Using classic counterespionage techniques, the Swiss FIS attempt to identify Swiss bank insiders Credit: REUTERS/Arnd Wiegmann In late April German authorities arrested a Swiss national and charged him with espionage, according to German reports. The individual, operating on behalf of Swiss Federal Intelligence Service (FIS), had penetrated the North Rhine-Westphalia (NRW) tax authority. He had, in a word, recruited a “mole” with the NRW government.In a brief announcement, the German Attorney General announced the arrest of a 54-year-old Swiss citizen, Daniel M. in Frankfurt Am Main. The Attorney General indicated the individual had been working on behalf of the intelligence service of a foreign power since 2012.Why would the Swiss wish to penetrate a German state’s tax authority? The Swiss FIS engaged in classic counterespionage activity, in order to identify an insider breaking trust, you recruit an insider from within the entity that has penetrated the organization which you are protecting, the Swiss banks.The Swiss banks have seen a continuous stream of their non-public banking information being provided by trusted insiders to NRW tax authorities (and other German tax entities). According to Blick, a Swiss publication, since 2006 German tax authorities have paid millions to purchase Swiss bank data CDs (compact discs) containing information on German tax evaders. The German state of NRW has been particularly active in the acquisition of Swiss bank data. In 2012, the data from Swiss bank, UBS, identified accounts owned by German nationals whose combined assets totaled 2.9 billion euros. German publication, The Local, quotes Swiss Minister of Parliament, Corina Eichenberger (vice president of the parliamentary committee supervising the FIS) as saying, “counterespionage is part of the FIS remit.” She noted how in 2012, the Swiss Attorney General issued arrest warrants for three NRW tax investigators for violation of Swiss law, engaging in economic espionage. These arrest warrants were based on the information garnered by the individual arrested by the Germans. Is NRW the only entity paying for Swiss bank data? Not according to Russian media site, Sputnik News, who notes that in 2015, the Dusseldorf finance ministry had spent 5 million euros to purchase a CD containing identifying information on 70 billion euros worth of transactions which evaded German taxation. Sputnik News continued as to how more than 120,000 Germans have been charged with tax evasion because of the successful efforts by the various German tax authorities in acquiring Swiss bank information. The Swiss, demonstrating that a good defense, requires a strong offense, decided the risk of discovery by the Germans of the Swiss espionage activity was worth the gain, identifying who was providing inside bank information to the German tax authorities.What is the German perspective? The NRW Finance Minister, Norbert Walter-Borjans described the German perspective best when speaking to Tagesschua, a German language publication, “The scandal reaches new proportions when spies sign up informers in the finance administration, in order to spy on successful NRW tax investigators and play into the hands of people who make billions in profit at the expense of society. It’s hard to believe that such a spy thriller took place not on the screen but on our own doorstep.”That is until at least 2018, when this type of spy-vs-spy activity surrounding Swiss bank account ownership and the German tax authorities will no longer be necessary. Blick pointed out how the Swiss parliament had authorized the exchange of this type of information to begin in 2018, rendering the German activity moot, as the information will be shared automatically between the Switzerland and the German tax authorities.In conclusion, we have cases of trusted insiders on both sides of the equation breaking trust with their employers and assisting foreign entities in advancing the entity’s agenda. In the case of the Swiss, they clearly believe the NFW tax investigators are violating Swiss laws by illegally Swiss bank account data. If they successfully identify the individuals, they may be able to identify their sources within the Swiss banks.Germany, by neutralizing this Swiss national, who had recruited sources within the NRW Finance Ministry, have successfully neutralized the Swiss FIS counterintelligence efforts. The damage assessment on the Swiss activities, may indicate the current crop of tax investigators and some/all of their sources may have been identified. This does not preclude a new cadre of investigators being launched into Switzerland to rejuvenate the clandestine collection effort. Related content news analysis China’s MSS using LinkedIn against the U.S. The head of the U.S. National Counterintelligence and Security Center says China's MSS is using social networks, specifically LinkedIn, to target, access, and recruit U.S. sources. By Christopher Burgess Aug 31, 2018 4 mins Social Engineering Cybercrime Security news analysis Tesla insider with expired NDA spills the tech beans A former Tesla engineer with an expired non-disclosure agreement (NDA) shared inside technical information on an obscure forum, which was quickly shared across multiple social media platforms. By Christopher Burgess Aug 30, 2018 3 mins Risk Management Security news analysis Horizon Air tragedy highlights airline insider threat vulnerability The ease at which a Horizon Air employee was able to steal and crash a Bombardier Q400 turboprop will likely prompt airlines to develop an insider threat mitigation strategy to close this vulnerability. By Christopher Burgess Aug 13, 2018 4 mins Security news analysis How did the TimeHop data breach happen? Compromise of an employee's credentials, lack of multi-factor authentication, and weak insider threat analysis all played a factor in the recent TimeHop data breach in which 21 million user accounts were compromised. By Christopher Burgess Aug 10, 2018 4 mins DLP Software Analytics Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe