Markus Naarttijärvi

Project summary

Information security from a cross-disciplinary legal perspective

Between 2010 and 2012, hackers repeatedly gained access to servers operated by the IT company Logica, where several Swedish public authorities stored large amounts of sensitive information. The attackers were able to obtain sensitive personal data from the Swedish Enforcement Authority, the Swedish Tax Agency and the Swedish Police. These and similar incidents revealed weaknesses in Sweden’s approach to information security and highlighted the challenges involved in protecting against such threats.

 

Today, public authorities increasingly rely on private IT companies to develop, host and operate their IT systems. At the same time, IT services that are essential to society are becoming concentrated among a smaller number of large providers. Much of the information created and stored in these systems is both important and sensitive. Examples include medical records and information relating to criminal investigations and intelligence activities. Previous incidents have shown that attacks on these systems can have serious consequences for both public authorities and individuals.

 

The project examines the legal responsibilities and requirements surrounding information security when publicly used IT systems operated by private companies are targeted by deliberate attacks or unauthorised access. It focuses particularly on the protection of personal data and on who can be held accountable when security measures fail. The project takes a broad approach, combining perspectives from both public and private law.