Spy Suspect Worked at the Armed Forces for Several Years

A 34-year-old man of Iranian background, active in IT and previously tasked by the Armed Forces, has been remanded in custody on probable cause suspected of espionage. The Armed Forces state that he worked for the authority for four years.

The man was arrested in early January, and the custody decision was made on Wednesday. The investigation is described as highly sensitive and is surrounded by strict confidentiality.

– This is a very sensitive investigation, and in light of that, I cannot comment further at this time, says senior prosecutor Mats Ljungqvist.

According to the prosecutor, the suspected offenses took place in Stockholm County between January 1, 2025 and January 4, 2026, when the man was arrested and detained.

The Public Prosecutor’s Office has previously stated that the suspicions also involve activities dating back to 2022. The man denies any wrongdoing.

– The district court has detained the suspect in accordance with my request, says senior prosecutor Mats Ljungqvist.

Four Years at the Authority

Samnytt can report that the now detained 34-year-old was born in Sweden. His mother is Swedish, while his father came to Sweden from the city of Abadan in Iran during the 1980s.

Furthermore, he is registered in central Sweden and has a background in IT security. He started several university programs focusing on the field, but did not complete any of them.

The Armed Forces have informed Samnytt that the man worked as a consultant for the authority between 2018 and 2022.

Photo: Facsimile, Swedish Armed Forces / Johan Lundahl

Tight-Lipped About Who He Spied For

In 2024, the man started his own IT consulting firm. According to the company’s own description, its activities would focus on cybersecurity and, among other things, conduct “offensive cyber operations.” However, the company reported no turnover for the year.

The man denies the accusations. His defense attorney does not wish to go into detail about the suspicions. The Security Police have stated that the case has been under investigation for a long time. The government has been informed about the case of the suspected spy.

The prosecutors have so far not disclosed which country or actor the man is suspected of having provided information to.

– We cannot reveal which country or countries, or which intelligence or security services, he is alleged to have assisted, prosecutor Per Lindqvist told TT on Monday.

Leads Point to the FRA

The investigation concerning the 34-year-old suspected spy shows several parallel leads. On one hand, he had access to systems and user accounts within the Armed Forces through his work as an IT consultant, where he worked with networks, administration as well as hardware and software.

On the other hand, digital traces lead to a cybercriminal forum where hundreds of email addresses belonging to employees at the FRA have been distributed.

The man has worked with advanced cybersecurity, including penetration testing and offensive methods, while also spreading conspiracy theories online and accusing Swedish authorities of criminal activity.

– The person’s expertise and knowledge could be misused by threat actors, an intelligence source told SvD.