Kapo, the Estonian Internal Security Service, is building a new headquarters on Toompuiestee in Tallinn that will cost more than 50 million euros because of its strict security requirements. In our digital state, we tend to think of security mainly in terms of cyber. In reality that is only one side of it, and it isn’t enough on its own. Protecting state secrets calls for complex engineering solutions and specific conditions for equipment, premises, technology and the people themselves.
But Kapo’s headquarters is far from the first building in Estonia to get this level of security attention. Where might Estonia’s most secure building actually be? Is the Bank of Estonia’s gold reserve guarded by steel doors and secret code combinations, and how many assault rifles are waiting for an enemy at the Estonian Defence Forces Headquarters? What means are used to keep the servers running at Estonia’s largest data center even when there’s no electricity anywhere else in the country? Let’s try to find out!
Bank of Estonia
We already know top-level bank security systems from Hollywood films. The image of a vault stuffed to the brim with cash may be outdated, but there’s no question that Estonia can’t afford to skimp on security at its bank buildings either. We can’t go into much more detail here, though, because information about the surveillance, alarm, communication and information systems at the Bank of Estonia’s headquarters on Estonia puiestee in Tallinn is classified as a state secret.
The Bank of Estonia is the country’s central bank and a member of the European System of Central Banks, tasked with implementing euro-area monetary policy, organizing the circulation of cash, safeguarding financial stability, compiling statistics on Estonia’s financial and external sectors, and managing its own financial assets. The Bank of Estonia is also among the institutions providing vital services, in this case the continuity of cash circulation and payments. “With that in mind, both the physical security requirements for the Bank of Estonia’s buildings and its cybersecurity requirements are very high, and various security systems are in place to ensure that,” confirms Hanna Jürgenson, communications specialist at the Bank of Estonia.
The only publicly accessible part of the central bank building is the Bank of Estonia museum, which visitors can tour during its opening hours; the rest of the building is for official use only.
But the sweetest part, of course, is the Bank of Estonia’s gold reserve. According to its website, the Bank holds 8,250 troy ounces, or 256.6 kg, of gold, kept mainly for historical rather than financial reasons. Gold earns no interest, storing it securely is expensive, and trading it is difficult. In the early years after regaining independence, most of the gold reserve was sold off to buy bonds instead, which served the reserve’s goals better.
Even so, the gold reserve still has to be kept securely. That no longer concerns the Bank of Estonia’s building, though, since our gold reserve isn’t held there at all, but at the Federal Reserve Bank of New York in the US.
Greenergy Data Centers
If data can be called the gold of the digital age, then it follows that data centers need to be as secure as banks.
Greenergy Data Centers, near Tallinn in Hüüru, is the only data center in Estonia whose detailed spatial plan and design were drawn up specifically around a data center’s needs. Security starts even before the gates. Behind the gates are automatic road blockers that make sure nobody can force their way in with a vehicle. The building is surrounded by a three-meter security fence on a concrete foundation, which is likewise hard to drive through. Climbing over it won’t get you far either, since the gates and fence are fitted with motion sensors.
And even if someone with bad intentions somehow made it past the gates, their journey would be short. The center is covered by more than 350 cameras. The cameras carry both motion and thermal sensors, so neither darkness nor thick fog is an obstacle. Even so, there are always real people in the control room watching the camera feeds.
Effective security measures continue inside the building too. The data center can only be entered through the main door, which has armed guards around the clock. Biometric identification checks that the person walking through the door really is who they claim to be: a scanner reads a contactless, three-dimensional image of all four fingerprints at once. So a copied fingerprint straight out of the movies won’t get you anywhere. All of this ensures that only people who need access to the center get it.
The reliability of the Greenergy Data Centers facility is backed by redundant power, cooling and connectivity infrastructure, top-tier fire prevention systems, and continuous monitoring of the facility with more than 3,000 sensors. Communication cables reach the data center from eight different directions, and two independent connections link it to one of Estonia’s most central electrical substations, backed in turn by UPS units and generators. Huge fuel reservoirs have been built underground on the site, meaning the data center can run on fuel alone if it has to. That guarantees power even if the lights go out in every home and office in the country.
The security of the largest data center in Estonia and the whole Baltic region is confirmed by international recognitions: the ISO/IEC 27001 cybersecurity certificate, the ISO 9001 quality management certificate, and the EU’s dedicated data center certificate, EN 50600, which no other facility in the Baltics or in Finland holds. “It’s an extremely thorough standard that looks at the data center as a whole, including security, reliability and environmental friendliness. In short, it’s a complete audit: if something is wrong, corrective requirements are issued and the center is reviewed again,” explains GDC CEO Tõnu Grünberg.
So it’s fair to say, with some confidence, that the Greenergy Data Centers facility is one of Estonia’s most secure and reliable buildings outside the security agencies.
Tallinn Prison
While a data center doesn’t have to worry about its servers making a run for it, a prison generally thinks about security the other way around. Naturally, you’re not supposed to just walk in (anyone determined enough will surely find a way, per the Penal Code), but what matters even more is that nobody gets out at the wrong time. “The purpose of prisons is to create security, so the infrastructure itself is secure too,” says Liis Lumiste, public relations adviser at the Ministry of Justice’s prison service.
Naturally, prison grounds are surrounded by concrete walls and barbed wire, backed by video surveillance and manned guards. The “new” Tallinn Prison, completed at the end of 2018 at a cost of nearly 75 million euros, was already being talked about during construction as one of the largest and most expensive building projects in Estonian history. So what makes it so special?
According to Lumiste, Tallinn Prison, located in the village of Soodevahe in Rae parish, differs from Estonia’s other prisons starting with its construction. The buildings themselves (walls, floors, ceilings), their openings, locks and fittings, were all designed and built to strict security standards. The biggest difference from the Viru and Tartu prisons is that Tallinn Prison’s buildings are connected by underground tunnels. A dividing wall inside the tunnels separates people moving in different directions, so prisoners held in different buildings never come into contact with each other. Moving through the tunnels also means prisoners can’t, for example, throw prohibited items over the fence.
“In Tallinn, inmates mostly walk in exercise areas on the roof of the residential building, which also eliminates any chance of them finding something prohibited on the grounds,” says Lumiste. Prisons are equipped with physical panic buttons and personal safety devices issued to staff. These measures allow help to be called quickly and to the right place if a threat arises. Most common areas are covered by camera surveillance.
According to Lumiste, prisons also use various other security systems and technical monitoring systems, besides video surveillance, that help officers maintain security. People entering the prison are checked with a body scanner, and any items they carry go through an X-ray machine. The prisons also employ drug detection dogs, which check both people entering and items sent into the prison (such as inmates’ letters and parcels). Ramps are used in front of the transport gate to prevent anyone from forcing a vehicle through. Prison officers carry specialized equipment and are ready to intervene if the situation calls for it.
“In practice, one of the main contributors to security is our officers’ skill, their constructive communication with inmates, and the resulting familiarity with them, which lays the groundwork for preventing potential security incidents as much as possible,” Lumiste notes.
The Ministry of Justice recently began working with the domestic startup GScan to bring even more effective security scanners into the prison, ones that use novel technology based on natural radiation and can also determine the material composition of objects, among other things. A pilot project is under way at Tartu Prison.
Estonian Defence Forces Headquarters
“The Defence Forces use various measures and resources, and combinations of them, to secure our infrastructure, but we don’t discuss the specifics of how we ensure security publicly,” says Captain Taavi Karotamm, head of the press section at the Defence Forces Headquarters’ strategic communications department. So we can only speculate about the security measures involved.
There’s no doubt that the Estonian Defence Forces Headquarters on Juhkentali Street in Tallinn is one of Estonia’s most secure facilities. As the name suggests, the headquarters is the Defence Forces’ command center, and its security is critical to Estonia’s national defense. It’s where strategic decisions on the country’s defense and security are made. The headquarters holds state secrets that are extremely important to Estonia’s security and defense.
That’s why the headquarters needs protection from both internal and external threats. By internal threat, we mean risks that can arise from within the building, such as leaked information or espionage. External threats can come from outside Estonia, including cyberattacks and terrorism.
We can assume that the headquarters’ security measures include armed guards, access control, analysis of past attacks and incidents, alarm systems and much more, but only those who need to know are aware of the exact details. The fact that the specifics of the security arrangements aren’t disclosed is, in itself, part of how that security is maintained.
The Riigikogu
Toompea has been the seat of power in Estonia for 800 years. Over the centuries, Toompea Castle has grown from a medieval fortress into a modern seat of government. The Riigikogu building was in fact the first public building in Estonia designed with an electrical system. Today, various security measures, both physical and electronic, are in place to protect the building’s 101 members of parliament. Guarding the Riigikogu and securing the building is, by law, the responsibility of the Police and Border Guard Board.
Entry to Toompea Castle and other Riigikogu properties is governed by the Riigikogu’s entry and security procedure for its premises, under which visitors to the castle must present identification and go through a security check to enter. Any items they carry pass through a screening device and, if needed, a security officer is entitled to search a visitor’s personal belongings, much like at an airport. Anyone who has ever taken even a tour of the Riigikogu building has had to go through this same check.
The entry procedure gives the police the authority to decide whether a person is allowed into the building or not. “A security officer may refuse entry to the castle, or remove from it, a person who is visibly intoxicated, improperly dressed, or who behaves in a way that threatens the security of the castle or fellow citizens, or shows disrespect toward the Estonian state, the Riigikogu, a Riigikogu member, or other people,” explains Riigikogu press adviser Merilin Kruuse.
As for Riigikogu members and staff working in the building, they aren’t subject to blanket background checks. Still, the Riigikogu Chancellery has a number of positions that require access to state secrets at various classification levels. A security clearance check is carried out before anyone takes up one of those positions.
In front of the Riigikogu there are vehicle barriers that only let a car approach the building when the correct card is shown. Electronic security measures include video surveillance systems that monitor the building both inside and out. The voting system, one of the most critical parts of the Riigikogu’s work, is protected against hijacking by various information security measures.
Bonus: the Internal Security Service headquarters
Since the renovation and extension of Kapo’s headquarters on Toompuiestee in Tallinn is still under way, we’re adding it as a sixth entry. Plans for an extension to the Internal Security Service headquarters were first discussed as far back as 2001, and at one point building an entirely new headquarters elsewhere was also considered, precisely because the old building wasn’t suited to preventing and managing security threats.
The cornerstone for the extension was finally laid the autumn before last, and it should be finished by early next year. So far, media reports say the project will cost more than 50 million euros, since nearly all of Kapo’s work spaces have to meet security-zone requirements. Those requirements are set out in Chapter 5, Section 1 of the state secrets and classified foreign information protection procedure, which spells out exactly how far the security measures go.
Exactly how these requirements are met, and where Kapo’s new building might eventually land in our ranking, we can only guess, since that information is also classified as a state secret.
In short, Estonia does have facilities protected by top-tier security measures, but which one is the very best, we can only speculate, since a veil of state secrecy covers the security systems of state institutions. And that’s probably for the best.