Latvia
Front-line NATO and EU state bound into Europol, Schengen, Prüm and Nordic-Baltic sharing, its traffic exposed to Sweden’s FRA cable-tapping, with 20+ espionage arrests since 2023 and Pegasus against Russian opposition journalists
Overview
EU Member State (since May 2004), NATO (since March 2004), Schengen (since December 2007). For the EU framework, see the EU Framework page.
Latvia is a front-line NATO state on Russia’s border with a 25% ethnic Russian population and a record 20+ espionage detentions since 2023. Three intelligence services (SAB, VDD, MIDD) reformed from KGB structures after 1991 independence. 18-month mandatory data retention, one of the longest in the EU (the President returned the law to Parliament over CJEU compatibility concerns before it was adopted with the period intact). Pegasus infections confirmed against Latvia-based Russian opposition journalists at Meduza (Citizen Lab/Access Now 2023). Kremlin hybrid warfare includes disinformation and “single-use agents” for sabotage.[1][2]
Latvia’s outward data-sharing runs through its alliances and treaties, each detailed below. It is a NATO member (since 2004) tied to the United States by a Defense Cooperation Agreement and a classified-information agreement, and its services take part in the Club de Berne intelligence forum, its Counter-Terrorism Group, the Nordic-Baltic Eight, and Baltic trilateral cooperation with Estonia and Lithuania; it is a party to the 1959 Council of Europe Mutual Assistance Convention and the Budapest Convention on Cybercrime, belongs to the Schengen and Prüm frameworks and to Europol and the European Investigation Order, and holds bilateral mutual legal assistance treaties with the United States, its Baltic neighbours, Russia, and Poland. These are the channels through which the domestic protections described below are, in practice, bypassed.[10][11][12][13][14]
International Data Sharing Agreements
Mutual Legal Assistance
EU Member States (26 countries): Latvia cooperates with the other EU states through the EU Convention on Mutual Assistance in Criminal Matters (2000), the Schengen Convention, and the European Investigation Order, which enables binding cross-border evidence requests.
European Convention on Mutual Assistance in Criminal Matters (1959, ETS 30): This Council of Europe instrument and its Additional Protocols apply between Latvia and all other parties. As of July 2026 it has 51 parties: all 46 Council of Europe member states (Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom) plus five non-members (Chile, Israel, Mongolia, the Republic of Korea, and the Russian Federation).[10]
Convention on Cybercrime (the Budapest Convention, 2001, ETS 185): Latvia is a party to the Council of Europe’s cybercrime convention, which governs the expedited preservation and cross-border disclosure of stored computer and subscriber data. As of July 2026 it has 82 parties: 45 Council of Europe member states (every one of the 46 except Ireland, which has signed but not ratified), namely Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom; together with 37 non-member states: Argentina, Australia, Benin, Brazil, Cabo Verde, Cameroon, Canada, Chile, Colombia, Costa Rica, Côte d’Ivoire, the Dominican Republic, Ecuador, Fiji, Ghana, Grenada, Israel, Japan, Kiribati, Mauritius, Morocco, New Zealand, Nigeria, Panama, Papua New Guinea, Paraguay, Peru, the Philippines, Rwanda, São Tomé and Príncipe, Senegal, Sierra Leone, Sri Lanka, Tonga, Tunisia, the United States, and Vanuatu.[11]
Bilateral MLATs: US-Latvia MLAT signed June 13, 1997, supplementary protocol December 7, 2005. Trilateral MLA agreement with Estonia and Lithuania (signed Tallinn, November 11, 1992). Bilateral MLA with Russia (civil, family, and criminal matters) and Poland. Latvia’s treaties are published in the consolidated legal database likumi.lv, where the full set is searchable.[8]
Intelligence and Defense Cooperation
NATO (since March 2004). NB8 (the Nordic-Baltic Eight: Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden) intelligence cooperation.[16] Latvia’s services participate in the Club de Berne and its Counter-Terrorism Group (CTG); the Club de Berne keeps no public roster, but it is reported to comprise the intelligence services of the 27 EU member states (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden) together with Norway and Switzerland, with the United Kingdom also reported as a member; the CTG comprises the same services plus the United Kingdom.[15] Baltic trilateral intelligence cooperation with Estonia and Lithuania. US-Latvia DCA (2017) defense cooperation agreement. US-Latvia Classified Information Agreement (December 2024). EU-US Umbrella Agreement, SWIFT/TFTP, PNR. Interpol I-24/7. Egmont Group.[9]
EU Law Enforcement Cooperation
SIS II: Real-time query and alert sharing across the Schengen Area (29 states: Austria, Belgium, Bulgaria, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and Switzerland).[12] Prüm: Automated DNA, fingerprint, and vehicle-registration exchange; the framework binds 31 states (all 27 EU members plus the non-EU Schengen associates Iceland, Liechtenstein, Norway, and Switzerland); Prüm II (2024) adds facial images and police records.[13]
Europol
As an EU member state, Latvia is one of the 27 EU members that constitute Europol, the EU Agency for Law Enforcement Cooperation (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden). Europol also holds operational agreements permitting personal-data exchange with 17 non-EU states (Albania, Australia, Bosnia and Herzegovina, Canada, Colombia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, and the United States) and cooperates with US law enforcement including the FBI, so Latvian person data flowing through Europol is reachable onward.[14]
The Privacy Backdoor Effect
- FRA transit exposure: Latvian traffic through Swedish cables subject to bulk FRA interception
- 18-month retention: One of EU’s longest, with CJEU compatibility unresolved
- EU Framework: Latvian data in SIS II, Prüm, EIO accessible to 27 EU states
- MLAT/CoE Conventions: US, Estonia, Lithuania, Russia, and Poland bilateral treaties, plus the 51 parties to the 1959 Convention and the 82 parties to the Budapest Convention, can request data through MLA channels
- Pegasus: Latvia-based journalists confirmed targets
- 25% Russian population: Creates unique intelligence targeting dynamics for both Russian and Western services
Surveillance and Intelligence
Three intelligence services under the Law on State Security Institutions (1994): SAB (Constitution Protection Bureau): civilian intelligence and counterintelligence. VDD (State Security Service): counterintelligence and internal security. MIDD (Defence Intelligence and Security Service): military intelligence and SIGINT. All reformed from KGB structures after 1991. Parliamentary oversight via the National Security Commission of the Saeima.[4]
Pegasus Targeting of Meduza Journalists
Citizen Lab and Access Now confirmed Pegasus infections against Latvia-based Russian opposition journalists at Meduza (2023). The independent Russian news outlet relocated to Riga after being designated a “foreign agent” and “undesirable organisation” in Russia. The targeting demonstrates that journalists in Latvia face spyware threats from both Russian intelligence and potentially from allied intelligence services with Pegasus access.[2]
Espionage and Hybrid Warfare
20+ espionage detentions since 2023, including former military personnel and government officials recruited by Russian intelligence. Kremlin hybrid warfare includes disinformation campaigns targeting the Russian-speaking population and “single-use agents” for sabotage operations. January 2025 submarine cable damage incident in the Baltic Sea underscored infrastructure vulnerability.[1]
Internet Infrastructure and Transit Exposure
LIX (Latvian Internet Exchange) provides domestic peering. Latvia’s international connectivity relies on terrestrial fibre links to Lithuania, Estonia, and Sweden. Submarine cable vulnerability demonstrated by the January 2025 Baltic Sea cable damage incident.[5]
FRA cable-tapping exposure: A significant proportion of Latvian international traffic routes through Sweden, where the FRA Law authorises bulk interception of cross-border cable traffic. The ECtHR found Sweden’s FRA regime violated Article 8 ECHR in Centrum för Rättvisa (2021), but reforms remain pending. Latvian traffic transiting Swedish cables is subject to FRA collection under Type 2 warrants (ministerial only, no judicial approval for non-Swedish persons).[6]
Recent Developments
Pegasus Infections at Meduza (2023): Citizen Lab/Access Now confirmed targeting of Latvia-based Russian opposition journalists.[2]
20+ Espionage Detentions (Since 2023): Record number of detentions for Russian intelligence recruitment.[1]
Baltic Cable Damage (January 2025): Submarine cable incident underscoring infrastructure vulnerability to hybrid warfare.[5]
US-Latvia Classified Information Agreement (December 2024): Deepened bilateral intelligence-sharing framework.[9]
Privacy Framework
The DVI (Datu valsts inspekcija) enforces the GDPR and Personal Data Processing Law (2018). Largest Baltic GDPR fine: EUR 1.2 million against Tet (2022) for disclosing unverified personal data to debt recovery services. The National Cyber Security Law (2024) transposes NIS2 (effective September 1, 2024). Law on State Security Institutions (1994) governs intelligence services.[3]
Data Retention
The Electronic Communications Law (2022) imposes 18-month mandatory retention of telecommunications metadata, one of the longest in the EU. The President returned the law to Parliament over CJEU compatibility concerns, but it was adopted with the 18-month period intact. Access requires judicial authorisation.[7]
Pending Legislation
- Data-retention reform: Latvia’s 18-month metadata-retention regime (Electronic Communications Law 2022), among the longest in the EU and adopted despite the President’s CJEU-compatibility objections, remains vulnerable to challenge and reform; no narrowing amendment has yet been enacted.[7]
- NIS2 full transposition: the National Cyber Security Law (2024) took effect September 1, 2024, but Latvia received a May 2025 Commission reasoned opinion for incomplete transposition; completing measures are pending as scope expands toward 6,000–8,000 entities.
- EU AI Act implementation: Latvia must designate AI market-surveillance authorities and adopt implementing rules; legislation is pending.
- Baltic cable-security measures: national implementation of EU/NATO subsea-cable protection frameworks continues following the January 2025 cable incident.[5]