ANNEX VISupplementary provisions
ANNEX VI EXCHANGE OF CLASSIFIED INFORMATION WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS I. INTRODUCTION 1. This Annex sets out provisions for implementing Article 13. II. FRAMEWORKS GOVERNING THE EXCHANGE OF CLASSIFIED INFORMATION 2. Where the Council determines that a long-term need exists to exchange classified information, — a security of information agreement shall be concluded, or — an administrative arrangement shall be entered into, in accordance with Article 13(2) and Sections III and IV and based on a recommendation from the Security Committee. 3. Where EUCI generated for the purposes of a CSDP operation is to be provided to third States or international organisations participating in such an operation, and where neither of the frameworks referred to in paragraph 2 exists, the exchange of EUCI with the contributing third State or international organisation shall be regulated, in accordance with Section V, under: — a framework participation agreement, — an ad hoc participation agreement, or — in the absence of either of the above, an ad hoc administrative arrangement. 4. In the absence of a framework referred to in paragraphs 2 and 3, and where a decision is taken to release EUCI to a third State or international organisation on an exceptional ad hoc basis in accordance with Section VI, written assurances shall be sought from the third State or international organisation concerned to ensure that it protects any EUCI released to it in accordance with the basic principles and minimum standards set out in this Decision. III. SECURITY OF INFORMATION AGREEMENTS 5. Security of information agreements shall establish the basic principles and minimum standards governing the exchange of classified information between the Union and a third State or international organisation. 6. Security of information agreements shall provide for technical implementing arrangements to be agreed between the competent security authorities of the relevant Union institutions and bodies and the competent security authority of the third State or international organisation in question. Such arrangements shall take account of the level of protection provided by the security regulations, structures and procedures in place in the third State or international organisation concerned. They shall be approved by the Security Committee. 7. No EUCI shall be exchanged under a security of information agreement by electronic means unless explicitly provided for in the agreement or in corresponding technical implementing arrangements. 8. When the Council concludes a security of information agreement, a registry shall be designated in each party as the main point of entry and exit for classified information exchanges. 9. In order to assess the effectiveness of the security regulations, structures and procedures in the third State or international organisation concerned, assessment visits shall be conducted in mutual agreement with the third State or international organisation concerned. Such assessment visits shall be conducted in accordance with the relevant provisions of Annex III and shall evaluate: (a) the regulatory framework applicable for protecting classified information; (b) any specific features of the security policy and the way in which security is organised in the third State or international organisation which may have an impact on the level of classified information that may be exchanged; (c) the security measures and procedures actually in place; and (d) security clearance procedures for the level of EUCI to be released. 10. The team conducting an assessment visit on behalf of the Union shall assess whether the security regulations and procedures in the third State or international organisation in question are adequate for the protection of EUCI at a given level. 11. The findings of such visits shall be set out in a report on the basis of which the Security Committee shall determine the maximum level of EUCI which may be exchanged in hard copy, and where appropriate electronically, with the third party concerned as well as any specific conditions governing exchange with that party. 12. Every endeavour shall be made to conduct a full security assessment visit to the third State or international organisation in question before the Security Committee approves the implementing arrangements in order to establish the nature and the effectiveness of the security system in place. However, where this is not possible the Security Committee shall receive as full a report as possible from the GSC Security Office, based on the information available to it, informing the Security Committee about the security regulations applicable and the way in which security is organised in the third State or international organisation concerned. 13. The report on the assessment visit, or in the absence of such a report the report referred to in paragraph 12, shall be forwarded to, and deemed satisfactory by, the Security Committee before EUCI is actually released to the third State or international organisation in question. 14. The competent security authorities of the Union institutions and bodies shall communicate to the third State or international organisation the date as from when the Union is in a position to release EUCI under the agreement, as well as the maximum level of EUCI which may be exchanged in paper form or by electronic means. 15. Follow-up assessment visits shall be conducted as necessary, in particular if: (a) there is a need for the releasable level of EUCI to be raised; (b) the Union has been notified of fundamental changes in the third State or international organisation’s security arrangements that might have an impact on how it protects EUCI; or (c) there has been a serious incident involving unauthorised disclosure of EUCI. 16. Once the security of information agreement is in force and classified information is exchanged with the third State or international organisation concerned, the Security Committee may decide to modify the maximum level of EUCI which may be exchanged in paper form or by electronic means, in particular in the light of any follow-up assessment visit. IV. ADMINISTRATIVE ARRANGEMENTS 17. Where a long-term need exists to exchange information classified as a general rule no higher than RESTREINT UE/EU RESTRICTED with a third State or international organisation, and where the Security Committee has established that the party in question does not have a sufficiently developed security system for it to be possible to enter into a security of information agreement, the Secretary-General may, subject to approval by the Council, enter into an administrative arrangement on behalf of the GSC with the relevant authorities of the third State or international organisation in question. 18. Where, for urgent operational reasons, a framework for exchanging classified information needs to be put in place rapidly, exceptionally the Council may decide that an administrative arrangement be entered into for exchanging information of a higher classification level. 19. Administrative arrangements shall as a general rule take the form of an Exchange of Letters. 20. An assessment visit referred to in paragraph 9 shall be conducted and the report, or in the absence of such a report the report referred to in paragraph 12, forwarded to, and deemed satisfactory by, the Security Committee before EUCI is actually released to the third State or international organisation in question. 21. No EUCI shall be exchanged under an administrative arrangement by electronic means unless explicitly provided for in the arrangement. V. EXCHANGE OF CLASSIFIED INFORMATION IN THE CONTEXT OF CSDP OPERATIONS 22. Framework participation agreements govern the participation of third States or international organisations in CSDP operations. Such agreements shall include provisions on the release of EUCI generated for the purposes of CSDP operations to the contributing third States or international organisations. The maximum classification level of EUCI which may be exchanged shall be RESTREINT UE/EU RESTRICTED for civilian CSDP operations and CONFIDENTIEL UE/EU CONFIDENTIAL for military CSDP operations, unless otherwise laid down in the Decision establishing each CSDP operation. 23. Ad hoc participation agreements concluded for a specific CSDP operation shall include provisions on the release of EUCI generated for the purposes of that operation to the contributing third State or international organisation. The maximum classification level of EUCI which may be exchanged shall be RESTREINT UE/EU RESTRICTED for civilian CSDP operations and CONFIDENTIEL UE/EU CONFIDENTIAL for military CSDP operations, unless otherwise laid down in the Decision establishing each CSDP operation. 24. In the absence of a security of information agreement and pending the conclusion of a participation agreement, the release of EUCI generated for the purposes of the operation to a third State or international organisation participating in the operation shall be governed by an administrative arrangement to be entered into by the High Representative or subject to a decision on ad hoc release in accordance with Section VI. EUCI shall only be exchanged under such an arrangement as long as the participation of the third State or international organisation is still envisaged. The maximum classification level of EUCI which may be exchanged shall be RESTREINT UE/EU RESTRICTED for civilian CSDP operations and CONFIDENTIEL UE/EU CONFIDENTIAL for military CSDP operations, unless otherwise laid down in the Decision establishing each CSDP operation. 25. The provisions on classified information to be included in framework participation agreements, ad hoc participation agreements and ad hoc administrative arrangements referred to in paragraphs 22 to 24 shall provide that the third State or international organisation in question shall ensure that its personnel seconded to any operation will protect EUCI in accordance with the Council’s security rules and with further guidance issued by the competent authorities, including the operation’s chain of command. 26. If a security of information agreement is subsequently concluded between the Union and a contributing third State or international organisation, the security of information agreement shall supersede the provisions on the exchange of classified information laid down in any framework participation agreement, ad hoc participation agreement or ad hoc administrative arrangement as far as the exchange and handling of EUCI is concerned. 27. No exchange of EUCI by electronic means shall be permitted under a framework participation agreement, ad hoc participation agreement or ad hoc administrative arrangement with a third State or international organisation, unless explicitly provided for in the agreement or arrangement in question. 28. EUCI generated for the purposes of a CSDP operation may be disclosed to personnel seconded to that operation by third States or international organisations in accordance with paragraphs 22 to 27. When authorising access to EUCI in premises or in CIS of a CSDP operation by such personnel, measures shall be applied (including recording of EUCI disclosed) to mitigate the risk of loss or compromise. Such measures shall be defined in relevant planning or mission documents. 29. In the absence of a security of information agreement, the release of EUCI, in the event of a specific and immediate operational need, to the host State on whose territory a CSDP operation is conducted, may be governed by an administrative arrangement to be entered into by the High Representative. This possibility shall be provided for in the Decision establishing the CSDP operation. EUCI released under such circumstances shall be restricted to that generated for the purposes of the CSDP operation and classified no higher than RESTREINT UE/EU RESTRICTED, unless a higher level of classification is laid down in the Decision establishing the CSDP operation. Under such an administrative arrangement, the host State shall be required to undertake to protect EUCI according to minimum standards which are no less stringent than those laid down in this Decision. 30. In the absence of a security of information agreement, the release of EUCI to relevant third States and international organisations, other than those participating in a CSDP operation, may be governed by an administrative arrangement to be entered into by the High Representative. Where appropriate, this possibility, as well as any conditions attached thereto, shall be provided for in the Decision establishing the CSDP operation. EUCI released under such circumstances shall be restricted to that generated for the purposes of the CSDP operation and classified no higher than RESTREINT UE/EU RESTRICTED, unless a higher level of classification is laid down in the Decision establishing the CSDP operation. Under such an administrative arrangement, the third State or international organisation in question shall be required to undertake to protect EUCI according to minimum standards which are no less stringent than those laid down in this Decision. 31. No implementing arrangements or assessment visits are required prior to implementing the provisions on release of EUCI in the context of paragraphs 22, 23 and 24. VI. EXCEPTIONAL AD HOC RELEASE OF EUCI 32. Where no framework is in place in accordance with Sections III to V, and where the Council or one of its preparatory bodies determines the exceptional need to release EUCI to a third State or international organisation, the GSC shall: (a) to the extent possible, verify with the security authorities of the third State or international organisation concerned that its security regulations, structures and procedures are such that EUCI released to it will be protected to standards no less stringent than those laid down in this Decision; and (b) invite the Security Committee, on the basis of available information, to issue a recommendation regarding the confidence that can be placed in the security regulations, structures and procedures in the third State or international organisation to which the EUCI is to be released. 33. If the Security Committee issues a recommendation in favour of releasing the EUCI, the matter shall be referred to the Committee of Permanent Representatives (Coreper), which shall take a decision on its release. 34. If the Security Committee’s recommendation is not in favour of releasing the EUCI: (a) for matters relating to CFSP/CSDP, the Political and Security Committee shall discuss the matter and formulate a recommendation for a decision by Coreper; (b) for all other matters, Coreper shall discuss the matter and take a decision. 35. Where deemed appropriate, and subject to the prior written consent of the originator, Coreper may decide that the classified information may be released only in part or only if downgraded or declassified beforehand, or that the information to be released shall be prepared without reference to the source or original EU classification level. 36. Following a decision to release EUCI, the GSC shall forward the document concerned, which shall bear a releasability marking indicating the third State or international organisation to which it has been released. Prior to or upon actual release, the third party in question shall undertake in writing to protect the EUCI it receives in accordance with the basic principles and minimum standards set out in this Decision. VII. AUTHORITY TO RELEASE EUCI TO THIRD STATES OR INTERNATIONAL ORGANISATIONS 37. Where a framework exists in accordance with paragraph 2 for exchanging classified information with a third State or international organisation, the Council shall take a decision to authorise the Secretary-General to release EUCI, in accordance with the principle of originator’s consent, to the third State or international organisation in question. The Secretary-General may delegate such authorisation to senior GSC officials. 38. Where a security of information agreement exists in accordance with paragraph 2, first indent, the Council may take a decision to authorise the High Representative to release EUCI originating in the Council in the area of the Common Foreign and Security Policy, after having obtained the consent of the originator of any source material contained therein, to the third State or international organisation in question. The High Representative may delegate such authorisation to senior EEAS officials or to EUSRs. 39. Where a framework exists in accordance with paragraph 2 or with paragraph 3 for exchanging classified information with a third State or international organisation, the High Representative shall be authorised to release EUCI, in accordance with the Decision establishing the CSDP operation and with the principle of originator’s consent. The High Representative may delegate such authorisation to senior EEAS officials, to EU Operation, Force or Mission Commanders, or to Heads of EU Mission.