Lithuania

Overview

EU Member State (since May 2004), NATO (since March 2004). For the EU framework, see the EU Framework page.

Lithuania occupies one of the most strategically sensitive positions in Europe: bordered by Russia’s Kaliningrad exclave and Belarus, controlling one side of the Suwalki Gap, the 100-km corridor NATO considers its most vulnerable point. This geography has driven intelligence capabilities far exceeding what 2.8 million people would suggest. VSD (civilian intelligence) and AOTD (military intelligence, origins 1918) face persistent Russian, Chinese, and Belarusian espionage. Pegasus infections confirmed on Lithuanian territory (May 2024). The BCS East-West Interlink (Lithuania’s sole submarine cable to Sweden) was severed November 2024 by the Chinese vessel Yi Peng 3. Belarus weaponised migration in 2021.^[1][2]

Lithuania’s outward data-sharing runs through its alliances and treaties, each detailed below. It is a NATO member (since 2004, hosting the Alliance’s ENSEC Centre of Excellence in Vilnius), and its services take part in the Club de Berne intelligence forum, its Counter-Terrorism Group, the Nordic-Baltic Eight, and Baltic trilateral cooperation with Estonia and Latvia; it is a party to the 1959 Council of Europe Mutual Assistance Convention and the Budapest Convention on Cybercrime, belongs to the Schengen and Prüm frameworks and to Europol and the European Investigation Order, and holds bilateral mutual legal assistance treaties with the United States, its Baltic neighbours, and Russia. These are the channels through which the domestic protections described below are, in practice, bypassed.^{[13][14][15][16][17]}

International Data Sharing Agreements

Mutual Legal Assistance

EU Member States (26 countries): Lithuania cooperates with the other EU states through the EU Convention on Mutual Assistance in Criminal Matters (2000), the Schengen Convention, and the European Investigation Order, which enables binding cross-border evidence requests.

European Convention on Mutual Assistance in Criminal Matters (1959, ETS 30): This Council of Europe instrument and its Additional Protocols apply between Lithuania and all other parties. As of July 2026 it has 51 parties: all 46 Council of Europe member states (Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom) plus five non-members (Chile, Israel, Mongolia, the Republic of Korea, and the Russian Federation).^[13]

Convention on Cybercrime (the Budapest Convention, 2001, ETS 185): Lithuania is a party to the Council of Europe’s cybercrime convention, which governs the expedited preservation and cross-border disclosure of stored computer and subscriber data. As of July 2026 it has 82 parties: 45 Council of Europe member states (every one of the 46 except Ireland, which has signed but not ratified), namely Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom; together with 37 non-member states: Argentina, Australia, Benin, Brazil, Cabo Verde, Cameroon, Canada, Chile, Colombia, Costa Rica, Côte d’Ivoire, the Dominican Republic, Ecuador, Fiji, Ghana, Grenada, Israel, Japan, Kiribati, Mauritius, Morocco, New Zealand, Nigeria, Panama, Papua New Guinea, Paraguay, Peru, the Philippines, Rwanda, São Tomé and Príncipe, Senegal, Sierra Leone, Sri Lanka, Tonga, Tunisia, the United States, and Vanuatu.^[14]

EU e-Evidence Regulation (2023/1543) and Directive (2023/1544): since August 18, 2026 a judicial authority in any other participating EU member state can serve a European Production Order or European Preservation Order directly on a service provider established or represented in Lithuania, and Lithuania’s own prosecutors and courts can do the same to providers elsewhere in the Union, for subscriber, IP-identification, traffic and content data, with a ten-day deadline (eight hours in an emergency) and no mutual-assistance request in between. Lithuania is notified of traffic- and content-data orders served on its providers and may stop execution only on the Regulation’s listed grounds. Any provider offering services in the EU, wherever it is headquartered, must designate an addressee in the Union to receive orders, and an unjustified refusal can draw a penalty of up to 2% of worldwide annual turnover. For provider-held data this instrument now sits ahead of the Budapest Convention and the 1959 Convention among EU states; Denmark alone is outside it, and Switzerland adopted a transitional permit scheme in October 2026 so that its providers can comply (see the European Union and Switzerland pages).^[20]

Bilateral MLATs: US-Lithuania MLAT signed January 16, 1998, in force August 26, 1999. Trilateral MLA with Estonia and Latvia (Tallinn, November 11, 1992). Bilateral MLA with Russia (pre-independence agreement on legal cooperation). Lithuania’s treaties are published in the Register of Legal Acts, searchable via the Seimas legal-acts database.^[10]

Intelligence and Defense Cooperation

NATO (since 2004); hosts ENSEC COE. NB8 (the Nordic-Baltic Eight: Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden).^[11] Lithuania’s services participate in the Club de Berne and its Counter-Terrorism Group (CTG); the Club de Berne keeps no public roster, but it is reported to comprise the intelligence services of the 27 EU member states (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden) together with Norway and Switzerland, with the United Kingdom also reported as a member; the CTG comprises the same services plus the United Kingdom.^[18] Baltic trilateral intelligence cooperation with Estonia and Latvia. EU-US Umbrella Agreement, SWIFT/TFTP, PNR. Interpol I-24/7. Egmont Group.

EU Law Enforcement Cooperation

SIS II: Real-time query and alert sharing across the Schengen Area (29 states: Austria, Belgium, Bulgaria, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and Switzerland).^[15] Prüm: Automated DNA, fingerprint, and vehicle-registration exchange; the framework binds 31 states (all 27 EU members plus the non-EU Schengen associates Iceland, Liechtenstein, Norway, and Switzerland); Prüm II (2024) adds facial images and police records.^[16]

Europol

As an EU member state, Lithuania is one of the 27 EU members that constitute Europol, the EU Agency for Law Enforcement Cooperation (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden). Europol also holds operational agreements permitting personal-data exchange with 17 non-EU states (Albania, Australia, Bosnia and Herzegovina, Canada, Colombia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, and the United States) and cooperates with US law enforcement including the FBI, so Lithuanian person data flowing through Europol is reachable onward.^[17]

The Privacy Backdoor Effect

• FRA transit: Sole submarine cable terminates in Sweden’s FRA collection jurisdiction
• Intelligence expansion: February 2026 law allows surveillance without clear time limits
• Pegasus: Infections confirmed on Lithuanian territory (Estonian operator suspected)
• Suwalki Gap: Strategic vulnerability drives intelligence capabilities disproportionate to population
• EU Framework: Lithuanian data in SIS II, Prüm, EIO accessible to 27 EU states
• MLAT/CoE Conventions: the US, Estonia, Latvia, and Russia bilateral treaties, plus the 51 parties to the 1959 Convention and the 82 parties to the Budapest Convention, can request data through MLA channels
• EU e-Evidence: prosecutors and courts in the 25 other participating member states can serve production orders directly on providers here, ten days or eight hours, no MLA request (since August 18, 2026)

Surveillance and Intelligence

Intelligence Agencies

VSD (State Security Department): Civilian intelligence and counterintelligence, accountable to Seimas and President. AOTD (Second Investigation Department): Military intelligence, counterintelligence, cyber warfare under Ministry of National Defence, origins October 27, 1918. Article 22 of the Constitution requires judicial authorisation for surveillance, but the February 2026 expansion retains provisions criticised for indefinite monitoring without meaningful judicial review.^[5]

Pegasus Infections (May 2024)

Access Now and Citizen Lab confirmed Pegasus infections in the Baltic region including at least one Belarusian activist based in Vilnius (infection dating to March 2021). No evidence Lithuania is a Pegasus customer; Estonia (which acquired Pegasus) is believed to operate it across EU jurisdictions. Lithuania’s territory is an active surveillance environment for state-sponsored spyware.^[2]

Russian and Belarusian Threats

VSD 2025 National Threat Assessment: Russia actively rebuilding spy networks, conducting sabotage operations across Europe, and could develop capabilities for limited military action against NATO countries within three to five years. Belarus weaponised migration in 2021, directing thousands to the Lithuanian border. Hosts NATO ENSEC COE (Energy Security Centre of Excellence) in Vilnius.^[6]

Internet Infrastructure and Transit Exposure

IXPs: LIXP (Vilnius), LITIX (Vilnius, connected to AMS-IX/DE-CIX/LINX), BALT-IX (Vilnius/Kaunas). The BCS East-West Interlink (218 km, Lithuania-Sweden via Gotland) is Lithuania’s sole submarine cable, severed November 17, 2024 simultaneously with C-Lion1, by Chinese vessel Yi Peng 3 (departed Russia’s Ust-Luga), reducing internet capacity by one-fifth. Cross-border fibre: Baltic Highway (3,000 km Tallinn-Frankfurt backbone). Lithuania ranks first in Europe for fiber-optic penetration.^[7]

FRA cable-tapping exposure: The BCS East-West Interlink terminates at Katthammarsvik, Gotland, Sweden, within FRA collection jurisdiction. Lithuanian data transiting this cable is subject to Swedish bulk interception under the FRA Law (Type 2 warrants, ministerial only for non-Swedish persons). The ECtHR ruled Sweden’s regime violated Article 8 ECHR in 2021.^[8]

Recent Developments

Šventoji–Liepāja Cable (January 2, 2026): an Arelion telecom cable linking Šventoji (Lithuania) and Liepāja (Latvia) was damaged two days after the Gulf of Finland incidents. Latvian police boarded a ship docked at Liepāja and opened criminal proceedings, but on January 5 said they had found no evidence linking that ship to the damage; the investigation continues and the cause has not been established.^[19]

National Property Registry Breach (May 2026): Attackers using stolen government credentials extracted more than 600,000 records from Lithuania’s national real-property registry, including residential addresses that could expose intelligence officers, soldiers, and diplomats to physical targeting. Lithuania’s President stated that “hostile states” orchestrated the theft, framing it as a national-security incident rather than ordinary cybercrime.^[12]

Intelligence Law Expansion (February 2026): Significantly expanded VSD/AOTD powers while retaining provisions for surveillance without clear maximum time limits.^[4]

BCS East-West Interlink Severed (November 2024): Sole submarine cable cut by Yi Peng 3, simultaneously with C-Lion1. Under investigation.^[7]

Pegasus Confirmed (May 2024): Belarusian activist in Vilnius among confirmed targets in Baltic region.^[2]

VSD Threat Assessment (2025): Russia could develop limited military action capability against NATO within 3–5 years.^[6]

Privacy Framework

The VDAI (State Data Protection Inspectorate) enforces the GDPR and the Personal Data Processing Law. Largest fine: Vinted EUR 2.39 million (July 2024). NIS2 transposed via Cyber Security Law (October 2024). Intelligence law expanded February 1, 2026 with provisions criticised for allowing surveillance without clear maximum time limits and classifying conditions for court-free intelligence methods.^[3][4]

Data Retention

6-month retention of traffic and location data (internet) / 12-month (telephony). Lithuania has not repealed or substantially amended retention provisions despite the CJEU’s Digital Rights Ireland invalidation of the underlying EU directive.^[9]

Pending Legislation

Lithuania’s major recent measures are already enacted, so the pipeline is dominated by oversight responses and implementation:

• Intelligence Law oversight (surveillance): the expanded Intelligence Law (in force February 1, 2026) granting court-free surveillance methods with a 24-hour post-hoc authorisation drew criticism from the Seimas Ombudsman for lacking maximum-duration limits; corrective amendments and tighter oversight are under discussion.^[4]
• Registry-security reform: the May 2026 national property-registry breach (600,000+ records) is expected to prompt access-control and credential-security legislation for state registries.^[12]
• NIS2 (Cybersecurity Act): transposition completed March 12, 2026; implementing requirements continue to phase in (organisational measures due by April 17, 2026).
• EU AI Act implementation: Lithuania must designate AI market-surveillance authorities; implementing legislation is pending.

Sources