1 Swedish Security Service Swedish

2018 2

Xx 3

Contents

Preface 2018 - Reflections by the Head of the Security Service 4–5 2018 - Reflections Remit 4 by the Head of the The Swedish Security Service 6–7 Security Service in brief

The cooperation International cooperation 8–9

The future Trends and tendencies 10–11 The elections 12 The elections Protecting the elections 12–15

Strategic cooperation for Sweden’s security 1 6 – 1 7

Threats The grey area 18–23 Strategic 16 cooperation Protective security Sweden’s security: stricter legislation in place 24–25 Protective security explained 26–27

Dignitary protection explained 2 8 – 3 0 The new Extremism Protective 24 Security Act Extreme unit 31–35 The drop that hollows the stone 36–37 Ideologically motivated crime 38–39

Reduction Counter-proliferation 40 Aliens cases 41 31 Extreme unit

Contents 4

Klas Friberg

The intelligence threat is also a security threat

The world is changing faster than ever. Political developments in the Baltic Sea region as well as in the rest of Europe, the Middle East and China have an impact also on Sweden’s national security. In 2018, there were several incidents that put the ability of the Security Service to protect Sweden and our democratic form of government to the test.

he threats to our country are threats and security is large and as cyber operations, strategic pur- more substantial than they ever-growing. chases and certain diplomatic initia- Thave been in many years. They In the past few years, we have tives, state actors seek to gain an are also broader and have taken on noted that Russia in particular has advantage that could be used to new forms. State actors collect classi- improved its ability to actively and destabilise another country. fied information on a daily basis. covertly influence other states. These This development makes it neces- There are constant attempts to carry activities take place in a grey area sary to increase the capacity of the out influence operations. At the between peace and armed conflict, Security Service and other public same time, there are rapid techno- and are aimed at achieving political agencies tasked with combating logical developments, which are objectives while at the same time crime and other activities carried largely positive but also increase our avoiding an armed conflict. By out in the grey area. Strengthening vulnerabilities. The gap between engaging in grey area activities such the emergency preparedness and

Preface 5

developing the total defence capacity number. The intelligence threat is supporters with the intent and are key factors in maintaining also a security threat, which capability to commit terrorist acts. national security. includes serious criminal activities There are also repeated actions To counter the intelligence threat, targeting certain individuals. taken by the white power and the the Security Service, the National New developments in the activities autonomous movements. Defence Radio Establishment (FRA), engaged in by state actors point to To meet this situation, the Security the Armed Forces and the Civil the importance of cooperation on Service must continue to develop. Contingencies Agency (MSB) have both a national and international We have to increase our capacity to agreed to step up the cooperation in level. Lessons learned from elections ensure national security. The threats the area of cyber security, which also in other countries helped us prepare must be reduced. ties in with the national information for last year’s election campaign. In the past few years, the Security and cyber security strategy. These preparations, which began Service has put much effort into Reducing vulnerabilities is a almost two years before the general strategic competence management. responsibility of society as a whole elections, involved close cooperation Seve­ral hundred individuals have and should be given a higher priority with the Swedish Police Authority been employed to improve the by all involved parties. We have iden- and other agencies. The efforts paid performance in our different areas tified a number of areas associated of operation. To adapt to the with critical assets that need Reducing changing environment, we need addressing, including a better under- qualified staff in many areas, not standing of what constitutes a criti- vulnerabilities is a least technology. cal asset from a national security While it is clear that the world has perspective, vulnerabilities associ- responsibility of changed, we are also standing at the ated with these, and which security society as a whole and threshold of a new era of rapid enhancing measures should be taken develop­ments that could have a large to address these vulnerabilities. should be given a impact both globally, in Sweden and There may also be some weaknesses higher priority by all for the Security Service. Such devel- associated with the design of the pro- opments include artificial intelli- tection, such as the physical security involved parties. gence and 5G, both of which not only or information security. come with new possibilities but The Security Service therefore wel- off and as the elections approached could also keep the vulnerabilities of comes the new Protective Security we knew that we were well prepared. critical assets at a high level. Act which will come into effect on The elections were not affected by For this reason, we continue to 1 April 2019. The Act places stringent any major influence operations by work for a more secure Sweden and a demands on the protective security foreign powers. State governed by the rule of law, efforts of public agencies and private Cooperation with other agencies is also in the face of external pressures. companies. The effectiveness of this also a crucial aspect of counterter- work cannot solely be measured in rorism. In this context, the Security financial terms but should also be Service cooperates with the Military considered in terms of better and Intelligence and Security Service, more robust protective security the National Defence Radio Estab- measures. This is an investment that lishment, the Swedish Police Author- not only secures government and ity and several other public agencies. private business but also protects This work requires perseverance and Head of the Swedish Security Service national security. a long-term strategy. In 2018, it became evident on a The violent extremist movements number of occasions that the intelli- have grown in recent years. There gence threat is also a security threat. have also been acts of violence com- Several countries demonstrated their mitted by individuals affiliated with readiness to go beyond regular intel- the violent Islamist movement, the ligence activities to achieve their white power movement and the political objectives. This was particu- autonomous movement. The larly evident in the case of the for- Security Service handles a steady mer Russian intelligence officer and flow of intelligence related to terror- his daughter, who were poisoned in ism. Based on this intelligence, we Great Britain. Another example was reduce threats on a daily basis by the planned murder of an Iranian preventing criminal activities at an regime critic, revealed by Danish early stage. The largest threat is still authorities. posed by the violent Islamist move- The activities engaged in by state ment. Individuals affiliated with this actors in Sweden have also broad- movement continue to spread their ened in scope and increased in propaganda and recruit new

Preface 6

The Swedish Security Service in brief

By detecting and preventing offences against national security, countering terrorism and protecting the central government, the Swedish Security Service safeguards Sweden’s democratic system, the rights and freedoms of our citizens, and protects national security.

The Service Governance Threats The Swedish Security Service is a The Security Service is mainly To ensure the functioning and main- public agency, answering to the governed by a letter of appropriations tenance of Sweden’s democracy and Government. The Head of the and instructions from the sovereignty, the Head of State, the Security Service has the ultimate Government. Under these, the Service Government and the Riksdag responsibility for its operation. The is to monitor world developments so (Swedish Parliament), as well as infor- Swedish Security Service is both a as to be able to rapidly adjust its oper- mation on Sweden’s national defence security service and a police service, ational activities in response to new and key buildings, are to be regarded with a nationwide remit. A security situations. The annual letter of appro- as critical assets. A threat arises when service aims to raise the level of priations, which is classified, specifies an individual, an organisation or a security in its own country. The the Service’s objectives and remit. foreign power has both the intent and Swedish Security Service does this Like any other public agency, the the capability to commit a crime, e.g. by detecting and reducing security Security Service is also governed by a terrorist attack or espionage. Intent threats to the country and its critical various laws and regulations, e.g. the and capability can change over time. assets, and by reducing vulnerabilities Police Act. What sets the Security When threats change, the Security within these assets. The Service has Service apart is that most of the Service modifies its assessment and five operational areas: counter- steering and planning documents as adjusts its measures in response to espionage, protective security, well as the reports to the Government the current situation. dignitary protection, counter- are classified on the grounds of subversion and counter-terrorism. national security. The Service also works with non- proliferation and aliens cases.

The Security Service’s areas of activity Counter- Protective Dignitary Counter- Counter-terrorism intelligence security protection subversion involves preventing involves preventing involves raising the involves ensuring the involves countering and detecting terror- and detecting espio- level of security across security of the Central harassment, violence, ism targeting Sweden, nage and other unlaw- society by carrying Government, foreign threats, coercion or Swedish interests ful intelligence activi- out analyses, records diplomatic represen- corruption aimed at abroad, foreign inter- ties targeting Sweden checks, supervision tatives, state visits harming the basic ests in Sweden, and and Swedish interests and providing recom- and similar events. functions of Sweden’s acts of terrorism in abroad, foreign inter- mendations to public democratic form of other countries. It also ests in Sweden, and agencies whose activi- government. involves preventing espionage targeting ties have a bearing on and detecting interna- refugees. Sweden’s security. tional terrorist net- works in Sweden as well the support and financing of terrorism.

Remit 7

The Swedish Security Service’s headquarters in Solna.

Intelligence Registers Transparency A considerable part of the Security Under the Police Data Act, the The Security Service is inspected not Service’s work is carried out in the Security Service may process only by the agencies supervising the form of intelligence gathering, both personal data when this is necessary national administration, such as the nationally and internationally. Intel- to prevent, avert or detect offences Parliamentary Ombudsman and the ligence work consists of the direction, against national security. The Service Office of the Chancellor of Justice, collection, processing, analysis and may also process personal data when but also by the Swedish Commission dissemination of information. people apply for posts for which on Security and Integrity Protection National information gathering is security clearance is required. This (SIN). SIN inspects how the Service carried out via surveillance, human procedure includes checks against handles personal data and also acts at sources, interrogations, contacts with the Criminal Records Registry. The the request of private individuals to other government agencies and Service is not allowed to register check the use of intrusive measures. organisations, etc. Once the informa- personal data based solely on what The Security Service also has an over- tion has been processed, investigated is known about a person’s race or sight council tasked to provide public and analysed, and conclusions have ethnicity, political opinions, religious transparency. The members of this been drawn, it is further processed by conviction, health or sexual council, representing all the Riksdag the Service; for instance, a criminal orientation. parties, are appointed by the Govern- investigation may be launched by the ment. They closely monitor the Service’s investigators. Sometimes, Secrecy Service’s operational activities and intelligence is shared with other The Service strives to be as open as may provide advice and suggestions agencies or organisations, who take possible about its work and conclu- to the Head of the Security Service. appropriate measures within their sions. However, the Service’s first areas of responsibility. Initiating legal consideration is always its operations proceedings, declaring a foreign and national security. The Service’s diplomat persona non grata, or working methods cannot be disclosed improving protection in some respect and sources must always be pro- are all examples of such measures. In tected. In ongoing criminal investiga- 40% an international context, intelligence tions, the Security Service, just like of the Security Service’s staff of importance to the Service’s remit is the Police, must leave it to the person are women. often gathered by liaison officers heading the investigation, usually a posted abroad. prosecutor, to decide on the extent of investigation secrecy, the purpose of which is to prevent investigations from being jeopardised or hampered. 42% of the Security Service’s staff have police training. Remit 8

International cooperation strengthens Sweden’s security

Global developments may have consequences for Sweden and affect the threat to our national security. The Swedish Security Service’s cooperation with other countries’ security services serves to protect against terrorism and other threats, which often emanate from actors based outside Sweden’s borders. The Service therefore needs information from partner services. The Service’s efforts also include countering the proliferation of weapons of mass destruction and the technology needed to develop such weapons. The Service’s closest cooperation partners are the security services of the Nordic countries, the EU countries and the USA.

Four multilateral forums • Europol is the law-enforcement • As a member of the Counter Terror- So far, CTG cooperation has agency of the European Union. The ism Group (CTG), the Swedish resulted in a number of ter- aim of Europol is to assist the EU Security Service cooperates with rorist attacks having been member states in achieving a more 30 European security services. This prevented in efficient cooperation in order to cooperation platform was estab- Europe. prevent and counter organised lished in 2001 and consists of the transnational crime and terrorism. security services of the EU coun- The Service has a liaison officer sta- tries, Norway and Switzerland. The tioned at the Europol headquarters. platform enables the Swedish • Interpol is the world’s largest inter- Security Service to share national police organisation and intelligence quicker, cut has around 190 member countries. down on the red tape and Interpol is tasked with preventing work even more and countering transnational crime effectively to and other international crime by counter enabling and facilitating interna- terrorism. tional police cooperation. Interpol focuses on five prioritised areas of criminal activities, including terrorism. • The UN and the EU are two import- ant international players whose decisions and activities often have a bearing on the Service’s work. This can for example be the case when these bodies make decisions on enforcement measures, such as sanctions. The Service’s interna- tional cooperation rests not only on shared values but also on various conventions and treaties that Sweden has signed, primarily as a member of the EU and the UN.

Cooperation 9

Nordic cooperation is crucial

Among the Swedish Security Service’s closest cooperation partners are the Nordic security services: the Danish Security and Intelligence Service (PET), the Finnish Security Intelligence Service (SUPO) and the Norwegian Police Security Service (PST). This cooperation is characterised by an extensive openness and concerns the prevention and detection of terrorism, as well as matters pertaining to espionage, unlawful intelligence activities and unlawful intelligence activities targeting refugees.

In many respects, the Information exchange There are many Nordic countries face is crucial similarities between ” similar challenges ” ” Why is Nordic cooperation of our services Why is Nordic cooperation of importance to you? Why is Nordic cooperation of importance to you? “PST values the close and good coop- importance to you? “Our prosperous Nordic countries eration between the Nordic security “The Nordic intelligence services are share the same values and objectives. services. Good cross-border coopera- some of our closest partner services. In our capacity as security services, tion and information exchange is Our particularly good cooperation is our task is to keep our countries safe. crucial in countering the threats based on the fact that we are neigh- This is a common goal for all the Nor- faced by our security services.” bours largely facing the same kind of dic security services. International In what way has the significance of Nor- challenges and sharing the same cooperation plays a key role in our dic cooperation evolved in the past basic values.” counter-terrorism efforts, and Nordic years? What are the concrete advan- In what way has the significance of cooperation is of particular impor- tages of this cooperation? Nordic cooperation evolved in the past tance in this context. Our countries “The development of the threat years? are neighbours, and many of our sub- emphasises the need for even closer “Historically, the cooperation jects of interest travel between them. Nordic cooperation. Over the past few between the Nordic services has been In many respects, the Nordic coun- years, we have seen an increasing excellent and, in my opinion, it has tries face similar challenges, and that need for concrete cooperation in the evolved further over the past few is why cooperation is so important.” areas of counter-terrorism, counter­- years. At a time when threats are In what way has the significance of intelligence and, not least, in the often transnational, very close coop- Nordic cooperation evolved in the past digital arena. eration with our neighbours is years? Marie Benedicte Bjørnland, Head of crucial. Our ongoing cooperation “Nordic cooperation has always been the Norwegian Police Security with our Nordic partner services in of utmost importance. We have Service (PST) operations and other efforts is very enhanced this cooperation as a result productive, and we want to develop of the drastic changes we have seen this further in the years to come.” around the world.” What are the advantages of Nordic What are the advantages of Nordic cooperation? Can you provide some cooperation? Can you provide some concrete examples? concrete examples? “In addition to being vital in “One concrete example is the fact operations and other efforts, Nordic that we exchange information on a cooperation is valuable because our daily basis, which, of course, is of services are very similar as far as the great help to us in our operational structure and culture of our organi- work. We are also able to learn from sations is concerned. This means that each other by frequently sharing we can learn a lot from each other in both valuable tips and best practice.” terms of how we develop our organi- Antti Pelttari, Head of the Finnish sations. We at PET find this very use­ Security Intelligence Service (SUPO) ful, and I look forward to continuing to develop our excellent cooperation. Finn Borch Andersen, Head of the Danish Security and Intelligence Service (PET)

Cooperation 10

The widening gap – between threats and security

The terrorist threat from violent Islamists will remain elevated. Digitalising critical infrastructure without ensuring commensurate information security increases vulnerability. Intelligence gathering by foreign powers could affect Sweden’s security. These are three assessments made by the Security Service for the years to come.

he weakening of the Islamic ment or motivated by xenophobia Keeping an eye eastward State and the fall of its could also possibly pose an attack Russia is still assessed as the antago- Tcaliphate in 2018 are two of the threat. nist having the greatest impact on reasons why violent Islamist move- Swedish security, both through ments will probably not grow at the Strengthening protective security influence operations and active same rate as in previous years. That The digitalisation of critical infra- intelligence gathering targeting said, such movements were seen as structure without ensuring com- national critical assets. China is the main terrorist threat against mensurate information security is cementing its position as a global Sweden last year. The threat remains assessed as the main vulnerability superpower, and is actively gather- largely at the same level as a year for public agencies holding critical ing intelligence on economic inter- ago, although very few individuals assets. Technical developments have ests, e.g. through cyber attacks and are likely to have the intent to carry also enabled state and ideologically­ acquisitions of companies with out attacks in Sweden. Individuals motivated actors to operate covertly coveted technology. The large-scale acting on their own, likely driven by and efficiently. Although protective nature of these acti­vities may impact a violent Islamist ideology, remains security and rebuilding the total security in Europe. Preventive the most probable attack threat. Any defence capability are highly priori- efforts are required to make public attack would probably be inspired, tised in Sweden, new vulnerabilities agencies and private enterprises rather than directed or guided, by a emerge along with technical aware of threats and reduce terrorist organisation abroad. Indi- developments. vulnerabilities. viduals in the white power move-

The future 11

Seven threats to Sweden in the coming years

Technological developments have increased the capabilities of both state and ideologically-­ 1 motivated actors, but public agencies’ protective security measures have not kept pace with this. This has increased the vulnerabilities in critical assets. Further strengthening of protective security measures is necessary to avoid widening the gap between threats and security even more. 2 Modern technology makes it easy to engage in propaganda and political influence campaigns, and to threaten others. New behaviours change what is seen as normal in the political discourse. Although more people can take part in public debate, this is becoming more transnational and vulnerable to manipulation, making increased vigilance necessary. 3 The international system has become more destabilised, considering the fact that the USA no longer has the same ability or intention to maintain the international post-war world order, and because other countries are attempting to advance their positions. This has resulted in less predictability in international relations. 4 Russia has continued to use military and non-military leverage as a foreign and security policy instrument, e.g. through cyber espionage and influence operations. This calls for increased vigilance.

China is cementing its position as a global super power. There is an increasing threat associated 5 with Chinese attempts to gain economic advantage through cyber attacks and acquisitions of companies. Preventive efforts are required, both in terms of reviewing the legal framework and making public agencies and private enterprises aware of the threats.

The terrorist threat to Sweden from Islamist-motivated actors has not changed significantly from 6 last year, and is assessed to remain at the same level in 2019. The number of attacks in the West has decreased in the past year; one important reason being the fall of the caliphate. The past few years’ substantial increase in supporters of violent Islamism in Sweden will probably slow down, although the number of individuals in Sweden maintaining a violent Islamist ideology is now higher than ever before.

A xenophobic and radical nationalist current, most evident online, is on the rise in Sweden. This 7 contributes to a picture of a growing broad radical nationalism including radical and violent groups. The rapprochement between the white power movement and the unorganised xenophobic groups could become a driving force propelling individuals to commit offences motivated by xenophobia. Such developments have to be closely monitored.

The future 12

Mission: protecting the elections

Together, we worked through a number of conceivable scenarios ” in order to establish our respective roles.

Susanna Trehörning 13

In the Security Service’s view, efforts to protect the elections and the election process were successful. “This means that nothing occurred that was outside the range of what we had expected”, says Susanna Trehörning, Head of the election command centre at the Swedish Security Service.

usanna Trehörning started planning for being carried out by foreign powers. We the 2018 elections already in 2016. That were helped in this by the fact that influence Swas when the Service began its prepara- operations as a phenomenon received tory work both internally and in collaboration extensive media attention. The elections being with the Swedish Police Authority. over does not mean that this question is no “The Swedish Security Service and the longer pertinent; on the contrary. Swedish Police Authority have different “This process raised Sweden’s security remits, but it becomes very clear that our awareness, which was much needed. Our missions overlap during an election campaign Service hopes that this will prove useful also when we are dealing with the security of the in the future. The risk of influence operations Central Government and threats posed by the being conducted will not decrease; these ques- extremist movements and individual actors”, tions will be at least as relevant in the future says Susanna Trehörning, Head of the election as they are now. We need to maintain this command centre. awareness and carry on working with these According to her, one success factor was questions. We will of course use what we have the Service’s cooperation with various public learned from working with the 2018 elections agencies that played a key role in the election in our ongoing work”, says Susanna process. “Together, we worked through a Trehörning. number of conceivable scenarios in order to establish our respective roles. If a particular scenario were to happen, how would we handle it and who would do what? Another important Facts The Swedish Security part of the work was to frequently share Service and the 2018 situation reports with each other in order to elections form a collective view, which would enable us to respond more quickly should anything In this context, the Swedish Security actually happen”, says Susanna Trehörning. Service was responsible for protecting Sweden and Swedish interests, mean- ing the democratic system, our elected In line with expectations representatives in the Central Govern- The Service’s subsequent evaluation shows ment and public confidence in the elec- that the work to protect the elections and the tion process. This included: election process was successful. • advising public agencies and political Government representatives and Members parties on how to protect their criti- of Parliament were able to carry out their cal functions from IT attacks, etc. and election campaigns as planned, and no exten- supporting them in these efforts sive influence campaigns from foreign powers • ensuring that government represen- aiming at influencing the elections took place. tatives and Members of Parliament “We have found that this work was carried were able to carry out their election out successfully, which means that no incident campaigns as planned occurred outside the range of what we had • detecting threats from extremist expected. This, in turn, confirms that the circles and preventing these from preventive measures taken by our Service in being carried out, so that such collaboration with other public agencies, threats would not disrupt the political parties and our protectees, were election campaigns or the elections adequate”, says Susanna Trehörning. • protecting the election process The elections and the election process and the election, as well as public provided our Service with an information confidence in these, from threats platform we were able to use for the purpose from foreign powers, for example via of raising awareness among public agencies, influence operations organisations and the public about protective security and the risk of influence operations

The elections 14

The elections provided important data on influence operations

The Security Service’s remit in relation to the elections included protecting not only the election result but also public confidence that the election process would be free from external influence. Experiences gained have significantly increased the Service’s knowledge of how foreign powers are trying to influence Sweden.

Linda Escar

The elections 15

What is an influence operation? The Security Service uses the definition of influence operation set by the Military Security and Intelligence Service (MUST): “Coordinated and deniable activities initiated by a state actor with the intent of influencing the decision-making, opinions or actions of political leaders, the public or particular target groups in order to promote a particular set of security policy objectives, mainly by spreading mis- leading or false information – often com- bined with other actions specially designed for this purpose.”

he Service assessed that influence operations might occur, Europe to be able to exert long-term chances were small that foreign such as potential NATO membership, influence and nudge Swedish politics Tpowers would influence vote were discussed in electoral campaigns in a direction that serves their inter- tallying and the actual result of the but never became major issues. This is ests. The Service has good knowledge 2018 elections. The Swedish election probably why we didn’t see any exten- of both networks and key individuals. system is robust. sive influence campaigns from foreign “But it doesn’t matter that we have a powers”, says Linda Escar. A giant puzzle legitimate election result if the public Vulnerabilities in society facilitate, thinks that it has been manipulated. and increase the risk of, espionage. This is why we always have to protect The Service’s preventive efforts to public confidence in the election The Service knows reduce vulnerabilities therefore began process”, says Linda Escar at the that foreign powers long before the elections, and included Service’s Security Department. close cooperation with the political Influence operations are not a new build networks and parties represented in the Riksdag phenomenon, but something that is (Swedish Parliament) and the Riksdag going on more or less openly all the relations in Europe Administration. time. In view of the 2018 elections, the to be able to exert “This has yielded many positive Service worked to raise public aware- effects, as political organisations are ness about threats from foreign long-term influence targets of intelligence gathering also powers, influence operations as a after the elections”, says Linda Escar. method, and what foreign powers and nudge Swedish As foreign intelligence entities pose might seek to achieve and would politics a threat to Sweden also after the actually be able to achieve. Raising elections, there is still a need for awareness is a tried and tested know­ledge and cooperation. method, and the Service assessed this In the course of its efforts, the “The Service’s intelligence work is to be the best way to inoculate the Service has gained considerably more carried out around the clock and year public against influence campaigns knowledge about how, and with what round, in cooperation with other from foreign powers. tools and objectives, foreign powers authorities. As with all intelligence conduct influence operations. The work, it’s about piecing together a NATO not a major election issue Service knows that foreign powers giant puzzle to get the full picture”, “The political issues where we thought build networks and relations in says Linda Escar.

Så Thesäkrades elections valet 16

Strategic cooperation for Sweden’s security

The National Centre for Terrorist Threat Assessment (NCT) was formed in 2005. This cross-agency working group became permanent ten years ago. “The work involved in assessing the terrorist threat to Sweden cannot be assigned to any one public agency as it is not aligned with the way tasks are demarcated between these agencies. It is therefore necessary to have concrete and continuous cross-agency cooperation in this area”, says Linda Thörnell, Head of the NCT.

he NCT is a cross-agency work- ­analyses with a global perspective”, nature of the threat, in other words ing group consisting of staff says Linda Thörnell. what we have noted in Sweden and Tfrom the Swedish Security internationally, and the implications Service and two other public agencies: Explaining the threat scale of this. This is not a risk assessment the National Defence Radio Establish- The NCT uses a threat scale for its or an operational threat assessment ment (FRA) and the Military Intelli- terrorist threat assessments. This meant to assess the risk of an immi- gence and Security Service (MUST). scale allows the recipients of the nent attack”, explains Linda Thörnell. It is housed in the premises of the information to quickly and easily Security Service in Solna, and its understand the NCT assessment of Strategic and forward-looking steering group consists of the direc- the terrorist threat to Sweden and assessments tors of these three agencies. Swedish interests and enables them The NCT’s terrorist threat level for Linda Thörnell, from the Swedish to check whether there have been any Sweden is based on strategic assess- Security Service, has headed the NCT changes since past assessments. How- ments of actors’ intent and capability analysts for over a year. The assess- ever, Linda Thörnell finds that there to carry out terrorist attacks on ments made by these analysts are are limitations in using this five-level Sweden. The threat level scale is thus used by the public agencies that make scale, “Communicating threat levels a strategic scale for Sweden as a whole up the Counter-Terrorism Coopera- is not an uncomplicated matter. We over time, and the assessments are tion Council and by the Government must keep track of a number of therefore strategic and forward- Offices. These assessments are of an parameters over time that are associ- looking. internationally high standard, as ated with the intent and capability of “Our strategic assessments are evidenced by how highly they are actors and also keep abreast of global produced considering all available regarded abroad. “We have noticed factors. All this information must be information. On this basis, we have this in our contacts with our counter- weighed and valued”, she explains. established that an elevated threat parts from other countries, which ”Subsequently setting threat levels in can mean that there are a small often have many more analysts than order to produce reliable assessments number of actors who will have the we do but nevertheless regard the is important from an analytical point intent and capability to carry out NCT as an important partner. of view, but the assessments are not terrorist attacks in Sweden”, The NCT needs this international comparable internationally. It is says Linda Thörnell. cooperation in order to produce therefore important to explain the

3 4 5 The Counter-Terrorism Cooperation Council 2 The Counter-Terrorism Cooperation Council held its first meeting at the 1 beginning of 2005, on the initiative of the Swedish Security Service. The public agencies that make up this council have taken on various roles in the The NCT threat level scale work to counter and handle terrorism. The council is led and convened by 1. No identified threat the Head of the Swedish Security Service, and the council members are the 2. Low threat heads of the agencies which make up the council. 3. Elevated threat 4. High threat 5. Very high threat

Strategic cooperation 17

Linda Thörnell

It is therefore important to explain the nature of the threat, in other words what we have noted in Sweden and internationally, ” and the implications of this. 18

Johan Olsson

Threats 19

Ongoing conflict without war Influence operations, strategic acquisitions and electronic attacks. These are some of the methods currently used against Sweden, and which we must protect ourselves against. “Currently, no state has a clear intent to start a war with us. But there are states that want to weaken Sweden and make us act in their own interest”, says Johan Olsson, Head of Operations at the Swedish Security Service.

Daniel Stenling

weden has been at peace for the past 200 years. This does not Smean that there have been no conflicts; one example is with Russia during the Cold War. At that time, Sweden was alliance-free and aimed to be neutral in case of war, but belonged to the West. This still applies. “Similarities with the Cold War, which was a military arms race, end here”, says Johan Olsson.

Threats 20

There are no imperialist Russian” ambitions involving Sweden,

“Nowadays, Russia is at an eco- strives to influence Sweden and other Russia, in the long term, is to weaken nomic, and thereby military, disad- countries in order to achieve its own the Western countries’ political, vantage compared to the West, and is security policy objectives without economic and military cooperation well aware of this. The country has provoking a military conflict, in and collaboration by creating therefore completely changed its which the costs would be higher and division. One goal is to keep Sweden strategy and developed a grey area the chances of winning lower. A free of military alliances. doctrine”, Johan Olsson continues. number of methods are used to “This is why the Russian strategic A state with a grey area doctrine achieve those objectives, which for objective is to keep us out of NATO. To

Grey area explained In the past few years, Russia has states, such as China, use it to gain Although this strategy may result shown clear intent and developed an advantage which may be used to in an armed conflict, it is based on its capability to actively and influence another country. avoiding such an outcome, and covertly influence other states. The pace of technological develop- instead transferring the conflict to This intent and capability is espe- ments over the past few years, a domain where Russia has a cially obvious in Russia’s relations along with financial globalisation, greater ability, the so-called grey with the West and countries in have led to vulnerabilities which area. This development makes it Russia’s geographical proximity. make these methods more power- vital to enhance the capability of Methods used include various ful than previously. The grey area the Swedish Security Service, types of influence operations, stra- between peace and armed conflict defence intelligence agencies and tegic acquisitions, cyber operations in which these operations often other government agencies including electronic sabotage, take place makes it is difficult to responsible for countering attacks diplomacy, military power displays, detect and assess whether the sit- which are not primarily military in and other Russian and non-Russian uation, at any given moment, nature. proxies. Grey area activities are involves preparations for conflict primarily used by Russia, but other escalation.

Threats 21

reach those goals, state-run unlawful influence operations were carried out “Seeing the dangers here activities are used”, says Johan Olsson. previously compared to nowadays is and now” The last few years have seen Russian that in the past, radio stations or Another grey area method is the use military interventions in Ukraine single articles planted in newspapers of electronic sabotage, aimed at for and Syria. were required to transmit the desired example power supplies, payment “There are no imperialist Russian message. Today, states can operate systems or healthcare providers. Such ambitions involving Sweden, despite through social media, where it is planned attacks against critical Russian presence in Ukraine and possible to not only send false and infrastructure systems are relatively Syria. Sweden is a member of the EU, manipulated messages, but to target difficult to trace, but could never­ regarded as belonging to the West these to specific groups and spread theless be a way of forcing another and located in the Baltic region, them rapidly and extensively. country to act in a certain way which is important to Russia from a “Throughout history, states have without resorting to a military military and security policy perspec- tried to spread their view of the world attack. This capability is also import- tive. Therefore, security-threatening to others, openly or covertly. But it is ant should a conflict escalate into activities targeting Sweden are in line not just states that carry out influence war, which, although undesirable, is with the Russian doctrine on non- operations. Organisations, which may taken into account. military methods”, says Daniel be in contact with states, may also be Stenling, Head of Counter-Intelligence engaged in these activities”, says at the Swedish Security Service. Daniel Stenling. If you want to influence Another method used nowadays is strategic acquisitions or investments. something, buying whatever Influence operations and This means that another state, it is you want to influence is acquisitions through state-owned or state- The use of influence operations is one controlled companies, acquires e.g. an easy way of doing so method state actors can use. In an ports, transport companies and influence operation, misleading or technology companies, which may Having other groups convey and false information is spread, both via then be used in influence operations achieve your ideas and objectives, i.e. social and traditional media, with the or to gather information. exerting influence by proxy, is yet aim of influencing the decision-­ “If you want to influence some- another method. making, opinions or actions of politi- thing, buying whatever it is you want “This may involve providing sup- cal leaders, the public or particular to influence is an easy way of doing port to extremist groups which influ- target groups, so as to benefit a state’s so. Sometimes, it can also be a good ence public debate, but at a later stage own set of security policy objectives. deal for the buyer from a financial also physical support through riots The main difference between how standpoint”, says Johan Olsson. and so on”, says Daniel Stenling.

Threats 22

“What we currently see is mainly Cause for vigilance grey area have resulted in new and intelligence gathering by agents and By using the above-mentioned meth- positive vigilance. in the cyber arena, influence opera- ods over time and with varying inten- “The foreign powers involved in tions and strategic acquisitions. This sity, the antagonist state makes room these activities should feel some con- is where the foundation is laid, along for action which can be used at a later cern over the Swedish debate and the with plans on how to intensify these stage. For example, the immediate realisation of what could happen and activities in case of a more escalated result of computer intrusion is some the need for security. Sweden and conflict”, explains Johan Olsson, who extent of information leakage, but other states are becoming less naive”, the real damage occurs at some point says Johan Olsson. in the future when an opponent uses One example of increased vigilance “A focus solely on a the leaked information to influence is that security and intelligence public debate or disable the computer services around the world are now military conflict with system. looking for signs of unlawful pres- “The full extent of the damage sure in association with elections, Russia makes it more caused by such an intrusion is not which increases the adversary’s risk difficult to see the immediately evident”, says Johan of exposure. Olsson, who is of the opinion that it is dangers here and crucial to reach a stage where it is Broadening the definition of now. more difficult to disable critical infra- counter-intelligence structure, such as power supplies and A lot of work remains to be done. payment systems, electronically and “We now need to identify the most stresses that the underlying aim is to from a distance. critical assets in Swedish society and achieve the desired objectives with- “We should be able to feel confident protect those by all means available”, out an escalation to a military that even if a foreign power should says Johan Olsson. conflict. want to disable Swedish infrastruc- “Some people argue that that this “A focus solely on a military ture, this will not be possible, at least could happen at some point should conflict with Russia makes it more not for an extended period of time”, we find ourselves in a military con- difficult to see the dangers here and says Johan Olsson. flict. This is not the case. The antago- now. It must be understood that the In the past few years, public debate nistic activities taking place today are purpose of engaging in grey area on topics such as influence opera- a problem to handle here and now. activities is to achieve success without tions, strategic acquisitions and other State actors are already engaged in armed conflict”, says Johan Olsson. methods which may be used in a everything from murder and gather- ing of military secrets to industrial espionage”, says Daniel Stenling, who, along with Johan Olsson, would like to see increased understanding in Sweden of not only that counter- intelligence is about exposing those who wish to steal Swedish secrets, but also that the adversary currently does not want an armed conflict but is working within an extended conflict spectrum. Armed conflict is one part of this, but not the primary method used. “We need a wider definition of what counter-intelligence and Swedish security involves. Both public and private enterprises must safeguard their information and reduce vulnerabilities”, says Johan Olsson.

Threats 23

Who is spying on Sweden? Many of the grey area problems are related to Russia – but Russia is not the only state using these methods. The Swedish Security Service knows of approximately 15 states which are engaged in various forms of intelli- gence gathering in Sweden. “This includes all state actors with the intent to weaken Sweden’s power to act by using the methods men- tioned above. China is very relevant in this regard”, says Daniel Stenling. China’s ambition to advance from a regional to global superpower means that the Chinese sphere of interest is growing. Sweden could be affected by this.

This includes all state actors with the intent to weaken Sweden’s power to act by using the methods Global ambitions, mentioned above. China is very relevant global leadership in this regard – how China is furthering its position

“We have begun to see signs of China getting into conflicts with n the past, China has mainly been stability and economic growth, but countries that are reluctant to act involved in industrial espionage also a more advanced position as a the way China wants”, Iand unlawful intelligence activi- global power. Geographically, Sweden says Johan Olsson. ties targeting refugees. Today, the is far from China, but in terms of Daniel Stenling and Johan Olsson country is also engaged in extensive strategic investments and acquisitions, agree that it goes without saying that and systematic intelligence gathering business and academic collaborations, Sweden must be able to defend itself targeting other areas, carried out by and intelligence activities, for example from a military attack, but we also their civilian and military intelli- through electronic attacks, need to shift our focus to a more gence services. Intelligence gathering Sweden is undoubtedly in the Chinese likely scenario. “Russia is currently also takes place through civilian sphere of interest. our main focus in terms of grey area Chinese-owned companies, which The Swedish Security Service has activities. But we also need to keep are required to share their technol- established that the Chinese intelli- an eye on China, which has started ogy and know-how with the country’s gence services carried out extensive to use this modus, even though we military authorities. Chinese citizens and thorough intelligence gathering are not in their geographical proxim- are also required by law to assist the globally in 2018, including in Sweden ity. This will be expensive for public country’s intelligence and against Swedish interests, with and private enterprises as they will services, if needed. the aim of achieving its political need to improve their protective The political objectives behind this objectives. security”, says Johan Olsson. strategy are continued national

Threats 24

Sweden’s security: stricter legislation in place A significant date for public agencies and companies engaged in activities that are “of importance to Sweden’s security” is 1 April 2019, when the new Protective Security Act comes into effect. “This act will have a great impact on Sweden. Many public agencies and companies not affected by previous legislation in these matters will have to consider how this new act will affect them”, says Fredrik Agemark, Head of the Protective Security Unit.

hich infrastructure assets are so important affected, this could in turn be detrimental to the activities that it would be difficult for Sweden as a state of other operators, for example in cases where companies Wto function without them? Which are so are providing services to important public agencies”, critical that they could not be completely restored if explains Fredrik Agemark. they were to be disabled? Is our organisation directly or Sweden’s national security can be divided conceptually indirectly involved in activities which support such into its external security (such as military capability and assets? These are questions that many operators, as they defence intelligence activities) and its domestic security. are called in legal terms, must ask themselves in the Sweden’s domestic security includes the protection of its spring of 2019. form of government, democracy, and judicial system, ”If the activities of certain operators are negatively nationally critical infrastructure in areas such as energy, Protective security legislation has been made progressively stricter The government issues a memorandum on the draft bill Stricter controls of outsourcing and the transfer The inquiry report A new protective security of security-sensitive activities by public agencies act (SOU 2015:25) is presented. (Ju 2017/07544/L4), proposing amendments to the existing Protective Security Ordinance.

December 2011 March 2015 Mars 2017 October 2017 February 2018 The government appoints The government appoints an inquiry into the outsourcing The government submits an inquiry into protective of security-sensitive activities, sanctions and supervision. a bill (Bill 2017/18:89) to security legislation. The inquiry is to complement the previous proposal for a the Riksdag for a new new protective security act. protective security act.

Protective security 25

telecommunications and transport. It also includes the public setting where a terrorist attack could occur; this is protection of facilities, such as nuclear power plants, not encompassed by the Protective Security Act either. power plant dams, and microbiology labs, as attacks on However, measures taken preventively in order to protect these could generate major damage. Sweden’s economy, the Riksdag or a power plant dam from attacks are including its nationally significant payment systems, is regarded as activities of importance to Sweden’s security”, also part of its domestic security. explains Fredrik Agemark. When the previous Protective Security Act came into effect in 1996, the Swedish state owned most of the criti- cal infrastructure. This is no longer the case, and it is Important concepts in the new Protective therefore clarified in the new act that the provisions also Security Act apply to private enterprises. In the new act, the concept Security-sensitive activities: Activities of importance to the security of the realm has for instance been replaced Sweden’s security or included in an international protec- with Sweden’s security. tive security commitment that is binding for Sweden. “Another area in which there was a great need to update These activities must be protected under protective the legislation is information security. For example, the security legislation. new act contains a clearer explanation of the procedure Information concerning security­- for classifying secret information. It also clarifies Swe- Classified information: sensitive activities and therefore subject to secrecy under den’s international protective security commitment to the Public Access to Information and Secrecy Act. Such protect foreign interests”, says Fredrik Agemark. information is divided into four protective security classes As before, the responsibility for ensuring that public depending on what harm would ensue if it were to be agencies and private enterprises fulfil their protective disclosed. security obligations lies with these operators themselves. Their mandatory protective security analyses, made in Protective security analysis: Those who carry out order to identify and assess their security-sensitive activi- security-sensitive activities are obligated to make a ties, form the basis of their protective security work. protective security analysis and to plan and implement whatever protective security measures are deemed necessary as a result of this analysis. These measures are Regulations and guidelines divided into the categories information security, physical The Swedish Security Service has been preparing to imple- security and personnel security. It might also be necessary ment the new act for quite some time. In March 2019, the to make a protective security analysis prior to carrying out Service will issue a complement to the new act and ordi- a procurement procedure, in order to determine whether nance in the form of detailed protective security regula- a protective security agreement is required. tions. It will also issue a number of guidelines in the spring to facilitate implementation of the regulations. Information security: Serves to prevent classified “We are planning courses for this, mainly intended for information from being disclosed, altered, made unavailable sector-specific agencies with responsibilities under protec- or destroyed. tive security legislation”, says Fredrik Agemark. Physical security: Serves to prevent unauthorised Exactly what sort of activities are persons from gaining access to areas, buildings, facilities considered to be of importance to and premises where security-sensitive activities are Sweden’s security is a question the carried out. Security Service frequently receives. Personnel security: Serves to prevent persons who are “The security of a big football unreliable in terms of protective security from carrying out match affects many people but not to security-sensitive activities. This includes taking the the extent that it would have an necessary action to ensure that those who take part in impact on Sweden as a state. The security-­sensitive activities have sufficient knowledge of Fredrik Agemark same applies to the security of a protective security.

In an amendment to the Protective Protective security legislation has been made progressively stricter Security Ordinance (1996:633), the government imposes new regula- tions for specific types of outsourc- The inquiry report Additions to the ing which, among other things, gives new Protective Security Act (SOU the Swedish Security Service the 2018:82) is presented which, The new Protective Security Act power to stop a procurement among other things, proposes (2018:585) and the new Protective process that could harm sanctions against those who Security Ordinance (2018:658) come Sweden’s security. violate the regulations. into effect. April 2018 May 2018 November 2018 March 2019 April 2019 January 2021 The new Protective Security The Swedish Security Service issues new Reg- Proposed date for Act (2018:585) is adopted by ulations on Protective Security (PMFS 2019:2) the Additions to the Riksdag. which will come into effect on 1 April 2019. They the new Protec- contain more detailed provisions to comple- tive Security Act ment the new act and ordinance. (SOU 2018:82) to come into effect.

Protective security 26

Protective security explained – how it works

The Security Service’s protective security efforts aim to raise the level of security across society. Such efforts include providing Swedish public agencies with analyses and recommendations for commensurate measures.

Sweden must be protected terrorism, as a potential attack would security). Additionally, they have to Attacks on certain enterprises in have very serious consequences. make sure that persons who are not Sweden may have serious conse- reliable from a security perspective quences for national security, espe- Preventing crime are prevented from participating in cially if essential services such as Enterprises such as those described activities of importance to national energy and water supplies, telecom- above need to have protective secu- security (personnel security). munications and transports are rity measures in place, to prevent dis- targeted. Some enterprises, including closure, destruction or alteration of What to protect – and what public agencies, may be required to classified information (information measures can be taken process classified information as part security). They must also make sure It is vital to identify exactly what to of their remit. Should such informa- that unauthorised persons cannot protect, i.e. the areas of operation tion be disclosed, destroyed or access locations where classified where the consequences of an attack altered, this could affect Sweden’s information is kept or where would affect Sweden’s security or security. Certain enterprises may activities of importance to national where protection against terrorism is also need special protection against security are carried out (physical necessary. The enterprise’s security

Supervision – Advice – Records checks – Security awareness The Service’s responsibility under the Protective Security Act Supervision and advice regulations are complied with, and ­Service suggests measures to The Security Service is at liberty to that the level of protective security im­prove protective security. decide where to conduct inspections, is commensurate with the activities Advising critical assets on how to and always gives priority to the carried out. A typical inspection reduce vulnerabilities and improve nation’s most critical assets. This includes going through the agency’s protective security is a daily feature means that inspections focus protective security analysis and of the Service’s work. Targeted mainly on areas where an attack other relevant documentation. This training for heads of protective would have consequences serious is followed by an on-site inspection security is also offered. enough to affect Sweden as a nation. as well as interviews with heads of Once the Service has decided to operations and security. In some Records checks conduct a protective security cases, a technical inspection of IT In addition to inspections and inspection of a public agency, the system security procedures is advice, the Service is required by law agency in question is contacted and included, in which testing of the to conduct records checks requested given some time to prepare. The system’s ability to withstand an by public agencies. Records checks inspection involves checking that electronic attack is carried out. form part of the security screening protective security legislation and Following the inspection, the procedures that are mandatory for

Protective security 27

analysis, containing its assessment of what constitutes its critical assets, serves as the basis for protective measures to be taken. A holistic approach is important in order to avoid taking measures in one area only, e.g. access control. Effective perimeter protection is not sufficient in the event of an insider disclosing information, or if critical assets are accessible electronically. The ultimate responsibility for ensuring commen- surate, holistic protective security measures lies with the enterprise itself.

Supervision – Advice – Records checks – Security awareness The Service’s responsibility under the Protective Security Act public agencies, and serve as a basis are always taken by the 122,313 for their subsequent decisions on requesting agency. employment. Decisions on whether to disclose information resulting from Security awareness The number of records checks records checks are taken by the carried out by the Swedish Records Checks Delegation, which is a information The Service is required by law special decision-making body within Security Service in 2018. to provide security awareness the Commission on Security and information through individual Integrity Protection. Security screen- This is a 12.5 per cent talks with persons whose posts ing serves to assess a person’s suitabil- involve substantial handling of increase compared ity, loyalty and reliability from a secu- information that may be of great rity perspective. Checks carried out w i t h 2 0 17. importance to national security. One by the Swedish Security Service of the purposes of this is to make new against various police records are one staff or contractors aware that they element of this. may be targeted by e.g. spies. Decisions concerning employment

Protective security 28

Dignitary Protection explained – how it works

The Head of State, Ministers, Members of Parliament and other protectees who are part of the Central Government must be able to carry out their work in a safe and secure environment. This is why the Swedish Security Service’s Dignitary Protection Unit exists.

Dignitary protection 29

Designing the protection The protectees The decision on which security-enhancing measures The Swedish Security Service is responsible for the to use for a protectee is based on a threat and vulnera- personal protection of the Central Government, bility assessment and an assessment of the function’s which includes the following positions: the Head of criticality. Threat assessments are also made for State, the heir to the throne, the Speaker, the events and venues to be attended by the protectee. Members of Parliament, the Prime Minister, the These assessments underpin decisions on measures to Government Ministers and the State Secretaries. The be taken on each specific occasion. Service is also responsible for the dignitary protection during official visits by foreign Heads of State and Cooperation persons with a position comparable to that of the Security-enhancing measures constitute a large Head of State, and their family members. This also portion of the Swedish Security Service’s dignitary includes visits by foreign Speakers, Heads of protection work and are designed to help the Service’s Government and Foreign Ministers. Visits by foreign protectees carry out their planned activities in the political party leaders or representatives of interna- best possible way. As part of this work, the Swedish tional organisations which demand special public Security Service cooperates closely with the Royal order or security measures may also be the responsi- Court, the Riksdag (Swedish Parliament), the bility of the Swedish Security Service. On a case to Government Offices, the Swedish Police Authority, case basis, personal protection may also be provided foreign embassies in Sweden and security services for other positions, such as ambassadors. in other countries.

Dignitary protection Nilsson/TTFoto: Johan 30

Designing the protection – three parts

Threat and vulnerability Security measures Commensurate protection assessment The Swedish Security Service’s secu- Security measures taken should pre- The decision on which security-­ rity measures are requirement-based. vent, pre-empt and obstruct attacks. enhancing measures to use is based Information and advice is on the When planning security measures, it on a threat and vulnerability assess- lower end of the scale, and includes is necessary to assess the assailant’s ment and an assessment of the func- measures such as informing protec­ capabilities, such as the use of threats tion’s criticality. Criticality refers to tees about precautionary measures or physical violence. Changes in capa- the consequences if a critical func- they can take in their daily lives, or bilities are often unknown or impos- tion were to be negatively affected, informing the Swedish Police Author- sible to assess. For especially critical for instance if a protectee is pre- ity about an activity which will take functions, security measures must be vented from doing their job. A threat place in a certain location. Among the commensurate with the assumed refers to the intent to physically more stringent security measures is capabilities of potential assailants, so attack a protectee and the capability the use of close protection officers as to withstand attacks over time. to realise this intent. Vulnerability is combined with fixed site security. defined as qualities or aspects of a Security measures may also involve protectee which might be exploited secure transports and various techni- by a threat-maker with both intent cal solutions, such as the installation and capability. of physical security measures in resi- dential homes, or security searches.

Dignitary protection 31

Fredrik Hallström Extreme unit

Handling concrete threats. Analysing disturbing material. New ways of monitoring terrorists. 32

eing a Monday before a public early hours. The suspects had been communication and potential attack ­ holiday, 30 April 2018 would arrested. targets. Bhave been a perfect day off. “It was a great relief that nobody Not so for Fredrik Hallström, Deputy was injured in the operation, neither Working over Christmas Head of the counter-terrorism and suspects nor colleagues. After a long Some of the seizures were videos of counter-subversion unit at the stressful period of considering new executions by the Islamic State. ­Swedish Security Service. Like many steps forward in handling the threat, Fredrik Hallström’s team has to of his colleagues, he had come into it was now time to start planning watch this type of graphic material the office very early that morning. ahead”, says Fredrik Hallström. when seeking to identify individu- For weeks, surveillance officers, It was necessary to establish als, locations, and so on. This inevita- investigators, analysts, behavioural whether there were any other actors bly puts members of staff under scientists and other specialists had involved, capable of mounting tremendous mental stress. been working around the clock. attacks, and it was time to start the “Handling this type of information Now, they received reports on difficult task of identifying those on a daily basis can be very stressful. successful raids carried out in the arrested, their contacts, on-line We sometimes examine extremely

Extremism 33

disturbing material”, says Fredrik more complex than what is Hallström. accounted for in the report”, he says. Unregistered top-up cards Working at the Security Service The District Court trial was con- used to support terrorism sometimes involves working outside cluded on 15 February 2019. Unlike several other European regular office hours. At times staff countries, it is possible to buy may even have to work in shifts Investigation leading top-up cards and telephone around the clock for longer periods numbers in Sweden without of time, without prior notice. This is to conviction Another case in 2018 involved presenting any proof of identity very different from most other or linking the number to an indi- Swedish workplaces. In addition, threats against The Central Govern- ment and attempted murder in vidual. This makes top-up cards those working at the Security interesting for individuals Service cannot tell their friends and another country. “In this case, an individual sent involved in criminal activities, families why they have to work odd not least in the extremist move- hours. All they can say is “I’m sorry threatening letters containing suspi- cious powder to all members of the ments, as they make it possible but I have to work late”. to communicate anonymously “My colleagues’ attitudes, even if Swedish Government. The motive for this action remains unclear. The by phone or text messages. In they have to be at work over Christ- the past few years, the Security mas, is quite outstanding. The tasks same individual later sent a letter bomb to another country with the Service has noted that Swedish are carried out, steadily and care- unregistered top-up cards are fully, reflecting the fact that threats intention of killing the recipient. Again, the reason remained unclear. used to support terrorism in for have become more concrete and we instance Syria and Iraq. Violent have to act swiftly to refute or The actions were very serious. The individual in question was traced, Islamists in conflict areas use counter them. Our staff is well aware the numbers from such cards of this”, says Fredrik Hallström. arrested and charged largely due to the extensive investigation carried to access encrypted chat appli- out by the Security Service with the cations where they plan criminal No final conclusions assistance of international partners. activities and spread propa- 240 days after the raid, six men were Our investigators had a very busy ganda. charged at Solna District Court. year, but their efforts really paid “The Security Service has noted Three of them were charged with off”, says Fredrik Hallström. several instances of mass dis- preparation to commit a terrorist The Svea Court of Appeal sen- tribution of telephone numbers offence and all six of them were tenced this individual to eight years’ in the form of log-in information charged with crimes against the Act imprisonment for attempted murder linked to foreign terrorist on Criminal Responsibility for the and 21 counts of aggravated actors in other countries”, says Financing of Particularly Serious unlawful threat. Fredrik Hallström. Crime in some cases. Fredrik Today, it is more likely that a ­Hallström underlines that although Swedish phone number found in the several thousand pages of Protecting the elections the conflict areas in Syria and investigation report contain Based on previous experiences, Iraq does not belong to an indi- information on chat contacts, robust cooperation with the Swedish vidual from Sweden. This situa- conversations and images, there are Police Authority and lessons learned tion is quite unique for Sweden. no details on how the Security from elections abroad, the Security Service worked on this case. Service’s counter-subversion unit “The intelligence work continues was well-prepared for the 2018 also after the criminal investigation elections. is complete. For this reason, no final “There were concerns that the conclusions can be drawn as to the white power movement and the actions taken by the Service. Our autonomous movement would intelligence activities are much mobilise and attack each other, and

Extremism 34

also attack representatives from the is quite another. Both tasks are confirm the ideas propagated by established political parties. How- important if we are to succeed and extremists, as fundamentalism and ever, in many ways the election cam- the exchange of information violent extremism are two sides of paign was quite peaceful. Although between government agencies is one the same coin”, says Fredrik there were instances of violence, critical aspect of these efforts. Hallström. threats and harassment between the “The Security Service shares extremist movements, as well as a information with the Swedish Police Top-up cards to terrorists number of incidents and threats Authority, Swedish Customs, the Top-up cards. Hundreds of them, for against The Central Government, it Swedish Prison and Probation free, ordered by one individual in was never to the extent that we had Service and several other stake­ Sweden with no intention of ever feared”, says Fredrik Hallström. holders to ensure that they can fulfil using them or activating them in a their remit. We also receive a lot of mobile phone network. Instead, The intent to act information from the agencies with these cards are intended to be used which we cooperate. For instance, In the spring of 2019, the last strong- to give access to various chat extremists repeatedly engaging in holds of the Islamic State in Syria applications. fraud should not be allowed to carry and Iraq fell, making it harder for “Information about a chat account, on uninterrupted, as money the organisation to plan and carry linked to a Swedish mobile phone acquired from such activities may be out large-scale attacks. However, the number, is later sent to countries used to finance terrorism. Being a Islamic State is still capable of such as Syria, Iraq, Libya and criminally active extremist should launching attacks, as we have seen Somalia, where it could be used for never be easy”, says Fredrik in Europe in 2018. A common feature anonymous and encrypted commu- Hallström. of several of these attacks is that nication by unknown individuals. It they were carried out without much follows that people involved in sup- preparation, financing or advanced The role of schools plying Swedish top-up cards could be planning. “All sectors of society must be able to helping terrorists in other countries”, “It only takes an idea, based for address the problems associated with says Fredrik Hallström. instance on a perceived or actual extremist movements. All parts of A ban on unregistered top-up cards insult, and a knife from the kitchen the safety net must be strong. The would complicate this type of drawer to strike fear in society. It is Security Service and the Swedish activity. incredibly difficult for us to identify Police cannot do this on their own”, Another obstacle in the Security such threats”, says Fredrik says Fredrik Hallström. Service’s counter-terrorism efforts, Hallström. He wants more sectors of society also linked to telecommunications, to be involved in forming positive concerns the retention of electronic relationships addressing socially communications, following ruling “Being an extremist should alienated youth. by the Court of Justice of the never be easy” “Schools are an important arena European Union in 2016. Preventing attacks is one thing. for reducing the threat from extrem- “When we receive information Preventing the growth of extremism ism. We cannot have schools that from an international partner that a

Extremism 35

certain Swedish IP address has com- express intent to attack targets in ­Security Service since the mid-1990s, municated with known actors with Sweden roughly every second day. Fredrik Hallström has seen how the express terrorist intent, we contact The flow of intelligence has service’s remit as well as its staff has the telecommunications operator to remained relatively stable for some changed over time. establish who this IP address belongs time. However, there tend to be some “Back then, we were mainly police to. But this information is unavail- fluctuations in connection with com- officers. Today, our staff has a more able as operators have no obligation pleted attacks, prompting intensified diverse competence. This makes us to retain this type of data. This exchange of intelligence, or national better and more efficient when it means that, very much in contrast or international political statements. comes to countering extremists to the actors we monitor, the Service “This proves that the international intent on committing crimes. I am cannot proceed”, says Fredrik flow of counter-terrorism related impressed not least by our new staff. Hallström. information between security ser- They develop and pick up new things vices is working. Vast amounts of very quickly, which is necessary. International flow information are shared on a daily Their dedication and drive is a great There is a never-ending flow of basis to prevent terrorist attacks”, booster”, says Fredrik Hallström. intelligence. The Security Service says Fredrik Hallström. What is your own motivation? handles more than 6,000 intelli- “My motivation is probably similar gence reports on terrorism every Boosting our capability to that of my colleagues, to make our month and receives information on Having worked at the Swedish country safe and secure.”

Stopped signals Hidden data The National Defence Radio Establishment (FRA) “First name Second name has been assigned by the collects data from telecommunications traffic on Islamic State to mount an attack in Sweden. He how a certain individual, a ‘sender’ in another country probably has access to hand grenades”. Or “First - e.g. Iraq, Libya or Syria - contacts people in Sweden. name Second name from X country is prepared to The instructions from the ‘sender’ are clear: Mount ‘work’ in Sweden”. These are two real, but masked, an attack in Sweden. Do this. We and I encourage examples of the type of intelligence handled by the and support you, we may even pay you. Security Service several times a week. To refute or When the FRA shares this information with the confirm this type of intelligence, it is often neces- Security Service, it leads to intense, often cross- sary to analyse data and telecommunications agency, efforts to further explore the intelligence at traffic. However, this information is rarely retained hand. If there is reason to believe that a crime has by Swedish telecommunications operators and been committed, the Service will launch a criminal broadband providers. Since 2016, when the investigation. However, once a criminal investigation ­European Court of Justice found that Swedish has been initiated, the Service will no longer receive ­legislation contravened EU law, many Swedish any information or intelligence from the FRA, as sig- ­operators and providers have ceased to retain nals intelligence may only be used for intelligence traffic data, while others only retain data for a short purposes. In 2018, a Government commission pro- period of time. New data retention regulations posed that the legislation in this area be amended to compatible with EU law were suggested in 2017. A make it possible for the Security Service to gain proposal for new legislation was drawn up in 2018. access to signals intelligence in parallel with a crimi- nal investigation. The signals intelligence would still be used for intelligence purposes only.

Encrypted communication It was a long time since murder plots and espionage operations were discussed using landline telephones or possibly even a telephone booth. Technological development have taken giant leaps. Unfortunately, so too have those who want to harm Sweden and our democratic form of government. Today, this type of communication often relies on digital platforms and applications, and is frequently encrypted and anonymised. More than 90 per cent of the internet traffic that law enforcement agencies have court permission to intercept is encrypted. In November 2017, a Government commission submitted a proposal for a new act containing provisions for equipment interference, which would grant the Security Service access to this type of communication before it has been encrypted.

Extremism 36

The drop that hollows the stone How the extremist movements may scare people into silence

It is up to everyone to challenge the ideas propagated by the ” extremist movements.

Ahn-Za Hagström

Ideologi 37

Three extremist movements the Security Service expected an engaging in activities that fall outside increase in the number of activities the remit of the Security Service have as their goal to overturn engaged in by these individuals. This could eventually disappear. the existing social order. In especially concerned the white power “The individuals committing these addition to attack threats, and the autonomous movements, but crimes are not necessarily members even individual actors – who are not of an organisation. Their affiliation they pose a more long-term always ideologically driven – have and involvement is expressed in other threat to democratic attempted to approach the Security ways. As a result, ideologically moti- governance, and their Service’s protectees. vated crime shows increasingly fuzzy boundaries, and when a certain methods may scare people Extremists made a mark action is taken against a specific tar- into silence. “Politicians are seen and heard a lot get, this may depend on factors and more during election years. The large circumstances other than someone’s “When discussing the threat posed number of public political meetings organisational affiliation”, says by extremist movements, it is easy to also make it possible for people to Ahn-Za Hagström. focus solely on the attack threat. In come into contact with them in ways According to her, this development this context, the violent Islamist that may be, or be perceived, as will likely continue in the coming movement is seen as posing the great- threatening”, says Ahn-Za Hagström, years, meaning that ideology could est threat. However, the threat to the The activities that took place in the become a more important unifying democratic system consists not only run-up to the election corresponded factor than someone’s organisational of terrorist attacks. The threat is a to the assessments made by the affiliation. The role of groups and question of who is being targeted and Security Service. organisations would in that case when”, says Ahn-Za Hagström, Senior “However, the extent to which the mainly be to inspire, guide and urge Analyst at the Security Service. white power organisation that ran for individuals – who may or may not Although the white power move- election last year managed to influ- belong to extremist movements – to ment and the autonomous movement ence public debate and receive exten- carry out actions against certain are also capable of committing terror- sive media reporting was quite sur- targets, or towards a certain aim, ist crimes, the violent Islamist move- prising. Even though far from every- without prior approval. ment poses the greatest threat from thing they did was illegal, their “If anyone who sympathises with a an attack perspective. The threat scaremongering had an impact on particular question, or shares the posed by the white power movement public debate and they also received same ideological convictions, is and the autonomous movement is wide media coverage”, encouraged to commit crimes as part more long-term in nature. Their says Ahn-Za Hagström. of a certain action, this will add to actors strive to set the rules for who the complexity of the Security Ser- may be seen or heard, while at the vice’s mission. This will also put A tougher tone higher demands on the cooperation same time keeping their own group She also notes that the tone of the between law enforcement agencies outside established society. debate during the election campaign and other stakeholders in society”, “They are less concerned with lowered the threshold for what is says Ahn-Za Hagström. large-scale acts of violence, leading to acceptable to say. This had an impact mass-casualties, and focus more on on the movements; when normal dis- the systematic use of violence, threats course toughened, they became more and harassment aimed at changing or extreme. In Ahn-Za Hagstöm’s abolishing our democratic form of words, it is up to everyone to Extremist government”, says Ahn-Za Hagström. challenge the ideas propa- movements Criminal activities gated by the extremist movements. The Secu- By extremist movements, the Swedish “In similarity with the violent Isla- rity Service protects Security Service refers to individuals, groups mist movement, these individuals and organisations held together by an ideology that the democratic sys- also want to change our way of life, advocates, supports or uses violence, threats, coer- tem, but everyone how we go about our work and carry cion or other serious crimes to bring about changes to has a responsibil- out our tasks. Their methods may the existing social order. In addition, they may seek to influ- ity in this regard. scare people into silence, by signal- ence decision-making processes or the exercise of public authority, or prevent people from enjoying their fundamental ling that involvement in certain mat- Fuzzy rights and freedoms. ters or organisations, as well as hold- Fundamentally, they consider crime a legitimate and necessary ing certain jobs, will expose people to boundaries part of their ideological (political or religious) struggle, for threats, harassment and sometimes Activities engaged instance by considering it inevitable that other people’s rights wilful damage and violence”, says in by extremist and freedoms are sometimes violated in order for them to Ahn-Za Hagström. movements have reach their goal. The Security Service is tasked with coun- The Security Service monitors these changed in the past tering serious or systematic crime targeting fundamen- individuals due to their criminal few years. The tal democratic functions with a view to overturning the activities aimed at overturning the boundary between existing social order. There are currently three main existing social order by using undem- actors monitored by the extremist movements: the autonomous move- ment, the white power movement and the ocratic methods. In connection with Security Service and ideo- violent Islamist movement. the 2018 Swedish general elections, logically motivated actors

Extremism 38

Ideologically motivated crime – aimed at bringing about a change in society

Definition of ideologically The strategy of the extremists key society stakeholders so that they motivated crime Violent extremists do not only use will be able to discover at an early stage any signs indicating intent to Ideologically motivated crime is the criminal methods. Their ideological carry out a crime and react to this. type of crime committed for reasons struggle also includes recruiting sym- of e.g. political or religious convic- pathisers to their ranks and creating tion. This sort of crime is often asso- opinion through social activities, The assessed threat ciated with a conflict, a specific issue, handing out leaflets, and peaceful In the current assessment of the or with what is perceived to be an demonstrations. They sometimes ­Security Service, none of the extrem- unfair situation. commit offences such as blockades or ist movements has the capability to The Security Service works to sabotage for symbolic reasons in change the democratic system as a prevent and avert crimes that target order to create debate about a certain whole. Violent Islamists still pose the ­Sweden’s fundamental democratic issue. Even the resulting trial could greatest threat as far as terrorist functions and are carried out with also be used for this purpose. The attacks in Sweden are concerned, the aim of influencing decision- Security Service focuses on the more although the white power movement making or the exercise of public serious crimes of this nature that are and the autonomous movement are authority, or crimes listed under carried out with the aim of directly also assessed to have the capability to Sweden’s terrorism legislation, affecting the democratic system, such carry out the type of criminal acts regardless of the ideology in terms of as attacks and other violent offences, that could be considered terrorist political or religious conviction that threats and intimidation. The Police offences under Swedish legislation. may be behind such crimes. Such Authority handles the other types of The Security Service’s assessment of crime might be aimed at instilling crimes. the threat posed by violent Islamists fear in the population, compelling is based partly on information about officials into taking measures which The Security Service’s work to the intent of certain individuals to otherwise would not have been counter extremist crime commit crimes and the number of taken, or in some other way damage The Security Service is a law- individuals attracted and inspired by fundamental national structures. It enforcement agency involved in violent Islamist ideology. Such indi- could also involve recruiting, financ- crime-prevention work aimed at viduals regard everyone in society ing and training for terrorist attacks. reducing, over time, the threat posed who does not share their ideology as Whether a particular crime can be by violent extremist movements. All legitimate targets. considered a terrorist offence or not sectors of society must work together Even though the white power move- is determined by a prosecutor and to this end. For the Security Service, ment and the autonomous movement ultimately by a court. this mainly involves raising aware- also have an extreme ideology and ness about violent extremism, its intent, their calls to action are not as modus and how it is manifested. It clear and extensive as those from vio- Who commits ideologically also involves providing those who lent Islamists. The white power move- motivated crime? come into contact with violent ment and the autonomous movement The majority of those who consider it extremists in various contexts with mainly pose a threat to particular necessary to resort to criminal meth- an accurate picture of what to expect people, as, apart from their attempts ods in order to bring about a change so that any necessary action can be to create opinion, these movements in society belong to one of three taken. often and systematically engage in extremist movements: violent Isla- violent, threatening and intimidating mists, the white power movement, or Preventing crime criminal activities to prevent certain the autonomous movement. There The Security Service uses various people from meeting, carrying out are also individuals who do not methods to prevent and avert ideolog- their political duties or assignments, belong to any of these extremist ically motivated crime. One method and expressing their opinions. This movements but who share their ideol- is making assessments as to what could be done in order to make these ogy and who, either on their own or targets an individual, group or organ- people abandon their political com- together with others, have expressed isation might act against, and what mitments, to influence their decision-­ the desire to carry out an attack or modus they might use for this. making or to refrain from accepting some other serious violent criminal Another way is by sharing informa- certain assignments, which would act based on this ideology. tion with public agencies and other have serious effects on democracy.

Extremism 39

Kurdish YPG militia shooting at IS-controlled drones in Raqqa, Syria. Photo: Goran Tomasevic/TT

Individuals acting Individuals who have Returnees from on their own travelled to conflict zones conflict zones There are individuals who are not Since 2012, approximately 300 indi- Of course not everyone returns obvious members of any of the viduals have travelled from Sweden from a conflict zone with the extremist movements but who to conflict zones in order to join an intent to carry out an attack or sympathise with these in one way organisation, engage in combat other terrorist offence. Some or another or share their values, training or join a combat unit. The returnees are disillusioned with and feel compelled to do what majority of these have travelled to the Islamic State and their stay in they can to bring about a change the Syria/Iraq conflict zone in order the war zone while others are in society or heed the message to support the Islamic State or traumatised by their experiences, promulgated by tone-setting indi- al-Qaeda-linked groups in various whether they actually engaged in viduals within these movements. ways. A number of them have combat or not. The Security Ser- There are also individuals who returned or plan to return to vice assesses each returnee indi- independently carry out attacks Sweden or other parts of Europe. vidually and, if there are grounds or other serious violent crimes These individuals might have to suspect that they committed a assigned by established organisa- acquired knowledge and skills, an crime, a criminal investigation is tions which use this strategy in increased readiness to use violence, initiated and they are interro- order to avoid detection by or even to carry out attacks, and gated. Whether or not a criminal law-enforcement agencies. Per- they are therefore of interest to the investigation is initiated, each petrators acting on their own Security Service. Other reasons for returnee’s intent and capability to thus do not constitute a homoge- this interest is that they might have carry out a terrorist attack or neous group. This modus cannot widened their contact network or serious violent crime is assessed. be attributed to any particular earned status among other violent In the voluntary interviews held ideology but has been shown to extremists, meaning that they could with each returnee, any wish to be used in all three of the extrem- become key figures in a terrorist put the life of violent extremism ist movements. There are also context. behind them is noted. If so, the individuals acting on their own Some of the individuals who have Security Service informs the who commit the same type of travelled in this context are guilty of Police Authority and ensures that offences on similar targets and crime. This applies for example to these individuals and their families using very similar methods for no those who travelled in order to receive the attention of other ideological reason. commit serious offences in support authorities concerned. In cases of violent extremism on and after where children could be nega- April 1, 2016, when legislation con- tively affected, the Security cerning terrorist travel (making it Service files a formal report of illegal to travel abroad to engage in concern about maltreatment of or plan terrorist offences) came into a child to the social welfare effect. Some of the individuals who authority. have travelled in this context are suspected of war crimes, which are handled by the Police Authority.

Extremism 40

Preventing the proliferation of weapons of mass destruction

Each year, illicit attempts are WMD programmes. The majority of In such cases, the focus is usually on the products needed to produce areas where the knowledge gained made to procure products and WMDs are not unique to weapons may be used both for civilian pur- know-how in Sweden – for use manufacturing, but feature in several poses and in WMD programmes. in other countries’ weapons of types of industries which manufac- ture common civilian products. Such mass destruction (WMD) How to prevent the crimes products, for example vacuum pumps, One of the most important ways of programmes. Countering such which may also be used to produce preventing the proliferation of WMDs attempts falls within the remit weapons of mass destruction, are is to have an active dialogue with referred to as dual-use products. companies, research institutes and of the Swedish Security Service. public agencies having access to the In addition to intensive Why such crimes take place here products, technology or expertise intelligence work, targeted Sweden has an open research climate needed to develop such weapons. with extensive international contacts, Many companies are not aware that information campaigns have which is a contributing factor to the they are manufacturing items that proven to be an efficient country’s leading position in a num- could be used in the development of method. ber of technological areas. While this WMDs. For this reason, the Swedish is very positive, cutting edge technol- Security Service visits companies, ogy and know-how can also be used trade fairs, industry associations and weden is committed to limiting for military purposes. For this reason, research institutes to reduce the risk access to and proliferation of attention needs to be paid to who gets that these become involved in pro- SWMDs (nuclear weapons, bio- access to this technology and exper- curement for WMD programmes. logical and chemical weapons, and tise. This factor, together with During these visits, the Service pro- their carriers, such as ballistic Sweden’s extensive export industry, vides information about current legis- robots). For this reason, products and makes Sweden attractive to countries lation and the importance of applying know-how must be prevented from wishing to manufacture WMDs. This for an export permit when exporting exiting the country and being made applies to products and know-how for products subject to export control. available to other states. The Swedish the manufacturing as well as develop- These visits are sometimes made Security Service’s remit also includes ment of WMDs. A majority of the together with the Inspectorate of preventing chemical, biological, states the Swedish Security Service Strategic Products. In counter- radiological, or nuclear substances suspects of having WMD pro- proliferation issues, the Service’s (CBRN) from ending up in the wrong grammes require advanced research other partners include Customs, the hands. expertise from outside their own Defence Research Agency, the country. States needing to advance Radiation Safety Authority and the Crimes to combat their expertise may send researchers Armed Forces. The Swedish Security The goal is to prevent Swedish from their own country to universi- Service is also involved in interna- companies and research institutes ties abroad, or initiate a collaboration tional efforts to prevent the transfer from knowingly or unknowingly project between one of their own of expertise and products from or via contributing to other countries’ universities and a Swedish university. Sweden.

How procurement takes place – an example Thwarted attempts in 2018 The Swedish company Alfapump is a leading manufacturer of vacuum In 2018, the Swedish Security Service pumps. They are contacted by a company called Bravovarb, located in helped thwart numerous attempts to a country outside the EU. Bravovarb wants to purchase a number of procure products or expertise used to vacuum pumps. Alfapump applies for and is granted an export permit manufacture WMDs. The Service’s goal by the Swedish Inspectorate of Strategic Products (ISP). However, the is to continue to prevent procurement buyer of the products, Bravovarb, is only an intermediary. Shortly attempts, mainly through information after the acquisition, the vacuum pumps are illegally exported to the efforts. Detecting these crimes requires real end recipient, C-Ypres, located in a third country, which is part of intensive intelligence work, sharing of a WMD programme. Without Alfapump knowing, the Swedish vacuum information and close collaboration pumps are used in a uranium enrichment process as a part of the between the Swedish Security Service, concerned country’s ultimate aim to manufacture nuclear weapons. other law enforcement authorities and export control authorities

Reduction 41

Aliens cases

The Swedish Security Service’s such assessments, and therefore terrorism, left and right-wing refers certain cases to the Security extre­mism, and unlawful remit includes preventing Service for comments. If someone is intelligence activities. Therefore, an individuals who pose or may assessed to pose a security threat, this investigation is initiated only when come to pose a security threat may be grounds for refusing them there is information that an Swedish residency or citizenship. individual is linked to one of these from staying or settling in areas. Based upon what is known Sweden. The Service’s role in When are investigations about the individual’s background, relation to aliens legislation initiated? contacts or activities, in Sweden or An investigation is initiated when the elsewhere, the Service makes an and as a referral body for the Migration Agency becomes aware of assessment as to whether he or she Swedish Migration Agency is certain facts or has information could come to engage in security- a key element of this work. about an individual that indicates threatening activities. that further investigation may be necessary. Alternatively, the Security What happens once the What does being a referral Service may have information and assessment is made? body entail? therefore asks to have a particular The Service’s assessment of whether Put simply, the Service replies to case referred to it. The Service only the individual poses a threat or not is questions from the Swedish Migra- investigates cases where it is feared sent to the Migration Agency, which tion Agency. These primarily concern that the applicant could pose a makes the final decision in the case. cases where people have applied for security threat, and attaches great In addition to its competence in resi- Swedish residency or citizenship. The importance to investigating dency and citizenship processes, the processing of such applications by the applications for Swedish citizenship, Swedish Security Service may also Migration Agency includes an assess- as this cannot be revoked. take special measures to monitor ment of whether the applicant could individuals assessed to pose a threat pose a security threat to Sweden. What is assessed? but who for various reasons cannot However, the Migration Agency does The Service assesses threats to be expelled and therefore remain in not have enough information to make Swedish security in the areas of Sweden.

Developments in 2018 The Security Service and the mainly associated with the huge more efficient without compromis- Swedish Migration Agency make increase in asylum applications ing quality or the rule of law. This is continuous efforts to enhance their received by the Migration Agency in done to maintain the ability to cooperation and methods. Over the 2015. Since 2015, both the Security identify potential security threats past few years, the influx of referrals Service and the Migration Agency amid the increasing number of to the Service has been substantial, have intensified their efforts to cases. and this also applies to 2018. This is render methods and procedures

What powers does the Service have to intervene Residency cases against individuals posing a security threat? In 2018, the Swedish Security Service received The Service applies existing laws and regulations within the 762 referrals concerning Swedish residency. framework of its remit to prevent and avert offences that Citizenship cases may harm Sweden and Swedish democracy. Under e.g. the In 2018, the Swedish Security Service received 2 Act concerning Special Controls in Respect of Aliens, the 604 referrals concerning Swedish citizenship, Service may take special measures to monitor and detain requested and commented on a further 377 cases, individuals assessed to pose a threat to Sweden. and recommended rejection in 56 cases. This Act also allows the Service to apply to the Migration Agency to have an individual expelled, and in general autho- Legislation rises the Service to decide on whether an individual is to be Legislation governing the Swedish Security temporarily detained. The Migration Agency and the Service’s handling of aliens cases: Government then make the final decision. • The Aliens Act • The Swedish Citizenship Act • The Act concerning Special Controls in Respect of Aliens

Reduction 42

Production: The Swedish Security Service Graphic design: Yours Communications Agency, Sweden Printed by: Stibo Graphic A/S, Horsens Denmark ISBN: 978-91-86661-16-8 How to order: This publication can be downloaded from www.sakerhetspolisen.se and ordered via [email protected]

Illustrations: Cover and pages 5, 27, 30: Fredrik Tjernström Pages 32 and 34: Michel Ducourneau Pages 8, 9, 10, 11 and 23: Shutterstock

Photographs: Pages 3, 4, 12, 14, 17, 18, 19, 20, 21, 22, 24, 25, 31, 32, 33 and 36: Magnus and Jennifer Glans/Svartpunkt Pages 28, 29 and 39: TT Pages 7: The Swedish Security Service

Infographics: Patrik Öhman/Yours Communications Agency, Sweden

Production 43 44

The Swedish Security Service detects and prevents offences against national security, counters terrorism, and protects the central government. We do this to safeguard Sweden’s democratic system, the rights and freedoms of our citizens and to protect national security.

Swedish Security Service Box 12312, SE-102 28 Stockholm Phone +46 10 568 70 00, Fax +46 10 568 70 10 Email: [email protected] www.sakerhetspolisen.se