Is Luxembourg the weak hyperlink in EU and Nato safety?

In a case that made worldwide headlines on the finish of the Chilly Warfare, Luxembourg’s ambassador to Nato, Man De Muyser, was stripped of his safety clearance when America’s Central Intelligence Company (CIA) was knowledgeable by a Russian defector that he was leaking Western secrets and techniques to the Soviet Union.

However De Muyser, who’s now 97, remained Luxembourg’s ambassador to Belgium and retired with a string of medals, together with France’s Légion d’honneur.

”I used to be good pals with him,” recalled Jamie Shea, a retired British Nato official, talking to EUobserver.

And Shea’s recollections made Luxembourg’s intelligence service, the Service de renseignement de l’État (SRE), sound a bit foolish.

”He [De Muyser] was dismissed [from his Nato post] due to a number of undisclosed journeys to Moscow. It was the CIA that tipped off the Luxembourg intelligence about these journeys,” Shea mentioned.

”They [the SRE] did not appear to know themselves,” he mentioned.

That was again in 1990, however in line with some SRE insiders, the Grand Duchy remains to be letting down Western allies by not doing correct vetting of officers earlier than giving them clearance to deal with labeled EU and Nato recordsdata.

And two current profession strikes by elite Luxembourgish officers posed the query in the event that they had been the proper males for the job.

Luxembourg’s former ambassador to Russia, Jean-Claude Knebeler, left to work for the Kremlin-owned Gazprombank in 2020.

Luxembourg’s former defence minister, Etienne Schneider, additionally took a job in 2020 with Russian funding agency Sistema, which is now below US sanctions over Kremlin ties.

Knebeler and Schneider have not been accused of leaking something.

Gazprombank and Sistema did not reply when EUobserver tried to succeed in them through their employers.

Nato has 5 forms of safety classification: RESTRICTED, CONFIDENTIAL, SECRET, COSMIC TOP SECRET, and COSMIC TOP SECRET ATOMAL.

COSMIC stands for ”Management of Secret Materials in an Worldwide Command”. ATOMAL is atomic-weapons data shared by the UK and US with Nato.

And each Knebeler and Schneider would have had SRE clearance to deal with SECRET-level paperwork of their pre-Kremlin jobs.

Luxembourg declined to say when their safety clearances had been revoked.

However whether or not they did something improper or not, the optics alone had been dangerous sufficient to break belief amongst Nato pals.

”It is a recognized modus operandi of Russian particular providers to make use of state corporations to deprave Western officers,” mentioned a Western intelligence contact, talking on situation of anonymity.

”What is the distinction how they [Knebeler and Schneider] share their information? I would do it orally — that method there is not any hint of what was talked about,” the contact mentioned.

The brand new Luxembourg downside arose in 2016, when authorities reforms noticed its nationwide vetting company lose entry to police data, making it unimaginable to see if candidates met authorized standards.

The SRE’s inner commerce union wrote to Nato HQ in Brussels in 2018 to warn them, in correspondence later made public by Luxembourg’s parliament.

Nato replied saying Luxembourg needed to meet ”minimal requirements” enshrined in EU accords, such because the 1997 Settlement Between the Events to the North Atlantic Treaty for the Safety of Info.

”The actions taken [by Luxembourg] don’t help the spirit of the coverage”, a Nato official mentioned.

However the Nato official additionally famous that vetting was a part of ”nationwide prerogatives that fall exterior of the remit of the NOS” — Nato’s Workplace of Safety.

And a few 4 years later — on 3 June 2022 — nothing had modified, when the SRE commerce union wrote to Latvia’s intelligence service, the Structure Safety Bureau (SAB), to say Luxembourg was nonetheless dropping the ball.

The SRE reacted by giving a ”dishonourable discharge” to the trade-union chief, Philippe Schaack, on grounds he had leaked nationwide secrets and techniques to an unauthorised get together (SAB).

”My solely goal was to repair long-standing and formally acknowledged shortcomings within the nationwide vetting procedures,” Schaack, who’s preventing the choice in a Luxembourg tribunal, instructed EUobserver.

”As a fellow Nato ally, Latvia can hardly be seen as an unauthorised get together with respect to frequent Nato safety procedures,” he added.

”It was simpler to make them [the SRE trade union] shut up by attempting to discredit them than to repair the issue, which has continued for seven years now and counting”, a Belgian intelligence contact instructed EUobserver.

Cosmic cock-up?

Luxembourg and the SRE have a chequered document except for any De Muyser-type situations.

Luxembourg is a monetary centre with a fame for Russian money-laundering, as uncovered within the 2014 LuxLeaks scandal.

Its SRE has simply 80 or so workers, in line with a database leak reported in 2020.

Luxembourg’s ex-prime minister and ex-European Fee president Jean-Claude Juncker resigned in 2013 in an imbroglio involving SRE unlawful wire-tapping and corrupt pay-offs.

And the SRE’s former chief of operations, Frank Schneider, is at present a global fugitive, after snapping off his ankle bracelet whereas below home arrest in France in June, pending extradition to the US for his alleged function in a $4bn [€3.68bn] crypto-currency Ponzi scheme.

The Grand Duchy declined to touch upon vetting, on the Gazprombank and Sistema instances, or the Ponzi affair.

”The issues which have arisen from the conduct of the SREL, the SRE’s predecessor, have been totally addressed in 2016 when a transparent, detailed authorized framework, acceptable complete procedures and supervision mechanisms had been put in place,” the workplace of Luxembourg prime minister Xavier Bettel instructed EUobserver.

”The SRE is a revered member of the worldwide safety group and thus actively participates within the associated intelligence-sharing fora”, they added.

Nato declined to remark.

However the NOS carried out a Luxembourg inspection in 2019 and gave it a broad all-clear, Nato sources instructed EUobserver.

And a few consultants mentioned it was onerous to consider the NOS would have turned a blind eye if the SRE commerce union was proper.

Edward Arnold, a safety specialist on the Royal United Companies Institute (RUSI) think-tank in London, was a British army officer serving at Nato in Belgium when Russia first invaded Ukraine in 2014.

”Nato undoubtedly cares about these items [proper vetting and counterintelligence], even when it isn’t resourced on the degree that you just’d like”, he mentioned.

The Luxembourg downside regarded like a ”molehill” somewhat than a ”mountain”, a senior EU official added.

However two Western intelligence contacts painted a special image.

”It looks like Nato does not actually care in regards to the safety of its SECRET recordsdata, solely from COSMIC TOP SECRET and ATOMAL — that is big, it is reckless,” one of many sources mentioned.

”This is not only a Luxembourg cock-up — it is a Nato cock-up,” he added.

The second contact mentioned: ”Russian particular providers exploit the truth that worldwide buildings, just like the EU and Nato, are essentially dysfunctional relating to countering intelligence threats.”

”They solely appear to take motion in main instances, normally for PR causes,” they added.

And the Luxembourg alert wasn’t the primary of its sort.

The Membership de Berne, a Western intelligence-sharing construction exterior EU or Nato establishments, highlighted safety failures in Vienna in 2019 in a report leaked to Austrian newspaper Expressen.

Belgium is the present presidency of the Membership de Berne and can be partly liable for EU and Nato safety, as their HQs’ host state.

Its intelligence service, La Sûreté de l’Etat (VSSE), is properly conscious of Luxembourg’s alleged shortcomings, in line with EUobserver sources.

Nevertheless it mentioned: ”The VSSE wish to stress that our service retains full confidence within the SRE”.

It additionally voiced ”full confidence” in Austria’s intelligence providers.

”The VSSE as a [Club de Berne] president has no authority on the functioning of particular person providers, who solely report back to their nationwide hierarchies,” a Belgian intelligence contact added, though the membership did use its delicate energy to press for Austrian enhancements.

Latvia, whom the Luxembourg commerce union warned, did not defend the SRE.

”It isn’t our responsibility and duty to guage the work of different providers and specific opinions”, the SAB instructed EUobserver.

”For positive, safety vetting of personnel with regard to Nato belief and intelligence-sharing is very vital,” it added.

”A working and trusting relationship within the sphere of intelligence gathering and sharing is a crucial a part of profitable actions in opposition to crime and worldwide terrorism,” the Austrian inner ministry additionally mentioned, after conducting reforms below Membership-de-Berne stress.

Spy capital?

The alleged Luxembourg vetting downside comes amid an unprecedented Western crackdown on Russian espionage in Europe.

The SRE wrote to Latvia in June 2022 similtaneously Nato states started expelling a whole lot of Russian diplomats on grounds they had been spies working below cowl.

Luxembourg’s neighbour, Belgium, expelled 40 Russians — nearly half of all of the Russian diplomats within the nation — within the largest counter-espionage clear-out in its historical past.

Brussels was once the ”spy capital” of Europe 10 years in the past, in line with former VSSE chief Alain Winants.

The Russian acting-ambassador to the EU, Kirill Logvinov, remains to be in place, though the VSSE warned the EU international service final 12 months that he works for Russia’s foreign-intelligence service, the SVR.

”Belgium has taken this motion [the 40 expulsions] in an effort to scale back the chance of Russian spying on and from its territory. Nevertheless, the VSSE is conscious this doesn’t cease such actions,” the VSSE instructed EUobserver.

”The VSSE will proceed to observe the scenario and advise its political authorities on the plan of action to take,” the Membership-de-Berne presidency holder and EU-and-Nato safety supplier mentioned.

Brussels will, this week, turn out to be a ”spy capital” another way when Nato’s Civilian Intelligence Committee and Army Intelligence Committee meet at Nato HQ.

The twice-yearly occasion brings collectively 75 intelligence-service administrators from Nato’s 31 member states to debate information-sharing.

But when that kind of occasion made Brussels a goal for hostile international powers, then close by Luxembourg was additionally in danger.

Luxembourg is a brief drive from Belgium, France, Germany, and the Netherlands, all of that are in Europe’s free-movement ’Schengen Zone’, which suggests no border controls.

”A Russian operative primarily based in Luxembourg may simply drive throughout the border to satisfy his informant or handler and be again earlier than anybody is aware of he is gone,” a 3rd Western intelligence supply mentioned.

However Luxembourg expelled only one Russian diplomat in 2022 — Dmitry Alexandrovich Solomasov, a 35-year previous ”cipher clerk” on the Russian embassy, who was suspected of being an SVR officer, in line with EUobserver’s sources.

That also left eight Russian diplomats in place, Luxembourg’s international ministry mentioned, in addition to 11 different Russian officers and spouses named in Luxembourg’s ”corps diplomatique” ledger in October 2023.

Luxembourg declined to substantiate or deny if Solomasov was the Russian it expelled.

Its muted response was all the way down to fears that Russia would shut down Luxembourg’s embassy in Moscow if it went too far, a Luxembourgish supply instructed EUobserver.

Recalling the Chilly Warfare-era De Muyser case, Shea, the retired Nato official, mentioned: ”This was way back and I am unable to say if it factors to endemic issues in Luxembourg intelligence providers”.

However for among the Grand Duchy’s bigger Western pals, the Solomasov case confirmed that Luxembourg nonetheless wasn’t taking the Russian risk significantly.

”He [Solomasov] was a cipher clerk, which is type of humorous, as a result of it means the SRE did not wish to exclude any energetic Russian discipline officers. It implies that the SRE’s counterintelligence unit is doing little to combat Russian spy exercise,” one of many Western intelligence contacts mentioned.