Frequently Asked Questions

What is classified information?

As provided by Article 3(1) of the Estonian State Secrets and Classified Information of Foreign States Act, “classified information” means information provided for solely in this Act or legislation issued hereunder which requires protection from disclosure in the interests of the national security of the Republic of Estonia or international relations, with the exception of foreign classified information.

This definition contains two important characteristics: (a) information must be classified according to the State Secrets and Classified Information of Foreign States Act and (b) it must require protection from disclosure in the interests of the national security and international relations of the Republic of Estonia.

Articles 4 – 8 of the Procedure for the Protection of State Secrets and Classified Information of Foreign States give an exhaustive description of the types of information that require protection from disclosure in the interests of national security and international relations. Information matching the description is deemed to be classified information regardless of what it is being used for and in which form it can be found.

What is foreign classified information and how should it be treated?

The Estonian State Secrets and Classified Information of Foreign States Act gives the following definition: Foreign Classified information means information originating from a foreign state, the European Union, NATO or other international organisation or an institution established under an international agreement which is communicated to Estonia on the basis of international agreements, and that has been classified by its originator and information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified, as provided by the international agreement.

Therefore, the law attaches two characteristics to the foreign classified information: (a) the information originates from some foreign state, international organisation or an institution established under an international agreement and (b) its originator has classified it. Estonia shall exchange classified information with countries that we have concluded agreements on the protection of classified information with and such information is protected according to the provisions of such agreements.

Secondly, the definition provided by the Act states that foreign classified information is information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified, as provided by the international agreement. This means that it is also possible to create foreign classified information in Estonia. For example, information generated within the framework of the participation in a NATO programme is classified under NATO Classification Guidelines and not according to the provisions of the Estonian State Secrets and Classified Information of Foreign States Act of the Republic of Estonia and therefore is classified information of NATO and not Estonia.

Requirements and protective measures applicable to Estonian classified information are applied in the protection of foreign classified information, with consideration to the level of classification of foreign classified information and its conformity to the respective level of classification in Estonia, also considering exceptions defined in legislation of Estonia and international agreements for processing foreign classified information.

The protection of NATO and EU classified information is additionally protected under the respective documents, issued by these organisations. In NATO, these documents are NATO Security Policy C-M(2002)49 and in the EU, the same purpose is served by a Council Decision no. 488 of 23 September 2013, by which the Council's Security Regulations (2013/488/EU) were adopted.

Which legal acts provide for the protection of classified information in Estonia?

General requirements to the protection of classified information are laid down in the State Secrets and Classified Information of Foreign States Act. It specifies the definition of a classified information, types and levels of classified information, access to classified information, and the grounds for processing classified information and classified materials, but also the general provisions for the protection of foreign classified information. The provisions of international agreements shall apply to the protection of foreign classified information, in addition to the State Secrets and Classified Information of Foreign States Act.

In compliance with the duties arising from the State Secrets and Classified Information of Foreign States Act, the Government of the Republic has adopted the Procedure for the Protection of State Secrets and Classified Information of Foreign States, which lays down more specific procedures for the processing of classified information and requirements to persons and authorities processing such information.

As provided by the Procedure for the Protection of State Secrets and Classified Information of Foreign States, each legal person in possession of classified information is required to adopt in-house regulations for the protection of such information.

Who is granted the right to access classified information of Estonia?

As provided by Article 26 of the State Secrets and Classified Information of Foreign States Act, there are various grounds that grant access to classified information of Estonia:

  1. as a general rule, access to CONFIDENTIAL level classified information and above is provided on the basis of a national security clearance.

  2. access to classified information may be also given by virtue of office. Access by virtue of office means that for obtaining the access rights, it is sufficient to be in an appropriate office and have justified need-to-know that would grant access to classified information. The positions that grant access to classified information by virtue of office are laid down in Article 27 of the State Secrets and Classified Information of Foreign States Act. The following have the right by virtue of office to access classified information, regardless of the classification thereof: the President of the Republic, a Member of the Parliament, a Member of the Government of the Republic, judges, the Commander of the Defence Forces, the Chancellor of Justice and his/her Deputy-Advisor, the Auditor General, the President of the Bank of Estonia and the Chairman and Members of the Board of the Bank of Estonia.

    Access to classified information by virtue of office is also applicable to information classified as RESTRICTED. This means that a person wishing to only access information classified as RESTRICTED is not required to pass a security vetting; it is sufficient to hold a position that requires access to classified information of an appropriate level of classification. The list of such positions shall be adopted by the head of an agency.

  3. A person in respect of whom witness protection measures are applied pursuant to the Witness Protection Act and the advocate representing the aforementioned person have the right for access to classified information concerning his/her protection without a national security clearance or compliance with the requirement to pass a security vetting.

  4. the law also provides a fourth alternative for access to classified information. Participants in pre-trial proceedings or judicial proceedings in criminal, civil or administrative matters, or matters of misdemeanour have the right for access, after passing the security vetting, to classified information on the basis of a reasoned order of an investigative body, Prosecutor’s office or a court ruling if access is unavoidably necessary for the adjudication of the criminal, civil or administrative matter, or the matter of misdemeanour.

What is a national security clearance?

A national security clearance is a document, which verifies that you have been granted the right of access to national classified information and that is issued by an authority that conducts a security vetting.

What is a security vetting?

As provided in Article 47 of the State Secrets and Classified Information of Foreign States Act, in order to obtain a national security clearance or to be granted extension of the term thereof (in the case of a legal person to obtain a facility security clearance or to be granted extension of the term thereof), an applicant must pass a security vetting. The purpose of the security vetting is to determine whether the person meets the requirements for issue of a security clearance or extension of the term thereof.

While a national security clearance for access to classified information is not required for obtaining access to information classified as RESTRICTED, security vetting may be still performed with regard to persons who have the right to access information classified as RESTRICTED by virtue of office, if deemed necessary.

Basically, a security vetting means that an authority that conducts security vetting determines whether the person applying for a national security clearance complies with the criteria, established for the access to classified information or not, by conducting covert investigations within the limits. The Act also provides the absolute bases (§ 32 (1)) for refusing the issue or extension of the term of a national security clearance to a person; the bases for refusing the issue or extension of the term of an access permit to a person, subject to the right of discretion (§ 32 (2)), that allow consideration of the person concerned and circumstances related to his/her activities, are listed separately.

The requirement for a security vetting is not applied in the case of those persons who have access to classified information by virtue of office, as specified in the State Secrets and Classified Information of Foreign States Act; nevertheless, if an international agreement has defined security vetting as a pre-requisite for granting access to foreign classified information, security vetting shall be also conducted with regard to these persons, with the exception of the President of the Republic.

Where may one process classified information?

As provided by the State Secrets and Classified Information of Foreign States Act, information classified as CONFIDENTIAL or above may only be processed within a Security Area. A Security Area is an area where the processing of classified information is permitted and that meets certain requirements (access to the area must be identifiable and controllable; the area must be protected with an alarm system; there are also restrictions in regard to the presence of persons with no security clearance in the Security Area, etc).

Information classified as RESTRICED may be processed also in an Administrative Area. This regards all the official premises, which are at the disposal of an authority.

What are the NATO security classification levels?

The levels of NATO classified information and corresponding Estonian security classification levels are the following:
COSMIC TOP SECRET TÄIESTI SALAJANE
NATO SECRET SALAJANE
NATO CONFIDENTIAL KONFIDENTSIAALNE
NATO RESTRICTED PIIRATUD

Documents are often marked as NATO UNCLASSIFIED. This is not a security classification level but refers to information that still needs to be protected from being disclosed and the distribution of such information is performed according to a ‘need to know’ basis, similar to the Estonian marking of ASUTUSESISESEKS KASUTAMISEKS (transl. For Official Use Only).

What are the EU security classification levels?

The levels of EU classified information and corresponding Estonian security classification levels are the following:

TRÈS SECRET UE / EU TOP SECRET TÄIESTI SALAJANE
SECRET UE / EU SECRET SALAJANE
CONFIDENTIEL UE / EU CONFIDENTIAL KONFIDENTSIAALNE
RESTREINT UE / EU RESTRICTED PIIRATUD

The marking LIMITÉ is sometimes used on the EU documents; this is not a classification level but refers to information that still needs to be protected from being disclosed, and the distribution of such information is performed according to a ‘need to know’ basis, similar to the Estonian marking of ASUTUSESISESEKS KASUTAMISEKS (transl. For Official Use Only).

How should a document that contains classified information be marked?

Classified documents must be marked by the person who has drawn up the document immediately upon the drafting of such a document, by applying the marking that complies with the level of classification (PIIRATUD, KONFIDENTSIAALNE, SALAJANE or TÄIESTI SALAJANE) on the header and footer of the document (capital letters, font size 16). If a classification marking cannot be applied with text processing software (for example, logos on a letterhead do not allow printing of the marking or the documents are not available as a hard copy), a classification marking can be later added with an impression of the seal (after being printed). The State Secrets and Classified Information of Foreign States Act also defines that Classified media may be marked by additional marking that refers to additional security measures applicable to media or circle of persons, which has the right for access to the media.

In addition to the classification marking, the grounds for classification are also marked on the front page of a document. If a document contains a classified information of Estonia, one of the provisions of articles 4-8 of the Procedure for the Protection of State Secrets and Classified Information of Foreign States is given as the grounds for classification. If there are several grounds for classification, all these shall be marked on the media. The term of classification must be also stated on a document. Incurrence of a certain event may also serve as a classification term in addition to a date. The registration number and date of registration must be marked on classified media.

If considered practical, it is also possible to mark classified media additionally by paragraphs and illustrations, etc., to make it clear which part of the information is classified at which level for the readers, but also to indicate parts of the media that are free of any restrictions. Here it should be noted that the document as a whole shall be given the highest classification level attached to parts thereof.

If a document, containing a classified information of Estonia, is communicated to a foreign state or an international organisation, classification marking must be given on the document, as required by the international agreements concerned; a marking, in English, stating that the document contains a classified information of Estonia (“Classified as State Secret of the Republic of Estonia”), must be given in the right-hand corner of the front page of the document.

Both a soft and a hard copy, containing classified information of some other foreign state or an international organisation, shall be marked with the appropriate level of classification, indicated in the originator of classified information in the appropriate international agreement, and the required marking. “SALASTATUD VÄLISTEAVE (transl. foreign classified information) must be indicated in the right-hand corner of the front page of the document, completed with the name of the originator of foreign classified information, level of classification and classification term, if specified.

How can one apply for a Personnel Security Clearance Certificate for access to foreign classified information?

See: Description of the Rules and Procedure for Access to Foreign Classified Information.

What is the penalty for compromising classified information?

Penalties for committing an offence related to classified information are laid down in the Articles 52¹, 55¹, 217, 232 234, 241 and 242 of the Penal Code and Articles 53 – 55 of the State Secrets and Classified Information of Foreign States Act.