Top Stories

Influential clients contribute to criminal activities worth EUR 1.5 million The criminal network was found to be supplying a large number of clients across Romania and the European Union. The Romanian suspect had close ties with gyms in Romania, which the networks supplied with the illegal goods. Some of their clients were well-known social media influencers with popular dietary and nutrition channels, as well as prominent entertainment personalities who often appeared in broadcast media. The suspects used instant messaging applications and dark web marketplaces to reach customers in other EU countries. To disguise the origin of the products, they used labels from famous e-commerce marketplaces to package the parcels. They then received payments in cryptocurrencies and used crypto-mixers to launder the criminal assets. Based on Europol’s analysis and the information provided by the investigators, it is estimated that the criminal profits may have reached EUR 1.5 million. Results of the action day on 29 March 2023:  37 house searches (22 in Moldova in the counties of Chisinau, Briceni, Telenesti and 15 in the counties of Iași, Bacău, Bucharest, Constanța and Sibiu in Romania); 11 arrests in Romania (4 main organisers and 7 facilitators);  Illegal lab dismantled and over 1 million pills found at the production site; 42 litres of injectable anabolic steroids;  6.5 kg of various active powders; 20 000 vials with multiple doses of Trenox, Trenbolone H, Boldenone, Primobolan, Terstosterone, Masteron, Sustanon, Clenbuterol;  28 000 vials Mastera, Tren Mix, Testoviron, Evogene, Stanoject; 340 000 anabolic steroid tablets containing various products such as Danamed, Testomed, Decamed, Provimed, Anadrol, Stanobol, Dianabol, Vikalis; 433 syringes and 8 500 labels; Assets seized include 5 cars, luxury watches, EUR 47 000, USD 15 000, over MDL 190 000, over ROL 40 000, luxury watches and precious stones, electronic equipment, two crypto “cold” wallets and bank cards. Special surveillance leads to the arrests  The national authorities deployed special investigative techniques to gain a better understanding of the criminal activities. Through these techniques, the investigators discovered that the criminal activity was logistically well-planned and had an effective overall organisation. There were four main organisers, one Romanian and three Moldovans. The investigations revealed that every Tuesday, all three Moldovans travelled by car in Romania. From Wednesday to Thursday or Friday, they produced the illegal pharmaceuticals in the factory. Once the production was ready, the Moldovan suspects supplied the Romanian suspect in charge of distribution.  Europol supported the investigation with operational coordination and analysis and, during the action day, deployed one expert to Romania and one to Moldova to cross-check operational information in real-time and provide leads to officers in the field. During the course of the investigation, Europol also provided financial and cryptographic analysis.  Eurojust supported the authorities involved by setting up and funding a joint investigation team. Europol’s IPC3 (Intellectual Property Crime Coordinated Coalition), which supported the investigation, is a project co-funded by the EUIPO to combat intellectual property crime.

During the raids, investigators uncovered a large number of mobile devices in both Belgium and Spain, which were used by the suspects to communicate with clients and send instructions to victims. This reveals that there was no direct victim-client communication and that the suspects could retain control over the victims. The victims had no choice but to accept any client, with the services to provide, location and payment already arranged by the criminal network. In total, authorities identified more than 200 victims. Over the past 3 years, the investigators monitored about 3 000 advertisements linked to that network, suggesting that the real number of the victims is much higher.  Forensic sub-focus of the operational taskforce Lotus  The online aspect was an important facilitation factor in the functioning of this sexual exploitation ring. The joint investigative activities enabled by Task Force Lotus has led to the dismantling of an important part of this network. The investigations are however not over; as part of this task force, Europol organised a one-week forensic sprint to coordinate and speed up the follow-up investigations.  During this week, 15 experts from Belgium, Denmark, Germany, The Netherlands, Norway, Poland, Spain and Switzerland extracted together tens of terabytes of data from hundreds of seized devices. By carrying out this extraction jointly, as opposed to each participating country performing this work for itself, the process took a few days instead of potentially months. The result of these common efforts will serve operational analysis and further investigations into the activities of this human trafficking network. 

Arrests: 104 individuals arrested Seizures: 3 500 tons of non-compliant pallets (estimated sale value of EUR 2 000 000) and other packaging that did not meet mandatory legal requirements for their use in international trade and shipment. Modus operandi: 148 criminal offenses detected, including crimes against natural resources and the environment, crimes against industrial property, crimes of misappropriation, belonging to a criminal organisation, theft, and fraud. Europol’s contribution: Operational coordination, information exchange with Spanish authorities, operational analysis. For additional information, please reach out to Europol’s Press Office.

Their insights are compiled in Europol’s first Tech Watch Flash report published today. Entitled ‘ChatGPT - the impact of Large Language Models on Law Enforcement’, this document provides an overview on the potential misuse of ChatGPT, and offers an outlook on what may still be to come.  The aim of this report is to raise awareness about the potential misuse of LLMs, to open a dialogue with Artificial Intelligence (AI) companies to help them build in better safeguards, and to promote the development of safe and trustworthy AI systems.  A longer and more in-depth version of this report was produced for law enforcement only.  What are large language models?  A large language model is a type of AI system that can process, manipulate, and generate text.  Training an LLM involves feeding it large amounts of data, such as books, articles and websites, so that it can learn the patterns and connections between words to generate new content.  ChatGPT is an LLM that was developed by OpenAI and released to the wider public as part of a research preview in November 2022. The current publicly accessible model underlying ChatGPT is capable of processing and generating human-like text in response to user prompts. Specifically, the model can answer questions on a variety of topics, translate text, engage in conversational exchanges (‘chatting’), generate new content, and produce functional code.  The dark side of Large Language Models As the capabilities of LLMs such as ChatGPT are actively being improved, the potential exploitation of these types of AI systems by criminals provide a grim outlook. The following three crime areas are amongst the many areas of concern identified by Europol’s experts:  Fraud and social engineering: ChatGPT’s ability to draft highly realistic text makes it a useful tool for phishing purposes. The ability of LLMs to re-produce language patterns can be used to impersonate the style of speech of specific individuals or groups. This capability can be abused at scale to mislead potential victims into placing their trust in the hands of criminal actors. Disinformation: ChatGPT excels at producing authentic sounding text at speed and scale. This makes the model ideal for propaganda and disinformation purposes, as it allows users to generate and spread messages reflecting a specific narrative with relatively little effort. Cybercrime: In addition to generating human-like language, ChatGPT is capable of producing code in a number of different programming languages. For a potential criminal with little technical knowledge, this is an invaluable resource to produce malicious code.  As technology progresses, and new models become available, it will become increasingly important for law enforcement to stay at the forefront of these developments to anticipate and prevent abuse.  Read Europol’s recommendations and the full findings of the report here. *** Important notice: The LLM selected to be examined in the workshops was ChatGPT. ChatGPT was chosen because it is the highest-profile and most commonly used LLM currently available to the public. The purpose of the exercise was to observe the behaviour of an LLM when confronted with criminal and law enforcement use cases. This will help law enforcement understand what challenges derivative and generative AI models could pose. *** About the Europol Innovation Lab  The Europol Innovation Lab helps the European law enforcement community to make the most of emerging technologies by finding synergies and developing innovative solutions to improve the ways in which they investigate, track and disrupt terrorist and criminal organisations. The Lab leads several research projects and coordinates the development of investigative tools with national law enforcement authorities.  Read more about the Lab’s work.

Europol supports national authorities through operational coordination, cross-border investigations and establishing links between field actors. This is also Europol’s role in such exercises; helping Member States improve connections and build up common operational capabilities.  Following the successful conclusion of the exercise, Europol’s Deputy Executive Director Jean-Philippe Lecouffe remarked: Europol is well-placed to bring networks together. Europol hosts ATLAS and supports numerous other Europe-wide networks such as the European Surveillance Group. Common exercises are fundamental to increasing the preparedness of Special Intervention Units for cross-border operations. Their readiness directly translates into making Europe safer. Surveillance and intervention units – the ones you (almost) never see Terrorist plot foiled. Kidnapped child retrieved. These are the results, but how they are achieved is something that we (almost) never see. Can criminals and terrorists escape by crossing a border? Can a potentially dangerous suspect be tracked while travelling in another country to commit an attack?  Intervention and surveillance units are on the ground every day, sometimes 24/7. We almost never see them: this is a job well done. There is of course a challenge – special units from different countries have to cooperate closely, communicate swiftly, and coordinate all activities in real time. The use of common systems facilitates this coordination, permits joint exercises and - most importantly – builds operational networks that bring together specialised units from across the EU.   Tracking suspected terrorists across Europe The exercise focused on a fictional terrorist plot. The scenario started in Ireland, from where two suspects took a plane to Austria. Surveillance teams from Ireland and Austria were then joined by counterparts from Belgium, France, Switzerland, Germany, and Luxembourg, who followed the targets across borders while gathering information about the individuals’ nefarious plans. This coordination and exchange of information led to the final assault, which took place in the Netherlands – fictional arrests of the two suspects for planning a terrorist attack. Coordinated from Europol’s headquarters, this exercise put all national teams in a real time situation. This was the first time the two networks had worked this closely together, successfully coordinating an operation across fifteen national borders. The ATLAS network is a cooperation platform of 38 Special Intervention Units of EU Member States and associated countries, Iceland, Switzerland, Norway and the United Kingdom. The development of the EU security landscape in recent years has highlighted the need of well-trained and EU-wide interoperable Special Intervention Units to strengthen law enforcement responses in Europe. Europol has hosted the Support Office of the ATLAS network at its headquarters since 2019, in order to enhance that close cooperation.  The European Surveillance Group is a network of covert surveillance units from the EU Member States and associated countries Norway, UK and Switzerland. Europol has been supporting the network since its foundation in 2007.   

Arrests: 49 arrests and 87 house searches – including repetitive criminals, CSEM producers and child sexual molesters. Seizures: In total 92 computers and 170 storage devices – so far within seized digital media about 170 thousands of files depicting sexual abuse of children had been recovered. The forensic review is ongoing.  Modus operandi: Production, possession and distribution online of pictures and videos depicting child sexual abuse and exploitation Europol’s contribution: Europol provided most of the data to Poland, Europol provided analytical and operational support since the onset of the case.  For additional information, please reach out to Europol’s Press Office.

ChipMixer, an unlicensed cryptocurrency mixer set up in mid-2017, was specialised in mixing or cutting trails related to virtual currency assets. The ChipMixer software blocked the blockchain trail of the funds, making it attractive for cybercriminals looking to launder illegal proceeds from criminal activities such as drug trafficking, weapons trafficking, ransomware attacks, and payment card fraud. Deposited funds would be turned into “chips” (small tokens with equivalent value), which were then mixed together - thereby anonymising all trails to where the initial funds originated.  A service available both on the clear and on the darkweb, ChipMixer offered full anonymity to their clients. This type of service is often used before criminals’ laundered crypto assets are redirected to cryptocurrency exchanges, some of which are also in the service of organised crime. At the end of the process, the ‘cleaned’ crypto can easily be exchanged into other cryptocurrencies or directly into FIAT currency though ATM or bank accounts.  EUR 2.73 billion in crypto assets laundered with “chips” The investigation into the criminal service suggests that the platform may have facilitated the laundering of 152 000 Bitcoins (worth roughly EUR 2.73 billion in current estimations) in crypto assets. A large share of this is connected to darkweb markets, ransomware groups, illicit goods trafficking, procurement of child sexual exploitation material, and stolen crypto assets. Information obtained after the takedown of the Hydra Market darkweb platform uncovered transactions in the equivalent of millions of euros.  Ransomware actors such as Zeppelin, SunCrypt, Mamba, Dharma or Lockbit have also used this service to launder ransom payments they have received. Authorities are also investigating the possibility that some of the crypto assets stolen after the bankruptcy of a large crypto exchange in 2022 were laundered via ChipMixer.  Europol facilitated the information exchange between national authorities and supported the coordination of the operation. Europol also provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through operational analysis, crypto tracing, and forensic analysis. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. National authorities involved: Belgium: Federal police (Police Fédérale/Federale Politie) Germany: Federal Criminal Police Office (Bundeskriminalamt) and General Prosecutors Office Frankfurt-Main (Generalstaatsanwaltschaft Frankfurt/Main, Zentralstelle zur Bekämpfung der Internetkriminalität) Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości) Switzerland: Cantonal Police of Zurich (Kantonspolizei Zürich) USA – Federal Bureau of Investigation, Homeland Security Investigation, Department of Justice  

According to the investigation, the perpetrators used a Romanian company to purchase the precursors (raw materials) and incorporate them into two pharmaceutical products, 50 and 120 milligram tablets of ephedrine and pseudoephedrine. They used a formula that allowed them to quickly extract these precursors afterwards for the production of methamphetamine in clandestine laboratories. One of the suspects was partner and director of this company. The tablets produced in Romania were shipped to companies in several European countries that purchased them without having a marketing authorisation in those countries. The tablets did not reach their declared destination, but were sent to various locations in Poland. From there, the shipments were split into smaller quantities and delivered to the Czech Republic and Slovakia, where they were distributed to clandestine laboratories.  Using the 'Czech method' of producing methamphetamine in clandestine laboratories, approximately 0.70 kg of methamphetamine was obtained from one kilogram of ephedrine/pseudoephedrine hydrochloride. Between January 2021 and February 2023, the members of the criminal group allegedly organised the transport and delivery of 168 788 870 tablets containing ephedrine and pseudoephedrine (approximately 6.7 tonnes of ephedrine hydrochloride), from which a total quantity of at least 4.7 tonnes of methamphetamine could be produced. During joint action days from 26 February until 2 March, 16 suspects were arrested in the four countries involved.  In Poland, 3 184 500 pills containing ephedrine for a value of approximately EUR 840 000 (PLN 4 012 470) and 121 776 pills containing pseudoephedrine were seized. Additionally, PLN 366 200, EUR 177 215, USD 260 and CZK 1 400 were also seized. A total of EUR 148 163, CZK 711 082 and PLN 22 433 were seized from bank accounts in the Czech Republic. Cash was also found and seized during the searches. In Slovakia, EUR 1 129 220 was seized. A joint investigation team (JIT) among involved countries was set up in November 2022 with the support of Eurojust. The Agency also hosted three coordination meetings to facilitate judicial cooperation and provide support for the coordinated investigative efforts. Europol has been supporting the investigation since August 2022 by facilitating the information exchange, cross-checking operational information against its databases and providing analytical support. A Europol mobile office was also deployed to Slovakia on the day of action to assist the national authorities with their investigative measures.   The following authorities took part in this investigation: Czech Republic: Regional Public Prosecutor´s Office in Ostrava, Czech Police, National Anti Drug Unit  Poland: The National Prosecutor´s Office Department for Organized Crime and Corruption in Katowice and Wroclaw, Police Central Bureau of Investigation in Katowice and Wroclaw and Polish Border Guard in Nowy Sacz Romania: Prosecutor’s Office attached to the High Court of Cassation and Justice – Directorate for Investigating Organised Crime and Terrorism – Central Structure – Department for Combatting Drug Trafficking; Romanian National Police Directorate for Countering Organised Crime – Central Antidrug Service, and the Directorate for Special Operations Slovakia: Regional Public Prosecutor´s Office in Žilina, Presidium of the Police Force National Crime Agency Drug Headquarters  

The main motive for organised crime is financial gain. Identifying and confiscating the profits of international criminal networks is therefore a top priority for law enforcement, and Europol has provided significant support in the field of asset recovery in recent years. This is a crucial mechanism for deterring criminal activity, and law enforcement agencies worldwide are investing great resources into asset recovery than ever before.  This is what led to the establishment of Europol’s European Economic and Financial Crime Centre (EFECC) by Executive Director Catherine De Bolle in 2020. While providing operational and analytical support to Member States and Europol’s partners, EFECC is also primarily focused on tracing, identifying, and freezing criminal assets. This has proven to be invaluable in light of the growing complexity of investigating criminal networks, a development influenced by improvements in technology and growing instances of cross-border crime. The pandemic also illustrated that a key characteristic of criminal networks is their agility in adapting to and capitalising on changes in the environment in which they operate. According to EU Directive 2014/42/EU Tracing and identification means any investigation by competent authorities to determine instrumentalities, proceeds, or property that may be derived from criminal activities;   Freezing means the temporary prohibition of the transfer, destruction, conversion, disposal or movement of property or temporarily assuming custody or control of property;  Confiscation means a final deprivation of property ordered by a court in relation to a criminal offence.  But how are criminal assets defined? Assets are any property, movable or immovable, tangible or intangible, held by an individual or a legal entity. They are criminal whenever their origin is tainted. This can include, inter alia, the: direct proceeds of a crime (e.g. the jewellery stolen from a shop); indirect proceeds of a crime (e.g. a car purchased thanks to the money from the stolen jewels); instrumentalities of crime (e.g. the car used to commit the jewellery robbery).  Financial investigations determine what assets are criminal, and which assets are eligible for recovery proceedings. This is where Europol’s asset recovery unit can provide essential expertise. Cracking down on criminals’ lavish lifestyles Most criminals are motivated by financial gain. Criminals aim to use stolen funds to create lavish lifestyles and often go to extreme measures to hide the origins of their illicit gains. In 2018, Europol aided the French Gendarmerie in arresting a suspect behind an international corruption and money laundering scheme. The suspect had initially faked his own death, fled his country of origin, and was found living in a French castle. In 2022, the suspect was sentenced in France to four and a half years in prison, including six months suspended and a fine of EUR 100 000. The estate he had purchased was also confiscated as it was considered an indirect proceed of his crimes. More recently, Europol provided analytical and operational support to the Spanish police in an operation that took down a criminal network involved in drug trafficking across multiple member states. Europol was decisive in uncovering a variety of methods used to transfer and launder the illicit profits generated by drug trafficking. These include the clandestine transport of large amounts of cash, the use of the informal value transfer systems and investments in luxury goods such as yachts, watches, vehicles or real estate and property renovations. The criminal network further invested in companies located in several European countries and used loans and mortgages to businesses to launder illicit funds. Europol’s resources in asset recovery were also deployed in the context of the Russian invasion of Ukraine in 2022. Operation Oscar, conducted with the support of Eurojust and Frontex, supported financial investigations by EU Member States targeting criminal assets owned by individuals and legal entities that had been sanctioned in relation to the conflict. As well as targeting criminal assets themselves, Operation Oscar supports Member State investigations into circumvention of sanctions. But how does Europol make these operations happen on the ground? Who are the people doing the investigating, and what tools do they use for their work? Asset recovery offices Each EU country has an asset recovery office and these offices can communicate directly with each other and with Europol via SIENA, Europol’s secure messaging platform for use by law enforcement. The decision to create a network of asset recovery offices was established in 2008 by the EU Commission as a new approach for connecting law enforcement authorities dealing with asset recovery in different countries. As part of this decision, all EU Member States were required to have an asset recovery office. According to the 2021 SOCTA, from 2016 to 2020 the volume of information exchanged among asset recovery offices in the EU doubled, while staffing levels increased by 18 % on average, displaying the need for these specialised teams and the importance of international cooperation. This network is particularly effective as each office has a legal requirement to answer any request from another office within one week. Europol co-chairs this platform with the EU Commission and performs a crucial role in connecting the different offices. Creating international asset recovery networks Criminals transfer and spread their assets across multiple jurisdictions and make it increasingly difficult for national authorities to trace, freeze and confiscate them. They then use these assets to invest in further criminal activity or to facilitate ostentatious lifestyles that they cannot sustain. Most of the time, criminals do not necessarily hide their profits, they simply reinvest them in further criminal activities. When it comes to laundering money, criminals use numerous techniques including investing in works of art and real estate, amongst other options. CARIN Another important network in the field of asset recovery is the Camden Assets Recovery Inter-Agency Network. CARIN’s mission is to enhance efforts that deprive criminals of their profits. This network was established in 2004, with the permanent secretariat located at Europol and staffed with Europol specialists. As part of this network, members can gather to discuss strategic topics related to asset recovery and ways to improve cases. In 2022, CARIN worked on the following topics: best practices in asset management; asset recovery and anticorruption; asset recovery in response to international aggressions; strengthening ARINs (Financial Action Task Force projects). CARIN’s membership comprises 61 jurisdictions - EU and non-EU - and 13 organisations that are either members or observers. As of 2023, CARIN (together with the other alike asset recovery networks created worldwide) can reach out to 174 jurisdictions.  As part of CARIN, there are points of contact in all participating countries. One of the main advantages of this is that law enforcement is able to quickly and effectively contact their counterparts in different jurisdictions all over the globe. For example, CARIN specialists from countries that are continents apart can rapidly get in touch via the network and successfully recover stolen assets. Through CARIN we have a very trusted community of asset recovery practitioners, and this enables us to connect the dots as never before. Frédéric Pierson, European Financial and Economic Crime Centre Legislation All activity by law enforcement regarding asset recovery is subject to a robust legal framework which is currently under revision, as policymakers look to enhance its strength. The pillars of the EU regime are Council Decision 2007/JHA/845 and Directive 2014/EU/42 which sets minimum rules for the freezing, management, and confiscation of criminal assets. Member States have various interpretations and applications of laws related to asset recovery. There is currently a proposed Directive on asset recovery and confiscation which will make it easier for police to identify, freeze and manage assets. It will also cover all relevant criminal activities carried out by organised crime groups, enabling confiscation of all relevant assets.  Ensuring crime doesn’t pay Europol functions as the central hub around which international asset recovery offices and networks revolve, and it links countries so that they can clearly see patterns of criminal activity. Each of the instruments described in the article is part of a bigger picture, targeting the financial incentives that spur organised crime.  This international cooperation, and Europol’s role in creating it, is therefore crucial in ensuring that crime doesn’t pay.  

This ransomware appeared in 2019, when cybercriminals started using it to launch attacks against organisations and critical infrastructure and industries. Based on the BitPaymer ransomware and part of the Dridex malware family, DoppelPaymer used a unique tool capable of compromising defence mechanisms by terminating the security-related process of the attacked systems. The DoppelPaymer attacks were enabled by the prolific EMOTET malware. The ransomware was distributed through various channels, including phishing and spam emails with attached documents containing malicious code — either JavaScript or VBScript. The criminal group behind this ransomware relied on a double extortion scheme, using a leak website launched by the criminal actors in early 2020. German authorities are aware of 37 victims of this ransomware group, all of them companies. One of the most serious attacks was perpetrated against the University Hospital in Düsseldorf. In the US, victims payed at least 40 million euros between May 2019 and March 2021.  During the simultaneous actions, German officers raided the house of a German national, who is believed to have played a major role in the DoppelPaymer ransomware group. Investigators are currently analysing the seized equipment to determine the suspect’s exact role in the structure of the ransomware group. At the same time, and despite the current extremely difficult security situation that Ukraine is currently facing due to the invasion by Russia, Ukrainian police officers interrogated a Ukrainian national who is also believed to be a member of the core DoppelPaymer group. The Ukrainian officers searched two locations, one in Kiev and one in Kharkiv. During the searches, they seized electronic equipment, which is currently under forensic examination.  Europol on-site to speed up forensic analysis of seized data On the action days, Europol deployed three experts to Germany to cross-check operational information against Europol’s databases and to provide further operational analysis, crypto tracing and forensic support. The analysis of this data and other related cases is expected to trigger further investigative activities. Europol also set up a Virtual Command Post to connect the investigators and experts from Europol, Germany, Ukraine, the Netherlands and the United States in real time and to coordinate activities during the house searches. Europol’s Joint Cybercrime Action Taskforce (J-CAT) also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. From the beginning of the investigation, Europol facilitated the exchange of information, coordinated the international law enforcement cooperation and supported the operational activities. Europol also provided analytical support by linking available data to various criminal cases within and outside the EU, and supported the investigation with cryptocurrency, malware, decryption and forensic analysis. 

Specialised counter terrorism units from 17 countries worked hand in hand with Europol’s European Counter Terrorism Centre to restrict access to instructions online on how to use high-risk chemical for terrorist attacks.  A number of chemicals routinely used in industrial processes or professional functions can react upon mixing, producing hazardous substances that could be used to carry out chemical terrorist attacks. Investigators scoured the clear and dark web to identify and refer for removal propaganda and instructions on the use of high-risk chemicals, and the toxic gases they generate, in terrorist material and online fora.  As a result, over 120 individual pieces of content were referred to 21 online service providers to secure their swift removal.  The referred content covered five languages and was disseminated by terrorist supporting networks, including jihadist, right-wing and left-wing terrorist groups. The findings of this Referral Action Day will feed into the analysis of the current threat picture on high-risk chemicals in the impact assessment produced by the European Commission.  Participating countries  Albania, Bosnia-Herzegovina, Colombia, Czechia, Denmark, France, Georgia, Germany, Greece, Luxembourg, Moldova, Montenegro, Portugal, Romania, Slovak Republic, Spain, the United Kingdom

Results of the operation include: 6 houses searched in Seville, Spain  20 suspects arrested assets seized worth an estimated at EUR 5.5 million 2 luxury watches and EUR 16 545 in cash seized 2 500 kilograms of hashish and 45.6 kilograms of marijuana seized criminal infrastructure seized including lorries, a boat, tools for marijuana cultivation and hashish production, and 34 mobile phones  large marijuana plantation and drug lab discovered forged travel and identification documents seized Criminals relied on false identities As the Italian leaders of the criminal network were subjects of European Arrest Orders, they used falsified documents to veil their identities. Residing in towns between Seville and Malaga, they attempted to avoid detection by taking various security measures and by frequently changing their addresses.  The criminal network used a variety of money laundering methods to obfuscate their drug trafficking proceeds. These included the channelling of money - through business bank accounts using fake invoices, loans, or other debts - among a network of companies involved in the transport of drugs. Other methods used were investments in luxury real estate, rentals, luxury goods and vehicles, as well as cash payments.  Drug lab and marijuana plantation Investigations in this case were kicked off in October 2021, when a hashish shipment was found hidden in a lorry transporting pallets of onions. Law enforcement arrested the two drivers and seized 468 kilograms of hashish. This was followed by another seizure of 194 kilograms of hashish and 30 kilograms of marijuana in May 2022. In the same month a boat chartered by the criminal organisation was intercepted by law enforcement on the open sea, resulting in the arrest of its three occupants, as well as the seizure of 1 800 kilograms of hashish and the vessel itself. The interception of this large shipment from Morocco shows that is has become increasingly difficult for criminals to import drugs via the sea. To circumvent this issue, the organisation had built a laboratory for hashish production and set up a large marijuana plantation in southern Spain. These were discovered in the course of the operation, which involved more than 150 law enforcement officials. Europol provided operational expertise as well as analytical and operational support from the very beginning of the investigation. Furthermore, a Europol specialist was deployed on location in Spain during the main action day.

The operation resulted in: 30 searches 15 people detained and 18 people formally charged considerable amounts of cash seized in zlotys, euros and US dollars silver and gold coins and bars, gold jewellery, watches and 7 luxury cars seized electronics and evidence of the use of cryptocurrencies, cash remittances and currency conversions gathered total value of seizures amounts to EUR 2 million Europol’s intelligence packages provide new leads Europol’s dissemination of intelligence packages has given investigators new insight into the criminal network. In addition to identifying tobacco smuggling as a source of income, investigators were now able to trace the illicit profits. Analysis of encrypted data intercepted from criminals’ phones also revealed locations used to hide large sums of cash. Europol provided an analyst and a specialist on-site to assist the 200 Polish law enforcement officers involved in the operation. 

The five action days resulted in: 8 house searches in France and Israel The arrest of the main organiser in Israel 8 suspects arrested (6 in France and 2 in Israel) Seizures include: electronic equipment and vehicles, about EUR 3 million from Portuguese bank accounts, EUR 1.1 million from Hungarian bank accounts, EUR 600 000 from Croatian bank accounts, EUR 400 000 from Spanish bank accounts, EUR 350 000 in virtual currencies  The total value of the seizures is estimated at about EUR 5.5 million International search for the EUR 38 million lost in few days The criminal network, comprised of French and Israeli nationals, targeted companies located in France. In early December 2021, one of the suspects impersonated the CEO of a company specialised in metallurgy, based in the department of Haute-Marne in north-eastern France. The fraudster asked the company’s accountant to make an urgent and confidential transfer of EUR 300 000 to a bank in Hungary. The fraud was discovered a few days later when the accountant, thinking he was acting on behalf of the company’s CEO, attempted to make a transfer of EUR 500 000. The company filed a complaint, and the investigators subsequently found that the call from the alleged CEO came from a number in Israel.  In late December 2021, a real estate developer based in Paris also felt victim to fraud with a similar modus operandi. The damages were much more significant in this case, however. To perpetrate the fraud, the suspects impersonated lawyers, saying they worked for a well-known French accounting company. After gaining the victim’s trust, the fraudster requested a large, urgent and confidential transfer. Pretending to be consultants, they persuaded the Chief Financial Officer (CFO) to transfer millions of euros abroad. In total, they defrauded the company of almost EUR 38 million in a matter of days. Using a pre-existing money laundering scheme, these funds were quickly transferred to different European countries, then to China and finally to Israel. A link between these two scams was established in January 2022 when the Parisian real estate company filed a complaint. The information exchange and international cooperation facilitated by Europol led to the discovery of accomplices, modi operandi and funds. The criminal investigation in Croatia contributed to the discovery of the real identity of the money mules used by the criminal network. The competent authorities in Croatia blocked and froze over EUR 600 000 in several bank accounts. The Portuguese investigation led to the seizure of approximately EUR 3 million held in multiple bank accounts. The Hungarian authorities discovered that more than EUR 7 million had been received in Hungarian bank accounts before being withdrawn in cash or transferred to bank accounts in other countries. The Hungarian authorities interrogated 16 individuals, two of whom had been arrested previously and are currently under criminal supervision. They seized more than EUR 1 million in several bank accounts. Europol’s support in tracing money movements  Since January 2022, Europol has facilitated the exchange of information and provided specialised analytical support, including financial and cryptocurrency analysis and expertise. The analysis led to the identification of links between countries to enable the urgent seizure of criminal assets before the suspects could launder them. On the action days, Europol deployed experts to France, Hungary and Israel to cross-check operational information against Europol’s databases in real-time and provide forensic support on the ground.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat.  

The criminals advertised their illicit activities on various social media platforms to lure as many migrants as possible to be smuggled across the borders. To that end, videos of successful transports were published. Migrants would be moved along two main routes, either from Croatia via Slovenia to Italy, or from Serbia via Hungary to Austria. The operation resulted in: 13 suspects arrested (Slovenian, Serbian and Bosnian-Herzegovinian) at least 212 migrants smuggled in at least 16 separate incidents seizures include: weapons (an automatic rifle, a semi-automatic pistol, silencers, a hunting rifle with an optical sight fitted and over 2 300 pieces of different types of ammunition), various illegal drugs, illegal doping substances, electronic devices and cash  Over 3 million in illegal profits Migrants using the criminals’ services had to pay exorbitant prices to cross into the European Union clandestinely. An illegal trip from Serbia to Austria would require a payment of around EUR 5 000 per person. The entire journey from the country of origin to the EU would cost between EUR 15 000 to 20 000, thus making an enormous profit for the smugglers. In total, investigators believe the criminals obtained at least EUR 100 000 for the transports from Serbia to Austria and at over EUR 3 180 000 in total. The migrants usually entered Hungary through the Serbian-Hungarian green border on foot with the help of guides. The suspects then picked them up in vehicles. Investigations show that up to 37 people may have been transported in the same vehicle, which exposed them to extreme risks to their health and lives. The migrants were then taken across Hungary and dropped off close to the Austrian border. After crossing the border into Austria on foot, they would surrender to the police and apply for asylum.  

This action is the biggest hit to date against Chinese human trafficking in Europe.  On 7 February, some 34 house searches were carried out in Belgium (Brussels, Antwerp and Charleroi) and Spain (Alicante and Barcelona). These actions follow earlier actions against members of this group which led to 7 arrests in Switzerland in May 2022.  A total of 28 individuals were arrested (27 in Belgium and one in Spain).  Among those arrested in Belgium feature five Chinese nationals considered as high-value targets by Europol due to their involvement in multiple high-profile cases in Europe.  This international sweep follows a complex investigation led by the Belgian Federal Prosecutor (Federaal Parket) and Federal Judicial Police East Flanders (Federale Gerechtelijke Politie Oost-Vlaanderen), working together with their counterparts in  Spain, Germany, Poland and Switzerland, with the coordination of Europol and Eurojust. A conveyor belt for sexual exploitation  The investigation uncovered how hundreds of Chinese women were forced into prostitution after being lured to Europe by the promise of a legitimate job. The perpetrators would use popular messaging apps in China to ensnare their victims. They would then smuggle their victims to Europe using forged EU ID documents and residence permits which were either falsified or obtained using falsified supporting documents.  Once in Europe, the victims were held in bondage and forced to work as prostitutes to pay off debts.    The criminals would advertise the women online and set them up in hotels across Europe, rotating their victims between EU countries.  Over the course of the three year-long investigation, over 3 000 online advertisements linked to this ring have been monitored by law enforcement. The investigators were able to identify over 200 victims so far, with the actual number believed to be much higher.  International police cooperation  With cells scattered across Europe, international police cooperation was central in breaking up this Chinese prostitution ring. Initiated in 2020 by the Belgian authorities, this operation rapidly grew in scale, with targets being investigated simultaneously in multiple European jurisdictions.  In order to bring all these perpetrators to justice, an Operational Taskforce (OTF) was set up at Europol in December 2021 between Belgium, Spain, the Netherlands, Poland and Switzerland. This OTF was later joined by Germany at the end of 2022.  Europol has been supporting this high-priority case from its onset in 2020. Its experts coordinated the operational activities, mapped out the different targets and their criminal activities and brought together the investigators on all sides to agree on a joint strategy.  Investigators from the OTF Member States were also deployed to Europol’s premises to work jointly with Europol on the case. Six Europol officers were deployed in February to Belgium and Spain to assist the national authorities with their investigative measures.  Europol also funded the deployment of two German and two Spanish investigators to the coordination centre in Belgium. The case was opened at Eurojust in October 2020 at the request of the Belgian authorities. Two coordination meetings were hosted by the Agency to facilitate judicial cooperation and provide support for the coordinated investigative efforts. The following authorities took part in this operation:  Belgium: Federal Prosecutor (Federaal Parket), Federal Judicial Police East Flanders (Federale Gerechtelijke Politie Oost-Vlaanderen) Germany: Federal Criminal Police Office (Bundeskriminalamt) Poland: National Police HQ (Komenda Główna Policji) The Netherlands: National Police (Politie) Spain: National Police (Policía Nacional)  Switzerland: Federal Police (fedpol)

The 2022 competition comprised the following three categories: Making Europe safer; Caring for the community; On the road. In the ‘Making Europe safer’ category, photographer Pedro Manuel Reis Valongo of the Polícia de Segurança Pública submitted the winning photo of a Portuguese police officer on patrol in a railway station. The officer stands on the platform as the trains pass by, demonstrating the steadfast presence of police in Europe’s public spaces as citizens go about their daily lives. In the ‘Caring for the community’ category, the Guardia Civil’s Ricardo Rueda Fernandez’s winning photo of a Spanish police officer helping a Moroccan citizen safely to shore is poignant and powerful. This police officer’s diving gear shows the versatility and variety of police work, both on shore and at sea. Finally, the ‘On the road’ category was won by photographer Florin Jugravu of the General Inspectorate of Romanian Police for the image of a police officer on duty in Bucharest traffic. This image perfectly encapsulates the frenetic nature of modern life in Europe and the reliability of the police on Europe’s roads and streets. These winning photographs will be on display at Europol headquarters in The Hague. Follow Europol on Instagram to see these winning photographs plus a selection of the best entries.

These arrests took place in November 2022 in several Spanish provinces - Badajoz, Cádiz, Ciudad Real, Córdoba, Tenerife and in the Autonomous City of Ceuta- and follow the arrest of 21 other members of the same criminal organisation in 2021. Known as Operation Conifera, this investigation into match-fixing was carried out by the Spanish National Police (Policía Nacional) in a joint operation with Europol and INTERPOL.  A total of thirty football matches are currently being investigated in this case. The profits generated are estimated at over half a million euros.  Inside the fixing  The investigators were able to uncover with Europol’s support how this betting syndicate operated. The criminal organisation operated a top-down operational business model. At the top of the criminal structure were the two leaders of this criminal gang who had close connections with football players and backroom staff. The intermediaries were responsible for the coordination of the match-fixing schemes, while the corrupted athletes would provide confidential information in order to influence matches. This organised crime group also relied on mules who would place sports bets at bookmakers and collect the prize money, and a network of procurers responsible for providing identities for online betting on rigged matches. The procurers were paid between  EUR 4 000 and EUR 24 000 per online account.   The criminals used encrypted means of communication in order to avoid police detection.  Europol and match-fixing Europol’s support was central in the development of the Spanish investigation. Europol’s European Financial and Economic Crime Centre has been providing continuous intelligence development and analysis to map out the different targets and their criminal activity.  A specialised officer was deployed to Spain to provide on-the-spot operational and analytical support to the national investigators.  Europol has a team of experts working with law enforcement authorities across the EU to identify links between suspicious matches and suspects, and to uncover the organised crime groups orchestrating these multi-million euro frauds against sport. Read Europol’s latest report on the role of organised crime in sports corruption.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

In the last year, HIVE ransomware has been identified as a major threat as it has been used to compromise and encrypt the data and computer systems of large IT and oil multinationals in the EU and the USA. Since June 2021, over 1 500 companies from over 80 countries worldwide have fallen victim to HIVE associates and lost almost EUR 100 million in ransom payments. Affiliates executed the cyberattacks, but the HIVE ransomware was created, maintained and updated by developers. Affiliates used the double extortion model of ‘ransomware-as-a-service’; first, they copied data and then encrypted the files. Then, they asked for a ransom to both decrypt the files and to not publish the stolen data on the Hive Leak Site. When the victims paid, the ransom was then split between affiliates (who received 80 %) and developers (who received 20 %).  Other dangerous ransomware groups have also used this so-called ransomware-as-a-service (RaaS) model to perpetrate high-level attacks in the last few years. This has included asking for millions of euros in ransoms to decrypt affected systems, often in companies maintaining critical infrastructures. Since June 2021, criminals have used HIVE ransomware to target a wide range of businesses and critical infrastructure sectors, including government facilities, telecommunication companies, manufacturing, information technology, and healthcare and public health. In one major attack, HIVE affiliates targeted a hospital, which led to severe repercussions about how the hospital could deal with the COVID-19 pandemic. Due to the attack, this hospital had to resort to analogue methods to treat existing patients, and was unable to accept new ones.   The affiliates attacked companies in different ways. Some HIVE actors gained access to victim’s networks by using single factor logins via Remote Desktop Protocol, virtual private networks, and other remote network connection protocols. In other cases, HIVE actors bypassed multifactor authentication and gained access by exploiting vulnerabilities. This enabled malicious cybercriminals to log in without a prompt for the user’s second authentication factor by changing the case of the username. Some HIVE actors also gained initial access to victim’s networks by distributing phishing emails with malicious attachments and by exploiting the vulnerabilities of the operating systems of the attacked devices.  About EUR 120 million saved thanks to mitigation efforts Europol streamlined victim mitigation efforts with other EU countries, which prevented private companies from falling victim to HIVE ransomware. Law enforcement provided the decryption key to companies which had been compromised in order to help them decrypt their data without paying the ransom. This effort has prevented the payment of more than USD 130 million or the equivalent of about EUR 120 million of ransom payments. Europol facilitated the information exchange, supported the coordination of the operation and funded operational meetings in Portugal and the Netherlands. Europol also provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through cryptocurrency, malware, decryption and forensic analysis.  On the action days, Europol deployed four experts to help coordinate the activities on the ground. Europol supported the law enforcement authorities involved by coordinating the cryptocurrency and malware analysis, cross-checking operational information against Europol’s databases, and further operational analysis and forensic support. Analysis of this data and other related cases is expected to trigger further investigative activities. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. *Law enforcement authorities involved Canada – Royal Canadian Mounted Police (RCMP) & Peel Regional Police France: National Police (Police Nationale) Germany: Federal Criminal Police Office (Bundeskriminalamt) and Police Headquarters Reutlingen – CID Esslingen (Polizei BW) Ireland: National Police (An Garda Síochána) Lithuania: Criminal Police Bureau (Kriminalinės Policijos Biuras) Netherlands – National Police (Politie) Norway: National Police (Politiet) Portugal: Judicial Police (Polícia Judiciária) Romania: Romanian Police (Poliția Română – DCCO) Spain: Spanish Police (Policía Nacional) Sweden: Swedish Police (Polisen) United Kingdom – National Crime Agency USA – United States Secret Service, Federal Bureau of Investigations Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The criminal groups were allegedly responsible for the large-scale trafficking of cocaine, cannabis and heroin mainly from Albania to Italy. Today’s operation is part of a longer-term investigation carried out jointly by the Italian and Albanian authorities, which has already led to the arrest of 62 persons and the seizure of assets worth approximately EUR 1 million (in Italy), as well as to the seizure of huge quantities of drugs. The case was opened at Eurojust and Europol in 2019. Eurojust organised two coordination meetings in which representatives of the involved authorities came together to discuss the case, exchange information and agree on further steps. The Agency also supported the authorities by setting up and funding a joint investigation team (JIT). Over the course of the investigation, Europol provided in-depth analytical support and expertise, mapping out the different high-profile targets and their criminal activities. The investigation was supported by the Countering Serious Crime in the Western Balkans – IPA 2019 project, which – for the first time – was able to financially support operational activities. The following authorities took part in the investigation: Italy: Public Prosecutor’s Office of Bergamo, Central Investigation Service on Organised Crime of the Guardia di Finanza, Economic-Financial Police of Brescia of the Guardia di Finanza, Central Directorate for Anti-Drug Services, Italian International Police Cooperation Service Albania: Special Prosecution Office Against Corruption and Organised Crime (SPAK), Albanian State Police - International Cooperation Office of Tirana

As part of the campaign, ENFAST and Europol directed EU citizens to the EU Most Wanted website to view images of the fugitives and check if they recognised any of them. The campaign appeared across social media and there was a call to action in all EU languages to reach as wide an audience as possible. As part of the campaign, murals were unveiled in Brussels and Barcelona to increase awareness of the campaign and to attract more media attention. The campaign imagery focused on a house of cards, as the removal of a key figure in the criminal network by an anonymous tip could cause the whole organisation to fall. Key successes During this year’s campaign, 14 fugitive cases were successfully solved. This made the 2022 campaign the most successful since 2019. Five fugitive cases were solved as a direct result of the publication of the fugitive profiles on the EU Most Wanted website. This would not have been possible without both the expertise of the ENFAST network and Europol’s far-reaching communications campaign, as both complemented each other in the search for these dangerous fugitives.  Crucial influence of the EU Most Wanted website The EU Most Wanted campaign has experienced significant success in the past with a number of anonymous tips leading to actual arrests. The website was originally launched in 2016, and since then 392 profiles of fugitives have been listed on the website. Out of this figure, 136 fugitives have been arrested with 49 of those arrests directly influenced by the fact that the fugitive profile had been published on the website.  

Almost half of all Bitzlato transactions linked to criminal activities Targeting crucial crime facilitators such as crypto exchanges is becoming a key priority in the battle against cybercrime. Bitzlato allowed the rapid conversion of various crypto-assets such as bitcoin, ethereum, litecoin, bitcoin cash, dash, dogecoin and USDT into Russian roubles. It is estimated that the crypto exchange platform has received a total of assets worth EUR 2.1 billion (BTC 119 000).  While the conversions of crypto-assets into fiat currencies is not illegal, investigations into the cybercriminal operators indicated that large volumes of criminal assets were going through the platform. The analysis indicated that about 46 % of the assets exchanged through Bitzlato, worth roughly EUR 1 billion, had links to criminal activities.  Cryptanalysis uncovered that the majority of suspicious transactions are linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), with others linked to cyber scams, money laundering, ransomware and child abuse material. For example, investigations showed that 1.5 million BTC transactions have been made directly between Bitzlato users and the Hydramarket, taken down in April 2022.  This exchange platform, available both in Russian and English language, rented dedicated servers from a hosting company in France. The coordinated action of the judicial and law enforcement authorities from the different involved countries led to the takedown of the platform, seizures of present financial assets, and further technical analysis. Overall results 5 individuals arrested so far (1 in Cyprus, 3 in Spain and 1 in the US); 1 individual questioned in Portugal; The main administrator arrested in the US; CEO, Financial director and Marketing director arrested in Spain; 8 house searches (4 in Spain, 1 in Cyprus, 2 in Portugal, 1 in US); Takedown of the digital infrastructure of the service, enabling further analysis and investigation; Seizures include crypto wallets worth about EUR 18 million in cryptocurrency at the time of writing, vehicles and electronic equipment; 100+ accounts at other crypto exchange frozen, involving a total of EUR 50 million.   Cryptoanalysis and international coordination to uncover links During the first phases of the investigative activities, Europol facilitated the information exchange, provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through the analysis of millions of cryptocurrency transactions.  On the action day, Europol deployed 13 of its experts on the spot (10 in France, 1 in Cyprus, 1 in Spain and 1 in Portugal) and supported the deployment of national investigators in other countries taking part in the operational activities. Europol supported the law enforcement authorities involved with coordination related to cryptocurrency analysis, cross checking of operational information against Europol’s databases, and operational analysis. At this moment, already over 3 500 bitcoin addresses and over a 1 000 Bitzlato user details showed links with various criminal cases reported in Europol’s systems. Analysis of this data and other related cases is expected to trigger further investigative activities.  Law enforcement authorities involved Cyprus: Cyprus Police Belgium: Federal Police (Federale Politie/Police Fédérale) France: National Gendarmerie (Gendarmerie Nationale) United States: Federal Bureau of Investigation Spain: Civil Guard (Guardia Civil)  Netherlands: National Police (Politie) and the Fiscal Information and Investigation Service (FIOD) Portugal: Judicial Police (Policia Judiciaria) Judicial authorities involved Belgium: Federal prosecutor office (Parquet fédéral) France: Paris Prosecutor / JUNALCO (Parquet de Paris / JUNALCO) United States: United States Department of Justice (US DOJ) Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The action day on 16 January led to: 92 persons charged 624 locations checked  4 202 vehicles checked 7 019 persons checked Up to EUR 10 000 to cross Bulgaria The joint actions took place across Bulgaria and focused on a number of networks smuggling migrants from Türkiye, via Bulgaria, to Serbia and then Western Europe. The main organisers of the networks active along this route are based in Bulgaria, Serbia and Türkiye. They have created their own national networks of members responsible for the transport and accommodation in their respective countries. The main modes of transportation used by the smugglers were vans, campers and buses. The prices for the full smuggling service in larger groups varied between EUR 2 000 and 3 000 per person. If the migrants were smuggled in a smaller group of 5-6 people, the payments were reaching up to EUR 10 000. Payments for the full trip would be made after the main organiser from Türkiye had confirmed that the migrants had reached the Bulgarian-Serbian border. Increased migratory pressure on the Bulgarian – Turkish border Bulgarian authorities have reported an increase in migrant smuggling activities on their southern border. In August 2022 an incident, which involved a bus transporting irregular migrants, led to the death of two police officers on duty. Later the same year, an officer from Bulgaria’s Border Police was shot dead during regular patrol at the green border with Türkiye. These incidents suggest an increase of both the smuggling activities and the violence of the involved criminal networks.  At the end of last year, Europol increased its support for Bulgarian authorities with the deployment of dedicated analyst. On the action day, 16 January, Europol deployed an expert to Sofia to provide real-time analytical support and cross-check operational information against Europol’s databases.   

During the raids last week, the French officers arrested nine suspects, most of them Moldovan nationals. The gendarmes discovered a quasi-industrial set-up for the production of counterfeit cigarettes in large quantities. They discovered three separate zones in the targeted factory. One of the zones was dedicated to the processing of raw tobacco to produce boxes of cigarettes labelled as well-known brands sold on the legal market. Another zone was dedicated to the storage of large boxes of counterfeit cigarettes. The third zone was used as a living area for the workers with some 15 beds, a kitchen and a living room. This allowed the workers to live at the factory, completely cut off from the external world.  During the raids, the officers seized more than 100 tonnes of illegal products including 55 tonnes of cigarettes in boxes (19.4 million cigarettes and 15 tonnes of cut tobacco), 50 tonnes of packaging materials such as paper, filters and labels, as well as 18 tonnes of waste from the cigarette production process. The estimated value of the seized tobacco is about EUR 17 million. Further to this, the officers seized vehicles, factory machinery and electronic equipment. The seizures also included over a tonne of food products, later donated to food banks. The seized tobacco and counterfeit products were destroyed.  Europol facilitated the information exchange and provided specialised analytical support. On the action day, Europol supported the French authorities by cross-checking operational information against Europol’s databases in real-time and providing leads to investigators in the field.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating major criminal threats. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The Action day on 11 January 2023 led to: 15 arrests, 14 in Serbia and one in Germany; 261 individuals questioned, some of whom are awaiting prosecution (42 in Bulgaria, 2 in Cyprus, 3 in Germany and 214 in Serbia);     22 locations searched (5 in Bulgaria, 2 in Cyprus, 15 in Serbia) including: 4 call centres and 11 residences in Serbia; 2 residences in Cyprus; 2 companies and 3 residences in Bulgaria. Seizures include 3 hardware wallets with about USD 1 million in cryptocurrencies on it and about EUR 50 000 in cash, 3 vehicles, electronic equipment and data back-ups, documents.   At least EUR 2 million in losses  The suspects used advertisements on social networks to lure victims to websites covertly operated by the criminals, which offered seemingly exceptional investment opportunities in cryptocurrencies. The victims, mainly from Germany, would first invest low, three-digit sums. Fake price hikes leading to supposedly lucrative profits for investors then persuaded them to make transfers of higher amounts. Currently, it is estimated that the financial damage to German victims is over two million euro, while other countries such as Switzerland, Australia and Canada also have victims. The investigation suggests that the number of unreported cases is likely to be much higher. This would mean that the illegal gains generated by the criminal groups, with at least four call centres in eastern Europe, may be in the hundreds of millions of euro.  Europol has supported this investigation since June 2022 following an initial request from Germany. During the course of the investigation, Europol facilitated the information exchange, provided analytical support and coordinated operational activities. During the action day, Europol deployed two experts to Bulgaria and Serbia to cross-check operational information in real time against Europol’s databases in order to provide leads to investigators in the field. The experts also provided technical expertise to enable the extraction of information from mobile devices and IT infrastructure. On the day of the action, Eurojust hosted a coordination centre to facilitate the information exchange and support cooperation between involved authorities during the operational activities.     --- Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

Support to Ukraine Following the Russian invasion of Ukraine in February, Europol united with the EU and its Member States in our unwavering support of our Ukrainian friends and colleagues. Russia’s war of aggression caused a humanitarian crisis and prompted large numbers of people to flee from Ukraine to the EU, meaning that opportunistic criminal networks could exploit this situation to further their illicit activities. Europol, alongside the Member States, remains strongly committed to identifying and tackling these criminal threats and working at all levels to support the EU Member States impacted by the conflict.  As part of this ongoing support, the agency is in close communication with the Member States bordering Ukraine, and is currently deploying experts and guest officers to support local law enforcement authorities in these countries. Europol is also actively engaging with Ukrainian law enforcement through the Ukrainian Liaison Officer at Europol headquarters. International hit against Brazilian narcos An extensive investigation involving authorities in Brazil, Spain, Paraguay and the United States, coordinated by Europol’s European Serious and Organised Crime Centre, led to the dismantling of an international criminal organisation shipping Bolivian cocaine into the EU.  The investigative activities revealed that the criminal organisation had developed a production infrastructure in Bolivia, with logistical and supply lines in Brazil, Paraguay and Uruguay, which enabled the shipment of several multi-tonne cocaine consignments to Europe every few months. Investigators also uncovered a distribution network based in Valencia and Barcelona that was responsible for receiving the cocaine shipments and circulating them on the European market. The members of the network used encrypted communications to coordinate their criminal activities, including supplying drugs to Europe and laundering the criminal assets. Listen to the Europol Podcast episode on this case. Hanging up on call centre scams Call centre scams have become more prevalent in recent years, with fake ‘traders’ persuading victims to part with their savings by promising lucrative investment opportunities. However, these too-good-to-be-true opportunities are typically scams.  In March 2022, Europol’s European Financial and Economic Crime Centre supported an investigation by Lithuanian and Latvian authorities into one such scam. The operation led to raids of three call centres belonging to the same organised crime group. More than 100 people in Riga and Vilnius were detained on suspicion of being involved in an international call centre scam that was believed by investigators to have turned an illegal profit of over EUR 3 million per month. Listen to the Europol Podcast episode on this case. Cutting power to world’s biggest hacker forum Operation TOURNIQUET, which took place in April, was coordinated at the international level by Europol’s European Cybercrime Centre that culminated in the shutdown of ‘RaidForums’ – one of the world’s biggest hacker forums. The operation was the culmination of a year of meticulous planning between U.S., UK, Swiss, Portuguese and Romanian law enforcement authorities.  At its peak, the forum had a community of more than a million users. It made a name for itself by selling access to high-profile database leaks belonging to a number of US corporations across different industries. These contained information for millions of credit cards, bank account numbers and routing information, and the usernames and associated passwords needed to access online accounts. In addition to the domain seizure, the forum’s administrator and two of his accomplices were arrested, and additional infrastructure seized. Disrupting migrant smuggling across the English Channel The smuggling of migrants across the English Channel is a very dangerous modus operandi that increased shortly before the start of the COVID-19 pandemic. Europol’s European Migrant Smuggling Centre (EMSC) has been actively monitoring and supporting law enforcement efforts to effectively tackle these developments by establishing Operational Task Force Dune. The OTF includes authorities from Belgium, France, Germany, the Netherlands and the UK, and is coordinated by Europol. Authorities focus on a number of high-level smugglers, known as High-Value Targets, whose prosecution could seriously disrupt or even halt the functioning of this criminal network. In July 2022, more than 39 suspects were arrested across France, Germany, the Netherlands and the UK, including 3 High-Value Targets. Investigators estimated that the network could have smuggled up to 10 000 migrants in the past year and a half, with as much as EUR 15 million in criminal profits. Confronting labour exploitation across EU  During an EU-wide coordinated action week in July 2022, authorities identified more than 500 employers linked to labour infringements and over 480 possible victims. Europol supported the action days, which were led by the Netherlands and co-led by France, Italy, Romania and the United Kingdom and involved 29 countries. The actions were implemented as part of the European multidisciplinary platform against criminal threats, known as EMPACT. The action week mobilised nearly 18 500 officers, who searched more than 10 467 locations, 32 525 vehicles and more than 86 000 persons to detect different administrative infringements and criminal offences. These checks led to the detection of a significant number of companies linked to infringements of employment law. This year’s inspections focused on a number of labour-intensive sectors such as mining, home healthcare services, nail bars, cleaning services, restaurants and food delivery services. Vietnamese nationals are especially vulnerable to labour exploitation, predominantly in nail bars. Home healthcare is also a sector that is susceptible to exploitation. This is especially difficult to detect as it happens behind the closed doors of households. Eastern European nationals often fall victim to domestic servitude with reports of cases in Spain, Italy, the Netherlands and the United Kingdom. Authorities also focused on detecting the possible exploitation of Ukrainian refugees.    Super cartel controlling one-third of Europe’s cocaine trade taken down There is no safe haven for drug lords. This was the message sent by Operation Desert Light, a series of coordinated raids carried out across Europe and the United Arab Emirates in November 2022. The raids targeted both the command-and-control centre and logistical drug trafficking infrastructure in Europe. A total of 49 suspects were arrested during the course of the investigation, which were run in parallel in Spain, France, Belgium, the Netherlands and the UAE. The suspects had come together to form what was known as a ‘super cartel’ that controlled around one-third of the cocaine trade in Europe. The scale of cocaine importation into Europe under the suspects’ control and command was massive and over 30 tonnes of drugs were seized by law enforcement over the course of the investigations.

The report confirms that the need for cross-border digital evidence is on the rise The report reflects on the complexity of cross-border investigations involving digital evidence, offering extensive feedback from officials of EU Member States’ law enforcement and judicial authorities.  It shows that there was a 36% increase in the volume of requests for data to OSPs in 2021, while the number of Emergency Disclosure Requests increased by 29%.  The success cases presented in this report also show how digital evidence is crucial in all crime areas. The SIRIUS platform remains the leading source of knowledge The report confirms that the SIRIUS platform, hosted on the Europol Platform for Experts, remains the number one source of information for law enforcement and judicial practitioners seeking know-how in relation to data acquisition methods in cross-border circumstances.   Ongoing technological transformation While the relevance of Online Gaming Platforms in criminal investigations is stable, there is growing concern that technology linked to the metaverse will pose considerable challenges for law enforcement in the near future. For instance, the use of the metaverse is conceptually different from existing mainstream platforms, meaning that user behaviour could become more important than user generated content in future investigations. The need for strengthening capacity and mutual trust  Advances in technology and the ever-expanding digital landscape are the sources of many challenges, including the risk of losing digital data and difficulties in establishing the applicable jurisdiction. For judicial and law enforcement practitioners to tackle these challenges successfully, they will need to join forces, share knowledge and commit to daily interoperability. These collaborative efforts will lead to a ‘toolbox’ of shared investigative and prosecutorial solutions that aim to evolve in tandem with legislative developments.  The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under contribution agreement No PI/2020/417-500.

Pioneering AI technology Europol used this AI tool to specifically generate portraits of law enforcement officers inspired by the style of renowned artists. This experimentation led to new and innovative representations of law enforcement that contrast with some of the default imagery generated by AI on this subject in the past. Human oversight This technology was carefully used by Europol to generate ideas, but the final version of the calendar was ultimately as a result of the decisions made by the designers during the creative process. Each image was created using a particular sequence and combination of written prompts. This method was applied in an iterative approach, with a view to creating a detailed image in a certain style as already envisioned by the designer.  Responsible innovation AI is becoming invaluable for law enforcement authorities all over the world and Europol embraces this type of responsible innovation. Rather than a tool to replace human design skills, AI technology functions as an extension of the designer. The ideas generated by this technology have inspired the designer’s free and creative choices for the final versions of the images included in this calendar. It is an example of how the combination of AI and human oversight can result in the creation of a unique and memorable final design. The calendar can be ordered for free and citizens need only pay the postage costs. Calendars are available for delivery from 22 December 2022.  

The investigators uncovered that an estimate of 250 tonnes of fireworks were stored in a bunker complex in Germany, about 20 kilometres from the border with the Netherlands. The suspects involved in this illegal scheme attempted to circumvent the strict regulations for the sale of fireworks by hiding behind the façade of legal company, registered for the sale of authorised fireworks. In fact, the trade of fireworks is very highly regulated due to the dangerous aspect of the merchandise. The free sale of heavy fireworks is strictly forbidden. Criminal networks also use the heaviest categories of fireworks, such as the ones seized during the action day, to perpetrate violence or to facilitate their criminal activities during, for example, ATM attacks.   The year-long investigation exposed a Dutch criminal network illegally trading with dangerous, highly explosive fireworks. The investigation was initiated in 2021 based on an anonymous tip coupled with intelligence from other investigations into the trafficking of illegal fireworks. The suspects stored the heavy fireworks in unsecured locations, while illegally selling these extremely dangerous goods to the public – despite such fireworks being banned for open sale. The illegal storage and sale of such highly regulated explosive materials poses a serious risk to the safety of users, and also to unaware people living in the areas surrounding the storage facilities.  The illegal sale of fireworks targeted A dedicated taskforce was also set up at Europol to target the trafficking of illegal fireworks. 350 tonnes of illegal heavy fireworks, with a commercial value of up to EUR 25 million, were already seized in November this year. Back then, stockpiles of cash were also discovered at the same time. Europol coordinated operational activities, facilitated information exchange and provided analytical support.  During this new operation also targeting the trafficking of heavy fireworks, Europol deployed two experts to provide real-time technical and analytical support to the investigators on the spot.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

During the operation, law enforcement officers dismantled 59 criminal groups and arrested or reported to the judicial authorities 349 suspects. Simultaneously, authorities seized massive amounts of misused, falsified or counterfeit medicines, doping products and substances and illegal food and sport supplements, as well as counterfeit COVID vaccines, sanitary products and medical devices. Doping substances and medicines for erectile dysfunction were amongst the most seized items. In order to increase prevention and awareness, some participating states launched anti-doping campaigns and performed both ‘in-competition’ and ‘out-of-competition’ controls. Operation Shield III in a nutshell:seizures worth over EUR 40 million more than 10.5 million units of medicines and doping substances seizedover 1 million counterfeit COVID tests seized195 investigations carried out349 suspects arrested or reported to judicial authorities59 organised crime groups investigated10 underground labs shut down588 websites monitored 89 websites shut downover 218 000 shipments checked over 74 000 shipments seized 3 526 anti-doping controls ‘in-competition’ carried out (39 positive)3 245 anti-doping controls ‘out-of-competition’ carried out (9 positive)Misuse of medicine a serious societal issueThe trade and consumption of medicines not prescribed by medical professionals or a medical framework continues to pose a social problem, fostering illegal activity. Misuse spans the desire for psychotropic, recreational or performance-enhancing effects and extends to unintended means of consumption. This can cause growth in demand that is unable to be legally met, which incentivises trafficking - mostly with product diverted from the legitimate supply chain.In addition, falsified medicines are introduced among those diverted from the legitimate supply chain. These are manufactured in underground laboratories where criminals work under questionable hygienic circumstances and safety measures, leading to health risks for end consumers. Furthermore, counterfeit medicines will often not produce the desired effect and leave the consumer untreated. Medicine trafficking lucrative for organised crimeIn the course of the operation, many cases of large-scale medicine trafficking were uncovered, confirming that it can be as lucrative as or even more lucrative than narcotics trafficking. While these crimes generate massive illicit gains for traffickers and counterfeiters, the public finances and the social care systems of some Member States are inflicted with massive financial costs. The public health cost is also significant, be it because of treatment of addictive behaviours or the consequences of overdoses or stock shortage.Organised crime group dismantled in GreeceThe Greek Financial Police Division disrupted an organised crime group with a hierarchical structure, distinct roles and a years-long history of smuggling anabolic steroids and other illegal pharmaceutical products such as erectile dysfunction remedies. Members of this particular group were active in Greece and held other minor hubs in Europe, the US and Asia. Two labs in Greece were used to turn raw material trafficked through Moldova and Bulgaria into various products. Sales were conducted through websites and encrypted e-mail addresses to an international clientele including dozens of professional athletes. A large-scale police operation led to the arrest of one leading member of the organised crime group and the seizure of more than 2.4 million units of anabolic steroids and other illicit substances, as well as packaging material. Significant reduction in COVID-19-related traffickingWhile criminal networks are still exploiting opportunities offered by the COVID-19 pandemic, trafficking with medicines and protective equipment has met a significant decrease due to the high attention to the topic and intense monitoring by law enforcement. Governments offering the vaccines at no cost contributed to creating a disadvantageous situation for criminals aiming to feed an illegal market. Several fraud attempts targeting national bodies responsible for the supply of medicines and protective devices could be detected and thwarted. EU Member States: Austria, Belgium, Bulgaria, Croatia, Cyprus, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Lithuania, Netherlands, Poland, Portugal, Romania, Slovakia, Spain.Third-party countries: Albania, Bosnia and Herzegovina, Colombia, Georgia, Iceland, North Macedonia, Serbia, Switzerland, United States.

The participating authorities were involved in detecting and flagging terrorist content to online service providers and evaluating their responses. The activities resulted in the referral of 831 items to 34 affected platforms. Referred materials include content produced by or favouring proscribed right-wing extremist organisations. It also includes content disseminated in relation to terrorist attacks motivated by violent extremism. Such materials include livestreams, manifestos, claims and celebrations of attacks.  Violent extremism still a growing concern since Bratislava and Buffalo Since the first Referral Action Day targeting this type of online content in 2021, the threat posed by violent extremism and terrorism is still on the rise. The terror attacks in Buffalo (USA) and Bratislava (Slovakia) illustrated a concerning proliferation of violent right-wing extremist and terrorist activities on a global scale. The perpetrators of these attacks were part of transnational online communities and took inspiration from other violent right-wing extremists and terrorists. In their manifestos, terrorist actors have highlighted the pivotal role of online propaganda in the radicalisation process. This shows how the abuse of the internet continues to be an important aspect of violent right-wing radicalisation and recruitment.  RADs consolidate law enforcement’s efforts to tackle the creation and dissemination of violent extremist and terrorist propaganda online. During the coordinated activities, the participants refer content linked to propaganda material to online service providers, inviting them to evaluate and remove the content breaching their terms of service. The platforms are invited to reinforce their moderation protocols to avoid this type of abuse in the future.  *Czechia, Denmark, France, Germany, Hungary, Ireland, Italy, Malta, The Netherlands, Portugal, Slovakia, Slovenia, Spain, United Kingdom.  --- Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Known as Operation Power Off, this operation saw law enforcement in the United States, the United Kingdom, the Netherlands, Poland and Germany take action against these types of attacks which can paralyse the internet.   The services seized were by far the most popular DDoS booter services on the market, receiving top billing on search engines. One such service taken down had been used to carry out over 30 million attacks.  As part of this action, seven administrators have been arrested so far in the United States and the United Kingdom, with further actions planned against the users of these illegal services.  International police cooperation was central to the success of this operation as the administrators, users, critical infrastructure and victims were scattered across the world. Europol’s European Cybercrime Centre coordinated the activities in Europe through its Joint Cybercrime Action Taskforce (J-CAT). This international sweep follows previous editions of Operation Power Off which targeted the administrators and users of the DDoS marketplace webstresser.org.  Participating authorities United States: US Department of Justice (US DOJ), Federal Bureau of Investigation (FBI) United Kingdom: National Crime Agency (NCA) The Netherlands: National High Tech Crime Unit Landelijke Eenheid, Cybercrime team Midden-Nederland, Cybercrime team Noord-Holland and Cybercrime team Den Haag Germany: Federal Criminal Police Office (Bundeskriminalamt), Hanover Police Department (Polizeidirektion Hannover), Public Prosecutor’s Office Verden (Staatsanwaltschaft Verden) Poland: National Police Cybercrime Bureau (Biuro do Walki z Cyber-przestępczością)   DDoS-ing is a crime  DDoS booter services have effectively lowered the entry barrier into cybercrime: for a fee as low as EUR 10, any low-skilled individual can launch DDoS attacks with the click of a button, knocking offline whole websites and networks by barraging them with traffic.  The damage they can do to victims can be considerable, crippling businesses financially and depriving people of essential services offered by banks, government institutions and police forces. Emboldened by a perceived anonymity, many young IT enthusiasts get involved in this seemingly low-level crime, unaware of the consequences that such online activities can carry. DDoS-ing is taken seriously by law enforcement. Size does not matter – all levels of users are on the radar of law enforcement, be it a gamer booting out the competition out of a video game, or a high-level hacker carrying out DDoS attacks against commercial targets for financial gain. The side effects that a criminal investigation could have on the lives of these DDoS users can be serious, going as far as a prison sentence in some countries.  

As the first joint publication of this kind, the report emphasises the hand-in-glove approach between the agencies in the common fight against global drug trafficking. Titled 'Complexities and conveniences in the international drug trade: the involvement of Mexican criminal actors in the EU drug market', the publication is a result of systematic and continuous exchange of operational and strategic information. The EU’s most recent Serious and Organised Crime Threat Assessment showed that criminal networks across the EU are increasingly international and specialised in scope, with 65 % of criminal groups active in the EU composed of members of multiple nationalities. The presence of Mexican criminal actors collaborating with EU-based actors in the EU drug market follows this trend. Cartel cooks in service of EU-based criminal networks The joint report delves into how the involved criminal networks cooperate with one another, particularly through the use of specialised actors at different points in their operations. The different actors include facilitators such as brokers, laboratory specialists, envoys, intermediaries and money laundering service providers. Law enforcement have arrested Mexican laboratory specialists – also known as 'cooks' – working in EU-based production sites. These actors are especially important due to their unique knowledge of how to produce higher yields of more potent end product, and obtain larger and more profitable crystals of methamphetamine.  The report also states that Mexican cartels are known to cooperate with EU-based criminal networks to traffic both methamphetamine and cocaine to EU ports for further distribution with the EU or transit to even more lucrative markets of Asia and Oceania. The use of concealed shipments – such as cocaine hidden in blocks of cellular thermal concrete – or the plans to establish cocaine smuggling routes from Colombia to airports in southern Italy using private jets show the ever-evolving nature of these criminal activities. Corrupt officials in the public and private sectors act as facilitators and help to increase the likelihood of successfully trafficking drug consignments to the EU. On US soil, Mexican cartels have a history of establishing drug trafficking hubs and strong criminal partnerships, and of using violence to gain control over the territory where they operate. An increased presence of Mexican cartels in the EU could also result in increased profits for them and their EU-based criminal collaborators, as well as an increase in violence in the EU. The DEA and Europol will continue to act in concert in monitoring and fighting these developments.  

This money laundering ring is believed to have funnelled millions of euros through bank accounts in Europe before sending the funds to Spain to purchase real estate. The individual at the centre of this money laundering scheme has been arrested in the Canary Islands. A total of 75 properties have been seized so far across Spain for a cumulative value of EUR 25 million. The EUR 219 million at the heart of the fraud is known as the Magnitsky case. Its name derives from the Russian tax lawyer Sergei Magnitsky who died in a Russian prison in 2009 after having uncovered massive tax fraud carried out by Russian tax officials.  The Spanish investigators were able to uncover how part of that dirty money ended up in Spanish real estate. A group of individuals were identified – all Russian nationals with little or no ties to Spain, alongside a number of shell companies with no real economic activity.  The dirty money was either sent to the bank accounts of these Russian citizens supposedly residing in Spain for them to purchase properties, or sent to Spanish real estate agencies with strong ties to the Russian community which would buy real estate on behalf of alleged clients.  Europol’s European Financial and Economic Crime Centre provided specialised support to the investigation. One of its specialists was deployed to Tenerife to provide on-the-spot support to the Spanish investigators during the action day.  Eurojust provided significant support by managing European investigation orders and information requests sent to 12 different jurisdictions.  The investigation in Spain was carried out by the Spanish National Police (Policía Nacional) under the coordination of the Special Prosecutor’s Office Against Corruption and Organised Crime, and the Central Court of Instruction No.2 of the National High Court.  

On 29 November, the EPPO, in cooperation with law enforcement agencies in 14 EU Member States and with the support of Europol, carried out simultaneous investigative measures in relation to a complex VAT fraud scheme based on the sale of popular electronic goods.  Over 200 searches were carried out in Belgium, Cyprus, France, Germany, Greece, Hungary, Italy, Lithuania, Luxembourg, the Netherlands, Portugal, Romania, Slovakia and Spain. Within the framework of the EPPO operation, searches had previously been conducted in Czechia, Hungary, Italy, the Netherlands, Slovakia and Sweden on 12 and 13 October 2022.  The case started in April 2021 after the Portuguese Tax Authority in Coimbra started looking into a company selling mobile phones, tablets, earphones and other electronic devices, on suspicion of VAT fraud.  The case was passed on to the EPPO in June 2021. Since then, the EPPO, Europol’s European Financial and Economic Crime Centre (EFECC) and national law enforcement authorities have established connections between the suspected company in Portugal and close to 9 000 other legal entities, and more than 600 natural persons located in over 30 countries. Results so far  312 house searches; 24 arrests in Portugal, Italy and France. Seizures 529 bank accounts; shares of 21 legal persons; 81 real estate properties; 31 luxury cars; over EUR 2.5 million in cash;  104 valuable watches; Connected earbuds of an estimated value of EUR 2 million; 42 luxury accessories;  1 Kalashnikov; Total value of seizures (so far): EUR 67 million.   Europol’s role  Upon the request of the European Delegated Prosecutor for Portugal, Europol has been supporting this case since December 2021.  Europol’s EFECC has been providing extensive analytical support by cross-checking the evidence against its databases and mapping out the key targets and their criminal activities. In addition, Europol’s EFECC has facilitated the obtainment of financial information from Financial Intelligence Units across Europe in the framework of the EU Directive 1153/2019.  During the action day on 29 November, six Europol experts were deployed on location to assist with the investigative measures at a national level. ***  All the data collected is being analysed, and the investigation into the organised crime groups behind this scheme is continuing. Measures to recover the damages have been undertaken.  

The goal for law enforcement at the World Cup Europol’s crime centres are monitoring for potential threats stemming from the World Cup, so as to support local authorities responsible for the safety of fans and the wider tournament. As a result of open source and intelligence monitoring, Europol has detected and advised on threats including the following: potential threat to safety of match attendees, cyber threats, phishing campaigns relating to tickets and counterfeit products, extremist propaganda. Europol’s Operational & Analysis Centre has been working closely with the FIFA World Cup Qatar 2022 Safety & Security Operations Committee for more than one year, in order to prepare a tailored support package, including: on the spot deployments,  back office support from Europol’s 24/7 Operational Centre,  a support network consisting of nominated Points of Contact from all the Centres of the Operations Department, support from Europol’s international network of Liaison Bureaus. Closing the net on organised crime Large sporting events can attract organised crime groups as they attract vast numbers of spectators and a lot of economic activity. Organised crime groups are highly adaptable, and can be quick to find and exploit opportunities for illicit profits. Speaking about Europol’s approach to supporting international sporting events, Julia Viedma, Head of Europol’s Operational & Analysis Centre, remarked: International sporting events are some of the largest public gatherings in the world. Law enforcement’s role should be protecting the fans, the organisers and the participants themselves, so they can get on with enjoying the tournament in safety. We are grateful to our partners in Qatar and the IPCC in Doha for providing an excellent platform for law enforcement cooperation. With hundreds of thousands of fans in Doha, Europol will participate in the IPCC for the entire duration of the tournament and remain vigilant for threats in the aftermath of the 2022 World Cup.  

The action day on 7 December led to: 8 arrests (5 in Germany, 2 in Lithuania and 1 in Poland)  17 locations searched (14 in Germany, 2 in Lithuania and 1 in Poland)   12 transfers detected with 13 facilitators and 30 migrants seizures include electronic equipment, various documents, and cash The smuggling network is linked to over 100 smuggling incidents  The criminal network, composed mainly of Syrian and Turkish nationals, arranged the entire trip of Iraqi migrants from Baghdad to the EU via diverse smuggling corridors. The migrants recruited in Iraq travelled to Russia via Turkey and then to Belarus before entering the EU through the borders of Latvia, Lithuania and Poland. The final destinations were predominantly Germany and, to a lesser extent, Finland. The members of the criminal network were based in and acting from the countries across the smuggling route.  This large criminal network, connected to over 100 smuggling incidents, was divided hierarchically. The majority of the individuals involved in the smuggling operations did not knowing each other personally. The money flows were arranged via the hawala underground financial system and through the use of cryptocurrency. Hawaladars based in Berlin (Germany) were also used to execute payments for the drivers against a proof of delivery such as pictures of migrants at their final destination.  The smugglers arranged the travel by plane as far as Belarus. Then they used local drivers, mainly Ukrainian nationals, to complete the last leg of the smuggling route leading to the EU via land. The suspects charged between EUR 3 000 and 15 000 per person, with an estimated money flow worth at least EUR 16 million. Once in Belarus and unable to return to their countries of origin, some migrants arranged the final trip into the EU on their own. A number of groups on social media messaging platforms were created to advertise illegal smuggling activities from the border area to Germany. Reportedly, the drivers asked between EUR 500 and 1 000 per person for this criminal service. Smuggling in life-threatening conditions, including transport in overcrowded vehicles in loading platforms, was also reported. In a single incident, a migrant was found dead in Germany, abandoned in critical health condition by the driver close to the German/Polish border. Europol’s Task Force Flow to increase the law enforcement response to the crisis In February 2022, Europol set up Operational Taskforce Flow (OTF) Flow, currently operating from Vilnius. The investigations supported by the OTF have so far led to over 40 arrests, and the detection of about 100 transfers of more than 1 000 migrants in total. During the action day on 7 December 2022, Europol deployed, in addition to the staff already sent to the OTF, three experts to Germany and Poland to cross-check operation information against Europol’s databases in real time, perform digital forensics, and support the investigators in the field with new leads. Operational Task Force Flow is composed of representatives from law enforcement authorities from Estonia, Finland, Germany, Latvia, Lithuania and Poland, as well as Europol experts. This special set-up was created specifically to support national authorities in combating the increased migrant smuggling activities across the EU-Belarus border. Through OTF Flow, Europol supports the coordination of joint investigative and operational activities and facilitates the information exchange between the involved law enforcement authorities. The OTF was created following the Joint Investigative Cell (JIC), set up by Lithuania in June 2021, to tackle the newly-emerged phenomenon of migrant smuggling from Belarus then affecting Latvia, Lithuania and Poland.  Law enforcement authorities involved:  Estonia – Estonian Police and Border Guard (Politsei- ja Piirivalveamte) Germany – German Federal Police (Bundespolizei)  Latvia - State Border Guard Lithuania – State Border Guard Service (Valstybės sienos apsaugos tarnyba) and National Police (Lietuvos policija)  Poland – Border Guard (Polska Straż Graniczna)   

Heading towards Europe, the 21 meter-long vessel was intercepted in international waters off the coast of Sierra Leone. Its illegal shipment is believed to be worth in excess of EUR 150 million. An investigation is underway to identify the criminal groups involved on either side of the Atlantic Ocean.  Participating authorities  Brazil: Federal Police (Polícia Federal) France: National Police (Police Nationale – OFAST), National Navy (Marine Nationale) United Kingdom: National Crime Agency (NCA)  United States: US Drug Enforcement Administration (US DEA)  Europol: European Serious Organised Crime Centre  Maritime Analysis and Operation Centre – Narcotics (MAOC – N) The cocaine infrastructure  Underpinning the drug trafficking activities is a transport infrastructure that connects Latin American source countries with areas of consumption. Europol’s unique capabilities has positioned the Agency as the place where such crucial intelligence emerges. Europol currently hosts at its headquarters over 250 liaison officers from over 50 countries and organisations, which sees law enforcement from countries across the world working side by side to fight the most dangerous criminal networks. Coupled with Europol’s work into the encrypted means of communication used by criminals, this coordinated intelligence-led approach is delivering tangible results in the fight against maritime drugs trafficking. 

In total, 34 countries across Europe, supported by EU agencies and international organisations*, took part in these large-scale coordinated actions. The EMPACT Joint Action Days were planned based on an intelligence-led approach in which police, customs, immigration agencies and border control agencies joined forces.  Checks at borders and locations vulnerable to exploitation  In the framework of the EMPACT Joint Action Days, national authorities targeted human trafficking for sexual exploitation, forced begging and forced criminality. Officers made special checks at borders, bus and train stations, and locations vulnerable to exploitation such as brothels, massage parlours, shelters for families, shelters for victims of domestic violence and hospitals. National authorities also performed preventive actions. For example, Romanian authorities conducted awareness-raising and preventive activities to identify potential victims of human trafficking on their way to destination countries. These activities focused on checks and controls of persons and vehicles, controls in street prostitution areas, and awareness-raising of the threat of human trafficking and exploitation.  National authorities developed a number of investigations linked to the action days. One example is the identification of an individual suspected of child sexual exploitation in Croatia. The suspect was luring victims, mainly minors, via social networks. The investigative activities led to the identification of 16 victims, 14 of which were minors.  UK authorities also conducted focused activities targeting child sexual exploitation. Police forces visited children vulnerable to exploitation and disseminated training materials to hotels and local authorities to help identify children in need of help. During the JAD, approximately 20 % of potential victims identified in the United Kingdom were minors. Results of the actions targeting human trafficking 254 arrests; 910 potential victims identified; 115 suspected traffickers identified; 18 430 officers involved; 205 new cases opened. Global results of the EMPACT Joint Action Days conducted in October 2022 636 arrests; 910 potential victims of human trafficking identified; 2 476 illegal entries detected; Seizures include 106 firearms, half a tonne of drugs (mainly heroin and cannabis), electronic equipment and about EUR 1.7 million in cash; 335 new investigations initiated.   Police, gendarmerie, border guards, customs authorities and national units involved in combating organised crime across Europe cooperated in these EMPACT Joint Action Days. The intelligence-led approach, operational coordination across borders and joint work of all authorities involved contributed to increased interceptions. The information exchange led to the opening of 335 new cases against criminal networks involved in firearms trafficking, drugs trafficking, migrant smuggling and trafficking in human beings. Europol coordinated the exchange of operational information during the EMPACT Joint Action Days and supported the operational coordination. Europol also deployed experts on the ground to provide real-time analytical support to field operatives.  Europol’s officers deployed to Moldova earlier this year, as part of Europol’s support to bordering countries in the context of the war of aggression against Ukraine, also contributed to the action days.  Overall participants in all Joint Action Days EU Member States: Austria, Bulgaria, Croatia, Cyprus, Denmark, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.  Non-EU countries: Albania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, Switzerland, Türkiye, Ukraine and United Kingdom.  EU Agencies: Europol, Eurojust, Frontex International and institutional partners: EUBAM, IPA/2019  (Instrument for Pre-Accession Assistance) countering serious and organised crime in the Western Balkans, INTERPOL, PCC SEE (Police Cooperation Convention For Southeast Europe Secretariat), SEESAC (South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons) and SELEC (Southeast European Law Enforcement Center). * This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.  

During an operational phase carried out between mid-September to the end of November 2022, 8 755 money mules were identified alongside 222 money mule recruiters, and 2 469 individuals were arrested worldwide.  Now in its eighth edition, the European Money Mule Action (EMMA8) has gone international, with actions carried out in countries as far apart as Colombia, Singapore and Australia.  EMMA is the largest international operation of its kind, built around the idea that public-private information sharing is key to fighting complex modern crimes. This year, and with the continuing coordination of the EBF, around 1 800 banks and financial institutions supported law enforcement in this action, alongside online money transfer services, cryptocurrency exchanges, Fintech and KYC companies, and multinational computer technology corporations.   Overview of the results  2 469 money mules arrested; 1 648 criminal investigations initiated; 4 089 fraudulent transactions identified; EUR 17.5 million intercepted. Participating countries  Australia, Austria, Bulgaria, Colombia, Cyprus, Czech Republic, Estonia, Greece, Hungary, Singapore and Hong Kong (China), Ireland, Italy, Moldova, Netherlands, Poland, Portugal, Romania, Slovak Republic, Slovenia, Sweden, Switzerland, Spain, United Kingdom, United States. A link in the money laundering chain Have you ever been asked to help transfer money by: •    An online friend or love interest? •    Someone offering a way to make easy money? •    Someone claiming to need help as they can’t use their own bank account? If yes, you may have been talking to a money mule recruiter - and if you did what they asked, you may have committed a crime. The issue may seem trivial, yet the amount of criminal money being laundered through this method is not. Money mules are a significant part of the money laundering landscape, enabling criminals to swiftly move funds across a network of accounts, often in different countries.  The use of money mules is especially widespread in cybercrime, with the mules transfer the proceeds from their jurisdiction to the criminal’s home country. #DontBeaMule This week Europol, together with international partners, the European Banking Federation and financial institutions, will be raising awareness about this crime and its criminal implications through the #DontBeaMule campaign.  The campaign is available for download in 26 languages and will inform the public about how these criminals operate, how they can recognise the signs and what to do if they become a target.  Do you think you might be used as a mule? Act now before it is too late: stop transferring money and notify your bank and your national police immediately. EMMA8 was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) Cybercrime OFS Operational Action Plan led by the Netherlands.   

The investigation uncovered a large criminal network, which was altering the traceability of horse meat by falsifying transfer and identification documents. During the operational activities, national authorities arrested 35 individuals, including the heads of the network, while targeting 6 companies linked to the criminal organisation. During the raids in Spain, authorities seized half a tonne of horse meat unfit for consumption. Active international cooperation, facilitated by Europol, enabled the dismantling of the criminal scheme with six other arrests made by the Belgian Federal Police. The suspects involved in the criminal network had different functions: from the ones who slaughtered the animals without the necessary controls to the individuals dealing with the transport, the veterinarians providing false documents and the butcher facilities, which sold the meat unfit for consumption. Animal abuse generating millions in illegal profits The suspects acquired horses from across Spain for free or by paying up to 100 euros per animal. Due to several factors, these animals were not destined for the food market and the potential illegal profit was substantial. Once the leader of the criminal network acquired enough livestock to activate the illegal scheme, they set up a complete cattle exploitation facility in 2019 and started exporting the meat to other European markets. Spanish officers raided the clandestine facilities and uncovered 80 horses, which had been abused and were suffering from various untreated diseases due to the lack of veterinary control. This lack of supervision posed a significant risk for the development of zoonotic diseases transmittable to humans. Moreover, the animals endured poor conditions in the cattle facilities, a lack of food and water, as well as permanent stress situations during transport. Even a single illegal shipment generated 35 000 euros for the transporters, with an estimated turnover of EUR 4.5 million in turnover on the logistical side. The criminal network turned dirt into diamonds: horses, that were written off and worth only EUR 100 each, generated illegal profits of about EUR 1.5 million.  Europol coordinated the operational activities, facilitated the information exchange and provided analytical support to national law enforcement authorities. During the action days, Europol deployed experts to Belgium and Spain to cross-check operational information against Europol’s databases in real time and provided leads to investigators in the field.  

Over half of all criminal investigations today involve a cross-border request for electronic evidence. Due to the ongoing development of new technologies, more criminal investigations than ever are dependent on prompt, secure and legal means of sharing electronic evidence across borders. This goal is what guided this year’s SIRIUS conference. The SIRIUS Conference Programme The first day saw a wide-ranging dialogue with policy experts, judicial practitioners and technology companies discussing the latest developments, challenges and the future of digital evidence. The SIRIUS team provided an overview of the progress made in the last year as well as a peek into the upcoming SIRIUS EU Digital Evidence Situation Report 2022.  The second day, restricted to representatives of law enforcement and judicial authorities, explored the process of obtaining electronic evidence in various jurisdictions and crime areas, and delved into the rapidly developing field of Open Source Intelligence (OSINT). This two-day event highlighted the progress that the SIRIUS project has made to date, reflected by its ever-expanding membership and the growing popularity of its key products and services.   The SIRIUS project is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by OSPs. These services are available to law enforcement and judicial authorities via a platform and an application. To this day, SIRIUS serves a community of competent authorities from over 50 countries, representing all EU Member States and a growing number of third countries. The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under contribution agreement No PI/2020/417-500.  

As of this year’s Cyber Monday, law enforcement agencies across several continents have taken down 12 526 websites, disconnected 32 servers used to distribute and host illegal content for 2 294 television channels and shut down 15 online shops selling counterfeit products on social media sites. In the physical realm, investigators seized 127 365 counterfeit products such as clothes, watches, shoes, accessories, perfumes, electronics and phone cases worth more than EUR 3.8 million.  Criminals living lavish lifestyles In the course of the operation, 10 search warrants were issued and 14 people were detained or formally accused of intellectual property crimes. In one specific action, Spanish Police arrested four people and one person was formally charged. According to preliminary investigative results, the prime suspect in this investigation was earning up to EUR 150 000 a month and living a lavish lifestyle in a luxury house, driving expensive cars and embarking on extravagant vacations all over the world. The criminal network dedicated itself to large-scale marketing and distribution of pirated audio-visual content  on the internet. As part of the operation, Spanish police disconnected 32 servers hosting the illicit content and seized cash, documents and two luxury vehicles. The Bulgarian Cybercrime Unit investigated a criminal network using Facebook accounts and websites to sell counterfeit clothes imitating well-known brands. In a coordinated action, a number of house searches were conducted and a workshop with sewing and embossing machines was discovered. Authorities seized fake stickers, the labels of well-known trademarks, unbranded articles ready to be processed, 600 counterfeit articles worth EUR 35 000 and an illegally possessed firearm.  These discoveries show once more that the production of counterfeit products increasingly takes place within the European Union. Additionally, it emphasises the growing overlap of intellectual property crimes with tax evasion and money laundering. The high-profit nature of the criminal activities also reaffirms the importance of law enforcement in conducting financial investigations and asset recovery concurrently.  Consumers to be cautious when shopping online The results of this operation act as a reminder to be extra cautious when shopping online to avoid buying counterfeit products through illicit platforms. Not only can such illicit products present serious health and safety risks to consumers, but the proceeds can also serve criminal networks involved in other forms of crime. The internet offers these criminals a certain level of anonymity and the possibility of covering their tracks. Its borderless nature facilitates criminal activities that largely take place at an international level. A domain, an IP address or a server may be registered in one country, the bank account for payments in another, while packages are sent from yet another country. This is often being orchestrated by criminals who are not located in any of these jurisdictions.  Organised crime groups frequently use established social media platforms to promote their websites and guide potential consumers to online sales platforms. Websites offering illicit products may also profit from advertisements. Occasionally, even prestigious brands may accidentally publish their ads on such domains, which might cause reputational harm and loss of investment. In certain cases the advertisements placed on commercial platforms (which are infringing intellectual property rights) may expose the consumer to malware or spyware, which is another reason to be extra careful and check Europol’s advice when shopping online.   Europol’s role Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

Between 8-19 November, coordinated raids were carried out across Europe and the United Arab Emirates (UAE), targeting both the command-and-control centre and the logistical drugs trafficking infrastructure in Europe.  A total of 49 suspects have been arrested during the course of this investigation. The drugpins considered as high-value targets by Europol had come together to form what was known as a ‘super cartel’ which controlled around one third of the cocaine trade in Europe.  These arrests are the culmination of parallel investigations run in Spain, France, Belgium, the Netherlands and the UAE with the support of Europol into the activities of this prolific criminal network involved in large-scale drugs trafficking and money laundering.  The scale of cocaine importation into Europe under the suspects’ control and command was massive and over 30 tonnes of drugs were seized by law enforcement over the course of the investigations.  Participating law enforcement authorities:   Spain: Civil Guard (Guardia Civil)  France: National Police (Police Nationale – OFAST)  Belgium: Federal Judicial Police Brussels (Federale Gerechtelijke Politie Brussel/Police Judiciaire Fédérale de Bruxelles), Federal Judicial Police Antwerp (Federale Gerechtelijke Politie Antwerpen) The Netherlands: National Police National Criminal Investigations Division and Police Unit Rotterdam (Nationale Politie - Dienst Landelijke Recherche en Eenheid Rotterdam) United Arab Emirates: Ministry of Interior (وزارة الداخلية) Dubai Police Force (القيادة العامة لشرطة دبي) United States: US Drug Enforcement Administration Results in brief  Spain: 13 arrests + 2 High-Value Targets arrested in Dubai France: 6 arrests + 2 High-Value Targets arrested in Dubai  Belgium: 10 arrests  The Netherlands: 14 arrests in 2021 and 2 High-Value Targets arrested in Dubai Global cooperation In the framework of intelligence activities underway with its operational counterparts, Europol developed reliable intelligence concerning a drug trafficking cartel flooding Europe with cocaine. The main targets, who used encrypted communications to organise the shipments, were identified in the participating authorities.  Europol has since then hosted multiple coordination meetings in the past 2 years in order to bring together the different countries working on the same targets to establish a joint strategy to bring down the whole network. More than 10 operational meetings took place at Europol in this period.  In addition, Europol has been provided continuous intelligence development and analysis to support the field investigators.  During the action, Europol facilitated the real-time coordination among all  the partners involved, ensuring swift tactical decisions to adjust the strategy as required.  Eurojust provided cross-border judicial support to the French and Belgian authorities regarding seven arrests in both countries and organised four coordination meetings to prepare for these actions No safe haven for drug lords  This coordinated clampdown sends a strong message to criminals seeking sanctuary from law enforcement.  Earlier in September, Europol and the Ministry of Interior of the United Arab Emirates took an important step in enhancing their cooperation. A Liaison Officer Agreement was signed between the two, allowing UAE law enforcement liaison officers to be  deployed to Europol’s headquarters in the Netherlands.  A liaison officer from the Ministry of Interior of the UAE has already joined the network of more than 250 liaison officers from over 50 countries and organisations with a permanent representation at Europol.  This unique approach to international police cooperation has positioned Europol as the place where crucial intelligence emerges with law enforcement from countries across the world working side by side to fight the most dangerous criminal networks.

The investigations in eight countries uncovered that several criminal organisations were working together to carry out large-scale poly-criminal activities in and outside the European Union. These include drug trafficking, money laundering and illegal enrichment among others. On 22 November, a total of 94 searches were executed across Europe, targeting both the leaders of these criminal organisations and their associates. The criminal network operated in Lithuania, Latvia, the Czech Republic, Poland, France, Germany and the Slovak Republic.  This international sweep follows complex investigations led by the Lithuanian Prosecutor General’s Office together and the Lithuanian Criminal Police Bureau, together with their partners in the Czech Republic, Latvia, France, Germany, Poland, Norway, Slovak Republic, Hungary, Spain and the United States, under the coordination of Eurojust and Europol.  Overview of the arrests:  Lithuania: 7 arrests Czech Republic: 9 arrests France: 9 arrests Slovak Republic: 7 arrests Latvia: 5 arrests Poland: 2 arrests Norway: 2 arrests Germany: 1 arrest Spain: 1 arrest United States: 1 arrest Across borders and between continents The scale of drugs trafficking alone attributed to this criminal network is massive, with activities reported across three continents.    Large quantities of various illicit drugs, such as cocaine, hashish and cannabis and methamphetamine were seized during the investigations. The criminal network is believed to be linked to major drug trafficking organisations outside the European Union.  Highly flexible, these criminals would quickly adapt to new drugs trafficking methods to try to evade law enforcement. Drug shipments have been found in vessels and trucks amongst others, often concealed in sophisticated hidden compartments.  The criminal network was structured like a business, with different criminal groups and brokers working together across borders to control the whole chain of drugs trafficking – from arranging huge shipments of drugs to the distribution throughout Europe and beyond.  Global cooperation  International cooperation coordinated by Europol and Eurojust was central in bringing the perpetrators to justice who were all located in different geographical locations across the world.  From an early stage in the investigation, an Operational Taskforce was set-up at Europol, with Eurojust setting up and financing two joint investigation teams (JITs), which served as a joint hub for criminal intelligence. The participating countries were able to combine and analyse all the information and evidence obtained on these criminal networks at a national level, together with the information held in databases of the participating law enforcement authorities.  Based on this pool of information and evidence, the different authorities agreed on a common strategy to prepare for the final phase of the investigations and bring down the whole network. Eurojust not only assisted with setting up and financing the JITS, but organised 15 coordination meetings to prepare for the action day and set up a coordination centre to provide cross-border judicial assistance.  From the onset, Europol has provided continuous intelligence development and analysis which allowed for the identification of the targets and the mapping of their criminal activities. During the action day, a total of 4 of its officers were deployed on the ground in France, Czech Republic, Slovak Republic and Spain, ensuring the swift analysis of data as it was being collected and adjusting the strategy as required. Eurojust Vice-President and National Member for Lithuania Ms Margarita Sniutyte-Daugeliene stated: This action day is the result of an exemplary and outstanding cooperation between judiciary and law enforcement, with the pro-active support of both Eurojust and Europol. This enabled a long term monitoring and well prepared operation, taking down at the same time several linked organised crime groups involved in large-scale drug trafficking. Commenting on this operation, the Head of Europol’s Serious Organised Crime Centre, Jari Liukku, said: Criminals are good at cooperating across borders – operations like this one today shows them law enforcement and judicial authorities can do just as well. The success of this operation shows how powerful and far-reaching our actions can be when we join forces to turn the tables on these high-risk criminals, regardless of where they are located. The following authorities took part in these investigations:  Lithuania: Criminal Police Bureau; Organised Crime and Corruption Investigation Department Prosecutor General’s Office  Czech Republic: National Drug Headquarters Criminal Police; Regional Public Prosecutor´s Office Ústí nad Labem, Liberec branch Latvia: 2nd Unit (Drug Enforcement) Serious and Serial Organised Crime Enforcement Department Central Criminal Police Department of the State Police of Latvia; Specialised Prosecution Office for Organised Crime and Other Branches Spain: Civil Guard (Guardia Civil); Investigative Court no. 1 Marbella; Specialised International Cooperation Public Prosecutor’s Office Málaga United States: Drug Enforcement Administration (US DEA)  Poland: Nadbuzanski Unit of Border Guard/ Lublin Branch Office of the Department for Organized Crime and Corruption of the National Prosecutor's Office in Lublin  Norway: Police France: National Police (OFAST) and National Gendarmerie ( Gendarmerie Nationale – Section de Recherches Marseille – PACA); National Jurisdiction Against Organised Crime (JUNALCO) Slovakia: National Crime Agency, Special Prosecutor's Office Hungary: RSSPS National Bureau of Investigation Germany: State Criminal Office (LKA) Berlin/ REOC Special Unit 412; Public Prosecutor’s Office Berlin  

More than 350 inspections took place in the joint action days in September. Investigators detected irregularities in connection to 17 companies (one in Italy, one in the Netherlands, three in Spain and 12 in Portugal). The relevant authorities opened criminal proceedings against one of these companies. The national authorities conducted the checks mainly at Brazilian ports for the export and European ports searching for illegal imports. Criminal networks use document forgery dissimulate the origin of the timber or the actual species in the shipment to pass customs controls and reach the consumers. Corruption is also an enabler of this criminal activity.   Illegal timber trade affecting climate change This is the first time when source and destination countries for illegal timber trade joint forces in coordinated inspection of countries trading with timber. The inspections focused on different criminal activities used by criminal networks to enable illegal timber trade including document fraud and bribery to dissimilate the origin or the true species of the goods. The timber is used in for a wide diversity of purposes including construction or creating of ornaments, while the rare origin is appreciated for its natural characteristics. The obtained profits are not taxed, leading to tax evasion. Criminal networks the launder these illegal profits by placing them in legal financial system and thus, integrating them into the legitimate economy. However, the illegal trade contributes significantly to current deforestation in the origin countries, depleting their natural resources. According to Brazil’s National Institute for Space research, the deforestation of the Brazilian Amazon rose at least 28% in 2020.  Europol coordinated the operational activities, facilitated the information exchange and provided analytical support. During the action days, Europol deployed experts to Netherlands to support the field activities. This enabled Europol to facilitate the real-time exchange of information and support with operational analysis to provide clues to investigators on the ground.  

To assist these first responding officers, a new set of training guidelines have been published today on the occasion of the European Day on the Protection of Children against Sexual Exploitation and Sexual Abuse. This toolkit is the result of a collaboration between Europol’s European Cybercrime Centre (EC3) and the European Cybercrime Training and Education Group (ECTEG) in the framework of the GRACE project.  The guidelines will equip first responding officers with the necessary knowledge to effectively handle delicate situations that take place at a victim’s close whereabouts, such as their home or school, often hidden from the eyes of the public. The guidelines are prepared in a way that encompasses the unified standards that these officers can use in their daily work, equipping them with relevant information on how best to respond if they came across a child they believe is being subjected to sexual abuse. The restricted version of these guidelines will be embedded into the ECTEG’s eFirst project, as part of the knowledge base that every law enforcement officer should be aware of, regardless of their field of work.  Read the public version. About the authors GRACE (Global Response Against Child Exploitation) is an EU-funded Horizon 2020 project that aims to equip European law enforcement agencies with advanced analytical and investigative capabilities to respond to the spread of online CSEM that will help safeguard victims and prosecute offenders. GRACE will be running until November 2023 to apply proven technologies to referral and analysis processes while embracing the technical, ethical and legal challenges unique to fighting child sexual exploitation. GRACE is leveraging resources already in place at Europol and participating EU Member States aiming to provide results early, frequently and flexibly – watch the GRACE video. Europol is one of the 22 organisations across 14 countries in Europe that have come together to deliver GRACE. Its Innovation Lab is coordinating Europol’s participation in this project, while supporting numerous EU-funded projects with an advisory role. The European Cybercrime Centre (EC3) was set up to strengthen the law enforcement response to cybercrime in the EU and thus to help protect European citizens, businesses and governments from online crime. As a form of cybercrime, child sexual exploitation is one of the EU’s priorities in the fight against serious and organised crime as part of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). ECTEG is the European Cybercrime Training and Education Group, an international non-profit organisation funded by the EU Commission. ECTEG comprises of participants from European Union Member States and candidate countries' law enforcement agencies, international bodies, academia and private industry.  ECTEG’S eFIRST is a first responders e-learning tool that focuses on essential IT forensics and cybercrime, available in English and translated with adapted content in several EU languages. For more information about these guidelines: •    For law enforcement: Reach out to Europol’s European Cybercrime Centre  •    For the general public: Reach out to Europol’s Press Office For more information about GRACE, visit the project website or follow the project’s progress on Twitter and LinkedIn. GRACE has received funding from the European Union’s Horizon 2020 Research and Innovation Programme under Grant Agreement Number 883341. We encourage you to disclose the abuse to a professional or adult you trust in your school, child protection services or similar institutions. It is not your fault. You are not in trouble. We want you to be safe. You are not alone.

Operations against food fraud target criminal networks that can seriously harm consumer health and safety. From rotten tuna to fake vodka with methyl alcohol and counterfeit vitamins, illegal food and beverages are a serious threat to EU citizens, who are often unaware that they are consuming poisonous products. To detect criminal activities, the national authorities conducted checks in customs areas, in physical and online market places, and across the food supply chain. Operational actions focused on seafood fraud and conducted targeted actions on alcohol and wine.  Seizures and activities reported to Europol 26 800 tonnes of illicit products seized  15 million litres of alcoholic beverages About 74 000 checks 80 arrest warrants 137 individuals reported to judicial authorities 175+ criminal cases opened 2 078 administrative cases opened 8 criminal networks disrupted   What are the main illegal products seized?  (in order of quantity) Alcoholic beverages Cereals, grains and derived products Fruits/vegetables/legumes Food supplements/additives Sugar and sweet products Meat and meat products Seafood  Dairy products Poultry products Winemakers that faked it The Italian NAS Carabinieri reported to the judicial authorities the owners of a winery who produced and marketed sophisticated and altered wine. The producers added water and sugar to some of the labels. To others, they added natural aromas, not corresponding to the quality of the wine advertised to the buyers. In some cases, they also declared a higher alcohol content than the actual one. The Italian authorities seized the winery, 11 motor vehicles and 1 million litres of wine. A spicy smell of gardenia  The Spanish Civil Guard (Guardia Civil) dismantled a criminal network selling molecularly modified gardenia as the highly expensive saffron spice. The suspects imported the extract of gardenia from Asia. The national authorities investigated 3 companies, arrested 11 people and seized 10 000 kg of the gardenia extract, which – if sold as saffron – would have been worth about EUR 750 000. This case also highlights a growing phenomenon: more and more spices and condiments have been adulterated and trafficked recently. Bad meat  The operational actions also targeted meat unfit for consumption. One action involved the Portuguese authority responsible for food safety and economic surveillance (Autoridade de Segurança Alimentar e Económica), which ran an operation against a clandestine slaughterhouse. The officers raided two homes suspected of being used as locations for the illegal slaughter and roasting of pigs. The actions resulted in the seizure of 60 piglet carcasses. The officers dismantled the sites, which had no license, poor hygiene conditions and no veterinary control – all of which are mandatory for such activities. Because the meat produced there could not be traced, it did not meet the minimum conditions for consumption. Other operations, which targeted the illegal meat trade, seized horse meat unfit for consumption, old meat to be reintroduced into the food supply chain and processed food with expired consumption dates.   Fresh or not France, Italy and Switzerland carried out a sampling activity on fish. They were checking if the indication of ‘freshness’ declared on the label was ‘true’ or ‘fraudulent’. The samples were collected and subsequently processed and analysed according to the standard operating procedure. The results provided fraud indicators, which will make future inspections more effective.  Europol’s Intellectual Property Crime Coordinated Coalition is co-funded by EUIPO to combat intellectual property crime. Participating countries reporting to Europol * Austria, Belgium, Bulgaria, Colombia, Croatia, Cyprus, Czechia, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Montenegro, Netherlands, Norway, Portugal, Romania, Slovenia, Spain, the United States.  

The first phase of the action took place less than a year ago in Barcelona and was decisive in obtaining conclusive evidence against this criminal organisation. Following an analysis of devices and documentation seized on the first action day, investigators were able to link 10 people with bringing 117 tons of hashish and over 3 tons of cocaine into Spain. During the second phase of the action, the Guardia Civil raided venues in Barcelona, Ceuta, Almería and Malaga, where the suspects of Spanish, German and Moroccan nationality were apprehended. Among them is the main suspect’s lawyer, who specialises in cases related to drug trafficking. Impressive list of seized valuables and criminal assets In total, Spanish authorities arrested 27 suspects in the two-phase action, who were relying on assets such as 39 phones, a satellite phone, 8 computers, 3 microphone scanners as well as a cash counting machine to conduct their criminal activities. The most tangible of the items seized include 14 tons of hashish, 5.1 tons of cocaine and more than 1 million EUR in cash, which are now in the hands of law enforcement.  The organised crime group clandestinely imported boats and powerful engines from the Netherlands, made them ready on a ship off the coast of Portugal, and then used them to collect and transfer the drugs from Morocco to Spain. Three vessels were subsequently seized during the action days, adding to the impressive list of confiscated valuables. These include 11 real estate properties, 5 companies, 36 luxury cars, the contents of 58 bank accounts and 12 luxury watches. Corporate business structure for money laundering Europol’s European Financial and Economic Crime Centre (EFECC) was decisive in uncovering a variety of methods used to transfer and launder the proceeds generated by drug trafficking. These include the clandestine transport of large amounts of cash, the use of the hawala system to transfer money, and investments in luxury goods such as yachts, luxury watches, luxury vehicles or real estate property and renovations. The criminal network further invested in companies located in several European countries, and used loans and mortgages to businesses to launder illicit funds.  Europol’s role Europol has been providing analytical and operational support since 2020 and has helped to establish links with other investigations. It facilitated cooperation with other law enforcement agencies and analysed the business activity and corporate structure used to launder the money. Support was also provided on the spot during the action days by deploying a money-laundering specialist with a mobile office.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

A number of interceptions made in 2021 in Belgium uncovered the suspects’ links to a migrant smuggling network which was transporting migrants in small boats from France to the UK across the English Channel. The investigation suggests that some of the members of the criminal network were operating from France, while others operated from the UK. The information exchange between involved national authorities through Europol and Eurojust channels led to the identification of a number of suspects.  On 9 November, following this international cooperation at the judicial and law enforcement level, French and UK law enforcement authorities arrested two suspects (one Iraqi and one Kuwaiti national) by order of the investigating judge in Bruges. At the same time, French Border Police made one arrest (one Iraqi national) under a European Arrest Warrant issued by Belgium.  Europol facilitated the information exchange between the participating countries. Europol also provided 24/7 analytical and operational support, and facilitated the real-time exchange of communication between the participating authorities. Law enforcement authorities involved:  Belgium – Belgium Federal Police (Federale Politie/Police Fédérale) France - French Border Police (OCRIEST-BMR Lille) The United Kingdom – Home Office Immigration Enforcement and the Metropolitan Police Judicial authorities involved:  France: Dunkirk Public Prosecutor's Office  Belgium: Prosecution Office of West-Flanders and Investigative Judge in Bruges (Parket Brugge)   --- Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The two-year-long investigation exposed a Dutch criminal network involved in the large-scale trafficking of dangerous, highly explosive fireworks. The investigation was initiated in 2020 based on intelligence gained from the Encrochat operation. The Dutch and German authorities’ joint investigation uncovered the routes used to transport illegal heavy fireworks from countries such as China across several national borders, including Germany, to reach the Netherlands. The police are increasingly seeing organised criminal networks using highly explosive and dangerous fireworks in acts of violence directed against other criminal groups. The explosives are also being used for criminal activities such as ATM explosive attacks carried out in Germany. Explosives stored dangerously near unsuspecting communities  In October, German and Dutch authorities arrested 11 suspects in total. The three main suspects were arrested in the Netherlands on 17 October. The other eight suspects who were arrested are believed to have played logistical roles, such as facilitating transport, storing the fireworks or acting as a point of contact with buyers. In June, law enforcement authorities in Germany and the Netherlands raided several locations including suspects’ houses, business premises and storage facilities. The German officers uncovered seven sites including bunkers, barns, businesses and containers that were being used for storing the illegal fireworks. The locations were far from meeting the strict safety requirements for the storage of such highly explosive items. In total, 350 tonnes of illegal heavy fireworks, with a commercial value of up to EUR 25 million, were seized. Stockpiles of cash were also discovered. The investigation into the criminal network and the illegal fireworks is ongoing, and further arrests cannot be ruled out. The fireworks will be destroyed once the investigation is completed. Europol set up an operational task force to support this priority investigation. Europol also coordinated operational activities, facilitated information exchange and provided analytical support.   

At the end of October, Polish police officers carried out 82 searches across the country and arrested 44 suspects aged between 18 and 66. The preliminary analysis and the searches led to the identification of 15 500 files of both video and photographic material depicting the sexual abuse of children, and to the seizure of 350 large-capacity digital storage units. Some of the images saved on the seized storage items depicted the sexual abuse of infants and toddlers. As some of the files were encrypted, they will be subjected to further examination once decrypted. The leads gathered during the operational actions have fed further investigations that are still in progress. Among the arrested is an individual suspected of sexual abuse of two children aged four and five, as well as a second individual who has already served a five-and-a-half-year sentence for sexually abusing minors. The operational activities also led to the possible prevention of the victimisation of a child. During the search of a suspect’s house, the officers uncovered correspondence with a 10-year-old boy, which suggests that the adult had obtained the trust of the child for the purpose of his subsequent sexual exploitation. An investigation into a further similar case is now ongoing.   For several years, Europol has served as a destination for NCMEC reports targeting online suspects in various EU Member States, including Poland. Every NCMEC report is stored and cross-checked against Europol data and eventually disseminated to the respective country. Europol supported the Polish operation by providing analytical, victim identification and open-source support, and by facilitating exchanges of information. Note to media: Europol encourages you to use the term ‘child (sexual) abuse material’ and not ‘child pornography’ in your reporting. The use of the term ‘child pornography’ helps child sex abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child pornography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation where a child has been abused. This is not pornography.  

The operational activities involving 28 countries across Europe were also supported by Eurojust, Frontex, INTERPOL, SELEC and other international organisations. The EMPACT Joint Action Days were planned based on an intelligence-led approach, which involved the cooperation of a wide range of law enforcement authorities including police, customs, immigration agencies and border control agencies.  382 arrests and 130 new investigations The operational activities mainly took place in the Balkans and Southeast Europe. Other countries from across Europe contributed criminal intelligence and conducted operational actions at the national level. Almost 16 000 officers were involved in the actions on the ground. Simultaneously, between 24 and 29 October, national authorities coordinated special activities that targeted human trafficking networks involved in sexual exploitation, forced begging and forced criminality. The results of these actions will be released in a second communication.   In total, the activities led to 382 arrests of suspects, the majority of whom were alleged to be involved in drug trafficking, facilitation of illegal immigration, document fraud and the trafficking of firearms. Officers on the ground detected a number of offences related to the facilitation of illegal immigration and related legal violations such as document fraud. The arrests and evidence retrieved has allowed law enforcement authorities to initiate 130 new investigations.  Overall results:  74 924 people checked 998 locations searched 32 665 vehicles inspected 2 004 packages/parcels checked 382 arrests: 159 related to migrant smuggling, 112 related to drug trafficking, 38 related to firearms trafficking, 2 related to trafficking and human beings 71 related to other crimes.  2 476 illegal entries detected Seizures include: 106 firearms: 43 rifles, 42 pistols, 6 air guns, 1 anti-personnel mine, 1 air defense system, 15 grenades, 2 machines for assembling, 2 antitank missiles and  12 250 pieces of ammunition Drugs: 304 kg of heroin, 147 kilograms of cannabis, 5 402 plants of marijuana and 1.3 kg of cocaine 130 new investigations initiated  Drugs and firearms traffickers targeted along the Balkan route The Balkan route is notorious for its use in a number of crime areas, including migrant smuggling and the trafficking of firearms and drugs into the EU. Multinational criminal groups source the weapons predominantly from countries in the Western Balkans, where human resources with expertise in firearms are widely available. The firearms are then trafficked to the EU - mainly to Belgium, France, Germany, Spain and the Netherlands. On the other hand, the Balkan route is a key entry point for heroin traffickers, while cannabis and cocaine traffickers also use this transition point.  Drug trafficking and the illegal trade in weapons are closely connected, especially in connection to cocaine trafficking networks. In some cases, criminal networks exchange weapons for drugs. They also use the weapons to gain and maintain control over lucrative drug markets. The illegal market for weapons has remained stable in recent years, both in terms of products offered and intensity of trade. The firearms present on the black market range from old to new military grade weapons. Blank-firing weapons, later converted into real ones, are also an issue. Coordinated activities of national authorities in the Western Balkans contribute to detecting this trafficking and, during the Joint Action Days, led to the interception of both drugs and firearms. Intensified checks to detect trafficking along the Silk Road  Weapons are often smuggled as part of multi-commodity shipments or hidden in vehicles. This is similar to how drugs are smuggled, examples being cocaine concealed in construction material or fruit shipments, or heroin in hidden compartments in vehicles. Drug traffickers still utilise the ancient Silk Road network of routes to bring heroin to the EU market. Migrant smuggling activities are also intense in these areas.  As an important logistical hub, the Balkan route sees thousands of trucks entering the EU with different goods, including food and construction material. National authorities focused therefore on major entry points.  An example is Europe’s biggest land entry point - Bulgaria’s Kapitan Andreevo checkpoint at the border with Turkiye - which sees about 1 500 trucks with different goods enter the EU every day. As criminal networks are highly international, their supply chain and markets affect multiple countries and pose a threat to the EU as a whole. Europol’s EU SOCTA 2021 outlines that 80% of the criminal networks active in the EU use legal structures to facilitate their criminal activities.  The EMPACT Joint Action Days were made possible through the cooperation of border guards, customs authorities and national units. The exchange of operational information and joint investigations during the operation contributed to more interceptions and the development of ongoing cases. Europol supported the coordination of the EMPACT Joint Action Days and facilitated the exchange of information between the participating countries. During the course of the operation, Montenegro, with the support of the CSC WB IPA 2019 Project, hosted an operational centre to enable the swift exchange of operational information between the participants. A Europol analyst was deployed to the operational centre to provide live analytical support to field operatives. During the action week, Europol also deployed an expert to Bosnia and Herzegovina to facilitate the real-time exchange of communication between the participating authorities. Europol also deployed officers to support the Moldavian authorities. Further support has been provided in the context of the war of aggression against Ukraine to mitigate the threats of arms trafficking into the EU. Participants EU Member States: Austria, Bulgaria, Croatia, Denmark, France, Germany, Greece, Italy, Luxembourg, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.  Non-EU Countries: Albania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, Switzerland, Türkiye, Ukraine and United Kingdom.  EU Agencies: Europol, Eurojust, Frontex International and institutional partners: EUBAM, IPA/2019  (Instrument for Pre-Accession Assistance) countering serious and organised crime in the Western Balkans, INTERPOL, PCC-SEE (Police Cooperation Convention For Southeast Europe Secretariat), SEESAC (The South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons) and SELEC (Southeast European Law Enforcement Centre). * This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.  

The annual event was launched in 2017 to gather law enforcement and private sector entities involved in the fight against intellectual property crime and provide a platform for public-private cooperation and innovation in this joint cause. After two years of online meetings, this 2022 edition responds to a growing need for an in-person gathering and networking among the attendees representing law enforcement agencies from 45 countries as well as 140 private entities.  Counterfeiting and piracy continue to pose a serious threat to the health and safety of consumers, as well as to the European economy. Imports of counterfeit and pirated goods reached EUR 119 billion in 2019, accounting for 5.8 % of all goods entering the European Union. The latest Intellectual Property Crime Threat Assessment, produced jointly between Europol and the European Union Intellectual Property Office (EUIPO), reveals that the distribution of counterfeit goods has been thriving during the COVID-19 pandemic.  Jean-Philippe Lecouffe, Deputy Executive Director of Europol, commented: Law enforcement and the industry community are required to adapt rapidly when facing the challenges presented in crises. Be it fake vaccines and medical devices, the pressure on the automotive spare parts market due to supply chain interruptions, or the distribution of counterfeit pesticides, intellectual property crime shows to be particularly reactive to crises. In light of these challenges, the importance of an effective public-private partnership is ever-growing. All major Europol operations targeting intellectual property crime involve close cooperation with private partners. Lieutenant General Giuseppe Vicanolo, Deputy General Commander of the Guardia di Finanza added: The importance of the interests involved in the protection of intellectual property and in the fight against related economic and financial violations, together with the complexity of the investigations on an international scale, make it necessary to pursue the most effective cooperation among institutions and other actors. Our institution is fully aware of that and will make any useful contribution for these purposes. Bob Barchiesi, President of IACC remarked: This conference is a platform for public and private entities to find synergies and solutions in the common fight against intellectual property crime. Our yearly event allows consolidation of partnerships and cooperation among public and private stakeholders. Recent crises have presented new criminal business opportunities for the distribution of counterfeit and substandard goods. Criminal networks involved in IP crime have been highly adaptable in adjusting their business model by shifting product focus and marketing as well as means of transport and routes. The yearly event gives the opportunity to collect useful information from brand owners about possible fraudulent practices and to share it with police bodies and customs. While the two-day conference centred on challenges in the context of crises, the 55 speakers shed light on further developments observed in recent times. While most counterfeit and substandard goods distributed in the EU are produced outside its borders, the frequent seizure of counterfeit packaging materials and semi-finished products upon import indicates the presence of manufacturing facilities in the EU. Another issue is the laundering of criminal proceeds, which is performed in both traditional and more sophisticated schemes relying on technology, trade-based money laundering, and offshore jurisdictions. These and more key topics will remain the focus of the public-private partnership which is set to convene again in Portugal next year.

Under the theme “The Evolution of Policing – do we need a social contract in cyber space?” Europol’s Cybercrime Conference looked at the challenges and opportunities that the digital age present to policing.  This two-day conference (19-20 October) organised by Europol’s European Cybercrime Centre (EC3) saw the participation of over 150 organisations and more than 58 different law enforcement agencies engaging in fruitful discussions on how to tackle the challenges at hand and proactively prepare for emerging technologies.   Key themes discussed included:  Criminal investigations in the digital age The role of law enforcement in keeping the metaverse safe and secure Emerging technologies – separating fiction from real impact The future law enforcement officer – in which areas do we need to invest?  The topic of the Russian war of aggression against Ukraine was high on the agenda. This was reflected in this year’s keynote speeches, with Mikko Hyppönen from WithSecure delving into how technology is shaping conflicts and crises. In a moving address, a senior inspector at the Cyber Police Department of the National Police of Ukraine went on to explain the impact the Russian war of aggression against Ukraine has had on their policing priorities.  In his closing remarks, the Head of Europol’s European Cybercrime Centre, Edvardas Šileris, said: These two days of lively, solution-orientated discussions between law enforcement, the industry and academia have proved how central public-private partnerships have become to running criminal investigations in the digital domain. I look forward to continue building on our trust relationships to deliver an improved international response to the ever-changing criminal landscape.  The conclusions of the conference, emphasised that:  Policing requires a future-proof and agile legal framework to operate in the digital age; regulation and innovation have to complement one another.  Public and private partnerships remain an essential dimension in the fight against cybercrime. While safety, security and privacy are the essence of our social contract, developments like the metaverse, artificial intelligence, quantum computing, etc. show the constant need for adaptation and evolution, at regional, national, and global level.  

Europol Executive Director, Catherine De Bolle: I believe it is important for police to anticipate changes to the reality in which they have to provide safety and security. The metaverse will bring about new ways of interacting and whole new virtual worlds to live in, potentially transforming our lives, just as the internet has done in the last three decades. As our discussions at the European Police Chiefs Convention this year demonstrated, this report from the Europol Innovation Lab will undoubtedly help law enforcement agencies to begin to grasp this new world, in order to adapt and prepare for policing in the metaverse. Recommendations for tackling criminal uses within the metaverse What (safety) measures do we require metaverse service providers to implement, and what tools should law enforcement be given to police the metaverse? To be a serious partner in these discussions, the law enforcement community will have to build an understanding of the relevant technologies and what is needed to effectively protect (and investigate) in the metaverse. The report provides several suggestions on first steps for building this experience, as well as further positive examples of how law enforcement agencies are innovating in this field. Monitoring and experiencing the metaverse and related technologies, learning what is happening as well as engaging with the companies creating it, will be essential in understanding and shaping policing in the non-physical world. About the Europol Innovation Lab Europol's Innovation Lab aims to identify, promote and develop concrete innovative solutions in support of the EU Member States’ operational work. These will help investigators and analysts to make the most of the opportunities offered by new technologies to avoid duplication of work, create synergies and pool resources. The activities of the Innovation Lab are directly linked to the strategic priorities as laid out in Europol Strategy 2020+, which states that Europol shall be at the forefront of law enforcement innovation and research. Download the report Policing in the Metaverse: what law enforcement needs to know.  

This arrest follows a complex investigation initiated in December 2019 by the German Police Headquarters Ludwigsburg (Polizeipräsidium Ludwigsburg) with the support of Europol’s European Financial and Economic Crime Centre.  The action day has resulted in:  The arrest of an individual considered as a high-value target by Europol for his involvement in numerous high-profile cases throughout Europe.  37 property searches Germany (18), the Netherlands (12), Spain (4) and Hungary (3). Giving victims a false sense of legitimacy The investigation uncovered how this criminal would pose as an employee of a real, Geneva-based investment company and would reach out to unsuspecting victims to persuade them to part with their savings, promising lucrative investment companies. In order to fabricate a sense of legitimacy, the scammer had set-up a ‘spoofed’ website which looked nearly identical to the real company’s website. Investment documents which appeared to have been made by recognisable banks and insurance companies were also provided to prospective victims to trick them. The investors were instructed to send funds via wire transfer to bank accounts controlled by the criminal.  Once the payments had been made, the scammer would disappear with the money, moving the stolen funds from one jurisdiction to the other to conceal their illegal origin. The investigators were able to track down the stolen funds all the way to Türkiye. European coordination  International police cooperation was central in bringing the perpetrator to justice as the criminal had set up a sophisticated infrastructure spread across multiple countries to hamper law enforcement’s abilities to track him down.  Europol’s European Financial and Economic Crime Centre supported the investigation by bringing together the national investigators to establish a joint strategy and to organising the intensive exchange of evidence needed to prepare for final phase of the investigation. Europol experts from its European Financial and Economic Crime Centre were also deployed to Spain to assist the Spanish national authorities with the action day. The following authorities took part in this investigation: Germany: Police Headquarters Ludwigsburg (Polizeipräsidium Ludwigsburg) The Netherlands: National Politie (Politie)  Spain: National Police (Policía Nacional) Hungary: National Police Headquarters Budapest  This investigation was carried out with the financial support of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). Better safe than sorry  Europol encourages prospective investors to:  Don’t rely on unsolicited marketing material/calls/emails or social media direct contact: Do an internet search for the company name and verify the contact information with the financial institution or firm directly. Compare and confirm websites: Check for misspellings in the website, the complete website name (URL) and email address. Also, many consumer protection and financial market supervisory authorities publish lists of abused websites and warnings on current frauds.  Avoid unusual payment methods:  Be cautious if you are instructed to send funds via wire transfer to an off-shore location, or if you are instructed to pay using cryptocurrency or other unusual payment method.  

We were also delighted to showcase The Recovered Collection for our visitors last weekend, which is a special art exhibition made possible thanks to the hard work of Italy’s Carabinieri Command for the Protection of Cultural Heritage, otherwise known as the Carabinieri TPC.  Why Europol is backing Just Peace Month As one of the largest EU agencies in The Hague, Europol is a host to citizens from across the EU – as well as dozens of other countries from all corners of the globe. We are part of a community of EU and international agencies in The Hague, working hand-in-glove to deliver the values of rule of law and a more secure society. Open days and visits through the Just Peace Month provide means for agencies like Europol to have dialogue with the public – the people we work in service of – and to introduce some of the remarkable people and capabilities here at the agency. We’re backing Just Peace Month because it is a chance for transparency, dialogue and learning; key pillars of the EU and our work as law enforcement. The theme for this year’s Just Peace Month is ‘hope in times of adversity’. With multiple crises facing the world right now – many of which will require a law enforcement response and cross-border cooperation – we were pleased to meet and explain our remit to members of the public at this time. The Recovered Collection Visitors to Europol’s HQ on the Sunday had the opportunity to visit The Recovered Collection, which is a special art exhibition that is temporarily on display at headquarters.  The Recovered Collection features artefacts and artworks that tell important stories of Europe’s cultural heritage. It includes rare pottery, handcrafted statues, mirrors, vases and even pieces of armour from the ancient era. Yet unlike a normal art collection, which is curated and donated by museums, art lovers and collectors, The Recovered Collection is somewhat different. All the pieces in the exhibition were recovered from organised criminals by the Italian Carabinieri Command for the Protection of Cultural Heritage (TPC).  These rare and sometimes priceless pieces of history were stolen from legitimate collectors or excavated illegally from historical sites by organised criminals. The Recovered Collection shows some of the seizures from just four of the many operations conducted by the TPC, many of which are supported by Europol. In fact, these four operations alone have recovered tens of millions of euros’ worth of rare historical and modern cultural goods – just one way law enforcement cooperation is working hard to take money out of criminal pockets. It was our pleasure to host these works for the public at our HQ. Find out more about Europol’s work recovering cultural goods and stolen art on the dedicated page on our website. If you’d like to take part in a future visit to Europol, be sure to follow Europol and The Hague Humanity Hub on social media. Or sign up for the walking tour on 21 October via the Just Peace website.  

The criminals targeted vehicles with keyless entry and start systems, exploiting the technology to get into the car and drive away.  As a result of a coordinated action carried out on 10 October in the three countries involved, 31 suspects were arrested. A total of 22 locations were searched, and over EUR 1 098 500 in criminal assets seized.  The criminals targeted keyless vehicles from two French car manufacturers. A fraudulent tool – marketed as an automotive diagnostic solution, was used to replace the original software of the vehicles, allowing the doors to be opened and the ignition to be started without the actual key fob.  Among those arrested feature the software developers, its resellers and the car thieves who used this tool to steal vehicles.  The investigation was initiated by the French Gendarmerie’s Cybercrime Centre (C3N). Europol has been supporting this case since March 2022 with extensive analysis and the dissemination of intelligence packages to all the countries affected by this crime. Two operational meetings were organised at Europol’s headquarters to jointly decide on the final phase of the investigation. A Europol mobile office was also deployed to France for the action day to assist the French authorities with their investigative measures.  The case was opened at Eurojust by the French authorities in September 2022. The Agency actively facilitated cross-border judicial cooperation between the national authorities involved, including the organisation of the joint action day. The following authorities took part in the investigation: France: National Jurisdiction against Organised Crime (JUNALCO), National Gendarmerie (Gendarmerie Nationale) Latvia: State Police of Latvia  Spain: Investigative Court num. 2 in Palma de Mallorca Balearic Islands PPO This investigation was carried out with the financial support of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) and the Internal Security Fund (ISF) SWORD.  *** Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The action week resulted in: 17 arrests in France, Spain, the United Kingdom and Ukraine 42 suspected traffickers identified in Cyprus, France, Italy, Spain, Sweden, United Kingdom and Ukraine  874 workers affected by exploitation and labour violations identified (including 231 identified as possible victims of trafficking of human beings and exploitation) 4 291 locations (including vineyards and farms) checked 1 087 vehicles checked 37 017 people checked 36 new investigations initiated  192 suspected violations recorded by labour inspectors Seasonal workers remain at high risk of exploitation The agricultural sector is more vulnerable to exploitation practices due to various factors, including the high level of informality (undeclared or under-declared work) and the sector’s predominantly low-skilled workforce. The risk of exploitation is even higher for seasonal jobs. Criminal networks often recruit victims from their countries of origin and exploit them in other countries. Victims are then coerced into working long hours for low wages or none at all, or working in deplorable conditions with no possibility of travelling back to their home countries. EU citizens are mostly exploited in the agricultural sector year-round, while non-EU citizens are employed in seasonal work. Investigators have detected specific modus operandi used in this criminal area, including the use of look-a-like and falsified documents and forged residence permits for the exploitation of non-EU nationals and violation of minimum wage laws.  The fight against human trafficking for labour exploitation requires a consolidated, cross-border and multi-disciplinary effort by different authorities. This is the second year that the European Labour Authority has coordinated joint inspections and supported the deployment of labour inspectors from workers’ countries of origin to destination countries. Inspectors from Bulgaria and Portugal joined French authorities to inspect different locations in France, including vineyards, farms and locations operated by the forestry sector. Officers of the Finnish labour authority participated in the joint actions in Belgium involving the floriculture industry. Europol coordinated the action days and facilitated the information exchange between the participating countries. Europol provided analytical and operational support 24/7 and facilitated the real-time exchange of communication between the participating authorities. Participating countries: Belgium, Bulgaria, Cyprus, Finland, France, Greece, Ireland, Italy, Latvia, Netherlands, Portugal, Romania, Spain, Sweden, Ukraine and United Kingdom *** Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. The European Labour Authority (ELA) was created to help Member States to effectively enforce labour mobility rules within the EU, including the coordination and support of cross-border inspections.