NORWAY Law and Practice Contributed by: Hedvig Moe, Pål Lieungh, Espen Randen and Elin Ibsen Gustavsen, Advokatfirmaet Thommessen AS
5.7 Counter-Espionage and Insider Threat Obligations Espionage and sabotage are criminal offences under the Penal Code. Every entity subject to the Secu - rity Act must establish a security management sys - tem, conduct regular risk assessments, and imple - ment proportionate physical, electronic, human and organisational security measures. Management must review the system annually and ensure persons with access to protectable assets are identity-verified and adequately trained. Entities subject to the Security Act must immediately notify NSM and the relevant supervisory authority where affected by security-threatening activity, where there is well-founded suspicion of such activity, or where a serious security breach has occurred. These obligations extend to suppliers under classi - fied procurements. A supplier entering into a security agreement assumes corresponding obligations to pro - tect classified information for the contract duration. NSM supervises Norway-based suppliers directly. 5.8 Foreign Ownership, Control and Influence (FOCI) Mitigation The risks posed by foreign ownership, control and influence are addressed through the FDI screening mechanism in Chapter 10 of the Security Act (see 6.1 FDI Screening Legislation and Regulatory Frame- work ), the facility security clearance regime, and clearance requirements described in 5.2 Security Vet- ting and Clearance Requirements . There are no proxy board arrangements, special security agreements or government-appointed security directors. An entity holding facility security clearance must promptly notify NSM of any change in its board, man - agement, ownership structure, premises or financial position. Foreign ownership changes affecting secu - rity fitness may lead to clearance revocation. 5.9 Interaction Between National Security Regulation and Other Regimes The Security Act does not operate in isolation. Each of the national security, export control, sanctions, FDI screening and procurement regimes is governed
by separate legislation and administered by distinct authorities, but they apply concurrently. The most direct interface is with defence procure - ment: FOSA sets procedural rules, while the Security Act imposes substantive security obligations through requirements for security agreements and, where rel - evant, facility security clearance (see 2.4 Restricted and Classified Procurement ). Export controls operate under a separate DEKSA- administered framework (see 3. Export Controls and Dual-Use Items ) and apply independently of the Security Act. The Security Act’s prohibition on trans - ferring classified information to foreign entities with - out clearance authority consent functions as a parallel restriction. NSM holds the cross-sectoral supervisory mandate for preventive security work, while DEKSA co-oper - ates operationally with PST, the Intelligence Service and the Customs Service on export control and sanc - tions (see 3.9 Enforcement, Penalties and Voluntary Disclosure ). There is no single inter-agency body for co-ordinating the regimes. 6. M&A, Joint Ventures and Foreign Direct Investment in the Defence Sector 6.1 FDI Screening Legislation and Regulatory Framework The FDI filing regime is narrow in scope and only applies to entities formally subjected to the Security Act through individual administrative decisions. The government through the King in Council also holds a broad “golden power” under Section 2-5 of the Security Act, enabling intervention in any “activ - ity” that may pose a national security risk, including transactions not requiring FDI filing. This power may be exercised irrespective of the Public Administration Act’s limitations and regardless of whether the activity is otherwise permitted by law. A Section 2-5 decision constitutes a special enforcement title.
150 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook