that the freedom of the press in Denmark was in danger. IT security Banks and providers of credit card payment services are usually expected to have very effective IT security. Nets, along with all other payment service providers, must be certified under the Payment Card Industry Data Security Standard (PCI DSS) and when the scandal broke had last been certified in 2013 by the British firm Foregenix. However, the security emphasis is on protection of card numbers as opposed to the transaction data leaked by the source. Furthermore, the standard does not deal with attacks by insiders with system access; employees must therefore be implicitly trusted by the service provider. The Danish Financial Supervisory Authority, which is responsible for regulation of IT security at 407 financial organisations operating in Denmark, had performed very few inspections in the period leading up to the leaks; from 2008 to the breaking of the scandal in 2014, just 29 inspections of any firm had been carried out in total. Commenting on these numbers, Venstre's business spokesperson Kim Andersen said that he "thought this area appeared to be seriously underprioritised and that the responsible ministers should have egg on their faces". Lars Pram, the director at the consumer rights organisation Forbrugerrådet Tænk, considered the inspection record to be "quite simply not good enough". In a comment on the case, Poul-Henning Kamp wrote that "insiders are always the greatest threat" but also noted that "there are simply some people that must be trusted ... it isn't more complicated than that". Kamp suggested that such security workers should be given a sufficient salary and employment benefits with "freedom under responsibility and mutual trust and understanding". Additionally, he recommended peer review of any system work to spot irregularities. The Se og Hør case, together with Gottfrid Svartholm's charges, demonstrated that personal data could apparently be copied form domestic mainframes without Danish IT security professionals noticing; it was respectively journalists and the Swedish police that spotted the problem. Kamp specifically considered the use of IBM's mainframes by companies to be "deeply, deeply out of date" and that they should be "out of Danes' private lives". He commented on problems with IBM's mainframes, security model, software and general IT organisation: IT security expert Peter Kruse from CSIS Security Group did not consider the Se og Hør case to be an isolated one and wrote regarding IT outsourcing that his "general