Top Stories

The joint investigation into this criminal network was initiated in 2021. The suspects recruited the victims, young women from Romania, via the so-called 'lover boy' method or by seducing them with the false promise of good work opportunities abroad. Once the girls were under their control, the suspects transported them to Spain and forced them into street prostitution. They coerced the victims through violence. The criminal network also forced their victims to sell drugs to their clients and assist them in their money laundering activities. The investigators identified more than 25 victims in total, as well as about 10 suspects, including a woman. The latter was overseeing the victims at the place of prostitution.The actions led to:5 house searches (4 in Romania and 1 in Spain)9 arrests in Spain5 European Arrest Warrants issued14 victims safeguarded in Spain10 victims identified in RomaniaSeizures include: jewellery, 4 bladed weapons (1 machete, 1 axe, 1 butterfly knife and 1 switchblade knife with a 19.5 cm blade), one vehicle, phones, documents and cash.The lover boy trickThe ‘lover boy’ technique is widely used by criminals to recruit victims confronted with economic and social hardship. The suspects target their victims’ vulnerabilities and seduce them with expensive gifts and promises of a better life abroad. This is how many women leave their families in search of love and new opportunities in other countries. However, once they find themselves in their new home, they are forced into prostitution to earn money for their handler. The victims are lured with affection, violence and threats against them and their families back home.Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. During the action, Europol supported via a Virtual Command Post, which enabled the cross-checking of operational information in real time.  Eurojust facilitated the judicial cooperation, funded coordination meetings and set up a Joint Investigation Team to coordinate the operational activities.

During the large-scale operation, which involved almost 200 police officers, law enforcement authorities also dismantled a laboratory in Belgium where members of the criminal organisation produced and stored synthetic drugs. Following production, the criminal group would smuggle the drugs across different countries in Europe. The action day on 12 December 2023 led to:16 locations searched (3 specific spots believed to be drug production laboratories);14 arrests in Belgium (12), Netherlands (1) and Spain (1);Seizures include: firearms, laboratory hardware and related equipment, precursors for producing synthetic drugs, cash, cars used by drug mules, and luxury watches.Participating authorities:Belgium: Judicial police (Federale Gerechtelijke Politie) from Limburg, Luik, Antwerpen, Leuven, Brussels, and Halle-Vilvoorde, and Local police (Lokale Politie) from Trudo, Lama and Tongeren-HerstappeItaly: Italian Carabinieri Corps (Arma dei Carabinieri)Netherlands: Dutch Federal Police (Korps Nationale Politie)Spain: Spanish National Police (Policía Nacional) Europol facilitated the exchange of information and continuously provided the involved law enforcement authorities with analytical support. On the action day, Europol provided support with a virtual command post, deployed specialists on the spot with a mobile office to work hand-in-hand with investigators, and provide analytical support and live crosschecks against Europol’s databases.

The operation led to:226 inspectionsSeizures include: timber from Myanmar with an estimated value of EUR 12 000; Brazilian timber - equivalent to 2 maritime containers - with an estimated value of EUR 67 0001 criminal investigation initiated.A lucrative practice with pernicious effects on climateIllegal timber trade is an ominous practice that entails the clear-cutting of an area of forest equivalent to a football field every two seconds worldwide. The illegal trade of timber depletes origin countries’ natural resources and has direct impact on deforestation and, consequently, on climate change.At the same time, illicit timber trade is one of the most financially rewarding transnational criminal activities, generating an estimated USD 7 billion. Organised criminal groups camouflage the origin of the timber through document forgery and bribery to pass customs checks and reach their destination - consumer countries. Various timber types such as teak, rose wood, ipé and pernambuco are in high demand in European countries, where they can be used for multiple purposes, including for the creation of ornaments and general construction. Europol’s roleEuropol deployed experts and analysts into the hotspots across the EU, delivering expertise and operational analysis support to the involved countries and law enforcement authorities.  Europol also provided operational support through a Virtual Command Post. Before the operation, law enforcement authorities met in a dedicated workshop to share learnings and best practices to combat illegal timber trade. Participating authorities:Brazil: Federal Police (Polícia Federal);France: French National Gendarmerie (Gendarmerie Nationale) – Central Office for Combating Environmental and Public Health Attacks (Office central de lutte contre les atteintes à l'environnement et à la santé publique OCLAESP); Costa Rica: Criminal Investigation Department (Departamento de Investigaciones Criminales) and Prosecutor;Germany: Federal Criminal Police (Bundeskriminalamt);Italy: Italian Carabinieri (Arma dei Carabinieri);Netherlands: Dutch Food and Consumer Product Safety Authority (Nederlandse Voedsel- en Warenautoriteit);Panama: National Police (Policía Nacional) and Prosecutor;Portugal: National Republican Guard - SEPNA (Guarda Nacional Republicana – SEPNA).Spain: Spanish Guardia Civil (Guardia Civil – SEPRONA) and SVA from Spanish Customs (Servicio de Vigilancia Aduanera). 

For the past several years, Europol has been observing a growing crime phenomenon: the use of Bluetooth trackers in organised crime.Bluetooth trackers are small devices designed to help people find personal objects, such as keys and bags, as well as vehicles at risk of theft. They can be attached to an item one does not want to lose, and wirelessly connected to the owner’s mobile phone or tablet.Criminals have always been quick to adopt new and emerging technologies, misusing them to further their criminal goals. It is no different with Bluetooth trackers: Europol is now seeing criminals increasingly using these devices to geolocate illicit commodities.The vast majority of cases reported to Europol relate to cocaine smuggling. These trackers have been discovered most frequently alongside cocaine in container shipment of food products, but have also been found hidden in sea chests within sea vessels. Based on the technological capabilities of Bluetooth trackers, and the information shared with Europol, it is confirmed that drug traffickers use them to track the transit of illicit cargo.  Through the trackers, cargo can be traced after arrival in ports, and onward by road towards storage locations in European markets. They are likely also used to locate illicit shipments upon arrival in ports.To warn about the misuse of this technology, Europol has issued a restricted early warning notification to all EU Member States, as well as a public version.The public version of the warning notification is available on our website.

Europol’s latest Serious and Organised Crime Threat assessment (EU SOCTA) report highlights that 60% of the criminal networks use corruption to facilitate their criminal activities. Continuing the fight against corruption is therefore crucial to bring down the criminal networks that pose the most serious risks to the security of EU citizens. Swift and close cooperation between national authorities is decisive in successfully addressing corruption. The announcement of the results of these latest EMPACT actions is timely as the International Anti-Corruption Day takes place on 9 December, marking 20 years since the United Nations Convention against Corruption. Austria, Croatia, Finland Hungary, Latvia, Netherlands, Spain and Sweden have also participated in previous strategic and operational actions within the same EMPACT annual action plan against corruption. Global results of the actions in November:49 cases233 persons of interest interviewed, some of whom were arrested267 searchesEUR 5.5 million of frozen assetsCorruption, misappropriation of funds and misconduct in public officeThe investigations targeted a number of corruption related crimes including bribery and kickbacks, bid-rigging, trading in influence, collusion, conflict of interest, trading of information, embezzlement, favouritism and nepotism. The operational actions focused on corruption cases affecting politically exposed persons and foreign public officials, as well as corruption cases related to public procurement and investigations involving law enforcement and judicial authorities. National authorities also targeted different corruption practices in private companies as well as corruption in sports.One example is a Portuguese case, which targeted the misappropriation of funds and abuse of positions in office. The Portuguese authorities investigated the use of public money by a political party between 2018 and 2021, which resulted in 20 searches. In another case, the Dutch authorities arrested three suspects as part of a bribery investigation into divulging confidential information linked to a procurement procedure of an oil storage company. This led to the seizure of EUR 2.5 million.In a third case, the French authorities arrested an elected official who had executive functions in French overseas territories, together with two of his accomplices, directors of a company in which he had a vested interest. The value of the public procurement contracts signed by the company, notably with the administration supervised by the elected representative, amounts to EUR 2.3 million.Europol support to corruption investigationsTogether with France, Europol co-leads the annual operational action plan against corruption, implemented in the framework of EMPACT CFMLAR. Europol facilitated the information exchange and the operational coordination. The Agency also provided analytical support to assist law national authorities in combating corruption. During a number of action days, Europol deployed analysts to locations to cross-checked operational information in real-time against Europol’s databases and provide technical expertise. In addition to the November actions, cases on corruption supported by Europol in the second half of 2023 resulted in the identification of 75 suspects in corruption related investigations.Involved law enforcement authoritiesAlbania: Albanian State Police (Policia e Shtetit)Belgium: Federal Police (Office central de répression de la corruption - Police Judiciaire fédérale)France: National Police (Police Nationale)Greece: General Directorate of Financial and Economic crime SDOEIreland: National Guard (An Garda Siochana)Netherlands: Anticorruption Centre of the Fiscal Information and Investigation Service (FIOD)Portugal: Judicial Police (Policia Judiciaria) 

After a pre-selection process, 32 images were shortlisted and put to a vote. Three awards were up for grabs this year, each decided by a different group of voters:the international law enforcement community represented in our headquarters members of the public Europol staffWe are happy to announce that Caroline Cange from Belgium, Connie Maria Westergaard from Denmark, and Jan-Niklas Kansteiner from Germany submitted the winning entries.The winners of Capture23The Europol Community Vote went to Caroline Cange from Belgium for her submission showing the preparation of horses for the Royal Escort of the Belgian Federal Police. This image was the clear favourite of the law enforcement community represented in the Europol headquarters in The Hague. All Liaison Bureaux, representing both EU Member States and Third Parties, were invited to rank their favourite images.The Public Vote was awarded to Connie Maria Westergaard with her portrait of a Danish police officer on evening patrol in the streets of Copenhagen. Her photograph received the most votes in the online ballot advertised on our social media channels, which was open to anyone who wanted to participate.Jan-Niklas Kansteiner from Germany entered the winning capture that became Europol’s Choice, which shows a department exercise under heavy rain. This shot was the picture of choice for Europol’s staff and its communications team!The three winners win a trip for two to the Netherlands, including a visit to Europol. Their images will also feature in our 2024 calendar and other Europol publications.If you are a law enforcement officer with a passion for photography, keep an eye on our website for next year’s photo competition!  

During the action day, officers arrested 10 suspects. Six are accused of trafficking in human beings, of which five are Greek nationals and one is a Venezuelan national. These six suspects allegedly belonged to an organised criminal group involved in the sexual and economic exploitation of female victims. The remaining four arrested suspects worked at the onsite locations in which the victims were exploited. The kingpin of the criminal group is accused of trafficking in human beings and money laundering.Three other members of the criminal organisation (two Greek nationals and one Albanian national) are on the run and wanted by the police, as they are also accused of trafficking in human beings. They are believed to still be in Greece. The actions on 2 December 2023 led to:10 arrests;8 locations searched;Seizures including cameras and other surveillance equipment, dozens of mobile phones and laptops, over EUR 6 300 in cash. During the operational actions, Greek authorities safeguarded 10 victims of sexual exploitation in Athens. Seven of the victims were Venezuelan nationals. Members of the criminal network recruited the victims in their home countries and transferred them to Greece. There, the criminal network placed the victims in apartments and exploited them at other locations in the centre of Athens. The criminal group would make tens of thousands of euros from abusing the victims. Profits were laundered via real estate acquisitions and investments. Europol supported the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed one expert to Athens to cross-check operational information in real time and support investigators on the ground.  

In early 2023, the Spanish Civil Guard opened an investigation into the manufacture of illegal firearms. Clues pointed investigators to individuals across Europe and North America who had purchased specific tools to manufacture or modify firearms. Some of the individuals had previous criminal records, including for firearms-related crimes. The investigation uncovered several illegal workshops for the production of firearms. In some cases, the individuals used heavy industrial machinery, such as lathes and milling machines, to manufacture the illegal weapons. In other cases, suspects used 3D printing to produce some of the components needed to assemble the firearms. The investigative activities in the countries led to 15 action days in recent months.The total results include:10 arrests (6 in Spain, 1 in Sweden and 3 in the United Kingdom)10 illegal firearms workshops dismantled (in Canada, Germany, Spain and the United Kingdom)24 location searches (2 in Canada, 9 in Germany, 2 in Ireland, 5 in Spain, 1 in Sweden, 2 in the Netherlands and 3 in the United Kingdom)49 new investigations initiated (2 in Canada, 9 in Germany, 2 in Ireland, 2 in Spain, 1 in Sweden, 2 in the Netherlands and 31 in the United Kingdom)Seizures of:70 illegal firearms, including assault rifles, 3D-printed semi-automatic submachine guns, pistols and drill presses)Weapons, including tasers, compressed air/blank firing weapons, crossbows, bayonets and butterfly knivesOver 37 000 rounds of ammunition, explosives precursors, gunpowder and a grenade launcherWeapon parts and components: barrels, silencers and magazinesThe results of the actions carried out in the different countries highlighted the importance of law enforcement cooperation across borders to combat the illegal production and trafficking of firearms. The multiple raids led to the detection of illegal private print shops in Canada, Germany, Spain and Sweden. This also highlighted the increasing use of 3D printing technology in the illegal production of firearms and the role of private manufacturing in the illegal trafficking of firearms.Europol facilitated the exchange of information and operational coordination, and provided analytical support.

The action day led to:12 location searches in Italy (Taranto, Roma, Matera and Perugia)4 persons arrested1 illegal mint shop dismantled The following seizures: 107 000 in bitcoins, counterfeit coins and part of the coin press machine used for production.The investigation was initiated on 10 April 2021, when officers of the Carabinieri seized 668 counterfeit two euro coins and arrested two individuals for possession of counterfeit currency. The technical analyses of the seized coins, carried out by the Italian Coin National Analysis Centre (CNAC) and the European Technical and Scientific Centre (ETSC) of European Commission, linked the seized coins to a new and insidious class of counterfeit two euro coins. The counterfeiters distributed the fake coins in several EU countries, mainly France, Germany, Lithuania, Portugal and Spain, as well as in Switzerland. The quality of the counterfeit coins was good and had very similar characteristics to the genuine ones. The investigation revealed that a vendor who managed a channel on a messaging application had set up the production chain. On his channel, the vendor sold these counterfeit currencies for 50% of their value, receiving the payments in cryptocurrency. Members of the criminal network shipped the parcels containing the fake coins to customers via private international postal services. The investigators managed to identify the suspects through special investigative techniques such as cryptanalysis of the blockchain transactions that enabled the illegal trade. During the investigation, officers tracked 60 shipments of parcels containing counterfeit coins. These parcels were destined for Italy, France and Switzerland, among other countries. They weighed almost 100 000 kg and had a total value of about EUR 102 000 euros in counterfeit two euro coins. Europol facilitated the information exchange and financed and coordinated several operational activities. Europol also provided analytical support to identify the country in which the coins were distributed. During the action day, Europol sent an expert to Italy to provide technical support and cross-check the operational information against Europol’s databases and the systems of the European Central Bank.  

Unfortunately, the faking of extra virgin olive oil is a common practice, which is why the fight against it is a law enforcement priority - especially in production countries. In this food fraud operation, investigators uncovered that the criminals used so-called ‘lampante oil’, the lower-quality variant of olive oil, to dilute their product. Lampante olive oil is characterised by elevated acidity levels, an undesirable flavour, and a distinctly unpleasant odour, which make it unsuitable for consumption. The term ‘lampante’ itself originates from its historical use as a fuel in oil lamps.A mix of various factors, such as the general inflation of prices, reduced olive oil production and increasing demand, have created the perfect breeding ground for fraudulent producers. Mixing consumer-grade olive oil with lower grade alternatives allowed the criminals to offer competitive prices while entering legal supply chains. This illegal practice can not only cause a public health risk, but also undermine consumer trust and thus have further economic repercussions.Coordinated raids in Spain and ItalyIn a coordinated action in November 2023, Spanish and Italian law enforcement officials conducted searches in various locations. Around Ciudad Real, Spain, 11 suspects were apprehended and 12 barrels containing 260 000 litres of adulterated oil were seized. The officers also seized four vehicles and EUR 91 000 in cash, as well as digital and physical evidence such as billing documents and e-mails.In the Italian provinces of Sicily and Tuscany, investigators inspected three oil factories suspected to be involved in the illegal practices. Several fiscal documents and clients lists were acquired, oil samples gathered, and one company sanctioned for irregular labelling of its products. Europol deployed a specialist with a mobile office to Spain, allowing for quick cross-matches against Europol databases.Participating law enforcement agencies:Italy: Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri); Ministry of Agriculture, Food Sovereignty and Forests (Ministero dell'agricoltura, della sovranità alimentare e delle foreste - Ispettorato centrale della tutela della qualità e della repressione frodi)Spain: Spanish Civil Guard (Guardia Civil)This press release was amended 04/12/2023 to reflect changes in the numbers of arrests.

The ninth edition of the European Money Mule Action (EMMA 9), which was funded by EMPACT and led by the Netherlands, was the continuation of an established international law enforcement effort. As in previous years, it involved operations around the globe, such as in Colombia, Singapore and Australia.Results of the operation include:10 759 money mules identified474 recruiters/herders identified1 013 individuals arrested10 736 fraudulent transactions reported4 659 investigations initiated2 822 banks and financial institutions supported the action EUR 100 million losses reportedEUR 32 million in losses preventedEMMA is the most extensive international operation of its kind, grounded in the principle that information sharing between the public and private sectors is essential in combating today’s sophisticated crimes. The European Banking Federation (EBF) was the first industry partner to EMMA, playing an active role since EMMA’s inception in 2016. In this year's endeavour, with ongoing coordination of the EBF, approximately 2 822 banks and financial institutions collaborated with law enforcement. This joint effort also involved online money transfer services, cryptocurrency exchanges, online travel providers and ‘Know Your Customer’ (KYC) companies, as well as multinational computer technology corporations.Crime fuelled by crimeAs a coordinated action conducted across Europe and the globe, EMMA aims to fight money mule networks benefitting from different types of criminality, such as cyber-enabled fraud against financial institutions and their customers. Building on investigations conducted with the support of private industry partners, law enforcement authorities can then take action, such as arrests, seizures, house searches and interviews. Operation EMMA's primary goal is to enhance and exchange cross-border information between the countries involved, thus making a significant contribution to the fight against money mule networks. By doing so, it aims to prevent financial losses and raise awareness about this widespread problem.The EMMA initiative has successfully strengthened bolstering cross-border collaboration to combat and dismantle money mule networks engaged in international money laundering. These networks operate by transferring (digital or cash) funds received from third parties to other recipients, while earning a commission in the process. The majority of investigations involve cross-border cases: either money is transferred from one country to another, or organised money mules travel globally to open bank accounts, often using fake documentation to deceive KYC procedures.Recent trends in a globalised criminal landscapeInvestigators have reported a number of recent developments in the criminal landscape of international money laundering. One EU Member State has discovered that migrants from Ukraine, seeking refuge from war, are being increasingly targeted as unwitting accomplices in crime. Exploiting their vulnerability and economic distress, criminals coerce them into inadvertently laundering money by forcing them to open bank accounts.Bank impersonation crimes are also on the rise, with criminals posing as bank officials predominantly targeting elderly people and persuading them to open new accounts. Perpetrators often visit victims in person to obtain copies of identity documents and signatures.Another alarming trend involves the fraudulent use of artificial intelligence to create fake identities, thus making it possible to bypass KYC security features during online account creation.In yet another emerging modus operandi, criminals target younger persons and provide them with online means of payment, such as gift cards. These are activated in a tokenisation process for purchasing goods or electronic devices. The mules then hand over the purchased goods to the criminals, who then offer them for sale on the most popular e-commerce marketplaces, receiving a percentage of the illegal proceeds either in cash or in goods.Investigations have revealed that a series of intricate online fraud schemes are funnelling money into accounts operated by money mules. These schemes include investment scams, compromised business emails, bogus holiday rental listings, middleman scams, phishing, messenger app fraud, help desk fraud, counterfeit bank cards and the use of crypto values transferred from virtual currencies exchanges to e-wallets. This global crackdown aims to make it more difficult for criminals to operate and to disguise the flow of their illicit earnings.Europol’s roleEuropol supported the planning and preparation of all the operation’s phases. The Joint Cybercrime Action Taskforce (J-CAT) supported the actions by facilitating information exchange between law enforcement authorities. During the operational phase, Europol’s analytical support helped to identify the connections between cross-border cases and the money mule networks. Additionally, Europol coordinated and aligned the EMMA 9 awareness campaign with the participating countries and private industry partners.Participating countries:Australia, Austria, Bulgaria, Cyprus, Colombia, Czechia, Denmark, Estonia, Greece, Hong Kong (China), Hungary, Ireland, Italy, Latvia, Moldova, Netherlands, Poland, Portugal, Romania, Singapore Slovenia, Sweden, Spain, Ukraine, United Kingdom, United StatesParticipating agencies:Europol, Eurojust, INTERPOLPrivate industry partners:European Banking Federation, Coinbase, Fourthline, Santander, Tripadvisor, Western Union 

The arrested man, who has ties to many high-ranking members of Italian organised crime as well as Latin American drug cartels, had spent several months in clandestine drug laboratories. Investigators were able to establish how the ‘Ndrangheta had sent the individual to the mountains in Colombia to work directly with drug manufacturers in their production facilities, with the aim of bringing these new-found skills to Europe.A futile, old-school attempt to avoid captureIn November 2023, the fugitive was apprehended near his temporary residence, despite trying to identify himself with a forged Colombian identity document. Europol had developed reliable intelligence concerning this individual’s international drug trafficking activities, for whom INTERPOL had issued a Red Notice, and was able to narrow down his location in Latin America. Europol then brought together all the investigators involved to agree on a joint strategy to arrest the suspect. To this end, Europol also set up a virtual command post to coordinate the activities on the ground. This operation was supported by EMPACT and the ON Network, which is funded by the EU (Internal Security Funds Project ‘ISF4@ON’) and led by the Italian Antimafia Investigation Directorate. 

The EMPACT Joint Action Days were planned based on an intelligence-led approach which saw police, customs, immigration agencies and border control agencies join forces. Spain coordinated the operational activities, while Europol coordinated the exchange of operational information between the parties involved.The EMPACT Joint Action Days included intensified checks at the EU’s external borders and special operations in the countries involved. Police, gendarmerie, border guards, customs authorities and national units involved in combating organised crime across Europe cooperated in these EMPACT Joint Action Days. The intelligence-led approach and cross-border operational coordination involved joint efforts by more than 22 000 officers from the participating authorities. The operation was coordinated from an international coordination centre set up in Skopje, North Macedonia, where officers representing these authorities were present to facilitate international cooperation and respond to operational needs on the ground. The information exchange led to the opening of 121 new cases against criminal networks. Europol coordinated the exchange of operational information during the EMPACT Joint Action Days and supported the operational coordination. Europol also deployed experts on the ground to provide real-time analytical support to field operatives. The Netherlands deployed two teams with special scanning equipment to border crossing points in Greece and Montenegro. Frontex deployed experts and equipment to the external borders.Global results of the EMPACT JAD 2023:22 488 officers involved 163 investigations initiated288 774 total entities checked215 273 persons checked67 277 vehicles checked5 225 postal packages/parcels checked999 premises searched2 229 illegal entries detected566 arrests (218 related to migrant smuggling, 186 related to drug trafficking, 69 related to firearms trafficking, 89 related to other crimes)114 forged documents identifiedSeizures including: 310 weapons (84 automatic weapons, 65 pistols, 59 rifles, 22 grenade launchers, 16 revolvers, 7 carbine, 6 shotguns, 4 converted weapons, 2 air guns, other, 42 other)20 206 pieces of ammunitionAlmost a tonne of drugs including 626 kg of cocaine, almost 300 kg cannabis, heroin and marijuana plantsCyber patrolling coordinated with the JAD SEE 2023Cyber patrolling was set up during the operational phase of the JAD SEE 2023 between 13 and 18 November 2023. The cyber patrolling focused on monitoring and investigative activities on different websites, forums and marketplaces on the clear and dark web as well as on messaging applications and social media networks. The operational activities were aimed at detecting the illicit trafficking of firearms and collecting further information on the identified targets. The online investigations also focused on re-enactment activities that could assist the operational actions on the ground. These investigations were conducted in native languages by officers from Albania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, and Ukraine. The officers carried out these activities in a synchronised manner, with the operational actions coordinated through the JAD Coordination Centre in Skopje, North Macedonia. During the cyber patrolling activities, investigators identified 120 targets (accounts and/or individuals) related to the trafficking of firearms, 94 of which were on a messaging application, 11 on marketplaces and 10 on other clear websites and 5 on the dark web. Overall participants in all joint action daysEU Member States: Austria, Bulgaria, Croatia, France, Germany, Greece, Hungary, Italy, Luxembourg, Netherlands, Poland, Portugal, Romania, Slovenia, Spain and Sweden. Non-EU countries: Albania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, Türkiye, Ukraine and United Kingdom. EU agencies: Europol, Eurojust and Frontex.International and institutional partners: EUBAM, IPA/2019 (EU co-funded projects: “EU Support to Strengthen the Fight against Migrant Smuggling and Trafficking in Human Beings in the Western Balkans” and “Countering serious crime in the Western Balkans), INTERPOL, PCC SEE (Police Cooperation Convention for Southeast Europe Secretariat), SEESAC (South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons), SELEC (Southeast European Law Enforcement Center), UNDP and UNODC. *This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.

On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne and Vinnytsia, resulting in the arrest of the 32-year-old ringleader. Four of the ringleader's most active accomplices were also detained.More than 20 investigators from Norway, France, Germany and the United States were deployed to Kyiv to assist the Ukrainian National Police with their investigative measures. This set-up was mirrored from Europol’s headquarters in the Netherlands where a virtual command post was activated to immediately analyse the data seized during the house searches in Ukraine.This latest action follows a first round of arrests in 2021 in the framework of the same investigation. Since then, a number of operational sprints have been organised at Europol and in Norway with the aim of forensically analysing the devices seized in Ukraine in 2021. This forensic follow-up work facilitated the identification of the suspects targeted during the action last week in Kyiv. Dangerous, undetected and versatileThe individuals under investigation are believed to be part of a network responsible for a series of high-profile ransomware attacks against organisations in 71 countries. These cyber actors are known for specifically targeting large corporations, effectively bringing their businesses to a standstill. They deployed LockerGoga, MegaCortex, HIVE and Dharma ransomware, among others, to carry out their attacks.The suspects had different roles in this criminal organisation. Some of the them are thought to be involved in compromising the IT networks of their targets, while others are suspected of being in charge of laundering cryptocurrency payments made by victims to decrypt their files.Those responsible for breaking into networks did so through techniques including brute force attacks, SQL injections and sending phishing emails with malicious attachments in order to steal usernames and passwords.Once inside the networks, the attackers remained undetected and gained additional access using tools including TrickBot malware, Cobalt Strike and PowerShell Empire, in order to compromise as many systems as possible before triggering ransomware attacks.The investigation determined that the perpetrators encrypted over 250 servers belonging to large corporations, resulting in losses exceeding several hundreds of millions of euros.International cooperationInitiated by the French authorities, a joint investigation team (JIT) was set up in September 2019 between Norway, France, the United Kingdom and Ukraine, with financial support from Eurojust and assistance from both Agencies. The partners in the JIT have since been working closely together, in parallel with the independent investigations of the Dutch, German, Swiss and U.S. authorities, to locate the threat actors in Ukraine and bring them to justice.This international cooperation has remained steadfast and uninterrupted, persisting even amid the challenges posed by the ongoing war in Ukraine.A Ukrainian cyber police officer was initially seconded to Europol for two months to prepare for the first phase of the action, before being deployed to Europol permanently to facilitate law enforcement cooperation in this field.From the onset of the investigation, Europol’s European Cybercrime Centre (EC3) hosted operational meetings, providing digital forensic, cryptocurrency and malware support, and facilitating the information exchange in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol’s headquarters.Eurojust hosted twelve coordination meetings to facilitate the communication and judicial cooperation between the authorities involved.The forensic analysis carried out in the framework of this investigation also allowed the Swiss authorities to develop, together with the No More Ransom partners and Bitdefender, decryption tools for the LockerGoga and MegaCortex ransomware variants. These decryptions tools have been made available for free on: www.nomoreransom.org.Participating authorities:Norway: National Criminal Investigation Service (Kripos)France: Public Prosecutor’s Office of Paris, National Police (Police Nationale - OCLCTIC)Netherlands: National Police (Politie), National Public Prosecution Service (Landelijk Parket, Openbaar Ministerie)Ukraine: Prosecutor General’s Office (Офіс Генерального прокурора), National Police of Ukraine (Національна поліція України)Germany: Public Prosecutor’s Office of Stuttgart, Police Headquarters Reutlingen (Polizeipräsidium Reutlingen) CID EsslingenSwitzerland: Swiss Federal Office of Police (fedpol), Polizei Basel-Landschaft, Public Prosecutor's Office of the canton of Zurich, Zurich Cantonal PoliceUnited States: United States Secret Service (USSS), Federal Bureau of Investigation (FBI) Europol: European Cybercrime Centre (EC3)EurojustThe investigation benefited from funding from the European Multidisciplinary Platform Against Criminal Threats (EMPACT).          

On 22 November, 59 searches were carried out, resulting in the arrest of one of the alleged ringleaders. Seizures included:a total of 1 800 AirPods;cash and two luxury cars (a Lamborghini and a Porsche), worth a collective EUR 550 000;a luxury watch, worth EUR 907 000;a jammer – used to scramble communications and to avoid detection by the Police – was also confiscated.Code-named ‘Goliath’, the investigation was led by the European Public Prosecutor’s Office (EPPO) in Hamburg, Germany, with the support of Europol and law enforcement authorities in Denmark, France, Germany, Hungary, Lithuania, the Netherlands, Sweden and Switzerland. The investigation focused on the suspected members of two criminal organisations, active in the international trade of consumer electronics (mainly AirPods). They are believed to have evaded tax by means of a VAT carousel fraud – a complex criminal scheme that takes advantage of EU rules on cross-border transactions between its Member States, as these are exempt from value-added tax. The estimated loss to the EU and national budgets amounts to at least EUR 85 million.The investigators were able to uncover how the suspects established companies in Germany and other EU Member States, as well as in non-EU countries, in order to trade the goods through a fraudulent chain of missing traders – who would vanish without fulfilling their tax obligations. Other companies in the fraudulent chain would subsequently claim VAT reimbursements from the national tax authorities.The investigative work conducted by the EPPO, with the support of Europol, established connections between the suspects and the numerous companies used in the fraudulent schemes.  During the action day, Europol deployed one of its specialists to the coordination centre in Luxembourg to facilitate the information exchange and crosscheck against its databases the data gathered during the house searches.Participating authorities: EuropolGerman tax investigation units: Steuerfahndung Nürnberg, Steuerfahndung Hamburg, Steuerfahndung Oldenburg, Steuerfahndung Braunschweig, Steuerfahndung KonstanzGerman criminal police investigation units: Landeskriminalamt Düsseldorf, Polizeipräsidium Dortmund and Polizeipräsidium DüsseldorfHungary: Budapest’s Metropolitan Chief Public Prosecutor’s Office and the National Tax and Customs AdministrationFrench Customs: Douane – Finances Denmark: Rigsadvokaten (Director of Public Prosecutions), Københavns Politi (Copenhagen Police) and Funen PoliceSwitzerland: Public Prosecutor’s Office of Kanton Thurgau Sweden: Ekobrottsmyndigheten (Swedish Economic Crime Authority) Other law enforcement authorities in Lithuania, The Netherlands and Switzerland. 

Since 2014, Europol has been regularly bringing together victim identification experts from around the world to focus on unsolved cases of child sexual abuse. Over 695 children have been safeguarded and 228 offenders arrested as a result of operations based on the VIDTF. As the largest recurring operation of its kind in the world, the VIDTF has also inspired a number of similar initiatives at the national and regional levels.Public appeal for helpYou can help us identify the origin of certain objects as part of Europol’s Trace an Object initiative. Visit https://www.europol.europa.eu/stopchildabuse to see if you recognise any identifiable features or individuals in the publicly released images. Europol periodically releases new series of pictures containing non-confrontational details of images extracted from child sexual abuse cold cases in the hope that someone will recognise a detail that will help narrow down the location of the victim. No clue is too small.  Note to media:Europol encourages you to use the term ‘child (sexual) abuse material’ as opposed to ‘child pornography’ in your reporting.The use of the term ‘child pornography’ helps child sex abusers as it suggests legitimacy and compliance on the part of the victim and therefore legality on the part of the sex abuser. The use of the term ‘child pornography’ conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation in which a child has been abused. This is not pornography. Participating countries:Australia, Belgium, Bulgaria, Canada, Czechia, Denmark, Estonia, France, Germany, Ireland, Italy, Latvia, Malta, Moldova, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, United Kingdom, United StatesParticipating agencies:Europol, Interpol 

The suspect was a high-value target sought by Croatia and Germany. The investigation, carried out in the framework of Europol’s Operational Taskforce (OTF) ‘Balkan Cartel’, marked a successful cooperation between the involved EU Member States and Türkiye in targeting and bringing down this criminal organisation.The arrest of the Croatian kingpin is the result of operational activities supported by Europol in early October, involving law enforcement authorities from Croatia and Germany. The action day on 11 October led to:21 arrests (12 in Split, Croatia and 9 in Germany); the seizure of 8 vehicles;firearms (rifles, machine guns, ammunition and silencers);large amounts of money, drugs, mobile phones and various types of documentation.Europol facilitated the exchange of information and continuously provided the investigation with analytical support. The development of operational intelligence revealed an extensive, covert network operating across continents and countries.Operational Taskforce targets Balkan Cartels  The takedown of encrypted communication tools used by criminals has given international law enforcement an unprecedented insight into criminal networks and how they function. One trend that emerged was the important role played by criminal networks largely composed of nationals from countries in the Balkan region, in the global cocaine trade.Europol created the Operational Taskforce Balkan Cartel to respond to this threat. Led by members with close ties to the region, the Operational Taskforce brings together Balkan, EU and global countries, to effectively target these criminal networks.Participating authorities:Croatia: Croatian National Police Office for Suppression of Corruption and Organised Crime; Service in Split and Croatian Drug Crime Service (Policijski nacionalni ured za suzbijanje korupcije i organiziranog kriminaliteta; Služba u Splitu i Služba kriminaliteta droga);Germany: Federal Criminal Police (Bundeskriminalamt); Spain: Civil Guard (Guardia Civil);Türkiye: National Police; Counter Narcotics Department/Istanbul Narcotics Division (Emniyet Genel Müdürlüğü Narkotik Suçlarla Mücadele Başkanlığı/ İstanbul Narkotik Suçlarla Mücadele Şube Müdürlüğü). 

This Taskforce aims to help identify suspects and their involvement in war crimes, crimes against humanity or genocide crimes committed in Ukraine through the collection and analysis of open source intelligence (OSINT).Since the outbreak of the war, there is an unprecedented level of OSINT available online, largely owing to the growing importance of the internet and social media. Such intelligence can greatly assist investigators in verifying and recording instances of war crimes.Due to the enormous amount of information that is available online and the impact of core international crimes on the global community as a whole, international cooperation is invaluable.The OTF is led by the international crimes units of the Dutch Police (Nationale Politie) and German Federal Criminal Police Office (Bundeskriminalamt), with the support of Europol and its Analysis Project Core International Crimes (AP CIC).So far, 14 countries have agreed to assign a dedicated OSINT capacity to the taskforce to support prioritised requests from Ukraine, other countries and the International Criminal Court.The OTF may also appeal on the support and cooperation of non-OTF members, EU agencies, NGOs or private companies.Participating countriesBelgium, France, Germany, Ireland, Italy, Lithuania, Netherlands, Portugal, Slovak Republic, Slovenia, Spain, Norway, United Kingdom, United States of America  

Operation MOZAIK 2023 was led by the Slovenian National Police and coordinated by Europol in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). It aimed to identify and arrest people using online forums and messaging applications to share and distribute child sexual abuse material. The Western Balkan countries –Bosnia and Herzegovina, North Macedonia, Montenegro and Serbia – Slovenia, Croatia and Hungary carried out a series of enforcement actions between 6 to 17 November.Police conducted 41 raids across the participating countries, following investigations into the sharing of images and videos depicting child sexual abuse. As a result, 3 suspects were already arrested or charged with crimes relating to the distribution of child abuse images.During the actions, more than 200 items containing images or videos of child sexual abuse were seized, including computers, mobile phones, computer servers and memory cards.Europol facilitated the information exchange between all the countries involved, and further enhanced the operational picture in the region by cross-checking the seized data and providing intelligence packages to continue the investigative work in this region and beyond.A priority regionIn the framework of EMPACT, Slovenia, Croatia, Hungary and Europol’s European Cybercrime Centre have teamed up to establish an expert network in the Western Balkans with the goal to strengthen cross-border cooperation in the fight against child sexual abuse.Europol’s ‘Say No!’ prevention campaign has been made available to all the countries in the Western Balkan region in their own national language.  This campaign includes a 10-minute long video which portrays two teenagers, a boy and a girl, being exploited online by a criminal organisation for financial gain and by an individual online sexual offender seeking further sexual material, respectively. The video includes advice as to how such crimes may be reported to law enforcement and how to avoid falling victim in the first place.This video has been shared with parents, children and teachers to raise awareness in the Western Balkans about child sexual abuse.The video is now available in the languages of the following 29 countries: Austria, Belgium, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italia, Latvia, Lithuania, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Bosnia and Herzegovina, Moldova, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine and the United Kingdom.Visit the Say No campaign page for more advice.Participating authorities in Operation MozaikSlovenia: Slovenian National Police, General Police Directorate, Criminal Police DirectorateBosnia and Herzegovina: Brčko District Police, Cyber Unit, Ministry of Internal Affairs of Republic of Srpska, Criminal Police Directorate, High Tech Crime Department,Federation BIH, Federal Police Administration, Department to Combat Inter-Cantonal Crime, Federal Criminal Police Investigation ServiceSerbia: Service for combating High-Tech Crime, Directorate for Technology, Police Directorate, Ministry of the InteriorMontenegro: Departments for Combating Serious Crimes, High-tech Crime UnitNorth Macedonia: Ministry of Interior of North Macedonia, THB Unit, Organised Crime Department and THB SM Task Force, and Computer Crime and Digital Forensic SectorCroatia: Ministry of Interior, General Police Directorate, Criminal Police Directorate, Crime Intelligence Sector, Cyber Security DepartmentHungary: Rapid Response and Special Police Services, National Bureau of Investigation, Cybercrime Department     

Over 50 most wanted criminals newly uploaded to the websiteThis year’s campaign sees a fresh batch of wanted criminals uploaded to the website. Over 50 profiles of fugitives linked to serious crimes have been uploaded to the website this year. Some of the crimes committed by fugitives highlighted in this year’s list include murder, trafficking in human beings, armed robbery and cybercrime amongst other offences.Europol’s Executive Director, Catherine De Bolle, said:  Collaboration across EU countries and with EU citizens is crucial when trying to find wanted fugitives. These criminals escape from country to country and repeatedly try to evade law enforcement authorities. By quickly browsing our EU Most Wanted list website, you could help save potential victims. Check the website and help us find them. Be our next hero.   Could you be our next hero? ENFAST and Europol are asking EU citizens to visit the website and view images of these fugitives to check if they recognise any of them. The theme for this year’s campaign is that citizens can step into the story and be superheroes too. This year, the campaign will be present at the Dutch Heroes Comic Con in Utrecht on Saturday 18 November. All you have to do is check the EU Most Wanted list website, keep your eyes peeled and submit tips anonymously via the website.How the website worksWhen you send an anonymous tip via the website, you will reach the ENFAST community. ENFAST is the European network of police officers within national fugitive teams, available 24/7 who can immediately undertake action to locate and arrest fugitives when necessary. The members of ENFAST are all specialised in locating criminals on the run who are suspected, or have been convicted, of serious crimes and are subjects of European Arrest Warrants. EU Most Wanted list gets results The EU Most Wanted list has achieved significant success in the past with a number of anonymous tips leading to actual arrests. The EU’s Most Wanted was launched by the ENFAST community in January 2016 with the full support of Europol. Since then:  408 profiles of fugitives have been listed on the website; 146 fugitives have been arrested; 50 arrests came as a direct result of a fugitive profile being published on the website;  21 cases successfully solved since the launch of last year’s campaign in September 2022. This year’s campaign will also appear across social media and there will be a call to action in all EU languages to reach as wide an audience as possible.  ENFAST  ENFAST aims to increase security within the EU by successfully tracing and arresting internationally wanted criminals who have committed serious crimes. The evolving nature of cross-border crime has prompted national police forces in EU Member States to combine forces and use their expertise to ensure that it is impossible for dangerous criminals to flee and escape punishment.  

This type of crime is particularly prevalent in Germany. While the number of ATM robberies in the Netherlands is decreasing, most perpetrators are based in the Netherlands and operate from there. Their reliance on high-grade explosives, which they often assemble and store in residential areas, can cause serious risks to residents.Ruthless modus operandiWhen committing the crime itself, perpetrators typically act with no regard to the health and safety of persons living in a building where a target ATM is located. After scoping out potential attack sites and escape routes, the robbers usually arrive in the night with vehicles that are either stolen or feature stolen plates. They then apply explosives to the cash machine and detonate them, which can cause fires or structural damage to the building. After collecting the cash money from the destroyed ATM, they flee the scene at high speed to avoid the police, showing no consideration for the safety of others on the road.Investigations show that the criminal groups involved in ATM attacks are highly fluid in terms of size and individuals involved, and seem to have little trouble recruiting new accomplices. Despite some criminals getting severely hurt during test explosions or actual robberies, they are willing to use increasing levels of violence, amplifying the consequences for affected communities. Businesses have to close for extended periods, apartment buildings become uninhabitable and the local cash supply is impacted. Apart from the economic damage, which can run into millions of euros, persons directly or indirectly affected by the violent robberies may experience psychological trauma and fear for their safety. Europol’s support to the investigationGermany, the Netherlands and Europol created an operational task force aimed at taking down this criminal group. Apart from organising and financing several operational meetings, Europol provided database checks, analytical support, and facilitated the exchange of information in this investigation. On the action day, Europol staff were deployed on the spot to provide real-time analytical support and to cross-check operational information against Europol’s databases. 

Cannabis products are becoming increasingly potent and diverse, while collaboration between criminal groups is creating new security risks in Europe. These are among the conclusions of a new analysis — EU Drug Market: Cannabis — released today by the EMCDDA and Europol (1). The analysis describes the illegal European market for cannabis products, from production and trafficking to distribution and use. It also details the processes, materials and criminal actors involved at different stages and levels of the market. Estimated to be worth at least EUR 11.4 billion annually, the cannabis market is the largest drug market in Europe. Latest estimates show that some 22.6 million adults in the EU (15–64 years) have used cannabis in the last year. In 2021, seized quantities of herbal cannabis and cannabis resin in the EU reached their highest levels in a decade, at 256 tonnes and 816 tonnes respectively. In addition, over 4.3 million cannabis plants were intercepted.Most of the herbal cannabis found in the EU appears to be grown locally. The Western Balkan region remains a source, albeit less so than in the past. Some cannabis products, including herbal cannabis, are now smuggled into the EU from North America. As for cannabis resin, Morocco is still the largest supplier to Europe, but there are signs that resin production within the EU may be on the rise. Latest data reveal a significant increase in the potency of cannabis products. The average potency of herbal cannabis in the EU rose by about 57 % between 2011 and 2021, while the average potency of cannabis resin increased by nearly 200 % in the same period, raising additional health concerns for users. Cannabis consumer products: increasingly potent and diverseWhile cannabis herb and resin still dominate the market, cannabis products in Europe are increasingly diverse, and include a range of natural, semi-synthetic and synthetic cannabinoids available in many different forms. These include oil, a variety of other high-potency extracts known as ‘concentrates’, vaping products and edibles. Increasingly, at the retail end of the market, commercial marketing strategies are being used both offline and online to advertise and sell products. Some of these products pose a high risk to users’ health due to their potency, often exceeding 90 % delta-9-THC. Others may contain dangerous synthetic cannabinoids. In addition, several semi-synthetic cannabinoids (e.g. delta-8-THC, HHC) have emerged in recent years, underlining the need for close monitoring. An attractive market for serious and organised crime The cannabis trade in Europe involves a broad range of networks, comprising both EU and non-EU criminals. These networks are highly cooperative, particularly at the wholesale level, sharing resources, building partnerships and providing services from production to distribution. Some criminal networks act as service providers to cannabis traffickers. Examples include networks that specialise in supplying boats to cannabis resin traffickers, while others provide aerial drones and helicopters. The methods used to smuggle cannabis have also diversified, highlighting how adaptable and opportunistic criminals can be. In addition to the traditional means of transportation, for example, unmanned semi-submersible vessels have recently been seized during investigations. This booming cannabis trade is not without its repercussions, being linked to violent clashes in several EU countries. Corruption related to the cannabis market also contributes to undermining the rule of law, security and governance. Environmental impact — the carbon footprint of cannabis cultivationToday's analysis describes the environmental impact of illicit cannabis production as 'considerable', due to significant water and energy use and chemical pollution. For example, an indoor cannabis cultivation site of 500 plants would potentially consume between 1.6 million and 2 million litres of water per year. Energy use accounts for the largest share of carbon dioxide emissions in the production process, particularly for cannabis grown indoors. Much of the electricity used to cultivate cannabis indoors in the EU is stolen. The carbon footprint of indoor cultivation is also striking, estimated to be 16 to 100 times higher than outdoor cultivation. Cannabis policy developments in a complex marketGlobally, and within some EU countries, there is an ongoing policy debate around the cannabis market, with a number of changes in the approaches taken to the drug’s regulation and control. Today, five EU Member States (Czechia, Germany, Luxembourg, Malta and the Netherlands) have introduced, or are planning to introduce, new approaches to regulate the supply of cannabis for recreational use. Switzerland also started trials of legal cannabis sales in early 2023. These changes highlight the need to invest in monitoring and evaluation to fully understand their impact on public health and safety (2). Addressing current threats and boosting preparednessToday’s findings draw on data and information from the EMCDDA’s drug monitoring system and from Europol’s operational information on serious and organised crime. Taking a threat assessment approach, the agencies highlight key areas for action at EU and Member State level to respond to developments in the illegal cannabis market. These include: improving the strategic intelligence picture; enhancing monitoring of potency and emerging health risks; investing in capacity-building; fostering technological innovation; and strengthening policy, public health and safety responses, including responding to environmental risks.Europol’s Executive Director Catherine De Bolle states: ‘Cocaine seizures might be grabbing the headlines, but trafficking of cannabis is just as important a threat. The cannabis trade yields a staggering EUR 11.4 billion annually, which is still a minimum estimated value of the market. In addition to the impact on public health, the substantial illegal proceeds criminal networks obtain from trafficking cannabis fuel dire consequences — criminals increasingly veer into extreme violence to further their criminal goals and use these proceeds to fund other criminal activities and infiltrate economies and societies. This is just one of the reasons why our fight against criminal networks involved in cannabis trafficking should go hand in hand with efforts to mitigate the associated societal harms'. EMCDDA Director Alexis Goosdeel says: 'Cannabis continues to divide public opinion and remains the subject of European and international debate. Today’s analysis looks at the elements needed to support evidence-based policymaking and preparedness in this complex domain, where the scope of cannabis policies is widening and where products are becoming increasingly potent and diverse. Our new findings come at a time when decision-makers must address a vast array of challenges posed by Europe's largest illicit drug market, from the heavy carbon footprint left by cannabis cultivation, to health harms, corruption and violence on our streets'. (1) This latest module of the EU Drug Markets: In-depth analysis from the two agencies is available in English at https://www.emcdda.europa.eu/publications/eu-drug-markets/cannabis_en and www.europol.europa.eu. This resource is the fourth comprehensive overview of illicit drug markets in the EU by the EMCDDA and Europol. Data relate to the period 2019–21. (2) Cannabis laws in Europe: questions and answers for policymaking.  

As a result of this investigation, six suspects were already arrested in Ukraine and four in the Czech Republic in April this year. Locations in Czechia (Domazlice, Rokycany and Plzen) and Ukraine (Dnipropetrovsk) were searched during the raids, including the homes of the accused, vehicles and call centres.Mobile phones, SIM cards and computer equipment were seized during the crackdown.The criminal group operated from call centres located in Ukraine and carried out vishing attacks, mainly targeting Czech victims. The fraudsters asked them to transfer funds from their ‘compromised’ bank accounts to ‘safe’ bank accounts controlled by the criminals.The suspects used  spoofed phone numbers and impersonated bank employees and police officers to gain the trust of their victims.European coordinationThe case was opened at Eurojust in November 2021 at the request of the Czech authorities. A joint investigation team (JIT) was set up between the Czech and Ukrainian authorities with the support of Eurojust in June 2022. The Agency hosted five coordination meetings to facilitate the communication and judicial cooperation between the authorities involved.Europol’s European Cybercrime Centre (EC3) has been supporting the case since December 2021 by facilitating the information exchange, hosting operational meetings and providing digital forensic support on the seized devices. Europol is currently carrying out analytical work to identify potential victims in other European countries.How to avoid being a victim of bank vishing callsVishing – or voice phishing – is the use of fraudulent phone calls to trick people into giving money or revealing personal information. Vishing frequently involves a criminal pretending to represent a trusted institution, company or government agency.Here is how to keep you and your finances safe from this type of phone scam: Beware of unsolicited telephone calls.Take the caller’s number and tell them that you will call them back.In order to verify their identity, look up the organisation’s phone number and contact them directly.Fraudsters can find your basic information online (e.g. social media). Do not assume a caller is genuine just because they have such details.Do not share your credit or debit card PIN number or your online banking password. Your bank will never ask for such details.Do not transfer money to another account on their request. Your bank will never ask you to do so.If you think a call is bogus, report it to your bank.For more tips on how to take control of your digital life, read our #CyberScams prevention guide.The following authorities took part in this investigation:Czechia: Metropolitan Public Prosecutor’s Office in Prague; Police of the Czech Republic, Regional Police Directorate of the Region Vysočina; Criminal Police and Investigation ServiceUkraine: Prosecutor General’s Office, Department for Combating Narcotic Crime together with the investigators of the Main Investigation Department (GSU) of the National Police 

The action day on 13 November 2023 led to:11 arrests (8 in Belgium, 2 in Greece and 1 in Sweden)  16 location searches (12 in Belgium and 4 in Greece) 2 travel agencies searched in Athens (included above)Seizure of phones, other electronic devices and digital evidence, two boxes with forged passports and almost EUR 200 000 in cashMigrants paid at least EUR 5 000 – EUR 6000 to reach Norway from GreeceThe criminal network, mainly composed of Egyptian and Syrian nationals, has been operating since January 2022, facilitating the illegal secondary movements of migrants from Greece to Northern Europe, mainly Norway, through Belgium. The suspects facilitated the transport of migrants via legitimate travel agencies, while also having connections with forgers to supply migrants with fake travel identification documents. The smugglers arranged for irregular migrants to travel from Athens to Brussels Airport Zaventem and Brussels South Gosselies. The migrants used genuine passports, presenting themselves as the real owners of the documents – what is called ‘look-alike’ document fraud. After the migrants arrived in Brussels, members of the criminal network provided the migrants with fake Romanian or Bulgarian travel documents and sometimes a short stay in the Brussels area. The migrants subsequently continued their journey directly or via Sweden to Norway. A member of the criminal network would accompany the group of migrants as far as Brussels and then return to Athens. The migrants paid at least EUR 5 000 - EUR 6 000 per person via the Hawala underground banking system, depending on the quality of the fake documents and additional smuggling services.In May 2023, Eurojust set up a joint investigation team between Belgium, Greece and Europol to facilitate the judicial cooperation. 

The suspects allegedly belong to a right-wing organisation that uses an online platform for terrorist-related activities, including the dissemination of violent extremist propaganda, the active recruitment of new members and for sharing manuals of 3D printed weapons. Some of the members of the organisation are believed to have written their own manifesto and to have access to weapons.Despite of the young age of some of the suspects, indicators showed that there was an increased risk that some of them would take action soon.The case was opened by Eurojust in July 2023 at the request of the Belgian authorities. Two coordination meetings were hosted by the Agency to facilitate judicial cooperation between the authorities of the countries involved the investigation. Eurojust supported the organisation of a coordination center on the action day on 9 November to enable real-time coordination of the actions.Europol’s European Counter Terrorism Centre (ECTC) has been supporting the case since July 2023 and brought together the investigators involved across Europe to establish a joint strategy and prepare for the final day of action. The information exchange facilitated by Europol was intense – over 350 SIENA messages were exchanged in the framework of this investigation. On the action day, a joint Operational Command Room was set up at Europol’s headquarters to coordinate the different actions taking place simultaneously across all the countries involved. In addition, Europol experts were deployed to Belgium, Italy, Lithuania and Croatia to facilitate the real-time information exchange between all the countries involved.Participating authorities:Belgium: Federal Public Prosecutor’s Office, Investigative Judge Court of 1st Instance Antwerp; Federal Judicial Police Antwerp. Croatia: County State Attorney's Office Zagreb; (Županijsko državno odvjetništvo u Zagrebu); Counter Terrorism Service of General Police DirectorateItaly: Public Prosecutor's Office at the Piedmont and Aosta Valley Juvenile Court and Public Prosecutor's Office at the Salerno Juvenile Court; Polizia di Stato (National Police)  Lithuania: Department for Investigation of Organized Crimes and Corruption of the Prosecutor General's Office; Lithuanian Criminal Police BureauThe Netherlands: National Public Prosecutors Office in Rotterdam; National PoliceRomania: National Police

The Memorandum was signed by APPF Director Pascal Schonard and Europol Executive Director Catherine De Bolle at the APPF premises at the European Parliament in Brussels, Belgium.This agreement aims to pave the way for Europol and the APPF to benefit from each other’s networks and to exchange strategic information falling under their respective mandates. The cooperation covers unlawful use of personal data, such as data theft, data leaks or deepfakes, which pose a serious challenge for European democracy if used in an electoral context.Under this new and strengthened framework, Europol and the APPF will cooperate each within their mandate, leveraging their respective expertise and networks to strengthen the resilience of EU democracies.In line with its awareness-raising activities, the APPF has recently joined the Europol Data Protection Expert Network, has participated in the Europol Cybercrime conference in October 2023, and will be joining the next European Union Cybercrime Task Force meeting, facilitated by Europol. Europol is also actively participating in the APPF’s tabletop exercises on European electoral integrity.Europol’s Executive Director, Catherine De Bolle, commented: The signature of this Memorandum of Understanding is a strong signal of our shared recognition of the need to strengthen the resilience of EU democracies against criminal threats. This is especially true in relation to cybercrime, as we face an evolving context of digital transformation of our democracies, associated disinformation campaigns, and rising extremism.The APPF Director, Pascal Schonard, commented: Europol as the European Union’s law enforcement agency, and the Authority as a guardian of democratic integrity at EU level, have complementary mandates to address increasingly sophisticated cyber-enabled threats to our democracies. Today, we are giving a future-proof basis to our continuing cooperation to counter unlawful interference in EU democracy.About EuropolHeadquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. The Agency also work with many non-EU partner countries and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.About the APPFThe Authority for European Political Parties and European Political Foundations is an independent body of the Union which has its seat in the European Parliament. It delivers registration and verification procedures in relation to European political parties and foundations. It controls the European political parties' and foundations' compliance with the applicable EU Regulation. In 2019, the legislator additionally mandated the Authority to impose sanctions against European political parties and foundations that would try to influence European elections by illegally abusing personal data, including by cyber-enabled means. 

Law enforcement identified a variety of criminal tactics during the operation, including several instances involving so-called 'cloned cars’. Criminals use the identity papers belonging to another vehicle, usually a destroyed car, of the same make, model and colour. The papers are presented to the authorities in the event of a border control procedure connected to the search for a stolen car. Such incidents present a growing problem for border officers, as the sophistication of forged vehicle identification numbers increases.  Europol’s role Europol supported Operation Mobile 6 by providing expertise during the preparation meeting as well as contributing to the database checks during the action phase. One example included Greek authorities requesting the Europol guest officer deployed to the border between Greece and Türkiye to crosscheck information about an arrested person. The suspect had been taken into custody while attempting to cross the border in a car reported stolen in Austria a few days before. With the information provided by the Europol guest officer, the vehicle was linked to a request from the Austrian authorities. The operation took place under the umbrella of EMPACT, the European Multidisciplinary Platform Against Criminal Threats, which tackles the most important threats posed by organised and serious international crime affecting the EU. EMPACT strengthens intelligence sharing and strategic and operational cooperation between national authorities, EU institutions and bodies, and international partners. Operation Mobile 6 falls under EMPACT’s organised property crime priority. Participating countries: EU Member States: Austria, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, France, Greece, Germany, Italy, Latvia, Lithuania, Netherlands, Poland, Portugal, Romania, Slovakia, Spain Non-EU countries: Albania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia Participating agencies/organisations: Europol Frontex INTERPOL * This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.

The agreement covers several important arrangements designed to ensure the security and success of the event. This includes increasing operational preparedness, developing special channels for swift cooperation during the event, and enhancing strategic foresight to anticipate and confront complex situations quickly and efficiently.  During the event, Europol will deploy a special team to assist with security arrangements at the Paris 2024 Olympic and Paralympic Games. Europol’s experts will work in close cooperation with the Central Section for Operational Police Cooperation (SCCOPOL) of the Department for International Operational Cooperation within the French Ministry of the Interior, as well as with experts from INTERPOL also specially deployed to step up security at the event.  Law enforcement cooperation is crucial for ensuring safety at major international events. Europol’s Operational Centre has provided support to a number of major international events, including the G20 Summit in Germany (2017), the G7 Summit in Taormina, Italy (2017), Amsterdam Gay Pride (2017), the 2020 UEFA European Football Championship, the FIFA World Cup 2022 and the Rugby World Cup 2023 in France. The Operational Centre manages the constant flow of data between Europol and its partners on a 24/7 basis, making it the gateway of all operational information and intelligence channelled through the Agency.     

Co-organised by Europol and the Basel Institute on Governance, the 7th Global Conference on Criminal Finances and Cryptocurrencies was hosted at Europol’s headquarters.  The two-day event (26-27 October), organised in a hybrid format, was attended by representatives from law enforcement, the public and private sectors, policy institutions and academia from more than 100 countries. The aim was to explore trends and strategies to tackle crimes involving cryptocurrencies.  The discussions focused on the key issues associated to combating the criminal misuse of these virtual assets, including:  Trends and threats in relation to the criminal use of cryptocurrencies, including evolving scam typologies. Growing adoption of cryptocurrencies by criminals, particularly in underground banking. Evolving legal frameworks around virtual assets in the European Union. Current institutional capacity to tackle money laundering, terrorist financing and other crimes involving cryptocurrencies. Public-private cooperation in cryptocurrency investigations and confiscation proceedings. Best practices in investigative and regulatory responses. On the second day of the conference – which was restricted to law enforcement only – national investigators and Europol shared their experiences in cryptocurrency investigations. Among the topics of discussion were methodologies for exploring criminal operations in dark markets and scams involving cryptocurrencies.  The conference participants converged around a set of recommendations to strengthen skillsets, improve knowledge, boost expertise and encourage best practices for crypto asset investigations and recovery. Peer learning forums such as this conference are key to achieving all of these challenges. These recommendations will be made available to the public in the weeks to come.  Jean-Philippe Lecouffe, Europol’s Deputy Executive Director Operations, said: Criminals aren't giving up on misusing cryptocurrencies anytime soon. Europol's Strategy 'Delivering Security in Partnership', adopted earlier this year, highlights the pivotal role that cryptocurrencies play in the financial schemes of criminals. Europol is convinced of the value of partnering with the Basel Institute on Governance to bring together law enforcement and private sector representatives from across the world to share their insights and to collaborate on how we respond to emerging technologies. Gretta Fenner, Managing Director of the Basel Institute on Governance, said: Our Basel AML Index shows that countries struggle to address money laundering and terrorist financing risks related to virtual assets. Events like this are crucial to build capacity in law enforcement and maximise the opportunities of public-private and cross-border collaboration. We are proud to partner with Europol to organise the conference for the seventh year. The annual conference is organised by the Working Group on Criminal Finances and Cryptocurrencies, established in 2016 and led by the Basel Institute on Governance and Europol.

The conference, themed "Tackling counterfeit goods posing a threat to health, safety, and the environment," delved deep into the critical issues surrounding intellectual property (IP) crime, with a particular focus on the role of advanced technology. Within a busy agenda of conference activities, a diverse group of experts and stakeholders from around the world came together for the discussion.  Key topics at the conference included: the role of women in fighting intellectual property crime; counterfeit goods posing a threat to health and safety; counterfeit goods posing a threat to the environment; the impact of advanced technology on intellectual property crime.   Catherine De Bolle, Executive Director of Europol, said: This conference and the recent renewal of the Service Level Agreement between Europol and EUIPO demonstrate our relentless commitment to combatting intellectual property crime. The financial and economic crimes afflicting the EU and its Member States amount to billions of euros in damages, and the criminals behind intellectual property crime infiltrate every aspect of the legal supply chain, threatening public health and safety. Initiatives like this conference are vital in uniting law enforcement experts and industry specialists to respond effectively to this substantial threat. This event emphasises the importance of international cooperation and the role of women in the fight against intellectual property crime, ensuring that gender equality remains a priority at every level. João Negrão, Executive Director of the European Union Intellectual Property Office (EUIPO), said:   Ensuring the rigorous enforcement of intellectual property law is a priority for our institution. Criminal infringement of intellectual property is not just an attack on individual innovation; it is an attack on our collective progress and security. In an increasingly interconnected world, safeguarding these rights is not merely a legal necessity but a moral imperative. Our commitment to this issue is unwavering, as we aim to protect creativity, drive economic growth, and secure the integrity of markets for both consumers and producers alike. Pedro Portugal Gaspar, Inspector General of the Portuguese Economic and Food Safety Authority, said: Ensuring economic safety in the Portuguese market is one of the main drives of ASAE’s action. To ensure the fulfilment of our mission, cooperation among law enforcement authorities, both national and international, and the private sector is crucial to ensure this fight against illegal activity. Intellectual property crime poses a global threat to the consumer’s health, enterprises, fair competition and competitiveness for which international cooperation between public and private sector is crucial. Events such as this Conference, in which ASAE has the pleasure to cohost, represent a decisive opportunity to bring us all closer in finding solutions and new tools to combat intellectual property crime.  José Barros Correia, National Director of the Portuguese Polícia de Segurança Pública, said:  Ensuring the rigorous enforcement of intellectual property laws is a priority for our institution. Criminal infringement of intellectual property is not just an attack on individual innovation; it is an attack on our collective progress and security. In an increasingly interconnected world, safeguarding these rights is not merely a legal necessity but a moral imperative. Our commitment to this issue is unwavering, as we aim to protect creativity, drive economic growth, and secure the integrity of markets for both consumers and producers alike.  Platform for sharing expertise in combatting IP crime  Since its inception in 2017, the Europol Intellectual Property Crime Conference has proven to be an invaluable platform for law enforcement authorities and the private sector. The conference provides an opportunity for participants to strengthen cooperation, share experiences, and identify new trends in intellectual property crimes. The conference embodies the spirit of the amended Europol Strategy, emphasising engagement with relevant private parties and recognising the crucial role played by the industry community in addressing intellectual property and counterfeiting issues. The fight against intellectual property crime is a top priority for Europol and a key focus in the EU's efforts to combat serious and organised crime. Recent data and analysis indicate a significant increase in intellectual property crimes, underlining the need for the close collaboration between law enforcement, EU institutions, third countries, and private sector entities. Close and continuous cooperation at EU level The recent renewal of the Service Level Agreement between Europol and EUIPO for the period of 2024-2027 demonstrates the close and continuous cooperation between the two organisations in the fight against intellectual property crime. Last year, the European Financial and Economic Crime Centre (EFECC), home to the Intellectual Property Crime Coordinated Coalition (IPC3), provided support to over 400 financial investigations. In September 2023, Europol unveiled its assessment of the threats originating from financial and economic crimes  at EU level. A section of this report is dedicated to intellectual property crime, drawing from a blend of operational insights and strategic intelligence contributed by law enforcement agencies to Europol. For more information about the 2023 Europol Intellectual Property Crime Conference, visit the event page.  

The action day on 17 October led to:78 arrests (58 in Italy and 20 in Spain)104 house searches (89 in Italy and 25 in Spain)Seizures of about 350kg of cannabis (327 of hashish and 33kg of marijuana), weapons, electronic equipment, documents and assets worth EUR 845 000The criminal network had already taken a hit in November 2022, when Europol supported a coordinated action leading to the arrest of 36 suspects of Albanian, Italian and Spanish nationality in Italy. Dutch and Spanish authorities arrested six other suspects through the execution of European Arrest Warrants. Between 2019 and 2021 alone, law enforcement authorities in Italy and Spain seized more than six tonnes of cannabis and hashish, as well as refills for cannabinoid-based electronic cigarettes. Criminal investigations were launched in 2019 in Italy and 2022 in Spain, while links were established as the investigations and international cooperation progressed. It was discovered that the suspects had enabled the logistics behind the trafficking operation through the use of the encrypted communication platforms Sky ECC and Encrochat. Moroccan nationals based in Spain arranged the drug deliveries to Spain and their subsequent shipment to different distributors in Italy. Various actors facilitated the overall supply and logistical process of the network: from cannabis collection, storage, transportation and distribution to payment and money laundering activities. The payments for the drug shipments were arranged via an informal banking system similar to hawala known as fei-ch’ien. This underground banking system is run mainly by Chinese nationals and allows the transferral of cash from one country to another through a network of trusted offices. The money is not physically sent, rather the offices compensate each other afterwards. The investigations uncovered two separate networks, one dealing with the drug trafficking and the other with the money laundering activities. Although different, the networks are linked through their leaders. The financial and asset recovery investigations are still ongoing. Europol’s supportEuropol facilitated the exchange of information and supported the coordination of the investigation. Europol also provided continuous analytical support, including with the production of in-depth operational analysis packages to help investigators advance both the drug trafficking and financial investigations. During the action day, Europol deployed an expert to Barcelona to cross-check operational information in real time in order to provide leads to investigators on the ground. Europol is further supporting the investigation by providing forensic expertise.  

Quantum computing and quantum technologies are knocking on law enforcement’s door with new opportunities, as well as new threats, that authorities need to anticipate. Europol published today the first-of-its-kind report, “The Second Quantum Revolution: The impact of quantum computing and quantum technologies on law enforcement”. The report provides a forward-looking assessment of the impact of quantum computing and quantum technologies on law enforcement. It also outlines potential applications of these new technologies. The report is a joint endeavour between the European Commission’s Joint Research Centre (JRC), Europol’s European Cybercrime Centre (EC3) and Europol’s Innovation Lab.  Europol's Executive Director Catherine De Bolle said:  Quantum computing and quantum technologies hold significant potential to strongly impact law enforcement. From the analysis of large and complex data sets, to improved forensics capabilities and new ways of secure communication, the future promises significant opportunities to strengthen the fight against crime. Nevertheless, malicious actors could equally try to profit from such advancements and we have to prepare accordingly. This new report offers  valuable insights to help law enforcement step into the second quantum revolution and start preparing for the future. Opportunities and threats in the post-quantum era  This report provides a forward-looking assessment of how quantum computing and quantum technologies might impact law enforcement activities across the globe. These emerging technologies have the potential to impact a remarkably wide range of applications used by law enforcement, but could be exploited by criminals.  A particularly pressing concern is the impact of quantum computing on cryptography. While quantum computing could offer advantages to law enforcement in the investigation of cold cases and improving password guessing, it also threatens to break the encryption we use to keep sensitive information safe today. In a concept known as ‘store now, decrypt later’, criminal actors could already accumulate encrypted information, such as stolen databases, protected files, or communications data; and hold onto them with a view to later decryption for nefarious purposes.  To counteract this, the transition to post-quantum cryptography is vital. It is imperative for law enforcement and data-driven organisations to audit and protect their systems against a threat that is not just a distant future concern, but an imminent issue that demands immediate attention and action today. Moreover, the report highlights how quantum technologies could improve machine learning and artificial intelligence, the establishment of highly secure communication channels, as well as enhance forensic capabilities. Five key recommendations for law enforcement:  Observe quantum trends: monitor relevant developments to detect emerging threats;  Build up knowledge and start experimenting to benefit from these developments in the future; Foster research and development projects engaging closely with scientific community to build a network of expertise; Assess the impact of quantum technologies on fundamental rights to ensure law enforcement uses these new technologies while protecting fundamental rights; Review your organisation’s transition plans to ensure critical systems are protected in the post-quantum era. About Europol’s European Cybercrime Centre  Europol set up the European Cybercrime Centre (EC3) in 2013 to strengthen the law enforcement response to cybercrime in the EU and thus to help protect European citizens, businesses and governments from online crime. The centre focusses on cybercrime committed by organised crime groups, which generate large profits (online fraud), seriously harm victims (online child sexual exploitation) or impact critical infrastructure and information systems in the EU, including cyber-attacks. Since its establishment, Europol’s EC3 has made a significant contribution to the fight against cybercrime: it has been involved in hundreds of high-profile operations and hundreds on-the-spot operational-support deployments resulting in hundreds of arrests.  About Europol’s Innovation Lab The Innovation Lab aims to identify, promote and develop concrete innovative solutions in support of the EU Member States’ operational work. This helps investigators and analysts to make the most of opportunities offered by new technologies to avoid the duplication of work, create synergies and pool resources. The activities of the Lab are directly linked to the strategic priorities as laid out in Europol Strategy 2020+, which states that Europol shall be at the forefront of law enforcement innovation and research. The work of the Europol Innovation Lab is organised around four pillars: managing projects to serve operational needs of the EU law enforcement community; monitoring technological developments that are relevant for law enforcement; maintaining networks of experts; being the secretariat of the EU Innovation Hub for Internal Security.  About The Joint Research Centre (JRC) The Joint Research Centre (JRC) of the European Commission plays a key role at multiple stages of the EU policy cycle by providing independent, evidence-based science and knowledge, supporting EU policies to positively impact society. The JRC works closely with other Commission departments, EU institutions and agencies, as well as with scientific partners and policy organisations in Europe and internationally, offering scientific expertise and competences from a wide range of scientific disciplines. 

This action, coordinated at international level by Europol and Eurojust, targeted the Ragnar Locker ransomware group. The group were responsible for numerous high-profile attacks against critical infrastructure across the world. In an action carried out between 16 and 20 October, searches were conducted in Czechia, Spain and Latvia. The “key target” of this malicious ransomware strain was arrested in Paris, France, on 16 October, and his home in Czechia was searched. Five suspects were interviewed in Spain and Latvia in the following days. At the end of the action week, the main perpetrator, suspected of being a developer of the Ragnar group, has been brought in front of the examining magistrates of the Paris Judicial Court. The ransomware’s infrastructure was also seized in the Netherlands, Germany and Sweden and the associated data leak website on Tor was taken down in Sweden.    This international sweep follows a complex investigation led by the French National Gendarmerie, together with law enforcement authorities from the Czechia, Germany, Italy, Japan, Latvia, the Netherlands, Spain, Sweden, Ukraine and the United States of America.  In the framework on this investigation, a first round of arrests were carried out in Ukraine in October 2021 with Europol’s support. What kind of malware is Ragnar Locker? Active since December 2019, Ragnar Locker is the name of a ransomware strain and of the criminal group which developed and operated it. This malicious actor made a name for itself by attacking critical infrastructure across the world, having most recently claimed the attacks against the Portuguese national carrier and a hospital in Israel.  This strain of ransomware targeted devices running Microsoft Windows operating systems and would typically exploit exposed services like Remote Desktop Protocol to gain access to the system.  The Ragnar Locker group was known to employ a double extortion tactic, demanding extortionate payments for decryption tools as well as for the non-release of the sensitive data stolen.  The threat level of Ragnar Locker was considered as high, given the group’s inclination to attack critical infrastructure.  Don’t call the cops  Ragnar Locker explicitly warned their victims against contacting law enforcement, threatening to publish all the stolen data of victimised organisations seeking help on its dark web ‘Wall of Shame’ leak site.  “All that the FBI/ransomware negotiators/investigators do is muck things up, so we’re going to publish your stuff if you call for help”, the Ragnar Locker ransomware gang announced on its hidden website.  Little did they know that law enforcement was closing in on them.  Back in October 2021, investigators from the French Gendarmerie and the US FBI, together with specialists from Europol and INTERPOL were deployed to Ukraine to conduct investigative measures with the Ukrainian National Police, leading to the arrest of two prominent Ragnar Locker operators.  The investigation continued ever since, leading to the arrests and disruption actions this week. Europol’s European Cybercrime Centre Europol supported the investigation from the onset, bringing together all the involved countries to establish a joint strategy. Its cybercrime specialists organised 15 coordination meetings and two week-long sprints to prepare for the latest actions, alongside providing analytical, malware, forensic and crypto-tracing support. A virtual command post was set up this week by Europol to ensure seamless coordination between all the authorities involved. Eurojust support: The case was opened by Eurojust in May 2021 at the request of the French authorities. Five coordination meetings were hosted by the Agency to facilitate judicial cooperation between the authorities of the countries that supported the investigation. Eurojust set up a coordination centre during the action week to enable rapid cooperation between the judicial authorities involved.   The Head of Europol’s European Cybercrime Centre, Edvardas Šileris, said: This investigation shows that once again international cooperation is the key to taking ransomware groups down. Prevention and security are improving, however ransomware operators continue to innovate and find new victims. Europol will play its role in supporting EU Member States as they target these groups, and each case is helping us improve our modes of investigation and our understanding of these groups. I hope this round of arrests sends a strong message to ransomware operators who think they can continue their attacks without consequence. Close cooperation between the involved law enforcement authorities was also supported by Europol’s Joint Cybercrime Action Taskforce (J-CAT), composed of cybercrime liaison officers posted to Europol’s headquarters. The following authorities took part in the investigation:  Czechia: National Counter-Terrorism, Extremism and Cybercrime Agency of Police of the Czech Republic France: National Cybercrime Centre of the French Gendarmerie (Gendarmerie Nationale – C3N) Germany: State Criminal Police Office Sachsen (Landeskriminalamt Sachsen), Federal Criminal Police Office (Bundeskriminalamt) Italy: State Police (Polizia di Stato), Postal and Communication Police (Polizia Postale e delle Comunicazioni) Japan: National Police Agency (NPA) Latvia: State Police (Latvijas Valsts Policija) Netherlands: Police of East Netherlands (Politie Oost-Nederland) Spain: Civil Guard (Guardia Civil) Sweden: Swedish Cybercrime Centre (SC3) Ukraine: Cyberpolice Department of the the National Police of Ukraine (Національна поліція України) United States: Atlanta Field Office of the Federal Bureau of Investigation The investigation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).   

The analysis, from the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) and the European Union Agency for Law Enforcement Cooperation (Europol), covers the supply chain from production and trafficking to distribution and use. It also details the processes, materials and criminal actors involved at different stages and levels of the market. Europe is a major global producer of amphetamine, alongside the Middle East. Amphetamine use is also concentrated in these two regions. In Europe, amphetamine is largely consumed as powders and paste, whereas, in the Middle East, it is mostly used as ‘captagon’ tablets. Around 10.3 million European adults (15–64 years) have used amphetamines in their lifetime, 2 million having used them in the last year.  Amphetamine production in Europe evolves as criminals innovate and adapt  Almost all of the amphetamine consumed in the EU is made domestically. Production is mainly concentrated in the Netherlands and Belgium, where it occurs typically in large-scale facilities using complex equipment. Production is based on methods that use an internationally restricted chemical (BMK), which is typically produced in Europe from non-restricted 'designer precursors' imported from China. European amphetamine producers are both adaptable and innovative. Traditional amphetamine production methods have been simplified over the years to use fewer chemicals and less equipment, while delivering a similar final product at higher profits. In some cases, the manufacturing of the consumer product is not completed in the laboratories where it is synthesised. Instead, the amphetamine is exported as base oil and converted into amphetamine sulfate in laboratories elsewhere. This raises concern over the spread of such 'conversion labs' to more EU countries. Between 2019 and 2021, 337 sites related to illicit amphetamine production were dismantled in the EU. The production of amphetamine on a large scale generates vast quantities of chemical waste that harms the environment, creating risks for human health and high costs for local municipalities. Will demand for captagon tablets in the Middle East lead to increased production in the EU? Only a small share of the amphetamine manufactured in the EU is used to produce captagon tablets, which are mainly trafficked to consumer markets in the Middle East. This occurs infrequently, mainly in the Netherlands, often on-demand. Drug-related EU criminal networks do not appear to be otherwise involved in the captagon trade and no significant use of captagon is reported by EU Member States. EU countries are mainly involved as transhipment points between captagon-producing countries outside the EU (Lebanon and Syria), and destination markets in and around the Arabian Peninsula (3). The analysis raises the question of whether demand for captagon tablets in these markets may present opportunities for EU-based drug producers to increase amphetamine production for export. A sophisticated business  Criminal networks involved in the illicit amphetamine trade are business-oriented, cooperative and adaptable, often using each other’s resources and infrastructure or participating in joint criminal ventures. Today’s analysis shows how logistical support has become a parallel business, with some criminal actors acting as service providers, specialising in providing the chemicals, equipment and expertise needed to set up and operate production facilities. Legal business structures are often misused to facilitate production, trafficking and distribution. Criminals also resort to violence and corruption when needed to meet their aims. Addressing current threats and boosting preparedness Today’s findings draw on data and information from the EMCDDA’s drug monitoring system and from Europol’s operational intelligence on serious and organised crime. Taking a threat assessment approach, the agencies highlight key areas for action at EU and Member State level. These include: improving the strategic intelligence picture; strengthening responses to reduce supply and enhance security; boosting international cooperation; investing in capacity-building; and, reinforcing policy, public health and safety responses. Europol’s Executive Director Catherine De Bolle states: The market for synthetic drugs runs into the billions of euros each year, and their production is getting more sophisticated. Distribution networks are getting smarter; and the drugs themselves, more harmful. Large amounts of toxic chemical waste generated by chemical synthesis have been released into nature, endangering public health and safety. Europol is constantly monitoring this pernicious threat and providing cutting-edge operational support to investigations in Member States.  EMCDDA Director Alexis Goosdeel says: Amphetamine is the most common synthetic stimulant drug in Europe today. While its market remains relatively stable, we should not underestimate the impact the drug has on the health and security of Europeans. Not only does it affect individuals, but it also impacts communities around and beyond production areas through environmental damage and public health consequences. Europe is a global producer of amphetamine, and for each kilogram of amphetamine produced, almost 40 kilograms of chemical waste can be generated. This in turn is dumped into our soil and water. To tackle these cross-border challenges, it is vital that Member States cooperate, share knowledge, and enhance preparedness.   

The action week resulted in: 38 arrests 43 suspected traffickers identified 20 new criminal investigations initiated 1 583 workers subjected to exploitation and labour violations identified (including 353 identified as possible victims of human trafficking) 687 employers committing labour violations identified 156 new inspections by labour authorities initiated 29 forged documents identified 27 653 persons checked 3 148 locations checked 17 231 documents checked 3 204 vehicles checked Similar criminal practices in various countries Behind the figures reported by the participating law enforcement and labour authorities are an equal number of persons affected by this ruthless exploitation. Workers in the agricultural sector, especially those in low-skilled and informal roles, face a substantial risk of exploitation, which is even higher for those working in seasonal jobs. Investigators across Europe have confirmed similar modi operandi in relation to trafficking in human beings and labour exploitation in agriculture. These range from violations of laws on minimum wages or working hours, mismatches between payments and the employees’ actual working hours, to the employment of minors and practices such as debt bondage or the withholding of identity or travel documents. Officials checked thousands of documents such as residence permits, as these are often forged, counterfeited or misused through the look-alike method. In addition to working illegally and thus outside the legal framework that protects them, workers often face deplorable housing and sanitary conditions as well. Fake job adverts lure workers into labour exploitation Europol offers a guide on how to spot fake job adverts. Fake job adverts are used by criminals to exploit vulnerable jobseekers. These deceptive schemes involve posting enticing job listings, often from fake companies, or misrepresenting working conditions to attract victims. The targets are usually people in precarious economic situations seeking to improve their financial situation, with many advertisements offering opportunities abroad to further isolate victims. Read the prevention guide here This scam typically unfolds in three steps: the publication of attractive job adverts on social media and recruitment websites, followed by contact with applicants via messaging apps, and finally, the arrival of victims at workplaces with poor conditions that do not even remotely resemble what was promised. To protect themselves, jobseekers are advised to conduct background checks on the company and recruiters, scrutinise job details for unrealistic claims, and look out for grammar and spelling errors in the adverts. EURES (European Employment Services) offers a network of 900 advisers that can give information, help and assistance to cross-border jobseekers through personal contacts, and has an official database of job offers. Some examples of exploitative working conditions uncovered in this recent operation include Bulgarian workers housed under appalling sanitary conditions, Thai nationals recruited to pick berries being forced to work day and night, and Polish slaughterhouse workers receiving payments in cash without being covered by collective bargaining agreements. In one case in the forestry sector, workers from Belarus without work permits had to use dangerous machinery without proper training and had no access to toilets or indoor areas to rest and eat. Cross-border cases were jointly inspected by labour authorities, coordinated and supported by the European Labour Authority: Bulgarian and Romanian officials participated in the inspections in Belgium to help to check the working and living conditions of workers from Bulgaria and Romania active in the fruit sector. Simultaneous inspections were also carried out jointly by Belgian and Portuguese labour authorities to tackle illegal activities in the meat industry both in Belgium and Portugal. The aim of the operation and Europol’s role The recurring operation aims to provide an overview of the current criminal landscape in labour exploitation and to emphasise the importance of a prompt and accurate flow of information at the earliest stage of victim identification. As with the EMPACT Joint Action Days on trafficking in human beings for the purpose of labour exploitation, this operation goes beyond the human trafficking aspects and allows the European Labour Authority to pursue violations of labour law and workers’ rights.  Europol coordinated the action days and facilitated the information exchange between the participating countries. Europol provided analytical support, round-the-clock operational support and facilitated the real-time exchange of communication between the participating authorities. Participating countries: France (action leader), Spain (co-leader), Italy (co-leader), Romania (co-leader), Belgium, Bulgaria, Cyprus, Greece, Ireland, Latvia, Netherlands, Portugal, Sweden, Albania, Moldova, United Kingdom, Ukraine Participating agencies: Europol, European Labour Authority (ELA), Eurojust, Frontex

Human trafficking organisations have become increasingly digital, with the internet becoming an important enabler of criminal activities in this area. The 2023 Hackathon focused on identifying online platforms and social media hubs used to recruit victims for sexual and labour exploitation. Human traffickers use different methods to lure vulnerable individuals and exploit them for profit. For example, they are increasingly using social media and online platforms to recruit victims for sexual and labour exploitation, as well as other forms of servitude. They use several approaches to recruit their victims. One of them is deception: traffickers deceive victims with false promises of a better life, education, employment or marriage. Another is the fake offer of well-paid jobs abroad, which turns out to be highly exploitative employment with very low pay or none at all. Traffickers may also offer immigration services to people who want to migrate and then take advantage of their vulnerability and exploit them once they are in a foreign country. The 2023 Hackathon led to:  85 people/usernames checked  371 platforms checked (including social media and dating platforms, web forums, marketplaces and online applications)  325 communication devices (including phone numbers, mobile apps, email addresses and fax numbers) 26 online platforms suspected of human trafficking checked 5 online platforms identified as engaged in human trafficking checked 10 online platforms linked to child sexual abuse online checked Focus on recruitment of Ukrainian and Chinese victims The high vulnerability of Ukrainian refugees and the increasingly frequent signs of sexual, labour and other forms of exploitation of Chinese nationals have led the investigators to focus on these at-risk groups in particular. During the 2023 Hackathon, participants examined how to gather operational intelligence at the EU level on websites and social media platforms where the recruitment of Ukrainian refugees and Chinese immigrants in the EU is suspected to be taking place. The open source intelligence investigative activities revealed that traffickers are indeed using the most popular social media platforms, but also dating apps and review forums. Recruitment attempts often take place in community groups on social media as well, which are created based on the geographical provenance of those seeking services, the destination country and the service required. Europol supported the coordination of the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed two experts to the coordination centre to facilitate the information exchange in real time and cross-check operational information against Europol’s databases. This provided the participating officers from the national law enforcement authorities with further investigative leads.   

The actions led to: 4 house searches in Serbia 5 arrests (Serbian nationals), including the leader of the criminal group 8 victims identified (6 minors between 5 and 11 years old and two adults) Seizures include large amounts of cash and digital equipment, including over six mobile phones and financial documents. Victims aged between 5 and 17 The investigation targeted a family-based criminal organisation involved in the trafficking of minors aged between 5 and 17 years and young women. The individuals are suspected of having trafficked their own biological children and other children with whom they have family ties. The suspects allegedly forced the minors to beg and commit crimes in Serbia, Austria, France and Germany. Investigative leads indicate that the suspects exploited the minors and also sold victims to other perpetrators located outside of Serbia. Members of the criminal group also used the ‘lover boy’ modus operandi to lure victims into romantic relationships, after which they exploited them through forced begging and forced criminality. They also forced their victims to beg and commit criminal activities in Serbia and in other countries, where the suspects had established criminal connections. Most of the victims are of Serbian nationality, with the exception of one Ukrainian national, who was forced to beg by members of the criminal group. The suspects laundered the criminal proceeds by purchasing luxury goods and maintaining a high standard of living. The underage victims have been taken into child protection services by the relevant Serbian authorities including the specialised Centre for the Protection of Victims of Human Trafficking. Europol's role Europol supported the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed one expert to Serbia to cross-check operational information in real time and support investigators on the ground.      

During the operation, law enforcement authorities identified criminal trends in plant protection products emerging on the EU black market. These trends include the sale of counterfeits, banned products and unregulated imports – both online and offline. The participating authorities carried out inspections at land and sea borders, inland marketplaces, parcel service providers and online marketplaces. Cases of abuse in the trade of illegal pesticides range from trafficking counterfeit or mislabelled products to the irregular import of banned substances. While Asia and South Asia remain the primary source regions for illegal pesticides, much of the production and finishing takes place in the EU. Devastating effects on ecosystems The pesticide industry is highly regulated, and pesticides are among the most regulated products in the world. Unregulated substances can be extremely dangerous for the environment and human health. The use of cheaper, illegal and substandard products has led to the devastation of fields and other ecosystems, such as bee populations. Furthermore, counterfeit and illegal pesticides negatively impact the EU economy and the reputation of legitimate stakeholders across the entire agri-food chain. The collaboration between public authorities and private sector stakeholders will continue to build on the joint successes achieved to date. Catherine De Bolle, Executive Director of Europol, said: Operation Silver Axe, through its relentless efforts, has not only seized almost 7 000 tonnes of illegal and counterfeit pesticides but also underscores the high cost of unauthorised plant protection products. These clandestine chemicals may come with a low price tag, but they take a heavy toll on the environment, public health, agricultural livelihoods and even the well-being of our vital bee colonies. By removing these unregulated threats from the market, we are contributing to a safer and healthier future for EU citizens, exemplifying the power of collaboration in protecting what matters most. João Negrão, Executive Director of the European Union Intellectual Property Office (EUIPO) said:  The damage caused by illegal pesticides is appalling and clearly requires close cooperation between all parties. Operation Silver Axe has proved once again how effective and necessary coordinated action is in the fight against this illicit trade, not only to prevent economic and job losses in the legitimate industry, but above all to protect our citizens and the environment. Ville Itälä, Director-General of the European Anti-Fraud Office (OLAF) said: Pesticide smuggling is a threat to European consumers and to the environment. It is important that products such as pesticides remain strictly regulated and that we remain vigilant. Operation Silver Axe pooled expertise and resources from OLAF, Europol and many other partners to protect our citizens, our farmers and our environment.  Olivier de Matos, Director General of CropLife Europe said:   Counterfeit and illegal pesticides undermine the goals of the Green Deal and the Farm to Fork Strategy. They affect the EU economy and the reputation of legitimate stakeholders across the entire agri-food chain. Increasing stakeholder cooperation will continue to build on the successes achieved to date.  Total of 6 961 tonnes of illegal pesticides seized since Silver Axe I Operation Silver Axe was initially developed to respond in a coordinated way to the dangerous trafficking of illegal pesticides. To date, the efforts of the public and private sectors have led to the seizure of 6 961 tonnes of illegal pesticides during the past eight Silver Axe operations.  Europol coordinated the operation, facilitated the information exchange, and provided operational and strategic analytical support. Furthermore, Europol specialists with a mobile office and forensic experts provided support to national law enforcement agencies. Participating EU Member States: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden Participating non-EU countries: Australia, Brazil, Ukraine, United Kingdom, United States of America Participating EU bodies: Europol, European Union Intellectual Property Office (EUIPO), European Anti-Fraud Office (OLAF), European Commission’s Directorate-General for Health and Food Safety (DG SANTE)  Participating private industry partners: CropLife Europe, CropLife International.  

Following the COVID-19 crisis, Europol highlighted the risks of fraud related to the recycling of spoiled or expired food to reduce production costs. This possible development was taken under consideration when planning the operation activities in the framework of the OPSON 2023 operation. National authorities involved in the operation performed checks of the food supply chain, while detecting a number of irregularities. During this year’s operation OPSON, the relatively new trend of relabelling expired food has been detected on an unprecedented scale. In the majority of cases, criminal organisations approach waste disposal companies and purchase food that should have been destroyed. They then erase the labels’ expiration dates and print new ones to replace them. The quality of the food is poor, but the food also presents dangerous health hazards, as occurred in a case involving canned fish.  Seizures reported to Europol: 8 000 tonnes of illicit products seized  6.5 million litres of mostly alcoholic beverages 400 inspections 143 arrest warrants issued 168 search warrants executed 119 individuals reported to judicial authorities 6 criminal networks disrupted Main illicit products seized: (in order of quantity) Alcoholic beverages Cereals, grains and derived products Fruits/vegetables/legumes Sweet and sugary products Meat and meat products Seafood  Dairy products Food supplements/additives Trafficking spoiled food across the EU The exchange of information through Europol led to the detection of a company recycling spoiled or expired food in France, Germany, Italy, Lithuania and Spain. The criminal organisation, led by a Lithuanian citizen, was conducting illegal operations across these four countries, including the illegal relabelling and trafficking of spoiled and expired food. The first phase of the operational activities in Italy and Lithuania led to 27 arrests. The investigation, led by the Lithuanian Criminal Police Bureau (Lietuvos kriminalinės policijos biuras), led to 24 arrests, while the parallel case in Italy led to the arrests of three other individuals. The total seizures following the operational activities amounts to more than 1.5 million packages.      Rotten meat and fish off the plate Two investigations led by the Spanish Civil Guard (Guardia Civil), one conducted in Seville and one in Zaragoza, targeted fraud involving meat products. In the first investigation, two individuals were charged with crimes against public health, forgery and fraud for trafficking ham without traceability and with a manipulated expiry date. The operation led to the seizure of 48 896 kg and 3 000 pieces of ham and sausage. The second investigation targeted a criminal network trafficking expired meats, fish and seafood. The suspects falsified the labelling and trafficking of the food without going through the mandatory regulatory process. The results of the operational activities include 8 arrests, 48 individuals under investigation and the identification, seizure and destruction of more than 25 tonnes of food products. Sweet sugar wine  An operation led by the Spanish Civil Gard (Guardia Civil) in Albacete uncovered a sugar fraud perpetrated by three individuals and involving two companies. The suspects exported products from invert sugar, which they presented as grape derivatives and concentrated grape juice. This manoeuvre allowed them to double and in some cases triple the sale price and resulting profits. The main destinations of the exports were countries outside the European Union, mainly South Africa. The operational activities led to the seizure of two tanks containing 1.08 tonnes of invert sugar with a retail value of EUR 1.3 million. Protected food names The misuse of protected food names was also the focus of the operational activities. In the United Kingdom, authorities performed checks on protected food name products in food service establishments, such as restaurants, and in individual retailers. The checks identified cases of non-compliance with products, such as feta, Parmigiano Reggiano and Grana Padano cheeses, and meats such as Prosciutto di Parma and products of UK origin such as Welsh beef, Cornish pasties and watercress. The checks identified mislabelling, the temporary unavailability of a specified ingredient in restaurants, but also a lack of understanding of the regulations governing the use of protected food names. Europol’s Intellectual Property Crime Coordinated Coalition is co-funded by EUIPO to combat intellectual property crime. Participating countries: Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Ireland, Italy, Lithuania, Moldova, Netherlands, Norway, Portugal, Romania, Spain, Switzerland, the United Kingdom. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The investigation, carried out in the framework of Europol’s Operational Taskforce (OTF) ‘Balkan Cartel’, was a collaborative effort between law enforcement authorities on either side of the Atlantic Ocean. Over the last year and a half, the involved authorities worked tirelessly together to gather intelligence and coordinate the operational activities. The targeted criminal group, known for its elaborate network spanning both sides of the Atlantic, was involved in the large-scale trafficking of cocaine from South America to various European destinations.  In the early hours of 5 October, a series of raids were carried out at different locations in Brazil (São Paulo, Ceará, Paraná, Rio Grande do Norte et Santa Catarina). As a result, 16 suspects were arrested, several of whom had ties to the ‘Primeiro Comando da Capital’ criminal organisation. The Serbian ringleader was one of the most important targets within Europol’s OTF Balkan Cartel due to his role in organising numerous drug shipments between continents.  The Brazilian investigators were able to link this criminal gang to two recent cocaine seizures: one of 5.7 tonnes of cocaine on board a fishing vessel in Cape Verde in April 2022, and a second one of 1.3 tonnes of cocaine on board a fishing vessel in Fortaleza, Brazil, in August 2022. A total of 12 suspects – 10 Brazilian nationals and 2 Montenegrin nationals – were arrested on these two occasions.  This series of arrests in Brazil marks a significant victory in the fight against the Western Balkan criminal groups operating around the globe. The investigation was substantially developed within Europol’s OTF Balkan Cartel, with Europol providing continuous intelligence development and analysis to support the field investigators in Brazil and the agencies involved in the operation.  The evidence gathered during the raids will now be analysed to identify new investigative leads which can be further developed within the Operational Taskforce, which comprises law enforcement authorities from 11 countries.  The following authorities took part in the investigation: •    Brazil: Federal Police (Polícia Federal), Brazilian Marine (Marinha do Brasil) •    Cape Verde: National Police (Policia Nacional) •    Serbia: Criminal Police Directorate (Управа криминалистичке полиције) •    United Kingdom: National Crime Agency (NCA) •    United States: US Drug Enforcement Administration (US DEA) •    Europol •    MAOC-N

For the past months, officers from the Bulgarian General Directorate Combating Organised Crime have been investigating the network to establish the role the suspects have played in the migrant smuggling activities. The investigative activities established that this logistical migrant smuggling cell facilitated the transportation by car of irregular migrant from the eastern part of Bulgaria (the cities of Burgas and Yambol) to Sofia and later to the Bulgarian border with Serbia. The transportation of the migrants was arranged in two stages: first to Sofia and later to the border with Serbia. In Sofia, the migrants were moved to remote locations to avoid police attention. The migrants were charged between EUR 1 000 and EUR 3 000 per person to reach the Serbian border. The smugglers transported between 10 and 30 migrants at a time. The gathered operational information suggests that this logistical cell is part of a larger criminal network smuggling migrants from Türkiye to Western Europe through Bulgaria and Serbia. The action day on 4 October led to: 5 arrests (Bulgarian nationals) 7 house searches Seizures, including car rental documents and contracts for purchases and sales of cars, other documents related to the criminal activities, electronic equipment and EUR 10 000 in cash Joint efforts to fight smuggling networks active across the Balkan route Since mid-2022, Bulgarian authorities have reported a sharp increase in migrant smuggling activities on their southern border and an increase in violence perpetrated by members of the involved criminal networks against migrants and police officers. Following several deadly incidents involving numerous deaths of police officers and migrants, Bulgarian authorities have further increased their efforts to tackle migrant smuggling networks active using Bulgaria as a transit country.  At the end of last year, Europol increased its support for Bulgarian authorities with the deployment of a dedicated analyst. On the action day on 4 October, Europol deployed an expert to Sofia to provide real-time analytical support and cross-check operational information against Europol’s databases. This operation follows the recent establishment of a Europol-coordinated Regional Operational Task Force, based in Sofia, which is focusing on criminal networks smuggling migrants across Bulgaria towards Western Europe.    

The JIT was set up on 25 March 2022 by Lithuania, Poland and Ukraine with Eurojust's support. On 31 May 2022, Estonia, Latvia and Slovakia became members, followed by Romania on 13 October 2022. On 3 March 2023, the JIT’s seven national authorities signed a Memorandum of Understanding with the United States Department of Justice. Eurojust, the Office of the Prosecutor of the International Criminal Court (ICC) and now Europol are participants in the JIT. In line with its mandate, Europol will provide analytical and forensic support to the members of the JIT. In addition, Europol will support the collection and analysis of data legally obtained from open sources such as social media, broadcast TV or radio, what is known as Open Source Intelligence (OSINT). Europol will also make available their expertise and experience in the field of war crimes, crimes against humanity and other international crimes via the Analytical Project on Core International Crimes (AP CIC). Eurojust provides legal, logistical, financial and analytical support to the JIT. Since March 2022, the Agency has hosted 19 coordination meetings of the JIT and other national authorities who are investigating alleged core international crimes committed in Ukraine. For more information on all the actions taken by Europol since the outbreak of the war in Ukraine, please consult our dedicated webpage. 

TikTok regularly publishes content removal statistics for violent extremism content in its quarterly transparency reports. The latest report shows that TikTok proactively removed 95% of violent extremism content. As part of the joint exercise, some 2 145 pieces of content were assessed and flagged to TikTok for voluntary review against their terms of service. Among the referred content were items linked to jihadism and violent right-wing extremism and terrorism, such as videos and memes.  The action was put in motion by Spain and the EU IRU, in cooperation with law enforcement authorities from Czechia, Denmark, France, Germany, Hungary, Ireland, Malta, Portugal, Sweden and the United Kingdom.  This Referral Action Day is part of an ongoing public-private partnership between TikTok, law enforcement agencies and Europol that aims to address terrorists' abuse of the internet, prevent online radicalisation and safeguard fundamental rights. Europol has conducted similar exercises with other platforms.

Co-hosted by Europol and the Spanish Presidency of the Council of the EU, the two-day conference (26-27 September) brought together 385 high-level representatives from 44 countries to discuss how our rapidly-evolving world is creating new threats, opportunities and challenges for law enforcement.   The European Police Chiefs Convention, now in its 13th edition, is the leading platform for international police cooperation, allowing senior police officials from across the world to meet each other and discuss key matters of operational relevance in bilateral meetings and plenary sessions.  As in previous years, a meeting of the Directors General of Customs Authorities took place in the framework of the EPCC to strengthen the cooperation between law enforcement and custom authorities.  The changing operational context of policing Opening the EPCC, Europol’s Executive Director Catherine De Bolle said: There are big challenges for law enforcement ahead. We are facing today a world of multiple crises in the midst of which organised crime systemically reinvents itself. The criminal landscape is becoming more sophisticated, more transnational and more complex for investigators. We’re on the brink of what we could call a global crime warming. Alongside the geopolitical volatility of the recent years, the digital acceleration of our society is shifting the very ground below law enforcement, producing new operational realities. Executive Director De Bolle added: For law enforcement agencies, coping with this continuous and swift digital transformation will require a quantum leap if we are to provide for effective future policing. We will have to prioritise and re-assess where law enforcement can deliver, where to outsource and where private sector solutions may be preferable. Considerations for future preparedness  In preparation for the plenary discussions at the EPCC, four online workshops were organised with all the European Chiefs of Police in the weeks leading up to the event, bringing together diverse national perspectives and expertise to shape a collective response.  The discussions focused on the following pressing issues: Crime in the Digital Age: the evolution of illegal markets on the dark web and law enforcement’s ability to deal with online criminal trade; Policing in Partnership: the Digital Services Act, data retention and access to data and public private partnerships in prevention, investigation and takedowns; Illegal migration challenges for the Schengen area: Existing tools and gaps at the different stages to prevent and investigate criminal facilitation, criminal connection to secondary movements in the EU and EU Policy framework for security and migration; Destabilising our Society – the Organised Crime Factor: Key elements to disrupt high-risk criminal networks, national instruments to detect and target groups and networks and avenues for a coordinated response.  The outcomes of these four workshops were presented during the EPCC, with Europol and the Spanish Presidency of the Council of the EU concluding that:  Police chiefs expressed profound concern about the threats posed by organised crime. Citizens and victims of the increasingly violent methods that criminals apply must be protected. The international nature of organised crime requires an even stronger European and global cooperation to increase the effectiveness of law enforcement responses.  It is imperative to pursue partnerships with countries and regions that have a connection to crime that impacts the EU to enhance the efficacy of prevention, investigation, and disruption of crimes. Traditional law enforcement approaches must be combined, in partnership with non-law enforcement partners. The numerous advantages of enhancing collaboration with private sector partners are encouraged in the interest of enhancing efficiency. Celebrating innovation within law enforcement As with recent editions of the EPCC, Europol chose to recognise the most innovative projects within law enforcement with its 2023 Europol Excellence Awards in Innovation. On the margins of the EPCC, Europol announced the winners of this year’s awards. The Dutch Police (Politie), the French Gendarmerie (Gendarmerie Nationale) and the Estonian Police (Eesti Politsei) were recognised for their achievements in three categories: the most innovative initiative in ethics, diversity and inclusion; the most innovative operation and the most innovative technical tool. Read more about the 2023 Europol Excellence Awards in Innovation here.  

In the third edition of these prestigious awards, the Dutch Police, the French National Gendarmerie and the Estonian Police were recognised for their achievements in three categories: Innovation initiative in ethics, diversity and inclusion; Innovative operation and Innovative Technical Solution.  The winners were carefully selected by a panel composed of the European Commissioner for Home Affairs Ylva Johansson, the Police Chiefs of Spain, Belgium and Hungary, and Europol’s Executive Director Catherine De Bolle.    The Europol Excellence Awards in Innovation highlight how effective modern day law enforcement requires partnership and collaboration, whether in teams of officers, between forces, in multi-agency operations or through wider public sector involvement. The Awards also recognise that accomplishments arise from a diverse blend of innovative, committed and well-trained personnel, serving, engaging and protecting the public while using technology efficiently and effectively. Europol received this year 69 nominations from 18 countries. Meet the 2023 winners  Category 1: Innovative initiative in Ethics, Diversity and Inclusion This award went to the Dutch National Police (Politie) for its use of virtual reality and deepfakes to assess and discuss implicit bias in law enforcement. Implicit bias refers to the unconscious attitudes and stereotypes that can affect behaviour and decisions. It can manifest itself through ethnic profiling and the unequal treatment of certain groups of people. The Dutch Police have developed a virtual reality simulation which allows its officers to experience and reflect on simulations of real-world scenarios that may elicit bias. Category 2: Innovative Operation This award went to the French National Gendarmerie (Gendarmerie Nationale) for its Operation CRYPTOSTORM which took down the Hong Kong-based cryptocurrency exchange platform Bitzlato. This platform facilitated the laundering of over EUR 2.1 billion in criminal proceeds into Russian roubles. As a result of this operation, the digital infrastructure of the service was taken down, and 8 suspects were arrested in Europe and the United States of America. The innovative approach lies in the investigative approach, which saw law enforcement officers extract live data from the platform’s servers so as to not alert the suspects. This data was then used to identify criminal transactions which totalled 7 000 hits on Europol’s databases, triggering numerous investigations worldwide.  Category 3: Innovative Technical Solution This award went to the Estonian Police and Border Guard Board (Politsei- ja Piirivalveamet) for the development and implementation of the Drug Hunter Narcotic Analyzer. Through leveraging advanced technologies, ensuring portability and addressing regulatory considerations, this tool has the potential to revolutionise drug testing practices and improve public safety.  Innovation at Europol  Innovation is at the heart of modern policing, and Europol is striving to ensure that the European law enforcement community benefits from the most innovative technologies and tools to keep European citizens safe. Europol’s Innovation Lab aims to identify, promote and develop innovative concrete solutions supporting EU Member States’ operational work.  The Innovation Lab has set up the Europol Tool Repository (ETR), a secure online platform to share non-commercial, cost-free software developed by law enforcement  and research and technology organisations. These are shared under licence with Europol for distribution to other law enforcement authorities. Around 30 tools are currently available to all national police forces on ETR. These tools have already supported several operations across Europe.  Find out more about the work of Europol’s Innovation Lab.

Europol has supported the Spanish National Police (Policía Nacional) in 29 investigations, co-funded by EU financial mechanism. The operations, in line with EU priorities against serious and organised crime, targeted a number of criminal networks involved in drug trafficking, money laundering, fraud and corruption, among other crimes.  The 29 criminal investigations, led by Spain and involving other EU Member States and non-EU countries, have led to the arrests of 197 suspected members of criminal organisations of 34 nationalities. As many as 33 fugitives (detected in cooperation with the European network ENFAST) and 6 high-ranked members of criminal networks were among the arrested individuals. The multiple action days led to 114 house searches and many seizures totalling at: almost 5 tonnes of cocaine, over 3 tonnes of cannabis, 1.7 tonnes of heroin, 53 kilograms of synthetic drugs, 28 firearms, 57 vehicles, over EUR 4 million in cash, properties with an estimated value of about EUR 12 million, and close to EUR 10 million in frozen bank accounts. The investigations, co-funded by EU financial mechanism and supported by Europol, targeted criminal networks posing a serious threat to the safety and security of citizens across all EU Member States. The operations specifically targeted large criminal networks that represent a serious threat to EU security, such as those that use corruption and violence (often with firearms) and have the capacity to import large amounts of drugs. Europol facilitated the exchange of information between police agencies and provided operational coordination and analytical support, including in the field during action days. Funding through EU financial mechanisms Officers from the Spanish National Police, supported by Europol, carried out these joint operations in partnership with other EU Member States and non-EU countries, and in line with the EU Security Union Strategy. Within the focus of the EU Security Union Strategy are four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime and a strong European security ecosystem. To reach these goals, EU agencies and dedicated EU findings support EU Member States to tackle significant criminal threats through coordinated operational actions targeting criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combating criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.  Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The Spanish National Police (Policía Nacional), supported by Europol, dismantled a criminal network involved in drug trafficking and laundering large sums of criminal profits. The investigation was initiated in 2021 based on a Europol intelligence report, which led to the identification of a drug trafficking organisation. The criminal group was led by Albanian nationals and was active in the production and trafficking of marijuana, but also organised large-scale money laundering activities for drug trafficking organisations. They used the so-called hawala system of underground banking, while working closely with Chinese nationals.  Law enforcement actions on 17 July 2023 led to: -    27 arrests throughout Spain in Alicante, Barcelona, Madrid, Malaga, Seville and Valencia; -    Seizures of luxury watches and jewellery valued at more than EUR 400 000; -    Seizures of high-end cars, phones, encrypted mobile phones and EUR 615 000 in cash.  EUR 65 million in money laundering turnover Investigators estimate that the criminal network laundered over EUR 65 million from drug trafficking activities in under one year, between May 2020 and March 2021 alone. The Chinese nationals played a major role in these criminal activities by laundering high quantities of criminal assets through legal businesses. These large sums of money would first go through these legal structures and were then compensated elsewhere. Finally, the criminal assets would reach the country of origin and were then invested there.  The “hawaladars”, of Albanian origin, operated as an illegal banking entity, carried out the transfers and concealed large sums of money from the sale of drugs. This served for the financing of new criminal operations. Two Albanian nationals headed the criminal network, one was the leader while the other took the role of lieutenant and accountant. Two Chinese nationals worked for them as coordinators by managing a large portfolio of numerous Asian establishments spread throughout Spain, which serviced money laundering schemes for drug trafficking profits.  Europol’s role Europol facilitated the exchange of information and provided analytical support. During the action day, Europol deployed two experts to Spain to cross-check operational information in real time and support investigators on the ground with technical and asset-recovery expertise.   Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Drugs and other illegal commodities were sold in large quantities on this Finnish-language platform which had been operating on the Onion Router (Tor) network since May 2022.  This successful action by the Finnish Customs was supported, among others, by the German Federal Criminal Office (Bundeskriminalamt) and the Lithuanian Criminal Police Bureau (Lietuvos kriminalinės policijos biuras). Europol’s European Cybercrime Centre coordinated the international activity and provided operational support and technical expertise.  The investigation is still ongoing as law enforcement worldwide work together to identify the sellers and users on the platform. This successful takedown happened just days ahead of the annual Dark Web Conference which will take place at Europol’s headquarters between 4-5 October. This event, restricted to law enforcement, will bring together over 180 investigators from across the world to discuss the latest criminal trends and developments on the dark web. 

Check against delivery Dear Director General, Dear colleagues and friends, Buenas tardes. It is a great pleasure for me to be here this afternoon. I am very glad for this speaking invitation at the eleventh conference of Europol's Data Protection Experts Network. I am a regular visitor to Madrid and to Spain, but I never cease to enjoy the particular atmosphere of Madrid, a vibrant city full of life and wonderful people. I would like to thank the Spanish Ministry of Interior, the Policía Nacional and the Guardia Civil for hosting us so generously, in the context of the Spanish Presidency of the European Union. Hospitality is a distinctive feature of this city and of Spain. So, thank you very much. I would also like to thank our partners from the Academy of European Law (ERA) for co-organising this event. The EDEN conference has established itself as an important forum to debate Data Protection and Law Enforcement. It is great to see so many of you today. Your input means a lot to us and we are honoured to have so many distinguished experts here on stage and in the audience. The title of the conference and of the different panels bode well for an entertaining discussion: ‘whisperers of contrast’, ‘walking dead’, ‘dungeons and dragons’... But, letting aside Netflix series and board games, I would like to make a few reflections on the very serious world of law enforcement in connection to data protection. After all, policing is all too often a life and death business; a very serious business. As I have said many times, I do not see data protection and law enforcement as a zero-sum game. There is no privacy without respect for security; there is no liberty without respect for privacy; security requires both certain liberties and privacy. It is not a matter of choice: we need both. So, if I were a painter rather than a whisperer, I would focus on the harmony of my colours, rather than on their contrast. It is certainly true that data protection in law enforcement is a nuanced and complex topic. There are indeed many hidden or subtle aspects related to it. It is therefore important to explore and reflect about these complexities. Not just as an academic exercise, but to better inform our future policy decisions. As we do so, it is important that we seek clarity and precision, as well as distinct messages – for at least two reasons: First, because we are exercising our duties in a highly regulated and supervised framework, where legal certainty and legitimate expectations are preferable to grey areas and ambiguity. Second, because - as I said - we are ultimately dealing with life and death matters. Our collective role – in EU law enforcement and in the data protection community - is to contribute to an area of freedom, security and justice, one which places the individual at the heart of our activities. Europol’s specific role is to protect citizens against organised crime and terrorism. But all of us - law enforcement, supervisors and regulators – as public institutions, have to provide for the respect of the rights to life, liberty, security and the protection of personal data. Especially, as one set of rights cannot be enjoyed without the other. I always advocate for a culture of respect, loyalty and trust among all players in the Justice and Home Affairs area – we are all dealing with very delicate matters. This requires building a strong sense of inter-institutional trust, through objectivity and impartiality. We must ensure that all measures taken are proportional to the aim pursued. This conference is very much welcomed as it puts on the table a series of topics revolving around technological challenges, that are absolutely relevant for law enforcement. Today, public authorities – be it law enforcement or supervisory bodies - are faced with a difficult task as they seek to fulfil their responsibilities to protect the individual rights of citizens in the digital environment. Addressing these challenges requires creative thinking, innovative policy solutions and cross-sector partnerships. The technological changes are so fundamental and so rapid, that we are just about to comprehend their impact on law enforcement. However, the issue is not just technology. It is about the adaptability of our law enforcement response, of our legal and regulatory framework and most importantly the level of public acceptance. For law enforcement agencies, coping with this continuous and swift digital transformation will require a quantum leap if we are to provide for effective future policing. In order to navigate these challenges, we as law enforcement must embrace innovation and continuous learning, connect with relevant stakeholders, and foster a forward-looking mind set within our organisations. We established the Europol’s Innovation Lab precisely to identify and develop concrete innovative solutions to support Member States’ operational work. The Innovation Lab’s Observatory monitors technological developments of relevance to law enforcement. We assess potential benefits and threats and use this knowledge to help better prepare the law enforcement community for the future. I would like to briefly touch upon some related issues, building on the discussions of EU chiefs of police throughout the last few months. One key challenge relates to access to data for effective law enforcement in light of the digitalisation of communications. The digital and physical worlds are intertwined and police agencies must have the same prerequisites to combat crime irrespective of whether it is committed online or in the physical world. Police agencies in Europe have a sense that we are not yet there, that we are going dark. We need solutions that are compliant and in accordance with the rule of law. Solutions, which at the same time make a real difference for police agencies. There is a communication side to this. Police agencies must be as transparent as possible and provide concrete examples of how digital data is necessary to prosecute criminals as well as to exonerate innocent people. Public trust in the police is a fundamental prerequisite. Another challenge relates to legal insecurity in the area of data retention. In the absence of legal certainty of national legal frameworks on data retention, there is a risk that law enforcement agencies cannot access important evidence needed to identify, prevent, investigate and prosecute crimes. Other challenges relate to the development of generative artificial intelligence and quantum computing technologies.   Technology brings opportunities, but also risks: unwanted side effects from technology itself or the possibility for criminal actors to exploit it for their own illicit purposes. These include the production of synthetic media such as deep-fakes which can, for instance, be abused for a variety of purposes: disinformation, fraud, child sexual exploitation, terrorist propaganda, and many others. In the future, it will become increasingly difficult to discern what is real and what is not, and law enforcement needs to be ready in order to mitigate these types of threats. Another type of generative artificial intelligence is that of large language models such as ChatGPT. Here again, criminals can abuse this technology for a number of crime areas. But, on the other hand, large language models may offer some benefits to law enforcement agencies. For example, in supporting officers investigating unfamiliar crime areas, facilitating open source research and intelligence analysis, or to develop technical investigative tools. Finally, I would like to mention quantum computing and its related technologies, which are going to have a profound impact not just on law enforcement, but society as a whole. One of the most critical developments relate to the impact quantum computers are going to have on state-of-the-art encryption. Given their ability to solve certain problems faster than classical computers, the arrival of the universal quantum computer will effectively break the cryptography we employ today to keep our most sensitive data safe. This means that we need to already start thinking about some of the adverse consequences this type of technology might produce. At the same time, some potential uses may be interesting for law enforcement. For example, better decryption capabilities, advances in artificial intelligence, and potentially even improved crime scene forensics. These are just a few of the technological challenges and opportunities we face. Other challenges derive from a number of recent key legislative instruments, which Europol and Member States law enforcement agencies will have are implementing or will have to implement very soon. The Digital Services Act, which introduces harmonized rules for all digital services that operate in the EU, addressing all categories of illegal content, products, services and activities online. The Directive on the exchange of law enforcement information, which lays down the rules under which Member States’ law enforcement authorities may exchange existing information and intelligence effectively and expeditiously for the purpose of conducting criminal investigations. The Terrorism Content Online Regulation, which aims to ensure that terrorist content available to the public is removed swiftly, in a cooperative and coordinated manner among all EU Member States, Europol and hosting service providers (HSPs). Dear colleagues and friends, I tried to give you a quick snapshot of the complexity of the technological and regulatory environment in which law enforcement has to operate, while protecting citizens and fighting organised crime and terrorism. If we are to achieve both security and privacy in an effective manner, all stakeholders — law enforcement agencies, the technology sector, privacy advocates and the victims of online-enabled crimes — must come together for a reasonable and open public debate on this subject. We must focus on practical challenges and tangible, realistic and enforceable solutions. Solutions, which should allow citizens to enjoy technological innovation without fear for their civil liberties while empowering law enforcement agencies to serve their function in society. That is why events like the EDEN conferences are so helpful to come up with fresh and innovative ideas. I would invite you to actively participate in this debate in a constructive spirit and conscious of our joint aim to make Europe a safer place. Thank you for your attention and I wish you a very fruitful and entertaining debate. * * *

This major coordinated and complex law enforcement operation was carried out in several locations across France. More than 110 French police officers, including tactical and canine units, arrested 13 members of the criminal network. Supported by Europol and INTERPOL analysts and in coordination with international police forces, law enforcement took the two main network coordinators in France, logisticians and car thieves into custody. The deployed officers searched various houses and seized tools and material used for car theft including illicit on-board diagnostic (OBD) port software, vehicle documents and cash. Real-time analysis of several seized mobile phones led to the identification of two containers carrying nine stolen cars, which were immediately intercepted at the ports of Le Havre, France, and Las Palmas, Spain.  Europol’s role Europol participated in two operational meetings, contributing analytical findings related to the main suspects in the investigation and information on overlaps with other cases. Europol’s analysts carried out multiple crosschecks and a staff member with a mobile office was deployed to France to support the action day.  This international police operation was carried out under the umbrella of EMPACT. This enabled the participating law enforcement authorities to regularly exchange concrete information during multiple operational meetings and to coordinate the action, ultimately resulting in the dismantling of this highly active criminal network. Organised property crime is one of the EMPACT priorities and Europol's operational activities in this field are carried out within Analysis Project Furtum. Its broad mandate covers all aspects of property crime such as major burglaries, armed robberies (banks, jewellery, money transporters and depots), motor vehicle crimes, cargo crime, metal theft, or organised pick pocketing. Participating countries: France: Judicial Police, Central Office fighting against Organized Crime (Direction nationale de la Police judiciaire - Office central de lutte contre le crime organisé (OCLCO – BNRBT)) Germany: Central Criminal Inspectorate Oldenburg (Zentrale Kriminalinspektion Oldenburg), Federal Criminal Police Office (Bundeskriminalamt) Netherlands: National Police, Central Unit (Politie) Spain: National Police (Policía Nacional, Unidad Trafico Ilicito Vehiculos) Sweden: Swedish Police (Polisen) Switzerland: Federal Office of Police (fedpol), Federal Office for Customs and Border Security (FOCBS) and various Cantonal police agencies Participating agencies: Europol, INTERPOL  

In 2020, law enforcement officers detected a number of suspicious online bets on international table tennis tournaments. Subsequent analysis led to the identification of a criminal network composed of Bulgarian and Romanian nationals, established in Spain, who were corrupting athletes mainly from these two same nationalities. The suspects targeted competitions mainly outside of Spain, while the leader of the organisation corrupted athletes playing for several football teams in Romania. They also provided this information to other fixers, and simultaneously managed to gather knowledge about frauds perpetrated by criminal organisations active in the same area.   Ahead of timeThe criminal organisation used a novel modus operandi based on technology: they used satellites to capture the live feeds of competitions before it would reach betting houses. They had also other less sophisticated systems at their disposal, which could detect the signal before it could reach the betting houses. This allowed the network to bet safely and perpetrate the fraud, thanks to this knowledge of the outcome of the matches. The suspects used this criminal manoeuvre mainly in Asian and South American soccer leagues and the Bundesliga. However, they also targeted the UEFA Nations League, the 2022 Qatar World Cup, and the ATP and ITF tennis tournaments. To avoid suspicion, they placed their bets in the names of other people, who collected the gains on their behalf. Additionally, the suspects corrupted a trader for a major betting house to secure the successful validation of the bets. Overall results 23 suspects arrested, including the leader of the organisation4 house searches Seizures include 2 real estate properties, 3 luxury vehicle, 2 large satellite dishes and signal receivers, 47 bank accounts, 80 phones, cash and EUR 13 000 in counterfeit banknotes Criminal net spread in several countriesThe suspected members of the criminal organisation had close ties with other groups active across Europe. The match-fixing network was especially involved in corrupted games in Romania. Therefore, the international cooperation between law enforcement authorities from Spain and Romania, facilitated by Europol, was instrumental for the detection and dismantling of the network. During the action day in March, Europol deployed two experts on the ground to provide real-time analytical support and expertise to field investigators. In addition, in the beginning of September 2023, the execution of an International Arrest Warrant led to the extradition to Spain of the main organiser, a former Bulgarian table tennis player. The investigation is still ongoing, as some suspected members of the network are still at large. Investigators are also looking into the identification of corrupted athletes who contributed to the perpetrated frauds. 

Malware-based cyber-attacks, specifically ransomware, remain the most prominent threat. These attacks can attain a broad reach and have a significant financial impact on industry. Europol’s spotlight report takes an in-depth look at the nature of malware attacks as well as the ransomware groups’ business structures. The theft of sensitive data could establish itself as the central goal of cyber-attacks, thereby feeding the growing criminal market of personal information. As well as shedding light on the most common intrusion tactics used by criminals, the report also highlights the significant boost in Distributed Denial of Service (DDoS) attacks against EU targets. Lastly, among the report’s key findings are the effects the war of aggression against Ukraine and Russia’s internal politics have had on cybercriminals. Key findings in “Cyber Attacks: The Apex of Crime-as-a-Service” Malware-based cyber-attacks remain the most prominent threat to industry; Ransomware affiliate programs have become established as the main form of business organisation for ransomware groups; Phishing emails containing malware, Remote Desktop Protocol (RDP) brute forcing and Virtual Private Network (VPN) vulnerability exploitation are the most common intrusion tactics; The Russian war of aggression against Ukraine led to a significant boost in Distributed Denial of Service (DDoS) attacks against EU targets; Initial Access Brokers (IABs), droppers-as-a-service and crypter developers are key enablers utilised in the execution of cyber-attacks;  The war of aggression against Ukraine and Russia’s internal politics have uprooted cybercriminals, pushing them to move to other jurisdictions. Europol’s response in fighting cyber-attacks Europol provides dedicated support for cybercrime investigations in the EU and thus helps protect European citizens, businesses and governments from online crime. Europol offers operational, strategic, analytical and forensic support to Member States’ investigations, including malware analysis, cryptocurrency-tracing training for investigators, and tool development projects. Based in Europol’s European Cybercrime Centre (EC3), the Analysis Project Cyborg focuses on the threat of cyber-attacks and supports international investigations and operations into cyber criminality affecting critical computer and network infrastructures in the EU.

Europol’s first ever threat assessment on the topic, ‘The other side of the coin: an analysis of financial and economic crime in the EU’, sheds a light on this system which, from the shadows, sustains the finances of criminals worldwide. The report is based on a combination of operational insights and strategic intelligence contributed to Europol by EU Member States and Europol’s partners. It analyses all financial and economic crimes affecting the EU, such as money laundering, corruption, fraud, intellectual property crime, and commodity and currency counterfeiting. Europol’s Executive Director Catherine De Bolle said: Organised crime has built a parallel global criminal economy around money laundering, illicit financial transfers and corruption. With modern technology, they have diversified their modi operandi to evade detection. The report presents Europol’s expertise in financial and economic crimes, detailing how the current threats are manifesting themselves and how these crimes impact the wider society. It serves as a roadmap to foster cooperation that will derail the world of criminal finances, intercept illicit profits, and – above all else – Make Europe Safer.  The European Commissioner for Home Affairs Ylva Johansson said: Financial and economic crime, and its scale, is a corrosive force in society. Europol and the European Financial and Economic Crime Centre are part of the solution. This report sets out the increasingly sophisticated methods of organised crime and the European law enforcement successes in fighting back. If EU Member States work together even closer on this fight, we can achieve great results. Key findings of the report  Almost 70% of criminal networks operating in the EU make use of one form of money laundering or the other to fund their activities and conceal their assets.  More than 60% of the criminal networks operating in the EU use corruptive methods to achieve their illicit objectives. 80% of the criminal networks active in the EU misuse legal business structures for criminal activities. The criminal landscape in this area is fragmented, with key players often located outside of the EU.  The techniques and tools used by the criminals advance quickly, as they take advantage of technological and geopolitical developments.  Asset recovery as a powerful deterrent  Asset recovery remains one of the most powerful tools to fight back. It deprives criminals of their ill-gotten assets and prevents them from reinvesting them in further crime or integrating them into the mainstream economy. Increasing efforts are being made by EU legislators, Member States and law enforcement to corrode the economic power of serious and organised crime through the recovery of confiscated assets. Yet the amount of captured proceeds still remains too low – below 2% of the yearly estimated proceeds of organised crime, according to a data collection carried out on seized assets for the purpose of the report.  Europol’s European Financial and Economic Crime Centre  The European Financial and Economic Crime Centre (EFECC), founded in June 2020, is Europol’s answer to the growing threats to the economy and integrity of our financial systems. EFECC’s dedicated specialists and analysts support law enforcement and relevant public authorities in their international financial crime investigations and aims at improving the recovery of criminal assets.  In 2022, EFECC supported 402 investigations, with the demand for its skills and services increasing every year. Read the report here

According to Europol’s Serious and Organised Crime Threat Assessment 2021, almost 70% of criminal networks are active in three or more countries. In the EU alone, there are over 180 nationalities involved in organised crime activities. Additionally, nearly two-thirds of criminal groups are composed of members of different nationalities.      As these criminal threats continue to grow beyond national borders, the need for international cooperation between law enforcement actors is paramount. Every day, Europol brings law enforcement officers from across the EU and our partner countries together to prevent and combat all forms of serious international and organised crime, cybercrime, and terrorism.  This situates Europol at the heart of the European security architecture. The Agency plays a critical role as a support centre for law enforcement operations, a hub for information on criminal activities, and a focal point for law enforcement expertise and analysis. Our Secure Information Exchange Network Application (SIENA) has 2 600 secure lines to competent authorities around the world. This allows us to exchange time-sensitive crime-related operational and strategic data quickly and efficiently between our partners. With a network of liaison officers and partners spanning more than 50 countries worldwide coming together at our headquarters in The Hague, Europol is #TheNetThatWorks. To learn more about #TheNetThatWorks, follow us on social media. X (Twitter) – Facebook – LinkedIn – Instagram

Award for operational analysis targeting DDoS attacks The first category awards an analyst, or team of analysts, for delivering outstanding operational analysis. The winning analysis shed light on an investigation targeting criminal activity that fell within Europol’s mandate. The award for Operational Analyst 2023 went to the Cybercrime Investigations Team of the Regional Criminal Police in Hessen, Germany (Hessisches Landeskriminalamt) for their work on a case targeting European-wide Distributed Denial of Service (DDoS) attacks. The other two finalists in this category were: Greece: Hellenic Police (Ελληνική Αστυνομία) for a case targeting the trafficking of steroids; Spain: National Police (Policía Nacional) for an investigation against an itinerant transnational organised crime group. Innovative work on financial fraud wins the strategic analysis award  The second category awards outstanding strategic analysis, which has helped decision-makers to increase their foresight in the fight against serious and organised crime. The award for Strategic Analyst 2023 went to the German Federal Criminal Police (Bundeskriminalamt) for their analysis on investment fraud.  The other two finalists in this category were: France: National Police (Police Nationale / SIRASCO) for analysis on a new phenomenon in illegal car sub-letting; Germany: Berlin Police (Polizei Berlin) for analysis of the National Centre for Missing and Exploited Children.   

In January 2022, the Belgrade Department of the Serbian Criminal Police initiated an investigation into this drug cartel, believed to be involved in the wholesale trafficking of cocaine from South America to the EU. The law enforcement activities against this network extended to authorities across the EU and beyond, resulting in a large international investigation coordinated by Europol. The targeted organisation was soon suspected of organising multi-tonne cocaine shipments from Brazil to the EU. Operational intelligence pointed out that the skippers from Ukrainian and Czech nationality travelled several times to Capo Verde or other locations in West Africa to prepare their vessel for smuggling operations. Recently uncovered operational information revealed that the vessel was located in Brazil. This enabled Brazilian and Spanish authorities, supported by MAOC-N, to closely monitor its movements.The action day on 24 August 2023 led to:6 arrests15 house searches2.7 tonnes of cocaine seizedOther seizures include: two high-end vehicles, luxury watches and over EUR 550 000  in cashLarge number of bank accounts and real-estates blocked for the duration of the on-going financial investigationInvestigators identified a Serbian national as one of the main organisers in the criminal network, who was then designated to be a High Value Target (HVT). The law enforcement actions targeted this Serbian HVT, as well as other individuals instrumental for the continuous functioning of the drug cartel’s operations. These main coordinators of the drug cartel arranged the shipping operations via encrypted communication platforms.   Europol facilitated the exchange of information and provided continuous analytical support to the investigation. The intelligence development revealed a complete covered network operating across continents and countries. Europol facilitated the coordination among national authorities and deployed an expert to Belgrade on the action day to support investigators on the field. Europol also facilitated the deployment of two Serbian investigators to team with the Spanish authorities during the searches of the seized vessel.Operational Taskforce targets Balkan CartelsThe takedown of three encrypted communication tools used by criminals, namely Encrochat, Sky ECC and Anom, has given international law enforcement an unprecedented insight into criminal networks and how they function. One trend uncovered was the important role of criminal networks largely composed of nationals from nationals of countries in the Balkan region play in the global cocaine trade.Europol created the Operational Taskforce Balkan Cartel to provide a response to this threat. The Operational Taskforce brings together countries from the Balkan region, the EU and worldwide, so they can effectively target these criminal networks under the leadership of members with close ties to the region.The following authorities took part in this action:Brazil: Federal Police (Policia Federal)Croatia: National Police (Služba kriminaliteta droga/PNUSKOK - Policijski nacionalni ured za suzbijanje korupcije i organiziranog kriminaliteta)France: National Police (Police Nationale / OFAST - Office anti-stupéfiants) and General Customs Directorate (Direction Générale des Douanes / DNRED -  Direction nationale du renseignement et des enquêtes douanières)Poland: Police Central Bureau of Investigation (Centralne Biuro Śledcze Policji)Portugal: Judiciary Police (Polícia Judiciária)Serbia: Criminal Police Directorate (Управа криминалистичке полиције, Полицијска управа за град Београд) Slovenia: National Bureau of Investigations (Nacionalni Preiskovalni Urad)Spain: National Police (Policía Nacional)  

Active since 2007, this prolific malware (also known as QBot or Pinkslipbot) evolved over time using different techniques to infect users and compromise systems. Qakbot infiltrated victims’ computers through spam emails containing malicious attachments or hyperlinks. Once installed on the targeted computer, the malware allowed for infections with next-stage payloads such as ransomware. Additionally, the infected computer became part of a botnet (a network of compromised computers) controlled simultaneously by the cybercriminals, usually without the knowledge of the victims. However, Qakbot’s primary focus was on stealing financial data and login credentials from web browsers. How does Qakbot work?  The victim receives an email with an attachment or hyperlink and clicks on it; Qakbot deceives the victim into downloading malicious files by imitating a legitimate process; Qakbot executes and then installs other malware, such as banking Trojans;  The attacker then steals financial data, browser information/hooks, keystrokes, and/or credentials; Other malware, such as ransomware, is placed on the victim’s computer. Over 700 000 infected computers worldwide  A number of ransomware groups used Qakbot to carry out a large number of ransomware attacks on critical infrastructure and businesses. The administrators of the botnet provided these groups with access to the infected networks for a fee. The investigation suggests that between October 2021 and April 2023, the administrators have received fees corresponding to nearly EUR 54 million in ransoms paid by the victims. The lawful examination of the seized infrastructure uncovered that the malware had infected over 700 000 computers worldwide. Law enforcement detected servers infected with Qakbot in almost 30 countries in Europe, South and North America, Asia and Africa, enabling the malware’s activity on a global scale. Over the course of the investigation, Europol facilitated the information exchange between participating agencies, supported the coordination of operational activities, and funded operational meetings. Europol also provided analytical support linking available data to various criminal cases within and outside the EU. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. Eurojust actively facilitated the cross-border judicial cooperation between the national authorities involved. The Agency hosted a coordination meeting in July 2023 to facilitate evidence sharing and to prepare for this joint operation. Law enforcement authorities involved: France: National Police (Police Nationale) and National Gendarmerie (Gendarmerie Nationale) Germany: Federal Criminal Police Office (Bundeskriminalamt)  Latvia: State Police (Valsts policija) The Netherlands: National Police (Politie) Romania: Romanian Police (Poliția Română) United Kingdom: National Crime Agency United States: Federal Bureau of Investigation (US FBI) Judicial authorities involved: France: National Jurisdiction against Organised Crime (JUNALCO), Public Prosecutor’s Office Cybercrime Unit;  Germany: Prosecutor General's Office Frankfurt am Main – Cyber Crime Centre; The Netherlands: National Public Prosecutor’s Office Rotterdam United States: US Attorney’s Office for the Central District of California and the Department of Justice’s Computer Crime and Intellectual Property Section

The investigation, initiated in March 2022, focused on a Polish-flagged vessel with an established temporary base in the Canary Islands, and which was suspected of being used for the transportation of cocaine. Since then, law enforcement authorities monitored the activities of the crew. One of the individuals, an Italian national, was linked to the Italian ´Ndrangheta and the other, a Croatian national, was linked to the so-called Balkan Cartel. Although they had no professional activity, both were enjoying high living standards while maintaining the vessel in excellent condition. The suspicious vessel was making irregular trips to demonstrate normality up until 27 July 2023, when the Spanish authorities detected an unusual trip to an isolated point deeper in the Atlantic Ocean. The vessel departed from there on 2 August and three days later Spanish authorities raided the ship and uncovered 700 kilograms of cocaine on it. Meanwhile, officers on the ground in Spain arrested the Croatian suspect and another person, a Serbian national, both suspected of coordinating the drug smuggling operation from the land. During the arrests, the suspects were found in possession of the phones from which they coordinated the criminal activity. Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall case coordination among various agencies and supported the action day remotely.  

The action day on 20 June led to: 19 arrests (16 Syrian and 3 Moroccan nationals) 7 locations searched Multiples seizures including 5 vehicles, mobile and storage devices (smartphones, computers, memory sticks), about EUR 10 000 in cash and various documents  At least 550 migrants smuggled from Syria In June 2022, Spanish authorities initiated an investigation into this criminal group, which was based in the provinces of Toledo and Cuenca. The criminal organisation facilitated the transportation of irregular migrants from the coasts of Almeria and Murcia to the area surrounding Madrid, accommodating them in seven locations they used for this purpose. The suspects kept these locations in unsanitary conditions, putting migrants’ health at risk from their clandestine entry into Spain until their departure towards their final destination via land or air.  The suspects facilitated the transferral of migrants to Madrid – Barajas airport, while arranging tickets to destinations in Western and Northern Europe, mainly Germany and Norway. The criminal network is suspected of organising over 68 illegal transfers, and the consequent smuggling of more than 550 Syrian migrants into the EU.  Up to EUR 20 000 per person for the full journey The criminal group was closely connected to other migrant smuggling cells facilitating smuggling from Asia and Africa towards Europe. This interconnection, revealed over the course of the investigation, illustrates the international scale of an intercontinental migrant smuggling network active across Asia, Africa and Europe. The close-knit network would transfer migrants between local traffickers from one country to another, while arranging the collection and distribution of the criminal profits using the hawala underground banking system. The total price for the journey from Syria to the final European destination totalled more than EUR 20 000. The prices per leg of the smuggling route were as follows:  EUR 4 000 from Beirut, Lebanon to Egypt via plane;  EUR 3 500 from Egypt via Libya and Tunis to Algeria via land;  EUR 10 000 from the Algerian Oran y Mostaganem coast to the Spanish coasts of Almeria and Murcia via sea, and then via land to Madrid, Cuanca and Toledo; between EUR 1 000 and EUR 2 000 from Spain to Germany and Norway.  Europol’s role Europol facilitated the exchange of information, and provided operational coordination and analytical support. A large part of the operational analysis was developed in the framework of the Information Clearing House, created to enhance the intelligence picture on organised migrant smuggling from source and transit countries.  During the action day, Europol deployed an analyst to Spain to enable the real-time exchange of information and cross-check operational information against Europol’s databases to provide leads to investigators in the field. Following the actions, Europol provided extensive forensic support to the Spanish authorities to analyse the new data collected during the operational actions. Europol facilitated also the deployment of German officers on the spot to facilitate appropriate data collection and the exchange of evidence. 

Five of its administrators were arrested, and all of its servers seized, rendering LolekHosted.net no longer available.  This latest success in the fight against cybercrime follows a complex investigation supported by Europol and the US Federal Bureau of Investigation (FBI).  Criminal hideouts for lease Bulletproof hosting is a service in which an online infrastructure is offered, and operators will generally turn a blind eye to what customers use their rented domains for. However, being willing to ignore the transgressions of clients does not mean that law enforcement will take the same stance. The complex investigation into LolekHosted.net revealed how the service facilitated the distribution information-stealing malware, and also the launching of DDoS (distributed denial of service) attacks, fictitious online shops, Botnet server management and distribution of spam messages worldwide. The suspects marketed privacy as a key feature of this service, using slogans such as “You can host anything here!” and “no-log policy”. Payments were to be made in cryptocurrencies. European coordination Europol’s European Cybercrime Centre (EC3) provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through operational analysis, crypto tracing, and forensic analysis.  The Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol’s headquarters facilitated the information exchange. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations.