Investigation against federal agencies for serious violations

Following the ransomware attack on the Bern-based company Xplain and the illegal access to search data, the Federal Commissioner for Data Protection and Information (Edöb) opened an investigation against the Federal Police (Fedpol) and Customs and Border Protection (BAZF).

In both cases, the top Swiss data protection officer suspects serious violations of data protection regulations.

What happened?

As early as April 13, the Edöb launched a preliminary investigation into Federal Office of Customs and Border Protection (BAM) employees’ access to Fedpol’s Ripol national wanted register, as announced on Wednesday. During the preliminary clarification, both federal services took a position.

The suspicion of violations of data protection law arose due to the question of the “Aargauer Zeitung” about the legality of the BASF accesses.

The two federal agencies also informed the Edöb in early June that there had been data security breaches with potentially high risks for those involved when working with the hacked IT service provider Xplain. The watson news portal made the ransomware attack public in a report on May 23.

Formal investigation started

After evaluating the statements about possible data protection violations by the BASG and the reported data security violations in collaboration with the hacked IT service provider Xplain, Eböd completed the preliminary investigation. He started the formal investigation on Tuesday.

Hackers attacked a vulnerability on Xplain’s servers with ransomware and stole federal government data stored there.

On June 1, the suspected Russian cybercriminals released several gigabytes (GB) of stolen data on their dark web leak site.

On June 8, the National Center for Cybersecurity (NCSC) announced that federal operational data could also be compromised by the attack.

On June 14, the cyber criminals would have made all stolen data (more than 900 GB) accessible. Such a publication is called a «full dump».

The federal prosecutor’s office has started proceedings.

Questionable access to Ripol

The other possible breach of data protection regulations came from the BASF. As the “Aargauer Zeitung” reported on April 11, civilian customs officials there had access to the Ripol search system. That was stopped without warning in March.

According to the newspaper report, the BASF apparently knew that civilian access was not legal, but granted permission because it was practical and the legal basis in the Customs Act was long overdue.

Sources

(dsc/sda)