Supo's role in securing critical infrastructure has strengthened

New powers have given Supo better opportunities to combat threats to critical infrastructure in Finland. Critical infrastructure and the threats that it faces are becoming increasingly diverse.

Illustration, a ship's bow and trucks at night time.

The function of Supo is to supply relevant and proactive intelligence on economic threats to national security. Protecting critical infrastructure is a key part of this work.

Electricity and hydropower stations, air and rail transport, food and pharmaceutical supplies, and payment transactions and banking represent traditional critical infrastructure. Telecommunications and data are also key critical infrastructures in a modern, digitalised society. Various network enterprises, operators and cyber security businesses are important gatekeepers for the growing volume of valuable information about society and its security of supply in Finland.

Critical infrastructure may take the form of healthcare sector businesses, for example. The various subcontractors supplying paid services to businesses that are crucial for a functioning society may also be involved in critical infrastructure. Enterprises that supply IT services to a critical infrastructure business may serve as a backdoor to their clients’ information.

Supo is responsible for safeguarding critical infrastructure from espionage, hostile influence, disruption or destruction.

New powers have facilitated the investigation of economic threats

Critical infrastructure and the threats that it faces are becoming increasingly diverse. For example, control of critical infrastructure can be acquired through ownership structures. New powers that improve the ability of Supo to monitor and prevent issues of espionage and influence related to economic activity are accordingly welcome.

Supo formerly needed probable cause to suspect a criminal offence before it could pursue an investigation. Following the entry into force of new civilian intelligence legislation in 2019, Supo may now investigate threats proactively if they concern national security.

This may include such measures as registry checks, bank enquiries and gathering of data from open sources. An intelligence operation may be launched in the most serious cases.

Supo has focused on building expertise concerning financial influencing in recent years, with a view to increasing co-operation with local authorities, for example.

Protecting Finland’s critical infrastructure calls for extensive co-operation in society. Infrastructure in Finland is often owned by local authorities and businesses instead of central government. Local authorities and businesses are accordingly key players from a national security perspective.

Probes of critical infrastructure have also been observed in Finland

Business acquisitions and other investments are one way for authoritarian powers to acquire channels of influence. Some measures have also been observed in Finland that may have sought to access critical infrastructure.

A threat to critical infrastructure can take the form of a complex puzzle. Even though some individual investment may not pose a significant risk, simultaneous ownership of multiple assets may enable the emergence of undue influence.

The subcontractors that supply paid products and services to key operators in society also deal with critical infrastructure. Businesses commonly outsource and sell their operations, leading at worst to a situation in which some hostile party gains access to critical information.

Supo shares preventative information

It is important to identify risky investments or corporate transactions concerning critical infrastructure before they occur. For example, financial problems in business or local government can provide opportunities for foreign powers to access critical infrastructure.

Supo seeks to acquire intelligence concerning foreign economic influencing phenomena and the associated operators, their objectives and methods. It works to prevent and combat potential threats to national security arising from such projects.

Supo proactively distributes information to key operators about threats to national security, working with businesses, local government and other public authorities.

Even though tracking and confirming foreign business acquisitions falls within the purview of the Ministry of Economic Affairs and Employment in Finland, Supo evaluates such acquisitions from the perspective of national security on request. Supo does not prevent such transactions, but may discuss their security implications.

Security clearance vetting is also an important instrument for protecting critical infrastructure. Supo conducts security clearance vettings for enterprises of national importance, and has acquired resources and expertise in monitoring foreign economic influence to forestall threats.