NDB cyber case: exoneration with a key question open
The investigation finds no evidence of mass data deletion. But the Federal Prosecutor's Office is still investigating the possible exchange of network data.
The new administrative investigation into the Federal Intelligence Service's (NDB) former cyber unit exonerates the service on important points. It is not enough for a blanket all-clear: the suspicion of a possible systematic transfer of network traffic data in connection with the former cooperation with Kaspersky remains the subject of investigations by the Federal Prosecutor's Office. Precisely this distinction is the central message of the investigation report published on Monday.
What the investigation clarifies
The law firm Lenz & Staehelin reviewed earlier reports and documents and interviewed several employees as well as members of the NDB's executive management. In its assessment, the earlier questions about the lawfulness of data collection from internet providers are now essentially sufficiently clarified. It found no concrete indications of a further need for investigation in this subject area. Nor did this investigation turn up any indications of data deletions "on a large scale" by former employees.
These are limited but important findings: "no indications found" is neither proof that individual data were never deleted nor a verdict on all activities in the cyber unit. The report itself distinguishes between matters it was able to assess and suspicions that are being clarified elsewhere. The federal government's statement also summarises this distinction.
The open question concerns the transfer of data
According to the report, uncertainties remain regarding the earlier cooperation with the security company Kaspersky. The issue is suspicions that employees may have systematically passed on network traffic data. The oversight authority for intelligence activities (AB-ND) filed a criminal complaint on this in 2025; the Federal Prosecutor's Office is investigating. Whether data were in fact systematically passed on, to whom, and whether crimes were committed in the process is precisely not decided by this. A claimed leak to Russian intelligence services has likewise not been established as fact by the new investigation.
The AB-ND's 2025 audit report explains why this uncertainty is not incidental. In a forensically secured data set, the oversight body found indications of the processing of personal data and their possible exchange with external bodies. These included IP addresses, which it qualified as personal data in the NDB's working environment. According to the oversight body's account, the indications of a possible transfer were few; it was unable to reach a conclusive clarification. Anyone who already derives a proven data leak from this finding goes beyond what the files show.
Improvements – and a difficult past
The new investigation assesses the recommendations from earlier audits as essentially implemented or dealt with by the reorganisation. At the same time, it notes that the impression did not necessarily arise that the NDB had actively or as a matter of priority pursued their implementation in the past. That is a different statement from one of consistently exemplary oversight. In 2025, the AB-ND documented that immediate measures announced at the time had not been fully implemented, that an old data repository was still running and that additional controls were missing. The two reports examine different points in time; the new findings therefore do not cancel out the older ones.
Internal culture is also among the problems. According to the summary, those interviewed described trust in leadership and communication as in part substantially damaged, aggravated by repeated reorganisations and investigations. At the same time, the investigation highlights the commitment of employees and assesses a new set of rules for internal reporting positively. It is meant to encourage people who report misconduct on reasonable grounds to come forward and to protect them from reprisals.
The former cyber unit has already been restructured. The NDB's transformation is to be completed by the end of 2026. The investigators recommend evaluating the new organisation no earlier than after one year, drawing on employees' experience. The full report remains secret because it contains details about the service's working methods and personal names; a three-page summary is public. Outsiders' ability to verify the conclusions is therefore limited.
For Switzerland the lesson is twofold: an intelligence service needs effective technical analysis, and especially with sensitive network data it needs verifiable rules and oversight. Whether the reorganisation will durably strengthen trust will only become clear in practice. The remaining complex of suspicions will be decided by the ongoing criminal investigation, not by today's exoneration on other points.
