sou · H3B325 · 2015-03-18 00:00:00 — ’s international protective security commitments have increased significantly in terms of general security agreements agreed with other states and international organisations. The purpose of a general security agreement is for two or more countries (or international organisations) to be able to exchange information concerning national security in a secure . It follows from international commitments that there must be a designated body that has national responsibility for protective security issues and is the contact organisation in international protective security matters (Authority). Government agencies with responsibilities under the protective security legislation and the Swedish Armed Forces have particular responsibility for protective security, being the agencies with the main responsibility for supervision and application regulations. In addition, (the Swedish national grid), the Authority and the have been given responsibility – in matters concerning certain private organisations – for making decisions on individuals’ security classifications and record checks, and for monitoring protective security. The Swedish Commission on Security and Integrity Protection checks whether information emerging from record checks should be disclosed for security investigations. may under certain circumstances enter into protective security contracts with companies if this is necessary for the company to be able to take part in international assignments. We have studied the regulatory frameworks in the , , , the and . Threats and change factors The term ‘security of the realm’ has come to be associated mainly with military defence. At the same time, the trend has shifted towards other activities that are important to society becoming increasingly significant from a protective security perspective. The intelligence activities of foreign states have broadened to encompass research and development in civilian areas, and political issues and information concerning vital public systems. Electronic attacks are considered to be one of the most serious threats. However, the intelligence threat to military defence and to information that is important for ’s defence remains. The increased confinement to a small number of companies that provide government agencies with services – particularly in the area of IT – and that thus have access to large amounts of information may lead to greater vulnerability. Starting points for reformed protective security legislation Reformed protective security legislation should in certain regards be based on earlier regulations. We consider that the purpose of the legislation is to ensure that there is sufficient protection for that which is most worthy of protection for the nation; that it should be activity-oriented; that it should provide preventive protection, primarily against antagonistic threats; that it should cover combined protective security measures for information, persons and activities; and also that the current organisational division regarding implementation regulations and supervision should remain in place. However, the Act needs to be developed in terms of ’s international commitments in the area of protective security and the information security perspectives of availability and integrity. Moreover, there needs to be greater clarification about the act being applicable to both public and private activities. This means that our deliberations have focused on clarifying the act’s protective interests and scope of application. All of this combined means that there is a need to revise the description of the purpose of the act and partly amend the classifications. Purpose of the act The current act is based on the terms ‘security of the realm’ and ‘protection against terrorism’. We have identified a need to review this part of the legislation as well. One basic point was that protection against terrorism – which is more a matter of what we need protection against – should not be included in a description of what it is that needs protection. The security of the realm is an appropriate definition for protective security. We share the view of the meaning of the term expressed by the Government in its review of the provision on espionage, i.e. that activities worthy of protection may be conducted in more areas of society than was previously the case. We also share the view that ’s security is a more appropriate term. We have considered whether the scope of application can be made clearer through some form of supplementary text, providing examples of various kinds of civilian and military activities, for example, or through a reference to other vital security interests. However, such solutions can risk having the opposite effect to the desired one. We have therefore concluded that the area worthy of protection should be described as activities of importance for ’s security. There are protective security commitments that is bound by in relation to other states and international organisations. It is therefore important to have greater clarity concerning the protective security requirements that follow from such commitments. We therefore propose that the scope of application of the Act should also cover activities included in a protective security commitment that is binding for (international security commitment). We propose the term ‘security-sensitive activities’ as an umbrella term for these main components of the Act. The meaning of this term, which is central to the act, is therefore activities of importance for ’s security and activities included in an international protective security commitment. When it comes to what the act should protect against, we consider that it is good to have continued clarity over the fact that protective security is primarily a matter of protection against antagonistic threats, including espionage, sabotage and terrorist offences. The protection that covers other unauthorised disclosure, amendment, blocking or destruction of security-sensitive information should continue to be reflected in the provision on what the Act is to protect against. We propose that this protection also cover information that is to be protected under international protective security commitments. Security-sensitive activities – two main focuses Act is currently based on the idea that protective security needs are primarily about protecting secret information. The link to the Public Access to Information and Secrecy Act may give the impression that protective security is primarily a matter for government agencies and other public bodies to which the act is applicable. Furthermore, this protective security focuses on protection against terrorism for airports and , facilities, etc. that have protected status under the Act. Such definitions are now too narrow and result in – or risk resulting in – activities that are important for upholding fundamental public services falling outside the scope of application. A first step is to amend the classifications so that they more clearly encompass the kind of security-sensitive activities carried out by We propose that the description of protective security take its cue from two main focuses. Protective security should focus on activities that involve the handling of classified information. This should encompass the protection of information that is of importance for ’s security or that should be protected under an international protective security commitment, and that is information of the kind covered by provisions on secrecy. This therefore means a wider framework than the current act, which is based on the term ‘secret information’. In addition, protective security should focus on activities that need protective security for some other reason (other security- sensitive activities). This corresponds in part to that which is currently protected within the framework of protection against terrorism, i.e. essentially activities conducted at facilities with protected status, airports and certain activities that must be protected under international law commitments on security, port security and security. The area worthy of protection should not be demarcated through regulations on facilities with protected status; rather, it should be defined in such a way that it can also include other security-sensitive activities, such as the handling of IT systems or the compilation of information that is of vital importance to a functioning society, or activities that need to be protected on the grounds that they could be exploited to harm the nation, e.g. certain activities within the area of nuclear technology. What should be protected – protective security analysis The answer to the question of what assets and functions in organisations need protective security varies over time and will therefore need to be reviewed continuously. For this reason, and others, the question should be addressed at organisation level. This is one reason why there is a need to highlight the key role of protective security analysis in protective security. A provision should therefore be included in the act whereby any person responsible for security-sensitive activities is to ensure that the need for protective security in their own organisation is investigated. Protective secuirty analysis is to enable the identification of classified information and anything else that needs protective security, and the assessment of security threats and potential consequences, vulnerability and the need for protective security measures. This analysis should form the basis of plans for protective security for that particular organisation. In broader efforts to strengthen the protection of activities vital to society and critical infrastructure, risk and vulnerability analyses are conducted. Protective security analysis should, as far as possible, be coordinated with such analyses. Clearer responsibility for organisations We propose the simplification of the regulations on which activities the law should apply to. We do not consider there to be a need for any distinction between company forms over which the public sector has a legally decisive influence and company forms over which there is no such influence. The act should therefore apply to the activities of central government, municipalities, county councils and private actors that are of importance for ’s security or are covered by an international protective security commitment (security-sensitive activity). The current Protective Security Act contains no provision summarising the implications of being subject to the act. We therefore propose that the act state that any person responsible for a security- sensitive activity is to investigate the need for protective security, ensure that protective security measures are taken, monitor to ensure that the provisions on protective security are being followed and provide information in line with certain specified reporting obligations to the designated supervisory authorities. A system of combined protective security areas Combined protective security areas We consider that the classification into three protective security areas should remain in a new act. The three protective security areas – which should be termed ‘information security’, ‘physical security’ and ‘personnel security’ – interact and make up a coherent system for the protection of security-sensitive activities. The protective security measures can be combined in various ways to optimise the protective effect. Such an approach leads to balanced and cost-effective protective security. The grounds on which protective security measures should be taken are laid out in the protective security analysis, and these measures should then be clarified in a protective security plan. Classified information should be divided into four information security classifications based on the harm that could be caused if the information were disclosed. The four classifications should be termed kvalificerat hemlig, hemlig, konfidentiell and begränsad (equivalent to top secret, secret, confidential and restricted). The division into security classifications forms the basis for the design of the parts of the protective security areas (information security, physical security and personnel security) that aims to protect classified information. A provision on the classification of classified information should be included in the Act as this classification is crucial for how protective security is designed. Under our proposal, the protective security area information security should be divided into two parts. The first focuses on the protection of classified information to prevent the information being disclosed, amended, made unavailable or destroyed. In information security contexts, this is often described as confidentiality, integrity and availability. The second specifies that the measures are to prevent adverse effects on information assets that would in some other respects be of importance for security-sensitive activities. In this case, it is therefore only the integrity and availability considerations that apply. ‘Information assets’ refers to information and information systems in a broad sense, i.e. information, documents and technical systems that are used in various ways to communicate information electronically and handle information in general. Information security encompasses measures of various kinds intended to protect information that is of importance to security- sensitive activities. Such information appears in various environments and activities and is handled and used in various different ways. Protective security measures must therefore be adapted to the changing circumstances. The form that the information takes is not relevant in this context, and the measures must concern information as such, i.e. information on paper and information stored electronically, communicated information and information that can be gleaned from images or other material, for example. Under our proposal, the protective security area physical security should be divided into two parts. The first focuses on preventing unauthorised persons from gaining admission to areas, facilities, or objects where they may have access to classified information or where in other respects security-sensitive activities are conducted, and to prevent adverse effects on such areas, facilities, or objects. The new term corresponds to the measures better than the current term ‘access restrictions’. The purpose of personnel security We propose that the purpose of the protective security area personnel security be stated as being to prevent persons who are not reliable from a security perspective from taking part in activities where they may have access to classified information or in activities that for some other reason are security-sensitive (security investigation), and to ensure that those who take part in security- sensitive activities have sufficient knowledge of protective security (protective security training). A transition to security clearance? Under the terms of reference, we are to consider a transition from the current security investigation system towards a system with elements of security clearance. The description in the terms of reference is based in this respect on the changes that are required as a result of cooperation with other countries and international organisations. Experience that can be gleaned from the international survey shows that when it comes to clearance, the similarities with the Swedish model are greater than the differences. Overall, these are purely formal differences rather than differences in substance. The clearance systems in the countries we have studied also differ among themselves in several respects. When comparing these with the Swedish security investigation system, our impression is that the background material in the clearance models is more summary and is often based only on information concerning previous offences. In our view, a system with a clearance procedure would also be a departure from the important principle of protective security tailored to specific activities. Tailoring the investigation to the specific position is important, not only in view of the need for well-tailored protective security for the activity in question, but also for the person who is the subject of the investigation. On balance, no tangible needs have come to light that would require the introduction of a certification procedure for the protection of activities that are of importance for ’s security. Instead, the needs that exist are associated with foreign postings and similar. There is added value in the current system, which may need to be strengthened to some extent, but which may risk being weakened in the event of a transition to a clearance system. To meet the requirements that follow from international protective security commitments, the basis and background material for a security investigation need to tally with the method of classifying information on a four-grade scale, as we have proposed. Such an adaptation can be achieved by adjusting the grounds for classifying positions in security . Moreover, there is a need for a framework that provides clear support for issuing certificates that are accepted internationally in the area of protective security. Such changes can also be made within the framework of the current system of security investigation (more details below under the heading ‘International cooperation’). We have concluded, therefore, that the security investigation system should not be developed into a clearance system. Such a change is not necessary to be able to meet the requirements that follow from international protective security commitments, nor is it preferable for any other reason. As is the case today, security investigations should assess reliability and loyalty. The legislative history of the current Act states that this involves a need to investigate and determine whether, for example, various forms of substance abuse or links with other countries mean that the person under investigation runs a particular risk of being subjected to pressure. This may mean that it is necessary to ask questions about personal circumstances that may be sensitive for the person under investigation. We propose that the legislative text clearly state that the security investigation involves considering circumstances that may result in vulnerability from a security perspective. The provisions of the Act on security investigations should for the most part be transferred to a reformed Act. In some respects we have identified a need for clarification. Under our proposal, the act would more clearly state that the security investigation requires basic screening, which – to the extent that follows from the provisions on classification in security – is to be supplemented by record checks and a special personal screening. The basic screening thus involves interviews and other forms of information-gathering. Moreover, we propose that the legislative text clearly state that the security investigation involves requirements concerning follow- up during the entire time in which the person is taking part in security-sensitive activities. The provisions on the security classification of positions are adapted to the proposal on a transition from the protection of secret information to the protection of classified information, and to the proposal on the level of protection for such information being determined by which information security class the information belongs to. The fact that the person concerned has access to information that has been classified as top secret, secret or confidential should determine their security classification. If small amounts of information from a higher level of protection are accessible, the position is to be classified in the next security class down. The provisions on security classification will be broadened to also cover positions in activities that are security-sensitive (other security-sensitive activities), even if they do not involve dealing with classified information. The new basis for classifying positions in a security class means that the record checks that are currently carried out pursuant to Section 14 of the Act (protection against terrorism) are categorised in the system of security classifications. The fact that the employee, as a result of taking part in the activity, has the opportunity to cause particularly serious damage, serious damage or significant damage to ’s security is to be a determining factor when selecting the security class. Removal of the citizenship requirement We have concluded that Swedish citizenship should not be an eligibility requirement for holding a security-classified position within central government, municipalities or county councils, and that the requirement should thus not be carried over to a reformed Act. However, this does not mean that a lack of Swedish citizenship is insignificant. The fact that a person does not have Swedish citizenship may instead be investigated more closely and considered in the security investigation in the same way that it would, for example, for persons who have another citizenship alongside Swedish citizenship. An explicit requirement for restrictiveness when selecting security class A restrictiveness requirement for the security classification of positions should be introduced in the Act. Such a provision should state that the person who determines the security classification of a position should carefully consider the need for this, and that such classification may only be undertaken if the needs for protection cannot be met in any other way. Disclosure of information emerging from record checks The current system in which information emerging from record checks may only be disclosed following a relevance test by the Swedish Commission on Security and Integrity Protection should not be changed. Who should determine security classification? The authority to determine the security classification of positions should be based on the current decision-making system, whereby – with the exception of the Riksdag’s administrative area – the Government has ultimate decision-making power but can delegate this to government agencies, municipalities and county councils and, if there are special grounds, certain companies. Essentially, only the person who determines security classification should have the authority to receive information from the Swedish ’s record checks. Responsibility for security investigations An organisation planning to employ someone or in some other way allow someone to take part in security-sensitive activities is responsible for the security investigation and determines independently whether or not the person is suitable from a security perspective. A partially different system applies in certain areas, such as activities covered by the protective security requirements and for contractors for whom the terms and conditions of protective security are laid down in a classified contract. Protecting information about an individual’s personal circumstances The security investigation may involve information that is particularly sensitive for the individual being gathered by the prospective employer or by anyone else carrying out the security investigation. It is therefore important that there is protection in place so that the information is not used for purposes other than those intended. In our assessment, the current level of protection is not sufficient in all respects. We therefore propose an amendment to the Public Access to Information and Secrecy Act and a supplementary provision in the Act on the duty of secrecy regarding private actors. Security-protected procurement involving classified contracts should be retained in the new legislation.