activity report_2012.pdf

unication Service (STS), the Foreign Intelligence Service (SIE) and CERT-RO, of relevant measures in order to reestablish the proper functioning of those networks (in the case of Red October);  as part of the cooperation among SRI, DIICOT and FBI, 7 members of a local cyber-crime group were placed under arrest for perpetrating numerous cyber- attacks against various American banks and financial organizations by accessing 22  personal data and banking information and thus causing damages estimated at approximately 240 million USD.  the detention of 30 individuals affiliated to an organized crime network (with ramifications in the counties of Argeș, Teleorman and Vâlcea) specialized in IT fraud, which swindled 350 persons in USA, Canada and Great Britain, causing damages of over 8 million USD;  the arresting of 3 members of Anonymous Romania, a group that launched, in January 2012, a series of cyber-attacks on several Romanian state structures, while they were also taking part in organizing cyber aggressive actions on entities in the United States, Czech Republic, Serbia, Poland and Brazil or in supporting the attacks orchestrated by Anonymous International on various information systems from outside Romania. As a continuation of the above mentioned activities, our Service made constant efforts to ensure an optimal level of functioning of CYBERINT National Center which monitors/collects information on events/incidents carried out in the cyber-space and validates the proper measures needed to be adopted. Therefore, our Center launched various projects meant to increase its technical capacities, so as to design up a system intended to take over and store data which would be conveyed to public authorities and structures that are connected to the Joint State Infrastructure of Electronic Communication as a means to identify the sources of cyber-attacks. Some of those projects are: establishing and developing a malware analysis laboratory; setting up a map that would include sources of risks to information systems; creating a documented database of risks and vulnerabilities, as well as of weapons and attack methods used in cyber-space. In 2012, our Center cooperated with important IT&C companies, so the number of the Internet providers for which daily reports are generated increased. Furthermore, the activity of our Center also focused on developing cyber instruments meant to support the SRI experience at the operational level in order to help the Service fulfill its specific missions. SRI took part in and made a significant contribution to the national plan on designing an integrated system that should counteract specific cyber threats, as part of the national legal framework that should be adopted in order to regulate the specific ways and responsibilities of the state authorities in ensuring national security within the cyber- space. As a result of the good cooperation between institutions, a national strategy for cyber security was adopted at the end of 2012, and SRI played an important role in bringing it up. This strategy also referred to a cooperation methodology for the new national cyber security system (which included the competent state authorities and institutions). In line with its internal activities, the Service made an outstanding contribution to coordinate the institutional effort meant to ensure Romania’s position and role within the cyber security strategy of the European Union. 23 At the same time, SRI’s representatives took part in various international cooperation missions that were targeted at the exchange of best practices and expertise in the field. III. 5. The protection of classified information As part of its obligations as a competent authority in the field of ensuring the protection of classified information at a national, NATO and EU level, SRI carried on with its activities on the following dimensions:  the general coordination of its activity and the control of the necessary measures for the protection of the classified information by means of: - providing special assistance upon the request of the legal and natural persons who are authorized to access such information (427 cases); - performing control activities (724) aimed to verify how the persons who have access to classified information enforce the provisions of the law, identifying the risks and vulnerabilities and adopting the legal measures needed to prevent them;  the implementation of the specific security checks: - authorizing the programs targeted at preventing the leakage of the classified documents that were written (644 documents) or, as the case might be, the classified documents that were updated, filled in or modified (1060) by the entities that are granted to access the information SRI benefits from. In the above mentioned period, the number of requests for granting the authorization to attend the programs for preventing the leakage of classified information increased by 15% in comparison with 2011:  the granting of the authorization to access national and NATO/EU classified information to natural persons. The number of these requests increased by 43% in comparison with the last year.  the granting of the security authorization/certificate (228 requests), the granting of the special authorizations for aero-photography, filming, laser scanning or cartography of certain national objectives and areas that have a major importance in terms of state secret security (6 cases). As for the institutional cooperation with the designated security authorities, such as ORNISS and other institutions in the field of national security, SRI carried out the following activities related to the protection of classified information:  provided 3193 answers to requests (mainly for the Ministry of Administration and Interior, but also for the Foreign Intelligence Service and the Special Communication Service (STS)) concerning, for the most part, natural and legal persons who had been subject to security checks in order to be granted authorization to state secret information, and to enter into contractual agreements involving such data;  sent warnings to other competent authorities regarding the risk that its classified information might be compromised. 24 Comparably to the last years, SRI took part in or made a contribution to supporting official actions concerning classified information protection or related areas of activity. As for the proper collection, transportation, distribution and protection of classified national and NATO/UE correspondence on the Romanian territory, SRI fulfilled its duties as a competent authority in the field. It is important to underline that, in 2012, the correspondence increased in number at a central level by 3,38% in comparison with 2011 (2.581.272 documents being sent – envelopes, packages, transit folders), while the number of the beneficiaries increased by 4,48%. At the local level, the amount of correspondence reached a number of 7.970.793 documents that were being sent (by 4,54% less that in 2011), taking into consideration that the number of the beneficiaries decreased by 0,37%. The requests for correspondence express transportation also increased (by 40%), and the beneficiaries were mainly central public authorities and institutions that usually are entitled to express services, as well as other beneficiaries. During the last year, the focus was redirected to the frequent activities related to the adjustment of the routes and to the transportation program – simultaneously with the actions directed at ensuring the continuous and secure functioning of the specific activities -, the changes generated, among other things, by the reorganization of the public authorities/institutions (including the specific changes of address) or by extending the network of economic agents that are authorized to classified information and including them in a national system of collection, transportation, distribution and protection of classified correspondence. 25 CHAPTER IV NATIONAL AND INTERNATIONAL COOPERATION IV.1. Inter-institutional cooperation The cooperation with the other institutions in the security field was, in 2012 as well, one of the main responsibilities of SRI, as part of the common effort to preserve our national interests. Compared to the previous years, the inter-institutional relations were defined by a pro- active approach and by a tendency to aim to value more efficiently the institutional expertise in the fields where the Service has responsibilities as a national authority or as a designated security authority. SRI focused on collecting and sending relevant intelligence on these matters to its national partners and, at the same time, in other fields that the Service has to support by providing these law enforcement structures with intelligence. SRI acted in a consistent manner to ensure the efficient functioning of the National System for the Prevention and Countering of Terrorism, the development of CYBERINT capabilities, the protection of classified information and the highest efficiency of the analysis capacities from open sources. Concurrently, SRI took an active part in the inter-institutional activities targeted at managing important matters related to national security.  In order to optimize of the cooperation relationships, SRI constantly concentrated on improving the partnership framework with the other law enforcement bodies and institutions, at a technical level as well, on participating in a pro-active manner in joint operations and on ensuring an operational exchange of information.  Compared to the previous years, SRI became more involved in the inter- institutional cooperation and communication sessions, with visible outcomes related both to the benefits and the results of its participation, as well as at a quantitative level that was defined by an increase in the volume of the data and intelligence that resulted from the information exchange. This intelligence was, in fact, representative of the tangible results of a pragmatic management of the common interest aspects that mostly the experts dealt with. In 2012, the exchange of information covered 22.642 materials, the volume of information sent by SRI increasing by 16,29% compared with 2011.  The main cooperation relations were established with the Public Ministry, the Ministry of Administration and Interior (MAI), the Foreign Intelligence Service (SIE), the Ministry of National Defense (MApN), the Guard and Protection Service (SPP) and the Ministry of Justice.  The main problems that the Service dealt with were: - Tax evasion (in compliance with the national regulations that were issued by CSAT); 26  - Corruption and fraud related activities, as well as suspected money laundering practices; - Practices and activities associated to terrorism; - Risk factors for public order and for personal security; - Activities associated to organized crime; - Cross-border threats; - Ensuring the security of diplomatic objectives/missions and the prevention of the incidents that might have an impact on the physical integrity and lives of the persons who are under protection; - Risk factors for military security; - The prevention of the actions that might harm constitutional values; - Illegal activities of gathering intelligence for the benefit of other foreign entities; - Implications on national security originating from the evolution of the international security environment. The inter-institutional cooperation was carried out through various methods:  Operational exchanges of information on different matters related to national security. In 2012, compared to the previous year, there was a significant increase in the amount of information with the Ministry of Justice, the Public Ministry and with the Ministry of Administration and Interior;  Joint activities and missions that led to complex measures within SRI structures;  Security vetting and granting the authorization certificates in full compliance with the law;  Notifying and reporting to the legally designated bodies;  Technical and operational assistance or support in order to carry out complex missions that were initiated by other institutions in the field of national defense and security;  Sharing the experience and mutually supporting the personnel during its professional training and coaching. IV.2. International cooperation In 2012, the Service continued to be up to its high performance standards that had been set back in 2011, a year of performances in the field of cooperation in spite of all budgetary constraints, thus managing to strengthen its position. At the same time, the Service consolidated the relationship with its partners and witnessed an increase in the quantity and quality of the information and analysis products that were exchanged with other services or at a multilateral level (NATO, UE etc.). The bilateral cooperation involved complex and sensitive operations, frequent exchanges of information and expertise, as well as training programs organized by or for SRI. As for the relationship with NATO and UE, SRI strengthened its position as an important provider of crucial information aimed to support Romania’s interests on major issues. 27 Apart from the transfer of relevant information to NATO and EU intelligence structures, the Service considered a pro-active approach in order to promote various matters that are crucial to Romania’s interests (cyber security, energetic security and so on). Concurrently, SRI constantly focused on activities involving the exchange of expertise at the institutional level as a result of its participation in various NATO and EU events, and following the notifications SRI had sent to national decision-makers. By the end of 2012, the Service entered into several types of cooperation:  92 information and secret services from 64 countries;  29 law enforcement structures similar to SRI;  7 bodies with responsibilities in the field of coordination and control. At the same time, SRI had other responsibilities as:  a member of 6 multilateral partnership with other similar services;  a co-partner of other security structures re-united under the membership of various international organizations and bodies (OSCE, UNO, Interpol etc.), a co- partner in different European or international cooperation entities/initiatives (International Bomb data Center Working group – IBDCWG, The global Initiative To Combat Nuclear Terrorism – GICNT, International Association of Bomb Technicians and Investigators – IABTI, The Proliferation Security Initiative – PSI, The Wassenaar Arrangement etc.). New partnerships were established as a result of SRI’s systematic approach of its international cooperation, and given the evolution of the cross-regional and cross- sectorial security risks. Therefore, in 2012, in accordance with CSAT decision, SRI entered into the cooperation both with one of the Middle East information services, and with the French Network and Information Security Agency – ANSSI, the French cyber- security authority. In the above mentioned period, the total volume of messages sent and received by SRI increased by almost 20%. The number of meetings at the management level and at the level of experts taking part in international cooperation activities was similar to 2011. All these activities were carried out with budgets that were diminished compared to the previous years, given that the budgetary restrictions led to a decrease of SRI’s funds for international cooperation activities. As a consequence, the Service launched an activity prioritization program that would allow fulfilling its commitments with partners from abroad by identifying the proper solutions. IV.2.1. Bilateral Cooperation  SRI preserved its bilateral relations with the European and Euro-Atlantic services. As for its cooperation with certain partners from abroad, SRI’s rewarding operational results – in their diversity, by their amount and value – reconfirmed its privileged position in the relationship with these services.  At the same time, major evolutions were visible compared to the previous period in an effort to ensure a legal and operational framework based on common interests with similar services from the neighbor states (especially in order to 28  prevent the threats of cross-border organized crime – illegal migration, cigarette and drug trafficking, smuggling, intra-Community acquisition fictive declaration etc.). As a consequence, SRI signed border cooperation agreements and implemented new common programs aimed to ensure the interoperability of special structures.  Concurrently, special attention was paid to strengthening the cooperation with the services from the extended Black Sea region or from other regions that are strategic for Romania’s interests or generating security risks (Middle East and North Africa, Central and Eastern Asia e