[Investigation] Is Luxembourg the weak link in EU and Nato security?

In a case at the finish of the Cold War that made worldwide headlines, Luxembourg’s ambassador to Nato, Guy De Muyser, was stripped of his safety clearance when America’s Central Intelligence Agency (CIA) was knowledgeable by a Russian defector that he was leaking Western secrets and techniques to the Soviet Union.

But De Muyser, who’s now 97, remained Luxembourg’s ambassador to Belgium and retired with a string of medals, together with France’s Légion d’honneur.

“I used to be good mates with him,” recalled Jamie Shea, a retired British Nato official, chatting with EUobserver.

And Shea’s recollections made Luxembourg’s intelligence service, the Service de renseignement de l’État (SRE), sound a bit foolish.

“He [De Muyser] was dismissed [from his Nato post] due to a number of undisclosed journeys to Moscow. It was the CIA that tipped off the Luxembourg intelligence about these journeys,” Shea mentioned.

“They [the SRE] did not appear to know themselves,” he mentioned.

That was again in 1990, however based on some SRE insiders, the Grand Duchy continues to be letting down Western allies by not doing correct vetting of officers earlier than giving them clearance to deal with categorized EU and Nato recordsdata.

And two latest profession strikes by elite Luxembourgish officers posed the query in the event that they have been the proper males for the job.

Luxembourg’s former ambassador to Russia, Jean-Claude Knebeler, left to work for the Kremlin-owned Gazprombank in 2020.

Luxembourg’s former defence minister, Etienne Schneider, additionally took a job in 2020 with Russian funding agency Sistema, which is now underneath US sanctions over Kremlin ties.

Knebeler and Schneider have not been accused of leaking something.

Gazprombank and Sistema did not reply when EUobserver tried to succeed in them by way of their employers.

Nato has 5 varieties of safety classification: RESTRICTED, CONFIDENTIAL, SECRET, COSMIC TOP SECRET, and COSMIC TOP SECRET ATOMAL.

COSMIC stands for “Control of Secret Material in an International Command”. ATOMAL is no matter nuclear weapons info the UK and US shares with Nato.

And each Knebeler and Schneider would have had SRE clearance to deal with SECRET-level paperwork in their pre-Kremlin jobs.

Luxembourg declined to say when their safety clearances have been revoked.

But whether or not they did something mistaken or not, the optics alone have been dangerous sufficient to wreck belief amongst Nato mates.

“It’s a recognized modus operandi of Russian particular providers to make use of state corporations to deprave Western officers,” mentioned a Western intelligence contact, talking on situation of anonymity.

“What’s the distinction how they [Knebeler and Schneider] share their data? I’d do it orally — that approach there is no hint of what was talked about,” the contact mentioned.

The Luxembourg problem first arose in 2016, when authorities reforms noticed its nationwide vetting company lose entry to police data, making it unattainable to see if candidates met authorized standards.

The SRE’s inner commerce union wrote to Nato HQ in Brussels in 2018 to warn them, in correspondence later made public by Luxembourg’s parliament.

Nato replied saying Luxembourg needed to meet “minimum standards” enshrined in EU accords, akin to the the 1997 Agreement of the Parties of the North Atlantic Treaty for the Security of Information.

“The actions taken [by Luxembourg] don’t assist the spirit of the coverage”, a Nato official mentioned.

But the Nato official additionally famous that vetting was a part of “nationwide prerogatives that fall outdoors of the remit of the NOS” — Nato’s Office of Security.

And some 4 years later — on 3 June 2022 — nothing had modified, when the SRE commerce union wrote to Latvia’s intelligence service, the Constitution Protection Bureau (SAB), to say Luxembourg was nonetheless dropping the ball.

The SRE reacted by giving a “dishonourable discharge” to the trade-union chief, Philippe Schaack, on grounds he had leaked nationwide secrets and techniques to an unauthorised celebration (SAB).

“My solely goal was to repair long-standing and formally acknowledged shortcomings in the nationwide vetting procedures,” Schaack, who’s preventing the choice in a Luxembourg tribunal, advised EUobserver.

“As a fellow Nato ally, Latvia can hardly be seen as an unauthorised celebration with respect to widespread Nato safety procedures,” he added.

“It was simpler to make them [the SRE trade union] shut up by making an attempt to discredit them than to repair the drawback, which has endured for seven years now and counting”, a Belgian intelligence contact advised EUobserver.

Cosmic cock-up?

The SRE and Luxembourg have a chequered document except for any De Muyser-type eventualities.

Luxembourg is a monetary centre with a status for Russian money-laundering, as uncovered in the 2014 LuxLeaks scandal.

Its SRE has simply 80 or so employees, based on a database leak reported in 2020.

Luxembourg’s ex-prime minister and ex-European Commission president Jean-Claude Juncker resigned in 2013 in an imbroglio involving SRE unlawful wire-tapping and corrupt pay-offs.

And the SRE’s former chief of operations, Frank Schneider, is at the moment a world fugitive, after snapping off his ankle bracelet whereas underneath home arrest in France in June, pending extradition to the US for his alleged function in a $4bn [€3.68bn] crypto-currency Ponzi scheme.

The Grand Duchy declined to touch upon vetting, on the Gazprombank and Sistema instances, or the Ponzi affair.

“The issues which have arisen from the conduct of the SREL, the SRE’s predecessor, have been absolutely addressed in 2016 when a transparent, detailed authorized framework, applicable complete procedures and supervision mechanisms have been put in place,” the workplace of Luxembourg prime minister Xavier Bettel advised EUobserver.

“The SRE is a revered member of the worldwide safety neighborhood and thus actively participates in the associated intelligence-sharing fora”, they added.

Nato declined to remark.

But the NOS carried out a Luxembourg inspection in 2019 and gave it a broad all-clear, Nato sources advised EUobserver.

And some consultants mentioned it was onerous to imagine the NOS would have turned a blind eye if the SRE commerce union was proper.

Edward Arnold, a safety specialist at the Royal United Services Institute (RUSI) think-tank in London, was a British army officer serving at Nato in Belgium when Russia first invaded Ukraine in 2014.

“Nato positively cares about these things [proper vetting and counter-intelligence], even when it isn’t resourced at the degree that you simply’d like”, he mentioned.

The Luxembourg drawback regarded like a “molehill” slightly than a “mountain”, a senior EU official added.

But two Western intelligence contacts painted a special image.

“It looks like Nato would not actually care about the safety of its SECRET recordsdata, solely from COSMIC TOP SECRET and ATOMAL — that is enormous, it is reckless,” one among the sources mentioned.

“This is not only a Luxembourg cock-up — it is a Nato cock-up,” he added.

The second contact mentioned: “Russian particular providers exploit the incontrovertible fact that worldwide constructions, like the EU and Nato, are basically dysfunctional in the case of countering intelligence threats.”

“They solely appear to take motion in main instances, often for PR causes,” they added.

And the Luxembourg alert wasn’t the first of its type.

The Club de Berne, a Western intelligence-sharing construction outdoors EU or Nato establishments, highlighted safety failures in Vienna in 2019 in a report leaked to Austrian newspaper Expressen.

Belgium is the present presidency of the Club de Berne and can be partly accountable for EU and Nato safety, as their HQs’ host state.

Its intelligence service, the La Sûreté de l’Etat (VSSE), is nicely conscious of Luxembourg’s alleged shortcomings.

But it mentioned: “The VSSE wish to stress that our service retains full confidence in the SRE”.

It additionally voiced “full confidence” in Austria’s intelligence providers.

“The VSSE as a [Club de Berne] president has no authority on the functioning of particular person providers, who solely report back to their nationwide hierarchies,” it added, regardless that its membership did use its gentle energy to press for Austrian enhancements.

Latvia, whom the Luxembourg commerce union warned, did not defend the SRE.

“It is just not our obligation and duty to judge the work of different providers and categorical opinions”, the SAB advised EUobserver.

“For positive, safety vetting of personnel with regard to Nato belief and intelligence-sharing is very essential,” it added.

“A working and trusting relationship in the sphere of intelligence gathering and sharing is a vital a part of profitable actions towards crime and worldwide terrorism,” the Austrian inner ministry additionally mentioned, after conducting reforms underneath Club-de-Berne stress.

Spy capital?

The alleged Luxembourg vetting drawback comes amid an unprecedented Western crackdown on Russian espionage in Europe.

The SRE wrote to Latvia in June 2022 at the similar time as Nato states started expelling a whole bunch of Russian diplomats on grounds they have been spies working underneath cowl.

Luxembourg’s neighbour, Belgium, expelled 40 Russians — nearly half of all the Russian diplomats in the nation — in the largest counter-espionage clear-out in its historical past.

Brussels was the “spy capital” of Europe 10 years in the past, based on former VSSE chief Alain Winants.

The Russian acting-ambassador to the EU, Kirill Logvinov, continues to be in place, regardless that the VSSE warned the EU overseas service final 12 months that he works for Russia’s foreign-intelligence service, the SVR.

“Belgium has taken this motion [the 40 expulsions] in an effort to scale back the threat of Russian spying on and from its territory. However, the VSSE is conscious this doesn’t cease such actions,” the VSSE advised EUobserver.

“The VSSE will proceed to observe the scenario and advise its political authorities on the plan of action to take,” the Club-de-Berne presidency holder and EU-and-Nato safety supplier mentioned.

Brussels will, this week, grow to be a “spy capital” in a special approach when Nato’s Civilian Intelligence Committee and Military Intelligence Committee meet at Nato HQ.

The twice-yearly occasion brings collectively 75 intelligence-service administrators from Nato’s 31 member states to debate information-sharing.

But if that kind of occasion made Brussels a goal for hostile overseas powers, then close by Luxembourg was additionally in danger.

Luxembourg is a brief drive from Belgium, France, Germany, and the Netherlands, all of that are in Europe’s free-movement ‘Schengen Zone’, which suggests no border controls.

“A Russian operative based mostly in Luxembourg might simply drive throughout the border to satisfy his informant or handler and be again earlier than anybody is aware of he is gone,” a 3rd Western intelligence supply mentioned.

But Luxembourg expelled only one Russian diplomat in 2022 — Dmitry Alexandrovich Solomasov, a 35-year outdated “cipher clerk” at the Russian embassy, who was suspected of being an SVR officer, based on EUobserver’s sources.

That nonetheless left eight Russian diplomats in place, Luxembourg’s overseas ministry mentioned, in addition to 11 different Russian officers and spouses named in Luxembourg’s “corps diplomatique” ledger in October 2023.

Luxembourg declined to verify or deny if Solomasov was the Russian it expelled.

Its muted response was right down to fears that Russia would shut down Luxembourg’s embassy in Moscow if it went too far, a Luxembourgish supply advised EUobserver.

Recalling the Cold War-era De Muyser case, Shea, the retired Nato official, mentioned: “This was way back and I can not say if it factors to endemic issues in Luxembourg intelligence providers”.

But for a few of the Grand Duchy’s bigger Western mates, the Solomasov case confirmed that Luxembourg nonetheless wasn’t taking the Russian risk severely.

“He [Solomasov] was a cipher clerk, which is type of humorous, as a result of it means the SRE did not need to exclude any lively Russian subject officers. It implies that the SRE’s counter-intelligence unit is doing little to struggle Russian spy exercise,” one among the Western intelligence contacts mentioned.