Frequently Asked Questions

What is a state secret?
What is classified information of a foreign state and how should it be treated?
Which legal acts provide for the protection of state secrets and the classified information of a foreign state?
Who is granted the right to access state secrets?
What is a national security clearance?
What is a security vetting?
Where may one process a state secret?
What are the NATO security classification levels?
What are the EU security classification levels?
How should a document that contains classified information be marked?
How can one apply for a PSC for access to classified information of a foreign state?
What is the penalty for disclosure of a state secret and classified information of a foreign state?
How long is the process for applying for a national security clearance and a PSC for access to a state secret?

What is a state secret?
As provided by Article 3(1) of the State Secrets and Classified Information of Foreign States Act, a “state secret” means information provided for solely in this Act or legislation issued hereunder which requires protection from disclosure in the interests of the national security of the Republic of Estonia or international communication, with the exception of classified information of foreign states.

This definition contains two important characteristics: (a) information must be classified as a state secret in the State Secrets and Classified Information of Foreign States Act and (b) it must require protection from disclosure in the interests of the national security and foreign relations of the Republic of Estonia.

Articles 4 – 8 of the Procedure for the Protection of State Secrets and Classified Information of Foreign States give an exhaustive description of the types of information that require protection from disclosure in the interests of national security and foreign relations. Information matching the description is deemed to be a state secret regardless of what it is being used for and in which form it can be found.

What is classified information of a foreign state and how should it be treated?
The State Secrets and Classified Information of Foreign States Act gives the following definition: Classified information of foreign states means information originating from a foreign state, the European Union, NATO or other international organisation or an institution established under an international agreement which is communicated to Estonia on the basis of international agreements, and that has been classified as secret by its originator and information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified , as provided by the international agreement.

Therefore, the law attaches two parameters to the classified information of a foreign state: (a) the information originates from some foreign state, international organisation or an institution established under an international agreement and (b) its originator has classified it. Estonia shall exchange classified information with states that we have concluded agreements on the protection of classified information with and such information is protected according to the provisions of such agreements.

Secondly, the definition provided by the law states that classified information of a foreign state is information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified, as provided by the international agreement. This means that it is also possible to create classified information of a foreign state in Estonia, for example, within the framework for the participation in some NATO programme and therefore the positions, classified under NATO Classification guidelines and not according to the provisions of the State Secrets and Classified Information of Foreign States Act of the Republic of Estonia represent the classified information of NATO and not Estonia.

For that reason, requirements and protective measures applicable to the state secrets of Estonia are applied in the protection of classified information of a foreign state, with consideration to the level of classification of classified information of a foreign state and its conformity to the respective level of classification in Estonia and specifics defined in legislation of Estonia and international agreements for processing classified information of a foreign state.

The protection of NATO and European Union classified information is additionally protected under the respective documents, issued by these organisations. In NATO, these documents are NATO Security Policy C-M(2002)49 and in the European Union, the same purpose is served by a Council Decision no. 264 of 19 March 2001, by which the Council's security regulations (2001/264/EC) were adopted.

Which legal acts provide for the protection of state secrets and the classified information of a foreign state?
General requirements to the protection of classified information are laid down with the State Secrets and Classified Information of Foreign States Act. It specifies the definition of a state secret, types and levels of information classified as state secret, access to state secrets, and the grounds for processing state secrets and classified information materials, but also the general provisions for the protection of classified information of a foreign state. The provisions of international agreements shall apply to the protection of classified information of a foreign state, in addition to the State Secrets and Classified Information of Foreign States Act.

In compliance with the duties arising from the State Secrets and Classified Information of Foreign States Act, the Government of the Republic has adopted the Procedure for the Protection of State Secrets and Classified Information of Foreign States, which lays down more specific procedures for the processing of classified information materials and requirements to persons and authorities processing such information.

As provided by the Procedure for the Protection of State Secrets and Classified Information of Foreign States, each legal person in possession of a state secret is required to adopt in-house regulations for the protection of state secrets. 

Who is granted the right to access state secrets?
As provided by Article 26 of the State Secrets and Classified Information of Foreign States Act, there are various grounds that grant access to state secrets:

(a) as a general rule, access rights to CONFIDENTIAL and highly classified information are provided on the basis of a national security clearance.

(b) access rights to state secrets may be given by virtue of office. Access right by virtue of office shall mean that for obtaining the access rights, it is sufficient to be in an appropriate office and have justified need-to-know that would grant access to classified information. The positions that grant access to state secrets by virtue of office are laid down in Article 27 of the State Secrets and Classified Information of Foreign States Act. The following have the right by virtue of office to access state secrets, regardless of the classification thereof: the President of the Republic; a member of the Parliament; a member of the Government of the Republic; judges; the Commander and Commander-in-Chief of the Defence Forces; the Chancellor of Justice and his/her Deputy-Advisor; the Auditor General; the President of the Bank of Estonia and the Chairman and Members of the Board of the Bank of Estonia.

Access to state secrets by virtue of office is also applicable to state secrets classified as RESTRICTED. This means that a person wishing to only access a state secret classified as RESTRICTED is not required to obtain a security vetting; it is sufficient to hold an office that requires right for access to a state secret of an appropriate level of classification. The list of such offices shall be adopted by the head of an agency.

(c) A person in respect of whom witness protection measures are applied pursuant to the Witness Protection Act and the advocate representing the aforementioned person have the right for access to state secrets concerning his/her protection without a national security clearance or compliance with the requirement to pass a security check.

(d) the law also provides a fourth alternative for access to a state secret. Participants in pre-trial proceedings or judicial proceedings in criminal, civil or administrative matters, or matters of misdemeanour have the right for access, after passing the security check, to state secrets on the basis of a reasoned order of an investigative body, Prosecutor’s office or a court ruling if access is unavoidably necessary for the adjudication of the criminal, civil or administrative matter, or the matter of misdemeanour.

What is a national security clearance?
A national security clearance is a document, which verifies that you have been granted the right of access to state secrets and that is issued by an authority that conducts a security vetting, once you have passed a security vetting.

What is a security vetting?
As provided in Article 47 of the State Secrets and Classified Information of Foreign States Act, in order to obtain a national security clearance or to be granted extension of the term thereof (in the case of a legal person to obtain a processing permit or to be granted extension of the term thereof), an applicant must pass a security vetting. The purpose of the security vetting is to determine whether the person meets the requirements for issue of a security clearance or extension of the term thereof.

While a national security clearance for access to state secrets is not required for obtained access to information classified as ‘restricted’, security vetting may be still performed with regard to persons who have the right to access state secrets classified as "restricted" by virtue of office.

Basically, a security vetting means that an authority that conducts security vetting to determine whether the person applying for a security clearance for access to state secrets complies with the criteria, established for the access to state secrets or not, by conducting covert investigations within the limits. The Act also provides the absolute bases (§ 32 (1)) for refusing the issue or extension of the term of a national security clearance to a person; the bases for refusing the issue or extension of the term of an access permit to a person, subject to the right of discretion (§ 32 (2)), that allow consideration of the person concerned and circumstances related to his/her activities, are listed separately.

The requirement for a security vetting is not applied in the case of those persons who have access to state secret by virtue of office, as specified in the State Secrets and Classified Information of Foreign States Act; nevertheless, if an international agreement has defined security vetting as a pre-requisite for granting access to classified information of a foreign state, security vetting shall be also conducted with regard to these persons, with the exception of the President of the Republic.

Where may one process a state secret?
As provided by the State Secrets and Classified Information of Foreign States Act, information classified as CONFIDENTIAL or a higher level may only be processed within a security area. A security area shall mean an area where the processing of classified information is permitted and that meets certain requirements (access to the area must be identifiable and controllable; the area must be protected with an alarm system; there are also restrictions in regard to the presence of persons with no security clearance in the security area).

Information classified as RESTRICED may also be processed in an administrative area. This regards all the official premises, which are at the disposal of an authority.

What are the NATO security classification levels?
The NATO levels of classified information and corresponding levels of classification of state secrets of Estonia are the following:

Documents are often marked as NATO UNCLASSIFIED. This does not mean classified information, but refers to information that still needs to be protected from being disclosed and the distribution of such information is performed according to a ‘need to know’ basis, similar to the Estonian marking of ASUTUSESISESEKS KASUTAMISEKS.

What are the EU security classification levels?
The European Union levels of classified information and corresponding levels of state secret of Estonia are the following:

In some cases, the English language equivalents may be used instead of French language classification level terms (EU SECRET, EU CONFIDENTIAL, EU RESTRICTED). Documents that bear this kind of marking are also treated as EU classified information although the French language marking is used for the purpose of official regulations (with the exception of TOP SECRET where the classification marking is given simultaneously in French and English).

The marking LIMITÉ is sometimes used on the EU documents; this refers to information that is not classified but still needs to be protected from being disclosed, and the distribution of such information is performed according to a ‘need to know’ basis, similar to the Estonian marking of ASUTUSESISESEKS KASUTAMISEKS.

How should a document that contains classified information be marked?
Classified documents must be marked by the person who has drawn up the document immediately upon the drafting of such a document, by applying the marking that complies with the level of classification (PIIRATUD, KONFIDENTSIAALNE, SALAJANE or TÄIESTI SALAJANE) on the upper and lower edges of the document (capital letters, font size 16). If a classification marking cannot be applied with text processing software (for example, logos on a letterhead do not allow for printing of the marking or the documents are not available as a hard copy), a classification marking can be later added with an impression of the seal (after being printed). The State Secrets and Classified Information of Foreign States Act also defines that Classified media may be marked by additional marking that refers to additional security measures applicable to media or circle of persons, which has the right for access to the media.
 
In addition to the classification marking, the grounds for classification are also marked on the front page of a document. If a document contains a state secret of Estonia, one of the provisions of articles 4-8 of the Procedure for the Protection of State Secrets and Classified Information of Foreign States is given as the grounds for classification. If there are several grounds for classification, all these shall be marked on the media. The term of classification must be also stated on a document. Incurrence of a certain event may also serve as a classification term in addition to a year. The registration number and date of registration must be marked on classified media.

If expedient, it is also possible to mark classified media additionally by paragraphs and illustrations, etc., to make it clear which part of the information is classified and at which level for the readers, but also to indicate parts of the media that are free of any restrictions. Here it should be noted that the document as a whole shall be given the highest classification level attached to parts thereof.

If a document, containing a state secret of Estonia, is communicated to a foreign state or an international organisation, classification marking must be given on the document, as required by the international agreements concerned; a marking, in English, stating that the document contains a state secret of Estonia (“Classified as State Secret of the Republic of Estonia”), must be given in the right-hand corner of the front page of the document.

A document, containing classified information of some other foreign state or an international organisation, shall be marked with the appropriate level of classification, indicated in the originator of classified information in the appropriate international agreement, and the required marking. “SALASTATUD VÄLISTEAVE (classified information of a foreign state) must be indicated in the right-hand corner of the front page of the document, completed with the name of the originator of classified information of a foreign state, level of classification and classification term, if specified.

How can one apply for a Personnel Security Clearance Certificate for access to classified information of a foreign state?
See: Description of the Rules and Procedure for Access to Classified Information of Foreign Countries.

What is the penalty for disclosure of a state secret?

Penalties for committing an offence related to state secrets are laid down in the Penal Code:

Article  52¹. Deprivation of a Right for Access to State Secret and Classified Information of a Foreign State and Right to Process State Secret and Classified Information of a Foreign State

Additional punishment, consisting of deprivation of right for access to state secrets and classified information of a foreign state or deprivation of right to process state secrets and classified information may be imposed on an offender for the violation of the State Secrets and Classified Information of Foreign States Act for the period of one year by court ruling or the decision of a body conducting extrajudicial proceedings.

Article 55¹. Imposing an Additional Punishment on a Legal Person for an Offence

The following additional punishment may be imposed in cases provided by law:
1) deprivation of right for access to state secrets and classified information of a foreign state or deprivation of right to process state secrets and classified information may be imposed on a legal  person offender by a court ruling or the decision of a body conducting extrajudicial proceedings in cases specified in Article 52¹ of the Penal Code.

Article 241. Disclosure of state secrets and Classified Information of a Foreign State

(1) Disclosure or illegal communication of or provision of illegal access to information classified as a state secret or classified information of a foreign state, if such act does not comprise the necessary elements of an offence provided for in Article 232 or 234 of this Code, is punishable by a pecuniary punishment or up to 5 years’ imprisonment.

(2) The same act, if committed by a legal person, is punishable by a pecuniary punishment.

Article 242. Disclosure of State Secrets and Classified Information of a Foreign State Through Negligence

(1) Disclosure, illegal communication, or granting of illegal access to state secrets by a person, required to safeguard a state secret, if the conduct was due to negligence, and also the loss of classified media containing state secrets or classified information of foreign states, if:
1) this causes considerable damage to the security of the Republic of Estonia, a foreign state, an international organisation or an institution established under an international agreement; or
2) the object of an offence was a state secret classified as ‘secret’ or ‘top secret’ or classified information of a foreign state,
is punishable by a pecuniary punishment or imprisonment of up to one year.

(2) The same act, if committed by a legal person, is punishable by a pecuniary punishment.

Article 316². Classification of Information with no Legal Grounds and Classification of State Secret or Classified Information of a Foreign State at Wrong Legal Grounds, Wrong Classification Level or Term

(1) The classification of information with no legal grounds or the classification of a state secret or classified information of a foreign state at the incorrect legal grounds, level or for an incorrect term with the purpose of preventing the existence of an act classified as a criminal offence or its absence or identification or other circumstances of subject of proof is punishable by a pecuniary punishment or from one to five years’ imprisonment.
(2) The same act, if committed by a legal person, is punishable by a pecuniary punishment.
(3) A person shall not be relieved from responsibility when committing an offence, specified in this Article, if the information was declassified or the legal grounds, classification level or term for classification of such information was changed after the commitment of such offence.

Penalties imposed for the violation of requirements for the protection of state secrets is also defined by the State Secrets and Classified Information of Foreign States Act:

Article 53. Liability for the Violation of Requirements for the Protection of State Secrets

(1) Violation of requirements for the protection of state secrets by a person holding the right for access of state secrets, if accompanied by danger of disclosure or becoming known to a person with no right of access, processing of information as state secrets with no legal grounds, classification of state secret on wrong legal grounds, at an incorrect level or for a wrong term, failure to classify a state secret, failure to declassify a state secret after the lapse of a threat to security before the expiry of classification term or failure to comply with the notification requirement, specified in clauses 19 3), 4), 6) and 7), subsection 32 (4), subsection 42 (6) or § 45 of this Act – shall be punishable by a fine of up to 200 fine units or detention.

(2) Conduct specified in subsection (1) of this section, if the object of a misdemeanour is a state secret classified as ‘secret’ or ’top secret’ – shall be punishable by a fine of up to 300 fine units or detention.

(3) Conduct specified in subsection (1) – (3) of this section, if committed by a legal person – shall be punishable by a fine of up to 500,000 EEK.

Article 54. Disclosure of State Secrets Due to Negligence and Loss of Classified Media

(1) Disclosure, illegal communication or granting of illegal access to state secrets by a person, required to safeguard a state secret, if the conduct was due to negligence, and also the loss of classified media – shall be punishable by a fine of up to 300 fine units or detention.

(2) The same act, if committed by a legal person – shall be punishable by a fine of up to 500,000 EEK.

Article 55. Liability for the Violation of this Act

(1) A person shall not be relieved from responsibility when committing a misdemeanour, the object of which was a state secret, information was declassified or the legal grounds, classification level or term for classification of such information was changed, except if there were no legal grounds for the classification of such information. A person shall be responsible for classification of information with no legal grounds also after the declassification of such information.

(2) If a person is deprived from a right for access to a state secret or the right for processing state secrets and classified information of a foreign state outside an immovable or a movable possessed by a state agency or Eesti Pank for commitment of a misdemeanour under the State Secrets and Classified Information of Foreign States Act or legislation issued on the basis thereof, such a person must apply again for the respective right for access or processing permit to obtain right for access or processing right.

How long is the process for applying for a national security clearance and a PSC for access to a state secret?

§ 33 of the State Secrets and Classified Information of Foreign States Act defines the term for the issue of a national security clearance. The appropriate article states that the issue of a national security clearance or extension of the term thereof shall be decided by a head of an agency which performs a security check no later than within three months after the submission of a valid application. The issue of a processing permit or extension of the term thereof shall be decided not later than within two months in the case of natural persons and not later than within six months in the case of legal persons, after the submission of a valid application.

The Procedure for the Protection of State Secrets and Classified Information of a Foreign State stipulates that documents required for the application of a PSC must be supplied at least one (1) month before the expected commencement date of the PSC. Documents necessary for the issue of a certificate of a security clearance must be submitted at least one (1) week before the expected commencement date of the certificate. This period also includes the processing of the received applications by the National Security Authority and organisation of a briefing, which introduces the safety requirements governing the processing of classified information of foreign states to the applicant for a certificate.