DN's review shows that between 2013 and 2019, Swedish Radio worked with external consultants who were not security tested to build a system for a “digital VMA” that is communicated to other media and social actors in parallel with the VMAs that go out in radio broadcasts.
Documentation, which contained instructions on how to communicate a digital VMA and "blow off" one, must also have been stored on a US cloud service.
- It is problematic because Swedish Radio is an important part of the total defense and has a contingency mission, says journalist Patrik Lundberg who together with Josefin Sköld did the review.
Annsofi Eriksson, head of the technology unit at Swedish Radio, believes that DN's information that the consultants have not been security tested is incorrect.
- These theses are not always based on facts, therefore we do not comment on them as facts, she says.
"Can not take a stand"
She also says that SR can not take a position on the information about the cloud service because they have not seen the documentation that DN refers to.
But according to a policy that the company has, no security-classified information should be uploaded to cloud services.
However, the policy was not introduced until the end of June this year.
- Our review shows that these consultants have uploaded this documentation on the foreign cloud, says Patrik Lundberg.
According to sources to DN, no regular security test has been performed with regard to the digital VMA system.
- We perform regular security tests of all our systems, so it is simply not correct, says Annsofi Eriksson.
SVT uses the same system
Swedish Television also uses VMA, but according to SVT's press service, the system is based on manual handling.
First by SR's traffic editor and then at SVT.
The company does not intend to change any routines.
- SR, which is its own company, works with security issues completely separated from SVT, writes Christina Boman, head of security at SVT in a text message.
Kulturnyheterna has applied for Swedish Radio's CEO Cilla Benkö.