Switzerland adopts new checks against foreign espionage

Under pressure from India and other countries to share banking information, Switzerland today decided to beef up its IT security framework to protect against espionage by foreign intelligence services.
At a meeting held today, the Swiss government's apex decision making body, the Federal Council, approved a revision of the country's ICT (Information, Communication and Technology) security framework.
"A verification process will now be applied to reduce the risk of ICT providers that are exploited by intelligence services spying on information through procurement projects for the Federal Administration. The new directives will come into effect on January 1, 2016," the Federal Council said.

The Council said intelligence services of various nations pursue a comprehensive information gathering strategy.
"These services can oblige ICT industry in their country not to comply with contractual and statutory confidentiality obligations," it said in a statement from Berne.
Switzerland has widely been known as a 'safe haven' for alleged illicit funds of foreigners, including Indians, given the high secrecy practices followed by their banks.

However, the European nation has begun cooperating with various countries, including India, in suspected cases of black money over the recent years amid enhanced global pressure.
Without specifying the trigger for the move, the Council said it is putting in place "new ICT security procedures to protect against espionage by intelligence services".

Consequently, the service providers that have their registered office outside of Switzerland, or whose dependence on foreign countries represents a risk, can no longer be considered as the ICT security partners.
"They must undergo intensive checks and, where necessary, be completely excluded from the procurement of critical services," it said.
The Council further said that it had previously asked the Federal Department of Finance (FDF), together with the departments and the Federal Chancellery, to draw up principles for ICT service provision in the Federal Administration.
They were also asked to identify the need for protection vis-a-vis ICT service providers exploited by intelligence services, establish the necessary protective measures and coordinate them with the procurement procedure.

"To implement these tasks, the FDF's Federal IT Steering Unit (FITSU) has created a verification process which will be enshrined as a new security requirement in the directives on ICT security in the Federal Administration and will come into effect on January 1, 2016."
The new framework also defines a criteria for identifying the risk-related ICT procurements.
"It also specifies how protective measures in terms of security, organisation and the sensitive area of procurement law are to be applied," the Council said.