The Transport Agency IT scandal — security breach, but no proven leak
The Director-General deviated from the Protective Security Act in 2015. Foreign personnel without security clearance gained access to sensitive registers. The risk was real — but proven exfiltration is absent.
The claim
"The government leaked Sweden's entire driver's licence and vehicle register to Russia."
What is supported
When the Swedish Transport Agency outsourced its IT operations to IBM in 2015, Director-General Maria Ågren issued exemptions from the Protective Security Act. Foreign personnel (in the Czech Republic, Serbia and Romania) gained access to systems containing security-classified data.
In June 2017 Ågren was convicted of negligence with classified information by Attunda District Court and fined SEK 70,000 in day fines. The government dismissed her in January 2017.
The Committee on the Constitution scrutinised the government's handling and issued criticism in report 2017/18:KU20. Two ministers (Anna Johansson and Anders Ygeman) resigned in July 2017.
What is not supported
That data was actually copied out to a foreign power.
The Security Service (Säpo) established that the risk was very serious — but proven exfiltration has not been made public. That access existed is established; that the access was used for intelligence gathering is not.
That "all" of Sweden's registers leaked.
The affected registers included the driver's licence register, parts of the vehicle traffic register, and some data linked to the Armed Forces and Säpo. Tax records, civil registration and medical records were not part of this contract.
The honest conclusion
One of the most serious known protective-security breaches in modern Swedish public administration. Those responsible were held to account — the DG was convicted, ministers resigned, the Committee on the Constitution issued criticism. But the wider story of a confirmed foreign leak is not established. The risk was real; the transfer is not.
What this teaches us
When cost savings are allowed to override the Protective Security Act, accountability effectively vanishes — until something goes badly wrong. The National Audit Office's follow-up (RiR 2019:19) shows the weaknesses are structural, not unique to the Transport Agency.
Sources
Explicitly excluded as sources: Flashback, Nordfront and anonymous blogs.
Updated 2026-07-08