Photo: Blogtrepreneur/Flickr.

The Swedish government could face impeachment after Prime Minister Stefan Lofven admitted on Monday that Romanian, Czech and Serbian programmers without proper security clearance might have had access to the personal data of Swedish citizens – an incident that showed how low-cost Eastern European IT companies are increasingly being used by Western European countries.

Swedish premier Lofven confirmed at a press conference on Monday that his administration potentially exposed the personal information of millions of Sweden’s citizens after the Swedish Transport Agency started outsourcing its database and IT service management to private companies like IBM in the Czech Republic and Romania and NCR in Serbia.

Romanian programmers told BIRN that the situation is quite common, because many multinational IT companies in Central and Western Europe use Eastern European subcontractors whose employees carry out the projects at cheaper rates.

However, they said, security conditions, even when the client is a multinational company rather than a government, are tight for the programmers because of fears that they might steal sensitive data.

An investigation by Swedish newspaper Dagens Nyheter started to shed light on the case in mid-July.

The Swedish Transport Agency allegedly uploaded all of its data to IBM and NCR’s cloud servers, where it was accessible to people outside Sweden who didn’t have proper security clearance.

This information included all the details found on a vehicle registry: the names, photographs, and home addresses of millions of Swedish citizens, including information on thousands of people with protected identities working in the military or even Swedish intelligence.

But while the Swedish government is worried about a possible leak of confidential and national security data, Romanian programmers say the theft of data by subcontractors is not very common, unless it is a case of espionage.

A Romanian programmer employed by a company based in Bucharest told BIRN on condition of anonymity due to the sensitivity of the situation that his company has been subcontracted by Polish or Czech subcontractors to carry out projects for large British companies.

“We are basically cheap sub-sub-contractors. Eastern Europeans usually have the skills, but companies don’t have the certifications that multinational companies have and can’t get the contracts first-hand. Therefore we do the work, they get the big money,” he explained.

However, he said, when there is sensitive data involved, the security is also very tight.

“When the project is done, the laptop is formatted, the hard drive is destroyed and I’ve had instances when my laptop at work was tied to my desk with a security cable to avoid theft of information and at night it was locked up in a safe. Access to databases is also supervised,” the programmer explained.

“But yes, I believe that uploading national security data on an iCloud is quite reckless,” he added.

Micael Byden, the supreme commander of the Swedish Armed Forces, told Bloomberg that although he regards the incident as serious, there has been no indication so far of any significant impact on the Swedish military’s operational abilities.

Romania and Serbia’s information and communication technology industries have been booming over the last decade with large multinational companies setting up branches in both countries.

In Romania, this happened after the government decided in 2006 to scrap employee taxes for IT companies that hired Romanian personnel.

According to the most recent data released by the Romanian National Statistics Institute, information and communication technology makes up about six per cent of the country’s GDP and employed at least 163,000 people in 2015. The number of start-ups, however, has grown in the past year.

According to forecasts released by Romania’s Employers Association of the Software and Services Industry, ANIS, the industry is expected to generate over four billion euros in turnover in 2017, particularly because of services supplied abroad.

Belgrade is also one of the biggest information and communication technology centres in Eastern Europe.

Many large companies have set up operations in the Serbian capital, encouraged by a large pool of domestic engineers and mathematicians and low wages.

These major investments generated over 678.3 million euros worth of exports for Serbia in 2015.