5.The protection afforded to cryptographic products, mechanisms and classified information must be commensurate with the amount of the prejudice likely to be caused upon a compromise of classified information.
\n
Article 43Protection of Computer Storage Media
\n
1.All computer storage media used for recording classified information must be adequately identified, held and stored according to the requirements set for the protection of the most highly classified information contained therein.
\n
2.The classified information stored in reusable computer storage media may be deleted and the media declassified only in accordance with the procedures laid down in paragraph 1 of Article 40 of this Law.
\n
Article 44Functions of a Responsible Person in Organising the Protection of ADP Systems and Networks
\n
A responsible person must:
\n
1)ensure the installation, operation and maintenance of means of protection at the workstations with ADP elements;
\n
2)devise telecommunications plans and schemes and specify therein the location of wires, cables, amount, types, numbering thereof;
\n
3)on the basis of the requirements set by the Security Accreditation Authority, develop, implement and control the procedures for managing security of the ADP systems and networks of an entity of secrets or contractor (sub-contractor) and periodically acquaint therewith administrators and users of the ADP systems and networks;
\n
4)draft the documents on ADP systems and networks required for the obtaining of authorisations to store, process or transmit the information classified “Top Secret”, “Secret”, “Confidential”;
\n
5)ensure that ADP systems and networks are handled by the users authorised to familiarise with the information stored, processed and transmitted in the ADP systems or networks and related to the discharge of their duties as well as control user actions;
\n
6)exercise control of the administration of user passwords and/or of installations for the user identification;
\n
7)organise the administration of classified computer storage media and the physical security of the media;
\n
8)assess the preparedness of a contractor or sub-contractor carry out the requirements set for the protection of the hardware or software housing the information classified “Restricted” and control implementation thereof;
\n
9)organise and check the backup and recovery of the information of ADP systems and networks;
\n
10)verify the information collected about occurrences (process errors, unauthorised users and operation of the system);
\n
11)notify an entity of secrets or a person authorised by him of any gaps in the protection afforded to the ADP systems and networks of the entity of secrets or the contractor (sub-contractor) and the breaches which have occurred and take remedial measures.
\n
CHAPTER IX
\n
CONTROL OF THE PROTECTION OF CLASSIFIED INFORMATION
\n
Article 45Control of the Protection of Classified Information
\n
1.Implementation of the policy of protection of the Republic of Lithuania classified information and carrying out of actions of the protection of classified information in all institutions within the country and abroad shall be controlled by the State Security Department. The Department shall:
\n
1)control compliance with the procedure laid down for classifying, using, storing, destroying and declassifying the information classified “Top Secret”, “Secret” and “Confidential”. An entity of secrets must eliminate the deficiencies established in the course of an inspection by the State Security Department within a time limit laid down by the Department and notify thereof the State Security Department;
\n
2)submit proposals to the Government, the Commission for Secrets Protection Co-ordination on the upgrading of the classified information protection system;
\n
3)carries out pre-trial investigation activities in respect of unauthorised holding of classified information, compromise, loss, seizure or other unauthorised acquisition of classified information;
\n
4)provide methodological support to entities of secrets on the protection of classified information.
\n
2.Control of the protection of the information classified “Restricted” shall be exercised by the entities of secrets that have this information at their disposal.
\n
3.The persons exercising control of the protection of classified information must hold authorisations to handle or familiarise with the information classified “Top Secret”. The persons exercising control of the protection of the classified information released to the Republic of Lithuania by other states or international organisations must be appropriately security cleared.
\n
4.The persons exercising control of the protection of classified information shall, in the course of inspections, be familiarised with the contents of classified documents only with a consent of the head of an entity of secrets.
\n
5.The persons exercising control of the protection of classified information shall have the right:
\n
1)in accordance with the procedure laid down by an entity of secrets, to access the territories and premises where classified information is processed, stored or transmitted;
\n
2)to familiarise with the documents of an entity of secrets regulating the protection of classified information;
\n
3)to carry out inspections of storage of classified documents or copies thereof, where it is required to establish whether a document (copy thereof) has not been lost and is stored in a place specified in accounting documents;
\n
4)to familiarise with physical security measures;
\n
5)to familiarise with ADP systems and networks designed for the processing, storage or transmission of classified information;
\n
6)to request from responsible persons or from the persons handling classified information oral and written explanations about compliance with the procedure for protecting classified information or breaches of this procedure;
\n
7)to engage appropriate specialists, where special knowledge is required at the time of a check.
\n
6.Where classified information is suspected to have been lost or compromised, an enquiry shall be conducted by a decision of the head of an entity of secrets. The inspection must:
\n
1)establish and confirm the classification, contents and volume of the classified information lost or disclosed;
\n
2)establish the persons whose actions could have led to the loss or disclosure of classified information;
\n
3)specify the persons who had this information at their disposal or were familiarised therewith;
\n
4)establish the circumstances of the loss or disclosure of classified information.
\n
7.Where, upon the carrying out of the enquiry provided for in paragraph 6 of this Article and the inspection referred to in Article 27 of this Law, it transpires that classified information has indeed been lost or compromised, the head of an entity of secrets shall immediately notify thereof the State Security Department, and the officers authorised by it shall carry out a pre-trial investigation.
\n
8.Where, upon the conducting of an enquiry, it transpires that the classified information released to the Republic of Lithuania by foreign states or international organisations has indeed been lost or compromised, notice shall be immediately given to the Commission for Secrets Protection Co-ordination, appropriate services of the state or international organisation which has released the information and the State Security Department, which shall carry out a pre-trial investigation.
\n
CHAPTER X
\n
LIABILITY
\n
Article 46Liability for Unauthorised Holding of Classified Information, Compromise, Loss, Seizure or Other Unauthorised Acquisition of Classified Information
\n
A person shall be held liable for an unauthorised holding of classified information, the compromise, loss, seizure or other unauthorised acquisition of classified information or for other breaches of the requirements set for the protection of classified information in accordance with the procedure laid down by legal acts.
\n
I promulgate this Law passed by the Seimas of the Republic of Lithuania.
\n
PRESIDENT OF THE REPUBLIC VALDAS ADAMKUS Annex to 16 December 2003 Republic of Lithuania Law No. IX-1908 EU LEGAL ACT IMPLEMENTED HEREBY Council Decision of 19 March 2001 adopting the Council’s security regulations (2001/264/EC).