Minister calls for digital recovery plan to replace outdated systems

Denmark’s digital vulnerabilities are serious enough to require a recovery plan, Minister for Societal Security and Emergency Preparedness Lisbeth Bech-Nielsen said in an interview with Politiken, DR reports. She said several outdated IT systems should be replaced.

The announcement follows a hacker gaining access to the names, addresses and CPR numbers of about 8.8 million people. The Danish land-registration system, Tinglysningen, and the main contractor for the Fehmarn link have also been hit by digital attacks.

Bech-Nielsen said parts of Denmark’s digital infrastructure rely on old systems across many critical areas. She declined to identify them, saying that doing so could itself create a security risk.

She compared the problem to a house that has not been maintained: eventually, not only the windows but potentially the foundations may need replacing, she told Politiken.

Warnings about the state’s IT preparedness are not new. In a 2022 report, Rigsrevisionen found that authorities had not established satisfactory IT preparedness for any of 13 selected critical systems. A follow-up review the next year found inadequate preparedness for seven of 12 other systems. The remaining systems were mostly adequately prepared, but had some shortcomings.

Following the 2023 review, the Public Accounts Committee criticised the lack of satisfactory preparedness for seven systems. Rigsrevisionen warned that inadequate contingency plans could prevent the state from maintaining critical services, or significantly disrupt them, during major IT outages or data losses. The committee also cited hacker attacks and physical damage as events that could have serious consequences.