The Swedish Transport Administration was recently revealed purchasing Microsoft services and discarding their own regulations and any Swedish or EU laws in the process.
The following text is a translation of news article by the Swedish public broadcaster Sveriges Radio. “Ekot” is one of their programs and “P4 Dalarna” is one of their regional stations.
Minor edits were done to the raw translation for clarification.
The Tech Giant opposed the Demands – The Swedish Transport Administration signed anyway
- The Swedish Transport Administration released all requirements in negotiations for an agreement with Microsoft, requirements that the lawyers at the authority considered necessary.
- Among other things, it was about the fine, the principle of publicity and data transfer to other countries, shows Ekot’s and P4 Dalarna’s review.
- Because the tech giant’s delivery was considered crucial for the business, the Swedish Transport Administration signed the agreement despite Microsoft rejecting all demands in three rounds.
When the Swedish Transport Administration was about to sign a license agreement with Microsoft last year, the agency’s lawyers discovered several problematic points in Microsoft’s standard terms.
They entered into a negotiation that is described in detail in a service note that Ekot and P4 Dalarna have seen.
The lawyers identified 18 conditions that needed to be in the agreement – as minimum requirements.
The demands were brought up in negotiations with Microsoft, which responded that it was not willing to meet any of them.
Demand for fines and compliance with the law
The points were then whittled down to a shorter list, which included, among other things, that Microsoft, like all other suppliers, would have to accept that the Swedish Transport Administration may have to release information in accordance with the public disclosure principle.
And also that the storage, processing and transfer of data must comply with Swedish and EU legislation, and that Microsoft would have to pay a fine in the event of deficiencies and would not be able to terminate the agreement without reason.
But the slimmed-down list of demands was also rejected, and after Swedish Transport Administration’s stripped down its list again, there were only three demands left, which were described as “absolutely necessary”.
But Microsoft also said no to them, and had thus finally rejected all minimum requirements.
“Crucial”
But despite that, the Swedish Transport Administration then decided to accept the agreement, because the tech giant’s delivery was considered crucial for the business.
According to the IT researcher Björn Lundell, it is difficult to gain insight into how this type of negotiation takes place, and it is unusual for it to be this clear how authorities choose to accept the terms of the tech giants.
– I would say that is unusual. It’s not what you usually see.
Shall assess suitability
The Swedish Transport Administration does not agree to an interview, but states in a written comment that it cooperates with both suppliers and other authorities to ensure that cloud services meet all requirements for both security, legality and digital sovereignty.
Suitability assessments will also be carried out, to prevent security risks, before introducing cloud services. But they don’t want any further details around that so as not to “expose vulnerabilities”.
Microsoft declines an interview and writes in an email that it does not comment on individual customers, but that it works together with customers to find opportunities and risks and that it has all protections in place for data.
