Swedish intelligence, Russia and the war in Ukraine: anticipations, course, and future implications

ABSTRACT

As the sole plausible military threat facing Sweden, the Soviet Union and then Russia have consistently been at the top of Swedish intelligence collection priorities. In fact, understanding Russia and its military forces well is a source of pride and self-perceived comparative advantage of the Swedish intelligence community. This article contextualizes Swedish intelligence collection on Russia, including its Cold War antecedents and the persistent counterintelligence threat. It then describes Swedish intelligence reporting in anticipation of the war in Ukraine, including a reported misjudgement that Russia would ultimately not conduct a full-scale war of aggression against Ukraine in its entirety. This ‘intelligence failure’ was reportedly based on the assessment that Russia had assembled insufficient military capabilities to subjugate Ukraine, and that such an operation would be too risky and costly. Coming full circle in again beginning to focus mainly on great power competition and military capabilities in its near abroad, Swedish military intelligence has since reported valuable intelligence on Russian military capabilities, drawing on a combination of collection capabilities.

KEYWORDS:

• Strategic warning
• intelligence failure
• Ukraine war
• Swedish intelligence
• signals intelligence

1. Introduction

With its attempted full-scale invasion of Ukraine, Russia poses an existential threat to Kyiv. But it has already broken the pre-existing European security order, re-organizing the national security of the countries in its near abroad in the process.¹ One component of this shift of the geopolitical tectonic plates includes Finland and Sweden abandoning their military non-alignment and applying for NATO membership on 18 May 2022. Finland was granted membership in April 2023, with Sweden waiting impatiently to join its ranks in spring 2024. For both countries, leaving behind their long-held military non-alignment was a momentous decision that would not have happened if President Putin had not crossed the proverbial Rubicon. While Sweden and Finland both collaborated closely with each other and NATO prior to the war, in neither country did parliamentary majorities, nor popular opinion, support NATO membership.² Furthermore, extensive studies in both countries had concluded that a prolonged application process could prove destabilizing both domestically and regionally.³ But Russia’s invasion changed this overnight, as popular opinion and political parties in both countries shifted stance much faster than scholars had anticipated. This article explores the role of the Swedish military intelligence at this critical juncture of Swedish history, arguing that a misjudgement regarding Russian intentions vis-à-vis Ukraine might have contributed to putting its government on the back foot, including in deciding upon its NATO application. In the universe of ‘intelligence failures’, this outcome is of course comparatively trivial. But it is nonetheless troubling, as understanding Russian military capabilities and intentions is the fundamental raison d’etre of Swedish military intelligence, and the NATO application was Sweden’s most important defence decision in decades.

As the sole plausible military threat facing Sweden, the Soviet Union and then Russia has consistently been at the top of its intelligence collection priorities.⁴ In fact, the Swedish intelligence community has long prided itself on understanding Russia particularly well, based on a combination of excellent signals intelligence (SIGINT), linguistic and cultural expertise, and covert collection, including human intelligence (HUMINT).⁵ Even so, Russia’s invasion of Ukraine in 2022 reportedly caught Swedish military intelligence off balance. Specifically, the Swedish Military Intelligence and Security Service (Militära underrättelse- och säkerhetstjänsten, MUST) allegedly misread the intentions behind the Russian build-up of forces on the Ukrainian border. According to one source ‘As late as the weeks preceding Russia’s attack MUST stated that a major attack was not very likely’. Another added: ‘Our Swedish intelligence service had for months insisted that the invasion would not occur. We had thumped our chests and said that we know our near abroad and Russia – that is what we can offer in our collaboration with other countries. Now we made a complete misjudgement’.⁶

This lack of strategic warning led then Minister of Foreign Affairs Ann Linde to question US warnings of an impending attack. But more importantly, while Finland began laying the groundwork for a NATO application already in early January 2022, the Swedish government instead acted only after the outbreak of war, and was hence forced to expedite its dramatic shift of Swedish defence and security policy to catch up to Helsinki.⁷ Linde expressed surprise at the scale of the attack, and elaborated that a wholesale invasion had been deemed unlikely – firstly because Russia had insufficient troops to succeed, and secondly because it would entail ‘an enormous acceptance of risk by Putin’.⁸ Unsurprisingly, both Swedish parliamentarians and ministers were unhappy with the flawed forecasting provided by MUST, noting that it harmed the agency’s credibility. Then-opposition politician – now Minister of Defence – Pål Jonsson agreed, but also noted that the US is ‘an exceptionally important’ strategic partner, and that the government should hence have heeded their warning.⁹

Against this background, this article describes Swedish intelligence, Russia and the war in Ukraine. It does so by describing Swedish military intelligence and its continuous focus on Russia, including both Cold War antecedents and the longstanding counterintelligence (CI) threat. It then situates Swedish intelligence reporting in the run-up to the Russian invasion within the strategic warning and intelligence failure literature; analyses subsequent Swedish intelligence analysis and support to Ukraine; and outlines implications for the future. Specifically, it argues that three decades with a broadened security agenda, covering non-military threats such as terrorism, out-of-area peacekeeping, and organized crime, diluted the Swedish intelligence agencies’ focus on Russia, an era that has now abruptly ended.

2. The Swedish intelligence community and Russia

As opposed to its Nordic neighbours Norway and Denmark, Sweden refrained from joining NATO at its inception in 1949, and instead opted to remain nominally neutral.¹⁰ However, during large parts of the Cold War Sweden covertly prepared for close collaboration with Western countries in case of war. This included intelligence cooperation, with Sweden sharing some of its well-developed SIGINT with Anglo-Saxon intelligence agencies.¹¹ During this period, Sweden had very sizable, mobilizing armed forces based on universal male conscription. But following the end of the Cold War, this structure was dramatically downsized, as Sweden sought a peace dividend and the political leadership deemed war unthinkable during the coming decade. In line with this understanding, MUST noted in an intelligence estimate from 1999 that an ‘armed intervention’ was implausible, as Russia lacked interests, was economically dependent on the West, and militarily weak.¹² Hence, defence spending decreased from 1.9 per cent of GNP in 2000, to 1.2 per cent in 2010. Similarly, from 1992 to 2009, the army shrank from 16 brigades to 2, the air force went from 20 squadrons to 4, and the navy decreased from 30 surface combatants and 12 submarines to 7 and 4, respectively.¹³ Instead of a large force focused on territorial defence, the Swedish Armed Forces transformed into a small, all-volunteer force, with more modern materiel in much lower quantities, and primarily focused on out-of-area peacekeeping operations. During this ‘Afghanistan era’, Russia’s war of aggression against Georgia in 2008 raised concerns within the defence establishment, but this was largely dismissed by the political leadership.¹⁴ The Russian annexation of Crimea and its proxy war in Donbas in 2014 thus came as a ‘rude awakening’ to Sweden’s strategic community, and the onus of its defence policy shifted, albeit initially slowly and piecemeal, and this remains a work in progress.¹⁵

In spite of this ‘strategic time-out’, the Swedish intelligence community, and particularly defence intelligence, never entirely abandoned its focus on Russia as Sweden’s sole potential military threat. In fact, Sweden’s strategic community and the military intelligence agencies in particular take pride in understanding Russia well, considering this both a strategic priority and a comparative advantage in their collaboration with other nations.¹⁶ But in the interim between the end of the Cold War and the full-scale Russian invasion of Ukraine in 2022, Sweden embraced a broadened security agenda.¹⁷ Consequently, the three main intelligence agencies all received competing collection targets, such as terrorism, out of area operations, and organized crime.¹⁸ As intelligence resources are not limitless, this arguably diluted their focus on military security in Sweden’s near abroad, while by no means entirely abandoning it.

A crucial component of Swedish intelligence collection is SIGINT, under the purview of the National Defence Radio Establishment (Försvarets Radioanstalt, FRA). During the Cold War and beyond, FRA has collected SIGINT from both stationary and mobile listening posts, and according to media accounts collaborated closely with US counterparts.¹⁹ According to first-hand memoirs, during the Cold War the FRA also conducted some SIGINT operations from foreign territory – on land, at sea and via at least one specific Swedish embassy.²⁰ In 1952, the Soviet Union even downed a FRA SIGINT plane. While not the focus of this article, it can be noted that a combination of Sweden’s geographical location, the technical savvy of the FRA, and its notably forward-leaning SIGINT collection made FRA a valued partner of the US National Security Agency (NSA) during the Cold War and beyond.²¹ Former insiders from the Swedish intelligence community similarly claim that reporting from FRA is often highly trusted by Swedish policy-makers.²² In 2013, documents leaked by Edward Snowden confirmed that the NSA and the British Government Communications Headquarters (GCHQ) had collaborated with FRA since 1954. Furthermore, it also showed that FRA was viewed as a valuable SIGINT partner:

NSA’s relationship with the FRA, an extremely competent, technically innovative and trusted Third Party, continues to grow. The FRA provided NSA with access to its cable collection in 2011, providing unique collection on high-priority Russian targets such as leadership, internal politics, and leadership.²³

The other main actor within the Swedish military intelligence structure is MUST²⁴ which comprises several divisions, the most pertinent of which are the Intelligence Division (Underrättelsekontoret, UNDK), the Special Collections Division (Kontoret för Särskild Inhämtning, KSI) and the Security Division (Säkerhetskontoret – SÄKK). As a consequence of the growing focus on out-of-area operations, MUST also created a National Intelligence Unit (Nationella Underrättelseenheten, NUE), focused on intelligence collection from mission areas such Afghanistan and Mali.²⁵ While the Security Division is focused on counterintelligence in a broad sense, and the Special Collections Division on collection, the Intelligence Division (UNDK) plays a central role in the type of analysis involved in the run-up to the war in Ukraine. In 2014, MUST was staffed predominantly by civilians (70 per cent), mainly men.²⁶ Like FRA, MUST and its predecessors was occasionally notably forward-leaning during the Cold War. This included collaborating with the British in infiltrating Baltic assets back into the Baltic region during the 1950s,²⁷ recruiting human sources in the Warsaw Pact countries (during the late 1960s and early 1970s),²⁸ and netting a Russian ‘human warning indicator’, i.e., an individual tasked by the GRU to carry out assignments in Sweden in the early stages of an invasion (recruited during the 1980s).²⁹ Summarizing Swedish intelligence during the Cold War, Wilhelm Agrell, a Swedish professor of intelligence studies, notes that since the 1940s, Swedish defence policy was ambitious, in some sense acting like a ‘great power in miniature’, acquiring sophisticated weaponry and technology. Similarly, Swedish intelligence agencies such as the FRA, FOI and the predecessor of MUST also became partners to their corresponding US and UK intelligence agencies.³⁰

While MUST is characteristically secretive, a Ph.D dissertation by one of its analysts offers a remarkable window into some aspects of its analytical culture. Analysing MUST and its description of Russia during the early 2000s, Eriksson notes that the image presented was ‘that of a hereditary enemy of the West and, thereby, also of Sweden’.³¹ Russian politics was furthermore described as unpredictable, personalist and driven more by private incentives than ideologies or the public good.³² In intelligence estimates from this period, Russia is also described as a former superpower, mourning its loss of status, but with limited means to rectify it.³³ By contrast, in intelligence estimates from the same era, NATO is described in strongly positive terms, as the norm-setting and inevitable organization for military crisis-management in Europe.³⁴ Hence, in spite of Sweden’s military non-alignment and the relatively relaxed relations with Russia at the turn of the century, inside MUST there was seemingly little doubt as to who were Sweden’s long-term potential allies and adversaries.

Beyond MUST, minor supportive roles are also played by the Swedish Defence Research Agency (Totalförsvarets Forskningsinstitut, FOI) and the Swedish Defence Materiel Administration (Försvarets Materielverk, FMV), both of which are also subject to the Defence Intelligence Act.³⁵ Specifically on Russia, there is a well-established collaboration with FOI and its sizable and reputable Russia programme. For instance, during the early 1990s, FOI (then FOA) was given a second opinion function in understanding the ‘Russian threat’.³⁶ During the second half of the 1990s, MUST initiated an in-depth analysis of factors that could lead Russia to re-emerge as a threat to its near abroad, which involved collaboration with personnel from FOI.³⁷ Over time, the MUST-FOI relationship on Russia has oscillated between collaboration and competitiveness, predominantly in a positive sense.³⁸

3. The counterintelligence threat

The third major actor in the Swedish intelligence community is the Swedish Security Service (Säkerhetspolisen, SÄPO), in this context primarily focused on counterintelligence (CI). During the Cold War, SÄPO dealt continuously with a broad range of CI threats, primarily but not exclusively driven by Soviet Union and Warsaw Pact members’ operatives and assets.³⁹ Just like the Swedish Defence Forces focused more on out-of-area operations during the 2000s and 2010s, SÄPO devoted a greater share of its resources to counterterrorism than CI. This threat emanated mainly from Islamist extremists in Sweden, a steady stream of whom travelled to various conflict zones to fight on behalf of Al Qaeda and similar groups.⁴⁰ Some 300 Swedish residents are believed to have gone to Syria to join IS and other Islamist terrorist groups, and in 2017 a lone-actor terrorist attack inspired by IS in central Stockholm killed five people.⁴¹ Although the Islamist movement has declined in line with its general decline across Europe, it remains a serious threat to Swedes, one that was clearly visible in 2023.⁴²

Even so, towards the end of the 2010s, CI again began receiving increased resources, and Russia’s espionage against Sweden again came into the public eye through high-profile court cases.⁴³ This mirrors continent-wide trends – for the period 2010–2021, out of 42 individuals convicted for espionage, 37 had been acting on behalf of Russia.⁴⁴ Likewise, the number of Europeans convicted annually on espionage charges grew steeply over time, as more countries decided to publicly prosecute suspected spies, rather than simply intervene discreetly.⁴⁵

This change of policy is clearly discernible in Sweden, which has seen three convictions since 2021 – before that, there had been none in almost two decades.⁴⁶ In September 2021, a Swedish consultant for vehicle-manufacturers Scania and Volvo was convicted by the first court of instance (Tingsrätten) to three years in jail for espionage on behalf of Russia’s SVR in 2018 and 2019. The convict had struggled financially and seemed to be motivated mainly by money.⁴⁷

The so-called ‘Scania spy’ was however soon eclipsed by a much more serious case, involving a mole inside SÄPO and MUST, as two brothers of Iranian descent were arrested in 2021.⁴⁸ According to the sentencing from Tingsrätten, the older brother, Peyman Kia, worked both for SÄPO and later MUST, and stole information from both.⁴⁹ Whereas his specific positions were not discussed in the sentencing, Mr. Kia himself claimed in testimony that he worked with counterintelligence at SÄPO. A Swedish newspaper also reported that he had worked at the most secretive branch of MUST, the Directorate for Special Collection (KSI).⁵⁰ Shrouded in secrecy, KSI is assumed to collect i.a. human intelligence abroad.⁵¹

To older Swedes, the case was reminiscent of the Cold War, when the intelligence community was rocked twice by insider spies working on behalf of the Soviet Union – Air Force Colonel Stig Wennerström (detected in 1963) and Stig Bergling (detected in 1979), who worked for SÄPO and Defence Headquarters.⁵² The Kia case was opened after SÄPO received intelligence that a mole was offering stolen information from the Swedish intelligence community.⁵³ The agency then used computer logs to review who had accessed relevant files, and later found thumbnails of such files on one of Mr. Kia’s personal computers.⁵⁴ Peyman’s younger brother Payam, mainly acted as his courier, including receiving and laundering payments.⁵⁵ While arrested in 2021, an investigation had been underway since at least 2018, including surveillance and searches of Peyman’s job office and bank vault. The evidence against the brothers fell broadly into four baskets – an internal analysis of Peyman’s log-files; computer forensics of his private computers and USB memory devices; a diary of sorts kept by Payam; and a review of their handling of large amounts of cash during a single year.⁵⁶

Although the sentencing did not reveal what information was stolen and ostensibly provided to the GRU, it confirmed that it was highly sensitive.⁵⁷ In court, SÄPO drew parallels to FBI mole Robert Hanssen, due to similarities between the two cases. Peyman Kia was also compared to Sweden’s most damaging spies, particularly Stig Bergling, who also worked at SÄPO and Swedish defence and became a walk-in spy for the GRU due to greed.⁵⁸ The brothers’ Iranian descent prompted some speculation over whether divided loyalties may have motivated their espionage.⁵⁹ However, the sentencing argued that the only discernible motive was greed.⁶⁰ The brothers appealed, with Peyman admitting to parts of the accusations, including that he had received a total of $120 000 for his espionage, but also claiming that in part he had successfully sold false intelligence to Russia. Nevertheless, the second court of instance (Hovrätten) upheld Peyman’s lifetime sentence, while Payam withdrew his appeal.⁶¹

Set in the context of contemporary espionage, the Kia brothers are typical, insofar that both US and European spies are often driven mainly by greed.⁶² More specifically, amongst European spies during the 2010s, a quarter worked for intelligence (4) or defence agencies (7). Overall, these moles had more access to classified information, were better paid and avoided detection almost twice as long as other spies.⁶³ The Russian services also used more elaborate tradecraft to protect them, such as couriers, dead-drops, meetings in third countries, and advanced technology.⁶⁴ On each indicator – insider access, relatively large payments, active for a long time, and using sophisticated tradecraft – the Kia brothers fit the pattern well, reinforcing the impression that this is one of Sweden’s worst espionage cases on record.⁶⁵

In 2017, SÄPO also cracked down on a network of individuals who had been sharing sensitive military information with each other in closed online fora. The group discussed, for instance, military telecommunications and underground installations, some of which are classified.⁶⁶ The group consisted of 60 persons, with a shared interest in Swedish defence, most of whom did not seem to realize the potential hazards of their discussions. To date, a handful of individuals have been convicted of ‘unauthorized access to classified data’ (obehörig befattning med hemlig uppgift), since they did not intentionally share the data with a foreign power.⁶⁷ But in spite of the initial investigation having begun in 2017, the legal fall-out from the case is not yet final, with several new persons prosecuted in 2023.⁶⁸

In November 2022, the Swedish Police also arrested a Russian-Swedish couple on suspicion of illegal intelligence collection against Sweden and the USA.⁶⁹ The couple were originally Russian citizens but had obtained permanent residence permits and then citizenship. They had been involved with a number of companies, including one importing and exporting technical equipment. Studying Russian business interests in Sweden, researchers at FOI uncovered that the beneficial owner of one of the companies was an erstwhile GRU officer.⁷⁰ The investigative network Bellingcat also found that the couple long owned a Moscow apartment on the same floor as a GRU operative suspected of involvement in the Salisbury attacks.⁷¹ The prosecutor noted that the investigation was conducted together with the FBI, and that the suspicion against the husband focused on ‘technical collection on behalf of the Russian military industry’.⁷² In the sentencing, Tingsrätten largely agreed that the defendant had acted ‘as a platform for the Russian military intelligence agency GRU’. Even so, the court did not find that this amounted to illegal intelligence collection and acquitted him. Wilhelm Agrell noted that the case demonstrated a potential loophole in Swedish legislation.⁷³ As noted above, several of these investigations began prior to Russia’s invasion of Ukraine, and hence demonstrate that the Russian services had been notably aggressive in Sweden, well before the war, just as they had been in several other European countries, including via some remarkably brazen active measures.⁷⁴

4. Anticipating the Russian invasion

The run-up to the full-scale Russian invasion of Ukraine divided the Western intelligence community, insofar as Anglo-Saxon intelligence agencies were exceptionally outspoken in warning of an impending attack, while some European partners remained sceptical.⁷⁵ As the Russian build-up of tens of thousands of troops and heavy materiel along the border with Ukraine was visible for months using commercial satellite imagery, diverging assessments presumably centred on interpretations of Russia’s intentions, not capabilities. As media reporting has since clarified, ‘[T]he U.S. intelligence community had penetrated multiple points of Russia’s political leadership, spying apparatus and military, from senior levels to the front lines’.⁷⁶ But even as U.S. agencies were extraordinarily transparent in sharing their findings, it is not clear what level of insight for instance Swedish agencies had into the wealth of sources underlying the U.S. assessments.⁷⁷ This could be key, as even some US policymakers were initially incredulous at the audacity of Russian war plans but were gradually persuaded by the wealth of sources.⁷⁸ Furthermore, it may also be significant that some countries that were sceptical of the likelihood of a full-scale invasion – Germany and France, but also Sweden – did not necessarily see it as their single, overarching threat.⁷⁹ By contrast, the Baltic states were reportedly persuaded early by U.S. warnings.⁸⁰ Simply put, facing a potentially existential threat may make analysts more prone to err on the side of caution.⁸¹

As Russian troops crossed Ukrainian borders, it soon became apparent that the war had been preceded by multiple intelligence failures, on all sides. Most importantly, by the Russian FSB, that reportedly underestimated the Ukrainian will to fight so badly that they spent the final days before the invasion arranging accommodation in Kyiv.⁸² Whether due to poor sources, flawed analysis, or an unwillingness to communicate bad news, the FSB fed into the Kremlin’s overoptimistic war plans, rather than challenge them.⁸³ But there was arguably also a partial intelligence failure by Ukrainian leaders, who in spite of repeated warnings hesitated to heed them. In part, this was because they had to strike a balance between realistically assessing the risks and keeping the country running.⁸⁴ Many believed that there would be a limited invasion, focused on the country’s eastern regions.⁸⁵ But even as Ukraine’s political leaders downplayed the likelihood of a full-scale invasion, the Ukrainian military took critical steps to withstand the initial Russian assault. The head of the Ukrainian army, Gen. Col. Oleksandr Syrsky, also expressed disbelief that Russia would launch an all-out offensive – but still took preparatory actions, that in hindsight might have been decisive for the war’s opening stages.⁸⁶ In spite of correctly predicting the onset of war, the CIA too stumbled, as they reportedly ‘told the White House that Russia would win in a matter of days by quickly overwhelming the Ukrainian army’.⁸⁷ Hence, the CIA started planning to support a coming Ukrainian insurgency, and the U.S. withdrew intelligence assets. Similarly, only weeks into the war it became clear that the scholarly community had greatly overestimated Russian military capabilities in several important regards.⁸⁸

Set against this background, with Russia, Ukraine and the U.S. all to varying degrees making observable misjudgements,⁸⁹ it might be easier to explain why MUST missed the mark on the invasion, even though ‘[T]here is scarcely any invasion ever that had been so much warned about’, according to NATO Secretary General, Jens Stoltenberg.⁹⁰

Situating the Swedish case within the intelligence failure literature can provide some helpful contextualization. Firstly, compared to emblematical cases of intelligence failure, such as the Yom Kippur War, Pearl Harbor, 9/11, or the Hamas attack on 7 October 2023, the consequences of misjudging Russia’s invasion were modest for Sweden, and one can fairly question whether the event should even be analysed in this category.⁹¹ Even so, misjudging the nation’s only potential military adversary, undermining its own credibility in the eyes of its government principals, and delaying decision-making on an issue of critical national security importance (Sweden’s NATO application), was bad enough.⁹²

Secondly, predictions are notoriously difficult, and some argue that intelligence agencies should steer clear of them.⁹³ However, the risk of a Russian invasion was both visible and publicly debated months in advance, and Swedish scholars explicitly warned of the risk for a major war.⁹⁴ The MUST assessment likely consisted of forecasting possible futures, with estimates of likelihood. In so doing, they seemingly held a consistent line, believing that a full-scale invasion was improbable, as then-Foreign Minister Ann Linde suggested to her U.S counterpart Anthony Blinken on 2 December 2021, as did the head of MUST Gen. Maj. Lena Hallin at a conference in Sweden on 10 January 2022. ‘To the greatest extent possible they [Russia] seek to avoid a military intervention. This is about maintaining escalation control, to not challenge too much’, she told Dagens Nyheter.⁹⁵

Thirdly, short of prediction, a related aim of intelligence agencies is to prevent surprise, which can fail if products are inaccurate, or assessments of likelihood prove wrong.⁹⁶ But avoiding surprise is not merely about preventing it in a specific event, but also to identify change and anomalies in an adversary’s strategy and calculus.⁹⁷ However, on the eve of the invasion, Linde expressed surprise ‘[t]hat it became so extensive. Immediately. That I must say was unexpected … We had not excluded this, but I must still say that it is surprising that Putin chose to go in so massively from the east, the south, and from Belarus’.⁹⁸ Another source added that: ‘As late as the weeks prior to Russia’s invasion, MUST claimed that a large-scale attack was not very likely. At least there was no report that predicted an attack of the size that later occurred’.⁹⁹ A year on, a parliamentary White Paper reflected on why Sweden was surprised repeatedly by Russian military aggressions:

Surprise can occur because a chain of events conflict with an established worldview rather than due to lack of information. Russia’s aggression against Ukraine 2014 is a clear example of this, as are Russia’s actions in Syria 2015. Russia’s full-scale invasion in 2022 was preceded by a long-term military build-up in the border areas with Ukraine, combined with political, diplomatic and economic pressure and misdirection. There had for a long period been information and analyses that predicted the serious threat Russia again posed to Ukraine, the rest of Europe and the world. The management of the threat from Russia has in spite of this periodically been characterized by a lack of realism and too great expectations of positive developments.¹⁰⁰

Fourthly, one source of error identified in the intelligence failure literature is leaning too heavily on an established, unchanging assessment of an actor, such as Israel believing that Egypt would not attack in 1973 due to Israeli air supremacy, or the U.S. assuming that Japan would not attack in 1941, as American industrial capacity would make any drawn-out war unwinnable for Tokyo.¹⁰¹ In both cases, there were several indicators preceding the Yom Kippur War and Pearl Harbor attacks, respectively, that could have alerted analysts to the risk of an impending attack. But they were ignored, partly because they contradicted earlier assessments of the would-be attacker.¹⁰² There are some indications that similar factors might have been at play in the Swedish assessment of Russia. In an interview, then-Foreign Minister Ann Linde clarified: ‘That something would occur, that we believed the entire time. That it was a full-scale invasion, that was surprising’.¹⁰³ This assessment was based on two factors, according to Linde. Firstly, that a full-scale invasion of Ukraine would require substantially more troops than those Putin had forward-deployed.¹⁰⁴ Other European countries were reportedly also sceptical of a large invasion, for similar reasons.¹⁰⁵ Secondly, that a full-scale invasion ‘would be an enormous risk-taking from Putin’s side’.¹⁰⁶ This mirrors previous statements by the former head of MUST Lena Hallin, who argued that the invasion ‘did not come as lightning from a clear sky. That much you can say’.¹⁰⁷ However, MUST analysts still hesitated as to whether Putin was ready to launch a full-scale attack. ‘We saw that a full-scale war of aggression against Ukraine would be a very great political and military-strategic risk for Russia’.¹⁰⁸ Asked why they had not heeded U.S. warnings, Linde provided an answer that hints at relying too heavily on an established, unchanging assessment of the attacker:

Putin had not conducted a full-scale invasion of any of the countries that he attacked previously. Then he did it anyway. What you can say is that perhaps we should have realized that he was irrational in a manner that he had not been in the previous twenty years. But we didn’t.¹⁰⁹

While Linde may sound somewhat defensive in the interview, others were more overtly critical of MUST and its assessment. Then-Prime Minister Magdalena Andersson was, ‘not happy with the reporting she got from the Ministries of Foreign Affairs and Defence’. Wilhelm Agrell also noted that ‘This is a fairly typical misjudgement … They make the analysis that “this is improbable, because the negative consequences will be to great”. … It does not work in this context, since Putin has made up his mind a long time ago’.¹¹⁰ While the specific word is not used, several of these observations seem to refer to ‘mirror imaging’, interpreting other actors through a prism of one’s own worldview and preferences.¹¹¹ The aforementioned Swedish parliamentarians’ White Paper made similar reflections on the inherent risks of mirror imaging:

The perception of Russian actions as counterproductive and irrational has repeatedly contributed to mistaken assumptions regarding the limits of Russian actions. The analysis of Russia needs to depart from [the assumption] that the Russian leadership acts upon how it perceives the world, its aims and interests. An aggressive Russia, with both the capability and intent to wage war for a prolonged period, should be the main basis for the development of Sweden’s total defence.¹¹²

In a nutshell, it seems that mirror imaging and holding on to outdated conceptions of Russian decision-making in foreign policy may have played a part in explaining the reported misjudgement by MUST. It should however be recognized that MUST and other European agencies correctly assessed Russian capabilities, as they proved insufficient to subdue Ukraine – ironically, the very assessments that both the FSB and CIA got wrong.¹¹³ In this sense, they were to some extent wrong for the right reasons.

Last but not least, the producer-consumer relationship is often central to perceived intelligence failures, as policy-makers may blame their own mistakes on intelligence agencies, have unrealistic expectations, or simply not grasp how best to use intelligence.¹¹⁴ As defence politicians have pointed out, it was unclear why Swedish producers and consumers seemingly did not question why their assessments diverged so much from those of major partners such as the US and UK.¹¹⁵ Likewise, even in the face of diverging assessments, then Foreign Minister Linde did not necessarily have to overtly challenge U.S. warnings, as she did in a meeting with Antony Blinken, during an OSCE summit in Stockholm in early December 2021.¹¹⁶ Why key intelligence consumers chose this route is not known, but as noted earlier, understanding Russia well is a self-perceived comparative advantage of Swedish military intelligence.¹¹⁷ Beyond this, it might have been tempting to believe the less alarming assessments, particularly as the alternative suggested that Sweden might have to consider NATO membership – a very divisive course of action within the governing Social Democrats, and one that both the Ministers of Defence and Foreign Affairs objected to.¹¹⁸

5. Process versus product and organizational factors

Understanding precisely what went wrong in the Swedish intelligence analysis preceding Russia’s full-scale invasion of Ukraine in February 2022 is not possible for an outsider, as the intelligence estimate itself, as well as any deliberations that went into it, remain classified. However, while the preceding section focused on public reports on the product itself, it is also worth considering whether internal processes may also have some explanatory value.¹¹⁹

From the outset, some possible sources of error can be discarded directly. The Swedish strategic community in general, and MUST in particular, are in no way naïve about Russia, or its strategic culture. To the contrary, Russia’s revanchist worldview and the possibility that this might result in military aggression was identified in intelligence estimates during much more peaceful times.¹²⁰ Variations of this theme have since been repeated, for example in both White Papers on Swedish defence and in the agency’s own annual reports published since 2012.¹²¹ However, research on MUST as a knowledge producer, primarily by one of its analysts, identifies characteristics that may potentially create recurring problems. Firstly, an emphasis on continuity of thinking, and secondly, a search for consensus, coupled with a reluctance to offer or accept criticism of estimates outside of one’s nominal area of expertise.¹²² Taken together, these tendencies can plausibly create a disinclination to predict dramatic changes, or identify and rectify previous misjudgements. Analysts for instance reported that:

The sort of group-think that appears is completely crazy, and the scope for thinking differently is very limited. (…) In these environments there are always some analysts who set the norm for which analysis will be completed. Everything else falls by the wayside. It is all about thinking alike. If you asked me why we aren’t bold in the conclusions we come to, my answer would be because the organization doesn’t allow it.¹²³

Other analysts also note that it is easiest to stay within ‘company policy’, and that thinking outside the box can be controversial, and requires stronger evidence than repeating earlier assessments. Furthermore, some respondents were self-critical as to insufficient source criticism, valuing in-house collection more highly than other sources, and the analytical process being individual, unarticulated and often based on ‘gut feeling’.¹²⁴ Analysts can also be sensitive to criticism, and who can criticize what estimates is governed both by the perceived status and nominal areas of expertise of individual analysts, in a primarily informal hierarchy.¹²⁵ Along similar lines, an interview study with Swedish military intelligence analysts suggests that there was a lack of established methods, that the starting point for threat assessments was typically previous assessments, and that some analysts started with an assumption or belief, and then sought information to verify this.¹²⁶ Needless to say, lack of methodology for analytical processes, and over-reliance on intuitive and inductive reasoning are frequently pointed out as potential sources of intelligence failures.¹²⁷ Unsurprisingly, so are groupthink, cognitive closure and unwillingness to accept contrarian assessments.¹²⁸ Granted, the bulk of this research was conducted during the 2010s and giving access to researchers that publish openly suggests that at least some decision-makers within the agency are or were open to change. However, organizational culture can be resistant to change, and some intelligence agencies fail to learn even from intelligence failures.¹²⁹

6. Future implications for Swedish intelligence

Following Russia’s annexation of Crimea in 2014, a leading scholar concluded that Sweden had been quick to react to Russia’s aggression but slow to act on that assessment. Politicians specifically, ‘shied away from the two obvious steps needed to reduce Sweden’s deterrence deficit: to roughly double defence spending, and to join NATO’. Specifically for the Social Democrats, joining NATO would be difficult, ‘at least in the absence of strong external factors legitimizing accessions’.¹³⁰ However, the contrast between 2014 and 2024 could not be starker, with Swedish society now strongly in favour of supporting Ukraine, joining NATO, and quickly expanding national defence capabilities.¹³¹ This is plainly visible from official documents from the respective eras too. In its annual report 2014 (published in 2015), MUST noted that the Russian aggression demonstrated a lowered threshold to using military force and the importance of upholding its great power status, and that the war led to greater military presence and increased risks for military tensions in Sweden’s near abroad.¹³² The same report however also noted that since the mid-1990s, MUST had been tasked with a much wider range of collection targets, beyond the military balance of power in Sweden’s near abroad, including ‘IT-threats, terrorism and proliferation of weapons of mass destruction’.¹³³ In 2024, the report instead focused almost exclusively on the war in Ukraine, and great power competition in Sweden’s near abroad.¹³⁴ Similarly, a parliamentary White Paper on total defence in 2014 analysed the Russian aggression and found that it demonstrated that the threshold to using military force had been lowered, ‘at least against former Soviet Republics in Russia’s near abroad that are not members of NATO or the European Union’.¹³⁵ Similarly, the report argued that Russia’s foreign policy was ‘unpredictable and destabilizing’. Even so, it concluded that it was not possible to ‘imagine a military conflict in our near abroad that would affect only a single country. A military armed aggression directly against Sweden is still improbable’.¹³⁶ In 2023, the tonality had shifted completely. ‘A war in Europe, with the risk of quickly escalating further, is today a reality and poses a direct threat to both EU- and NATO members and other countries. Russia is the defining opponent [dimensionerande motståndaren]’.¹³⁷ At long last, Sweden is now taking the ‘obvious steps’ needed to reduce its deterrence deficit – doubling its defence spending and joining NATO.¹³⁸

In tandem, several steps have been taken to adjust Sweden’s military intelligence to the deteriorated security situation. Since Russia’s full-scale invasion of Ukraine, Swedish agencies have reportedly been successful in explaining how the war has unfolded,¹³⁹ provided high-quality SIGINT¹⁴⁰ and taken several measures to sharpen its CI efforts.

But Sweden is currently facing ‘the most serious security situation since the end of World War II’.¹⁴¹ Hence, a review of the Swedish intelligence community was begun in the fall of 2023. Led by former Prime Minister Carl Bildt the review has a broad mandate and is conducted ‘against the background of developments in our near abroad and the defence- and security-political situation, the changed threat perception’.¹⁴² Covering primarily FRA, MUST and SÄPO, its directive notes that, ‘due to the worsening security situation all agencies responsible for intelligence collection have received increased resources the past years’. Cooperation between MUST, FRA and SÄPO in particular has developed greatly.¹⁴³ And after three two decades with a broadened security agenda, where military threats were less prioritized, Sweden is now in a situation where ‘an armed aggression cannot be excluded’. This requires greater intelligence, including on ‘foreign states’ military capabilities and options, and intelligence on antagonistic actors’ political considerations’.¹⁴⁴

However, the review should not be seen mainly as a reaction to misjudgements preceding Russia’s invasion of Ukraine in 2022. Instead, it is a long-term review of Swedish intelligence writ large, with a very broad scope, including everything from hybrid threats, cooperation with civilian agencies, the possibility of using new technologies such as artificial intelligence, implications for intelligence of Swedish NATO membership, evaluation of intelligence, and recruitment, retention and training of intelligence analysts.¹⁴⁵ Over the past two decades, traditionally safe Sweden has lived through multiple security crises, beyond military threats most notably a disproportionately large threat of Islamist terrorism (in Sweden, and by Swedish citizens abroad) and steeply escalating gun violence connected to organized crime. In each case, Swedish authorities have proven ill-equipped to predict or address the threat in a timely manner.¹⁴⁶ Hence, the review – the first of its kind in two decades – is a belated, grand review of a system in great need of reform and modernization, not a critique of an individual agency for a single misjudgement.¹⁴⁷ Although it might have stumbled in the run-up to Russia’s invasion of Ukraine, the Swedish intelligence community has decades of experience of dealing with various facets of the Russian threat. Hence, coming full circle in again focusing mainly on great power competition, CI and military capabilities, it has every opportunity to remain a trusted and valued international intelligence partner, just as it was during the Cold War.¹⁴⁸

Disclosure statement

No potential conflict of interest was reported by the author(s).

Correction Statement

This article has been corrected with minor changes. These changes do not impact the academic content of the article.

Additional information

Notes on contributors

Michael Jonsson

Michael Jonsson holds a Ph.D in political science from the Department of Government at Uppsala University and works as a Deputy Research Director at the Swedish Defense Research Agency (Sw. FOI). Dr. Jonsson has published i.a. with Survival, Studies in Conflict and Terrorism, European Security and Georgetown Journal of International Affairs. He is also the editor (with Svante Cornell) of Crime, Conflict and the State in Postcommunist Eurasia (Pennsylvania University Press, 2014).

Notes

1. Dalsjö ,“Kriget i Ukraina”, 573–74.

2. Forsberg, “Finland and Sweden’s Road to NATO.”

3. Bergquist et al, Konsekvenserna av ett eventuellt finskt Natomedlemskap, 5–7, Bringéus och Eriksson, Säkerhets i ny tid, 154.

4. Leijonhielm, Ett svenskt Leijon, 144; Eriksson, Swedish Military Intelligence, 133.

5. On Swedish HUMINT-collection from sources in the Soviet Union during the Cold War, see for instance Leijonhielm, Ett svenskt Leijon, 91–95.

6. Holmström, “Källor: Så missbedömde Sverige.”

7. Ibid.

8. Holmström, ”Ann Linde: ‘Borde kanske ha insett’.”

9. Holmström, “Politiker kritiserar Must.”

10. Dalsjö, Life-Line Lost, 66–67.

11. Dalsjö, Life-Line Lost, 244–246.

12. Eriksson, Swedish Military Intelligence, 133.

13. Dalsjö, Sweden and its deterrence deficit, 95.

14. Larson et al, Det kaukasiska litmustestet.

15. Dalsjö, Sweden and its deterrence deficit, 96–98, 100–102.

16. See note 6 above.

17. Statsrådsberedningen, Nationell säkerhetsstrategi, 3.

18. MUST, Årsöversikt 2014, 7; SÄPO, Säkerhetspolisens Årsbok 2014, 5–6; Statens Offentliga Utredningar”Försvarets Radioanstalt”, 29–37.

19. See note 11 above.

20. Leijonhielm, Ett svenskt Leijon, 84–87; Agrell, Sprickor i järnridån, 272.

21. Agrell, Sprickor i järnridån, 170–72, 270–73, 301.

22. Leijonhielm, Ett svenskt Leijon, 206.

23. SVT Nyheter, ”Read the Snowden Documents.”

24. Hansén, ”Assessing intelligence oversight”, 944.

25. MUST, Årsöversikt 2014, 13–14.

26. In 2014, the personnel was 70 per cent male and 30 per cent female, and 70 per cent civilian and 30 per cent military. MUST, Årsöversikt 2014, 35. By 2022, the share of female personnel had increased to 40 per cent.

27. Agrell, Sprickor i järnridån, 84–102.

28. Leijonhielm, Ett svenskt Leijon, 47–65; Agrell, Sprickor i järnridån, 188–202.

29. Leijonhielm, Ett svenskt Leijon, 91–95. Agrell, Sprickor i järnridån, 278–80.

30. Agrell, Sprickor i järnridån, 301.

31. Eriksson, Swedish Military Intelligence, 148.

32. Eriksson, Swedish Military Intelligence, 149–150.

33. Eriksson, Swedish Military Intelligence, 48, 53.

34. Eriksson, Swedish Military Intelligence, 141.

35. Eriksson, Swedish Military Intelligence, 48, 53.

36. Leijonhielm, Ett svenskt Leijon, 144.

37. Leijonhielm, Ett svenskt Leijon, 191–194.

38. C.f. Dover, ”Adding value to the intelligence community”, 854–57, on the comparative advantages but also barriers of outside experts contributing to the intelligence community.

39. Nylander and Korsell, Säpo inifrån, 117–128.

40. However, other types of groups, such as the Kurdish PKK, also had a sizable presence in Sweden. SÄPO, Säkerhetspolisens Årsbok 2014, 31–35.

41. Gustafsson and Ranstorp, Swedish Foreign Fighters.

42. In August 2023, the terrorism threat level was increased from level 3 to 4 in Sweden, on a 1–5 scale. In October 2023, two Swedes were killed in a terrorist attack in Brussels, targeted due to their nationality. SVT Nyheter, ”Terrorhotnivån i Sverige”; Yle Nyheter, ”Två äldre män ihjälskjutna i Bryssel.”

43. SÄPO, Säkerhetspolisen 2017, 50–53.

44. Jonsson, ”Espionage by Europeans”, 7.

45. Jonsson, ”Europe’s Decade of the Spy.”

46. Bergqvist, ”Person inför rätta för spioneri”.

47. Zangana, ”Konsult hade tusentals bilder”; Wikström and Börjesson, ”Göteborgare döms – var spion.”

48. Uggla, ”Livstids fängelse för en av spionbröderna.”

49. Stockholms Tingsrätt, Målnummer B14349–21 Dom 2023-01-19.

50. Örstadius, Carlsson and Holmström, ”Man häktad för brott mot rikets säkerhet.”

51. Ibid.

52. Widén, ”The Wennerström Spy Case”.

53. Stockholms Tingsrätt, Målnummer B14349–21, 15, 18.

54. Stockholms Tingsrätt, Målnummer B14349–21, 13.

55. Stockholms Tingsrätt, Målnummer B14349–21, 27–33.

56. Stockholms Tingsrätt, Målnummer B14349–21, 36–37.

57. Stockholms Tingsrätt, Målnummer B14349–21 Dom 2023-01-19.

58. Westberg, ”Ett av de allvarligaste spionfallen”.

59. Braw, ”Sweden Spy Scandal.”

60. Westerberg, Hurinsky and Constantini”,Bröder döms till fängelse”.

61. Dahl and Canoilas. ”Livstidsdom mot spionbroder”; SVT Nyheter”Hovrätten fastställer livstids”.

62. Jonsson and Gustafsson, ”Espionage by Europeans”, 45–46.

63. Jonsson and Gustafsson, ”Espionage by Europeans”, 73–74.

64. Weiss, ”The hero who betrayed his country.”

65. Westberg, ”Ett av de allvarligaste spionfallen”.

66. Ronge, ”SÄPO stängde hemligt nätverk”; Bergqvist”Nätverket som kartlade försvarets hemligheter”.

67. Holmström ”Officer döms till fängelse – röjde anläggningar.”

68. Dagens Juridik, ”Nämndeman döms.”

69. SVT Nyheter, ”Det ryska paret levde Svenssonliv”.

70. SVT Nyheter, ”FOI kände till ryska agenten”.

71. Sadikovi and Hurinsky”,Misstänkta paret hade bostad på samma våning som GRU-agent”. They owned the apartment 1999–2015, after which their daughter owned it until 2019.

72. SVT Nyheter, ”Spionmisstänkte mannen begärs häktad”.

73. Hurinsky”Man frias i mål”; Stockholms Tingsrätt”.Friande dom i målet om grov olovlig”.

74. Ilves and Giles, ”Why can’t Europe see that it’s at war with Russia?.”

75. Corera, ”Inside the spies”; Harris and Sonne”,Russia planning massive military offensive”.

76. Harris et al, ”Road to war.”

77. Reportedly, U.S. agencies were for instance of sharing too much with Ukrainian counterparts until shortly before the invasion. Harris et al, ”Road to war.”

78. See note 76 above.

79. C.f. Meijer and Brooks, ”Illusions of Autonomy”, 17.

80. See note 76 above.

81. For a related point, on how intrawar warnings are more often heeded than prewar warning, since the cost of response has already been reduced, see Wirtz “Are Intelligence Failures Still Inevitable?“, 317–18.

82. Miller and Belton, ”Russia’s spies misread Ukraine.”

83. Ibid.

84. See note 76 above.

85. See note 82 above.

86. Harris et al, ”Road to war”; Sonne et al, ”Battle for Kyiv.”

87. Risen and Klippenstein, ”The CIA Thought Putin Would Quickly Conquer”; Harris et al, ”Road to war.”

88. Dalsjö, Jonsson and Norberg, ”A Brutal Examination.”

89. See note 82 above.

90. See note 6 above.

91. C.f. Agrell, Vi såg det inte komma, 15–28; Jensen”,Intelligence Failures”, 263.

92. Holmström, ”Källor: Så missbedömde Sverige”; Holmström, ”Politiker kritiserar Must.”

93. Jensen, ”Intelligence Failures”, 267–269.

94. Agrell”,Väntar ett storkrig runt hörnet?”; Persson”Små stater göre sig icke besvär”.

95. See note 6 above.

96. Jensen, ”Intelligence Failures”, 273.

97. Shapira, ”The Yom Kippur intelligence failure”, 981–982.

98. See note 6 above.

99. Ibid.

100. Försvarsberedningen, Kraftsamling, 31.

101. Shapira, ”The Yom Kippur intelligence failure”, 980–81; Agrell, Vi såg det inte komma, 18–19.

102. Shapira, ”The Yom Kippur intelligence failure”, 985; Agrell, Vi såg det inte komma, 23–24.

103. See note 8 above.

104. Notably, French and German officials questioned U.S. warnings based on a similar logic. Harris et al, ”Road to war”

105. See note 76 above.

106. See note 8 above.

107. Bodin”,Mustchefen Lena Hallin”.

108. Bodin”,Mustchefen Lena Hallin”.

109. Linde, cited in Holmström, ”Ann Linde: ‘Borde kanske ha insett’.”

110. See note 6 above.

111. C.f. Shapira, ”The Yom Kippur intelligence failure”, 982–987, that argues that part of Israel’s intelligence failure was a flawed understanding of foundational cultural and social aspects of Egypt’s decision-making” and to recognize that Egypt was willing to take major risks to erase perceived humiliation and restore dignity.

112. Försvarsberedningen, Kraftsamling, 16. Author’s translation, emphasis added.

113. Harris et al, ”Road to war”; Holmström, ”Ann Linde: ‘Borde kanske ha insett’”; Miller and Belton, ”Russia’s spies misread Ukraine”

114. Borer, Twing, and Burkett”Problems in the Intelligence-Policy”; Jensen, ”Intelligence Failures”, 274–75.

115. See note 9 above.

116. Holmström, ”Politiker kritiserar Must”; Holmström, ”Ann Linde: ‘Borde kanske ha insett’.”

117. See note 6 above.

118. Strömberg and Nilsson”Så gick det till”; Also c.f. Wirtz “Are Intelligence Failures Still Inevitable?“, 317–18, on the disincentives of policy-makers to respond to prewar warnings.

119. C.f. Jensen, ”Intelligence Failures”, 274–75.

120. See note 12 above.

121. Försvarsberedningen, Försvaret av Sverige, 14–19; MUST Årsöversikt 2014, 11.

122. Eriksson, Swedish Military Intelligence, 78–79.

123. MUST intelligence analyst, cited in Eriksson, Swedish Military Intelligence, 77.

124. Eriksson, Swedish Military Intelligence, 72–75.

125. Eriksson, Swedish Military Intelligence, 84–86.

126. Bang, ”Institutional influence on assessments”, 56.

127. Shapira, ”The Yom Kippur intelligence failure”, 982–983.

128. Shapira, ”The Yom Kippur intelligence failure”, 988.

129. Dahl, ”Missing the Wake-up Call.”

130. Dalsjö, Sweden and its deterrence deficit, 93, 105–106.

131. Sullivan, Larsson and Gressel, ”In Major Shift.”

132. MUST, Årsöversikt 2014, 10–11.

133. MUST, Årsöversikt 2014, 7. Author’s translation. Its sister agency FRA had also received similarly broadened collection requirements. Statens Offentliga Utredningar”Försvarets Radioanstalt”, 29–37.

134. MUST, Årsöversikt 2023, 12–25.

135. Försvarsberedningen, Försvaret av Sverige, 14.

136. Försvarsberedningen, Försvaret av Sverige, 19.

137. Försvarsberedningen, Kraftsamling, 15.

138. C.f. Dalsjö, ”Sweden and its deterrence deficit”,105–106.

139. See note 9 above.

140. Hagvall ”Svensk spaning på ryska trupper”

141. Försvarsberedningen, Kraftsamling, 15.

142. Regeringen, ”Kommittédirektiv”, 1.

143. Regeringen, ”Kommittédirektiv”, 5–6.

144. Regeringen, ”Kommittédirektiv”, 7.

145. Regeringen, ”Kommittédirektiv”, 8–14.

146. Agrell, Vi såg det inte komma, 181–207.

147. Jonsson, Oscarsson and Starbrink”,Carl Bildt ska vässa arbetet”.

148. Agrell, Sprickor i järnridån, 301.