1)the classification of protected classified information;
\n
2)the nature and volume of protected information;
\n
3)the risk factors – security of the persons employed in an entity of secrets, characteristic of the surrounding environment, criminal situation, the location of a building, layout of premises, size of the territory, likelihood of uncontrolled entry to a protected area, etc.
\n
4.Physical security shall consist of:
\n
1)the establishment of security areas;
\n
2)the installation and use of the mechanical security measures to impede intrusion or forced entry into a territory and premises;
\n
3)the installation and use of security alarms;
\n
4)the installation and use of the electronic surveillance and electronic security measures allowing personal identification and restricting entry as well as recording entry into premises, presence in and exit from the premises;
\n
5)the training, assignment and allocation of guards;
\n
6)the regulation of physical security procedures – the internal regulations providing that premises must be unlocked and locked, alarm be switched off and switched on and monitoring of premises and other physical security procedures be carried out.
\n
5.Taking account of the factors listed in paragraph 3 of this Article and facilities of ensuring the protection of protected information, the constituent parts of physical security as referred to in points 2-5 of paragraph 4 of this Article may be applied in the aggregate or priority may be given to several or one of them.
\n
Article 31Security Areas
\n
1.The territories and premises in which classified information is handled or stored shall be subdivided into separate security areas according to the classifications applied to the information, mode of storage and risk of unauthorised familiarisation with the classified information.
\n
2.An administrative security area – a defined territory and/or premises in which the movement of persons and vehicles shall be controlled. Class I or Class II security areas shall be accessible only from the administrative area. Only the information classified “Restricted” may be stored or handled in the administrative area. The classified information stored in the administrative security area must be kept in metal cabinets or in safes.
\n
3.Class II security area – the territories and premises in which the information classified “Confidential” and above is stored or handled as well as the premises entry into which constitutes direct access to the central control of this security area’s electronic security measures. The information stored in Class II security area and classified “Secret” or “Top Secret” must be kept in safes or in repositories specially designed to store such information. The information stored in Class II security area and classified “Confidential” must be kept in metal cabinets or in safes.
\n
4.Class II security area shall be imposed the following requirements:
\n
1)all entrances to and exits from the area must be established, protected and controlled;
\n
2)the area may be accessed only by the persons holding an authorisation to handle or familiarise with the information classified “Confidential”. All other persons must be escorted by a guard or a person authorised by the head of an entity of secrets;
\n
3)where the information classified “Secret” or “Top Secret” is stored in the area, a control post must be set up at entrances to the area or to separate premises thereof to identify a person or an identification system must be installed;
\n
4)approaches to buildings must be well lit throughout the night;
\n
5)the premises assigned to the area must be equipped with security, alert and fire alarms;
\n
6)electronic security measures must transmit a double signal warning of an attempt of forced entry into the area or of an unauthorised presence therein not to a single response system;
\n
7)where the information classified “Top Secret” is stored in the area, entry into the area or to the premises located within the area must be monitored by video cameras, and a video archive of 30 calendar days must be kept.
\n
5.Class I security area – the premises in which the information classified “Confidential” and above is handled or stored. Entry into the area constitutes direct access to the information stored therein as well as to the central control of this security area’s electronic security measures.
\n
6.Class I security area shall be imposed the following requirements:
\n
1)the requirements set in paragraph 4 of this Article;
\n
2)approaches to this security area must be controlled by electronic security measures;
\n
3)the objects brought into and taken out of the area may be checked;
\n
4)this security area shall, by a decision of the head of an entity of secrets or a person authorised by him, be accessed only by the persons holding authorisations to handle or familiarise with the most highly classified information stored in the said security area;
\n
5)no extraneous sources of electromagnetic emissions may be brought into the area;
\n
6)alarms against forced entry, perimeters alarms and fire alarms must be used;
\n
7)the mechanical security measures applied must prevent unauthorised entry into protected premises.
\n
7.Where necessary and in the event of absence of a person entrusted with classified information, repositories of documents, personal safes, metal cabinets may be opened only by the persons authorised by the head of an entity of secrets. Entities of secrets must lay down the procedure for the carrying out and recording of such actions.
\n
8.Where unauthorised persons are suspected to have entered repositories of documents or opened personal safes, metal cabinets, a report shall be immediately forwarded to a responsible person, the head of an entity of secrets and the State Security Department. Until the arrival of officers of the State Security Department, the responsible person and the head of the entity of secrets shall take measures necessary to preserve the place of the incident intact.
\n
Article 32Functions of a Responsible Person in Implementing the Physical Security of Classified Information
\n
A responsible person shall:
\n
1)ensure that appropriate physical security measures are in place and operate properly in the territories and premises where classified information is handled or stored;
\n
2)draft the documents regulating physical security procedures, control the compliance with the procedures laid down and carry out periodic inspections of the physical security arrangements in place;
\n
3)organise training of employees;
\n
4)submit proposals to the head of an entity of secrets or a person authorised by him on the subdivision of premises into security areas;
\n
5)notify the head of an entity of secrets of detected damage to the means of protection and installations of repositories, premises, safes, metal cabinets and take remedial measures.
\n
CHAPTER SEVEN SECURITY OF CLASSIFIED CONTRACTS
\n
Article 33Classified Contracts
\n
1.In performing the functions assigned to them, entities of secrets shall have the right to conclude classified contracts. The entities of secrets may assign conclusion of classified contracts to their structural divisions holding the rights of the contracting authority.
\n
2.A classified contract may be concluded only with a contractor who has been issued, in accordance with the procedure laid down by this Law, a facility security clearance or a contractor’s/sub-contractor’s authorisation to handle or familiarise with classified information.
\n
3.A contractor shall, subject to consent of the contracting authority executing a classified contract, have the right to engage a sub-contractor for execution of a part of the contract, where the sub-contractor holds a facility security clearance or a contractor’s/sub-contractor’s authorisation to handle or familiarise with classified information.
\n
4.The contractors participating in the selection published by foreign states or international organisations on the awarding of a classified contract shall be applied the requirements referred to in this Chapter, where a foreign state or international organisation requests to provide a proof of their security.
\n
5.The undertakings, agencies and organisations operating or registered in the foreign states with which international treaties have been concluded on mutual protection of classified information or with which classified information is exchanged under EU or NATO legal acts or the citizens of such foreign states engaged in economic activities may participate in the selection published by entities of secrets of the Republic of Lithuania on the awarding of a classified contract providing for release of classified information of the Republic of Lithuania in the course of execution thereof, where a foreign institution ensuring the security of classified contracts confirms that an undertaking, agency, organisation or natural person participating in the selection is secure and meets the requirements of the foreign state set forth to contractors concluding respective classified contracts.
\n
6.A classified contract may be unilaterally terminated, where the contractor/sub-contractor does not meet the requirements set for the protection of classified information.
\n
7.The contractor/sub-contractor shall not be considered the originator of classified information. The entire information created in the course of execution of a classified contract shall be considered the property of the Republic of Lithuania as of the moment of creation thereof and shall be protected and processed in compliance with the provisions of this Law.
\n
8.An entity of secrets planning to conclude, or having concluded, a classified contract must:
\n
1)appoint the persons responsible for the control of the protection of the classified information released in the course of conclusion and execution of the classified contract or created in the course of execution of the contract and the carrying out of requirements of the classified contract;
\n
2)organise the release of classified information to a contractor/sub-contractor;
\n
3)provide necessary methodological support on the protection of classified information;
\n
4)prepare a classification guide, where the execution of the classified contract will include creation of classified information;
\n
5)control the safeguarding of released classified information by a contractor/sub-contractor;
\n
6)provide, within five working days from the conclusion of the classified contract, the institution ensuring the security of classified contracts and exercising control of the protection of classified information in the course of the execution of the classified contract with copies of the classified contract and classification guide, if such has been prepared.
\n
9.The contractor/sub-contractor must:
\n
1)organise and carry out the protection of the classified information entrusted or created in the course of execution of the classified contract in accordance with the procedure laid down by this Law and other legal acts regulating the protection of classified information;
\n
2)ensure that classified information will be handled or familiarised with only by the persons holding an authorisation to handle or familiarise with classified information or authorised to handle or familiarise with information classified “Restricted” alone and only in compliance with the need-to-know principle;
\n
3)appoint a person/persons responsible for specific areas of protection of classified information;
\n
4)notify the State Security Department of the emergence of the circumstances referred to in Article 36(1)(1),(3),(4),(5) or (13) of this Law;
\n
5)hand over to an entity of secrets, upon the execution of the classified contract or upon the termination of execution thereof prior to the time limit, the entire classified information obtained or created in the course of execution of the classified contract.
\n
6)not disclose information on classified contracts concluded or executed;
\n
7)give an immediate notice to the responsible person of an entity of secrets and to the institution ensuring the security of classified contracts and exercising control of the protection of classified information in the course of execution of a classified contract of any breaches of requirements for the protection of classified information which resulted or might have resulted in a compromise or loss of classified information or if such breaches are suspected to have been incurred;
\n
8)comply with lawful requirements of the institutions ensuring security of classified contracts;
\n
9)give a notice, not later than within five working days, to the responsible person of an entity of secrets and the institution ensuring the security of classified contracts and exercising control of the protection of classified information of termination of a contract with the sub-contractor executing a part of the classified contract, also of termination of an employment contract with persons related to the contractor/sub-contractor who have been issued authorisations to handle or familiarise with classified information or who are authorised to handle or familiarise with information classified “Restricted”.
\n
Article 34Issuance of a Facility Security Clearance
\n
1.Private and public legal persons, other organisations, divisions thereof or groups of such persons (hereinafter: ‘legal persons’) seeking to obtain a facility security clearance must apply to the institution ensuring the security of classified contracts in compliance with the provisions of Article 38 of this Law.
\n
2.A legal person applying to the institution ensuring the security of classified contracts must submit:
\n
1)an application for initiation of the procedure of inspection of the legal person's security and issuance of a facility security clearance. In the application, the legal person shall indicate the economic activity in pursuit whereof the legal person intends to participate in classified contracts, the highest classification level of the classified information which the contractor intends to store and handle in its premises, also the address of the premises wherein classified information is to be handled or stored;
\n
2)a classified contracts security questionnaire as completed by the legal person and its written consent for inspection;
\n
3)the questionnaires completed by the head of the administration of the legal person, the chief accountant or the head of a structural division keeping accounts or the employee of another legal person keeping accounts of the legal person subject to inspection, the persons in charge of protection of classified information, substitutes thereof and the employees or authorised persons who will participate in preparing and making commercial offers to entities of secrets regarding conclusion of classified contracts, where the questionnaires have been prepared in respect of the persons applying for an authorisation to handle or familiarise with information classified “Top Secret”, “Secret” or “Confidential”, and written consents of such persons for inspection. Where the legal person applies for the issuance of a facility security clearance entitling to conclude classified contracts in the course of execution whereof the information classified \"Restricted\" will be used or created, the questionnaires of the specified form as completed by the head of the administration of the legal person, the chief accountant or the head of a structural division keeping accounts or the employee of another legal person keeping accounts of the legal person subject to inspection, the persons in charge of protection of classified information, substitutes thereof and the employees or authorised persons who will participate in preparing and making commercial offers to entities of secrets regarding conclusion of classified contracts, where the questionnaires are completed for the purpose of granting the right to handle or familiarise with the information classified “Restricted”, and written consents of such persons for inspection shall be submitted;
\n
4)the information required to assess the premises wherein classified information is to be handled or stored for their recognition as fit for handling classified information or storing such information;
\n
5)the information required to assess ADP systems and networks to be used for automated processing of classified information or to be used for transmission of such information for their recognition as fit for automated processing of classified information or for transmission of such information.
\n
3.The provision of the information indicated in points 4 and 5 of paragraph 2 of this Article may be omitted where a legal person decides to participate in procurement procedures and an entity of secrets indicates in the notice of procurement related to classified information that a classified contract will be executed using ADP systems and networks belonging to the entity of secrets or not using the ADP systems and networks. The information indicated in point 5 of paragraph 2 of this Article shall not be provided where the legal person informs that it will not use the ADP systems and networks in executing classified contracts.
\n
4.A legal person not holding a facility security clearance and intending to participate in published procurement procedures shall apply to an institution ensuring the security of classified contracts and submit the information referred to in paragraph 2 of this Article together with completed questionnaires of the employees of the legal person who will participate in executing a classified contract and who will need to handle or familiarise with classified information, the questionnaires being intended for the persons applying for the issuance of an authorisation to handle or familiarise with information classified “Top Secret”, “Secret” or “Confidential”, or questionnaires for the issuance of an authorisation to handle or familiarise with information classified “Restricted”, where in the course of execution of a published classified contract information classified not higher than “Restricted” will be used or created.
\n
5.Facility security clearances shall be issued and revoked by the State Security Department. In the cases when a legal person's security is screened by the institutions indicated in Article 38(1)(2), (3) and (4) of this Law, the State Security Department must take a decision on the issuance of a facility security clearance not later than within ten working days from the submission of the conclusion of the institution ensuring the security of classified contracts and screening the legal person's security regarding the legal person’s security.
\n
6.Facility security clearances shall be issued for a fixed term:
\n
1)three years - granting the right to conclude classified contracts in the course whereof access will be provided to information classified “Top Secret” or such information will be entrusted, used or created;
\n
2)five years - granting the right to conclude classified contracts in the course whereof access will be provided to information classified “Secret”, “Confidential” or “Restricted” or such information will be entrusted, used or created.
\n
7.The authorisations to handle or familiarise with classified military information issued to employees of a legal person shall be valid until the expiry of the period of validity of a facility security clearance issued to the legal person, but not longer than established in Article 16(5) of this Law. The employees of the legal person shall be granted the right to handle or familiarise with information classified “Restricted” for a period not longer than the period of validity of the facility security clearance issued to the legal person.
\n
8.During the period of validity of a facility security clearance, a legal person must forthwith notify the State Security Department of any changes in the information referred to in paragraph 2 of this Article.
\n
9.In order to ensure the continuity of the validity of a facility security clearance, the legal persons wishing to receive a new facility security clearance may, at least six months before the expiry of the validity of the facility security clearance and acting in accordance with the provisions of this Article, apply to the State Security Department for the issuance of the new facility security clearance.
\n
Article 35Security Screening of a Legal Person
\n
1.The aim of the security screening of a legal person shall be to determine whether a classified contract may be concluded with a contractor by ensuring an adequate protection of classified information.
\n
2.When performing a legal person's security screening, the following shall be verified:
\n
1)the capital and management structure of the legal person, origin of the capital, owners and formal registration;
\n
2)the offences committed by the legal person, the criminal acts committed by the employees, owners or members of the managing bodies of the legal person;
\n
3)the legal person's business relations, the relations of participants of the legal person holding at least 1/3 of votes at the meeting of participants, the head of the legal person, members of management bodies of the legal person, the chief accountant or the head of a structural division keeping accounts or an entity/person keeping accounts with the persons convicted for the criminal acts committed by an organised group or criminal association or with the persons who have been imposed preventive measures under the Law on Organised Crime Prevention, relations with special services of foreign states activities whereof are hostile to the interests of the State of Lithuania;
\n
4)implementation of the requirements for the protection of classified information;
\n
5)the ability of the legal person to pursue activities in accordance with the economic activities indicated in the application;
\n
6)the security of the employees of the legal person applying for the issuance of an authorisation to handle or familiarise with classified information, a personal security clearance or for granting the right to handle or familiarise with information classified “Restricted”.
\n
3.Employees of a legal person shall be screened regarding the issuance of an authorisation to handle or familiarise with classified information or granting of the right to handle or familiarise with the information classified “Restricted” and shall be issued the authorisations or granted the right by the State Security Department in compliance with provisions of this Law.
\n
4.The premises of a legal person wherein classified Information is to be handled or stored shall be examined and an authorisation to handle classified information or to store such information therein shall be issued by the institutions referred to in Article 38 of this Law.
\n
5.The ADP systems and networks of a legal person providing for automated processing of classified information or providing for transmission of classified information shall be assessed at the request of an institution ensuring the security of classified contracts and authorisations for automated processing and transmission of classified information via the ADP systems and networks by the Security Accreditation Service or a departmental security accreditation authority.
\n
6.An institution ensuring the security of classified contracts and screening a legal person's security must perform the security screening of the legal person not later than within six months from the request to initiate the procedure of the legal person's security screening. The request to initiate the procedure of security screening of the legal person shall be considered submitted upon submission to the institution ensuring the security of classified contracts of the documents referred to in Article 34(2) of this Law.
\n
7.An institution ensuring the security of classified contracts shall, when performing the security screening of a legal person, have the right to obtain the entire information regarding the security screening of the legal person and employees thereof from state and municipal institutions, banks and other legal persons.
\n
8.An institution ensuring the security of classified contracts must ensure the security of commercial secrets which it accessed in the course of security screening of a legal person.
\n
9.Where an entity of secrets publishes a notice of procurement related to classified information and a legal person holding a valid facility security clearance decides to participate in procurement procedures, the legal person shall, upon assessing the object of procurement, submit to an institution ensuring the security of classified contracts the questionnaires completed by the employees who will need to handle or familiarise classified information and intended for the persons applying for the issuance of an authorisation to handle or familiarise with information classified “Top Secret”, “Secret” or “Confidential”, or questionnaires for the issuance of an authorisation to handle or familiarise with information classified “Restricted”, where in the course of execution of the classified contract information classified not higher than “Restricted” will be used or created, with the exception of the persons referred to in Article 34(2)(3) of this Law and holding appropriate authorisations to handle or familiarise with classified information or authorised to handle or familiarise with information classified “Restricted”.
\n
10.Where an entity of secrets publishes a notice of procurement related to classified information and indicates that the classified contract will be executed in the premises of the entity of secrets using the ADP systems and networks belonging to the entity of secrets, the premises of a legal person and the ADP systems and networks used by the legal person shall not be subject to screening.
\n
Article 36Conditions of Denial of a Facility Security Clearance
\n
1.A facility security clearance shall not be issued where, in the course of a pre-clearance inspection, it transpires that:
\n
1)a legal person is registered outside the Republic of Lithuania;
\n
2)a legal person, in providing the information indicated in Article 34(2) of this Law, has provided falsified or false data or concealed data likely to affect the legal person's security clearance;
\n
3)a legal person does not have a valid licence/authorisation to engage in the activities indicated in its application for the issuance of the facility security clearance, where such activity is subject to a licence under the laws of the Republic of Lithuania, or the validity of the licence, the licence has been suspended or revoked;
\n
4)a legal person is being liquidated, reorganised, has suspended or limited the economic activities which it indicated in its application for the issuance of a facility security clearance, is subject to bankruptcy proceedings or extrajudicial bankruptcy proceedings have been initiated against it;
\n
5)the legal person has tax arrears to the state budget of the Republic of Lithuania, municipal budgets or the funds, the taxes paid whereto are administered by State Tax Inspectorate (except for the cases of deferral of the payment of taxes, interest, fines by the legal person in accordance with the procedure established by legal acts of the Republic of Lithuania or a tax dispute is held in relation to these taxes, interest, fines), has arrears to the budget of the State Social Insurance Fund;
\n
6)a legal person, a subsidiary of the legal person, a participant of the legal person holding at least 1/3 of votes at the meeting of participants, a member of the legal person's management body, the chief accountant or the head of a structural division keeping accounts and the entity/person keeping accounts of the legal person subject to inspection (hereinafter: ‘a legal person or the persons related thereto’) have been convicted of crimes against the independence of the State of Lithuania, its territorial integrity and constitutional order, regardless of whether the conviction has expired;
\n
7)a legal person or persons related thereto has an unspent or unexpunged conviction for criminal acts against human life, against property, property rights and property interests, against economy and business practice, against the financial system, against social security, against civil service and public interests, against government order;
\n
8)there are data confirming the fact that a legal person or persons related thereto are related to the financing of terrorism;
\n
9)there are data confirming the fact that a legal person or persons related thereto, due to the interests hostile to the Republic of Lithuania, collaborated or collaborates/collaborate or maintains/maintain relations with an intelligence security service of a foreign state or with the persons collaborating or maintaining relations with an intelligence security service of a foreign state;
\n
10)there are data confirming the fact that a legal person or persons related thereto performed the actions which are in conflict with international treaties of the Republic of Lithuania, international sanctions implemented pursuant to the Law of the Republic of Lithuania on the Enforcement of Economic and Other International Sanctions;
\n
11)there are data confirming the fact that a legal person, a subsidiary of the legal person, a participant of the legal person holding at least 1/3 of votes at the meeting of participants has violated the Law of the Republic of Lithuania on Control of Strategic Goods over the past three years;
\n
12)the persons referred to in Article 34(2)(3) and Article 35(9) of this Law do not comply with the requirements as set forth in legal acts for the issuance of an authorisation to handle or familiarise with classified information or an authorisation to handle or familiarise with information classified “Restricted”;
\n
13)a participant of a legal person holding at least 1/3 of votes at the meeting of participants is registered in non-EU Member States or non-NATO member countries or in the countries with which the Republic of Lithuania has not concluded an agreement on mutual protection of classified information, and the Commission for Secrets Protection Co-ordination has not taken a decision on the issuance of a facility security clearance in respect of the legal person;
\n
14)a legal person has not complied with the requirements set forth in legal acts for the protection of classified information;
\n
15)a legal person, through its own fault, has previously been denied a facility security clearance, the facility security clearance has been revoked and reasons for the denial or revocation of the said clearance have not been removed;
\n
16)the facts collected in the course of security screening of the legal person raise doubts as regards the legal person’s security in ensuring the protection of classified information.
\n
2.Where a legal person or the persons related thereto are given a notice of suspicion in the pre-trial investigation being carried out in respect of the criminal acts referred to in points 6 and 7 of paragraph 1 of this Article or an indictment is drawn up in respect of such acts, or a prosecutor applies to the court for the termination of proceedings by a penal order or for the hearing of the case under the accelerated procedure, or where the legal person is subject to tax inspection, the legal person’s security screening process shall be suspended until the pre-trial investigation is terminated, the court judgment becomes effective or a decision of the tax administrator is adopted allowing for the adoption of a decision on the issuance of a facility security clearance.
\n
3.A legal person shall have the right to appeal against a decision of the State Security Department on the refusal to issue a facility security clearance to Vilnius Regional Administrative Court within 30 calendar days from the receipt of such a decision.
\n
4.Where a decision is taken to refuse the issuance of a facility security clearance, a new application for initiation of inspection of a legal person and the issuance of the facility security clearance may be filed upon elimination of the circumstances leading to the refusal to issue the facility security clearance or in the event of disappearance of such circumstances.
\n
Article 37Revocation of a Facility Security Clearance
\n
1.A facility security clearance shall be revoked or a concluded classified contract shall be terminated in the cases when:
\n
1)the contractor/sub-contractor or an employee thereof grossly breaches the requirements set forth for the protection of classified information, which results in a compromise or loss of the classified information entrusted to the contractor/sub-contractor or poses a threat of a compromise or loss of classified information, or breaches the requirements set forth for the protection of classified information at least twice;
\n
2)at least one circumstance referred to in Article 36(1) of this Law transpires.
\n
2.A legal person shall have the right to appeal against a decision of the State Security Department on the revocation of a facility security clearance to court within 30 calendar days from the receipt of such a decision.
\n
3.Where a facility security clearance is revoked, a new application for initiation of inspection of a legal person and the issuance of a facility security clearance may be filed upon elimination of the circumstances leading to the revocation of the facility security clearance or in the event of disappearance of such circumstances.
\n
4.In the event of revocation of a facility security clearance, a classified contract concluded previously may remain in force (with the exception of the cases when the circumstances indicated in Article 36(1)(8), (9), (10) and (11) of this Law transpire), provided that the contract is approaching completion and the damage as a result of termination of the contract would be disproportionately greater than the potential threat to classified information. A decision on completion of execution of the classified contract shall be taken by the Commission for Secrets Protection Co-ordination on the recommendation of an entity of secrets.
\n
Article 38
\n
Institutions Ensuring the Security of Classified Contracts and Control of the Protection of Classified Information in the Course of Execution of Classified Contracts 1. The legal persons applying for a facility security clearance shall be screened by:
\n
1)the State Security Department, in all cases, with the exception of cases provided for in points 2, 3 and 4 of this paragraph;
\n
2)the Second Investigation Department under the Ministry of National Defence having regard to Article 35(3) and (5) of this Law, in the cases when institutions of the national defence system carry out procurement related to classified information, and procurement procedures involve the legal persons not holding a facility security clearance;
\n
3)the divisions authorised by the Minister of the Interior having regard to Article 35(3) and (5) of this Law, in the cases when institutions of the system of the Interior carry out procurement related to classified information, and procurement procedures involve the legal persons not holding a facility security clearance;
\n
4)the Special Investigation Service having regard to Article 35(3) and (5) of this Law, in the cases when the Special Investigation Service carries out procurement related to classified information, and procurement procedures involve the legal persons not holding a facility security clearance.
\n
2.When the institutions specified in points 2, 3 and 4 of paragraph 1 of this Article perform a legal person’s security screening, screening conclusions concerning the issuance (non-issuance) of a facility security clearance shall be submitted to the State Security Department.
\n
3.The control of the protection of classified information in the course of execution of classified contracts shall be exercised by:
\n
1)the State Security Department;
\n
2)the Second Investigation Department under the Ministry of National Defence - in the cases when classified contracts are concluded and executed by institutions of the national defence system;
\n
3)the divisions authorised by the Minister of the Interior - in the cases when classified contracts are concluded and executed by the institutions of the system of the Interior;
\n
4)the Special Investigation Service - in the cases when classified contracts are concluded and executed by the Special Investigation Service.
\n
Article 39Organisation, Execution and Termination of Classified Contracts, Where the Contractor is a Natural Person
\n
1.Classified contracts may be concluded and executed by a citizen of the Republic of Lithuania who, in accordance with the procedure laid down in this Article, has been issued an authorisation to handle or familiarise with classified information.
\n
2.A classified contract may be concluded with a natural person where the natural person to execute the classified contract meets the conditions specified by this Law for the issuance of an authorisation to handle or familiarise with classified information or for the granting of the right to handle or familiarise with information classified “Restricted”.
\n
3.Where a classified contract is executed outside the premises of an entity of secrets, provisions of Article 35(4) and (5) of this Law shall apply. The classified contract to be executed outside the premises of the entity of secrets may not be concluded with a natural person where the premises belonging to the natural person and/or the ADP systems and networks used have not been issued respective authorisations.
\n
4.Security screening of a natural person shall be performed, and a contractor’s/sub-contractor’s authorisation to handle or familiarise with classified information shall be issued by the State Security Department.
\n
5.A contractor’s/sub-contractor’s authorisation to handle or familiarise with classified information shall be issued for a fixed term:
\n
1)three years - granting the right to conclude classified contracts in the course whereof access will be provided to information classified “Top Secret” or such information will be created;
\n
2)five years - granting the right to conclude classified contracts in the course whereof access will be provided to information classified “Secret”, “Confidential”, “Restricted” or such information will be created.
\n
6.A natural person who has entered into a classified contract shall be subject to the requirements of Article 33(9)(1), (5), (6), (7) and (8) of this Law.
\n
7.Where a contractor’s/sub-contractor’s authorisation to hand or familiarise with classified information is revoked in accordance with the procedure laid down by this Law, the classified contracts concluded with this contractor/sub-contractor shall be terminated.
\n
8.A natural person who is a contractor/sub-contractor may appeal against a decision of the State Security Department to revoke an authorisation to handle or familiarise with classified information issued to the contractor/sub-contractor to Vilnius Regional Administrative Court within 30 calendar days from the receipt of such a decision.
\n
CHAPTER EIGHT ADP SYSTEMS AND NETWORKS
\n
Article 40Development and Certification of ADP Systems and Networks
\n
1.The rules for development and certification of ADP systems and networks shall be specified by the Government.
\n
2.Entities of secrets may, in accordance with the procedure laid down by the institution performing the functions of the Security Accreditation Authority, appoint or set up departmental security accreditation authorities. The general rules for activities of departmental security accreditation authorities shall be approved by the institution performing the functions of the Security Accreditation Authority. The institution performing the functions of the Security Accreditation Authority shall co-ordinate the activities of departmental security accreditation authorities relating to performance of the functions of control of security of ADP systems and networks and issuance of authorisations for automated processing and transmission of classified information via ADP systems and networks of an entity of secrets, the contractor/subcontractor thereof.
\n
3.Classified information may be subject to automated processing and transmission only via certified ADP systems and networks. ADP systems and networks shall be considered to be certified when an entity of secrets, the contractor/sub-contractor thereof are issued an authorisation for automated processing and transmission of classified information via ADP systems and networks. The authorisation for automated processing and transmission of classified information using ADP systems and networks shall be issued by the institution performing the functions of the Security Accreditation Authority, or a departmental security accreditation authority in accordance with the procedure laid down by the institution performing the functions of the Security Accreditation Authority.
\n
Article 41Requirements for the Protection of ADP Systems and Networks
\n
1.The means of protection used for safeguarding the security of ADP systems and networks must ensure:
\n
1)confidentiality of the classified information stored, processed or transmitted;
\n
2)a possibility to identify users of ADP systems and networks;
\n
3)integrity of the classified information stored, processed or transmitted and system services and resources;
\n
4)availability to authorised users of the classified information stored, processed or transmitted and system services and resources;
\n
5)recording of deliberate or accidental breaches of confidentiality, integrity or availability of the classified information stored, processed or transmitted via ADP systems and networks as well as services and resources of the ADP system and networks;
\n
6)control of interconnection of ADP systems and networks;
\n
7)assessment and verification of adequacy of the protection mechanisms of ADP systems and networks.
\n
2.ADP systems and networks must be equipped with the protection mechanisms and security management procedures preventing breaches of security, detecting occurred breaches of security and restoring the confidentiality, integrity and availability to authorised users of the classified information and services and resources of the ADP systems and networks as adversely affected by the breaches of security.
\n
3.The security requirements for ADP systems and networks shall be set forth by an institution performing the functions of the Security Accreditation Authority.
\n
4.ADP systems and networks must be equipped with the means of protection allowing to protect the information classified “Confidential” or above against compromise through electromagnetic emissions. The means of protection applied must be commensurate with the risk of the compromise of information and the prejudice likely to be caused upon the disclosure of the information.
\n
5.All operations of the installation and modification of ADP systems and networks must be carried out with the participation and under the supervision of a responsible person. The persons carrying out the maintenance of the communication facilities and computing devices used for storage or transmission of classified information, ADP systems and networks must be cleared to the highest classification level of the information processed, stored or transmitted in the said equipment or system.
\n
6.The requirements for the means of protection of ADP systems and networks against electromagnetic radiation shall be set forth by the Commission for Secrets Protection Co-ordination.
\n
7.Installation in the ADP systems and networks processing classified information of the hardware or software not provided for in the ADP systems and networks’ specifications shall be prohibited.
\n
Article 42Transmission of Classified Information via ADP Systems and Networks
\n
1.When transmitting classified information via ADP systems and networks, the confidentiality, integrity and availability to authorised users of the classified information must be ensured.
\n
2.When transmitting classified information via ADP systems and networks, confidentiality thereof must be ensured by means of the cryptographic methods and products approved by the National Distribution Authority and the telecommunications protection requirements approved by the National Communications Security Authority.
\n
3.Transmission of classified information via public telecommunications networks in clear text, with the exception of the cases referred to in paragraph 4 of this Article, shall be prohibited.
\n
4.By a decision of the head of an entity of secrets’ structural division housing classified information, the information classified “Restricted”, “Confidential” and “Secret” may be transmitted in clear text, where a state of war or emergency has been declared and means of encrypting are not available, while speed of delivery is more important than the imminent threat of disclosure of the information.
\n
5.The protection afforded to cryptographic products, mechanisms and classified information must be commensurate with the amount of the prejudice likely to be caused upon a compromise of classified information.
\n
Article 43Protection of Computer Storage Media
\n
1.All computer storage media used for recording classified information must be adequately identified, held and stored according to the requirements set for the protection of the most highly classified information contained therein.
\n
2.The classified information stored in reusable computer storage media may be deleted and the media declassified or destroyed only in accordance with the procedures laid down by the Government.
\n
Article 44Functions of a Responsible Person in Organising the Protection of ADP Systems and Networks
\n
A responsible person must:
\n
1)ensure the installation, operation and maintenance of means of protection at the workstations with elements of ADP systems and networks;
\n
2)devise telecommunications plans and schemes and specify therein the location of wires, cables, the amount, types, numbering thereof;
\n
3)on the basis of the requirements set by the Security Accreditation Authority, develop, implement and control the procedures for managing security of the ADP systems and networks of an entity of secrets or contractor/sub-contractor and periodically acquaint therewith administrators and users of the ADP systems and networks;
\n
4)prepare the documents required to obtain an authorisation for automatic processing and transmission of classified information via ADP systems and networks, organise the issuance of the authorisation;
\n
5)ensure that ADP systems and networks are handled by the users authorised to familiarise with the classified information stored, processed and transmitted in the ADP systems and networks and related to the discharge of their duties as well as control user actions;
\n
6)exercise control of the administration of user passwords and/or of installations for the user identification;
\n
7)organise the administration of classified computer storage media;
\n
8)organise and check the backup and recovery of the information of ADP systems and networks;
\n
9)verify the information collected about occurrences (process errors, unauthorised users and operation of the system);
\n
10)notify the head of the contractor/sub-contractor of an entity of secrets or a person authorised by him of any gaps known to exist in the protection afforded to the ADP systems and networks of the entity of secrets, the contractor/sub-contractor and the breaches which have occurred and take remedial measures.
\n
CHAPTER NINE CONTROL OF THE PROTECTION OF CLASSIFIED INFORMATION
\n
Article 45Control of the Protection of Classified Information
\n
1.Implementation of the policy of protection of the Republic of Lithuania classified information and carrying out of actions of the protection of classified information in all institutions within the country and abroad shall be controlled by the State Security Department. The Department shall:
\n
1)control compliance with the procedure laid down for classifying, using, storing, destroying and declassifying the information classified “Top Secret”, “Secret” and “Confidential”. An entity of secrets must eliminate the deficiencies established in the course of an inspection by the State Security Department within a time limit laid down by the Department and notify thereof the State Security Department;
\n
2)submit proposals to the Government, the Commission for Secrets Protection Co-ordination on the upgrading of the classified information protection system;
\n
3)(Repealed as of 1 February 2011);
\n
4)provide methodological support to entities of secrets on the protection of classified information.
\n
2.Control of the protection of the information classified “Restricted” shall be exercised by the entities of secrets that have this information at their disposal.
\n
3.The persons exercising control of the protection of classified information must hold authorisations to handle or familiarise with the information classified “Top Secret”. The persons exercising control of the protection of the classified information released to the Republic of Lithuania by other states or international organisations must be appropriately security cleared.
\n
4.The persons exercising control of the protection of classified information shall, in the course of inspections, be familiarised with the contents of classified documents only with a consent of the head of an entity of secrets.
\n
5.The persons exercising control of the protection of classified information shall have the right:
\n
1)in accordance with the procedure laid down by an entity of secrets, to access the territories and premises where classified information is processed, stored or transmitted;
\n
2)to familiarise with the documents of an entity of secrets regulating the protection of classified information;
\n
3)to carry out inspections of storage of classified documents or copies thereof, where it is required to establish whether a document (copy thereof) has not been lost and is stored in a place specified in accounting documents;
\n
4)to familiarise with physical security measures;
\n
5)to familiarise with ADP systems and networks designed for the processing, storage or transmission of classified information;
\n
6)to request from responsible persons or from the persons handling classified information oral and written explanations about compliance with the procedure for protecting classified information or breaches of this procedure;
\n
7)to engage appropriate specialists, where special knowledge is required at the time of a check.
\n
6.Where classified information is suspected to have been lost or compromised, an enquiry shall be conducted by a decision of the head of an entity of secrets. The inspection must:
\n
1)establish and confirm the classification, contents and volume of the classified information lost or disclosed;
\n
2)establish the persons whose actions could have led to the loss or disclosure of classified information;
\n
3)specify the persons who had this information at their disposal or were familiarised therewith;
\n
4)establish the circumstances of the loss or disclosure of classified information.
\n
7.Where, upon the carrying out of the enquiry provided for in paragraph 6 of this Article and the inspection referred to in Article 27 of this Law, it transpires that classified information has indeed been lost or compromised, the head of an entity of secrets shall immediately notify thereof the State Security Department.
\n
8.Where, upon the conducting of an enquiry, it transpires that the classified information released to the Republic of Lithuania by foreign states or international organisations has indeed been lost or compromised, notice shall be immediately given to the Commission for Secrets Protection Co-ordination, appropriate services of the state or international organisation which has released the information and the State Security Department.
\n
CHAPTER TEN LIABILITY
\n
Article 46Liability for Unauthorised Holding of Classified Information, Compromise, Loss, Seizure or Other Unauthorised Acquisition of Classified Information
\n
A person shall be held liable for an unauthorised holding of classified information, the compromise, loss, seizure or other unauthorised acquisition of classified information or for other breaches of the requirements set for the protection of classified information in accordance with the procedure laid down by legal acts.
\n
I promulgate this Law passed by the Seimas of the Republic of Lithuania.
\n
PRESIDENT OF THE REPUBLIC VALDAS ADAMKUS Annex to Republic of Lithuania Law No IX-1908 of 16 December 2003 LEGAL ACT OF THE EUROPEAN UNION IMPLEMENTED BY THIS LAW Council Decision of 19 March 2001 adopting the Council’s security regulations (2001/264/EC).