activity report_2012.pdf

ectively). The Service’s partners in the national security system received 10.19% of the Service’s reports, as part of a common effort to counter the risks and threats to national security and as an expression of SRI’s concern for strengthening inter-institutional cooperation. 16 Another priority was to provide information to certain autonomous /independent organizations with regulating competences in specific /specialized fields (the capital market, the insurance market, the banking sector etc.), as well as to a number of authorities capable of taking immediate countering measures (the Court of Accounts, the Anti-Fraud Department etc.). The number of informative documents submitted to local beneficiaries decreased in 2012 by approximately 23% (totaling 2,345 analyses, out of which 1,954 were submitted to prefects and 599 to county council presidents). This trend was determined by the changes at the top of these institutions, which caused delays in SRI’s reports due to the time needed by the new beneficiaries to obtain the necessary authorizations for accessing classified information. Nevertheless, the Service has various emergency procedures and mechanisms in place for such cases, which enable it to provide information to these beneficiaries, provided that such information refers to imminent risks or threats to national security that are likely to have local manifestations. At the same time, it should be noted that in 2012 local beneficiaries were provided with assessments on a number of relevant developments regarding the domestic and international security environment with national /European implications (e.g. terrorism), aiming at developing a security culture and acting as a warning about the possible occurrence of such manifestations in the region. Likewise, the local beneficiaries’ feedback decreased by 24.8% compared to 2011 (when it amounted to 3,733 responses). Within the total feedback (about 99.5%), the number of reactions confirming the usefulness and timeliness of the Service’s reports is still high. This is a relevant indication of the fact that local beneficiaries value the quality and timeliness of the information provided by the Service. In fact, in 709 cases local decision-makers took action in order to remedy the situation, by carrying out inspections or enforcing sanctions. III.2.2. Specific Preventive Measures One of the Service’s concerns was to optimize prevention mechanisms by:  implementing unitary preventive measures with respect to the monitored security issues (some of which were reconfigured given the interconnection of the manifestations of risks or threats to national security);  harmonizing the operational activities carried out as part of the prevention process. In 2012, the Service implemented 3,713 preventive measures (compared to 5,194 in 2011). The decrease in number compared to the previous year was counterbalanced by an increase in terms of potency, as well as by their unitary and practical character, with direct and visible effects on the quality of SRI’s specific activity in this area of expertise. In terms of the targeted national security issues, the preventive measures had the following distribution: 17   counterespionage, support of foreign policy interests and protection of classified information – 42.23%;  defense of constitutional rights and values – 26.72%;  economic security – 15.94%;  identification and assessment of terrorist threats – 8.19%;  assessment and management of other cross-border threats – 5.76%;  identification and assessment of IT&C threats – 1.16%. The preventive measures consisted primarily of:  actions aimed at prompting certain individuals to refrain from activities that are likely to generate security risks;  recommendations to limit, interrupt or revoke the residence permit or to declare certain individuals as undesirable citizens;  recommendations to withhold /cancel authorizations granted under certain laws;  ensuring the security of certain institutions prone to be the target of terrorist acts;  actions aimed at putting an end to the activities carried out in Romania by various individuals in support of terrorist organizations;  individual training activities for self-defense against terrorist risks or against actions carried out by competing intelligence services;  protection of certain groups of tourists (e.g. in the context of the Burgas bomb attack);  specialized measures for the protection of classified information. III.2.3. Notification of the Criminal Investigation and Prosecution Bodies If the intelligence-gathering process resulted in the identification of serious offences prone to have an impact on Romania’s security interests, SRI, in line with the current legal provisions, notified the competent institutions responsible for the criminal investigation and prosecution of such acts, in addition to notifying its lawful beneficiaries and taking specific preventive measures. As part of the activities related to the notification of the local and central law enforcement bodies, the Service focused its attention on enhancing its expertise and optimizing legal certainty. Likewise, steps were taken in order to ensure a high use value of the information products that are submitted to the institutions in charge of the criminal investigation and prosecution of a number of offenses that are likely to have a serious impact on national security. Great emphasis was placed on enhancing the quality and consistency of the data and information submitted to the law enforcement agencies, as well as on the prompt dissemination of the information related to the perpetration of offences to the criminal prosecution bodies, so as to avoid missing out on relevant information or on opportunities to gather evidence. 18 Moreover, the Service’s legal experts (from central or regional level) were often invited to take part in joint task groups established within certain structures of the criminal investigation and prosecution bodies. The total number of notifications was significantly higher than in the previous year (2,689 in 2011), amounting to 3,289. The Public Ministry received 1,770 reports (compared to 1,379 during the previous year):  the Prosecutor’s Office of the High Court of Cassation and Justice (PICCJ) – 25;  the Directorate for the Investigation of Organized Crime and Terrorism (DIICOT), central unit – 160;  the Directorate for the Investigation of Organized Crime and Terrorism (DIICOT), regional units – 413;  the National Anticorruption Directorate (DNA), central unit – 418;  the National Anticorruption Directorate (DNA), regional units – 442;  the Prosecutor’s Offices attached to the Courts of Appeal – 44;  the Prosecutor’s Offices attached to the Tribunals – 178;  the Prosecutor’s Offices attached to the Courts of First Instance – 90. The Ministry of Administration and Interior received 554 notifications /reports:  the Anticorruption General Directorate – 66;  the General Inspectorate of Romanian Police – 38;  the County Police Inspectorates – 450. In 2012 SRI continued to participate in the nationwide efforts to counter serious economic offences, by carrying out documentation activities and submitting information to the criminal investigation bodies. In this respect, as part of the GLO and GLI structures (inter-institutional working groups established in line with the National Joint Action Plan for the enforcement of the CSAT Decision no. 69/2010 on the prevention and countering of tax evasion), the Service submitted 1,094 reports, out of which 965 (compared to 787 in the previous year) referred to potential elements of tax evasion- related offenses or to certain aspects prone to trigger the adoption of countering measures (inspections or other administrative measures). III.3. Protection against Terrorist Risks and Threats Similarly to the previous year, in 2012 there were no manifestations of either homegrown or “imported” terrorism in Romania, but the assessment of the situation revealed that the terrorist risk is currently higher. Unlike the previous years, the terrorist threat became more direct and explicit. This was mainly revealed by the intentions and activities of a number of individuals and terrorist entities aimed at perpetrating terrorist attacks in Romania or support the perpetration of similar acts in Europe. Moreover, the statements of the pro-Jihad ideologist Omar Bakri have the potential to exacerbate the terrorist threat, as they drew the attention of certain Jihad groups to Romania, motivating the possible perpetration of such attacks. 19 Due to the efficiency of the preventive measures adopted by the Service both internally (within the National System for Preventing and Countering Terrorism) and as a result of its foreign cooperation activities, it was possible to maintain the terrorist threat level (Blue-Cautious), as the actual terrorist threats were not imminent. Despite the complex situation in 2012, it is difficult to estimate whether the short-term actions perpetrated by terrorist entities will go beyond the exploratory stage and will result in concrete measures against Romania’s interests. In 2012 SRI, as national authority responsible for the prevention and countering of terrorism, was able to put an end to various activities that were likely to evolve into direct terrorist threats or were aimed at supporting certain terrorist organizations. In order to ensure the protection of Romanian citizens, institutions and interests against terrorist threats, the Service engaged into a number of specific actions, consisting mainly of:  preventive measures (436), some of which had a highly offensive character. Such measures were: declaring 15 foreigners as undesirable citizens (individuals who were involved in planning terrorist attacks in Romania, by disseminating radical Islamic propaganda or having connections with terrorist groups); 44 decisions to ban certain individuals from entering the country (for individuals suspected of terrorist activities or intentions); 99 warnings (issued for potentially terrorist threats – e.g. the Burgas bomb attack, the premiere of the movie “Innocence of Muslims”); 6 decisions to withhold /withdraw the authorizations issued in accordance with certain special laws 1; other 266 specific measures 2;  reports submitted to the criminal investigation and prosecution bodies (23). The cooperation with DIICOT and with the Prosecutor’s Office of the High Court of Cassation and Justice resulted in the dismantling of an illegal migration network whose members came from terror-prone regions;  protection of the diplomatic missions established in Romania that fall within the Service’s purview. On December 13, 2012 the security staff at the Embassy of the United Kingdom of Great Britain and Northern Ireland identified and detained a suspicious individual who intended to perpetrate a terrorist attack against British diplomats. Following the specific missions performed, the Service received 4 thank you letters from representatives of the embassies where the missions had been carried out; 1 Refusal to grant Romanian citizenship, denial of the Romanian visa, withdrawal of the refugee status. 2 Among which: 56 actions aimed at ensuring the security of certain institutions that are likely to be targeted by terrorist acts; 26 actions in support of the enforcement of national security-related regulations by various departments, institutions and organizations; 6 actions designed to inform and prepare the public with regard to potential threats and self-defense procedures; 37 actions for self-defense against terrorist risks. 20   antiterrorist and anti-hijacking control and antiterrorist protection on civil airports. The security check measures at the two international airports in Bucharest (“Henri Coandă”/AIHCB and “Aurel Vlaicu”/AIBBAV) were efficiently implemented and the potentially dangerous goods were discovered on time so that the appropriate legal actions could be enforced. The assessments performed by European Commission experts after 3 security inspections at AIHCB and AIBBAV did not reveal any deficiencies. The inspection committees commended the high level of compliance to the EU aviation security standards.  In 2012 the specific missions consisted of: (1) security checks on passengers and airport staff, luggage and cargo /postal deliveries; (2) security checks on the vehicles that are granted access to the CPSRA 3 and on airplanes; (3) executing the specific procedures in 3 cases of bomb threats on board the airplanes. The above-mentioned activities resulted in: - the identification of 17 weapons and 2,532 ammunition items owned illegally; - the discovery of 73,237 forbidden items and potentially dangerous objects for the security of flights, materials and /or substances that are subject to special requirements. In addition to ensuring the security of the two airports, other actions were also taken: (1) maintaining the equipment operational within nominal technical parameters and radiologically secure; (2) security checks on about 20,000 Spanish football fans who came to Bucharest for the “Europa League” final (following this event, the Service received two thank you letters from the Bucharest Airports National Company);  antiterrorist protection /guard, as well as antiterrorist /counterterrorist pyrotechnic intervention The following actions were taken: - pyrotechnic interventions at various institutions (embassies, diplomatic residences, AIHCB) targeting certain suspicious objects, antiterrorist technical checks on airplanes (following bomb threats) or even examinations of envelopes suspected of containing CBRN 4 agents; - 599 long-term missions for pyrotechnic intervention at AIHCB and AIBBAV (35 of which were carried out during certain events attended by high officials); - 142 antiterrorist technical checks on institutions where high officials /dignitaries were attending certain events (mainly at the request of the Guard and Protection Service) etc.; 3 Critical Parts of Security Restricted Area. 4 Chemical, Biological, Radiological, Nuclear. 21   deployment of armed sky marshals on flights, in line with the provisions of the Prüm Convention and of the EU Council Decision 2008/615/JHA. To this purpose: - a Terrorist Risk Map was created in order to prioritize the deployment of armed sky marshals on board the airplanes; - the Service established cooperation protocols with partner structures on the management of the armament used by the air marshals; - inter-institutional activities were carried out (SRI – Ministry of Transport – CN TAROM SA) in order to modify /broaden the National Aeronautical Security Program (approved at the end of 2012); - final actions were taken, in cooperation with the Ministry of External Affairs, for the approval of the MoU between the Romanian and the United States Governments regarding the deployment of air marshals on board the airplanes, which was signed in Bucharest on May 3, 2010 (GD 1249 of December 12, 2012). III.4. Prevention and Countering of Cyber Threats The evolution of cyber-attacks in 2012 reveals that cyber threats against Romania’s Critical Information Structures (CIS) are currently among the most dynamic threats to national security. As national authority in the field of cyber-intelligence, SRI took firm action and contributed (towards the end of the analyzed period) to the annihilation of one of the most powerful attacks, which targeted various institutions with foreign policy and national security responsibilities. Such attacks reveal that Romania is clearly targeted by hostile entities operating in cyber space and the cyber security level of the Romanian CIS is not sufficiently high to deal with such high-intensity malicious attacks. As a result, enhancing the identification and response capacities has become more and more imperative. At the same time, the technological developments and the trends identified in the area of cyber threats require medium and long-term legal and procedural measures, as well as the qualification of the workforce and the upgrading of the logistic and material supplies used by the organizations dealing with CIS. The constant specific actions aimed at preventing and countering cyber threats that were carried out by SRI in 2012 had tangible results designed to contribute to the improvement of national cyber security. The most relevant actions of this type were:  the prompt notification of the institutions targeted by cyber-attacks – the purpose of which was to access critical IT networks and to gather confidential information – and the adoption, in conjunction with the Special Comm