Cyber scandal at the NDB Did Swiss intelligence service betray sensitive data to Russia?

A Swiss intelligence officer is alleged to have passed on confidential data to the Russian company Kaspersky for years - with possible access for Russian intelligence services. An SRF investigation reveals an internationally explosive scandal.

The revelations are explosive and cast a shadow over the Swiss intelligence service FIS: for years, a cyber team at the FIS is said to have passed on confidential information to the Russian software company Kaspersky - with potentially life-threatening consequences. This was reported by SRF in a large-scale investigation.

What began in 2020 with a secret meeting in a closed-down Geneva has now developed into one of the biggest security scandals in recent Swiss history. It centers on an FIS employee - known as W. - and his close cooperation with the Russian company Kaspersky, which, according to Western intelligence services, is closely linked to the Kremlin. Particularly explosive: information is said to have reached Russian intelligence services such as the GRU and the FSB via Kaspersky.

A friendly intelligence service warned that lives were in danger. The temporal connection with the Skripal case in England in spring 2018 is particularly precarious. Swiss intelligence service circles were involved in the investigation at the time - and now there is a suspicion that information about the case has been leaked to Russia.

A service on duty: a secret service with a life of its own

According to an internal report, the FIS cyber team acted partly autonomously. Its own servers, private cell phones for official communications, secret agreements - the report reads like a spy novel. Even malware samples - key evidence in cyber attacks - are said to have been given to Kaspersky as a "gift".

Some communications and data flows were not documented and were handled using private email addresses or Threema chats. According to the report, Kaspersky was "essential" for the team - as the NDB allegedly did not have sufficient resources of its own for cyber reconnaissance. A dangerous dependency, as it now turns out.

Warnings - and years of silence

The FIS began receiving information from friendly services as early as 2018. They explicitly warned about W. and the illegal transfer of data to Russia. But it took two years for the intelligence service to react.

W. was only suspended in 2020. The fact that he took his work laptop with him when he left and data was apparently deleted later caused additional irritation. Who ordered these deletions remains unclear to this day.

The new Minister of Defense, Martin Pfister, is showing determination. He announced an external administrative investigation to examine the implementation of previous recommendations - in particular whether unofficial contacts with Russian actors still exist. The supervisory authority AB-ND recently criticized the fact that a dual control principle had still not been established in the FIS cyber team by January 2025.

Former head W. rejects all accusations

W., who now works as a cyber expert and makes public appearances, says through his lawyer that the allegations are "completely out of thin air". He had cooperated fully in the internal investigation and no accusations had been made against him.

Insiders such as former BND deputy Arndt Freytag von Loringhoven warned that suspicions such as this would severely undermine trust between the intelligence services. Apparently, many collaborations with Switzerland are now only running on the back burner. Whether trust can ever be fully restored remains questionable.