Supo - News and press releases

Joint operation by authorities curbs Russian cyber espionage

Wed, 08 Apr 2026 06:46:00 GMT

An international joint operation by authorities has successfully disrupted cyber espionage activity by Russia’s military intelligence service GRU by preventing the use of a global cyber espionage network made up of compromised network devices. From Finland, the Finnish Security and Intelligence Service (SUPO) and the National Cyber Security Centre Finland (NCSC-FI) at Traficom took part in the operation led by the United States Federal Bureau of Investigation (FBI).

A cyber threat actor linked to the GRU, also known as APT28, Fancy Bear and Forest Blizzard, has in recent years made extensive use of poorly secured home routers as part of its global cyber espionage infrastructure. The international joint operation targeted TP-Link routers compromised by the GRU that had not been patched against vulnerability CVE-2023-50224. This vulnerability allows an attacker to send a request to the device that reveals passwords or keys stored on it, thereby enabling the attacker to take control of the device.

The GRU has used compromised network devices to spy on device users by modifying the devices’ domain name system (DNS) settings. This has enabled adversary-in-the-middle attacks and the decryption of encrypted network traffic. Compromised network devices have also been used as part of an operational security (OPSEC) infrastructure, which both disguises cyber espionage traffic as ordinary network traffic and makes it more difficult to detect, identify and trace the perpetrator. The GRU’s interests have included non-disclosable information relating to military activities, central government and critical infrastructure.

In Finland, SUPO and the NCSC-FI worked together to counter cyber threats targeting Finland and carried out via Finland. During the joint operation, the authorities informed the owners of at-risk routers, cleaned devices that the GRU had the capability to compromise and blocked the GRU’s access to the devices in cooperation with their owners. However, Russian intelligence services pose a continuous and long-term intelligence and cyber threat to Finland, and disabling a single network of compromised devices does not remove the threat.

Securing home devices helps prevent cyber espionage

The authorities warn that Russia is using poorly secured internet-connected network devices worldwide to gather intelligence. The purpose of the warning is to encourage device owners and cybersecurity professionals to reduce the opportunities for online espionage through their own actions.

A poorly secured router can, without the owner’s knowledge, enable cyber espionage or other malicious activity. Everyone in Finland can improve network security by taking care of their own network devices. Devices, applications and software should be kept up to date and updates should be installed regularly. When home network devices are current, updated and supported by the manufacturer, the risk of them being used in cyberattacks is significantly reduced.

Further information on how to secure your own devices is available on the NCSC-FI website:

Home network and router security | NCSC-FI

The FBI published a joint warning by the authorities on 7 April 2026:

Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information | Internet Crime Complaint Center

Technical information on APT28’s activities:

APT28 exploit routers to enable DNS hijacking operations | NCSC-UK

Enquiries
SUPO communications, tel. +358 50 402 6981, media@supo.fi
Traficom media service, tel. +358 29 534 5648

]]>

Russian superpower ambitions will remain also after the war

Tue, 10 Mar 2026 08:07:00 GMT

The Finnish Security and Intelligence Service’s (SUPO) assessment of the development of the Russian threat remains similar to the previous year: The security situation in Finland may deteriorate further when Russia’s war of aggression in Ukraine ends. Russian intelligence capacity in Europe has suffered due to the war, and Russia is preparing to restore this capacity particularly in terms of human intelligence. Russian intelligence and influencing resources currently tied to Ukraine will become available to be used elsewhere after the war, and Russia’s permanent interest in Finland is ensured by Finland’s position as a NATO country between the Baltic Sea and the Arctic region. The current uncertain security situation underlines the importance of intelligence produced by the Finnish Security and Intelligence Service to the government.

Although the war appears to continue for the foreseeable future, Western countries, including Finland, will have to decide how to restore economic and political relations with post-war Russia. Russia aims to regain its foothold in intelligence as well as in political and economic influencing, and one of its key objectives is to ease the sanctions imposed on it. Russia’s potential willingness to cooperate will not reverse the confrontational stance it has taken in relation to the West. Its strategic superpower ambitions will remain. These views are described in the SUPO National Security Overview which was published in a public hearing of the Parliamentary Intelligence Oversight Committee on 10 March.

"If relations are even partially restored, the intelligence threat posed by Russia to Finland will become more diverse, with previous operating methods complemented by methods proven effective in the current environment. These include the extensive utilisation of proxy actors and intelligence gathering from bases on Russian soil," says Juha Martelius, Director of the Finnish Security and Intelligence Service.

Finland and the Nordic countries have thus far not been at the focus of Russian influencing operations, and no sabotage has been targeted against Finland. As various events are readily attributed to Russia, Russian influencing against Finland may appear more extensive than it truly is. Such interpretations increase Russian deterrence.

In addition to Russia, also China has a continuous and long-term intelligence interest in Finland. While Chinese cyber operations continue to focus on foreign and security policy, in recent years they have increasingly targeted critical infrastructure in the West.

Superpowers leverage economic and technological dependencies

The importance of the private sector economy for national security is increasing as states are seeking to secure their own positions in the competition for technological development and the raw materials it requires. SUPO is aware of numerous successful cyber espionage cases in recent years in which state actors have penetrated the systems of Finnish start-ups. State-backed intelligence operations most often originate from Russia or China.

Dependencies on energy supply, raw materials, technologies, and supply and production chains give superpowers with control over them leverage to pressure other countries. For example, China has gained control over a significant portion of the supply chains of critical minerals, allowing it to exert influence by restricting the export of critical minerals from China.

From the perspective of national security, it is essential to ensure that Finnish top-level national government is able to make its decisions from the perspective of Finnish interests. SUPO has taken a more prominent role in the field of economic security over the past year.

The National Security Overview also includes an updated terrorist threat assessment. The threat level of terrorism remains at level three, elevated, on a five-point scale.

Inquiries

SUPO communications, tel. +358 50 402 6981, media@supo.fi

]]>

SUPO is looking for human intelligence officers proficient in languages – express your interest by letter

Tue, 03 Mar 2026 10:34:00 GMT

The Finnish Security and Intelligence Service (SUPO) has launched an exceptional campaign for recruiting a number of human intelligence officers for permanent positions. We are primarily interested in individuals proficient in Russian or Chinese. However, proficiency in French, Spanish or a less common language may also be considered.

Human intelligence officers spearhead SUPO intelligence operations both in Finland and abroad, gathering information on threats to Finnish national security. The work involves gathering intelligence from human sources by means of personal interaction. At best, this intelligence may prove significant for Finnish national security.

Human intelligence requires social skills instead of specific degrees or experience

Human intelligence involves long-term and responsible work in the background. It is suitable for ordinary individuals who are open and easily approachable but do not wish to be in the limelight. In addition to language proficiency, human intelligence requires social skills, the ability to work under pressure, creativity and teamwork.

“We are hoping to attract candidates of varied and diverse backgrounds. Being able to blend in is an asset in intelligence, but work experience in for example civil service is not a requirement for human intelligence officers,” says Pekka Hiltunen, Head of SUPO Intelligence Department.

You can express your interest in these positions by sending a letter to SUPO by post. Please print and attach the CV and motivation form available on the SUPO website as well as a short video on a USB memory stick. The Finnish Security and Intelligence Service may offer permanent posts in human intelligence to suitable candidates. Multiple posts are available, and they may be placed across Finland in localities with a SUPO office. At the latest, the letters should be received by 27 March 2026.

Read more about the campaign and human intelligence officer work:

Media inquiries and interview requests for Pekka Hiltunen:
SUPO communications
media@supo.fi and tel. + 358 50 4026 981

]]>

SUPO conducted more than 109,000 security clearance vettings in 2025

Fri, 27 Feb 2026 08:01:00 GMT

The Finnish Security Intelligence Service (SUPO) conducted more than 100,000 security clearance vettings for the first time in 2024. That number was also exceeded last year, even though the total number of 109,000 was a few thousand less than the 115,000 vettings carried out in the previous year.

Approximately 88,000 new vettings were performed and around 21,000 existing security clearances were utilised in people’s new positions.

Approximately 47,000 concise security clearance vettings were performed and they accounted for more than half of all security clearance vettings. Concise security clearance vetting may take place, for example, when an employee's duties involve accessing secure premises. At approximately 40,000, the number of standard security clearance vettings was at nearly the same level. Comprehensive security clearance vetting continues to apply only to special cases, and just over 600 were performed last year.

SUPO has focused on developing the use of interviews in the security clearance vetting procedure. If necessary, they can be utilised in all scopes of security clearance vetting. More than 900 security clearance vetting interviews were conducted last year.

Employers were informed of security clearance vetting observations in about three percent of the cases

Security clearance vetting involves examining the background of a person in order to ensure their reliability in relation to the position for which the vetting is performed. SUPO uses overall consideration and only informs the organisation requesting security clearance vetting of details that may be relevant to performing the duties in question.

Last year, SUPO notified employers of relevant information revealed during security clearance vetting around 2,600 times. This corresponds to approximately three percent of the cases. Employers can use this information to support their recruitment decisions or to assess whether a person can continue in their position.

Last year, almost all vettings were completed in less than two months. On average, security clearance vettings were completed within 12 working days, i.e. slightly over two weeks.

Inquiries

SUPO communications, tel. +358 50 402 6981, media@supo.fi

]]>

Director's column: The importance of economic security is emphasised in a transactional world

Mon, 15 Dec 2025 08:18:00 GMT

The importance of the economy and business sector for national security will grow as relations between countries shift from value-based partnerships in an increasingly transactional direction. In particular, competition for disruptive technologies will make authoritarian countries, above all China and Russia, use any means possible to improve their competitive position.

Disruptive technologies are rapidly evolving technologies that change our understanding of critical resources when taken to use. For example, as electric motors are taking over the market from internal combustion engines, the significance of oil as the key resource of the world is weakening, and the importance of rare earth metals needed in batteries is increasing. Quantum technology is an example of a disruptive technology in which Finland is exceptionally strong.

China and Russia strive to acquire technological innovations using both legal and illegal means even in Finland. Investments, corporate acquisitions, espionage and technology transfers through research cooperation are all part of the Chinese toolkit, for example.

Cyber espionage can steal a start-up’s future success

Start-ups in their early stages are often particularly vulnerable to activities against Finland’s security and interests, because their safety culture and resources are not yet at the same level as in large companies that have learned to protect themselves.

If an innovation developed by a start-up is stolen using, for example, cyber espionage, the company is often robbed of its whole future. At the same time, Finland’s national interests suffer if Finland thus loses a successful export company of tomorrow, a potential builder of a subcontracting chain or a driver of economic growth.

In its role as an intelligence and security service, SUPO both gathers intelligence for the Finnish state leadership on the objectives of great powers and combats threats to national security affecting Finnish business life.

Combating threats to the economy and business requires cooperation between companies and authorities. Protecting critical infrastructure alone is not enough, we must also be able to protect critical production and value chains. The information received from companies improves the authorities’ understanding of phenomena related to economic security, and the intelligence of SUPO helps companies protect themselves effectively.

SUPO must also be able to utilise technological development in its own work, which will require establishing more strategic partnerships with technology companies in the future.

Juha Martelius
Director of the Finnish Security and Intelligence Service

]]>

Mirkka Kreus appointed as Chief of Cabinet at SUPO

Thu, 16 Oct 2025 07:30:00 GMT

Licentiate of Administrative Sciences Mirkka Kreus started her duties as Chief of Cabinet at the Finnish Security and Intelligence Service (SUPO) at the beginning of September. She returned to SUPO after working for nearly two years at the Ministry of the Interior's National Security Unit. Kreus has a long-standing career at SUPO, having served in various departments. Prior to her transfer to the Ministry of the Interior, she most recently held the position of Head of the Intelligence Department.

“I have taken on this role with great enthusiasm. SUPO is undergoing change, and we are currently making strategic decisions on how to develop the agency. In the current security environment, the role of civilian intelligence is increasingly important, which makes the work of the Finnish Security and Intelligence Service particularly compelling,” says Kreus.

The Cabinet supports SUPO's leadership and departments in matters of strategic importance and also provides legal support, coordinates SUPO’s analytical activities, international relations, domestic partnerships, and communications.

Inquiries
SUPO communications, tel. +358 50 402 6981, media@supo.fi

]]>

Supo moves to Kaartinkaupunki

Mon, 15 Sep 2025 06:00:00 GMT

Supo has begun operating from new headquarters in Kaartinkaupunki, Helsinki. The security solutions of this new building along Fabianinkatu are entirely unique in Finland.

“For the first time in our history, we are now occupying premises that were specifically designed for the operating methods of a security and intelligence service. There is every reason to call this the most secure building in Finland," says Supo Director Juha Martelius.

The architecture and features of the building allow for the exceptional security challenges that are typical of Supo operations. Workspaces in the building seek to balance the sense of teamwork with exacting information security requirements. These flexible facilities are intended to serve the needs of Supo well into the future.

“Supo staff have been waiting for such state-of-the-art workspaces for decades, so we are eager to begin regular operations from the Kaartinkaupunki base,” Martelius explains.

The immediate neighbours of Supo in the block are the Ministry of Defence and Defence Command Finland, which previously occupied offices on the site of the new 140 metre-long Supo building.

A timeless facade in a historic setting

The new building was designed by Anttinen Oiva Architects, whose Adagio proposal was selected in an idea competition arranged for the construction project. The light brick facade and classical architecture of the building integrate it beautifully into the historic cityscape of the Kaartinkaupunki district.

The premises were designed in close partnership with Supo and the government real estate developer Senate Properties. The construction project was completed by SRV Construction Ltd on the alliance contracting model. The cornerstone was laid in September 2022, with the groundbreaking ceremony held just over a year later. Supo took formal delivery of the building in February 2025.

Supo and its predecessor agencies previously operated for over a century from the traditional Ratakatu premises in the Punavuori district of the city until this building reached the end of its lifespan. The Service has operated from temporary premises in recent years. The new Kaartinkaupunki building has now provided a new home for Finnish civilian intelligence.

The new street location of Supo is Kaartinkuja 3

The entrance to the new building is in Kaartinkuja near the corner of Tähtitorninvuori Park. The new visiting address is Kaartinkuja 3, 00130 Helsinki. Kaartinkuja is currently closed to through traffic due to construction work, with access from Fabianinkatu only.

The other contact information of Supo remains unchanged:

Postal address: PO Box 151, 00121 Helsinki, Finland
Telephone number (switchboard): +358 295 480 131
E-mail: kirjaamo@supo.fi

Inquiries
Supo communications, tel. +358 50 402 6981, media@supo.fi

]]>

Cyber security threat level remains high – serious cases on the rise

Fri, 29 Aug 2025 06:19:00 GMT

Based on cases reported to the National Cyber Security Centre Finland (NCSC-FI) at Traficom, Finnish organisations continue to be targeted by hostile cyber activity, and the number of serious data breaches and attempted intrusions has increased. The number of serious cases investigated by the NCSC-FI has more than doubled compared with the previous year. Findings of software vulnerabilities have also increased significantly, which greatly heightens the cyber threat to society. Traficom and the Finnish Security and Intelligence Service (Supo) nevertheless continue to consider the likelihood of cyberattacks capable of paralysing society on a broad scale to be low.

Serious vulnerabilities are being exploited faster

Based on reports made to the NCSC-FI, the cyber security threat level in Finland remains elevated. Over the past year, the number of serious cases has increased significantly, and several organisations have, for example, fallen victim to ransomware attacks.

Software vulnerabilities have also become more frequent. What is particularly concerning is how quickly new vulnerabilities are being exploited in attacks. This trend marks a clear change compared with last year.

Increasing phishing and scam messages are a growing problem

Phishing and scam messages have become a growing problem. During the past quarter, the number of scam and phishing messages reported to the NCSC-FI increased by 64 per cent. The figures are influenced by monthly fluctuations, and certain themes in scams tend to follow seasonal patterns. Bank-themed phishing messages, in particular, have become firmly established. These changes in the cyber threat landscape pose a broad challenge to society’s comprehensive security.

“For the NCSC-FI, the shift has been reflected especially in the growing number of tasks related to serious incidents. Cybercrime is international by nature, and technological development is expanding the opportunities available to criminals. It is crucial that society continues to function and that people can maintain trust in our digital society in the future as well. This requires ensuring sufficient resources for cyber security”, says Anssi Kärkkäinen, Director-General of the NCSC-FI.

Finland is well prepared for different cyber threats, but must remain vigilant

The NCSC-FI at Traficom maintains continuous situational awareness of cyber security across society and offers organisations broad support in different areas of cyber security. By analysing this information, it is possible to assess the impact of incidents and the development of the cyber security situation over the longer term.

Director-General Kärkkäinen reminds that Finland is well prepared for a range of cyber threats, but must remain constantly vigilant. Cooperation between different sectors of society is close, and information is shared on a daily basis. In some cases, companies themselves have actively shared information on an attacker’s activities, enabling other companies in the sector to protect their operations. This serves as a good example of collaboration between businesses and the authorities.

State-sponsored cyber threat against Finland remains active

The Finnish Security and Intelligence Service (Supo) works to counter foreign states’ cyber espionage and influence operations against Finland and provides related intelligence to relevant authorities. According to Supo, the development of Russia’s cyber threat towards Finland will be shaped in particular by how Russia’s military operations in Ukraine continue.

“When the war in Ukraine subsides or ends, Russia will be able to redirect cyber capabilities currently tied to Ukraine also against Finland", says Teemu Liikkanen, Head of Supo’s Counterintelligence Department.

Supo also assesses that China’s cyber activity targeting Finland remains active. China also makes active use of Finnish network infrastructure and poorly protected consumer devices in Finland in cyber operations directed at third countries.

Society must be constantly prepared for changes in the threat landscape, including online

According to Director-General Kärkkäinen, all sectors of society must be prepared for changes in the threat landscape at all times. Key elements in this are information sharing, foresight and the continuous development of effective cooperation.

"We remind organisations to continue reporting all information security incidents to us with a low threshold – whether they involve phishing messages, denial-of-service attacks or attempted data breaches. Sharing information helps us safeguard the operational reliability of critical infrastructure that is essential for national security. It is vital that the key services underpinning society – such as energy, telecommunications, healthcare and communications – remain protected and continue to function without disruption in all circumstances", says Director-General Kärkkäinen.

Enquiries
Traficom media service, tel. +358 29 534 5648
Supo media service, tel. +358 50 402 6981, media@supo.fi

]]>

Finland must prepare for growth in Russian influencing

Tue, 04 Mar 2025 08:00:00 GMT

Russia continues to pose a serious threat to Finland, with no improvement in sight. Russian resources will be freed up for influencing elsewhere when the war in Ukraine ends. The end of the war in Ukraine will improve the ability of Russia to engage in hostile activity elsewhere in Europe as it pursues its political objectives by means both fair and foul.

The use of proxy operators by various states has recently become a more prominent aspect of both the intelligence and broader influencing scenario. Sabotage operations in Europe linked to the Russian military intelligence service GRU are one example of this. By using intermediaries, Russia seeks to cover its tracks. Russian sabotage operations aim to influence public opinion and the sense of public safety, and to overwhelm the authorities in target countries. The main goal at the moment is to undermine Western support for Ukraine.

Finland has not yet become a focus of the intense influencing that has primarily targeted major EU Member States and countries with large Russian minorities or pro-Russia political parties. This will probably change when Russia is able to redeploy the resources that are currently tied up in Ukraine.

“The Western intelligence community has a highly uniform view of the growing threat from Russia. As a country that borders Russia and as a state on the Baltic Sea, Finland must prepare for growth in Russian influencing," says Supo Director Juha Martelius. Supo released its National Security Overview on 4 March.

Finland is a target for continuous and active espionage operations from both Russia and China. It is also an intelligence target of interest to certain third countries, such as Iran. Cyber operations targeted at Finland by Russian intelligence services have increased. They have become more specific, focusing mainly on central government, and on foreign and security policy.

The threat of terrorism has grown slightly

Multiple simultaneous negative trends in the international security situation have also affected the threat of terrorism in Finland. These include conflicts in the Middle East, ISIL networks that have activated in Europe, international far-right networks, and the radicalisation of minors. While the threat of terrorism in Finland has slightly increased, Finland has not emerged as a particular target for international terrorism.

The most likely threat of a terrorist attack continues to come from lone operators and small groups supporting far-right or radical Islamist ideology. The most likely attack will target civilians in a public place, and will be carried out using some readily available improvised means, such as a knife, vehicle or firearm.

In place of the previous four levels, Supo has introduced a new five-point scale to describe the threat of terrorism. The threat now stands at level three (elevated) on this new five-point scale, representing a slight increase from level two on the previous scale. The five-point scale enables the threat assessment to accommodate and show smaller changes. The updated terrorism threat assessment is included in the new Supo National Security Overview.

Inquiries

Supo communications, tel. +358 50 402 6981, media@supo.fi

]]>

Changed operating environment also puts demands on the PCB cooperation

Thu, 30 Jan 2025 08:00:00 GMT

A joint goal of the Police, Customs, the Border Guard and the Finnish Security and Intelligence Service is to promote safety and security in society in a flexible, fast and efficient manner, and to do their part in ensuring Finland is the safest country in the world. Enforcement and crime prevention is at the heart of the PCB authorities’ work, as well as safeguarding the vital functions of society.

“The work of Finnish Customs and the other internal security authorities ensures a reliable operating environment for us all. Lately, the importance of the PCB cooperation in guaranteeing societal safety and security and operational reliability has been even more highlighted. The power of this cooperation lies in its flexibility and efficiency, which is needed when facing the present challenges,” says Riikka Purra, Minister of Finance.

More impactful results through shared information

Shared information is the basis for the activities and decision-making and guides the PCB cooperation in crime prevention, enforcement and preparedness. A data-driven PCB cooperation can add value to the activities of the parties and help them respond to sudden developments.

The changed operating environment and the security situation pose challenges to the authorities’ activities and this also puts pressure on developing the PCB cooperation. The view is that the changes affecting the operating environment of the PCB authorities are most likely to continue.

“The PCB partnership has a significant impact on societal safety and security and the operating reliability in a changing operating environment where intelligence and a shared and coordinated preparedness are of key importance. The capabilities, powers and legislation will be developed in the same direction and from the point of view of cooperation, while taking into account the role and tasks of each authority,” says Mari Rantanen, Minister of the Interior.

The aim of ensuring that the PCB cooperation has the necessary operating requirements and powers is also mentioned in the Government Programme.

For more information

Customs media service: tel +358 295 527 150, viestinta(at)tulli.fi
National Police Board Communications: media.poliisihallitus(a)poliisi.fi
Finnish Border Guard media service: tel. +358 50 456 2862, viestinta(at)raja.fi
Finnish Security and Intelligence service, Communications: tel. +358 50 402 6981, media(at)supo.fi

]]>

The threat of Russian intelligence and malign influence remains elevated in Finland

Tue, 26 Mar 2024 08:00:00 GMT

Russia’s actions remain the greatest threat to Finland's national security, with Russia treating Finland as unfriendly state, and as a target for espionage and malign influence activities. NATO membership nevertheless protects Finland from the most forceful measures. The main goals of Russian influence operations targeting Finland are to create a deterrent and to affect the nature of Finnish NATO membership.

While counterintelligence work, expulsions of intelligence officers and a strict visa policy enabled Finland to undermine conditions for Russian human intelligence last year, intelligence operations remain a threat. In particular, these operations may target Finnish people who still travel or reside in Russia, or Finnish citizens in third countries.

The cyber environment and critical infrastructure are especially susceptible to an elevated threat of influence and espionage operations. Massive influence operations that seek to paralyse the normal operation of national critical infrastructure within the territory of Finland remain unlikely in the short term.

Weaponised immigration is a way for Russia to indicate its dissatisfaction with Finland’s NATO membership and generally to show the consequences of actions Russia perceives as unfriendly.

Supo's assessment is that Russia has no reason to modify its border policy in the near future.

“This is a long-term threat, it is an easy way for Russia to keep Finland on its toes”, Supo Acting Director Teemu Turunen explains.

Russia changed its established Finnish border policy last autumn, and began giving people access to border crossing points without appropriate travel documents.

No significant changes have occurred in the threat of terrorism faced by Finland

This threat remains at level two (elevated) on the four-point scale. The most likely threat of a terrorist attack in Finland comes from lone operators or small groups advocating far-right or radical Islamist ideology. Radicalisation in Finland will probably also increasingly affect minors.

The threat of a terrorist attack in Europe motivated by radical Islamism has intensified over the past year. Growth of this threat depends in particular on incidents of burning the Quran in Europe, and on the conflict between Israel and the terrorist organisation Hamas. The growing threat elsewhere in Europe has not significantly affected the threat level in Finland. The updated terrorism threat assessment is included in the latest Supo yearbook.

Inquiries
Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

Supo reorganises to boost intelligence work

Tue, 02 Jan 2024 08:06:00 GMT

A reorganisation of Supo on 1 January 2024 has implemented minor modifications to enhance information gathering and the work of Supo as an intelligence service. Supo now has eight departments instead of the previous nine: Administration and development, Cabinet, Collection, Counterintelligence, Counterterrorism, Intelligence, Regions and Vetting.

A Department Head manages each department:

Teemu Liikkanen, Regions
Saana Nilsson, Cabinet
Teemu Lehti, Administration and development
Risto Värtö, Counterterrorism
Mikko Kurttila, Collection
Pekka Hiltunen, Intelligence
Ilkka Hanski, Vetting
Pertti Haaksluoto, Counterintelligence

The organisation structure of Supo is public only at departmental level. The Cabinet and the Administration and development departments report directly to the Director. The other departments are accountable to the Deputy Directors.

Teemu Turunen serving as Acting Director

With the appointment of Supo Director Antti Pelttari to the position of Secretary-General of Parliament from the beginning of 2024, Deputy Director Teemu Turunen has been appointed Acting Director. Turunen will serve as Director of Supo until a new Director is appointed. The Director of Supo is appointed by the Government on the recommendation of the Minister of the Interior. Deputy Director Jonna Turunen will continue in her position.

Inquiries

Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

Supo launches system project applying artificial intelligence with co-funding from the European Union

Wed, 08 Nov 2023 08:05:00 GMT

The project will develop tools to improve the analysis capability of Supo by using machine intelligence to automate functionalities in its core information system. The aim is to identify phenomena that jeopardise security in advance, and develop the capacity to formulate more reliable situation assessments.‎

The intelligence analysis and research tools developed in the INTER project (Intelligence Analysis and Research Suite) will enable classification and analysis of a growing volume of data using artificial intelligence. Automating work stages reduces the amount of manual work required. Improved analytical capacity will enable management by information, with informed decisions taken in a well-founded and targeted manner, both within Supo and with partners.

Automated analysis can reveal links and detect weak signals that cannot necessarily be found by manual information searches. This also reduces the operational risk of overlooking some important connection. Success criteria will include the number of trainees and feedback from clients.

A suitable project partner was sought through a negotiation procedure under the Public Defence and Security Procurements Act (1531/2011). The winning tender was submitted by Reaktor Innovations Oy, which was selected to implement the project.

The estimated total ex-VAT price of the procurement, including all expenses, is EUR 4 million. Work on the project will commence in November 2023, and the project will end in April 2026.

Inquiries
Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

Russia treating Finland as an unfriendly country

Thu, 12 Oct 2023 07:00:00 GMT

Relations between Finland and Russia have shifted significantly due to the invasion of Ukraine, sanctions and NATO membership. Russia is currently treating Finland as an unfriendly country. This is evident in such aspects as negative coverage of Finland in the Russian media, and in the decision to close the consulate general in St. Petersburg.

“Russia currently remains focused on the war in Ukraine and on easing international isolation, but this does not mean that the threat of Russian intelligence and influencing in Finland has disappeared. The accession of Finland to NATO, the continuation of the war in Ukraine, the deepening confrontation between Western countries and Russia, and increasing sanctions may strengthen Russian countermeasures against Finland”, says Supo Director Antti Pelttari.

The main goals of Russian influencing are to undermine the unity of NATO and the European Union, and to reduce the support of Western countries for Ukraine. Russia is monitoring the progress of Finnish NATO membership and watching how Finland behaves in relation to Russia. Russia remains ready to take measures against Finland if it deems this necessary. Russia will determine its own measures in response to the actions of Finland. NATO membership nevertheless provides protection against the most aggressiveforms of influencing.

A Supo assessment last year suggested that although the threat of intelligence and influencing operations targeting critical infrastructure has increased, a crippling effect on such operations in Finland remains unlikely in the immediate future. Marine infrastructure remains more vulnerable than land-based installations. While this assessment remains valid, Finland is well prepared to face such threats.

“Russian influencing operations against Finland are mainly about creating deterrence at the moment. The energy sector is one example of an effective target in this respect, even if no real crippling impact is sought. Potential measures that Russia may take against Finland include information influencing and undermining bilateral links, such as by withdrawing from remaining treaties. Denial of service attacks can also give an impression that infrastructure and services are vulnerable, even without causing any real damage”, explains Supo specialist researcher Suvi Alvari.

For further details and interview requests, contact

Supo communications unit
tel. +358 50 402 6981, media@supo.fi

Correction at 13th of October. The title and text has been corrected due to mistakes in translation.

]]>

Russian human intelligence squeezed in Finland

Thu, 30 Mar 2023 07:00:00 GMT

Russia, China and certain other countries use intelligence operations to acquire information for their own ends and against the interests of Finland. The Finnish Security and Intelligence Service (Supo) significantly compromised Russian intelligence operations in Finland in 2022.

"The Russian intelligence station shrank to about half of its former size last year. The main reason for this decline was the expulsion of intelligence officers and visa refusals on the advice of Supo," explained Supo Chief Antti Pelttari at the official release of the new Supo yearbook on 30 March.

The falling number of intelligence officers and restrictions on travel across the Russian border have significantly undermined operating conditions for Russian human intelligence in Finland. Operations under diplomatic cover have been the main instrument of Russian intelligence abroad.

“While Russia is still seeking to station intelligence officers under diplomatic cover, it will have to find ways of compensating for the human intelligence shortfall, such as by increasingly adopting other forms of covert operation abroad. Establishing human intelligence contacts nevertheless remains a very time-consuming process, and alternative approaches cannot be set up overnight,” Pelttari notes.

Russia is also seeking to use cyber espionage to make up for the shortfall in human intelligence. Cyber espionage is nevertheless an incomplete substitute for human intelligence, as it provides information of a different nature. Russian cyber espionage efforts targeting Finland exceeded previous levels by the second half of 2022.

Terrorism threat largely unchanged

Supo continues to assess the threat of terrorism in Finland as elevated, corresponding to level two on the four-point scale. The danger of extreme right-wing terrorism has grown, whereas the threat of radical Islamist terrorism remains unchanged. Some extreme right-wing and radical Islamist actors in Finland probably harbour the desire and capacity to mount violent attacks.

Supporters of these ideologies pose the most likely threat, either as individuals or in small groups. Attacks remain unlikely in the short term. Unlicensed weapons spreading from the Ukrainian war zone are likely to increase the capacity of extremists in Europe for violence. The updated terrorism threat assessment is included in the latest Supo yearbook.

For further details, please contact

Supo communications, tel. +358 50 402 6981, media@supo.fi

]]>

National Security Overview: Russian intelligence changes approach

Thu, 29 Sep 2022 07:01:00 GMT

The main intelligence gathering approach traditionally applied by the Russian intelligence services is human intelligence under diplomatic cover. This has become substantially more difficult since Russia launched its war of aggression in Ukraine, as many Russian diplomats have been expelled from the West. Even though there are still some active intelligence officers working in Finland, the Finnish government has probably severed the connections to their Russian networks, at least for the time being, and little information is available through the usual channels.

Russian intelligence will probably seek to adapt its operations to these new conditions.

“We consider it highly likely that Russia will turn to the cyber environment over the winter,” explains Supo Director Antti Pelttari.

The Russian security and intelligence services are increasingly targeting foreigners who reside in or visit Russia. Russians working in the West may also be a target of intelligence gathering when visiting their home country. Russian citizens serving in critical positions in Finland may be subject to coercion from Russian authorities.

The threat of corporate espionage by Russia is also increasing as sanctions necessitate the launch of high-technology manufacturing to replace imports from the West. This places a particular premium on data security in Finnish businesses.

Future NATO membership will make Finland a more interesting target for Russian intelligence and influencing operations. Russia may seek to acquire NATO-related intelligence through Finland. Russia has assessed what kind of NATO member Finland will be, and is determining the goals and instruments of influencing accordingly.

Both the Russian war of aggression in Ukraine and the NATO accession process have highlighted the threat to Finland’s critical infrastructure in the physical and cyber environment.

“We nevertheless consider it unlikely that any cyberattack will paralyse critical infrastructure in the near future,” Antti Pelttari says.

Besides Russia, the espionage and influencing operations of China pose a significant threat to Finland’s national security. China continues to engage in active intelligence operations targeting Finland, nor has the Russian invasion of Ukraine had any significant impact on these operations. China is still applying both human intelligence and cyber espionage methods.

Authoritarian states can secure access to or influence over critical Finnish infrastructure by such means as corporate acquisitions or investments. There is a risk that another state will thereby acquire intelligence on the operations of services or public authorities that are critical to Finnish society.

Further details
Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

Director’s column: Finland counters terrorism, regardless of ideology

Tue, 21 Jun 2022 13:00:00 GMT

In connection with Finland’s application for NATO membership, Türkiye has, somewhat surprisingly, brought up also the counterterrorism in Finland. As Director of the Finnish Security and Intelligence Service (Supo), I can guarantee that Finland takes counterterrorism very seriously. The mission of Supo is to expose terrorist operations that occur in Finland or are launched from Finland at the earliest possible stage.

We are concerned about security both in Finland and in other countries. In our own role, we are ready to assist in discussions between Finland, Sweden and Türkiye relating to the concerns of national security of Türkiye.

Finland condemns all terrorism, regardless of ideology, so the ideology behind terrorism is not relevant. In the last years, the biggest threat here has been posed by extreme right-wing and radical Islamist terrorism. The authorities have, naturally, been forced to concentrate especially on these phenomena that cause the most concrete threat.

Supo and other security authorities combat terrorism in all its manifestations. Terrorism-related activity mostly consists of various support activities, such as radicalisation and spreading terrorist ideology and propaganda. Supo aims at exposing terrorist activity through its own operations and cooperates closely with other authorities and international partners. It is evident that Finland is a country where rule of law applies and the work of all authorities is based on law.

Terrorism legislation has been developed towards a positive direction

Countries differ in respect of the acts that are interpreted as terrorist. The United Nations and the European Union maintain lists of terrorist organisations. Finland has precisely fulfilled the criminalisation obligations of the UN and the EU and has taken into account also the recommendations of the Financial Action Task Force (FATF) on terrorism financing in its legislation. Terrorist offences are explicitly criminalised under the Penal Code of Finland.

Terrorism legislation has been amended on several occasions over the years. The changes introduced in the beginning of 2022 were especially welcome: i.a. taking part in activities of a terrorist group and public incitement to terrorist offence were criminalised through them. The intelligence legislation, which has been in force for three years now, has also improved Supo’s possibilities to gather information on terrorism.

Financing is one important way to support terrorism. Funds may be collected, for example, to finance attack plots, support individuals and groups participating in terrorist activities financially, pay wages, or supply material. The collection of funds may also include pressure and coercion. The legislation on financing of terrorism in Finland has also been changed towards a more fail-safe direction in the last years, which creates clearly better conditions for authorities to interfere in the activity.

Due to numerous changes introduced at different times, terrorism legislation has nevertheless become complicated and difficult to understand, which is why it needs to be entirely reformed and simplified.

Finland is a security provider, also in the field of counterterrorism

In practice, terrorist organisations always operate internationally. Correspondingly, the importance of counteracting cross-border effects is emphasised in counterterrorism work. Finland is a security provider in its own territory but also for Finland’s partners. This applies also to terrorism.

Antti Pelttari
Director of SUPO

]]>

FIIA Forum 2022 focuses on changes and challenges in the Nordic security climate

Tue, 26 Apr 2022 07:37:00 GMT

FIIA Forum is FIIA's largest annual discussion event, this time discussing the dramatic change in the Nordic security environment and its impact on the future of Finland. What are the dynamics shaping the current Northern European security climate and how should they be managed? What is the role of security intelligence cooperation in crafting a joint Nordic approach to evolving security threats and challenges?

Opening remarks of the seminar will be given by Speaker of the Parliament Matti Vanhanen.

The seminar will be launched by a panel Geopolitical outlook to the changed security situation in Finland’s neighbourhood attended by Director of FIIA Mika Aaltola, Supo Senior Analyst Veli-Pekka Kivimäki, Nonresident Senior Fellow Robert Nurick (Scowcroft Center for Strategy and Security), and Director for Northern Europe Anna Wieslander (Atlantic Council). The panel will be moderated by Charly Salonius-Pasternak, Leading Researcher with FIIA.

In the following panel Common challenges in the Nordic security and intelligence community, Head of Supo Antti Pelttari, Head of the Swedish Security Service SÄPO Charlotte von Essen, and Head of the Norwegian Police Security Service PST Hans Sverre Sjøvold will be discussing the changed security situation. The panel will be moderated by Katri Makkonen.

Media enquiries

FIIA: Mar-Leena Kolehmainen, marleena.kolehmainen@fiia.fi
Supo: media@supo.fi

]]>

Follow a seminar on 27 April: The heads of the Finnish, Swedish and Norwegian security and intelligence services discuss the changes in the Nordic security climate

Wed, 13 Apr 2022 06:45:00 GMT

In the FIIA Forum 2022: Changes and challenges in the Nordic security climate, Head of SUPO Antti Pelttari, Head of the Swedish Security Service, SÄPO, Charlotte von Essen, and Head of the Norwegian Police Security Service, PST, Hans Sverre Sjøvold will be discussing the changed security situation. The panel will be moderated by Katri Makkonen.

The seminar will be launched by a panel attended by Director of FIIA Mika Aaltola, Senior Analyst with SUPO Veli-Pekka Kivimäki, Nonresident Senior Fellow with the Scowcroft Center for Strategy and Security Transatlantic Security Initiative at the Atlantic Council Robert Nurick, and Director for Northern Europe at the Atlantic Council Anna Wieslander. The panel will be moderated by Charly Salonius-Pasternak, Leading Researcher with FIIA.

You can watch the seminar live on 27 April at 13.30-16.30.

Find out about the seminar’s programme and register to follow the livestream at:

• FIIA Forum 2022: Changes and challenges in the Nordic security climate

]]>

Supo Yearbook 2021: Finns must be prepared for influencing efforts from Russia during NATO debate

Tue, 29 Mar 2022 07:08:00 GMT

The war started by Russia in Ukraine will affect the security of Europe and Finland, both in the short and long term. Some of the greatest threats to national security are hybrid influencing and unlawful intelligence operations. Influencing efforts by Russia will probably reflect the reinvigorated NATO debate and the time for new security policy decisions in Finland.

“Finnish society as a whole should be prepared for various measures from Russia seeking to influence policymaking in Finland on the NATO issue. Public authorities must secure the conditions for a full and frank debate without intimidation, and ensure that outsiders are unable to influence security policy decisions made by Finland,” explains Supo Director Antti Pelttari.

No significant change in Russian operations targeting Finland have been observed for the time being. Russia’s resources are currently focused heavily on Ukraine and on its own domestic operations. The situation may nevertheless change very quickly.

“Supo considers it likely that Russia will expand its cyber and information operations from Ukraine to the West. An increase in operations targeting Finland is therefore also considered probable in the coming months,” Pelttari notes.

Most online cyberattacks take the form of denial of service attacks and defacing of websites. Their perpetrators seek to give the impression of paralysing society, when in reality they do not compromise information or critical processes. While denial of service attacks and measures to combat them are commonplace for online businesses, the threat of more serious cyberattacks has nevertheless also increased. Businesses must continually ensure that the control circuitry of critical infrastructure such as energy distribution systems cannot be accessed directly from the public network.

At the extreme end of the wide range of instruments for influencing are the acts of violence that Russian intelligence has been prepared to commit in the European Union over the last decade. There is clear evidence, for example, of the operations of Russian military intelligence in destroying arsenals in the Czech Republic and Bulgaria, and of assassinations perpetrated or attempted by Russian security and intelligence services in Germany and the United Kingdom.

Far-right and radical Islamist ideologies continue to pose a terrorist threat

Supo published its 2021 yearbook on 29 March. The yearbook includes an updated terrorist threat assessment. Supo continues to assess the threat of terrorism in Finland as elevated, corresponding to level two on the four-point scale.

Lone far-right individuals and small groups pose a significant threat of terrorism in Finland. Representatives of ethnic and religious minorities and political policymakers are particularly at risk of violence.

Networking on social media platforms, disseminating propaganda and promoting violent activities are integral to far-right operations. Some Finnish people also have links to Siege culture, where supporters of white supremacy incite violence and race war to bring about social collapse.

Terrorism motivated by radical Islamism in Finland mainly focuses on enabling operations such as recruiting, disseminating propaganda and raising funds. The most significant capacity to engage in violent operations is found among individuals who have fought or otherwise worked for terrorist organisations in conflict zones, and those with a violent background.

The threat of a radical Islamist terrorist attack is posed in particular by individuals who, for example, are motivated by terrorist propaganda or by events that they perceive to be offensive to Islam. Attacks by lone individuals using readily available instruments remain the most likely.

Inquiries

Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

Number of security clearances continued to increase in 2021

Fri, 21 Jan 2022 11:40:00 GMT

2021 was the first year in which Supo carried out more than 90,000 vetting investigations. Approximately 35,500 of them were concise and circa 36,700 standard. The number of comprehensive clearances was approximately 410. In addition, almost 17,700 applications could be appended to previous security clearances that were still in force for the individuals concerned. The number of concise and comprehensive clearances decreased to some extent, meaning that the increase resulted from the number of standard and appended clearances.

Supo promises to carry out vetting investigations within 25 business days. Even though the number of investigations increased, the average processing time in 2021 was only 12 business days, considerably shorter than the targeted time.

In accordance with the clients’ wishes, we focus on improving interaction

Last autumn, Supo canvassed the security clearance vetting clients to hear their views on Supo’s service. The clients are highly satisfied with the quality of the investigations and the smoothness of the process. Interaction with clients is the area most in need of development.

“This year we shall especially enhance the client communication and interaction. Supo’s new strategy also prioritises the interaction with partners. Collaboration must always be beneficial to both parties. I am delighted that, according to the received feedback, the clients of the vetting department consider the vetting investigations as useful and necessary”, says the Head of Vetting Department Ilkka Hanski.

The digitalisation of the security clearance vetting procedure is still ongoing. The aim is to shorten the processing time of concise investigations, for example, even more in 2022 when technical improvements will be made to the system.

“We received from our clients many concrete proposals for improving the electronic service. These wishes are valuable to us as we develop the system further.”

Further information

Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

The level of the terrorist threat in Finland not raised by the Kankaanpää terrorism investigation

Fri, 03 Dec 2021 16:09:00 GMT

The Southwestern Finland Police Department informed today, on 3 December, that they are investigating a widespread criminal skein in Satakunta. The Satakunta district court detained five men living in Satakunta who are suspected of terrorist offences. The Finnish Security and Intelligence Service has supported the Southwestern Finland Police Department’s investigation by providing expert advice relating to far-right terrorist ideology.

This is the first terrorism investigation concerning the extreme right in Finland. Although the investigation is exceptional, it does not affect the terrorist threat assessment completed by Supo. The investigation has been carried out for a long time and the case was taken into account also earlier in the threat assessment.

According to the latest terrorist threat assessment, the most significant threat is posed by lone operators or small groups inspired by far-right or radical Islamist ideology.

Supo Senior Analyst Eero Pietilä says that the Kankaanpää group is exactly this kind of a small group and a concrete example of the threat of far-right terrorism in Finland.

"Such small groups that glorify terrorist violence operate covertly. Their activity is not connected with publicly operating, organised far-right groups whose activity takes the form of demonstrations and street violence, for example", notes Pietilä.

Further information

Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

According to its new strategy, Supo seeks to optimise intelligence gathering, operating culture and collaboration

Fri, 15 Oct 2021 07:11:00 GMT

Supo has published its new strategy. In the coming years, Supo wants to improve its intelligence gathering in order to provide policymakers with optimal intelligence. Supo, that has undergone a profound change in recent years, also strives to be an even better working place for its employees. For this purpose, special attention will be paid to enhancing the competencies of the staff and to the management structure.

"Our new vision encourages us to produce intelligence that is essential in countering security threats and in foreign and security policy decision-making. We provide policymakers and other authorities with intelligence that is not available from other sources", notes Supo Director Antti Pelttari.

According to feedback received from the stakeholders, intelligence produced by Supo is of a high quality and reliable but the collaboration should contain more interaction.

"We take the feedback from our clients and stakeholders seriously and shall be more attentive to the information needs of our partners. Collaboration must always be beneficial to both parties", says Director Pelttari.

Legality, reliability and quality remain the values of Supo.

Explore Supo strategy

]]>

The National Security Overview: Finland continually targeted by cyber espionage attempts

Mon, 27 Sep 2021 09:30:00 GMT

Finland is subject to continuous state-sponsored cyber espionage attempts. No decline in cyber espionage is expected, even in the long term. This is one conclusion of the National Security Overview released by the Finnish Security and Intelligence Service (Supo) on 27 September.

Authoritarian states use cyber espionage to gather intelligence in support of their own policymaking, and to influence Finnish policymakers. Cyber espionage can also be used to obtain details of R&D from businesses, universities and research institutes.

Though primarily committed for financial gain, some cybercrimes are even capable of jeopardising Finland’s national security. Extortion attempts targeting operators of importance to the functioning of society, such as a health care or water supply organisation, may have serious consequences for society and for people in Finland more generally.

Though Finland’s information security culture is quite good by international standards, the associated risks increase as society becomes increasingly dependent on functional information systems. Data security is of heightened importance to organisations responsible for critical functions in society.

“Some Finnish business or branch of public administration is likely to fall victim to a ransomware attack. Data security must be managed throughout the subcontracting chain,” explains Supo Director Antti Pelttari.

Besides cyber espionage, Finland and its population are also targets of traditional human intelligence operations. Large-scale foreign intelligence and influencing operations are considered likely to continue in Finland, which remains a target of intelligence interest to Russia and China in particular.

Finnish critical infrastructure a focus of interest

The National Security Overview also highlights threats to critical infrastructure. The critical infrastructure of Finland is a point of interest to the intelligence services of authoritarian states.
This interest focuses not only on fixed infrastructure, but also on Finnish network infrastructure projects. Information infrastructure is especially sensitive, as it can give authoritarian administrations a gateway to Finnish data.

“Monitoring of business acquisitions and investments in Finland has been legitimately heightened. Such monitoring hampers the ability of authoritarian states to invest in critical functions in Finland,” Antti Pelttari notes.

Far-right and radical Islamist terrorism poses most serious threat

The most significant terrorist threat in Finland is posed by individuals and small groups supporting extreme right-wing or radical Islamist ideologies. Far-right terrorist attacks remain possible in Western countries, and even in Finland the possibility of such an attack cannot be ruled out. Supo has gained some indications of preparation for concrete actions.

Isil and al-Qaeda remain the most important radical Islamist terrorist organisations internationally. Though radical Islamist operators have interpreted the resurgence of the Taliban in Afghanistan as a victory, these events have no immediate impact on the terrorism situation in Finland. The radical Islamist movement in Finland mainly focuses on support operations, though attacks also remain possible.

For further details, please contact

Supo communications, tel. +358 50 402 6981, media@supo.fi

]]>

Jonna Turunen and Teemu Turunen appointed as deputy directors of Supo

Mon, 07 Jun 2021 10:12:00 GMT

The Supo Director Antti Pelttari has appointed Jonna Turunen, Master of Laws with court training, and Teemu Turunen, Master of Laws, as Supo deputy directors for five-year terms. Jonna Turunen takes office on 1 July and Teemu Turunen on 1 August.

Jonna Turunen comes to Supo from the Helsinki Police Department where she has been leading the Criminal Investigation Division. Earlier during her career, she has carried out various demanding tasks at the police: as leader of the section that investigates serious crimes against persons, as investigator in charge in serious threat matters and in violent and sexual offences, in control of legality, and as police liaison officer in Europol.

Teemu Turunen comes to Supo from the Finnish Ministry for Foreign Affairs where he currently acts as director of the Centre for Peace Mediation. Ambassador Turunen has made a long career as diplomat and before his current function, he worked at several Finnish missions abroad and led the Unit for Consular Assistance of the MFA.

The deputy director posts at Supo were declared as vacant as Olli Kolstela retired and Seppo Ruotsalainen took leave of absence. There are currently three deputy directors at Supo. One of the posts has been related to leading the big transformation projects within the agency. As the projects are now progressing steadily, Supo returns to the model with two deputy directors.

Further information

SUPO communications, tel. +358 504 026 981, media@supo.fi

]]>

Supo Yearbook 2020: Terrorism threat assessment shows changed scenario on the extreme right

Tue, 23 Mar 2021 07:30:00 GMT

Supo has assessed the threat of terrorism in Finland as elevated, corresponding to level two on the four-point scale. While this threat level remained unchanged from the preceding year, conditions on the extreme right are giving greater cause for concern. The updated terrorist threat assessment is included in the 2020 Yearbook published by Supo on 23 March.

The danger of extreme right-wing terrorism has grown in Finland, and Supo has identified far-right operators with the capacity and motivation to mount a terrorist attack. Some indications of concrete preparation have also emerged.

“The far-right counter-terrorism targets identified by Supo are typically linked to the extreme right-wing international online environment,” explains Supo Director Antti Pelttari.

The threat of radical Islamist terrorism has remained at the previous level. The ISIL terrorist organisation is still able to inspire its supporters, and is also seeking to mount attacks in Europe. The foreign fighter phenomenon has increased and strengthened the international connections of radical Islamist operators in Finland. Several people returned to Finland from the Syrian conflict zone in 2020. Most of these returnees are likely to continue operating in radical Islamist networks, for example by recruiting supporters and disseminating extremist ideology.

Supo also monitors and assesses the threat to Finland’s national security posed by the far-left movement and the Kurdistan Workers’ Party (PKK), which the European Union classifies as a terrorist organisation. In Finland the PKK has focused on actively supporting its operations in Kurdish regions. A few volunteers from Finland have joined armed organisations of Kurdish background and travelled to the Syrian conflict zone.

Intensive State-sponsored cyber espionage attempts detected in Finland

The coronavirus pandemic shifted many functions of society onto remote connections, leading to an increase in information available online. Some intensive State-sponsored cyber espionage operations targeting preparations for formulating Finland’s foreign and security policy were detected in 2020.

Supo issued early warnings to government organisations concerning cyber espionage operations that appeared to be seeking intrusion into e-mail services. Supo assisted in limiting damage and gathered information about the attacks for other public authorities. Some cyber espionage targeting private businesses was also detected, but not appreciably more than in a normal year.

Supo has grown with its new functions

2020 was the first full operating year in which Supo was able to apply its latest intelligence-gathering powers. With a total of some 500 employees, the Service has now reached the staffing level that was anticipated when the new intelligence legislation took effect.

“Even though full implementation of new practices and intelligence methods is still ongoing, Supo is already beginning to resemble a modern security and intelligence service,” Antti Pelttari explains.

The new intelligence legislation allows Supo to acquire intelligence concerning threats to national security, even without a concrete cause to suspect that any criminal offence has occurred. These powers have proved necessary, for example, in combating threats to critical infrastructure.

The confidence of the Finnish public in Supo has also reached a record high level, with a clear majority (91 per cent) expressing either a very high or at least fairly high degree of trust in the Security and Intelligence Service.

For further details, please contact:

Supo communications unit, tel. +358 50 402 6981, media@supo.fi

]]>

Supo identified the cyber espionage operation against the parliament as APT31

Thu, 18 Mar 2021 10:00:00 GMT

2020, the year of the pandemic, was also a year of exceptionally intensive cyber espionage operations both in Finland and elsewhere in Europe. Supo identified a state-run cyber espionage operation targeted last year against the Parliament with the aim of intruding into its IT systems. According to Supo intelligence, APT31 was responsible for the attack.

Supo provided the Parliament with information that enabled the Parliament to identify possible further break-in attempts. The Parliament followed the instructions it had received and further strengthened its information security. Besides warning the Parliament, Supo also provided information to the National Cyber Security Centre Finland (NCSC-FI), which is the national cyber security authority, to improve NCSC-FI monitoring capabilities.

As the Parliament’s own technical investigation revealed that its IT systems had been compromised, Supo assessed that the constituent elements of an aggravated offence were fulfilled and advised the National Bureau of Investigation (NBI) of the case.

The case in question is the same of which the Parliament announced in the end of December 2020. The NBI is responsible for the pre-trial investigation of the case and for providing information on it.

For further details, please contact:

SUPO communications, tel. +358 504 026 981, media@supo.fi

]]>

Foreign intelligence services use corporate and personal network routers for cyber espionage

Wed, 10 Mar 2021 11:00:00 GMT

Supo has noticed an increase in cyber espionage exploiting Finnish infrastructure. The cyber espionage divisions of intelligence services in authoritarian states in particular have exploited dozens of network devices and servers operated by individuals and businesses in Finland by linking them into an infrastructure used for espionage.

This involves routing intelligence service operation traffic through a Finnish network device, so that the attack on the organisation targeted by espionage appears to come from an organisation or a private individual in Finland.

Supo has already contacted some businesses and individuals whose hardware has been hacked in this way. The goal was never to obtain information contained in the hacked devices, as the perpetrator only used them as a means of securing access to the real espionage target.

Devices are often accessed using default passwords - check your hardware settings

The latest Supo findings suggest that home routers and network storage systems are the most typical hacked hardware devices. Using default passwords and otherwise insecure settings have allowed this hacking.

Supo recommends ensuring that you have taken at least the following steps to improve the security of your router:

Block external access to the router control panel from the Internet.
Change the default password so that it is as long as possible and hard to guess. The recommended password length is at least 20 characters.
Close any open ports on the router that you do not need to use.
Always update the router firmware to the latest version.

You should always apply the same precautions with online storage devices accessible over the Internet and any other networked devices, such as home appliances, cameras and even vacuum cleaners.

Cyber espionage has increased during the coronavirus pandemic

The intelligence services of foreign powers have expanded their cyber espionage operations during the coronavirus pandemic. Cyber espionage that directly affects Finland falls under two broad headings: either directly targeting Finnish organisations or using Finnish infrastructure.

Cyber espionage targeting Finnish organisations seeks information about them that is not otherwise available. Cyber espionage using Finnish infrastructure seeks to hack into network devices and servers located in Finland and link them into an infrastructure that is then used for a cyber espionage operation.

]]>

Pelttari appointed to a successive term as Supo Director

Thu, 28 Jan 2021 11:49:00 GMT

The Government appointed the Director of Supo, Master of Laws Antti Pelttari on 28 January 2021 to a new five-year term, that is, until 28 February 2026. Pelttari has acted as Supo Director since the year 2011.

- The unique information that Supo gathers, analyses, and reports to its clients, above all to the top-level national government, to substantiate policymaking is necessary in an uncertain and rapidly changing world. I believe that Supo’s role in maintaining national security continues to increase. I wish to continue with all the Supo employees the transformation of the agency into a modern security and intelligence service, says Pelttari.

The Government justified the election of Pelttari to a successive term by his management experience in the administrative sector of the Ministry of the Interior and his widely demonstrated capacities in carrying out development projects in Supo.

Supo is the middle of a transformation from a police organisation into a security and intelligence service. As the only authority in Finland, Supo is allowed to use civilian intelligence gathering methods in order to prevent serious threats to national security, such as terrorism and espionage by foreign powers.

]]>

The threat of extreme right-wing terrorism has grown in Finland

Thu, 29 Oct 2020 07:30:00 GMT

The threat of far-right terrorism has grown in the West, with an increase over the past 18 months in terrorist attack projects that seek to maximise casualties. International far-right online groups and messaging on social media platforms reinforce the transnational character of the extreme right.

“Supporters and sympathisers of far-right terrorist activity have also been identified in Finland. At the same time, the threat posed by radical-Islamist terrorist operators has by no means dispelled,” explains Supo Director Antti Pelttari.

The total number of counterterrorism targets has remained at approximately 390. The principal threat is posed by lone operators or small groups who support radical Islamist or far-right ideology, and are motivated by terrorist propaganda. Supo has identified some groups and individuals with the motivation and capacity to carry out a terrorist attack in Finland.

The ISIL and al-Qaeda terrorist organisations and their supporters remain a global threat. They are probably seeking to develop new tactics for mounting attacks, and will also continue to encourage attacks in Western countries.

Significant terrorism support operations found in Finland include financing and dissemination of propaganda. Counterterrorism targets have significant links to foreign terrorist operators and networks. Some people have moved to Finland from conflict zones after participating in and otherwise supporting the operations of armed groups.

Coronavirus temporarily hampered intelligence operations by foreign powers in Finland

Although the restrictions introduced in Finland in the early stages of the coronavirus pandemic in spring 2020 obstructed unlawful human intelligence operations, new opportunities arose at this time for foreign countries to spy on Finland by infiltrating information systems. Finland is a target of particular intelligence interest to Russia and China.

A substantial portion of key functions in society were relocated to remote access networks. The scale of remote access required expedited security solutions that focused on ensuring user access to information. The countries engaged in cyber espionage targeting Finland were not immediately able to take full advantage of the emerging opportunities, as the coronavirus pandemic also affected their own operations. Cyber espionage is currently more active than usual.

“It is highly likely that active cyber espionage will continue, as the pandemic is still hampering travel. New targets include the pharmaceutical industry and viral research,” Pelttari notes.

Human intelligence returned to its previous level in Finland when restrictions were lifted over the summer. Several dozen foreign intelligence officers are permanently stationed in Finland.

Supo revamped its website

A rebuilt supo.fi online service was launched on 28 October, with Supo also upgrading its public appearance at this time. Supo will also share more topical information online concerning phenomena that jeopardise national security and regarding its own operations.

supo.fi

For further details, please contact:

Supo communications, media@supo.fi

]]>

Supo Year Book 2019: Terrorist threat remains at level 2 as elevated - threat picture constantly evolving

Thu, 02 Apr 2020 06:00:00 GMT

The updated terrorist threat assessment is included in Supo’s 2019 Year Book, published on 2 April. The threat assessment will continue to be updated at least annually.

Travel to and long periods of stay in the Syrian-Iraqi conflict zone have boosted especially radical Islamist networks and strengthened their ability and capacity to engage in acts of violence. ISIL remains a threat in Western countries despite its territorial losses in Syria and Iraq.

The danger of extreme right-wing terrorism has grown in Western countries. The inspirational impact of recent attacks, social confrontation, and especially online radicalisation encourage similar individual acts of violence in Finland.

In assessing terrorist threat, Supo takes into account not only actual preparation of attacks, but also different support activities such as preparing and disseminating propaganda, encouraging others to support terrorism, recruiting, and financing.

Immediate threats posed to national security by the coronavirus pandemic limited so far

The internal security situation in Finland is stable for the time being but prolonging the exceptional circumstances may result in an increase in threats to national security.

Finland is a constant target for unlawful intelligence by foreign states. The states spying on Finland aim at detecting vulnerabilities, which they may exploit to obtain secret information, for example. Both state actors and non-state actors may use the opportunity to cause instability in the society. Furthermore, in case the exceptional circumstances last for a longer time, extremist movements may try to exploit the growing social confrontation. The amount and impact of intentionally disseminated disinformation may also increase under the exceptional circumstances.

”Exceptional circumstances create opportunities for illegal intelligence, cyber espionage and large-scale influencing activity by foreign states. Illegal intelligence is targeted against the impacts of the pandemic on the Finnish society, the performance of authorities, the activity of companies, or the security of supply,” says SUPO Director Antti Pelttari.

He goes on: “A large part of Finns have now switched to working remotely, and one should pay at least as much attention to information security during that period as under normal circumstances.”

New powers have been adopted

Year 2019 was historic for Supo, as the powers of the Service were revised in June when new intelligence legislation took effect.

“We shall strive to ensure that national leaders benefit from increasingly up-to-date and relevant information. We have already made a good start in this work, but building to full capacity will take time. We are becoming less dependent on intelligence from our international partners as our own expertise grows,” says Director Antti Pelttari.

Intelligence legislation also subjects Supo to even stricter oversight.

“We shall pay particular attention to exercising these powers lawfully. We deem comprehensive oversight as an absolute prerequisite for our work, and have further increased our own legality control. The main guarantor of legality is Intelligence Ombudsman Kimmo Hakonen, who enjoys unrestricted access to even the most secret information held by Supo,” Pelttari concludes.

Further information and interview requests

Due to the state of emergency caused by the coronavirus epidemic, no separate briefing will be held this year in connection with the publication of Supo Year Book.

Supo communications, tel. +358 504 026 981, media@supo.fi

Supo Director Antti Pelttari remains at your disposal for a phone interview on Thursday, 2 April 2020.

]]>

Foreign intelligence increasingly interested in Finland’s critical infrastructure

Thu, 05 Dec 2019 07:00:00 GMT

Dozens of foreign intelligence officers are permanently stationed in Finland. Furthermore, it is assessed that approximately the same number of foreign intelligence officers carry out short-term operational assignments in Finland every year. Finland is of interest especially for Russian and Chinese intelligence services.

Typical features of foreign intelligence services’ activity in Finland are long duration and planning.

Intelligence-gathering themes concerning topical phenomena vary, but primary intelligence aims include forecasting Finland’s policies in various fields and influencing political decisions.

"Intelligence services have some permanent topics they follow. In addition to those, primary topics of interest have recently been, among others, Finland’s actions as EU Presidency, Finland’s position in EU’s sanctions policy, national innovation activity, and high technology products", says Supo Director Antti Pelttari.

Besides human intelligence, Finland is continuously targeted by cyber operations for the purposes of state-run espionage, mapping the technical environment or exerting influence. In addition to public administration, targets have also included key R&D information of companies and confidential communications of individuals.

Critical infrastructure ending up in the control of a state conducting active cyberespionage or cyber influencing constitutes a threat to national security already before the spying state decides to act.

"This should be taken into account proactively in projects concerning critical infrastructure, such as investing in the 5G network", Director Pelttari says.

The national security review also deals with Finland’s terrorism situation and hybrid influencing.

]]>

New powers of the Finnish Security Intelligence Service (SUPO)

Fri, 31 May 2019 06:00:00 GMT

The new powers have a significant effect on SUPO’s activity. The aim of the reform is to provide SUPO with increased capacities to detect and prevent undertakings posing a threat to national security and to provide the national leadership with higher quality information faster than before.

When the new legislation enters into force, SUPO obtains the possibility of conducting network traffic intelligence and using new kinds of intelligence methods both in Finland and abroad. SUPO starts using the new powers as soon as the new legislation takes effect but it will take time before creating full operational capability.

SUPO will be further developed by training the personnel and recruiting new experts. Furthermore, the organisational structure and part of the working methods are improved.

SUPO’s new organisation is divided into nine departments. Three of them (Cabinet, Intelligence and Digital Services) are completely new. The other departments include Internal Services, Counter Terrorism, Counter Intelligence, Regions, Vetting and Collection.

The new legislation also brings about changes to the supervision of SUPO. A new Intelligence Oversight Ombudsman starts supervising SUPO’s activities. At the same time, SUPO’s own internal legality control is reinforced. The Intelligence Oversight Committee of the Parliament, for its part, starts conducting parliamentary oversight. Besides this, SUPO is supervised by the Ministry of the Interior.

]]>

Supo’s jubilee year marked by new intelligence legislation – possibilities to counter threats to national security will be considerably improved

Thu, 21 Mar 2019 07:00:00 GMT

According to Supo’s new yearbook, especially state-run cyber espionage was active in 2018. Finland is of interest in intelligence terms particularly to Russia and China.

Supo will be 70 years old this year and to celebrate the event, the yearbook published today is more extensive than usually.

The new intelligence legislation will significantly enhance Supo’s intelligence capacities

In the future also, one of Supo’s key functions will be to prevent threats to national security, such as espionage and terrorism. Nevertheless, Supo’s role in producing proactive and analysed intelligence information to the national leadership also takes on new importance in the future.

- The last few years have been an era of rapid change for Supo and the new legislation will transform the agency into a genuinely modern security and intelligence service, says Supo Director Antti Pelttari.

The change has become necessary because Finland’s security environment has evolved rapidly in the last few years.

- The past few years have seen an increased threat of terrorism, while developments in the near abroad have further intensified the illegal intelligence operations of foreign powers targeting Finland. It is our duty to ensure, for our part, that Finland remains the world’s safest country also in the future.

Supo will be 70 years old this year, and the Finnish Security Police will also celebrate its centenary. To celebrate the jubilee year, Supo published today its yearbook that is more extensive than usually and includes also an overview on the history of the agency, written by Professor Kimmo Rentola.

The world of cyber espionage has become more aggressive

The intelligence legislation will considerably intensify Supo’s activity e.g. in countering cyber espionage, with network traffic intelligence enabling direct detection of the cyber espionage operations of foreign powers over information networks.

- The world of cyber espionage has become more aggressive, now even including forcible intrusion in systems, explains Jyrki Kaipanen, the head of cyber functions at Supo in the agency’s yearbook.

Supo learned of several cyber espionage cases considered to involve foreign government sponsorship in 2018. This espionage targeted the Finnish government and also businesses and private individuals.

Cyber espionage no longer necessarily targets the organisation of interest directly, but focuses on less security-conscious organisations and individuals that are closely associated with the target. Entities close to the target may be used either directly in information gathering or as channel of access to the systems of the actual target.

Especially Russian and Chinese intelligence services are interested in Finland

The number of foreign intelligence service representatives stationed in Finland is still quite high in relation to the size of the country. Finland is of interest particularly to Russian and Chinese intelligence services.

Foreign intelligence activity aims at forecasting Finland’s policies in various fields and influencing political decisions. Like in the previous years, the primary topics of interest for foreign intelligence in Finland in 2018 were e.g. the debate on NATO, foreign and security political strategies, Finland’s position on EU sanctions policy, and the security situation in the Baltic Sea region.

In addition, Supo observed in 2018 that foreign intelligence services also showed interest in Finland’s chairmanship of the Arctic Council, the intelligence legislation under preparation, and Finland’s international military cooperation.

Even though cyber espionage is more active than before, intelligence services still try to find and recruit clandestine human sources with a view to obtaining information that is not publicly available.

Foreign intelligence organisations also sought to recruit individuals to assist in providing either direct or indirect influence over political decisions and public opinion.

Terrorist threat remained at level Elevated

In 2018, the terrorist threat assessment remained at level 2 (Elevated) on the four-level scale. The most significant terrorist threat in Finland is still posed by individual actors or small groups motivated by radical Islamist propaganda or terrorist organisations encouraging them. These persons are likely to have either direct or indirect links to radical Islamist networks or organisations.

Supo has around 370 counterterrorism (CT) targets. An increasing percentage have taken part in armed conflict, expressed willingness to participate in armed activity, or received terrorist training. Foreign terrorist fighters left from Finland have gained significant positions within ISIL in particular and have an extensive network of relations within the organisation.

Further information

Supo’s yearbook provides more detailed information on all the aforementioned topics. The yearbook also reveals, for example, why Supo shows interest in the climate change and how it was possible to disclose a foreign espionage operation through surveillance, and casts a glance at history.

]]>

Supo at Suomi Areena: Threats of the future are in the virtual world

Thu, 19 Jul 2018 06:00:00 GMT

Future of terrorism

Senior analyst of Supo, Saana Nilsson, adressed the future of terrorism. According to her assessment, the future terrorist is “an innovative digital native” who networks and also operates in the virtual world.

- Increasingly dangerous networks and mentors guide young people vulnerable to radical ideology who act in the virtual world exploiting its opportunities in a new way. It is essential that authorities adopt a holistic approach to the phenomenon and move their counterefforts into the world the young people live in. Authorities must act in an innovative way, says Nilsson in her presentation.

Espionage and influencing

SUPO analyst Pekka Iivari spoke about the future of influencing and espionage. Recent discussions on influencing have referred to Russian influence operations in particular.

- Different information operations conducted on the Internet, as well as cyberespionage, have become part of the threat scenarios during this decade. Over the next decade, operations taking place in cyberspace will play an increasingly strategic role. It is important to identify the phenomenon, expose the underlying structures and aims, and maintain open discussion. The success of influence operations conducted by foreign powers depends greatly on us ourselves, the effectiveness and credibility of our countermeasures, and the extent to which we wish to be influenced, argues Iivari in his presentation.

]]>

Supo in 2017: Cyber attacks have become commonplace in Finland as well

Wed, 21 Mar 2018 07:00:00 GMT

Foreign states wish to steal from data networks information concerning Finland’s critical infrastructure and Finnish product development, for example. This is apparent from Supo’s yearbook 2017 which is published today.

- Cyberespionage poses a serious threat to the Finnish information capital. If product development data is stolen to another country, it is possible that the company loses its whole future, says Supo Director Antti Pelttari.

Countering threats is harder than before because the enterprises outsource the management of data. There are also gaps in the authorities’ capability to counter cyber attacks.

- We have no access to the data networks, so our capability to detect cyberespionage is completely inadequate. Intelligence legislation would deliver an improvement to this, says Pelttari.

Traditional espionage still active

In addition to cyberespionage, traditional espionage also remained active. Foreign intelligence services try to recruit Finns to provide them with information that is not publicly available. Especially Russian intelligence organisations are active in Finland.

Foreign intelligence organisations still take interest especially in the Finnish foreign and security policy. In 2017, they were also interested in the ongoing process of drafting new intelligence legislation, cyber security infrastructure, and measures for combating the information operations.

Number of security clearance investigations increasing

The total number of security clearance investigations conducted by Supo in 2017 was over 61,000. Due to the rapidly changing security environment, new facilities and businesses requiring security clearance vetting are constantly included in Supo security clearance vetting procedures. Most security clearance investigations are conducted for state authorities.

The vetting seldom discloses adverse information. Information that needs to be notified to the employer comes out in just 2 per cent of cases. Supo never takes stand on the recruitment but the decision is always made by the employer.

Confidence in Supo unprecedentedly high

Supo carries out yearly a survey concerning the views of the citizens on Supo’s activity. This time, 89 % of the respondents told their confidence in Supo is high or rather high. That is the highest figure since the survey was first conducted.

Further information

Supo communications team, tel. +358 504 026 981, media@supo.fi

]]>

Supo: Threat assessment unchanged for the time being

Sat, 19 Aug 2017 06:00:00 GMT

The threat level was previously raised in the middle of June. The threat in Finland is at the level 2, that is, elevated.

-The suspected terror attack in Turku is in accordance with our threat assessment. Also, the suspect’s profile is similar to that of several other recent radical Islamist terror attacks that have taken place in Europe, according to Supo’s Director Antti Pelttari.

Supo takes active part in investigating the events in Turku in cooperation with the National Bureau of Investigation and Southwestern Finland Police Department. In addition, Supo keeps in contact with its international partners in order to get more information on the suspected perpetrator and his possible terrorist contacts.

According to the terrorist threat assessment published in June, Finland’s terrorist threat level has been elevated due to the country’s profile having become stronger within the radical Islamist propaganda and the counterterrorism target individuals’ increasingly serious affiliations to terrorist activities.

The most significant terrorist threat in Finland is posed by individual actors or small groups motivated by radical Islamist propaganda or terrorist organisations encouraging them.

]]>

Terrorist threat in Finland elevated

Wed, 14 Jun 2017 06:00:00 GMT

The threat has been further increased by Finland's stronger profile within the radical Islamist propaganda and more serious links of CT target individuals with terrorist activities.

At the same time, a new four-tier scale was implemented to describe the threat level. The terrorist threat in Finland is at the level elevated.

The most significant terrorist threat in Finland is still posed by individual actors or small groups motivated by radical Islamist propaganda or terrorist organisations encouraging them. Supo has become aware of more serious terrorism-related projects and plans in Finland.

- Because the terrorist threat against Finland is bigger than ever before, it is essential that we can inform people of it as clearly as possible. Due to the continuous changes in the operating environment of counterterrorism, we have decided to implement a four-tier scale to describe the threat level, says Supo's Director Antti Pelttari.

The previous threat assessment by Supo was issued in November 2015. According to it, the risk posed by individual violent actions in Finland was increased but the threat of structured attacks by terrorist organizations was low.

According to the new threat assessment, the overall threat is at the level elevated. The other levels used by Supo are low, high and severe.

]]>