activity report_2012.pdf

ROMANIA The Romanian Intelligence Service REPORT On the Activity of the Romanian Intelligence Service in 2012 The Service above us and the country above all www.sri.ro 1  TABLE OF CONTENTS CHAPTER I RELEVANT DEVELOPMENTS OF THE SECURITY ENVIRONMENT IN 2012 CHAPTER II THE MAIN PARAMETERS OF THE ACTIVITIES PERFORMED IN 2012 CHAPTER III PARAMETERS OF THE ACTIVITIES III.1. Intelligence activities III.2. Making use of intelligence III.2.1. Informing the decision makers III.2.2. Specific prevention measures III.2.3. Notifying the law enforcement authorities III.3. Protection against terrorist risks and threats III.4. Prevention and countering cyber threats III.5. Protection of classified information CHAPTER IV NATIONAL AND INTERNATIONAL COOPERATION IV.1. Inter-institutional cooperation IV.2. International cooperation IV.2.1. Bilateral cooperation IV.2.2. Multilateral cooperation 2 CHAPTER V COORDINATION AND CONTROL OF SRI’S ACTIVITIES V.1. Strategic coordination of the activities by the Supreme Council for National Defense V.2. Democratic control V.2.1. Parliamentary oversight V.2.2. Legal control V.2.3. Financial control CHAPTER VI COOPERATION WITH THE CIVIL SOCIETY VI.1. Relations with the civil society and the security education VI.2. Relations with the public and mass-media VI.3. Transfer of the Securitate files CHAPTER VII RESOURCES MANAGEMENT VII.1. Human resources management VII.1.1. Human resources parameters VII.1.2. Professional training VII.2. The management of financial and logistic resources CHAPTER VIII 2013 PRIORITIES VIII.1. Overview VIII.2. Objectives and guidelines for 2013 3 CHAPTER I RELEVANT DEVELOPMENTS OF THE SECURITY ENVIRONMENT IN 2012 In 2012, SRI made consistent efforts in order to manage a complex and dynamic operational situation, adjusting its specific actions to prevent and counter the risks and threats to national security. In the context of instability in Northern Africa and the Middle East, one of the most relevant developments in terms of security was represented by an increase in terrorist risks, meaning that the threat to Romania turned into a direct one, though in the absence of an imminent terrorist attack. The transformation of our country from a generic target into an explicit target was evidenced by both the Burgas attack and the statements of the jihadist ideologist Omar Bakri (who indicated our country as a potential target). The strategic commitments that outline Romania’s Euro-Atlantic profile – its involvement in the fight against global terrorism, its military participation in various conflict areas/theatre of operations – play a part in maintaining our country under the scrutiny of terrorist entities, and require that preventive measures be taken accordingly. Additional focus on security was entailed by an increase in illegal migration flows originating in areas affected by instability (MENA, Afghanistan-Pakistan) and by the upward trend of Islamic propaganda (the Internet remaining the main tool for the dissemination of Islamic messages). These developments are compounded by the persistence of certain domestic vulnerabilities in terms of regulations, procedures or even determined by eluding certain legal provisions (some of these are present in other EU countries as well). More precisely, this category encompasses deficiencies in the video monitoring of public locations and other public interest facilities that might be targeted by terrorist attacks, and non-compliance with tourist registration regulations. Under these circumstances, it was possible to keep the terror alert level - Cautious – Blue due to the preventive measures taken in the case of individuals suspected of terrorist intentions or activities (declaring them as undesirable, not allowing them to enter the country, determining them to renounce to their plans, etc.), and to domestic (within SNPCT - the National System for Preventing and Countering Terrorism) and foreign cooperation. Considering that the cyberspace has become the scene of a new type of war involving traditional state actors as well as non-state ones, the cybernetic threat is of increased concern. The cybernetic attacks aimed at domestic institutions with responsibilities in the field of foreign policy and national security (annihilated with the help of SRI) attest to the fact that Romania is a target for hostile entities acting in cyberspace and interested in gaining access to IT systems of national interest and collecting information. In 2012, the Red October cybernetic attack, cybernetic espionage, IT organized crime activities were highly aggressive and, secondarily, hacktivism. The Service was involved in countering them by means of providing technical expertise to targeted public 4 institutions, and through its cooperation with prosecution bodies and with foreign partners, as the case may be. This type of attacks are compounded by the insufficient cybernetic security of the IT systems managed by domestic operators, especially in the context of a significant development of the ITC systems and of an increased use of ITC technology in Romania (for example, the implementation of IT systems in the health sector). Moreover, the recent multiplication of databases managed by national institutions and authorities, and especially their prospective interconnection requires a coordinated and coherent approach in implementing both major projects designed to create the information society and cybernetic security ones (the vulnerabilities in one respect extending to the system). Additionally, the competition from the private sector causes the migration of specialized human resources from state entities (mainly because of low wages), and filling those vacant positions is difficult to achieve given the restrictions in respect of public sector employment. Hardware and software obsolescence as against the rapid development of new technologies also affects the capacity to ensure IT security. An activity that continued to be identified in this period was espionage, carried on through classical means by intelligence structures from various states, subsumed under the foreign policy actions promoted by the states of origin and related to major regional/international developments. The status of NATO and EU member state, Romania’s participation in Euro-Atlantic decision-making processes and mechanisms, in setting up the US anti-missile shield (by hosting on the national territory some of its components) and the presence of US military facilities on the national territory place our country under the scrutiny of players with divergent interests. In relation to these activities, the deficiencies in terms of the protection of classified information by the entities possessing them continue to be a domestic vulnerability. As an EU border state, Romania has been targeted by cross-border organized crime networks specialized in smuggling (excisable goods, counterfeit goods, cigarettes), various typed of trafficking (drugs, weapons) or illegal migration (there is a growing migration pressure at non-EU borders against the background of continuing tensions in MENA). Domestic criminal groups continued to act mainly in European countries, but extended their operations to Canada and the US as well (in addition to cybercrime, illegal migration and human trafficking activities have also been identified and brought to the attention of judicial bodies). These have substantial negative consequences on Romania’s international image as well, impacting on the freedom of movement of Romanian citizens to the US. On the other hand, the tendency to use violence, including military force, by certain organized crime groups, coupled with consistent efforts to protect their own fields of action has been reconfirmed. In terms of weapons of mass destruction and conventional armament counter- proliferation, the main risks and threats to Romania’s national security stemmed from the arming programs of certain states subject to international embargoes, and the turbulence in the Middle East security environment. An important role that fell upon the Service, in cooperation with the relevant authorities, was to avoid the breach of the sanctions imposed on proliferating states, especially in the context in which Constanța port is among the routes targeted by the exponents of those interests. 5 Although on a downward trend as compared with the previous interval, the black market remained substantial despite the measures taken to counter tax evasion, including inter-institutional arrangements. The main fields where represented by: food, energy, constructions, alcohol and related products, tourism, transportation, wood, labor („black” or „grey”). Significant losses to the state budget have been caused by intra-community transactions, “shuttle” operations or “carousel” fraud, as well as by the involvement of dummy corporations on the tax evasion circuit or unjustified requests for VAT refunds. The entities involved in tax evasion were constantly supported by representatives of the bodies that perform controls and impose sanctions, significant pressures being made in order to subordinate employees in institutions with border security responsibilities. Although it is a great opportunity to counter the effects of the economic crisis, the absorption of EU funds remained inadequate and, as a consequence, development gaps as compared with the EU continue to exist especially as the European Commission is more and more consistent in applying financial corrections. Against this background, foreign investments were low, and the economic growth resumed slowly, so that the negative effects of the crisis, including the social ones, continued to be present. The impoverishment of citizens in the context of prolonged economic and financial difficulties is a premise for the manifestation of social tensions having economic roots, and also for the propagation of extremist ideologies. The risk that legitimate protests might be diverted by the exponents of extremist movements and/or that they might degenerate into violence requires the cooperation of national structures with public order and security responsibilities. While up to now no large-scale extremist actions have been organized, the actions carried out by similar foreign organizations represent an inspiration to domestic followers, having the potential to significantly influence the level of activism and the manner of public expression, eroding the credibility of domestic authorities and of their public interest actions. A particular form of extremism, the ethnic one, is represented by the activities performed by the offshoots of Hungarian revisionist structures in our country. A factor with a significant contribution to the persistence of social and economic difficulties has been the large-scale corruption in public institutions, illegitimate interests groups acting so as to divert in their own interest the decision-making process in various fields (mainly public administration – preferential allocation of funds, discretionary awarding of public procurement contracts, etc.), and the administration of justice. Non-compliance with the legal framework on transparency while holding public positions, and the cases of incompatibility or conflict of interest have been a constant of the period, public interest being thus seriously affected. Such situations have also affected the citizens’ constitutional rights to education and healthcare, in addition to chronic underfunding, inadequate management (in many cases taking the form of unwise management of available resources) and human resources deficiencies (inadequate training, lack of qualified personnel). 6 The dynamics of the risks and threats to national security require a permanent adjustment of the Service’s specific missions – from prevention to countering – and the flexible configuration of its capabilities with a view to fulfilling the institution’s legal responsibilities, especially through the management of human resources, but also subject to meeting the material and financial needs at a satisfactory level at a minimum. 7 CHAPTER II THE MAIN FEATURES OF THE ACTIVITIES PERFORMED IN 2012 In order to continue the steps taken during the previous year to implement The Strategic Vision for 2011-2015 “SRI in the Age of Information”, 2012 witnessed a stage of the new strategic cycle, the main efforts being focused on: - maintaining the operational performance parameters – even with limited resources, by using the institutional planning system which allowed for adjustments and reallocations according to priorities - strengthening inter-institutional cooperation, including in respect of operative activities; - extending bilateral and multilateral international cooperation, with direct advantages in terms of strengthening the Service’s profile within the European and Euro-Atlantic intelligence community, as well as for the proper representation of Romania’s interests; - implementing the new human resources management system; - developing relations with the civil society and the academia as part of the Service’s objective to promote the culture of security and strengthen the communication with the public. Among the significant developments in 2012, the following should be emphasized:  from an institutional perspective - preserving the status of pivotal institution in the field of national security, by accurately adjusting its activities according to the multiple developments in the security context, and as a result there were no strategic surprises that the Service could not handle; - strengthening the capacity to coordinate the Service’s policies and strategies, including by way of specific implementation/operationalization plans and mechanisms for making efficient use of “lessons learned” and disseminating “best practices”; - taking further steps to increase flexibility and reduce bureaucracy by way of new norms or procedures, relevant especially for operational activities; - designing, testing and completing tools for the analysis and assessment of security risks, with a view to prioritizing operational efforts and the allocation of resources;  from an operational perspective - maintaining high operational performance parameters despite limited resources (by using the institutional planning system which allowed for adjustments and reallocations according to priorities); - continuing the structural and functional assessment and organizational reconfiguration process so as to achieve an optimal management of resources in accordance with the magnitude of the threats to national security; 8  - using unitary approaches within the territorial structures and improving their correlation with the priorities set by central units, simultaneously with a higher degree of flexibility of local actions; - initiating new measures to increase the efficiency of the activities that use covert human sources and using their potential to provide intelligence and their mobility in complex operations; - developing the traditional operational partnerships and establishing new ones; - performing specific activities meant to investigate and counter cybernetic attacks; - strengthening SRI’s role of national authority for the prevention and countering of terrorism, as evidenced by the achievement of significant results, and ensuring coherent relations with SNPCT players and foreign partners;  in terms of analysis and briefing - improving the quality, substance and complexity of the reports submitted to legal beneficiaries; - ensuring a better adjustment to the information needs of decision- makers (emphasizing the anticipatory and preventive nature of the reports), as evidenced by having twice as many responses and subsequent measures taken at the central level, concurrently with correlating the briefing process with the institutional changes, which made possible the avoidance of strategic surprises; - increasing the cooperation between the analysis and operational structures, including by setting up joint teams and actively participating in working groups within the Service on various regions or topics in order to make better use of the fund of information and guide the operative structures in accordance with the beneficiaries’ needs; - increasing the operational analysis capability, by generating timely and high-quality information products; - enhancing the involvement of territorial structures in the information analysis process, through a diversification of the topics (covering various lines of work) and of the types of reports submitted to local beneficiaries; - regulating and developing the OSINT activity, by surveying a considerable volume of virtual sources and ensuring the early alert function (including for beneficiaries outside the Service); - giving