the
| whole database at once?
| einr wrote:
| I cannot trivially get the whole database, no. But I kind
| of fail to see what a malicious actor would do with a
| large database of public information that they couldn't
| otherwise do. The system is designed such that you can't
| really do a lot of malicious stuff with just public data,
| and the stuff you can do (scam calls, etc) is probably
| not meaningfully more effective if you have the whole
| database than if you do manual lookups or web scraping.
| I'm open to being proved wrong about that however.
|
| Basically: obviously it's not _desirable_ to have that
| full database in the hands of a malicious actor but I 'm
| not sure it's such a big deal either. Again, it's public
| data by design.
| hrimfaxi wrote:
| In the US, property tax records are public by design.
| However, historically the records were physical and hard
| to search through. Now that these records are digitized
| and published online, it is trivial to find out where
| someone resides by searching through these records. So
| while public by design, at scale data aggregation changes
| the threat model.
| picafrost wrote:
| I think this is good to highlight for non-Scandinavians.
|
| Scandinavian countries are extremely open and transparent in a
| way that might be shocking for Americans. For example, in
| Norway, I can check nearly anyone's brokerage account holdings,
| addresses, phone numbers, etc. on public websites. I can in
| theory look up anyone's tax filings.
|
| Personal identification numbers do not tend to be considered
| private in the same way that social security numbers in the US
| are.
| ahoka wrote:
| Not open but stupid, IMHO.
| whynotmaybe wrote:
| I heard a rumor that some people use this to check their
| neighbour's revenue and sometimes make snark comments if one
| of them has a high revenue but lives in a "average revenue"
| part of town.
|
| They'd say that if you earn a lot, you shouldn't take a cheap
| housing.
|
| Any truth to that?
| sorum wrote:
| Yep, that tracks.
|
| There's also the underlying current of Jantelagen (Law of
| Jante) https://en.wikipedia.org/wiki/Law_of_Jante
| internet_points wrote:
| Making snark comments about that sounds very unlikely. More
| likely they'd have respect for someone living frugally and
| not showing off. See
| https://en.wikipedia.org/wiki/Law_of_Jante
| ale wrote:
| Yes and no. You get notified if someone else actually asks
| for your revenue info and so in practice nobody actually
| does it.
| arcticfox wrote:
| Is this not trivial to get a random person to check stuff
| for you in exchange for making requests for them (on
| people they are interested in)? Or is that illegal?
| vodkapump wrote:
| There's paid services that pull it for you, most charging
| around 100nok (10eur) per lookup.[1]
|
| Media is also allowed to pull "top" lists like the 100
| people with the most income in a city, 100 people with
| the most wealth in a city, etc.
|
| [1] https://sjekkskatt.no/
| kivle wrote:
| There used to be a lot more of that, but a system was put
| in place where you have to identify yourself with
| electronic ID to access the information, and the
| information is logged so the other party can see it.
|
| Nowadays I think mostly journalists use it to pull up
| information about politicians and other people that are in
| the public spotlight. There are of course the yearly
| "richest people in Norway" lists in various categories.
| embedding-shape wrote:
| > There used to be a lot more of that, but a system was
| put in place where you have to identify yourself with
| electronic ID to access the information, and the
| information is logged so the other party can see it.
|
| Yeah, kind of a fake solution, request it via Ratsit or
| whatever and all they get to see is that someone used
| Ratsit, but not who actually requested it.
|
| Same goes for criminal cases, using Krimfup or whatever
| just leads to the service's name "leaking", while you can
| use fake details to sign up for both Ratsit and Krimfup.
| ruszki wrote:
| What is the harm in this case? Shit people are shit even
| without information. They would be snark about something
| else then.
| whynotmaybe wrote:
| I think it was covered during a discussion about
| immigrants that are easily rejected - because they're
| immigrants.
|
| The points was that it added another layer of issues for
| immigrants because they didn't understand the
| neighbourhood they "should be living in" with their
| revenue.
| ruszki wrote:
| Why is this not the "shit people do shit things"
| category? This happens even without being immigrants.
| Large part of my family lives in a way poorer
| neighborhood than what we can afford, because we don't
| care to move. People who have problem with this had other
| problems even before we got richer. There is exactly zero
| difference. The exact same people are snark as before,
| just for something else now. They were and would be snark
| even without this.
|
| This seems to me a very bad attempt to hide xenophobia.
| heraldgeezer wrote:
| We don't talk to our neighbours.
| embedding-shape wrote:
| > They'd say that if you earn a lot, you shouldn't take a
| cheap housing.
|
| I think a lot of "humbleness" is also enforced this way, in
| the US seems normal (or even some European countries) to
| flaunt your wealth, and others seem more or less OK with
| it, while in Sweden it's much more socially unacceptable to
| in any sort of way brag about being rich, or showing that
| off. Humble-richness is OK and tolerated, but flagrantly
| displaying your wealth among the public is generally
| frowned upon.
|
| So together with that, living in a average neighborhood but
| have a house that sticks out as clearly "rich person's
| house" will gain you evil looks from your neighbors, as
| you're "supposed to" live in a different neighborhood where
| neighbors look more equal, otherwise you again stick out,
| which is cause for friction culturally.
|
| Lots of culture in Sweden is less about "lets correctly
| solve the problem" and more "lets ensure the gaping holes
| aren't so visible for everyone, so we can ignore it
| properly".
| torginus wrote:
| I have a friend who has moved to Sweden a while ago, and
| she told me a lot about the Swedish housing situation,
| and admittedly most if it went over my head, but in
| short, apparently very few places would even allow you to
| build even somewhat freely.
|
| Apparently she was in a situation where she 'owned' her
| house, but still paid a monthly maintenance fee to some
| agency. and she wasn't allowed to repaint the rooms or do
| any sort of repairs, but had to go through some agency,
| who would do it for her.
|
| Apparently that was a neighborhood thing, but she told me
| of epic (and apparently fruitless) struggles of her
| friends' who wanted to repaint their house in a different
| color and install some circular windows.
| lysace wrote:
| Take a step back.
|
| What, exactly is the connection between your uninformed
| story and the incorrect - and not unlikely Russo-Iranian
| propaganda HN post we are in?
| alentodorov wrote:
| what
| lysace wrote:
| Yup
| torginus wrote:
| Hold on, I was sharing an anecdote from a friend living
| in a foreign country, and somehow you're somehow
| connecting this to a dastardly geopolitical plot by a
| league of evil nations?
|
| Also may I ask who the heck you are to call my story
| uninformed? As far as I recall, there's nothing
| inaccurate about what I said, I might be missing some
| context or nuance, but there's no disinformation in
| there, and there's certainly no hidden motive (what would
| even that be?) you seem to imply.
| lysace wrote:
| "and admittedly most if it went over my head"
|
| "Apparently she was in a situation where she 'owned' her
| house, but still paid a monthly maintenance fee to some
| agency."
|
| (This is not the norm. I can go into a lot more detail if
| you want to.)
|
| I am not accusing you of disinformation. I am saying that
| are writing completely irrelevant stuff in a story that
| is, as far as I can see is mostly false and has a high
| probability of being propaganda related to current
| conflicts.
|
| And yes, dozens of other people did the same.
| patall wrote:
| Probably just didn't really buy the house. Many houses
| are part of an association (BRF). When you buy one, you
| practically only buy the right to live in the house plus
| a share of the entire association. The fee that she paid
| was towards that association for things like
| maintainance, managment, trash-fees, internet, parking,
| likely heating and water, and possibly interest on the
| associations loan. It's just a different structure that
| many countries have for flats in a building, in this case
| applied to single family houses.
| daneel_w wrote:
| Making snarky comments about it, no, not really. Will some
| people snoop around? Yes, nosy people can be found
| everywhere.
| ROllerozxa wrote:
| And then there are widespread amounts of identity theft and
| mapping out of minorities, but you may sleep well as everyone
| knowing where you do so is an important step in making sure
| corruption is no more, don't think too much about it.
| Batman8675309 wrote:
| Just a few years ago this was about to change in Sweden.
|
| But they didn't change it, because "women should be able to
| look up the men that they date".
| ROllerozxa wrote:
| Oh yes. I'm Swedish and I do have to admit I have looked
| up quite a lot of people on these kinds of sites. It's
| become so normalised to do this even though I also feel
| like it would be better as a whole if they just did not
| exist in the first place.
|
| Last update I heard about something being done about it
| was this:
|
| https://www.regeringen.se/pressmeddelanden/2024/11/utredn
| ing...
|
| Not sure what the current status is.
| kivle wrote:
| We're so open, we even leak our government source code
| _ourselves_ https://github.com/navikt
| valzam wrote:
| Uff, COBOL written in Norwegian, talk about a narrow target
| to hit for hiring :)
| scottyah wrote:
| Who needs a Jones Act when you can have processes like
| these?
| deepsun wrote:
| I see mostly Java/Kotlin and Maven.
|
| Pretty modern stack. I would start a government service
| using those today.
| kivle wrote:
| He is probably talking about this repo:
| https://github.com/navikt/DSF
|
| Description translated:
|
| > This system was one of the oldest IT systems in NAV,
| and ran in production for 51 years, from when the
| National Insurance Scheme was introduced in 1967. In
| January 2018, Presys was put into production, which
| together with Pesys became the successor to DSF. At that
| point, DSF was also shut down. The system is written in
| PL/I.
|
| It's like the Apollo 11 code, but for social services.
| ivell wrote:
| How do they have handle identity thefts, spams, etc.?
|
| There are so many ways to misuse these data. Are the
| residents not concerned about this?
| boxed wrote:
| It's just a unique ID of a person, it's not a password. I
| don't see how you can be confused by this.
| bondarchuk wrote:
| It's also "anyone's brokerage account holdings,
| addresses, phone numbers" according to the comment that
| this subthread of the conversation is about.
| SiempreViernes wrote:
| It only gives read permissions, to make any changes
| requires a password.
| ROllerozxa wrote:
| > How do they handle identity thefts
|
| By just accepting it as a normal fact of life that you will
| have some random stuff ordered in your name sooner or later
| with an invoice you'll have to dispute. Happened to a
| relative of mine, police do not care unless they order
| things above a certain value, without a police report you
| cannot get free ID protection, and then you'll have to sit
| for a long time in phone queues trying to cancel a
| subscription for a streaming service or whatever they
| ordered while get thrown around by support reps who go "you
| SURE you or someone in your family didn't order this?"
| PowerElectronix wrote:
| That sounds rather unacceptable.
| ROllerozxa wrote:
| Yes, I don't think anyone truly wants it to be like this.
| But it's just what happens.
|
| You of course cannot access and empty out someone's bank
| account this way, you're safe in that regard. But you
| need to dispute the invoices as soon as possible to show
| that it is fradulent, so you don't end up needing to
| actually pay for it. Or get debt collectors after you.
| heraldgeezer wrote:
| ^ Never had this happen in my 30 years here so YMMW
|
| So don't take this poster by their word.
|
| Not saying it DOES NOT happen as it is a system not made
| for the internet. But widespread? It is not.
| Hikikomori wrote:
| Never happened to anyone I know either.
| maest wrote:
| It basically never happens. I don't know where the GP got
| their story from.
| heraldgeezer wrote:
| I am Swedish and never had this happen to me. Never had
| random things show up or ordered for me at all. What
| would the point be, you have to pay or get an invoice?
| For Klarna they use BankID so only _I_ can order an
| invoice for myself in reputable shops.
|
| I am in my 30s btw so I was alive before BankID and it
| was a worse time. Remember my parents paid bills with
| paper.
| daneel_w wrote:
| That is absolutely not a normal fact of Scandinavian
| life. Gross exaggeration and misrepresentation.
| PeterisP wrote:
| The root cause of identity theft in USA and some other
| places is the lack of "proper" national identity and the
| associated use of various personal "secrets" (not that
| secret) for identity verification because there are no good
| easy other ways.
|
| Businesses in Scandinavia and many other countries would
| not treat someone knowing your personal information as any
| evidence of identity (because it's not); having all that
| information is not sufficient to impersonate you there -
| identity theft does happen but it would require stealing or
| forging physical documents or actual credentials to things
| like bank accounts; knowing all of what your mother or
| spouse would know is not enough to e.g. get credit or get
| valuable goods in your name.
| miki123211 wrote:
| The US has no single national photo + chip ID card that
| is available to everybody, for free, including illegal
| and semi-illegal immigrants and homeless people with no
| access to their birth certificate and such.
|
| It's completely crazy to me that you can be "out of
| status" with the USCIS and still get a social security
| card and a bank account, for example.
| eitland wrote:
| It absolutely isn't free here in Norway either, around
| $86 is what I'd have to pay now to get an id card as an
| adult (same price as a passport but easier to carry).
| concats wrote:
| Just knowing someone's name, address, and ID number isn't
| enough to like, open a bank account in their name or such.
| You'd need a proper ID card or passport for that. Similar
| thing with most businesses if you try to pay for some
| product with credit, they won't accept just a few digits
| and a pinky promise, you'll need to identify yourself
| properly (the BankID app for instance).
| guenthert wrote:
| We just change our identity every three years or so.
|
| https://www.youtube.com/watch?v=BK2gKuqbOHo
| xorcist wrote:
| "Identity theft" is newspeak right up there with
| "intellectual property". It serves the sole purpose of
| diminishing real theft. If someone says "we gave all your
| money to this other guy, but it's not our fault because he
| had stolen your identity" doesn't make it so. There are
| cases of mistaken identity, and with criminal intentions,
| but there is also an enormous majority of not checking
| identity because someone was lazy.
| stevekemp wrote:
| Which is what leads to this comedy:
|
| https://www.youtube.com/watch?v=CS9ptA3Ya9E
| daneel_w wrote:
| Unlike American SSNs, which are secret and wield certain
| authoritative powers, a Scandinavian "person number" is
| neither secret nor authoritative. Common misconception.
| victorbjorklund wrote:
| Of course ID theft happens but I think one thing that
| differs is that in Sweden it is harder to get a loan
| without verification that you are who you are (for example
| by Swedish BankID wish is an electronic id) while in US it
| seems you can take a loan if you just know someone's social
| security number
| designerarvid wrote:
| All email conversations in Swedish public institutions are
| basically a public act and any citizen can request an extract
| of them.
| einr wrote:
| _Identification numbers per se are not particularly useful or
| hard to get, they are effectively public information_
|
| They are absolutely trivial to get. One click on mrkoll.se.
| lysace wrote:
| That might be interesting but it's also completely irrelevant
| since no PII was actually leaked.
|
| Also, no source code of "Swedish e-government services" was
| leaked since that is not a thing:
|
| https://news.ycombinator.com/item?id=47363966
| olalonde wrote:
| Anyone knows what their tech stack looks like?
| bkummel wrote:
| I see comments about Swedish personal identification numbers. But
| the article is about source code that's leaked, not a database of
| numbers, right? I was thinking: should government source code not
| be open source anyway?
| johnisgood wrote:
| Ideally they should be open.
| FateOfNations wrote:
| The same attackers are releasing the database of personal
| information separately (for a fee).
|
| That said, Sweden takes a different approach to PII, so most of
| that information would have already been public. You can
| generally just look up any resident and their ID number and
| other biographical details in a public directory (among other
| things... their tax returns are also public records).
| FpUser wrote:
| Unless they hardcode passwords and other juicy details in their
| source code what's all the fuzz about? It is a publicly funded
| thingy anyways.
| hollow-moe wrote:
| "Government surprisingly fulfills its duty by making publicly
| funded source code public"
| GuB-42 wrote:
| First reaction: How come the source code is not public in the
| first place, accessible to every Swedish citizen? They paid for
| it!
|
| But it turns out that more than the source code was leaked.
| Lliora wrote:
| Worked on a similar platform. The real risk isn't the code - it's
| the config files. Government deployments have hardcoded staging
| credentials, VPN endpoints, and encryption keys that don't get
| rotated when code leaks. Source is whatever. Those env files are
| the skeleton key.
| Schlagbohrer wrote:
| Why was all that software not open source already?
| vladde wrote:
| CGI has a lot of consultants in both government and municipal
| places (i've worked at both), and some of our main tools like
| time reporting was built as a addon to our personnel system by
| consultants at CGI. half my team are consultants from CGI, 4 out
| of 7 people.
|
| also: hi tavro! it's been a few years, how have you been :D
| butz wrote:
| Most important question: do Swedish e-government services use
| curl?
| PeterStuer wrote:
| Misleading title, as my first thought was "why is Sweden's egov
| not open source to begin with?".
|
| Turns out it's about data.
| Surac wrote:
| following AI corp logic that everything in the internet is open
| source we have a open source goverment in europe now
___________________________________________________________________
(page generated 2026-03-13 23:00 UTC)