Finnish diplomats have been targets of cyber espionage by means of the Pegasus spyware, developed by NSO Group Technologies, which has received wide publicity. The highly sophisticated malware has infected users’ Apple or Android telephones without their noticing and without any action from the user’s part. Through the spyware, the perpetrators may have been able to harvest data from the device and exploit its features.
The Ministry for Foreign Affairs inquired into the case together with different public authorities and stakeholders in autumn and winter 2021–2022. The case was directed at posted employees working in Finnish missions abroad. The inquiry has enabled to Ministry to determine the timeline of the activities. The espionage is no longer active.
The Ministry for Foreign Affairs processes information at different security levels using different methods. Information transmitted by telephone is public or classified at level 4 at the maximum, which is the lowest level of classified information. However, it is worth noting that even if information is not directly classified, the information itself and its source may be subject to diplomatic confidentiality.
The Ministry for Foreign Affairs is continually monitoring events and activities in its operating environment and assessing related risks. The Ministry for Foreign Affairs monitors its services and strives to prevent harmful activities. The preparation of and decisions on foreign and security policy, in particular, are matters that attract much interest, which may also manifest itself as unlawful intelligence. The Ministry responds to the risk by various means, but complete protection against unlawful intelligence is impossible.
Questions related to information security and protection against illegal intelligence: Matti Parviainen, Director for Information Security, tel. +358 295 351 425
Finland’s cyber diplomacy: Jarmo Sareva, Ambassador for Cyber Security, tel. +358 295 350 418
The Foreign Ministry’s email addresses are in the format firstname.lastname@example.org.