Skr. 2016/17:213 Dependencies and links between different technical systems are in themselves a vulnerability factor since disruptions can have consequences that are difficult to anticipate and manage. This is particularly true as most networks and information systems are globally linked via the internet. The internet is today a global infrastructure, and Swedish society’s critical infrastructure is highly integrated with the internet. The internet is so essential that an attack against or other incidents within this infrastructure could lead to serious consequences for Sweden’s security and national interests. What are the risks and threats? The scale of threats and risks in the area of information technology ranges from less extensive risks for private individuals to well-planned and precision attacks against vital parts of the functioning of society. Various forms of disruptions to software or hardware, or disruptions in the operating environment are common. External physical events, such as fires, severed underground cables, floods or solar storms, are also a part of the threat scenario. In principle all those connected to the internet, both private individuals and private and public operations, are currently exposed to risks since intrusion attempts are constantly being made against internet-connected systems. This type of mass attack is often more or less random. An example of this is the major increase in fraud and identity theft taking place via the internet. According to the Swedish National Council for Crime Prevention (Brå), statistics show that crime with elements of IT (computer fraud, fraud committed with the aid of the internet, data infringement and internet-related child pornography crimes) increased by 949 per cent between 2006 and 2015 (2016:17). The person responsible for an IT system must assume that intrusions and attacks can succeed, even though a great number of these are actually averted. Targeted intrusions and attacks can be performed by private individuals, groups of individuals, non-governmental organised groups or states and statesponsored actors. The possible action of states, state-sponsored actors or other actors of a similar capability constitute the most serious cyber security threat against Sweden. These qualified attackers have the capability, resources and perseverance to devise and use advanced methods. Cyberattacks and various forms of intrusion in IT systems can constitute a separate antagonistic threat as well as one of several political and military instruments of power. Espionage and attacks from state and state-sponsored actors against security-sensitive activities in Sweden or against Swedish interests abroad can, for example, have the aim of appropriating information about Swedish economic interests, Swedish companies, Swedish research, Swedish defence capability and planning, our security policy objectives, vital societal functions and critical infrastructure. Covert intrusions and attacks can be used in order to prepare for sabotage against critical infrastructure in peacetime. These can also be used openly as a tool primarily in the initial stages of military operations. Cyberattacks can have major consequences for vital societal functions and critical IT systems similar to a conventional armed attack and can therefore, in some cases, be considered an armed attack. Attacks can also be directed against our fundamental values and the democratic functions of society, e.g. through disinformation and influence campaigns. Disinformation can be used to intentionally disseminate untrue or misleading details in order to influence people’s attitudes, standpoints and actions in a certain direction. An influence campaign is centrally controlled, while also offering the use of a broad spectrum of methods, both open and covert, a subset of which might be data intrusion and other cyberattacks. It can also include political, diplomatic, economic and military instruments of power. The dissemination of incorrect or misleading 6