Failed security clearance – and still in the systems

DN reports that an official close to the Prime Minister's security advisor failed the security clearance but retained access cards, secret IT systems, and entry to Rosenbad. The review contrasts this with the Security Protection Act: clearance, access, and employment are three distinct matters.

Summary: On October 14, 2026, Dagens Nyheter reported that an official at the Prime Minister's Office, working closely with the Prime Minister's national security advisor, failed their security clearance. According to DN, the individual could still access security-classified information, use secret IT systems, and move within the Prime Minister's corridor at Rosenbad. DN states that the issues arose in the spring of 2026, and the notification that the clearance was no longer approved came in mid-July. The individual was placed on leave pending a permanent solution but retained their access card and entered the premises several times. The Government Offices declined to comment. The law does not require a comment. The Security Protection Act (2018:585) stipulates that anyone participating in security-sensitive activities must be vetted before participation begins, that the vetting must be followed up, and that the assessment must be reconsidered when there is reason to do so. A person who can no longer be assumed to be loyal and reliable should not participate. The law does not specify a timeline for when cards and access should be revoked. DN's information highlights this gap.

What this investigation does not claim. DN's article is journalism, not a supervisory report or a verdict. The individual is not named here and has not been convicted of any crime. A failed decision in a security clearance is not proof of disloyalty; it is the employer's assessment that the person can no longer be assumed to be loyal and reliable. Omni reports that the previously approved clearance was withdrawn in March, while DN dates the notification to mid-July. The open information is therefore not consistent regarding the date. What both report is that access remained after the individual was no longer approved. The person was later found deceased. DN states it was a suicide and that a letter was left to the newspaper's journalists. This text does not delve into that. It concerns the access. The Government Offices' refusal to comment is not the same as an admission.

What DN actually reports

The official worked at the Prime Minister's Office, in an area close to the Prime Minister's national security advisor. It is one of the places where security-classified information and access to the Prime Minister's corridor are part of the job. DN writes that the individual was informed in mid-July that they were no longer approved and thus no longer deemed suitable to participate in the security-sensitive activities. The consequence was a leave of absence pending a permanent solution. Access cards, technical equipment, and access to the Government Offices' security-sensitive IT systems remained. According to DN, the individual entered the Government Offices several times after the notification.

In a letter left to DN's journalists, the individual writes, according to the newspaper: "I have done my part and informed." The letter criticizes the Government Offices' security organization and the incorrect assessment, while access remained. According to Omni's account, DN had not been in contact with the official previously. After the death, a report was made to the Swedish Work Environment Authority, according to DN, based on the Government Offices' assessment that the circumstances surrounding the security clearance could have been significant for the incident. The authority does not wish to comment on the matter.

What the law requires – and what it does not time

Chapter 3, Section 1 of the Security Protection Act: anyone who, through employment or otherwise, is to participate in security-sensitive activities must be security vetted. Ministers and members of parliament are exempt. An official at the Prime Minister's Office is not. Section 2 states the purpose: to determine whether the person can be assumed to be loyal to the interests the law protects and otherwise reliable from a security perspective, and to consider circumstances that may be assumed to entail vulnerabilities. Section 3: the vetting must be done before participation begins and followed up during the time participation continues. Section 4: the assessment is made by the person who decides on the employment or participation, and a previous assessment must be reconsidered if there is reason.

Säkerhetspolisen describes the same procedure. The register check is part of the basis in security classes 1–3. It is not Säkerhetspolisen that approves the person. It is the operator, here the Government Offices, that makes the final assessment. Säkerhetspolisen also states that all steps must be completed and approved before the person begins to participate. This says something about the starting point. It says less about the conclusion: how quickly an access card, an authorization, and an IT account should be terminated when the assessment changes.

The Labor Court has examined the consequence for employment, not for the card. In AD 2021 no. 63, an employee was dismissed after a renewed assessment made by the employer itself. The court invalidated the dismissal because the employer had not shown that the person actually no longer met the requirements. At the same time, the conclusion in the case is clear on another point: someone who can no longer be assumed to be loyal and reliable must not participate in the security-sensitive activities. Dismissal and reassignment are labor law issues. Suspended authorization is a security protection issue. They can point in different directions in the same week.

Three thresholds: vetting, access, employment

Keep three thresholds separate.

Security Clearance. An ongoing assessment of loyalty, reliability, and vulnerability. It is not a criminal judgment and not a disciplinary decision. A disqualification means that the person should no longer participate in the security-sensitive part of the work.
Access. Access cards, IT accounts, equipment, security-classified information. This is participation in practice. The law requires that the assessment exists before participation and that it is followed up. It does not specify within how many hours a card should be deactivated. According to DN's information, the card and systems remained active after the notification in July, and the person used them.
Employment. LAS and AD 2021 no. 63. A failed assessment can be a valid reason for termination if there is no other work, but when the employer has made the assessment themselves, the actual circumstances must be demonstrated. Vacation "awaiting a permanent solution" is an employment decision. It is not a decision to revoke access.

The gap arises when threshold two waits for threshold three. The person is no longer approved but remains in the systems until the personnel issue is resolved. During that time, security protection is a personnel matter. The law is written the other way around: participation should follow the assessment, not the calendar for a reassignment.

What the reader should do with this

Read Chapter 3, Sections 1–4, not just DN's introduction. The question is whether participation ceased when the assessment changed.
Request the Government Offices' governing documents for the termination of access upon a reassessed security clearance: routine, time limit, who deactivates the card and account. The security clearance in the individual case is confidential. The routine does not have to be. See the guide on requesting documents.
Note the report to the Swedish Work Environment Authority as a separate track. It examines the work environment, not whether secret information has leaked.
Do not confuse this with whistleblowing. The letter to DN is the person's own criticism after a disqualification, not a legally protected report of misconduct. That order is described in the review of the whistleblower law.

Frequently Asked Questions

Is a failed security clearance the same as the person leaking something?
No. The assessment evaluates whether the person can be assumed to be loyal and reliable, and if there are vulnerabilities. DN does not report that information has been passed on.

Who decides on the disqualification?
The one who decides on participation in the activity. For an employee at the Government Offices, it is the Government Offices, not the Security Police. The Security Police conduct a background check when the position is security-classified.

Must the access card be deactivated the same day?
The law states that those who do not meet the requirements should not participate, and that the assessment should be followed up. It does not specify a time limit in hours. The absence of a clock is part of the problem when access, according to DN, remained.

Can the person be dismissed?
That is a separate question. AD 2021 no. 63 shows that a renewed assessment made by the employer themselves is not automatically a valid reason if the employer does not demonstrate the circumstances on which the assessment is based. Dismissal does not resolve the question of whether the card should already have been deactivated.

Why does the Government Offices not comment?
Individual security clearances are confidential. This does not prevent the authority from disclosing the routine that applies when an assessment is disqualified. That question remains unanswered.