Latvian Political Monitor

The video maker is obviously not a local. In Dagda there are no traffic lights anywhere, also in Zilupe or Viļaka or Kārsava... and in many other small towns. And the fact that after the storm there was no electricity for a while is not the end of the world.

🇱🇻🇪🇪🇱🇹 Baltic security also begins with strong democracy and the rule of law. Today in Tallinn, together with the Estonian and Lithuanian justice ministers, we discussed how to strengthen our countries' resilience against increasingly complex threats. 🗳️ Democracy must also be protected in elections — against foreign interference, disinformation, and malicious use of artificial intelligence. In Latvia we have already introduced mechanisms to mitigate such risks, including the requirement to indicate the use of AI in pre-election campaigning and accountability for the use of misleading deepfakes. ⚖️ At the same time, we must be prepared for Russia's attempts to use law as an instrument of political pressure. Here, united and coordinated action by the Baltic states is especially important. 📉 However, a strong state is not a state with as many rules as possible. Regulation must be understandable, proportionate, and not create unnecessary burden on people and businesses. 🤝 Regular Baltic cooperation is essential to respond to common threats in a unified, timely, and practical way.

Last week's storm highlighted serious weaknesses in crisis prevention in Latvia. Ministries, as well as involved institutions and the Crisis Management Center, must submit proposals to the government by mid-September on how to improve the overall system's work in crisis situations.

This is work: https://t.co/pekL8zi61A

In all this storm mess, the thing that failed the most was Latvian Radio. The broadcaster, which could and should have become the main information provider for the public, calmly aired radio plays and worked in weekend mode. I wonder, will @seplpadome react to this somehow?

@Elina_Treija Of course, I agree, we will do that in parallel. But to bring clarity and so that nothing slips past us, the fastest is freezing.

Here is a legal aspect - when dismissing, there must immediately be someone who is allowed to sign papers, to answer for the company's operations. A temporary council must be installed so that it can legitimately appoint a temporary board = that's elementary logic, after all. Competitions for permanent positions will be held for all posts without delay. This is temporary, so that operations do not stop. That the whole system is rotten has long been clear, but to change it takes time, in the meantime we must act in accordance with existing legislation.

Here there is a legal aspect - upon dismissal there must immediately be someone who is allowed to sign documents and be responsible for the company's operations. A temporary council must be installed so that it can legitimately appoint a temporary board = that's elementary logic, after all. Competitions will immediately be held for all positions for permanent roles. This is temporary, so that operations do not stop. That the whole system is rotten has long been clear, but changing it takes time; in the meantime, one must act according to existing legislation.

This is important. Otherwise Latgale's court would have had a serious overload.

🧑🏼‍⚖️ Immigration-related cases will now be able to be distributed more evenly among courts throughout Latvia. ✅ The Saeima has adopted in the final reading amendments to the Immigration Law that will allow cases related to detained foreigners to be distributed more evenly among district courts throughout Latvia. Until now, these cases were largely concentrated in the Latgale District Court, creating a disproportionate additional burden. At the Saeima's out-of-town sitting in Latgale, we heard this problem very clearly from court representatives. We did not put this issue aside – we acted, and today the solution has been adopted. This means we will be able to use the capacity of the court system more wisely – if the volume of work increases significantly in one region, part of the cases can be redirected to courts where resources are available. This will help reduce the workload of one court and ensure more timely consideration of other cases as well. 💻 Importantly, the hearing of cases will be possible remotely using video conferencing, so transferring a case to another Latvian court will not require the physical transfer of the detained person to that court, and thus will not create expenses related to bringing the person to court. At the same time, court control, the grounds for detention, and the procedural guarantees of the person remain unchanged. Only the procedure for case distribution changes – so that the court system throughout Latvia can work more efficiently and resiliently. The court system must be sufficiently flexible to use resources where they are most needed at any given moment!

Good morning everyone from @ltvpanorama Morning News. Tune in right now for CSDD, AirBaltic, state-owned companies 'Corporate Governance' and more. https://t.co/EQQajxwdIv

That about the food is also in other countries. For example, in the UK, hot chicken is sold with VAT (because it is food as in a restaurant), but cold chicken is not subject to VAT (because it is food). And there are even lawsuits about this, a million-dollar industry for lawyers. And that is not nonsense, but a consequence of introducing different regulations for different groups, resulting in all sorts of oddities. About those cash registers, for instance. Well, they are needed everywhere, but there are exemptions for artisans. But a step left or right, and you still need a cash register. And it looks absurd.

No need to make a fuss... the only thing needed is to prevent mass anonymous pumping... if the user can be identified, everything is ok.

@Astridamains @guntarsv I agree... small entrepreneurs need all accounting and reports to the SRS with 5 clicks

@baidekalna @JurgisLiepnieks That is not restriction. Requiring access via smartID or e-signature is not restriction.

@JurgisLiepnieks @AndrejsUrbans No need to disinform, Jurģi... what restriction. Imposing access via smartID or e-signature is not restriction

@einemars @CSDD_LV @Apvienotais_ The contract has been in place since 2022 and is valid until 2027.

@EMEL_LV @zvejniekameita @CSDD_LV @Apvienotais_ That was already done yesterday.

🚨 CSDD CYBERATTACK — NEGLIGENCE WITH REAL CONSEQUENCES FOR STATE SECURITY — Today about the @CSDD_LV cyberattack, its consequences, and what must be done now. The CSDD board and council have been dismissed. Temporary management will be appointed instead, while competitions for the permanent board and council are started immediately. 🔴 WHAT HAPPENED? ➖️ On August 8 at about 3:00 AM, from Friday to Saturday, an attacker broke into the CSDD system. ➖️ The breach occurred through the CSDD MEDICAL platform, which about 200 doctors use to enter medical certificates for vehicle drivers. ➖️ The attacker operated undisturbed through the system on Saturday and Sunday. ➖️ On Sunday evening, a large-scale data download occurred. ➖️ CSDD only learned of the suspicious activity on Monday. ➖️ On Wednesday, it was established that data theft had occurred. ➖️ The Prime Minister was only informed on Wednesday at 5:00 PM. ❗ HOW WAS THIS POSSIBLE AT ALL? CSDD should have had secure multi-factor authentication. But CSDD MEDICAL access was possible only with a regular username and password. CSDD had every opportunity to implement top-level cybersecurity: 💶 there were financial resources; 💻 there was IT capacity; 🧠 there were knowledge and specialists. Yet self-assurance, negligence, and arrogance toward cybersecurity risks have led to one of the most serious data leaks in state possession. It threatens not only people's privacy but also the security of citizens, businesses, and the state. 📂 WHAT DATA HAS LEAKED? A very large volume of data is concerned: ➖️ data of approximately 1.3 million private individuals; ➖️ data of approximately 200,000 companies; ➖️ payment information for the period from 2008 to 2026; ➖️ first name, surname, or company name; ➖️ personal code or company registration number; ➖️ declared address; ➖️ vehicle state registration number. I do not understand why CSDD needed to store payment data since 2008 on its servers at all, if the regulatory acts do not require such storage. 🛡️ WARNINGS WERE THERE. THEY WERE NOT USED. CSDD had a contract with TET for server and connection cybersecurity, but not for the protection of CSDD's own application and software. Moreover. https://t.co/Y2dCsXsES5 had already offered from January to April 2026 to install its sensors that automatically identify suspicious anomalies in the network. The CERT measure is free. CSDD refused it. ⚖️ A submission has been filed with the prosecutor's office for possible negligence or wrongdoing. Law enforcement authorities must now establish the responsibility of each official. ✅ WHAT DO WE DO NEXT? I have issued a Prime Minister's resolution with 12 specific tasks for ministries and state institutions. Key ones: ➖️ CSDD must inform every affected person and company, indicating what specific data has leaked. ➖️ https://t.co/Y2dCsXsES5 sensors must be mandatorily installed in all critically important state systems so that anomalies are identified in a timely manner, not several days after the breach. ➖️ All critical infrastructure and sensitive data institutions must carry out full-scale intrusion simulations, i.e., penetration tests, to really test system resilience and find weaknesses before an attacker does. ➖️ Instructed to assess the possibility of restricting the freely accessible e-CSDD vehicle number plate check tool. ➖️ Instructed to assess how quickly state systems can abandon the use of the personal code as a username, moving to a more secure identification solution. ➖️ https://t.co/Y2dCsXsES5 has submitted a list of other state institutions that similarly refused the proposed cybersecurity measures. Next week we will go through this list. And the questions will be unpleasant. ⚠️ A MUCH GREATER STATE SECURITY RISK — declarations of officials. Individually, this data is already sensitive. But in combination with other publicly available state databases, it becomes a very effective profiling tool. The declaration information of officials in the VID system is currently freely viewable without user identification. In the era of artificial intelligence, the collection, structuring, and linking of huge amounts of data takes not months, but minutes. This means that such data can be systematically collected and regularly updated also by the services of Russia, Belarus, North Korea, or other countries. By combining CSDD's stolen data with publicly available declarations and other databases, it is possible to profile: 👮 police officers; 🪖 soldiers; 🛂 border guards; 🕵️ security service employees; 🏛️ officials and their families. This is already a national security issue. Declarations must remain accessible to the public, but I see no justification for them being mass-copied anonymously. The solution can be very simple — the information remains public, but access is after authentication, for example, with one's profile at https://t.co/2abj1S4l9U. 🌲 AND I HAVE NOT FORGOTTEN THE @valstsmezi CYBERATTACK. From the Minister of Agriculture @ArmandsKrauze I expect a concrete answer: who in Latvian State Forests was responsible for the systematic failure to update server software, which allowed the attacker to exploit vulnerabilities? Next week I want on the table: ➖️ the name and surname of the responsible official; ➖️ an explanation of how this was allowed; ➖️ information on what consequences and responsibility will follow. 🇱🇻 WE DO NOT LIVE IN A PEACETIME DIGITAL ENVIRONMENT. Latvia lives under constant hybrid threat conditions. Next to us are aggressor states that use all possible methods against our country. At the same time, artificial intelligence has made the preparation, automation, and data processing of cyberattacks much easier. Therefore, the attitude — “surely nothing will happen to us” — is no longer acceptable in public administration. Cybersecurity is not a technical matter for the IT department. It is state security. ❓ AND I ALSO HAVE QUESTIONS ABOUT THE NCC NATIONAL CYBERSECURITY CENTRE. I am interested in how it can be that the National Cybersecurity Centre, which had about 20 million euros in 2025 and about 28 million euros in 2026, has not been able to achieve significantly higher resilience of state systems against such attacks? That is very serious funding. About half of the public television and radio media budget. With such funding, there must also be a measurable result: ✅ how many institutions have actually been tested; ✅ how many vulnerabilities have been eliminated; ✅ in how many systems multi-factor authentication has been introduced; ✅ in how many institutions have https://t.co/Y2dCsXsES5 sensors been installed; ✅ how many real cyberattack simulation tests have been conducted; ✅ and who is responsible if known risks remain unaddressed for years. I have questions. And I expect very concrete answers. Cybersecurity cannot be fixed with presentations, strategies, and reports.

@ESvirskis We have a Minister of Justice to whom this question should start being addressed @EdvardsSmiltens. Otherwise I'll become the problem dispatcher here.