THE INVISIBLE GUARDIAN
Finland's military intelligence domestic operations, civilian operatives and the unmonitored blind spot of a constitutional state
Structural analysis based on public sources
February 2026
I. Introduction
The legal framework for Finland's military intelligence is seven years old. In that time, it has produced one doctoral dissertation, a handful of legal articles, and a single intelligence oversight ombudsman has been supervising a system in which statistics on the number of surveillance warrants are not published, the obligation to notify targets has become a dead letter, and the use of civilians in operational tasks has been left almost entirely unregulated.
The intelligence legislation amendment bill (project SM040:00/2024) currently being drafted by the Ministry of the Interior would expand operational powers in ways that the Chancellor of Justice, the Parliamentary Ombudsman and the country's leading academic researcher have criticised with exceptional force. The draft bill, which has completed its consultation round, would permit the use of outside persons in intelligence methods, abolish the obligation to notify the target entirely, and dismantle the restrictions on mass surveillance imposed by the Constitutional Law Committee in 2018.
This article maps, on the basis of public sources, the domestic operational environment of the Finnish Defence Intelligence Agency (Puolustusvoimien tiedustelulaitos, PVTL): the legislation, the methods, human intelligence, the legal status of civilian operatives, the operational psychology of target coercion, the limitations of oversight and international points of comparison.
It contains no classified information. All sources are public.
The article ends with a question that no one has yet answered.
II. The legislation — a historic rupture without precedent
The Military Intelligence Act (590/2019) entered into force on 1 June 2019 as part of a broader intelligence legislation package that also included the Civilian Intelligence Act (Chapter 5a of the Police Act) and the Communications Intelligence Act (582/2019). Before 2019, Finland had no legislation whatsoever specifically governing military intelligence — it operated as part of the general mandate of the Defence Forces without dedicated regulation. The director of PVTL, Colonel Esapekka Vehkaoja, described the situation in the Ruotuväki magazine in 2021: "The new law was a significant, if not outright revolutionary event."
The Act contains over 20 named intelligence methods, divided into four main categories: human intelligence (HUMINT) methods, technical surveillance, telecommunications-targeted methods and signals intelligence. The authorisation process is built on a three-tier system. The most intrusive methods — telecommunications interception, telecommunications monitoring and communications intelligence — require authorisation from the Helsinki District Court. Undercover operations and the directed use of intelligence sources fall within the decision-making authority of the Chief of Defence Intelligence at the Defence Command. Less intrusive methods, such as covert intelligence gathering and systematic observation, are decided by the military legal counsel of the intelligence division. All authorisations are time-limited, valid for a maximum of six months at a time and renewable.
The Constitutional Law Committee issued two significant opinions on the government bill (HE 203/2017 vp): PeVL 36/2018 vp and PeVL 76/2018 vp. The Committee stated that intelligence powers represent a "far-reaching interference" with the right to privacy, the protection of personal data and the confidentiality of communications guaranteed by Section 10 of the Constitution. Particularly significant was the Committee's position that the intelligence laws represent "an exceptional basis for restriction, one that has departed from criminal-offence-based operations" — intelligence may be directed at individuals without any concrete suspicion of a crime.
The Committee required an explicit prohibition on discriminatory intelligence activities, a requirement for narrow interpretation of intelligence methods, and the strengthening of the court panel to a two-judge composition. It stated unequivocally that the constitutional amendment "does not enable general, untargeted and all-encompassing monitoring of communications."
Sources: Military Intelligence Act 590/2019; Communications Intelligence Act in Civilian Intelligence 582/2019; PeVL 36/2018 vp; PeVL 76/2018 vp; Ruotuväki 2021.
III. The methods — what the law permits
Intelligence methods are divided into four tiers of progressively increasing invasiveness.
Signals intelligence (SIGINT) is the core competence of the Finnish Defence Intelligence Agency. The central rule of the Communications Intelligence Act (582/2019) is that the content of domestic communications within Finland may not be targeted for intelligence purposes (§ 12, intelligence prohibition): if both sender and recipient are physically located in Finland, content-level examination of the message is prohibited. Metadata — traffic data and technical identifiers — may, however, be processed more broadly. Intelligence is based on automated filtering according to approved search criteria.
Telecommunications monitoring (§ 35) refers to the surveillance of communications metadata: who communicated with whom, when, for how long and from where. The content of messages is not examined, but metadata can be used to construct a detailed picture of a person's social network, movements and routines. Research has shown that metadata analysis can reveal a person's health status, political views and intimate relationships without reading the content of a single message. Telecommunications interception (§ 32) extends to the content of communications and requires a court order.
Technical surveillance encompasses GPS tracking (§ 30), which enables real-time location tracking of a vehicle or person. Technical audio surveillance (§ 24) and technical visual surveillance complete the picture. Physical surveillance — systematic observation — is, despite being among the less intrusive methods, one of the most invasive in practice: a surveillance team observes the target's movements, meetings and routines in real time.
Human intelligence (HUMINT) is the most difficult category of methods to oversee. It is based on human interaction, which leaves fewer documentable traces than technical intelligence. Intelligence Oversight Ombudsman Hakonen has acknowledged this challenge: overseeing HUMINT operations is structurally more difficult than overseeing technical intelligence, because the interactions are not automatically recorded.
Sources: Military Intelligence Act 590/2019, §§ 24, 30, 32, 35; Communications Intelligence Act in Civilian Intelligence 582/2019; Intelligence Oversight Ombudsman Hakonen, annual reports 2023 and 2024.
IV. Human intelligence — the person as a source of information
Intelligence Oversight Ombudsman Kimmo Hakonen described human intelligence in his official column (11 May 2021): "Human intelligence can involve many kinds of information gathering. A person may provide information to an intelligence authority confidentially (source activity), or an intelligence official may obtain information from a person by concealing their official status (covert intelligence gathering and undercover operations)."
The distinctions in the law are precise. Source activity refers to the non-incidental confidential receipt of information from a person outside the authority. A source may be registered, and registered sources may be paid; unregistered sources may also be paid for justified reasons. Directed use of a source is a more advanced form in which a source is given an active information-gathering assignment; this is decided in writing by the Chief of Defence Intelligence, for a maximum of six months at a time. Covert intelligence gathering is short-term information collection through interaction in which the official's status is concealed. Undercover operations involve long-term infiltration under a false identity.
In historical context, human intelligence in Finland is nothing new. Yle's documentary series "Erittäin salainen, Vakoilua Suomessa" ("Top Secret: Espionage in Finland," 2024) depicted how, during the Cold War, both Finland's own intelligence organisations and the KGB systematically recruited civilians. The methods have changed, but the fundamental logic endures: a person who has access to information or a community is more valuable than any technical sensor.
The critical limitation in current law: Only "a Defence Forces official who has received sufficient training in the use of intelligence methods" may employ intelligence methods (§ 90). Ordinary civilians may not conduct intelligence operations. The civilian role is limited to serving as a source — providing information confidentially.
In theory.
Sources: Military Intelligence Act 590/2019, §§ 78, 90; Intelligence Oversight Ombudsman Hakonen, column 11 May 2021; Yle, "Erittäin salainen, Vakoilua Suomessa" (2024).
V. A civilian surveilling a civilian — the operational reality
The operational capacity of any intelligence organisation is finite. The number of officials is limited, they are known, and their movements are traceable. This is a universal problem, and every intelligence service in history has responded in the same way: by using civilians.
In physical surveillance, the basic unit is a surveillance team — typically several individuals who rotate near the target to avoid recognition. Professional surveillance requires vehicles, communications equipment and coordination. When the subject of surveillance is a civilian — a person who moves within their own living environment, goes shopping, takes their children to school, meets friends — the surveillance must blend into that environment.
This creates operational pressure to use individuals who do not stand out in the target's living environment. People who have their own car, their own time and their own reason to be present. Reservists whose patriotic motivation makes them willing but whose legal status is undefined. Members of the neighbourhood, school or hobby group whose presence raises no suspicion.
Such a civilian operative wears no uniform and carries no official identification. They have no official leave, no legal protections afforded by civil service employment, and no official duty to document their actions. They drive their own car, use their own time and operate without official status. If they are caught, no document links them to the organisation that assigned the task.
This is not speculation. It is the operational logic that recurs in every study of intelligence history. In the United Kingdom, this reality has been recognised and regulated by law — the Covert Human Intelligence Sources (Criminal Conduct) Act 2021 creates a statutory framework for civilian intelligence operatives. In Finland, no such framework exists.
Sources: Lohse & Viitanen, "Johdatus tiedusteluun" (Alma Talent, 2019); UK CHIS Code of Practice (2022); Norwegian EOS Committee report on the Frode Berg case.
VI. Target coercion — operational psychology
When an intelligence organisation determines that a person is a threat — not necessarily a criminal, but a threat to its interests, its information control or its operational freedom — the range of methods at its disposal extends beyond information gathering. In international intelligence research, this is known as target neutralisation.
The following description is based entirely on public sources: the documented methods of East Germany's Stasi Zersetzung programme, the findings of the US Senate's investigation into the FBI's COINTELPRO programme (Church Committee, 1975) and the practices of the United Kingdom's MI5, as examined by the Investigatory Powers Tribunal.
The methods follow a recognisable arc.
Phase 1: Isolation
The target's social environment is mapped: family, friends, colleagues, trusted relationships. Isolation does not happen openly but subtly. Trusted relationships erode as elements of uncertainty are introduced into the environment. The Stasi called this "the disintegration of social networks" — not blocking contact, but corroding trust.
Phase 2: Visible surveillance
Signs that the target is being watched are brought to their awareness. The same car appears repeatedly. An unknown person is always present. This is not information gathering — it is psychological pressure. The purpose is to create a sense of constant observation that drains mental resources and forces the target to live in the awareness that they are being watched.
In the Stasi's internal documents, this was called "demonstrative surveillance" — surveillance whose purpose is not to hide but to be noticed. The objective is not information. The objective is effect.
Phase 3: Institutional pressure
The frequency of contacts from authorities increases in a way that, when examined individually, appears normal but collectively forms a pattern. A tax audit. A child welfare report. Credit checks. Criminal investigation requests that lead nowhere but consume time and mental energy. Each contact is individually explainable. Together, they form coordinated pressure.
In the COINTELPRO programme, the FBI called this "harassing through established institutions" — using established institutions as instruments of harassment. The Church Committee's final report concluded that it was precisely the indirectness of institutional pressure that made it effective: the victim could not point to any single act as unlawful, because each act was individually lawful.
Phase 4: Induced disclosure
This is the critical phase of the mechanism. Pressure is maintained until the target begins to speak publicly about their experiences.
And the moment the target says "I am being followed," they sound paranoid. When they say "the authorities are coordinating actions against me," they sound like a conspiracy theorist. When they present evidence — photographs, observations, patterns — the evidence is interpreted as a sign of obsessiveness, not of proof.
The mechanism works regardless of whether the target's claims are true. That is precisely what makes it so effective. Truth and falsehood produce the same reaction in the audience: doubt about the target's mental health. A person who claims to be the subject of intelligence operations automatically enters a discursive category in which the weight of their words diminishes.
The Stasi's Zersetzung programme documented this explicitly: the objective was "the systematic destruction of the target's social reputation and standing without official proceedings." The FBI's COINTELPRO pursued the same goal: "neutralize" — render the target harmless without arrest, charge or trial.
Phase 5: Final neutralisation
Once public credibility is destroyed, the target is neutralised. Whatever they say is interpreted through the frame of "paranoia." They may have evidence, but the evidence comes from a person whose credibility has been called into question. The quality of the evidence is irrelevant — the status of the witness is what matters.
This is the elegance of neutralisation: it requires no censorship, no arrest and no violence. It requires only that the target speaks — and that society reacts predictably.
Sources: Hubertus Knabe, "Die unterwanderte Republik" (2001), Stasi Zersetzung; US Senate Select Committee (Church Committee), Final Report Book III, "Supplementary Detailed Staff Reports on Intelligence Activities and the Rights of Americans" (1976); Investigatory Powers Tribunal (UK), reports and decisions; David Cunningham, "There's Something Happening Here: The New Left, The Klan, and FBI Counterintelligence" (2004).
VII. Case study: Ano Turtiainen
The mechanism described above — isolation, pressure, disclosure, neutralisation — is not theoretical. It is recognisable in real-life trajectories. One such trajectory is the story of former Member of Parliament Ano Turtiainen.
This article takes no position on whether Turtiainen's claims were true. That is irrelevant to the article's purpose. What matters is the mechanism — how the sequence of events progresses, regardless of what actually happened.
Access. Turtiainen was elected to Parliament in 2019 on the Finns Party list and served as a deputy member of the Defence Committee. In this role, he had the right to attend meetings where classified military information was discussed. The meetings were held in secure facilities where only a pen and paper could be brought in.
Pressure. In April 2022, following Russia's launch of its war of aggression against Ukraine, the Defence Committee was reorganised. Iltalehti reported that the removal of Turtiainen was driven by suspicions that his notes from classified meetings may have reached Russia. Turtiainen denied the allegations.
Public disclosure. Turtiainen began speaking publicly about the actions of the authorities against him. He stated: "Friends from the Russian side advised me to leave immediately." He described experiencing pressure that, in his view, was connected to coordinated actions by the authorities.
Discrediting. The media framing was one-directional. Apu magazine wrote: "In Finland, Turtiainen has been persecuted by no one other than the bailiff." The narrative of debt enforcement, parliamentary debts and conspiracy theories buried everything else. Turtiainen's claims of pressure were interpreted as part of a broader picture of an "unstable" person — not as separate claims deserving independent evaluation.
Neutralisation. Turtiainen moved to Russia in October 2024 and received political asylum in December 2024. He declared himself ready to fight on Russia's side against Finns. His credibility was at zero. The neutralisation was complete.
It is critically important to understand what this example demonstrates and what it does not.
It does not demonstrate that Turtiainen was innocent. It does not demonstrate that his claims of pressure were true. It does not demonstrate that an intelligence organisation coordinated his removal.
What it demonstrates is that the mechanism is recognisable. A person with access to classified information is removed. They speak publicly about pressure. Their claims are interpreted as paranoia. Their credibility is destroyed. At the end of the process, nothing needs to be proved or disproved — the person is neutralised.
If Turtiainen's claims of government pressure were true, this is exactly the arc one would expect to see. If they were false, the arc is identical — because the mechanism produces the same outcome regardless of the truth. That is where its power lies, and its danger.
And that is precisely why documentation is the only difference. Irrefutable evidence — video, a registration number, a named individual — is the only thing that distinguishes a citizen experiencing unlawful surveillance from a person branded "paranoid."
Sources: Iltalehti, "Epäily johti eduskunnassa poikkeukselliseen ratkaisuun" (2022); Yle, "Kansanedustajat ovat nyt Venäjän infovaikuttamisen kohde" (5 May 2022); Yle, "Ano Turtiainen kertoo saaneensa turvapaikan Venäjältä" (30 December 2024); Apu, Anne Moilanen, "Ano Turtiainen on muuttanut Venäjälle" (2024); Suomenmaa/Demokraatti, "Ex-kansanedustaja Ano Turtiainen on muuttanut Venäjälle" (2024).
VIII. The legal status of the civilian operative — a juridical vacuum
In Finland, there is no legislation, no case law and no published academic analysis that specifically addresses the criminal liability, civil liability or fundamental rights status of a civilian participating in an intelligence assignment. This is the single most significant legal gap in Finland's intelligence legislation.
The gap is not theoretical. It concerns concrete situations: what happens when a civilian acting on an intelligence organisation's assignment carries out physical surveillance using their own vehicle? What is their legal status? Who bears responsibility if the surveillance meets the elements of a criminal offence?
The civilian operative's criminal liability
A civilian carrying out surveillance at the request of an intelligence organisation is not a public official. The provisions on offences by public officials in Chapter 40 of the Criminal Code do not apply to them, but all other provisions of the Criminal Code apply — just as they do to any citizen.
The relevant offence elements include:
Criminal Code 25:7a, Stalking. Repeated threatening following, observation and contact that is apt to cause fear or distress. The law does not require that fear actually arises — it is sufficient that the conduct is "apt to cause" it. Repeated, systematic surveillance meets this threshold.
Criminal Code 24:1, Violation of domestic peace. If surveillance repeatedly and intentionally extends to the immediate vicinity of the target's residence or yard.
Criminal Code 24:8, Dissemination of information violating personal privacy. If information about the target's private life collected during surveillance is passed on.
Criminal Code 25:7, Illegal threat. If repeated visible surveillance is interpreted as threatening — which is justified when the purpose of the surveillance is expressly psychological pressure.
Criminal Code 16:9, Usurpation of the powers of a public official. If the civilian presents themselves as, or gives the impression of being, an authority.
Critical legal observation: none of these elements of an offence are negated because the person acted at the request of an intelligence organisation. The civilian is not a public official. They have no legal authorisation to conduct surveillance. The intelligence organisation's request is not a lawful justification — it is incitement.
The liability of the commissioning official
If a civilian commits an offence during an intelligence assignment, the official who assigned the task is subject to:
Criminal Code 5:5, Incitement to a crime. A person who intentionally persuades another to commit an intentional offence is sentenced for incitement as if they were the perpetrator.
Criminal Code 40:7, Abuse of official position. A public official who, in the course of their duties, in order to obtain benefit for themselves or another or to cause harm to another, breaches an official duty based on regulations governing their official conduct.
Criminal Code 40:8, Aggravated abuse of official position. If the abuse targets fundamental rights, such as the right to privacy, and the offence is deemed aggravated as a whole.
The constitutional dimension
From a constitutional perspective, the situation is unambiguous.
Section 7 of the Constitution guarantees personal freedom and integrity. Section 10 guarantees the right to privacy. Restricting privacy requires regulation at the level of statute — not a verbal commission from an official to a civilian. The use of civilian operatives for surveillance without a statutory basis is not a restriction of a fundamental right — it is a violation of one.
Section 124 of the Constitution prohibits the delegation of significant exercises of public power to entities other than public authorities. Surveillance is indisputably a significant exercise of public power. Delegating it to a civilian without a statutory basis violates Section 124 of the Constitution.
Section 22 of the Constitution places an obligation on public authorities to ensure the realisation of fundamental rights. The state has not merely violated a fundamental right — it has actively used a third party to violate it.
The European Convention on Human Rights dimension
The case law of the European Court of Human Rights (Zakharov v. Russia, 2015; Big Brother Watch v. UK, 2021) requires that all state surveillance be based in law, necessary, proportionate and subject to effective oversight. The use of civilian operatives without a statutory basis violates every one of these criteria.
Article 8 of the ECHR (right to privacy) is violated because the measure has no legal basis. Article 13 of the ECHR (right to an effective remedy) is violated because the target is unaware of the surveillance and therefore cannot seek legal protection.
Civil liability
Under Section 3:2 of the Tort Liability Act (412/1974), a public body is obligated to compensate for damage caused by error or negligence in the exercise of public power — but a civilian operative does not exercise public power in the legal sense; they are not a public official. They are personally liable for damages. At the same time, the state is liable because the activity was carried out on its assignment. This creates a legally uncharted situation.
Practical consequences
If surveillance is documented irrefutably — video, photograph, vehicle registration number, the identity of the person conducting surveillance — the consequences unfold as follows:
A criminal complaint for stalking (Criminal Code 25:7a), possibly for violation of domestic peace. During the preliminary investigation, it will inevitably emerge who assigned the task — which leads to the intelligence organisation. A constitutional question arises: has the state used private individuals for unlawful surveillance of citizens without a statutory basis? Parliament's Intelligence Oversight Committee must address the matter — it would be the oversight system's first real test. The conditions for an ECHR complaint are met: it would be the first Finnish intelligence complaint to the European Court of Human Rights.
Documentation is the only difference between a citizen experiencing unlawful surveillance and a person branded "paranoid."
Sources: Criminal Code (39/1889), Chapters 5, 16, 24, 25, 40; Constitution of Finland (731/1999), §§ 7, 10, 22, 118, 124; Tort Liability Act (412/1974), Chapter 3; ECtHR: Zakharov v. Russia (2015); Big Brother Watch v. UK (2021); Centrum för Rättvisa v. Sweden (2021); Parliamentary Ombudsman Petri Råman, opinion on intelligence legislation amendment bill (SM040:00/2024).
IX. The target's rights — the death of the notification obligation
Section 89 of the Military Intelligence Act stipulates that the target must be notified in writing of the use of an intelligence method after its purpose has been achieved, and no later than one year after the method's use has ended. State actors need not be notified. The court may postpone notification by two years at a time, or dispense with it entirely, if necessary for national defence, national security or the protection of life and health.
In practice, non-notification has become the rule. Helsingin Sanomat reported in August 2025 that the Helsinki District Court has routinely granted permissions for non-notification, contrary to the original intent of the law. Parliamentary Ombudsman Petri Jääskeläinen noted this as problematic. The Deputy Chair of the Intelligence Oversight Committee, Pauli Kiuru (National Coalition Party), acknowledged during a plenary session in the autumn of 2025 that "the starting point of the laws is that the use of an intelligence method should be notified as soon as possible," but justified the situation with the changed security environment.
The intelligence legislation amendment bill currently being drafted would go even further: it would abolish the notification obligation entirely.
Researcher Joonas Widlund warned: "The proposed abolition of the notification obligation would weaken the safeguards ensuring that the individual's legal protection is realised." Without knowledge of intelligence activities, the target cannot assess whether their fundamental rights have been respected, nor file a complaint or appeal.
A comparison with the coercive measures of criminal investigation (Coercive Measures Act) highlights the disparity. In criminal investigation, the target has, as a starting point, the right to be informed of measures directed at them within a strict timeline. In intelligence, the target cannot directly appeal a decision to use an intelligence method before a court. Legal protection relies on complaints filed with the Intelligence Oversight Ombudsman — but the Ombudsman cannot even confirm or deny whether a person has been a subject of intelligence activities.
The situation can be distilled into a single sentence: a person subject to intelligence operations does not know about them, is not allowed to know about them, cannot appeal them, and soon the law will no longer even require that they be told.
Sources: Military Intelligence Act 590/2019, § 89; Intelligence legislation amendment bill, project SM040:00/2024; HS, August 2025; Joonas Widlund, interview Yle 21 January 2025; Pauli Kiuru, parliamentary plenary session, autumn 2025.
X. Who watches — seven layers and one reality
Finland's intelligence oversight system is built on seven levels: parliamentary oversight (Intelligence Oversight Committee), legality oversight (Intelligence Oversight Ombudsman), court oversight (Helsinki District Court), ministry-level internal oversight (Ministry of the Interior and Ministry of Defence), general legality oversight (Parliamentary Ombudsman and Chancellor of Justice), data protection oversight (Data Protection Ombudsman) and the authorities' own internal legality control.
On paper, the system is comprehensive. Professor Tapio Raunio of Tampere University stated in 2025 that Finland represents a model in which "parliamentary oversight is combined with specialised oversight bodies."
In practice, the challenges of oversight are significant.
Intelligence Oversight Ombudsman Kimmo Hakonen is the sole individual with access to all intelligence activities. He took up his position on 1 May 2019 and continued for a second term in 2024. A recurring theme in his annual reports is the adequacy of resources. The scope of oversight covers two intelligence organisations — PVTL and Supo — with international cooperation obligations that have grown following NATO membership. The statutory powers of a deputy ombudsman have still not been enacted, despite this shortcoming having been raised as early as 2019.
Hakonen himself has stated that "there is essentially no support from Supreme Court precedents or legal literature for interpreting the intelligence law." This means the Ombudsman operates in a legal vacuum — interpreting a law that no one else has interpreted, without points of comparison.
Court oversight statistics on the number of warrant applications or approval rates are not publicly available. This is a significant transparency deficit. Citizens cannot know how many intelligence warrants have been sought, how many granted and how many denied.
Parliament's Intelligence Oversight Committee convenes in secure facilities located underground. Mobile phones, papers and iPads are not permitted. The Committee's former secretary Sami Manninen emphasised that the Committee is not an intelligence committee: "It does not set priorities, let alone otherwise direct operational activities." The Committee oversees, but does not direct.
In the oversight of HUMINT operations, the particular challenge is structural: human intelligence leaves fewer traces than technical intelligence. Where a telecommunications interception can be verified from a technical log, an oral agreement between a civilian operative and their handler leaves no documentable trace unless it is deliberately documented. And where there is no documentation, there is nothing to oversee.
Turun Sanomat captured the paradox of oversight: "On the basis of the annual report, it is impossible for citizens to know what has been investigated and why."
Sources: Intelligence Oversight Ombudsman Hakonen, annual reports 2019–2024; Tapio Raunio, Intelligence and National Security (2025); Sami Manninen, Maanpuolustus-lehti; TiVM 1/2021 vp; TiVM 1/2022 vp; Turun Sanomat, analysis 2024.
XI. International comparison — what others have learned
Every country in this comparison has learned the same lesson in a different way: an unmonitored intelligence structure expands.
The United Kingdom's CHIS framework is the most developed point of comparison. The Covert Human Intelligence Sources (Criminal Conduct) Act 2021 creates a statutory framework for civilian intelligence operatives. The system requires formal authorisation for every operative, a risk assessment, a handler-controller structure and notification to the oversight authority within seven days. The CHIS Code of Practice contains special provisions for minors and vulnerable persons. In Finland, no such framework exists.
Norway's Frode Berg case is a cautionary example. A Norwegian civilian was recruited to carry out intelligence tasks in Russia, arrested in 2017 and sentenced to 14 years. The Norwegian parliamentary oversight body (EOS Committee) criticised "extremely serious shortcomings" — inadequate risk assessment, insufficient training and a failure to abort the operation. Frode Berg paid a personal price for the state's decision to use a civilian in a task for which he had neither training nor protection.
Denmark's FE scandal (2020–2021) demonstrated how cooperation between intelligence services can circumvent national legislation. The Danish Military Intelligence Service assisted the NSA in spying on European leaders, including Chancellor Angela Merkel, through the XKeyscore system. Five senior intelligence officials were dismissed. FE chief Lars Findsen was arrested and charged with disclosing secrets, but the charges were dropped in November 2023.
Germany's BVerfG BND ruling (19 May 2020) was groundbreaking. The Federal Constitutional Court found the BND Act largely unconstitutional and established that fundamental rights bind state action worldwide. Intelligence must be subject to "end-to-end oversight," and the "laundering" of intelligence data — exchanging data with partners to circumvent national restrictions — was explicitly prohibited.
Edward Snowden's revelations (2013) demonstrated a fundamental truth: the internal oversight of intelligence organisations is not sufficient. The NSA's mass surveillance programmes were internally "lawful" — they complied with the organisation's own interpretations of the law. External oversight revealed that those interpretations did not correspond to the law's intent.
The shared lesson is structural: when intelligence organisations are given powers without adequate external oversight, they use those powers more broadly than the legislator intended. This is not a moral argument — it is a historical observation.
Sources: UK CHIS Act 2021; EOS Committee, Frode Berg report; DR (Denmark), FE scandal 2020; BVerfG, 1 BvR 2835/17, 19 May 2020; Glenn Greenwald, "No Place to Hide" (2014).
XII. The intelligence legislation amendment bill — expansion of powers
The intelligence legislation amendment bill (project SM040:00/2024) being drafted by the Ministry of the Interior proposes three significant changes to the Military Intelligence Act.
First: the use of outside persons in intelligence methods. The bill would allow the military intelligence authority to use "a person outside the authority" to install or remove objects, methods or software. Researcher Joonas Widlund of the University of Vaasa described this as "a significant delegation of public power to persons outside the authority." Parliamentary Ombudsman Petri Råman criticised the proposal, noting that an outside installer "would apparently act independently within the sphere of domestic peace, without the concrete supervision of an official," and would not bear criminal liability as a public official for their acts.
Second: abolition of the notification obligation. The bill would eliminate the target's right to retrospective notification entirely. Under the current law, notification is the default from which exceptions may be made. Under the bill, the exception would become the permanent state.
Third: dismantling restrictions on mass surveillance. The bill would loosen the conditions set by the Constitutional Law Committee in 2018 for untargeted intelligence gathering.
The criticism has been exceptionally unanimous. The Chancellor of Justice, the Parliamentary Ombudsman and the Intelligence Oversight Ombudsman have all raised serious concerns about the bill — a combination that is rare in Finnish legislative drafting.
The bill is expected to proceed to Parliament during the spring of 2026. The criticism received during the consultation round has been exceptionally forceful.
Sources: Intelligence legislation amendment bill, project SM040:00/2024; Joonas Widlund, interview Yle 21 January 2025; Parliamentary Ombudsman Petri Råman, opinion on intelligence legislation amendment bill; Chancellor of Justice, opinion on intelligence legislation amendment bill.
XIII. The constitutional dimension
The Constitutional Law Committee's opinions PeVL 36/2018 vp and PeVL 76/2018 vp set clear boundary conditions for intelligence legislation, and their practical realisation warrants assessment after seven years.
Prohibition of discrimination. The Committee required an explicit prohibition on discriminatory intelligence activities. The original wording was found unconstitutional. The prohibition is in the law, but monitoring its compliance would require knowledge of whom intelligence is directed at. This information is not publicly available.
Two-judge panel. The Committee required the strengthening of the court panel in intelligence warrant cases. This has been implemented, but statistics on the number of warrant applications processed, approval rates or denied applications are not published.
Prohibition of mass surveillance. The Committee stated unequivocally that the constitutional amendment "does not enable general, untargeted and all-encompassing monitoring of communications." The intelligence legislation amendment bill currently being drafted seeks to loosen this boundary.
Monitoring of ECtHR case law. The Committee required continuous monitoring of the case law of the European Court of Human Rights and the Court of Justice of the EU. The ECtHR has since issued two significant rulings (Big Brother Watch v. UK and Centrum för Rättvisa v. Sweden, both 25 May 2021) that refine the legal parameters of mass intelligence. The impact of these rulings on the interpretation of Finnish legislation is an open question that no one has yet systematically assessed.
The Constitutional Law Committee's boundary conditions were set at a time when Finland was not a NATO member, Europe's security situation was more stable and intelligence powers were narrower. Now all three variables have changed. The question is whether the boundary conditions will also change — or whether they will hold.
Sources: PeVL 36/2018 vp; PeVL 76/2018 vp; ECtHR: Big Brother Watch v. UK (2021); Centrum för Rättvisa v. Sweden (2021); Zakharov v. Russia (2015).
XIV. The research vacuum
Seven years after the intelligence legislation entered into force, Finland's academic research on the subject is strikingly thin.
Joonas Widlund's doctoral dissertation "Tiedustelu oikeusvaltiossa" ("Intelligence in a Constitutional State," Acta Wasaensia 545, University of Vaasa, 2024) is the only dissertation addressing the rule-of-law prerequisites of Finland's intelligence legislation. Widlund himself noted: "Legal research on intelligence in Finland is relatively scarce, and the enactment of intelligence legislation created a significant research gap."
Mikael Lohse has published two foundational works: "Johdatus tiedusteluun" ("Introduction to Intelligence," 2019, co-authored with Marko Viitanen) and "Tiedustelumenetelmät" ("Intelligence Methods," 2019). Matti Kortesoja (Tampere University) has analysed the "banalisation" of intelligence laws — the process by which surveillance powers became normalised in public discourse. Professor Martin Scheinin (Oxford/EUI) was the most prominent critic during 2017–2019.
Seven years. One dissertation. A handful of articles. A law that gives the state over 20 methods for intruding into citizens' privacy — and the legal interpretive framework is still largely unwritten.
Journalistic oversight is also under pressure. In the Viestikoekeskus case, journalists from Helsingin Sanomat were charged with disclosing a security secret — an offence categorised among treason crimes. The Helsinki Court of Appeal upheld the convictions in July 2025 and stated that Helsingin Sanomat had "probably caused concrete harm to Finland's external security." The chilling effect on investigative journalism concerning intelligence is self-evident: a journalist considering an investigation into an intelligence organisation's activities knows that their predecessors received criminal convictions.
The vacuum is not accidental. It is structural. Intelligence organisations operate in secrecy. Academic research does not emerge because source material is unavailable. Journalistic research does not emerge because the consequences are concrete. Public debate does not emerge because the subject has been "banalised" — Kortesoja's term for the process by which significant powers become invisible once people get used to them.
Sources: Joonas Widlund, "Tiedustelu oikeusvaltiossa" (University of Vaasa, 2024); Mikael Lohse & Marko Viitanen, "Johdatus tiedusteluun" (Alma Talent, 2019); Matti Kortesoja, European Journal of Communication (2023); Helsinki Court of Appeal, Viestikoekeskus case, July 2025.
XV. The open question
This article does not claim that Finland's military intelligence operates unlawfully. It does not claim that civilians are used in operational tasks. It is not based on anyone's private experience.
It describes a structure. A structure in which:
- The law permits over 20 intelligence methods whose application does not require suspicion of a crime. The use of civilians in operational tasks is a nearly unregulated legal territory.
- The target's right to be informed of measures directed at them has become a dead letter, and the intelligence legislation amendment bill currently being drafted would eliminate even that.
- The oversight system is multi-layered but operates in a legal vacuum — without precedent, without legal scholarship, without statistics.
- Academic research is virtually non-existent.
- Journalistic investigation is punishable.
A structure in which an intelligence organisation can, in theory, use a civilian to conduct surveillance on another civilian — in their own car, on their own time, without official status, without documentation, without oversight, without accountability — and in which a target who speaks about this publicly automatically enters a discursive category in which the weight of their words diminishes.
This structure is not unlawful. It is something worse: it is unmonitored.
An unmonitored structure that is being given additional powers is a structure that is growing right now, here in Finland.
International experience — Snowden, Denmark's FE, Germany's BND, Norway's Frode Berg — shows that intelligence structures always expand when they are allowed to expand. Not out of malice, but out of structural logic: an organisation whose mission is to acquire information always acquires more information. Limits do not arise from within. They come from outside — from the law, from oversight, from public discourse and from fundamental rights, which exist for the very purpose of ensuring that the state cannot do everything it is capable of doing.
This article is part of that limit from outside.
The open question is this:
Has Finland built an intelligence system in which the mechanisms of oversight are adequate in relation to the scope of its powers — or has it built a system in which trust has replaced oversight?
The question is not rhetorical. It deserves an answer. And that answer should come from Parliament, not from an intelligence organisation.
All information presented in this article is based on public sources: legislative texts, government bills, Constitutional Law Committee opinions, Intelligence Oversight Ombudsman annual reports, academic publications, case law and journalistic sources. The article contains no classified information.
In the next article, we will examine the Pegasus system, also relevant to Finland: how it works, how it is activated, how it can be detected and how it can be removed.
Key sources
Legislation and legislative drafting
- Military Intelligence Act 590/2019
- Communications Intelligence Act in Civilian Intelligence 582/2019
- HE 203/2017 vp, Government bill for the Military Intelligence Act and certain related acts
- Intelligence legislation amendment bill, project SM040:00/2024, Ministry of the Interior's preparation of a broader reform of intelligence legislation
- HE 29/2025 vp, Government bill to amend the firewall provisions of the intelligence acts
- PeVL 36/2018 vp; PeVL 76/2018 vp, Constitutional Law Committee opinions
Oversight reports
- Intelligence Oversight Ombudsman Hakonen, annual reports 2019–2024
- TiVM 1/2021 vp; TiVM 1/2022 vp, Intelligence Oversight Committee reports
Academic sources
- Widlund, Joonas: "Tiedustelu oikeusvaltiossa" (Acta Wasaensia 545, 2024)
- Lohse, Mikael & Viitanen, Marko: "Johdatus tiedusteluun" (Alma Talent, 2019)
- Lohse, Mikael; Meriniemi, Ilkka & Honkanen, Petri: "Tiedustelumenetelmät" (2019)
- Kortesoja, Matti: European Journal of Communication (2023)
- Raunio, Tapio: Intelligence and National Security (2025)
International comparisons and case law
- ECtHR: Zakharov v. Russia (Grand Chamber, 4 December 2015)
- ECtHR: Big Brother Watch v. United Kingdom (Grand Chamber, 25 May 2021)
- ECtHR: Centrum för Rättvisa v. Sweden (Grand Chamber, 25 May 2021)
- BVerfG: 1 BvR 2835/17 (BND ruling, 19 May 2020)
- UK: Covert Human Intelligence Sources (Criminal Conduct) Act 2021
- Norway: EOS Committee, Frode Berg report
Historical documentation
- US Senate Select Committee (Church Committee), Final Report Book III (1976)
- Knabe, Hubertus: "Die unterwanderte Republik" (2001), Stasi Zersetzung
- Cunningham, David: "There's Something Happening Here" (2004), COINTELPRO
Journalistic sources
- Yle: "Erittäin salainen, Vakoilua Suomessa" (2024)
- Yle: "Asiantuntija varoittaa tiedusteluvaltuuksien nopeasta kasvattamisesta" (21 January 2025)
- Helsingin Sanomat: notification obligation practices (August 2025)
- Iltalehti: Defence Committee reorganisation (2022)
- Helsinki Court of Appeal, Viestikoekeskus case (1 July 2025)