2024-01-242023/24:FöU2 · p.7FöUDefence

Cloud services

State oversight of cloud services

What's at stake: Cloud services are used for sensitive information both in everyday operations and during crisis or war, and if data is stored outside the country's borders it affects the state's ability to protect and control sensitive information and maintain capability during heightened alert.

Case texts and AI reasoning are AI-translated from the Swedish originals; the Swedish text is authoritative.

What the vote decides

The question is whether the government should take the initiative to secure state oversight and control of security-sensitive information stored in cloud services, or whether current work on information and cyber security is already sufficient.

Yes Yes — the committee proposal

The committee welcomes the measures already taken on information and cyber security, including work on a new cybersecurity strategy and a national security council, and against that background sees no reason at present to give the government a specific mandate on state oversight and control of cloud services, and the motions are therefore rejected.

No No — the reservations

Reservation 8 (S)

The reservation (S) wants the government to take the initiative to secure state oversight and control of security-sensitive information stored, or that could be stored, in cloud services and servers, pointing out that digital infrastructure and cloud services are crucial to war-fighting capability and that information is today being moved outside the country's borders.

Summarised from the committee report. Party labels in the summary come from the report, not from the vote.

VSMPCLKDMSD
YesNoAbstainAbsent

What do the votes mean here?

Yes The committee proposal: rejecting the motions (keeping things as they are).

No Backing the counter-proposal: reservation 8 by S.

Abstain The party marks a position of its own that is not one of the two final alternatives.

What each plan points to — and how the party voted

For each party: the vote its own election manifesto and party programme point to in this case, next to how the party actually voted. A plan can only point to Yes or No; a party can also abstain.

PlanVoteConfidenceEvidence
VNoAbstain 0/0/19/5departs from the planconfidence: mediumnot addressed
Sown reservationNoNo 0/94/0/13follows the planconfidence: mediumnot addressed
MPNoYes 15/0/0/3departs from the planconfidence: mediumnot addressed
CNoYes 20/0/0/4departs from the planconfidence: mediumnot addressed
LNoYes 12/0/0/4departs from the planconfidence: mediumderived
KDNoYes 16/0/0/3departs from the planconfidence: mediumnot addressed
MNoYes 60/0/0/8departs from the planconfidence: mediumderived
SDNoYes 62/0/0/10departs from the planconfidence: mediumderived

Committee proposal

The Riksdag rejects the motions 2023/24:461 by Hanna Gunnarsson et al. (V) amendment 6 and 2023/24:2564 by Peter Hultqvist et al. (S) amendment 17.

Original (Swedish)

Riksdagen avslår motionerna 2023/24:461 av Hanna Gunnarsson m.fl. (V) yrkande 6 och 2023/24:2564 av Peter Hultqvist m.fl. (S) yrkande 17.

Riksdag decision: The Riksdag has reviewed a letter from the government concerning the National Audit Office's examination of the government's governance of society's information and cybersecurity. The National Audit Office's overall conclusion is that the government's work in this area is not effectively designed. According to the National Audit Office, strategic trade-offs and priorities for information and cybersecurity work are lacking. The National Audit Office therefore provided recommendations to the government on how the new national information and cybersecurity strategy should be designed to address the shortcomings. In its letter, the government agrees with the National Audit Office's findings. It has taken a long time to build up the National Cybersecurity Centre (NCSC). The distribution of responsibilities within the centre also makes the operations themselves difficult to manage and monitor. The Ministry of Defence has instructed a researcher to both propose how the Swedish Defence Radio Establishment (FRA) should be given main responsibility for the NCSC and to review the centre's organization and governance. The Riksdag views positively the measures announced by the government in the letter. With this, the Riksdag filed the government's letter with the records, that is, closed the matter.

Counter-proposals

Plan vs actual vote

Every party, in chamber order: what its own plan pointed to, how it voted, and the reasoning behind both. Highlighted rows are where the two differ — but a vote that follows the plan is a result too, so the reasoning is there for every party.

VVänsterpartietNoAbstaindeparts from the plannot addressed

The plan wants to reclaim socially important infrastructure into common ownership, demands that public ownership is strong within communications and other infrastructure and that the state increases its control over infrastructure, and that the state ensures digital access throughout the country.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan wants to reclaim socially important infrastructure into common ownership, demands that public ownership is strong within communications and other infrastructure and that the state increases its control over infrastructure, and that the state ensures digital access throughout the country. Measures to secure the state's insight and control over security-sensitive information in cloud services follow from this. The plan says nothing about the committee's reasons that ongoing strategic work is sufficient.

Original (Swedish)

Planen vill återta samhällsviktig infrastruktur i gemensam ägo, kräver att samhällsägandet är starkt inom kommunikationer och övrig infrastruktur och att staten ökar sin kontroll över infrastruktur, samt att staten säkerställer den digitala tillgången i hela landet. Insatser för att säkra statens insyn och kontroll över säkerhetskänslig information i molntjänster följer av detta. Planen säger inget om utskottets skäl att pågående strategiarbete räcker.

  • reclaim privatized infrastructuredecisive»Det är hög tid att agera och ta tillbaka den samhällsviktiga verksamhet och infrastruktur som har privatiserats.« (2022 manifesto ↗)“It is high time to act and reclaim the socially important activities and infrastructure that have been privatized.”
  • public ownership in key sectors»transportsystem, kommunikationer och övrig infrastruktur, finansiell sektor« (party programme ↗)“transport systems, communications and other infrastructure, financial sector”
  • state responsibility for digital infrastructure»Staten måste säkerställa att det över hela landet« (party programme ↗)“The state must ensure that throughout the country”
  • state control over infrastructure»Staten måste öka sin kontroll över infrastruktur och resurser som behövs för att genomföra klimatomställningen.« (2022 manifesto ↗)“The state must increase its control over infrastructure and resources needed to implement the climate transition.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

SSocialdemokraternaNoNofollows the plannot addressed

The plan establishes that Sweden must be able to defend itself against espionage and cyber attacks and that the capacity to resist cyber attacks shall be strengthened, while the civil defence's readiness shall be built out.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan establishes that Sweden must be able to defend itself against espionage and cyber attacks and that the capacity to resist cyber attacks shall be strengthened, while the civil defence's readiness shall be built out. Measures to secure the state's insight and control over security-sensitive information in cloud services follow directly from this, since critical infrastructure must function in crisis and war. The plan also emphasises society's obligation to protect personal integrity.

Original (Swedish)

Planen slår fast att Sverige måste kunna försvara sig mot spionage och cyberangrepp och att förmågan att stå emot cyberattacker ska stärkas, samtidigt som det civila försvarets beredskap ska byggas ut. Insatser för att säkra statens insyn och kontroll över säkerhetskänslig information i molntjänster följer direkt av detta, eftersom kritisk infrastruktur måste fungera i kris och krig. Planen betonar också samhällets skyldighet att skydda den personliga integriteten.

  • protection against espionagedecisive»Vi måste kunna försvara oss militärt, men också mot hybridattacker, spionage och cyberangrepp.« (2022 manifesto ↗)“We must be able to defend ourselves militarily, but also against hybrid attacks, espionage and cyber attacks.”
  • strengthened cybersecurity»Arbetet för att stärka förmågan att stå emot cyberattacker och desinformation ska stärkas.« (2022 manifesto ↗)“Work to strengthen the capacity to resist cyber attacks and disinformation shall be strengthened.”
  • protection of critical infrastructure»störningar av kritisk infrastruktur som el« (party programme ↗)“disruptions of critical infrastructure such as electricity”
  • protection for personal integrity»Det är samhällets absoluta skyldighet att skydda friheten och den personliga integriteten« (party programme ↗)“It is society's absolute obligation to protect freedom and personal integrity”
MPMiljöpartietNoYesdeparts from the plannot addressed

The plan counts threats to IT and communication systems among the new security threats and demands that Sweden and local communities become less vulnerable and more self-sufficient, with preparedness at home against the threats identified.

Plan documents: party programme · 2022 manifesto

Reasoning and quotes

The plan counts threats to IT and communication systems among the new security threats and demands that Sweden and local communities become less vulnerable and more self-sufficient, with preparedness at home against the threats identified. To secure state insight and control over security-sensitive information in cloud services and servers follows from this, as well as from the plan's demand for protection of privacy against both state and commercial actors. The demand is therefore supported.

Original (Swedish)

Planen räknar hot mot it- och kommunikationssystem bland de nya säkerhetshoten och kräver att Sverige och lokalsamhällena blir mindre sårbara och mer självförsörjande, med beredskap hemma mot de hot som identifieras. Att säkra statens insyn och kontroll över säkerhetskänslig information i molntjänster och servrar följer av detta, liksom av planens krav på skydd för integritet mot både statliga och kommersiella aktörer. Kravet stöds därför.

  • threats to IT systemsdecisive»energibrist, terrorism och hot mot IT- och andra« (party programme ↗)“energy shortages, terrorism and threats to IT and other”
  • reduce vulnerability»bli mer självförsörjande och mindre sårbara.« (party programme ↗)“become more self-sufficient and less vulnerable.”
  • protection for privacy»Vi vill värna människors rätt till integritet och« (party programme ↗)“We want to protect people's right to privacy and”
  • strengthened civil preparedness»satsa en större andel av försvarets pengar på det civila försvaret, och öka anslagen till krisberedskap.« (2022 manifesto ↗)“invest a larger share of defense spending on civil defense, and increase appropriations for crisis preparedness.”

Worldstate weighed in: Elevated threat picture against Sweden and war in Europe — Makes state control over security-sensitive information in cloud services more urgent

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

CCenterpartietNoYesdeparts from the plannot addressed

The plan requires that civil defence and society's preparedness for war and crisis be strengthened, which directly supports demands for measures that secure the state's oversight and control of security-sensitive information in cloud services.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan requires that civil defence and society's preparedness for war and crisis be strengthened, which directly supports demands for measures that secure the state's oversight and control of security-sensitive information in cloud services. The plan also states that the rule of law must exist even in the digital sphere and that strong privacy protection is an essential part of a democratic society. The plan therefore supports the counter-proposal's demands in substance.

Original (Swedish)

Planen kräver att civilförsvaret och samhällets beredskap inför krig och kris rustas, vilket direkt bär kravet på insatser som säkrar statens insyn och kontroll över säkerhetskänslig information i molntjänster. Planen slår också fast att rättssamhället måste finnas även i den digitala sfären och att ett starkt integritetsskydd är en omistlig del av ett demokratiskt samhälle. Planen stöder därför motförslagets krav i sak.

  • strengthen civil preparednessdecisive»Även det civila försvaret är livsviktigt. Vi måste rusta civilförsvaret och samhällets beredskap inför krig och kris.« (2022 manifesto ↗)“Civil defence is also vital. We must strengthen civil defence and society's preparedness for war and crisis.”
  • rule of law even digitally»Samtidigt måste rättssamhället finnas även i den digitala sfären.« (party programme ↗)“At the same time, the rule of law must exist even in the digital sphere.”
  • strong privacy protection»Ett starkt integritetsskydd är därför en omistlig del av ett öppet och demokratiskt samhälle.« (party programme ↗)“Strong privacy protection is therefore an essential part of an open and democratic society.”
  • arm against external threats»Sverige måste rustas snabbt och fokuserat; ingen ska kunna ta vårt demokratiska samhälle ifrån oss.« (2022 manifesto ↗)“Sweden must be armed quickly and in focused fashion; no one shall be able to take our democratic society from us.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

LLiberalernaNoYesdeparts from the planderived

The plan's security policy commitment is that dependence on undemocratic states for strategic goods shall be seen as a risk for political extortion, and that civil defence shall be strengthened at the same pace as military defence.

Plan documents: party programme · 2022 manifesto

Reasoning and quotes

The plan's security policy commitment is that dependence on undemocratic states for strategic goods shall be seen as a risk for political extortion, and that civil defence shall be strengthened at the same pace as military defence. Security-sensitive information in cloud services outside the country's borders is precisely such a dependence. The plan simultaneously wishes Sweden to be a leader regarding IT infrastructure, which assumes state oversight and control.

Original (Swedish)

Planens säkerhetspolitiska åtagande är att beroenden av odemokratiska stater för strategiska tillgångar ska ses som en risk för politisk utpressning, och att det civila försvaret ska stärkas i samma takt som det militära. Säkerhetskänslig information i molntjänster utanför landets gränser är precis ett sådant beroende. Planen vill samtidigt att Sverige är en föregångare vad gäller it-infrastruktur, vilket förutsätter statlig insyn och kontroll.

  • protection of strategic goodsdecisive»odemokratiska eller rentav totalitära stater förvärvar strategiska tillgångar« (party programme ↗)“undemocratic or indeed totalitarian states acquire strategic goods”
  • risk of political extortion»Det finns en tydlig risk för att dessa utnyttjas för politisk utpressning.« (party programme ↗)“There is a clear risk that these are used for political extortion.”
  • strengthened civil defence»Antalet anställda och värnpliktiga i krigsorganisationen ska öka, ny materiel tillföras och det civila försvaret stärkas i samma takt som det militära.« (2022 manifesto ↗)“The number of employees and conscripts in the war organisation shall increase, new equipment be supplied and civil defence be strengthened at the same pace as military defence.”
  • strong Swedish IT infrastructure»Sverige ska vara en föregångare vad gäller IT-infrastruktur.« (party programme ↗)“Sweden shall be a leader regarding IT infrastructure.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

KDKristdemokraternaNoYesdeparts from the plannot addressed

The plan requires capability to meet cyber warfare and that total defence can handle severe strains on society, which points to measures that secure state insight and control over security-sensitive information in cloud services.

Plan documents: party programme

Reasoning and quotes

The plan requires capability to meet cyber warfare and that total defence can handle severe strains on society, which points to measures that secure state insight and control over security-sensitive information in cloud services. According to the plan, reliable electronic communications with high performance are a prerequisite for society's function. The plan also requires great caution when handling personal data.

Original (Swedish)

Planen kräver förmåga att möta cyberkrigföring och att totalförsvaret kan hantera svåra påfrestningar i samhället, vilket talar för insatser som säkrar statens insyn och kontroll över säkerhetskänslig information i molntjänster. Tillförlitliga elektroniska kommunikationer med hög prestanda är enligt planen en förutsättning för samhällets funktion. Planen kräver dessutom stor försiktighet vid hantering av personuppgifter.

  • capability against cyber attacksdecisive»möta angrepp från internationell kriminalitet, terrorism, cyberkrigföring« (party programme ↗)“meet attacks from international crime, terrorism, cyber warfare”
  • preparedness in crisis»delta i hanteringen av katastrofer och andra svåra påfrestningar i samhället« (party programme ↗)“participate in managing disasters and other severe strains on society”
  • reliable digital infrastructure»tillförlitliga elektroniska kommunikationer med hög prestanda« (party programme ↗)“reliable electronic communications with high performance”
  • caution with personal data»vid hantering av personuppgifter.« (party programme ↗)“when handling personal data.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

MModeraternaNoYesdeparts from the planderived

The plan wants to provide security-sensitive operations with better government support against espionage and theft attempts by foreign powers and requires concrete measures against hybrid threats and cyberattacks.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The plan wants to provide security-sensitive operations with better government support against espionage and theft attempts by foreign powers and requires concrete measures against hybrid threats and cyberattacks. Securing the state's oversight and control over security-sensitive information in cloud services and servers is such a measure, especially when information is moved outside the country's borders. The plan treats digital infrastructure as a national matter and states that the state's core is not negotiable.

Original (Swedish)

Planen vill ge säkerhetskänslig verksamhet bättre statligt stöd mot spionage och stöldförsök från främmande makt och kräver konkreta åtgärder mot hybridhot och cyberattacker. Att säkra statens insyn och kontroll över säkerhetskänslig information i molntjänster och servrar är en sådan åtgärd, särskilt när information flyttas utanför landets gränser. Planen behandlar digital infrastruktur som en nationell angelägenhet och slår fast att statens hårda kärna inte är förhandlingsbar.

  • protection against foreign powersdecisive»Ge företag som är engagerade i säkerhetskänslig verksamhet bättre stöd från staten att kunna möta cyberattacker, spionage och stöldförsök från främmande makt« (2022 manifesto ↗)“Provide companies engaged in security-sensitive operations with better government support to meet cyberattacks, espionage, and theft attempts from foreign powers”
  • measures against hybrid threats»Införa en handlingsplan med konkreta åtgärder mot hybridhot och cyberattacker« (2022 manifesto ↗)“Introduce an action plan with concrete measures against hybrid threats and cyberattacks”
  • digital infrastructure as a national matter»Klassa bredband som nationell infrastruktur och prioritera därefter« (2022 manifesto ↗)“Classify broadband as national infrastructure and prioritise accordingly”
  • the state's core»Statens hårda kärna får aldrig vara förhandlingsbar.« (party programme ↗)“The state's core shall never be negotiable.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

SDSverigedemokraternaNoYesdeparts from the planderived

The counter-proposal wants to secure state oversight and control over security-sensitive information in cloud services and servers, since digital infrastructure is crucial in crisis and war.

Plan documents: 2022 manifesto · party programme

Reasoning and quotes

The counter-proposal wants to secure state oversight and control over security-sensitive information in cloud services and servers, since digital infrastructure is crucial in crisis and war. The plan points to disruptions in electronic systems as a threat with rapid and incalculable consequences, requires better evaluation of vulnerabilities in a digitalized society and means that essential infrastructure should be under state control. The demand therefore follows from the plan.

Original (Swedish)

Motförslaget vill säkra statens insyn och kontroll över säkerhetskänslig information i molntjänster och servrar, eftersom digital infrastruktur är avgörande vid kris och krig. Planen pekar ut störningar i elektroniska system som ett hot med snabba och oöverskådliga följder, kräver bättre utvärdering av sårbarheten i ett digitaliserat samhälle och menar att väsentlig infrastruktur bör stå under statlig kontroll. Kravet följer därför av planen.

  • digital disruptions as threatdecisive»Störningar i elektroniska system, betaltjänster eller elnät kan uppstå på grund av naturfenomen, angrepp eller fel och skulle kunna få oöverskådliga följder relativt snabbt.« (2022 manifesto ↗)“Disruptions in electronic systems, payment services or electrical grids may occur due to natural phenomena, attacks or errors and could have unpredictable consequences relatively quickly.”
  • state control of infrastructure»försvar och väsentliga delar av vår infrastruktur bör stå under statlig kontroll« (party programme ↗)“defence and essential parts of our infrastructure should be under state control”
  • evaluated digital vulnerability»Samhällets sårbarhet behöver bättre utvärderas, inkluderat hur ett allt mer elektrifierat och digitalt samhälle påverkar utsattheten vid en kris eller störning.« (2022 manifesto ↗)“Society's vulnerability needs to be better evaluated, including how an increasingly electrified and digital society affects vulnerability in a crisis or disruption.”
  • strengthened crisis management capability»Anslagen till de myndigheter som har övergripande ansvar för civilförsvar, krisledning och beredskap bör öka och stödet till civilorganisationer med samhällsuppdrag ska stärkas.« (2022 manifesto ↗)“Appropriations to agencies with overall responsibility for civil defence, crisis management and preparedness should increase and support for civil organizations with government assignments should be strengthened.”

The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.

Share and embed

Embed as a widget (iframe): previewSizeLanguage

Sources and documents

Documents under consideration

Source: The Swedish Parliament