GOVERNMENTN OF MONTENEGRO
DRAFT
INFORMATION SECRECY ACT
Podgorica, January 2008
Information Secrecy Act
I GENERAL PROVISIONS
Article 1
This Article lays down the common system for the determination classified
information for the classification, access, storage, handling, and protection of classified
information.
Article 2
This Act shall be binding on Government agencies, State administration
agencies, local community agencies, and other legal persons to whom is entrusted
carrying out of public authorities, (hereinafter referred to as agencies), likewise on
natural and legal persons providing goods and services and performing off works
(hereinafter referred to as organizations), when in carrying out of lawful duties or
performing of concluded works with classified information come to their knowledge,.
Article 3
Information shall be defined as classified if its disclosure to not authorised
person have or might have adverse effects onto security,, or political, or military or
economic interests of Montenegro, and is related to:
1)
2)
3)
4)
5)
defence;
national security;
foreign affairs;
intelligence and security activities of the State agencies of Montenegro
scientific, research, technological, economic and financial affairs of
importance to the public security, defence, foreign affairs and public security ,
and intelligence and security activities of the State agencies of Montenegro
and
6) systems, appliances, projects and plans of importance to the defence, public
security, foreign affairs and intelligence and security activities of the State
agencies of Montenegro
Classified information shall be defined under conditions and in a manner
specified by this Act.
Article 4
A classification of informationshall not be designated if data are classified in
order to cover up a criminal offence, the exceeding or abuse of competence, or some
other unlawful act or behaviour or administrative error.
2
Article 5
Classified information collected for conducting of certain affairs, shall be used
exclusively for the purpose of their collecting and during the time necessary for its
achieving.
Article 6
Access to classified information shall be restricted and permitted in a manner and
under conditions specified by this Act and the regulations based thereon, and
international treaties concluded by Montenegro..
Article 7
Classified data shall be stored and handled in accordance with protection
measures regulated by this Act.
Every person who handles such information or has come to their knowledge shall
be bound to safeguard and protect secrecy of such information, in accordance with this
Act.
Article 8
The meaning of individual terms used in this Act shall be as follows
1) 1) information : documents, their content and supplements, objects, measures
or procedures, likewise oral notifications with confident nature originating in the
work of agency from Article 2 of this Act, likewise of other legal and natural
persons, irrespective from their source, time of originating, place of storage and
way of coming to knowledge;
2) document: any written, copied, drawn, pictured, printed, recorded, photographed,
magnetic, optical or other record of data;
3) object : dummies, models, specimens, photographs, films and microfilms and
other records which are by optical, sound, machine, manual or other way
recorded on certain surface;
4) building: all kinds of buildings, overground and underground buildings, likewise
other artificial and natural buildings (houses, roads, tunnels, bridges, pits, airports
sea and river ports and terminals, spacecs for storage of devices and military
equipment, plans, cryptographic devices and documents, natural underground
passages, canals etc.);
5) classified information of a foreign state and international organization:
information which is to be kept classified by international agreement between
Montenegro and foreign country or international organization;
6) permission to access to classified data: a record which allows to certain legal
and physical person the access and handling with classified information;
7) security clearence: a record which confirms that foreign legal and physical
person is in possession of the security certificate issued by the foreign State and
right to access and handling with classified data in Montenegro;
3
8) operator with classified information is a person in the agency in charge for
storing, handling, exchange and other operations of processing of classified
information;
9) "needs to know" is a principle according to which is established justified need of
the person to handle with classified information in order to perform his/her jobs based
upon issued permission to access to classified information ;
10) security clearence:procedure of establishing of facts significant for the issue
of security permission;
11) security restrictions: information or fact established in the procedure of
security
clearance and on the ground of which is based suspiction into trust or
loyality of the person subject to the issue of security permission;
12) family: spouses likewise their children and parents of spouses;
13) Handling of of classified information : manipulating with classified information
in performing of duties in the Body or for the needs of the Body;
14) safeguarding of classified information: set of measures and activities aimed
preventing their disclosure, destroy and abuse by unauthorised person, Body or other
legal or physical person;
15) safeguarding of classified information: set of physical, organizational and
technical measures or actions taken aiming to prevent destroy, transfer or abuse of
classified information ;
16) security area is an area arround the building marking minimal distance from the
building from which building or classified information in it can not be endangered.
17) security zone is an area or premise in the building in which classified
information designated »CONFIDENTIAL« or higher
level of confidentiality are
safeguarded and which require appropriate physical protection and
18) administrative zone is an area or premise in the building in which classified
information marked RESTRICTED are safeguarded and which require appropriate
physical protection
II PROCEDURE OF CLASSIFICATION OF INFORMATION
Article 9
Procedure for designating of information as classified includes designating of the
level of classification and manner of declassification, likewise marking of classified
information.
Article 10
Information can be designated classified if such is necessary in the democratic
society and if interest from the Article 3 paragraph 1 of this Act is prevailing over the
interest for free access to the information..
Authorised person for designating of level of classification by explained decision
designates information classified and decides on the level of classification.
If a document contains information which can be classified by different levels of
classification, authorised person shall be binded to designate each information by the
appropriate level of classification.
4
Article 11
Classified information referred to in Article 3 of this Act shall, , be given one of the
following levels of classification:
:
1. A TOP SECRET;
2. A SECRET;
3. A CONFIDENTIAL;
4. A RESTRICTED
Article 12
Grounds for deciding on level of classification of information shall be its content
and its importance for the security of Montenegro or its political or economical interests
A TOP SECRET classification shall be applied to classified information the
disclosure of which would do irreparable damage to the security and interests of
Montenegro;
A SECRET classification shall be applied to classified information the disclosure
of which could seriously harm the security or interests of Montenegro;
A CONFIDENTIAL classification shall be applied to classified information the
disclosure of which could harm the security or interests of Montenegro;
A RESTRICTED classification shall be applied to classified information the
disclosure of which could harm the performance of tasks of an Body.
Article 13
In classifying information, or document, especially information intended for
cooperation with intelligence, defence or security institutions from foreign states,
international and regional organizations, markinks from Article 11 of this Act, may be
also used in English.
Article 14
Authorised persons for deciding on level of classification of information »TOP
SECRET« are: President of Montenegro, President of Parliament of Montenegro, Prime
Minister and members of Government of of Montenegro, director of the state
administration agency competent for police affairs, director of state administration
Agency competent for national security affairs (hereinafter : Agency), supreme state
prosecutor and president of the supreme court .
Article 15
Authorised persons for deciding on level of classification of information
»SECRET«, »CONFIDENTAL« and »RESTRICTED«, are chiefs of Agency from the
Article 2 of this Act or a person appiointed by him.
Article 16
The obligation of classification and deciding on level of classification of
information shall begin at the moment of creating or coming to knowledge of that
information more exactly at the moment of beginning of preparations for creating of that
information.
5
Any employee performing working in an Agency or organization, shall be bound
within the scope of their competencies to assess the security importance of information
and propose to authorised persons the level of classification of such information.
Article 17
An authorised person for determinig the levels of classification, in determining
shall such levels shall be bound to assess the adverse effects onto security of the State
and its interests.
An assessment from the paragraph 1 of this Article shall be in written form.
Article 18
An authorised person for determinig the levels of classification, in determining such
level shall also decide the manner of declassification by setting date, event or deadline
originating declassification of the information.
An authorised person for determinig the levels of classification, may declassify
information before run out of the deadline from the Paragraph 1 of this Article.
.
Article 19
Information that must be protected for reasons specified by this Act may be created
by linking two or more information which are not determined as classified.
In the case from paragraph 1 of this article, an authorised person shall be obliged
to determine the level of classification of information.
Where only a smaller part of information from paragraph 1 of this Article requires to
be protected, an authorised person shall be obliged to detach that part from the
remaining document and determine its level of classification.
Article 20
Where based upon the content of classified information, is not possible to
determine the manner of declassification, its secrecy ceases at the moment of run out
of deadline for free access to files in accordance with the regulations on files.
Article 21
Level of classification of information is subject to change.
Change of level of classification of information may regard complete information or
small classified piece.
Change of level of classification may be carried out exclusively by the authorised
person determinig the levels of classification.
Authorised person from the paragraph 3 of this Article, shall inform all Bodies and
organizations handling of such information, about such change.
Article 22
Classified information shall be marked by :
1) level of classification;
2) manner of declassification;
3) data on authorised person for determining level of classification (hereinafter
:classified person), and
4) data on the body of authorised person for determining level of classification.
6
Exceptionally from the provision of the paragraph 1 of this Article, information
shall be deemed classified if marked solely by the level of classification.
Manner and procedure for designating of level of classification shall be
regulated by the Government of Montenegro (hereinafter: Government).
III CLASSIFIED INFORMATION OF FOREIGN COUNTRIES AND INTERNATIONAL
ORGANIZATIONS
Article 23
The markings of the classified information of a foreign country or international
organization shall, as a rule, remain in the form in which they are used in that country or
international organization
Article 24
Classified information shall be delivered according to the principle «needs to
know»"
Employees in the Direction for protection of classified information (hereinafter:
Direction) who are in charge for receiving and exchange of classified information,shall
take necessary measures and activities for receipt, establishing of users and delivery of
classified information to such users.
IV CONDITIONS AND PROCEDURE OF ISSUING PERMISSION TO ACCESS
CLASSIFIED INFORMATION
Article 25
Acess to classified information of the TOP SECRET, SECRET and
CONFIDENTIAL levels, shall have a person who possess permission to accesss
classified information, if not otherwise regulated by this Act.
Before issuing a security permission a security clearance shall be carried.
Article 26
Acess to classified information without permission shall have:
1) President of Montenegro;
2) President of Montenegrin Parliament;
3) Prime Minister of Montenegro;;
4) Heads of State Agencies competent for the internal affairs, foreign affairs and
defence affairs;
5) Supreme Court Prosecutor, and
6) President of the Supreme Court
Persons from Paragraph 1 of this Article shall have access solely in order to
perform their tasks in accordance with the law.
Persons from Paragraph 1 of this Article, shall on the occassion of taking up a
duty sign a statement to the effect that they undertake to handle classified
information in accordance with the law and other appropriate regulations.
7
Article 27
Every person who works at the body or organization shall have access to
information classified at the RESTRICTED level.
Article 28
Permission to access classified information of the “TOP SECRET”,
“CONFIDENTIAl” and “SECRET” level shall be issued by the Direction.
Request for issuing of permission to access classified information from paragraph
1 of this Article shall be submitted to the Direction, namely:
1) for the person handling with classified information or other employee in the
agency, head of such agency and
2) for legal person, legal representative of such legal person
Based upon acquired permission to access classified information for legal person,
legal representative shall submit the request for issue of permission to access classified
information to the person handling with classified information or other employee at legal
person.
The request for issuing of permission to access classified information for foreign
legal and physical person shall be submitted by such person.
Article 29
Request for issuing of permission to access classified information to physical
person shall contain: identification data (name and surname) and residence, duties, jobs
and activities in relation to the access to classified information, likewise the level of
classification of information for the requested permission to access.
Together with the request from paragraph 1 of this Article, physical person shall
enclose evidences that :
1) he/she is Montenegrin citizen;
2) disposes with justified request for handling with classified information
according to principle ''needs to know»;
3) do not exist restrictions limiting the access to classified information;
4) he/she is capable for business;
5) has fulfilled 18 years or 21 years of life for access to classified information
designated by the level of classification ''TOP SECRET'';
6) against him/her is not pronounced the safeguarding measure of prohibition of
performing of activity ;
7) his/her health fitness;
8) he/she has signed the statement in written on lawful, conscientious and
responsible way of handling of of classified information;
9) do not exist security risks , and
10) he/she is informed about the regulations setting the area of protection of
classified data.
8
Article 30
Request for issuing of permission to access classified information to legal
person shall contain:: name, seat and activity, identification data (name and surname) of
the legal representative, likewise the level of classification of information of requested
permission to access.
Together with the request from paragraph 1 of this Article, legal person shall enclose
evidences that :
1) measures and actions for physical, administrative and cyber protection of
classified information are provided ;
2) is registered for carrying out of the activity;
3) against authorised person is not introduced criminal proceeding for the criminal
act with the elements of corruption and that he/she is not in effect sentenced for
such crime ;
4) he/she is financialy stabile;
5) he/she disposes with evidences on ownership structure ;
6) there is no security risk for handling with classified information and
7) employees who needs it for carrying out of contracted business dispose with
issued permission to access classified information.
Article 31
Foreign legal and physical person shall have access to classified information, if:
1) to him/her is issued security certificate by the state of his citizenship or in
which his/her seat or seat of the foreign International organization whose
member he is, is located
2) to him/her is issued permission bey the Direction, if obligation to allow
access to classified information originates from the ratified International
treaties.
Article 32
Security clearance shall be carried out by the Agency.
The request for carrying out of security clearance shall be submitted by the
Directorate.
Clearance is allowed only with previous written consent of the person subject to
clearance.
If a person subject to clearance does not give written consent, Agency shall not
carry out the procedure of security clearance.
Clearance may also include family memebers of the person subject to clearance
solely if estimated that they may influence behavior of the person.
Clearance shall be carried out at the place of birth, residence and employment
of the person subject to clearance.
Article 33
Depending on the level of classification of information, next clearances shall be
carried out:
1) basic security clearance, for information classified as " CONFIDENTAL";
9
2 special security clearance, for information classified as " SECRET" and
3) special security clearance, which also includes additional security clearance, for
information classified as " TOP SECRET".
Article 34
Before carrying out of clearance, Agency shall deliver to the physical and legal
person subject to clearance, a questionnarie for security clearance.
Questionnaire from paragraph 1 of this Article, may be basic and special security
questionnaire.
Legal and physical person shall fill in a basic security questionnaire, if permission
is requested for access to the information classified as " TOP SECRET"and "SECRET",
they shall fill in a special security questionnaire.
Filled in basic and special security questionnaire shall be classified as "A
RESTRICTED".
Article 35
Into basic security questionnaire for physical persons, next data shall be filled in:
1) identification data ( name, surname including previous);
2) personal identification number
3) date and place of birth;
4) nationality , including data on previous or double citizenship;
5) place of residence (permanent, temporary);
6) previous stays abroad lasting at least three months;
7) marital status and number of children;
8) level of education and profession;
9) carrying out of military service;
10) specialist or professional training in Montenegro and abroad;
11) previous employments;
12) criminal offences and ongoing criminal proceedings;
13) alcohol and drug adddiction;
14) medical data on adiction deseases or mental deseases.;
15) contacts with foreign intelligence services;
16) membership and participation in activities of organizations with prohibited
aims;
17) liability for violation of regulations regarding classified information;
18) previous clearances.
19) property right onto real estate registered into real estate registry or real estate
onto which applicant disposes with legal basis for acquiring of property of
reale state, likewise well as annual tax on citizen's income for previous year.
Article 36
Into basic security questionnaire for legal person, next data shall be filled in :
1) name and seat including previous;
2) registering number of the legal person and tax-identification number
10
3) personal name of the representative;
4) date and place of establishing ;
5) origin of the establishing capital including changes during last three years;
6) number of employees;
7) number of employees requesting permission for acces to classified information and
kind of jobs they carry out;
8) established legal responsibility and competent persons in the legal person, likewise
data on ongoing procedures;
9) contacts with foreign intelligence services;
10) membership and participation in activities of organizations with prohibited aims;
11) liability for violation of regulations regarding classified information;
12) previous security clearances;
13) property right onto real estate registered into real estate registry or real estate onto
which applicant disposes with legal basis for acquiring of property of reale state, likewise
well as annual financial report for previous year according to the Law on bookkeeping
and audit.
Beside filled in qustionnaire from paragraph 1 of this Article, representative of the
legal person shall also fill in the basic security questionnary for physical person..
Article 37
For special security clearance regulated by the Article 33, idents 2 and 3 of this
Act, beside basic, special security questionnaire shall be filled in.
Into special special security questionnaire, shall be filled in data on :
1) participation in foreign Armies and para-military formations;
2) other characteristics, beside those mentioned in the Article 35 and 36 of this Act
making physical or legal person subject to influence which represent security risk and
3) obligations resulting from financial debts and taken over mortages .
Article 38
Additional security clearance shall be carried out if permission to access to
information classified » TOP SECRET« is requested.
Beside clearing of facts from basic and special security clearance additional
security clearance shall also include clearance of all those facts, circumstances and
occurences from the private life of the applicant during last ten years since the day of
submitting of the request for isssue of the permission to access to classified information,
which might be ground for suspicion into his/her reliability, and especially if his/her
activities are contrary to interests of Montenegro or if he/she is in contact with foreign
persons who can endanger foreign policy and security of Montenegro.
Article 39
Deadline for carrying out of security clearance runs since the day of receipt of filled
in questionnaire at the Agency, that is:
1) 30 days for basic security clearance;
2) 90 days for special security clearance and
3) 180 days for special security clearance with additional security clearance.
If security clearance is not carried out within the deadline from paragraph 1 of this
Article, it shall be considered that apllicant passed security clearance.
11
Article 40
Clearance shall be carried out:
1) by applying means and and methods in accordance with law,not requiring the
Court permission, and
2) cooperation with administration body responsible for police affairs, judiciary
bodies, likewise companies, or institutions and other legal persons employing the
person (or who were employing him) and when appropriate, also with other bodies and
organizations in order to provide certain data from questionnarie.
Article 41
Agency may, in carrying of security clearance, cooperate with the agencies of
foreign countries and international organizations, responsible for security clearance, in
a manner specified by international treaties concluded between these agencies and
Montenegro likewise regulations on protection of personal data.
Article 42
Bodies and legal persons from article 40 of this Act, shall be obliged at the
written request of the Agency, to immediately deliver requested information to the
Agency and not later than 15 days after submitting of the request.
Article 43
In carrying of security clearance, Agency shall be obliged to provide:
1) accurateness and objectiveness of information regarding clearance ;
2) that dignity of person subject to clearance is protected by using of information
3) non disclosure of methods, means and source of information, and
4) that information from clearance shall be used solely for the purpose of their
collecting
Article 44
Agency shall deliver report to Directorate on carried clearance or additional
security clearance with recommendation for issuing or refusing of permission for access
to classified information.
Together with the report from paragraph 1 of this Article, Agency shall also
deliver to Directorate filled in security questionnaires of the applicants of the request
from Article 28 of this Act.
Report shall be considered classified and marked „SECRET“.
Article 45
A person subject to security clearance shall be entitled to inspect collected
information, except data regarding sources and the manner of their clearance.
12
Article 46
Directorate shall by decision refuse a request for of issuing of permission to
physical person for access to classified information if existence of next security
restrictions, is established:
1) final indictment for criminal offences prosecuted ex officio, with the exception of
criminal offences where as the main sentence a fine or imprisonment up to three years
is regulated, if unerased;
2) registering in the addicts register for alcohol and narcotics;
3) excessive debts identing possible extortion and other forms of pressure onto
person subject to clearance;
4) relations, or holding of relations with persons who on unauthorised way collect
classified and other information about terrorists, saboteurs, members of organized
criminal groups, justifiedly suspeted to be members of such groups;
5) unauthorized contacts and collaboration with intellingence-security or military
structures of foreign states;
6) membership in organizations which threaten security of Montenegro;
7) narcotics addictions or tendency to exessive use of alcohol;
8) tyrant behaviour and provoking of severe conflict in his work or living
environment;
9) hiding and giving of incorrect information about the person regarded or
members of his family
10) other security restrictions defined by laws and confirmed by international
treaties.
Article 47
Directorate shall by decision refuse a request for of issuing of permission or
security permission for access to classified information to legal person an foreign legal
and physical person if based upon the report of security clearance is established that
applicant does not fulfill conditions from Article 30 and Article 31 of tis Act.
Article 48
In the decision from Article 46 of this Act reasons for refusing of issuing of
security permission shall be stipulated.
In the decision from the paragraph 1 of this Article shall not be stipulated
information on source and manner of performing of security clearance.
Against decision from paragraph 1 of this Article a complaint shall be permited to
the Ministry competent for the defence affairs (hereinafter: Ministry).
Article 49
On the occasion of delivering of the permission for access to classified
information, Directorate shall inform the user on regulations regarding handling with
classified information, likewise on legal and other consequences of their unauthorised
disclosure.
13
A security permission shall be issued to the person who previously signs a
statement that he undertakes to handle classified information in accordance with this
Act.
If a person does not sign the statement from paragraph 1 of this Article, security
permission shall not be issued to him.
Content and form of the permission for access to classified information shall be
regulated by the Ministry.
Article 50
Permission for access to information classified "TOP SECRET" shall be valid for
three years.
Permission for access to information classified "SECRET" shall be valid for five
years.
Permission for access to information classified "POVJERLJIVO" važi deset
godina.
Article 51
Directorate shall in written, at least 180 days before expiration of validity of
permission for access to classified information inform the beneficiary that he/she is
entitled to submit the request for the prolongation of validity of permission for access to
classified information.
Along with the request for the prolongation of validity of permission from
paragraph 1 of this Article, beneficiary shall inform Directorate on all changes of data
from previously submitted security questionnaire with evidences, and Agency again
carries out the security clearance
Article 52
Directorate shall bring in decision on restricting or revoking of permission for
access to classified information even before its expiration, if establishes that person
subject to issuing of security permission does not handle or safeguard classified
information in accordance to this Act and other regulations or that is he/she does not
anymore fulfill conditions for issuing of the permission for access to classified
information.
If necessary, a part of explanation from paragraph 1 of this Article, classified
„CONFIDENTIAL“, shall not be delivered to the user.
Article 53
Permission for access to classified information shall be revoked, if:
1) after expiration, its validity is not prolonged;
2) ceased the function of the person from Article 26 of this Act;
3) ceased the function of carrying out tasks of employees in the body or organization;
4) based upon decision of Directorate in the procedure of security clearance for access
to classified information, and
5) physical person or legal person to whom is issued the permission for access to
classified information, deceased or ceases to exist.
14
Article 54
Chief of body, shall temporarily restrict or prohibit access to classified information
to person with issued permission, if such a person:
1) is subject to a disciplinary proceeding due to founded suspicion that he comitted
infractions refered to in this Act, and
2) criminal proceeding from criminal offences from Article 46 paragraph 1indent 1 of
this Act is introduced .
Restrictions from paragraph 1 of this Article, shall be applied until bringing of final
decision on disciplinary measure, or final court sentence.
V HANDLING WITH CLASSIFIED INFORMATION
Article 55
Classified information may be handled by Montenegrin citizens and legal persons
with their seat in Montenegro , with issued security permission, or foreign legal and
physical person with issued security permission based upon ratified International
agreement, likewise persons from Article 26 paragraph 1 of this Act.
Article 56
Bodies and organizations from Article 2 of this Act, who receive classified
information from the authorised person, shall not be allowed to give it to the other bodies
and organizations without consent, unless in cases otherwise provided by this Act and
regulations adopted based upon it.
Article 57
A person with issued permission for access to classified information, who handles
with classified information shall be obliged to immediately, in written inform the person
who set classified information on noticed irregularities regarding protection of classifed
information and their disclosure .
An authorised person who set classified information, shall be obliged to
immediately undertake measures for elimination of noticed irregularities in cases from
paragraph 1 of this Article, or measures to prevent or reduce possible adverse effects
resulting from disclosure of level of classification.
Article 58
An authorised person, from the Article 57, paragraph 2 of this Act, shall have
permanent controlling over disclosure of classified information and keep regularly
updated register of persons to whom data are delivered or is given access to classified
information and time of disclosure and access to classified information.
15
VI SAFEGUARDING OF CLASSIFIED INFORMATION
Article 59
The obligation to keep secret information begins at the moment when authorized
person from the Article 14 and 15 of this Act, sets information classified or designates
the level of their classification.
Article 60
Relieving of the obligation to keep information secret, may be given by
authorised persons who set their level of classification.
Relieving of the obligation to keep information secret, my be complete or partial.
Partial relieving of the obligation to keep information secret shall regard a part of
classified information or precisely defined agency or person to whom classified
information can be completely or partly disclosed.
VII PROTECTING MEASURES FOR CLASSIFIED INFORMATION
Article 61
Criteria for setting of protecting measures for secret information, are:
1) level of classification, and
2) content and form of classified information.
Article 62
Aiming protecting of classified information bodies and organizations are bounded to
undertake measures and actions providing administrative, physical, cyber, industrial and
protection of persons handling with classified information.
Article 63
Measures and actions for setting of administrative protecting of classified
information are:
1) setting and designating of level of classification;
2) receipt and registering of classified information;
3) safeguarding and handling with classified information;
4) coping, translating and excerpting fro classified information, setting number of
copies and users;
5) control and handling with classified information on their delivery to users;
6) preventing of unauthorized carrying out and publishing of classified
information resulting in endangering security and other interests of
Montenegro and its bodies;
7) preventing of unauthorized disclosure of the level of classification and
8) storing and destroying of classified information.
16
Article 64
Measures and actions for physical protection of classified information are :
1) evaluation of possible violation of security of classified information from
intrusion or unauthorised access, use and destry of classified information;
2) setting of security area around building with classified information;
3) setting of security and administrative zones;
4) organizing of physical protection and application of technical and other
means for protecting of buildings and premises with classified information;
5) issuing of permissions for access to buildings and premises;
6) control of entry and exit of persons and vehicles for transfer of classified
information and
7) transfer of classified information out of security zones.
Article 65
Measures and actions for providing of protection of persons handling with classified
information are:
1) setting of authorised persons for work and handling with classified information;
2) security clearance;
3) issuing of permissions for access to classified information
4) clearance and evaluation of capability for handling with classified information.
Article 66
Measures and actions for providing of cyber protection of classified information
are:
1) permission for communication-information systems and processes;
2) evaluation of possible endangering of security of classified information from
the intursion into information system and use and destry of processed
classified information safeguarded in the communication-information systems ;
3) establishing of methods and security procedures for receipt, processing,
transfer, safeguarding and setting of files of classified information in e-form.;
4) making of crypto keys and other crypto materials;
5) crypto protection of communication, information and other e-systems for
composing, transfering, processing and setting of files of classified information
and
6) installing of devices for safeguarding of classified information.
1)
2)
3)
4)
Article 67
Measures and actions for providing of industrial protection of classified
information are:
protection from loss and disclosure of classified information from service
contracts;
issue of security permissions for legal and physical persons who make, use or
are in contact with classified information of organizations;;
protection from loss and disclosure of classified information of foreign legal
and physical persons;
providing of protection in transfer of classified information and
17
5) setting up of special procedures on the occassion of visits of foreign legal and
persons to the organizations which make, process and safeguard classified
information .
Article 68
Classified information can be delivered out of premises of bodies and
organizations solely by observing of regulated protecting measures which guarantee
the access to classified information solely to persons who posses permission for
access to classified information.
Details of conditions and manner for carrying out of administrative, cyber,
industrial and protecting measures for pesons with the access to classified information
shall be proscribed by the Government .
Article 69
Authorised personnel and other employees in bodies and organizations, where
classified information is lost, shall in the case of loss or unauthorised disclosure of
classified information immediately notify the authorised person who established the level
of classification, thereof.
Authorised personnel and other employees in a recipient bodies and
organization, who establish that a loss or unauthorised disclosure of classified
information has occurred shall immediately notify the authorised person who established
the level of classification
In cases 1 and 2 from this Article,the authorised person shall immediately take all
necessary steps to identify the circumstances that occasioned the loss of classified
information or its disclosure to an unauthorised person, remove any harmful effects, and
prevent further losses and unauthorised disclosures of such information within bodies
and organizations.
.
Article 70
Based upon special protecting measures for classified data significant for
Country's defence, protection shall be provided to:
1) devices and military equipment;
2) buildings for the purpose of Country'y defence, and
3) conducting of affairs indispensable for Country's defence.
Special measures for protection from paragraph 1 of this Article, shall be
prescribed by the Government.
Article 71
Bodies and organizations shall ensure the regular internal supervision
in respect of the implementation information protecting measusres according to this
Act.
Internal supervision from paragraph 1 of this Article chall be carried out by
heads of bodies and responsible personnel within organizations.
18
Internal supervision from paragraph 1 of this Article, shall be carried out
within the existing organizational units and organizations from Paragraph 2 of this
Article or through the systematization of the work post for performing of duties of
protection of information secrecy.
The Government shall prescribe in detail the method and content of internal supervision
from paragraph 1 of this Article..
VIII RECORDS ON CLASSIFIED INFORMATION
Article 72
On classsified information, submitted requests for issuing of permission, issued
revoked permissions , records shall be kept.
The Government shall prescribe in detail the method and content of keeping
records from paragraph 1 of this Article.
IX DIRECTORATE
Article 73
Directorate is a body of administration , with characteristics of a legal person.
Article 74
Directorate shall carry out next tasks:
1) provide implementation of standards and regulations from the field of protection of
classified information;
2) adopt plan for protection of classified information for emergency and urgent cases;
3) organizes tasks of bodies concerning exchange of classified information with foreign
states and international organizations;
4) organize carrying out of jobs concerning providing of protection of classified
information entrusted to Montenegro by foreign states and International organizations;
5) acts according to requests for issuing of permissions for access to classified
information;
6) keeps files on issued permissions for access to classified information;
7) compiles and keeps central Register of classified information and classified
information of foreign state or international organization;
8) undertakes measures aiming training of persons handling with classified information
and bodies for operating with classified information according to standards and
regulations and
9) carries out other tasks according to this Act.
Article 75
Government appoints and recalls the Director of Directorate (hereinafter: Director),
on proposal of the Minister competent for affairs of defence.
Director shall be appointed a person who fulfills the conditions for work in the
State bodies, with university level of education and at least five years of experience
within the field of protection of classified information.
Director is no allowed to be a member of political party, or to act politically.
19
X OBLIGATIONS OF THE DIRECTION CENCERNING CLASSIFIED INFORMATION
OF FOREIGN STATES AND INTERNATIONAL ORGANIZATIONS
Article 76
Exchange of classified information with foreign states and International
organizations shall go through the Agency, unless otherwise provided by separate Act or
ratified international treaties.
Article 77
Directorate shall estblish, keep and provide Central Register of foreign classified
information. Authority recipient of foreign classified information in accordance with
separate Act or ratified international treaties, shall estblish, keep and provide Central
Register of foreign classified information.
Body shall deliver to the Directorate a copy of data from paragraph 2 of this
article.
Article 78
Directorate shall inform foreign state or international organization on security of
foreign classified information which Montenegro delivered to foreign state or
international organization.
Article 79
Under extremely negative political, economic or defence-security circumstances
for Montenegro and if such is necessary in order to protect interests from article 3 of this
Act and at the demand of body, Directorate shall exchange classified information with
foreign state or international organization without previously concluded international
agreement.
XI SUPERVISION OF THE IMPLEMENTATION OF THE ACT
Article 80
Supervision of the legality and suitability of the work of Directorate shall be the
responsibility of the Ministry.
Inspection supervision over carrying out of this Act and implementation of
international treaties shall shall be the responsibility of the Direction through competent
inspector in accordance with the law.
Article 81
Beside competences of inspectors according to the act regulating inspection
supervision, competent inspector from article 80 paragraph 2 of this Act shall :
1) supervise implementation of acts and other regulations on classified information;
2) order measures for elimination of irregularities concerning exchange and other
actions in processing of classified information;
3) bring criminal charges and proposes i propose bringing of infraction and other
proceedings, due to violation of regulations of this Act and
4) assist in the implementation of this Act and other regulations on classified information.
20
In carrying out of supervision, competent inspector shall control security, handling,
exchange and other manipulations in processing of classified information, without
previous notice to body, competent person, operator or recepient.
Competent inspector shall order measures and set deadline for elimination of
irregularities regarding manipulating, exchange and other actions of processing of
classified information
XII PENALTY PROVISIONS
Article 82
A body or legal person in Montenegro shall be fined for infraction between twenty
times and three hundred times amount of minimal sallary in Montenegro, if:
1 does not set as classified and mark level of classification of information at the
moment of establishing and coming to their knowledge, or at the moment of
beginning of preparations for establishing of such informationi (Article 16
paragraph 1);
2) does not assess the adverse effects onto security of the State and its interests,
and fails to provide written report on it (Article 17);
3) does not determine information which resulted by merging of two or more
information as classified , or does not separate a segment of information and
determine its level of classification (Article 19);
4) does not inform on changed level of protection all Bodies and organizations
using such information (Article 21 paragraph 4);
5) accesses classified information without granted permission for access (Article
25);
6) carries security clearance without written consent of the person subject to
clearance (Article 32 paragraph 3);
7) does not immediately act according to the request for security clearance and
does not deliver the report to the Agency within 15 days (Article 42);
8) acts contrary to the Article 47 of this Act;
9) does not immediately inform the authorised person who set information
classified on noticed irregularities regarding protection of that information
(Article 57 paragraph 1);
10) does not immediately take measures for elimination of noticed irregularities,
or measures for preventing or reducing of possible harmful effects of
disclosure of classified information (article 57 paragraph 2);
11) does not ensure the regular internal supervision in respect of the giving of
classified information for use and does not keep updated records from
Article 58 of this Act;
12) does not take measures and actions providing administrative, physical,
cyber, industrial and protection of protection of persons handling with
classified information (Article 62);
13) does not immediately inform the authorised person who designated the level
of protection of information on loss or unauthorised disclosure of classified
information within the body or organization where such information is lost or
within the body or organization to whom such information is delivered
(Article 69, paragraphs1 and 2);
14) does not immediately take all necessary steps to identify the circumstances
that occasioned the loss of classified information or its disclosure to an
unauthorised person, remove any harmful effects, and prevent further losses
21
and unauthorised disclosures of such information (Article 69 paragraph 3)
and
15) does not ensure the regular internal supervision in respect of the
implementation information protecting measusres according to this Act
(Article 71 paragraph 1).
A responsible person within body or legal person shall be fined for infraction from
paragraph 1 of this Article between two and twenty times amount of minimal sallary in
Montenegro
A natural person within body or legal person shall be fined for infraction from
paragraph 1, indents 5,10 and 13 between two and twenty times amount of minimal
sallary in Montenegro.
XIII TRANSITIONAL AND FINAL PROVISIONS
Article 83
The Directorate from Article 73 of this Act shall be established, no later than sixty
days after the entry into force of this Act.
Article 84
Bodies and organizations from Article 2 of this Act, shall be obliged to harmonize
their manner of designating of classified information,handling and storage likewise
protecting measures for classified information with provisions of this Act, no later than
six months after the entry into force of this Act.
Article 85
Level of classification of information, determined before coming into force of this
Act shall be reclassified in accordance with the provisions of this act no later two years
from entry into force, as follows:
- information designated as «state secret» shall be treated as «TOP SECRET»;
- information designated as „»official secret» or «military secret-highly confidential“
shall be treated as „SECRET“;
- information designated as «official secret» or «military secret-confidential» shall
be treated as «CONFIDENTIAL» and
- information designated as «official secret» or «military secret-internal» shall be
treated as «INTERNAL»
Until reclassification level of classification of information from paragraph 1 of this
Article, actual markings shall be applied.
Article 86
Previously initiated procedures for determining of kind and level of classification
of information shall be completed according to the regulations of this Act.
Article 87
Bylaws for implementation of this Act, shall be adopted
following entering into force of this Act.
within six months
22
Article 88
By coming into force of this Act ,Regulation on Criteria for Setting of Information
Significant for Defence Which Have to be Safeguarded as State or Official Secret and
on Establishing of Tasks and Jobs Especially Important for the Defence of Country
Which Have to be Protected by Applying Special Security measures („Official Gazette of
FRY“, Nr. 54/94),likewise other regulations concerning classified informationm, shall
cease to be valid,.
Article 89
This Act shall enter into force on the eight day following its publication in the
«Official Gazette of the Republic of Montenegro» and will start to be implemented 60
days following its entering into force.
23
I CONSTITUTIONAL FOUNDATION FOR BRINGING IN THE ACT
Constitutional foundadion for bringing in the Act is contained within the provision
Article 16 paragraph 1 indent 5 of the Constitution of of Montenegro,which proscribes
that according to the law shall be also regulated other issues within the field of its
interest .
II REASONS FOR BRINGING IN THE ACT
Existing normative frame regulating issues of classified information in
Montenegro (Criminal Code, Code on Criminal Proceedings, Lawsuit Law, Law on
Contentious Administrative Matter, Law on Banks, Law on Police, Parliament's Book of
Regulations, Government's Book of Regulations, Law on Army, Law on Defence, Law
on State Prosecutor, Law on Execution of Criminal Sanctions...) do not provide the
fundamental meaning of the term : data or information which contains state, official,
military or other secret, which opens the possibility for significant abuses.The reason for
that lays in the fact that legal definition of the state, official or military secret does not
exist but such is still concluded from the character of criminal offence of disclosure of
state, official or military secret according to the Criminal Law. On the other hand, in
some segments, or through certain acts, state secret is partially mixed and understood
exactly as military secret, that definitely do not contribute to clear distinguishing between
different types of «secrets».
Not enough clear procedure, or classifying of certain information, by marking
«secret», is definitely key shortage of existing legal regulations.
Not harmonised other legal acts and bylaws with exceptions regulated by the Law on
free access to information with public interest, which as such are taken over from
regulations of international documents, democratic standards and comparative-law
practice, likewise possibility that based upon separate acts in separate areas new
exceptions may be introduced, is definitely separate problem within existing legal
system.
Law on Free Access to Information («Official Gazette of the Republic of Montenegro»
Nr. 68/05), is one of keys for providing transparency of work of the State and its Bodies
and to reduce the secrecy of certain information onto necessary content measure
requested by open and democratic society.
Comparative law experience clearly shows the close connection between free access
to information and issue of information secrecy, that is visible from next table:
24
Table: laws on free access to information and laws on classified information in
the counties of Central and Eastern Europe
Country
Albanija
Bulgaria
Czech Republic
Estonia
Hungary
Latvia
Lithuania
Macedonia
Poland
Rumania
Slovak Republic
Slovenia
Law on right onto free
access to information
Law on free access to
information
in
official
documents, 1999.
law on wree access to
public information, 2000.
Law on free access to
information, 1999.
Law on public information,
2000.
Law on protection of
personal
informationand
disclosure of information
with
public
importance
1998.
Law
on
freedom
of
information, 1998.
Law on disclosure of
information to public, 2000.
Law on free access to
information
with
public
importance, 2006.
Law on access to
information, 2001.
Law on free access to
information
with
public
importance, 2001.
Law on free access to
information, 2000.
Law on access to
information with public
importance, 2003.
Law on state secrets
Law on establishing and
controlling of classified
information
Law on protection of
classified information, 2002.
Law on protection of
classified information, 1998.
Law on state secrets, 1999.
amended on 2001
Law on state secrets, 1997.
Law on state secrets, 1997.
Law on state secrets, 1995.
Law on classification of
information, 2004.
Law on protection of
classified information,1999.
Law on protection of
classified information,2002.
Law on protection of
classified information, 2001.
Law on classification of
information, 2001.
From mentioned reasons also results the need for bringing in the separate law
which should on apropriate way and according to international standards and
comparative law practice, reduce the issue of secrecy onto necessary content measure,
and on unique way cover all issues from this field including also those resulting from the
comparative law practice of countries which already brought in laws and other
regulations from this field.
25
Beside mentioned, goals wished to achieve by this Act are:
- precisely define the area of restrictions, or reduction of the right to access secret
information which must be compatible with the Law on free access to information;
- introducing of a democratic standard regarding appointing of person handling with
classified information;
- establishing of body who shall legally dispose with classified information and
- completing of system, or set of regulations regarding free access to informationi
and field of clasified information, bearing in mind their compatibility and
connection.
By bringing in of this Act, the obligation established by Action Program for
implementation of European partnership shall be fulfiled.
III
HARMONIZATION WITH EUROPEAN LEGISLATION AND RATIFIED
INTERNATIONAL CONVENTIONS
The draft act is covered by the Action plan for implementation of racommandations of
inovated European partnership.
Content of Draft Act is harmonised with primary legal sources of the EU:
- UEZ, articles: 80(2), 100a, 207(3)
- European convention for protection of fundamental human rights and freedoms ,
and
- Convention on persons protection regarding computer processing of personal
data of the European Council (ETSNo 108).
Content of Draft Act is harmonised with secondary mandatory sources of the EU law:
31995L0046
- European Parliament and Council Directive on protecting of citizens regarding
processing of personal data (95/46 dated 10.24.1995);on free movement of such
data (Official Gazette L 281, 23/11/1995 P.0031 – 0050)/Directive 95/46/EC of
the european Parliament and of the Council of 24 October 1995 on the protection
of individuals with regard to the processing of data and on the free movement of
such data; (Official gazette L 291, 23/11/1995 P.0031 – 0050) Amended
by:32203R1882
/ Directive 95/46/EC of the European Parliament and of the Council of 24 October
1995 on the protection of individuals with regard to the processing of personal data
and on the free movement of such dana; (Official Journal L 281 , 23/11/1995 P.
0031 – 0050) Amended by: 32203R1882
32001D0264
Council Decision 2001/264/EC of 19 March 2001 adopting the Council's security
regulations (Official Journal L 101 , 11/04/2001 P) Amended by:
Corrected by 32001D0264R(01)
Amended by 32004D0194 Replacement Annex 1 from 28/02/2004
Amended by 32004D0194 Replacement Annex 2 from 28/02/2004
Amended by 32005D0571 Replacement Annex 1 from 23/07/2005
Amended by 32005D0571 Replacement Annex 2 from 23/07/2005
Amended by 32005D0952 Amendment Annex 1.1 from 20/12/2005
26
Amended by 32005D0952 Amendment Annex 1.3 from 20/12/2005
Amended by 32007D0438 Replacement APP 1 from 26/06/2007
Amended by 32007D0438 Replacement APP 2 from 26/06/2007
IV EXPLANATION OF BASIC LEGAL INSTITUTIONS
Text of the draft of Data Secrecy Act (hereinafter: Draft Act) is systematized into
XIII Chapters with the next content:
In the Chapter General Provisions (Articles.1 to 8 of the Draft Act ) are defined
agencies and organizations who shall proceed according to this Act (Article 2) and
for the first time in our legislation is defined the term of classified information
whose revealing could result in adverse effect, foir the security, defence or political,
military or economic interests of the Republic of Montenegro and which are in
relation to national security, defence, foreign affairs, public security, scientific,
researching, technological, economic and financial interests of the State within the
field of security, defence, foreign affairs and public security and systems, apliances,
projects and plans within the field of national security, defence, foreign affairs and
public security (Article 3).
According to Article 7 of the Draft Act is prescribed that every person who in
handling classified information has come to their knowledge shall be bound to
safeguard and protect secrecy of such information,. (Article 7 paragraph 2).
In the Chapter II Procedure of data classification (Article. 9 to 22) levels of
information classification are established as a top secret; a secret; a confidental a
restricted, and in the Article 11 of the Draft Act is prescribed that grounds for
deciding on level of classification of information shall be its contents and its
importance for the security of Montenegro or its bodies. In the Article114 are SET
authorized persons for deciding on level of classification of information »top secret«,
»secret«, »confidental« and »restricted«.Furthermore in the Article 18 of the Draft
Act is proscribed that an authorised person for determinig the levels of classification,
shall also during determining the level of classification of such information decide the
manner of declassification. Also , change of level of classification can be done solely
by authorised person, upon his initiative or proposal of body or organisation using it.
In the Chapter III Classified information of foreign countries and international
organizations (Artricles 23 to 24) is established that countries or international
organizations shall deliver information to the Directorate for protection of classified
information, and gives them to be used by athorised persons and bodies and and
keeps apropriate records on this.
In the Chapter IV Conditions and procedure of issuing permission to access
classified information (Article 25 do 54) In this Chapter is prescribed that Acess to
classified information, shall have a person who possess permission to accesss
classified information (Article 25). On such a way full protection of classified
information is provided and prevented different abuses if classified information
comes into possesion of the person without permission.Group of people who shall
27
have acess to classified information without permission is defined (Article 26).
Permission to access classified information to domestic and foreign physical and
legal persons shall be issued by the Directorate (Article: 28 to 30).
In accordance with NATO and other generally accepted International standards
(Article 32 to 44) of the Draft Act is regulated carrying out of Security clearance, set
content of questionnarie for security clearance and its scope, defined group of
persons who can be covered by clearance and deadlines for delivery of the report on
completed security clearance likewise collecting of information on the person subject
to slearance, means and manners prescribed by law which do not require Court
permission.
For the scope objectiveness of clearance and ensuring protection of person subject
to clearance, in the Article 43 of the Draft Act is prescribed obligation of Agency
carying out security clearance to provide accurateness and objectiveness of
information likewise that information from clearance shall be used exclusively for the
purpose of their collecting and that dignity of person subject to clearance is
protected. Based upon precise definition of security restriction , taxative listed in the
Article 46 the Draft Act possibility of any arbitrary proceeding or discretion evaluation
of the person in evaluating his reliability and loyality in the procedure for issuing of
security permission is eliminated.Also, the possibility to inspect collected information
is given to the person subject to security clearance,exept those regarding sources
and manner of their clearance.
V Handling with classified information (Article 55 do 58) Handling with classified
information is also provided by prescribing rules for delivery of information based
upon written consent of the competent person who designated level of classification
likewise prescribing of specific conditions for delivery of information to other persons.
Aiming better protection of classified information, according Article 57 of the Draft
Act a person who handles with classified information shall be obliged to
immediately, in written, inform the person who set classified information on noticed
irregularities regarding protection of classifed information and their disclosure, that is
one additional segment within the procedure of protection of classified information
VI Safeguarding of classified information (Article 59 and 60) In this Chapter is
prescribed the obligation to safeguard classified information, which begins at the
moment when authorised person set information classified or designated the level of
their classification..
In the Article 60 of the Draft Act is established that, relieving of the obligation to keep
information secret, may be complete or partly.
VII Protecting measures for classified information (Article 61 to 70)
Protecting measures for classified information may be general and they are precisely
established in the Article 62 of the Draft Act, likewise separate measures regarding
protecting of information significant for Country's defence (Article 69).In the Article
62 to 67 are precisely proscribed measures and actions provoding administrative,
physical, cyber, industrial and protection of persons handling with classified
information.
28
VIII Records on classified information (Article 72) based upon this Article is
prescribed that records on classified informationm, submitted request for issue of
permission and issued and revoked permission, shall be kept
IX Directorate for protection of classified information (Article 73 to 75) In the
Article 73 of the Draft Act is prescribed that Directorate for protection of classified
information is an Administration body with characteristics of legal person.In the
Article 74 are described tasks of the Directorate.
X Tasks of the Directorate concerning foreign intelligence information (Article
76 to 79)
Exchange of classified information with foreign states and international organizations
shall go through the Directorate (Article 76). Directorate shall keep and secure the
central register of classified and foreign classified information and inform foreign
state or International organization on security of the foreign classified information
which Montenegro delivered to the foreign state or International organization
(Article78).
XI Supervision of the implementation of act (Article 80 and 81 )
Supervision monitoring of the implementation of this Act and of the International
traties shall be the responsibility of the Directorate through competent inspectors.
Supervision over suitability and legality of the work of Directorate shall be carried by
the Ministry responsible for Defence. In the Article 81 of the Draft Act beside
competences of the inspector
are regulated other inspector's competences
according to the law.
XII Penalty provisions (Article 82) By these Articles are proscribed penalties for
the infractions established by this Act.
XIII Transitional and final provisions (Article 83 to 89) Directorate for protection
of classified information shall be established no later than 60 days after the entry
into force of this Act. (Article 83). Bodies and organizations, shall be obliged the
harmonize the procedure of classification, access to classified information,handling
and safeguarding of classified information, and measures of protecting of classified
infformation with provisions of this Act, no later than one year after the entry into
force of this Act.(Article 84). In accordance with their copmpetence State agencies
and other Bodies shall issue separate regulations for determining of kind and level of
classification of information likewise measures for protection of secret information.
(Article 70). Bylaws for implementation of this Act, shall be adopted within six
months following entering into force of this Act. (Article 87).
V Means for bringing in the Act
In order to implement thic Act it shall be necessary to provide financial means from
the budget of Montenegro amounting , for current year: 44.625 €, for the year
2009:178.500 € and for the year 20010: 178.500 €.
29
30