2024-01-242023/24:FöU2 · p.6FöUDefence
Outsourcing and procurement
Outsourcing and procurement in the IT field
What's at stake: How outsourcing and procurement in the IT field are handled affects the security risks around sensitive information in state operations, and whether agencies have the competence and requirements needed to make safe trade-offs in procurement.
Case texts and AI reasoning are AI-translated from the Swedish originals; the Swedish text is authoritative.
What the vote decides
The question is whether the government should draw up specific guidelines to avoid outsourcing IT operations in the state sector and clearer security requirements for IT procurement, or whether the current work on information and cyber security is already sufficient.
Yes Yes — the committee proposal
The committee welcomes the measures already taken on information and cyber security, including work on a new cybersecurity strategy, a national security council and increased resources for the Government Offices, and against that background sees no reason at present to demand special guidelines against outsourcing or new security requirements for IT procurement, and the motions are therefore rejected.
No No — the reservations
Reservation 7 (V)
The reservation (V) wants the government to draw up guidelines for how outsourcing of IT operations can be avoided in state administration, and to task agencies with developing clearer security requirements for IT procurement, since outsourcing sensitive information carries security risks when short-term profit becomes a driver, and should only happen in exceptional cases, with requirements reviewed by an independent party.
Summarised from the committee report. Party labels in the summary come from the report, not from the vote.
What do the votes mean here?
Yes The committee proposal: rejecting the motions (keeping things as they are).
No Backing the counter-proposal: reservation 7 by V.
Abstain The party marks a position of its own that is not one of the two final alternatives.
What each plan points to — and how the party voted
For each party: the vote its own election manifesto and party programme point to in this case, next to how the party actually voted. A plan can only point to Yes or No; a party can also abstain.
| Plan | Vote | Confidence | Evidence | ||
|---|---|---|---|---|---|
| V | No | No 0/19/0/5 | follows the plan | confidence: high | not addressed |
| S | No | Yes 94/0/0/13 | departs from the plan | confidence: medium | not addressed |
| MP | No | Yes 15/0/0/3 | departs from the plan | confidence: medium | not addressed |
| C | No | Yes 20/0/0/4 | departs from the plan | confidence: medium | not addressed |
| L | No | Yes 12/0/0/4 | departs from the plan | confidence: medium | derived |
| KD | No | Yes 16/0/0/3 | departs from the plan | confidence: medium | not addressed |
| M | No | Yes 60/0/0/8 | departs from the plan | confidence: medium | derived |
| SD | No | Yes 62/0/0/10 | departs from the plan | confidence: medium | derived |
Committee proposal
The Riksdag rejects the motions 2023/24:415 by Jimmy Ståhl et al. (SD) amendment 6 and 2023/24:461 by Hanna Gunnarsson et al. (V) amendments 2 and 3.
Original (Swedish)
Riksdagen avslår motionerna 2023/24:415 av Jimmy Ståhl m.fl. (SD) yrkande 6 och 2023/24:461 av Hanna Gunnarsson m.fl. (V) yrkandena 2 och 3.
Riksdag decision: The Riksdag has reviewed a letter from the government concerning the National Audit Office's examination of the government's governance of society's information and cybersecurity. The National Audit Office's overall conclusion is that the government's work in this area is not effectively designed. According to the National Audit Office, strategic trade-offs and priorities for information and cybersecurity work are lacking. The National Audit Office therefore provided recommendations to the government on how the new national information and cybersecurity strategy should be designed to address the shortcomings. In its letter, the government agrees with the National Audit Office's findings. It has taken a long time to build up the National Cybersecurity Centre (NCSC). The distribution of responsibilities within the centre also makes the operations themselves difficult to manage and monitor. The Ministry of Defence has instructed a researcher to both propose how the Swedish Defence Radio Establishment (FRA) should be given main responsibility for the NCSC and to review the centre's organization and governance. The Riksdag views positively the measures announced by the government in the letter. With this, the Riksdag filed the government's letter with the records, that is, closed the matter.
Counter-proposals
- The counter-proposal wants to establish an IT disaster commission to coordinate reporting, follow-up and review of serious IT incidents with societal impact. (V) — Reservation 7
Plan vs actual vote
Every party, in chamber order: what its own plan pointed to, how it voted, and the reasoning behind both. Highlighted rows are where the two differ — but a vote that follows the plan is a result too, so the reasoning is there for every party.
The plan demands that societally important activity and infrastructure that has been privatized be taken back, that the state increase its control over infrastructure and that societal ownership is strong in key sectors such as communications; it also directs explicit criticism against increased outsourcing.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The plan demands that societally important activity and infrastructure that has been privatized be taken back, that the state increase its control over infrastructure and that societal ownership is strong in key sectors such as communications; it also directs explicit criticism against increased outsourcing. Guidelines for avoiding outsourcing of state IT operations and stricter security requirements in IT procurement follow directly from this. The plan says nothing about the committee's reasons that ongoing cybersecurity work suffices.
Original (Swedish)
Planen kräver att samhällsviktig verksamhet och infrastruktur som privatiserats tas tillbaka, att staten ökar sin kontroll över infrastruktur och att samhällsägandet är starkt i nyckelsektorer som kommunikationer; den riktar också uttrycklig kritik mot ökad outsourcing. Riktlinjer för att undvika outsourcing av statlig it-verksamhet och skarpare säkerhetskrav vid it-upphandling följer direkt av detta. Planen säger inget om utskottets skäl att pågående cybersäkerhetsarbete räcker.
- reclaim privatized infrastructuredecisive»Det är hög tid att agera och ta tillbaka den samhällsviktiga verksamhet och infrastruktur som har privatiserats.« (2022 manifesto ↗)“It is high time to act and take back the societally important activity and infrastructure that has been privatized.”
- societal ownership in key sectors»transportsystem, kommunikationer och övrig infrastruktur, finansiell sektor« (party programme ↗)“transport systems, communications and other infrastructure, financial sector”
- criticism of outsourcing»Användandet av olika former av outsourcing har ökat, vilket« (party programme ↗)“The use of various forms of outsourcing has increased, which”
- state control over infrastructure»Staten måste öka sin kontroll över infrastruktur och resurser som behövs för att genomföra klimatomställningen.« (2022 manifesto ↗)“The state must increase its control over infrastructure and resources needed to carry out the climate transition.”
The plan requires that the capacity to resist cyberattacks be strengthened, that Sweden can defend itself against hybrid attacks and espionage and that civil defence be upgraded.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The plan requires that the capacity to resist cyberattacks be strengthened, that Sweden can defend itself against hybrid attacks and espionage and that civil defence be upgraded. Guidelines to avoid outsourcing of security-classified IT operations and clearer security requirements in IT procurement are measures that fulfil these commitments, in line with the plan's opposition to short-term profit driving activities of national importance. The committee's reference to ongoing strategy work is not addressed by the plan.
Original (Swedish)
Planen kräver att förmågan att stå emot cyberattacker stärks, att Sverige kan försvara sig även mot hybridattacker och spionage och att det civila försvaret rustas upp. Riktlinjer för att undvika outsourcing av skyddsvärd it-verksamhet och tydligare säkerhetskrav vid it-upphandlingar är åtgärder som infriar dessa åtaganden, i linje med planens motstånd mot att kortsiktig vinst styr samhällsviktig verksamhet. Utskottets hänvisning till pågående strategiarbete berörs inte av planen.
- strengthened cyber-securitydecisive»Arbetet för att stärka förmågan att stå emot cyberattacker och desinformation ska stärkas.« (2022 manifesto ↗)“The work to strengthen the capacity to resist cyberattacks and disinformation shall be strengthened.”
- protection against espionage and hybrid threats»Vi måste kunna försvara oss militärt, men också mot hybridattacker, spionage och cyberangrepp.« (2022 manifesto ↗)“We must be able to defend ourselves militarily, but also against hybrid attacks, espionage and cyberattacks.”
- strengthened civil defence»Arbetet att förstärka det civila försvaret och krisberedskapen måste fortsätta« (2022 manifesto ↗)“The work to strengthen civil defence and crisis preparedness must continue”
- protection of critical infrastructure»störningar av kritisk infrastruktur som el« (party programme ↗)“disruptions of critical infrastructure such as electricity”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan warns that society relies on large-scale technical infrastructure that is vulnerable to disruption and wants Sweden to become less vulnerable and more self-sufficient, while threats to IT systems are counted as a growing security threat.
Plan documents: party programme
Reasoning and quotes
The plan warns that society relies on large-scale technical infrastructure that is vulnerable to disruption and wants Sweden to become less vulnerable and more self-sufficient, while threats to IT systems are counted as a growing security threat. Guidelines that limit outsourcing of protected IT activity and clearer security requirements in procurement follow from this, as does the demand for sharp requirements in public procurement. The demand is therefore supported in substance.
Original (Swedish)
Planen varnar för att samhället förlitar sig på storskalig teknisk infrastruktur som är sårbar för störningar och vill att Sverige blir mindre sårbart och mer självförsörjande, samtidigt som hot mot it-system räknas som ett växande säkerhetshot. Riktlinjer som begränsar outsourcing av skyddsvärd it-verksamhet och tydligare säkerhetskrav vid upphandling följer av detta, liksom av kravet på skarpa krav i offentliga upphandlingar. Kravet stöds därför i sak.
- reduce vulnerability in infrastructuredecisive»sårbar för oförutsedda störningar. Därför förordar« (party programme ↗)“vulnerable to unforeseen disruptions. Therefore”
- less vulnerable society»bli mer självförsörjande och mindre sårbara.« (party programme ↗)“become more self-sufficient and less vulnerable.”
- threats to IT systems»energibrist, terrorism och hot mot IT- och andra« (party programme ↗)“energy shortages, terrorism and threats to IT and other”
- strict requirements in procurement»redovisas öppet. Vid offentliga upphandlingar ska« (party programme ↗)“be disclosed openly. In public procurement shall”
Worldstate weighed in: Heightened threat picture against Sweden following attacks and terror threats — Sharpens the requirement for state control over protected IT activity
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan requires that civil defence and society's preparedness for war and crisis be equipped and that Sweden be equipped quickly and focusedly against external threats, which supports the requirement for guidelines against outsourcing of protected IT activities and clearer security requirements in IT procurement.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The plan requires that civil defence and society's preparedness for war and crisis be equipped and that Sweden be equipped quickly and focusedly against external threats, which supports the requirement for guidelines against outsourcing of protected IT activities and clearer security requirements in IT procurement. The plan also establishes that the rule of law must exist in the digital sphere as well. The plan is fundamentally positive about competition, which sets a limit: the limitation applies to protected tasks, not public procurement in general.
Original (Swedish)
Planen kräver att civilförsvaret och samhällets beredskap inför krig och kris rustas och att Sverige rustas snabbt och fokuserat mot yttre hot, vilket bär kravet på riktlinjer mot outsourcing av skyddsvärd it-verksamhet och tydligare säkerhetskrav vid it-upphandling. Planen slår också fast att rättssamhället måste finnas även i den digitala sfären. Planen är i grunden positiv till konkurrensutsättning, vilket sätter en gräns: begränsningen gäller skyddsvärda uppgifter, inte offentlig upphandling i allmänhet.
- equip civil preparednessdecisive»Även det civila försvaret är livsviktigt. Vi måste rusta civilförsvaret och samhällets beredskap inför krig och kris.« (2022 manifesto ↗)“Civil defence is also vital. We must equip civil defence and society's preparedness for war and crisis.”
- equip against external threats»Sverige måste rustas snabbt och fokuserat; ingen ska kunna ta vårt demokratiska samhälle ifrån oss.« (2022 manifesto ↗)“Sweden must be equipped quickly and focusedly; no one should be able to take our democratic society from us.”
- rule of law also digitally»Samtidigt måste rättssamhället finnas även i den digitala sfären.« (party programme ↗)“At the same time, the rule of law must exist in the digital sphere as well.”
- competition is fundamentally good»Offentlig verksamhet kan med fördel konkurrensutsättas för att ge det privata näringslivet möjlighet att skapa« (party programme ↗)“Public activity can advantageously be subject to competition to give private business the opportunity to create”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan establishes that acquisition of strategic assets by undemocratic or totalitarian states shall be viewed from a security policy perspective and that there is a clear risk that they will be used for political blackmail.
Plan documents: party programme · 2022 manifesto
Reasoning and quotes
The plan establishes that acquisition of strategic assets by undemocratic or totalitarian states shall be viewed from a security policy perspective and that there is a clear risk that they will be used for political blackmail. Outsourcing of protected IT activities is the same kind of dependence, and the plan requires that civil defence is strengthened at the same rate as the military. That clear requirements can be set in public procurement is also in the plan.
Original (Swedish)
Planen slår fast att odemokratiska eller totalitära staters förvärv av strategiska tillgångar ska ses i ett säkerhetspolitiskt perspektiv och att det finns en tydlig risk att de utnyttjas för politisk utpressning. Outsourcing av skyddsvärd it-verksamhet är samma slags beroende, och planen kräver att det civila försvaret stärks i samma takt som det militära. Att tydliga krav kan ställas vid offentlig upphandling ligger också i planen.
- protection of strategic assetsdecisive»odemokratiska eller rentav totalitära stater förvärvar strategiska tillgångar« (party programme ↗)“undemocratic or indeed totalitarian states acquire strategic assets”
- risk of political blackmail»Det finns en tydlig risk för att dessa utnyttjas för politisk utpressning.« (party programme ↗)“There is a clear risk that these will be used for political blackmail.”
- strengthened civil defence»Antalet anställda och värnpliktiga i krigsorganisationen ska öka, ny materiel tillföras och det civila försvaret stärkas i samma takt som det militära.« (2022 manifesto ↗)“The number of employees and conscripts in the war organization shall increase, new material shall be supplied and civil defence shall be strengthened at the same rate as the military.”
- clear requirements in procurement»offentlig upphandling ska tydliga miljö-, klimat- och hälsoskyddskrav kunna ställas« (party programme ↗)“in public procurement clear environmental, climate and health protection requirements can be set”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan requires that Sweden can meet attacks in the form of among other things cyber warfare and that the entire total defence has sufficient resources, which speaks for guidelines that limit outsourcing of protected IT activities and for clearer security requirements in IT procurement.
Plan documents: party programme
Reasoning and quotes
The plan requires that Sweden can meet attacks in the form of among other things cyber warfare and that the entire total defence has sufficient resources, which speaks for guidelines that limit outsourcing of protected IT activities and for clearer security requirements in IT procurement. The plan also requires great caution in handling personal data. That public activity otherwise should be procured in competition is a counterweight, but does not apply to protected information.
Original (Swedish)
Planen kräver att Sverige kan möta angrepp i form av bland annat cyberkrigföring och att det samlade totalförsvaret har tillräckliga resurser, vilket talar för riktlinjer som begränsar outsourcing av skyddsvärd it-verksamhet och för tydligare säkerhetskrav vid it-upphandling. Planen kräver också stor försiktighet vid hantering av personuppgifter. Att offentlig verksamhet i övrigt bör upphandlas i konkurrens är en motvikt, men gäller inte skyddsvärd information.
- capability against cyber attacksdecisive»möta angrepp från internationell kriminalitet, terrorism, cyberkrigföring« (party programme ↗)“meet attacks from international crime, terrorism, cyber warfare”
- robust total defence»Det samlade totalförsvaret måste ha tillräckliga re« (party programme ↗)“The entire total defence must have sufficient re”
- carefulness with personal data»vid hantering av personuppgifter.« (party programme ↗)“in handling personal data”
- procurement in competition»Övrig offentlig verksamhet, som inte är myndighetsutövning, bör« (party programme ↗)“Other public activities, that are not government administration, should be”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan requires an action plan with concrete measures against hybrid threats and cyberattacks, a developed cyber defence and better state support to security-sensitive activities against espionage by foreign powers.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The plan requires an action plan with concrete measures against hybrid threats and cyberattacks, a developed cyber defence and better state support to security-sensitive activities against espionage by foreign powers. Guidelines that limit outsourcing of protected IT operations and clearer security requirements in IT procurement are concrete measures of precisely that kind. The party programme moreover establishes that the state's hard core must never be negotiable.
Original (Swedish)
Planen kräver en handlingsplan med konkreta åtgärder mot hybridhot och cyberattacker, ett utvecklat cyberförsvar och bättre statligt stöd till säkerhetskänslig verksamhet mot spionage från främmande makt. Riktlinjer som begränsar outsourcing av skyddsvärd it-verksamhet och tydligare säkerhetskrav vid it-upphandling är konkreta åtgärder av just det slaget. Partiprogrammet slår dessutom fast att statens hårda kärna aldrig får vara förhandlingsbar.
- concrete measures against cyber threatsdecisive»Införa en handlingsplan med konkreta åtgärder mot hybridhot och cyberattacker« (2022 manifesto ↗)“Introduce an action plan with concrete measures against hybrid threats and cyberattacks”
- protection of security-sensitive activities»Ge företag som är engagerade i säkerhetskänslig verksamhet bättre stöd från staten att kunna möta cyberattacker, spionage och stöldförsök från främmande makt« (2022 manifesto ↗)“Give companies engaged in security-sensitive activities better support from the state to meet cyberattacks, espionage and theft attempts from foreign powers”
- stronger cyber defence»Utveckla cyberförsvaret« (2022 manifesto ↗)“Develop cyber defence”
- the state's hard core»Statens hårda kärna får aldrig vara förhandlingsbar.« (party programme ↗)“The state's hard core must never be negotiable.”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The counter-proposal wants to draw up guidelines for how outsourcing of state IT operations can be avoided and instruct authorities to formulate clearer security requirements in IT procurement.
Plan documents: party programme · 2022 manifesto
Reasoning and quotes
The counter-proposal wants to draw up guidelines for how outsourcing of state IT operations can be avoided and instruct authorities to formulate clearer security requirements in IT procurement. The plan establishes that essential parts of infrastructure and sectors of strategic and security-policy significance should be under state and strong societal control respectively, and that society's vulnerability in an increasingly digital society needs to be better evaluated. The demands thus align with the plan's direction.
Original (Swedish)
Motförslaget vill ta fram riktlinjer för hur outsourcing av statlig it-verksamhet kan undvikas och ge myndigheter i uppdrag att formulera tydligare säkerhetskrav vid it-upphandlingar. Planen slår fast att väsentliga delar av infrastrukturen och sektorer av strategisk och säkerhetspolitisk betydelse bör stå under statlig respektive stark samhällskontroll, och att samhällets sårbarhet i ett allt mer digitalt samhälle behöver utvärderas bättre. Kraven ligger därmed i planens riktning.
- state control of infrastructuredecisive»försvar och väsentliga delar av vår infrastruktur bör stå under statlig kontroll« (party programme ↗)“defence and essential parts of our infrastructure should be under state control”
- evaluated digital vulnerability»Samhällets sårbarhet behöver bättre utvärderas, inkluderat hur ett allt mer elektrifierat och digitalt samhälle påverkar utsattheten vid en kris eller störning.« (2022 manifesto ↗)“Society's vulnerability needs to be better evaluated, including how an increasingly electrified and digital society affects exposure in a crisis or disruption.”
- strong societal control of strategic sectors»andra sektorer av central strategisk och säkerhetspolitisk betydelse« (party programme ↗)“other sectors of central strategic and security-policy significance”
- increased self-sufficiency»Öka den svenska självförsörjningsgraden av kritiska produkter och varor« (2022 manifesto ↗)“Increase Sweden's self-sufficiency level for critical products and goods”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
Share and embed
Sources and documents
- The committee report on riksdagen.se (2023/24:FöU2)
- Committee report full text (HB01FöU2)
- Per-MP voting data (API)
- Case status (API)
Documents under consideration
- Motion 2023/24:1903 — Stärka Sveriges försvarsförmåga av Peter Hedberg och Malin Larsson (båda S)
- Motion 2023/24:2450 — En förstärkning av det civila försvaret och krisberedskapen av Emma Berginger m.fl. (MP)
- Motion 2023/24:2564 — Försvar och samhällets krisberedskap av Peter Hultqvist m.fl. (S)
- Motion 2023/24:2765 — med anledning av skr. 2023/24:26 Riksrevisionens rapport om regeringens styrning av samhällets informations- och cybersäkerhet av Mikael Larsson och Niels Paarup-Petersen (båda C)
- Motion 2023/24:415 — Post och it i hela landet av Jimmy Ståhl m.fl. (SD)
- Motion 2023/24:422 — En framtidsinriktad it-politik av Tobias Andersson m.fl. (SD)
- Motion 2023/24:461 — Cybersäkerhet av Hanna Gunnarsson m.fl. (V)
- Motion 2023/24:497 — En tillförlitlig, konkurrenskraftig och hållbar svensk AI-politik av Rashid Farivar m.fl. (SD)
- Motion 2023/24:880 — Granskning av svenskarnas användning av känslig teknik av Markus Wiechel och Björn Söder (båda SD)
- Regeringens skrivelse 2023/24:26 — Riksrevisionens rapport om regeringens styrning av samhällets informations- och cybersäkerhet
Source: The Swedish Parliament