Well-attended panel discussion on cyber risks and digital sovereignty

The conversation was based on the extensive cyber attack that the learning management system Studium/Canvas used by Uppsala University and the Swedish University of Agricultural Sciences (SLU) suffered in early May this year. Around 9,000 universities, schools and educational organisations around the world were hit when the attackers stole user data and demanded a large ransom for not publishing it. The company behind Canvas is said to have paid up, but the amount has not been disclosed.

Chief Security Officer at Uppsala University Fredrik Blomqvist began with a broad overview of the attack and its consequences for the University, students and staff. The hackers broke into Canvas on 25 April, and it was not until four days later that the intrusion was discovered. On 7 May, the hackers published a message from inside the system. As a result, Studium at Uppsala University was closed for about 12 hours.

Shutting down the system is the biggest challenge

In total, the incident lasted 18 days, and the hackers got their hands on over 3.6 terabytes of data — equivalent to about 72 million e-mails. Despite the size of this hack, the consequences for Uppsala University’s core business were limited, according to Fredrik Blomqvist.

“It was accessibility aspects that were most affected. Even though a large quantity of personal data was leaked, such as names, e-mail addresses, student IDs and messages between teaching staff and students, it was not sensitive data, he said.

The discussion also raised the issue of how dependent universities and municipalities are on global cloud services. When sensitive data is stored with international actors, they often fall under foreign jurisdictions, said Daniel Melin, business developer at Teracom, spokesperson for EuroStack, and expert on digital sovereignty. This can entail both legal and security risks. In addition, when critical systems are attacked, it can result in the loss of years of information, and this fact necessitates back-up procedures. He also said that unclear supply chains and complex systems can make it difficult to assess the suitability of cloud services.

Preparedness for alternative solutions needed

“Uppsala University has long been cautious about using cloud services, but is now entering the Microsoft ecosystem – with clear limitations on the type of data that may be stored there,” said Fredrik Blomqvist.

According to Robert Reineck, unit manager for Cyber and Information Security at Uppsala Municipality, you need to impose requirements, scrutinise the suppliers and do joint follow-up, as the same supplier is often used in multiple municipalities.

He also stressed the importance of being able to maintain essential services when there are disruptions.

“What capacity do we have to be able to communicate, share documents and hold digital meetings, if that service is not available? I think trying out and finding other solutions is key here,” Reineck said.

Have an exit strategy in mind

Moderator Ida-Maria Sintorn, Vice-Dean for Collaboration at the Disciplinary Domain of Science and Technology at Uppsala University, asked how these issues are taken into account when procuring new systems. The answer that Robert Reineck gave was that organisations often focus on choosing a service with the right functionality in the procurement process, but much less on what happens afterwards.

“People tend to think far less about continuity. What happens when we don’t have the service? Or how do we withdraw from the service? Can we have an exit strategy? Is it possible to move data from one service to another?

The conversation ended with a discussion about digital sovereignty and the EU’s work to control its own digital infrastructure and to reduce dependence on global actors. Geopolitics, wars in our neighbourhood and threats to critical infrastructure make the issue urgent, according to Daniel Melin.

“We’ve digitalised everything. But we must have more capabilities ourselves, otherwise we will have no continuity in our own countries,” he said.

Strategic work for digital independence

According to the panellists, both national strategies and local work with information classification, redundancy, continuity planning and well-considered exit strategies in procurements are needed. Municipalities and universities are now working to identify which activities must continue to function even in the event of a crisis or war and to develop alternative solutions.

Fredrik Blomqvist stressed the importance of a heightened state of alert, Sweden’s total defence and being able to continue to provide education even during a war. He said that strategic direction and strategic decisions are needed for Sweden as a nation, as it is difficult for individual government agencies to manage these issues.

“As part of strengthening our capabilities in Sweden’s total defence, Uppsala University is working to identify essential services, starting within the Disciplinary Domain of Medicine and Pharmacy. With this as our basis, we will then know which services need priority protection from all kinds of antagonistic threats in the event of the country being drawn into a war,” he concluded.

Anneli Björkman