Allied Intelligence — 2026-06-21

Finnish Intelligence Agency Supo Warns Data Centres May Be Exploited as Tools by Russia and China for Sanctions Evasion and Intelligence Operations

BLUFFinland's proposed authorization act will likely take effect by March 2027, but adversary-linked operators have already embedded in Finnish computing infrastructure during the years without any screening regime.

Supo analyst Veli-Pekka Kivimäki told Yle on June 18 that Finland lacks legislation requiring notification of foreign data centre projects, leaving municipalities to assess national security risks without formal state oversight 12. Kivimäki identified two exploitation vectors: Chinese law can compel any Chinese-linked operator to share data with the state, and Russia or China could access restricted AI chips by investing in Finnish computing capacity rather than importing them under sanctions 1. Supo's 2026 espionage overview also flagged that some facilities do not identify their customers, which Kivimäki said "practically enables criminal activity or state intelligence activities" 1. Finland's government has proposed authorization requirements for centres over 100 megawatts and AI- or quantum-linked facilities, expected to take effect next spring pending parliamentary approval 12.

Analysis
Finland's proposed investment authorization act will likely enter into force by 31 March 2027, but the legislative gap it addresses is already operational: adversary-linked operators have embedded in Finnish computing infrastructure before any screening regime existed. Moderate confidence rests on a government-initiated proposal with visible political awareness, though parliamentary timing and scope negotiations remain contingent on deliberations not accessible through open-source reporting. The sanctions-evasion vector, where Russia or China access restricted AI compute by investing in Finnish facilities rather than importing chips directly, represents a harder problem than data access, because it exploits infrastructure investment rather than ownership identity.

3 sources

Finnish spy agency warns of hidden security threats from data centres - YLE News
Yle: Supo warns of security risks linked to data centres - Helsinki Times
Overview of State Espionage and Influencing 2026 - Supo