Law-Abiding Criminals: How a Group of Military Over-Interested Persons Became a Threat Against National Security

Abstract

The present case study examines a new form of security threat in the form of a network of “military over-interested persons” who tried to perform a mapping of Sweden’s classified military infrastructure. What makes them stand out is that they seem to have had no malicious intent, unlike the more frequently studied areas of spies and other insider threats. The results indicate that an obsessive military interest and a “perfect storm” of factors—individual risk factors, a toxic social network, and the false safety of a closed military web forum—allowed the individuals to commit serious crimes. Implications for the security of military organizations and future research are discussed.

Keywords:

• Insider threat
• risk assessment
• security management
• urban exploration
• secrecy paradox

Introduction

The raid

At exactly 0600 on November 21, 2017, the Swedish Security Services (Säpo) conducted a raid against the main actors in a network of individuals suspected of crimes against national security. More would be implicated in the following investigation. The individuals lived in different parts of the country but had been connected through an online military forum where they had attempted to conduct a complete mapping of the country’s classified military facilities. The mapping had been systematic, conducted over several years in a way that posed a risk to national security (Säkerhetspolisen, 2023, p. 61). The Military Intelligence and Security Service (MUST) (Militära underrättelse- & säkerhetstjänsten, 2020) has stated that “mapping of military installations is a very serious crime and individuals who do so endanger both their own and Sweden’s security” (p. 63).

The collection and sharing of secret information on a larger magnitude are usually the tasks of spies (Jonsson & Gustafsson, 2022). The rationale of military secrecy is primarily to conceal information from foreign powers to reduce risk and maintain an advantage in time of war. As a result, foreign intelligence services are the primary parties interested in those secrets, and exploiting individual vulnerabilities to obtain them is a central task (Wilder, 2017). Sweden has seen several historical spy cases; perhaps the best known is that of Stig Wennerström who sold top-secret documents, including information regarding Swedish operational planning, to Soviet Military Intelligence Services (Widén, 2006).

However, what perhaps most distinguishes the individuals in the present case is that they showed no signs of aiding a foreign power. They appear to have had no malicious intent at all (Militära underrättelse- & säkerhetstjänsten, 2020, p. 63). Those who were prosecuted and sentenced were punished for violation of Chapter 19, section 8 of the Swedish Criminal Code (2019), “Gross unauthorized dealing with secret information,” which is directed against those who without authority obtain, transmit or reveal information concerning matters of a secret nature. The crime is akin to that of gross espionage (section 6) with the main exception that the person has committed it without any aim to benefit a foreign power. Those in the network who were prosecuted were convicted and sentenced with penalties ranging from prison to a suspended sentence.¹ In this regard, the case represents an unexplored form of criminality and security threat.

MÖP, urban exploring and bunkerology

The individuals in the network have been described with the expression “military over-interested persons” or just by the Swedish abbreviation MÖPs (Holmström, 2021). But being interested (even more than average) is usually something positive. For the most part, individuals can use a prominent military interest in a productive way. A similar concept is urban exploration and the exploring of abandoned facilities, which has a subbranch commonly referred to as bunkerology with a focus on military buildings and infrastructure (Bennett, 2011). Overall, many individuals enjoy visiting abandoned structures for photographic or historical reasons. Sweden is also a suitable country to pursue these interests. While every country has military secrets and underground facilities, Sweden stands out. During the Cold War, the country had a non-alignment policy and a strictly defensive strategy. Sweden is also a large country with suitable bedrock. Because of this both the Armed Forces and the Civil Defense moved facilities underground for better protection, leaving Sweden with a military infrastructure on a magnitude that is unparalleled in many other countries.

But urban exploration and bunkerology focus primarily on what is abandoned or decommissioned and enthusiasts normally adopt a positive codex of “take only pictures, leave only footprints, kill nothing but time.”² The activities do not include a criminal element but have on the contrary been argued to best be viewed as a resource of knowledge for the Armed Forces (Lundgren, 2022). Of course, there are subcultures within urban exploration that involve trespassing (e.g. metro tunnels) or that include active facilities. Exploring what is prohibited can part of the motivation for some. Cases also exist where such individuals have been subject to arrest by the Security Services. For example, on July 5, 2017, about five months before the present case, the Security Services conducted a raid in Hässelby against two men who operated an Instagram account with over 300 pictures of urban exploring with an explicit focus on unlawful entry. The raid attracted some momentary media attention since the police rappelled down from the roof and made a surprise entry through the windows of the apartment on the seventh floor. After some months of investigation, it was concluded that the men had greatly exaggerated their exploits online and the prosecutor decided to discontinue the investigation. It is not known why they made their exploits appear more unlawful than they were, but since the exaggerations occurred on social media then social factors like seeking validation and admiration from others probably contributed.

Previous research has shown that it is not primarily an interest per se that is problematic, but rather when that interest is allowed to develop from a harmonious passion to an obsessive one (Bélanger et al., 2019). When contextual factors allow it to do so it can inhibit moral reasoning and allow the interest to be expanded in an unhealthy direction and enable destructive behaviors. Examples of contextual factors that can contribute to the development of obsessive interests can be the search for significance and social recognition (Jasko et al., 2020). Simplified, it is usually not the interest itself that is problematic but when the ecosystem around the individual makes it take on unhealthy proportions and directions that are dangerous (or outright illegal).

The era of eternal peace

It is relevant to understand the context in which the current phenomenon has evolved.

The post-Cold War era of the late ’90s and early 00s is often ironically referred to as “the era of eternal peace” in Sweden (Agrell, 2010). It was a period where it was believed that conflict would never come again. The Armed Forces were greatly reduced and refocused on conducting international deployments. Military installations relevant to national defense, and the security regarding them, were still there but greatly deprioritized. At the same time, there was a breakthrough in geographical information systems available to the public. On June 28, 2005, Google Earth was launched followed by other sources for satellite/aerial- and street view photography, initially often with sensitive areas not blurred. The introduction of these services on a large scale to the public made the search for remote facilities considerably easier.

During this period, government authorities were also often too open in the balance between transparency and confidentiality. Sometimes, in hindsight embarrassingly so. For example, in 2009 when one of the main air combat commands for the Air Force was suggested for decommissioning due to budget cuts, both politicians and local media were invited into the large underground complex and the function and capability of the facility were presented as the reason for its continued existence. When the security situation had once again taken a turn for the worse and an officer was charged in 2018 for bringing his partner into a classified underground command center for the Navy without the proper clearance, the officer acknowledged his actions but pointed out that just a few years before, there had been a children’s party inside the facility, conducted with tacit consent rather than formal approval, indicating that security had still existed but sometimes had not been taken that seriously.³

But the era of eternal peace eventually came to an end. In the 2014 annual report the Swedish Security Service stressed that Russia (followed by Iran and China) was the largest intelligence threat to Sweden. They warned openly that their espionage in the country was “very comprehensive” (Säkerhetspolisen, 2015, p. 60) and that Russia was making war preparations against Sweden.

Secrets and social positioning

One recent case with similarities to the present one is the sharing of classified military information in a private group on the social platform Discord by Jack Teixeira. Teixeira was an airman who served in the 102nd Intelligence Wing of the Massachusetts Air National Guard, and he was arrested on April 13, 2023 by the FBI for “unauthorized retention and transmission of national defense information” after taking classified intelligence documents and posting photographs of them for the members of a Discord community group. From there they were passed on to another, larger community group and subsequently gained the public’s attention when they appeared on Twitter, the imageboard 4chan as well as in Russian Telegram channels. On April 9, 2023, the independent investigative collective Bellingcat published an investigation in which they had been able to backtrack the documents to the source using open-source intelligence (Toler, 2023). The case of Teixeira shares similarities with the present one in that he appears to have had no malicious intent. The motivation, other users of the community group have insisted, was rather to impress his peers and maintain social status (Beaumont, 2023).

Secrecy can primarily be seen as a social phenomenon (Kelly, 2002, pp 17–18). Humans are social beings and have a strong inherent desire to belong. When a person’s sense of who they are is affected by membership in a particular group (e.g. sports teams, religious groups, colleagues at work) it is often referred to as social identity (Tajfel & Turner, 1979). The sense of identity is often an important source of pride and self-esteem, and social identities affect people’s attitudes and behaviors more when they consider membership in a group to be central to their self-concept. Social identity can also be a factor contributing to collective action where individuals’ actions are directed toward a common objective (van Zomeren et al., 2008).

Inclusion in social contexts rarely comes without effort. It is often up to the individual to develop and maintain the necessary social ties in different groups. By sharing and receiving information relevant to the groups we belong to, we can maintain even a very large social network and our position in it. Anthropologist Robin Dunbar has described this function as “social grooming” (Dunbar, 1991). Or with a more colloquial expression: gossip. Knowing and revealing secrets not only determines inclusion but also position in different groups. Possessing information that others do not can give an ego boost and a strong sense of power, also making it possible to influence others in order to be regarded with higher esteem. A humorous military saying is that “It is no fun being secret if you can’t tell anyone.” This indicates that positions with unique insight are often related to higher status, but at the same time recognizes that the process of social validation is dependent on the counterpart being made aware of it. This is referred to as a secrecy paradox in the scientific literature (Bellman, 1981). Someone must not only conceal something but someone else must know or suspect this concealment. The same paradox affects the disclosure of information. A rise in social status is dependent on telling a secret. But once revealed it will no longer be a secret and the more the individual discloses, the less special he becomes. Consequently, social belonging and positioning can be strong motivators to both acquire and reveal secret information in order to feel and be seen as special; more so if the individual is not that special to begin with.

Another factor regarding secrets is the need to see patterns and view the world as comprehensible. Patterns have always been a central part of basic human cognitive functions such as perception and memory (Eysenck & Brysbaer, 2018). Seeing a pattern is preferable to fragments; it is easier to remember the motif that the puzzle depicts than the shapes and colors of all the different pieces. The need to find complete patterns can also be seen in the urban exploration cultures discussed in the previous section. Thus, a decisive factor when we assess whether we should trust someone else with certain information is whether we believe that they can reciprocate and offer some information of their own that gives us new perspectives. When people share their secrets with others, they can gain insight into their meaning and develop a deeper understanding. This situation can be compared to a puzzle that is so large that no single person can solve it alone, but if you reveal your piece to a few selected others, you can get other pieces in return that can help.

Aggregated information and the puzzle doctrine

The puzzle analogy is not only psychological but was made legal doctrine by the Norwegian Wilkes/Gleditsch case. Owen Wilkes and Nils-Petter Gleditsch are researchers in peace and conflict studies who in 1982 were convicted of publishing a mapping of classified military facilities in Norway (Gleditsch & Wilkes, 1981a, 1981b). Their argument and motivation for doing so was in essence that openness prevents misunderstandings and thereby conflict. They were convicted in a Norwegian court of crimes against national security. Owen Wilkes (a citizen of New Zealand) was at the time both affiliated with the Peace Research Institute Oslo (PRIO) and the Stockholm International Peace Research Institute (SIPRI). He was also convicted in a Swedish court on June 7, 1982, of the same type of crime after mapping military installations on the east coast of Sweden (mainly radio and radar installations) during a summer vacation. The case led to the coining of the expression the “puzzle doctrine” (In Norwegian: puslespilldoktrinen) after the verdict in the Norwegian High Court. Although the pieces of the puzzle may be available to some degree in the public domain it is still illegal to try to put the pieces of the puzzle together in order to see the whole view (Norges offentlige utredninger, 2003, p. 19). The legal puzzle doctrine is essentially the same as aggregated information in intelligence terms (Försvarsmakten, 2021). Although one piece of information may have been only restricted/confidential or even unclassified in itself, it will often be upgraded to a higher level of confidentiality when paired with other pieces of information. Especially if those pieces are chosen to be paired together exactly because they can offer insight into what is meant not to be disclosed.

The present study

The big question remains “why?” How can a group of military enthusiasts and supporters of the Armed Forces with no malicious intent become a threat to national security? The investigation by the Swedish Security Services has naturally focused on determining culpability for the actions and the reduction of potential loss of sensitive information, not on understanding the phenomenon and its mechanisms. This study tries to fill this gap by providing an empirical examination of this new type of criminality not previously studied. Specifically, the aim was to determine what factors influenced the individuals in the network to cross ethical and legal boundaries.

Method

Design

Because of the uniqueness of the case, a case study methodology was chosen to allow an in-depth, multi-faceted exploration of a complex and yet unexplored issue. The study is an example of an intrinsic case study, where the uniqueness of the phenomenon is that it resembles a spy case or insider threat but with a seemingly total absence of malicious intent.

Data

The data were open-source information from public courts and archives. Most comprised documents from the Swedish public courts submitted by the Swedish Security Services and the Swedish National Police Authority. Overall, more than 8,000 pages of documents related to the investigations were included. Of this, more than 95 hours/2,300 pages were interrogation transcripts. The material also included pleas submitted by the prosecuted themselves in their own defense as well as individual examinations by the Swedish Prison and Probation Service. When previous or continued criminal activity was found to have occurred, material from those court cases was added. It was augmented by archive material such as military service records. Data consisted only of public documents and open data available to anyone. Although the individuals were part of a network, those who have been prosecuted have been so in their respective county of residence over a period of several years, resulting in data from new cases being added over time.

Analysis

Using the extensive data, a social network analysis (SNA) was conducted building on Sparrow’s (1991) model of SNA as a tool for law enforcement. The method has often been used to compile a vast amount of data into a visual representation that can be used to gain significant insights into the dynamics of the criminal network (For a good overview, see e.g., Burcher & Whelan, 2018). Starting with a blank page, individuals and their presumed connections to others (often referred to as entities and relationships in an SNA) were added step by step. When new data confirmed connections and the network became more comprehensive, it was possible to identify critical nodes and assign labels (e.g., founder, leader, regular user). It was also possible to delineate “fuzzy boundaries” and set a limit of the network. Since the purpose of the analysis was to be scientifically explanatory and not criminally investigative, this was done primarily by excluding entities that did not offer any insight into the aim of the study for both practical and ethical reasons. Eventually, it was also possible to gain insights into the modus operandi of the network. Using the chosen method, data could have been added almost indefinitely. When new data were added without contributing anything substantive to the SNA it was decided that saturation had finally been reached, and it was possible to summarize the results and draw conclusions. These are described further in the results section. An author’s translation was performed of relevant quotes.

Ethical issues

The project and its procedures were approved by the Swedish ethical review authority.

Publication of identities is not uncommon in scientific research on major criminal cases such as spies and insider threats (e.g., Smith, 2022; Widén, 2006; Wiebes, 2008). Several examples are mentioned in the introduction. The identities of the individuals in the present case are also easily accessible to anyone reading the verdicts or other public records. Despite this, measures were taken to anonymize the individuals as far as possible. The primary reason for this is a concern for personal integrity. Since the aim and design of the study were chosen to focus primarily on understanding the phenomenon, it made knowledge about the individuals important but disclosure of their exact identities irrelevant. Descriptions about the individuals have as far as possible been made on an aggregated level and they are referred to primarily by their specific function within the network.

The study has also been conducted with due respect to the sensitivity of the military facilities that have been the focus of their quests. It is the phenomenon that the network represents that is relevant, not the classified military facilities the individuals have mapped. In this regard, too specific information about exactly what they have retrieved and compiled has been deliberately avoided.

Results

The forum

The LS-tornet forum was created in 2011 and remained active until November of 2017 after which it was shut down after a raid by the Security Services. ⁴ The forum has had several predecessors. Perhaps the first organized discussion of classified military facilities was on the open forum Flashback.net where on June 16, 2005, the first forum thread about the existence of a Swedish “Riksbunker” was started. A larger thread was subsequently started on July 31, 2008, which has to date more than 8,000 entries and has been read over 3.6 million times. The discussions were heavily inspired by the discussion surrounding the West German “Regierungsbunker” in Marienthal which had been decommissioned in 1997 (Diester, 2009). More dedicated forums were Fort & Bunker Webforum and FortForum.se. Although the predecessors had a primarily historical focus, many reports users being curious about and “fishing” for information regarding active facilities. This has been reported as a reason they were discontinued, as well as a reason that LS-tornet was founded. Several of the users had been active in some or all of the previous forums.

LS-tornet was founded by a retired man living in a rural part of southern Sweden. The man had no prior military service due to an exemption from the draft but exhibited a lifelong interest in military matters and facilities. The forum was named after a specific type of Air Force tower that was used for optical observation of approaching aircraft during the early Cold War era. Some years prior to starting the forum the man had bought such a 12 m high decommissioned tower that he transported to and erected on his property, where he had a lot of military surplus equipment. Citing health reasons, he turned the forum over to a new owner on May 9, 2014.

The new owner was a middle-aged man who had performed his conscript service in an underground radar center for the Air Force. As owner and administrator, he and a friend (with no military experience) serving as global moderator were the two primary facilitators of the forum until its termination. Both of them were well educated, were married with children, and lived orderly lives with jobs in the IT industry during the time they managed the forum. The new owner created two closed subforums: the White Room on May 23, 2015 and the Silver Room on September 13, 2015. These subforums served as the main hub for the illegal collection of classified information. In a private message to a prospective user, they were described by the owner himself as:

The White Room (where we discuss things that should not see the light of day) as well as The Silver Room (where we more systematically map the country).

At the time of the raid the forum had a total of 237 users with 22 and 25 for the respective closed subforums.⁵ In a pinned introduction post to the first of them the owner stated that it was:

[D]ifficult (not to say slightly illegal) to discuss anything about facilities that are in any way active or that can in any way provide information and understanding of other active facilities.

He went on to encourage systematic documentation but stressed that information shared in the forum should stay there. It was notable that the welcoming message explicitly recognized the illegality of the actions but still encouraged them within the closed confines of the subforum.

Regarding the second goal to systematically map the country, another user (encouraged but on his own initiative) created an interactive map in the form of a Kmz-file. The file is an add-on to Google Earth that let the user index and view large amounts of information graphically. The map had several layers for different kinds of installations, such as “fortified facilities.” Users of the subforums could add information and documentation about the facilities that they already possessed as well as what they acquired through fieldwork. There were suggestions in private messages in January of 2016 of a Golden room for access to the map application, but no known active measures were executed in this regard.

The individuals

The primary part of the network consisted of 25 individuals. Not all individuals in the network were part of the web forum. There were foreground figures that were older and not that tech-savvy that never registered on the forum (or were never invited to do so) but despite this they had an active role. There were also some who had registered on the forum, even admitted to the subforums, but abstained from participating in the mapping of installations. In addition, there were those who had been admitted to the subforums but once they gained insight into the function and the content actively asked to be removed. One user voiced concern that others had brought tools and actively cut padlocks to gain entry. His profile was deleted on March 27, 2016. Another user was added to The White Room on June 8, 2015, but wrote to the owner on September 11 of the same year and asked to be removed:

Please remove my access to The White Room section. Even though it is a closed part of the forum, it is now overflowing with pictures taken at active SOs (restricted areas, author’s note) and also by people who have been inside the fences of protected objects and photographed and that is not something I personally think is right, so I content myself with reading the open part of the forum.

All of the involved individuals were men. Most of them had done their basic conscript service with mostly mediocre grades (exceptions exist, elaborated below). In contrast, the most obvious common denominator was an extensive military interest, where several of them explicitly described themselves as “military over-interested persons.” This interest manifested itself in several ways. Many of the individuals had previously been or were at the time volunteers in auxiliary military organizations, most frequently the Voluntary Radio Organization (FRO). Some showed signs of collecting military surplus equipment, ranging from prohibition signs to (as mentioned) Air Force observation towers. A few of the users were published authors, or had expressed such intentions, exhibiting extensive knowledge on different aspects of military history.

Most of the users had built online personas for their forum activities. Only a few used their real names. In this regard they utilized pseudonyms that were often consistent over time and between different forums, building up online legends in the discussions. The long-term use of pseudonyms is an example of the secrecy paradox when users want to reveal enough information to build credibility for their online personas but still conceal enough information so that their identity is not exposed.

Some individuals showed signs of “stolen valor” in their legends. The term is primarily used in veteran organizations to describe the exaggeration of military merits to gain the acceptance and admiration of others, or to be seen as an authority in certain areas (Burkett & Whitley, 1998). For some of the individuals, there was a clear discrepancy between their military accomplishments as they presented themselves and available official military service records, in a way that their personal story was more grandiose than the documentation supports. Granted, historical records do not always give the complete picture. Nonetheless, some individual legends and historical records differed in such a way that was difficult to fully explain with any extra documentation.

Several individuals in the network had previous criminal records or had committed other offenses during the legal aftermath of the present case. The most obvious example was the forum owner, where the Swedish Security Service found not only pictures of classified military facilities but also child pornography on his computer. The pornographic material was in the form of pictures and movies of minors, as well as chat conversations and traces of electronic payments to foreign pay sites offering online web shows in that area. The relevant parts of the material were turned over by the Swedish Security Service to the regular Swedish Police Authority and the forum owner was detained, prosecuted and convicted in a separate charge for possession of child pornography.⁶ The most criminally burdened in the network was the individual who created the interactive map. He did his military conscript service as a cook at an infantry regiment in the late 1990s achieving low grades, the minimum required to pass. During the following years after being discharged he developed a substance abuse problem and was arrested and convicted on several occasions. Mainly for possession and use of narcotics as well as theft. He was sentenced to both participation in a treatment program and subsequently to a jail sentence for repeated offenses of the same nature.

For the crimes related to the present case, he received a two-year jail sentence. During the period between being initially arrested by the Security Services and prosecuted to when the prison verdict was finally affirmed by the Court of Appeal, his criminal activity spiraled with theft from parcel lockers used for distribution of packages to customers. The new criminality, although completely unrelated, had similarities to the present case in regard to systematicity, collective effort and web forum coordination. The items he stole had no mentionable monetary value (nasal spray from a web-pharmacy, a pair of training tights for women size XS, a few power bars …). The motivation rather seemed to have been to defeat the system and gain social admiration online from like-minded individuals. In the individual assessment from the Swedish Prison and Probation Service to the court regarding the subsequent criminality they state that:

[Name] downplay the events to some extent when he states that he was only curious about things that you are not allowed to be curious about in Sweden.

He was eventually also convicted for theft, preparation to commit theft, breach of data secrecy, narcotics crimes, gross unlawful driving, drunken driving, speeding and traffic offenses.

A third individual was also charged with subsequent criminal offenses such as abuse and violation of a restraining order, following repeated contacts with an expert witness from the Armed Forces and his wife using private communication channels. There were also other members of the network who had been involved in minor previous criminal activities such as assault, weapons charges and crimes in connection with right-wing extremist organizations. Overall, these other criminal charges had no direct connection to the present case of mapping military infrastructure. They nonetheless indicate that for some of the individuals their deficiency in ethical decision-making was not limited to the activities in the forum.

The network

The individuals and their activities can be summarized in a schematic figure that visualizes their position and respective roles in the network (Figure 1). The figure consists of three separate categories, with two subcategories, further described below.

Figure 1. Schematic picture of the groupings on the forum and their function, not exact as to the number of individuals in all categories.

Leaders

The network, and specifically the activity in the subforums, were led primarily by two individuals: the owner and the global moderator. They not only functioned as moderators in the classical sense of a discussion forum but also led and coordinated the efforts of the regular users, trying to attain a complete mapping of the country to see the larger picture. Hence, they were given the label leaders. They had been preceded by the founder who remained active on the forum for some time after relinquishing control but subsequently asked to be removed.

These individuals distinguished themselves in that they did not see anything wrong in their actions. They were on the contrary loud-voiced critics of the Swedish Security Services, the Swedish Armed Forces and the Swedish Prosecution Authority. The criticism exists on several levels. The global administrator openly questioned the competence of the interrogators from the Security Services with statements like “You don’t have a clue what you’re doing.” He criticized them for pushing an agenda and completing an already determined “press release” more than investigating. His interrogations were stopped and had to be postponed several times due to heated exchanges with the staff from the Security Services. Similarly, during his interrogations, the founder of the forum repeatedly questioned the competence of the operators from the police tactical unit that arrested him and went further and explicitly voiced contempt when one of the interrogators from the Security Services did not have knowledge about a specific book on military history:

This is scary that I have an investigator who has not received background knowledge. That’s the kind of thing I despise.

The individuals categorized as leaders generally displayed a superior attitude indicating an enhanced self-image. In a way, a superior attitude can be understandable: those who exhibit a specific interest over a period of several years will develop a high level of knowledge in that area, even greater than most professionals. However, the superior attitude was not limited to specific details but took interpretive precedence over the overall actions and assessments of the authorities.

Their overall argument was essentially a reverse of the puzzle doctrine: since the pieces collected were to some extent accessible and possible to find they could not have been that secret (the individuals evidently found them) and consequently their actions cannot be seen as illegal. There was also a clear transferal of guilt and attribution of blame: since the Armed Forces have sometimes done a less than satisfactory job in protecting the integrity of their facilities it is their own fault that they have been disclosed and that the network of individuals has been made scapegoats for the government’s incompetence. It is noticeable that their reasoning indicates a full moral disengagement (Bandura, 1986) since it focuses heavily on the organization’s inability to fully protect their facilities and a fatalistic minimization of possible damage (the Russians already know everything) but does not include the individuals own intentions and targeted efforts of actively seeking the same information.

A small subgroup of this category are some senior members that are closer to the forum leaders. They can be distinguished from the regular users described below primarily in that they shared the same perception of the events as the main forum leaders.

Regular users

Most of the users are best described as just regular users. Describing them as regular refers mainly to their function in the network rather than comparing them to the general population. This category includes most of the individuals with mediocre military merits as well as the ones with previous criminal activities. Their expressed interest has to a greater extent been in specific objects (e.g., types of antennas, armored doors, towers, signs) than to try and see a larger picture, though these are not mutually exclusive. They have expressed a high level of trust in both the leaders as well as the professionals with a higher level of knowledge, as exemplified by one of them in a discussion in the subforums about legality:

This is my opinion: This is a closed forum with an admin that I find credible and trustworthy. I listen, and without any reservations, do as administrator [name] decides in all matters around the forum.

Their participation is largely affected by the social influence of being specially selected and in the contextual frame of perceived safety in a closed forum. As illustrated by the individual responsible for the interactive map:

Yes, it was a bit exciting that I would be allowed to join there. It was the first time in my life that I had been allowed to participate in something secret. Of course—it was a bit of fun.

The same user describes the feeling of exclusive knowledge as a major motivator for creating the map. He also describes a powerful feeling associated with possessing knowledge that the average person does not have. The regular users have often been somewhat apologetic, often showing discontent that their actions led them to an uncomfortable situation but not showing any deeper remorse or introspective reasoning.

Professionals

A few individuals in the network had professional military backgrounds, either from prior service or were actively serving at the time the forum was active. These individuals are an exception to the mediocre military achievements described earlier. In contrast, they had excellent grades in their service records and held coveted positions in the military organization. They participated in the discussion in the same way as the regular users described in the previous section, but they are distinguished primarily by implicitly adding legitimacy just by being present in the context. Their primary contribution was through who they were rather than what they said or wrote. Since they were affiliated with the organization that was the object of interest, they should in the eyes of the other members have better insight into both the facilities in question but primarily just how far into the forbidden it was safe to wander. In other words: It is OK to break the rules of the parents as long as the babysitter is with you! This category is the only one where rare signs of deep remorse are exhibited. As exemplified by one previous Navy officer whose last position was with the Swedish national authority for signals intelligence, the National Defence Radio Establishment (FRA) while talking to the Security Services during his interrogation:

I think it is so incredibly embarrassing, I have been in the military. I’m still a reserve officer, it’s so incredibly embarrassing that I’ve been dragged into this. To sit here now. So I regret it, regret a lot. I had no [bad] intention whatsoever, I knew, I was so insanely stupid and naïve to go along at all.

Explanations in this category sometimes referred to being “naïve.” The same individual cited above mentioned the phrase several times during his interrogations. The explanation is somewhat contradictory. Naïve usually refers to a lack of experience, wisdom, or judgment. The professionals generally did not show any absence of those qualities. On the contrary, their interest and actions regarding specific facilities (unavailable even to them in their professional role) seem to have been connected to an extremely high level of knowledge and deep awareness of exactly how unsuitable such actions were. Thus, they do not primarily exhibit naïveté regarding the illegality of their actions, but rather an inability or unwillingness to act on their better judgment in the specific context. However, they did seem to have been unaware of how their presence in the subforums affected others. Consequently, they indeed displayed naïveté but not necessarily for the reasons they thought.

A small subgroup of this category were the semiprofessionals that showed signs of “stolen valor.” These were individuals that did not have the same professional background but where their implied legends have affected regular users in a similar way. Interestingly, there are signs that these exaggerations should have at least been suspected in some cases by the other users. For example, in interrogations they sometimes added the prefix “claims” when describing some of the proposed accomplishments, acknowledging that those claims had been made, but not necessarily vouching for their accuracy.

Modus operandi

Planning & direction

Admission to the closed subforums came about by personal knowledge, recommendation, or head-hunting. As instructed by the forum leader in the pinned welcoming message to the first closed subforum “Are there more individuals out there who reasons as above, talk to me and talk to them a little carefully.” Following initial contact an organized verification process by text message or a telephone call were performed to establish the real persons behind the online personas, their level of knowledge and focus of interest. The other users did not always know the true identities of the others’ online personas, but the leaders did.

The closed subforums and their organized admission process had two observable effects. First, establishing a false sense of security that it was okay to discuss, divulge and distribute sensitive (and even classified) information among the selected few of the subforum. One of the professionals described this effect:

I think I got the idea that this was going to be this rock solid place where no one else got in. I think I got that impression./…/And then in this situation I think I realized that this was a closed forum, nobody came in here and so. So that was probably how I reasoned.

Secondly, making individuals value membership highly according to a scarcity principle (Cialdini, 2021), influencing them to contribute information because they were among the selected few. The global moderator cautioned explicitly about nonparticipation and urged individuals who had not yet contributed to do so:

To have passive members sitting on the sidelines and watching is not the point of TWR (The White Room, authors note). Here we go.

During the time the subforums were active, there were discussions about removing a number of “read-only” users that were friends of the founder but who were only consuming information without contributing themselves. One of the users in retrospect described himself as a “useful idiot” to the interrogators, and others as “twisted” and “fanatical,” explaining that he was influenced to contribute more than he had planned to.

Interestingly, there is no indication that the leaders had any of the observed behavior-reinforcing effects in mind when they created the subforums and the structured admission process. Their primary reason seems only to have been to protect themselves and others against negative effects due to awareness of the unlawfulness of their actions.

Collection

The mapping was systematic with centralized control. This can be seen in several ways. On September 7, 2015, the global moderator posted specific instructions for naming inside The White Room in order to index information and forum threads according to geographical area and function, as well as to include a map link. Users were also recruited and assigned responsibilities with regard to their specific expertise on certain topics and/or their residence in the country. In one message to a historian residing in the southern part of Sweden the global moderator asked him specifically to take geographical responsibility and stressed that “the forum needs someone who can take charge of setting up [the specific geographical area] info in a structured way.” When receiving a positive response, the global moderator replied with encouragement:

Time is in short supply for all of us, but we who are here can put the puzzle together.

In addition, recruitment was carried out with specific objects in mind. For example, the forum owner actively contacted and invited one of the regular users who described himself as a “useful idiot,” who he knew from a previous forum. The individual was residing in the northern part of Sweden and had specific knowledge about communications. His focus in the mapping was the Defense Telecommunications Network (FTN). He recced and documented such nodes for the system in his geographical area. The information was then posted in a thread of the closed subforum (indexed “FTN” and the geographical area). His posts included coordinates and pictures detailing the overground bunker with the node and the communications tower with its equipment. He also added specific information about the status of the facilities (changes made from previous visits) and details such as the types of directional antennas and their exact compass bearing, connecting to other communication nodes and facilities. In the interrogations he said that such detailed information was pleasing to the others in the forum.

Analysis

There were several attempts at using maps as a tool to visualize information in order to facilitate interpretation and conclusions. Despite this, the network was not as coordinated in analyzing the information as in collecting it. Personal reward appears to have been more central than to reach any sort of collective conclusion or end state. One user who asked to be removed described the process more as “intelligence trading” between individuals; giving one’s own pieces of the puzzle to gain pieces of equal importance. This indicates the presence of a central secrecy paradox: sharing enough information to gain new insights but still withholding sufficient to maintain uniqueness. It is important to understand that the presence of a paradox means that several motivational factors are naturally true at the same time; both the will to contribute to a collective picture that would be unattainable alone, as well as a reluctance to be completely transparent since knowledge is related to social status. It also means that in such a setting the collection of information has the potential to continue indefinitely since it has no definitive end state.

Discussion

The perfect storm

As to the big question “why?” none of the identified factors are sufficient to explain the phenomenon by themselves. The main conclusion is that the present case seems to have been an effect of all concerned factors. Individual risk factors combined with an obsessive military interest, the social interaction between the groups in the network and the context of the forum created a “perfect storm”: an unusual combination of factors that produced an extremely bad result, that would not have occurred (at least not nearly to the same extent) if any of the factors had been taken away from the equation.

The interest seems to have expanded beyond over-interest into the obsessive. As noted in the introduction, being interested, even over-interested, is normally something positive. It is usually when that interest becomes obsessive that it takes on an unhealthy direction. Being interested in the military history of the Cold War could be described as something positive and common among many. In most cases, it can be a resource for the defense community. However, not many choose to buy, transport and erect a 12 m high Air Force observation tower on their property, especially if they have no professional connection to that part of the organization or not even any form of military background. This specific example is not illegal and acting it out does not hurt anybody. It nonetheless indicates an obsessive form of interest that goes beyond being over-interested. The same applies to the interest in military facilities. Being curious about military facilities is natural, even human. But crossing the line to actively search for such facilities, trespassing and documenting them in a structured and organized way as well as seeking others who do the same over a long period reveals an interest that has turned obsessive (and illegal).

Several of the identified individual factors can enable someone to exercise an interest in a destructive way. An enhanced self-image has previously been identified as a risk factor for unethical behavior (Wilder, 2017). Additionally, displaying mediocre military grades from prior military service or the tendency to exaggerate military merits could indicate a compensatory behavior of wanting to present oneself in a better light. The presence of individual risk factors is also indicated by the fact that for some their criminal activities were not limited to the present case. While we can all make bad decisions in life, individuals with unbalanced risk factors in their personality tend to make them more often, and thus are more likely to cross ethical limits. This has sometimes been referred to as “ethical flexibility” (Schoenherr et al., 2022), where individuals allow the situation to dictate their ethics instead of letting their personal beliefs dictate their actions. All categories in the present study display the risk factor of ethical flexibility in various ways: the regular users and professionals, who allowed curiosity to overshadow their better judgment, and the forum leaders, who displayed complete moral disengagement.

Moral disengagement goes beyond ethical flexibility and refers to when an individual convinces him/herself that ethical standards do not apply to them within a particular situation or context (Bandura, 1986). The reasoning of the leaders in the present case contains several key mechanisms for moral disengagement. The mapping was a well-meant documentation (moral justification) for future historical purposes (euphemistic labeling), it was conducted in an environment where everybody was interdependently cooperating (displacement of responsibility) in an area where the Armed Forces had not done enough to protect their facilities (attribution of blame), and besides, the Russians already know everything so it can’t hurt anybody, right!? (distortion of consequences). Thus, the leaders made themselves victims of the circumstances rather than responsible for their actions.

The convenience of such a position is easy to understand. The appeal lies in that the individuals are in some ways technically correct. For example, the authorities have indeed sometimes shown a less than stellar performance in safeguarding their classified facilities. Sufficient protection of them to avoid detection would have been good. But it would arguably have been even better if the individuals had refrained from intentionally breaking the law to systematically search for these facilities in the first place.

On the group level, a strong interdependency can be seen between the different categories in the network: The forum leaders were dependent on the regular users for labor; the regular users were dependent on the professionals for legitimacy; the professionals were dependent on the forum leaders for enticement, and so on. Each by themselves would have been less likely (although not unlikely) to display “ethical flexibility” in a way leading to illegal actions. Evidently, some had already done so. Together they formed what can be best described as a toxic social environment, acting in a destructive collective action making many cross ethical and legal limits that they would not have dared to cross alone.

Regarding context, the forum, and the structured admission to the closed subforums created both a false sense of security and influenced users to share more than they probably would in any other context in order to remain on the inside. Such a context can indeed present an unhealthy environment that can cause or aggravate adverse effects. However, the fact some of the other previous forums had closed subforums as well but did not degenerate in the same way indicates that they can just as well present a healthy environment where clear limits from moderators and positive peer pressure from others make users less likely to cross ethical and legal limits.

Foreign power—reality or paranoia?

No influence of foreign intelligence actors was reported in the investigations by the Swedish Security Services. Additionally, the present study has found no indication of any intent to aid a foreign power with any of the individuals. Still, these types of individuals, groups and forums are highly valued targets for foreign intelligence services. As one of the prosecutors pointed out in a radio interview: “it would almost be misconduct by a foreign power not to enter a forum like this” (Ek & Bergqvist, 2021).

Consequently, a big question that will likely remain is whether foreign actors were in any way indirectly involved. Recruitment in espionage is often done with minimal possible exposure for the intelligence personnel, using coercion to make the target do the job under the belief that he is doing the right thing and of his own free will (Wilder, 2017). It is always theoretically possible that someone in the network was unwittingly coerced by a foreign intelligence service into doing their spying for them, with the results to be collected later.

The new insider threat and future research

The present case indeed presents a new type of security threat. It also shows that auxiliary military organizations or interest groups with only limited access to sensitive information can be problematic in the same way as regular insider threats. In some respects, they can be even more problematic since they have enough insight to be potentially dangerous but lack the organizational control mechanisms available inside a regular military organization.

The “perfect storm” of factors correlates with previous research regarding insider threats and spies. There is no unique spy personality, but those who cross ethical and legal limits are usually individuals with a problematic mix of personality features combined with a personal crisis and an opportunity (Wilder, 2017, p. 20). Similarly, reasons for insiders to act maliciously or complacently do not have a single explanation; their actions are usually due to the cumulative effect of personal, social and contextual factors (Shaw & Sellers, 2015). Still, not all individuals in the current network displayed similar personality factors. In the same way, not all mentioned forums turned toxic and facilitated illegal actions. Consequently, three recommended main areas for future research are:

1. Individual characteristics. Identified psychological characteristics such as enhanced self-image, flexible ethics and the need for social validation can be parts of a pathological personality predisposed to unethical and illegal actions. Exactly which factors and how they contribute to unethical or illegal behavior is however still relatively unexplored.

2. Organizational/cultural factors. The present case is unique and (despite identified similarities with some forms of insider threats) represents a national phenomenon in the Swedish context. Similar forums and groups in other countries might have different characteristics and pose other difficulties.

3. Security threats. Networks of individuals (online or offline) with a common interest in defense issues will always be valuable targets for foreign intelligence services. Identifying both vulnerabilities and threats could help prevent or mitigate future incidents.

There are also some lessons to be learned for military organizations. While we cannot expect employees to be responsible for every way that others can misinterpret them, it is important to be aware that sometimes only their presence in the wrong contexts can lend both their own and the organization’s credibility to a wrongful cause. From a different perspective, the present case also indicates that the system is working. Most of the individuals involved in the network were historically not that successful in any parts of the military establishment despite possessing a military interest greater than average, indicating that the mediocre grades were probably given for good reasons and that some filters work. Had they been able to reach positions with critical insight, it is possible that the same individual vulnerabilities could have caused greater damage to the organization.

Notes

1 At the time the present study was finalized, not all court cases had been concluded.

2 The saying is more spoken code than written law. Origin disputed.

3 The officer was finally acquitted in the district court in Karlskrona on June 2, 2021. It was found that the security instructions regarding the exact handling of visitors had not been sufficiently clear at the time, and that he had taken necessary steps to maintain security (signing the visitors’ log, escorting during the stay and only visiting non-essential areas of the installation). No known inquiry has been conducted about the children’s party.

4 Main dates of the forum. Earlier and later versions of the webpage have existed.

5 This was the number at the time the forum leader performed a backup performed on 18th October 2017, the month before the raid by the Security Services. The exact number of users in the sub-forums has varied over time.

6 The individual was initially sentenced for more serious offenses (photographic activity constituting invasion of privacy, conspiracy to commit child rape, attempt of gross exploitation of children for sexual posing and two separate accounts of child pornography) in the District Court but was later acquitted of all charges but the last two in the Court of Appeal. He received a suspended sentence and enforced participation in a treatment program as a result.