Top Stories

In the framework of Operation Oscar, initiated by Europol’s European Financial and Economic Crime Centre, Europol will facilitate partners’ exchange of information and intelligence and provide operational support in a number of financial investigations targeting criminal assets and circumvention of the EU economic sanctions related to the Russia’s military aggression towards Ukraine. Europol will centralise and analyse all information contributed under this operation to identify international links, criminal groups and suspects, as well as new criminal trends and patterns. Europol will further provide tailor-made analytical support to investigations, as well as operational coordination, forensics and technical expertise, and financial support to the relevant national authorities.  Eurojust will be actively involved with the operation through the exchange of strategic and operational information. Eurojust will furthermore provide legal assistance and support and strengthen cooperation between national investigating and judicial authorities. Frontex will contribute to the operation by enhancing the scrutiny of the persons who are crossing EU’s external borders and fall under the scope of the sanctions. Taking advantage of the large spectrum of the operational activities of Frontex, the task will be implemented in the all their domains – land, sea and air.

French Border Police initiated the investigation in January 2021, although investigators suspect that the network was already active for some time before that. The members of the criminal network, predominantly of Spanish nationality, exploited mainly Colombian nationals in Spain and in the area around the French city of Nantes. The suspects recruited clients via websites and controlled the accounts advertising the victims. The network transported the illegal profits from France to Spain themselves or by using money mules. The criminals laundered their proceeds through investments in real estate and cash-intensive businesses such as bars and clubs in Spain.  Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. Europol deployed two experts to France and one expert to Spain to cross-check operational information in real time and support investigators on the ground with technical and asset-recovery expertise.  

On the action day, 7 April 2022, law enforcement authorities raided multiple locations across Europe and targeted 176 individuals in relation to offences such as dissemination of racist and xenophobic hate speech, calls to violence, and incitement to commit offences. For example in Austria, authorities carried out 12 house searches, interrogated 8 individuals and seized electronic devices, mobile phones, weapons and propaganda material. Meanwhile, Spanish authorities targeted five individuals and arrested four of them for disseminating hate speech online. The action also included a coordinated referral activity targeting the online hate speech component of the investigated cases in Luxembourg, Portugal and Spain. This resulted in 58 pieces of content on three platforms being assessed for referral to online service providers for their voluntary review against their terms and conditions. The coordinated action targeted communities and individuals using different types of content such as posts, comments, and memes to spread hate and propaganda via the internet while seizing computer devices and other evidence materials. The operation, targeting no specific organisations or groups, aimed at preventing hate crime, racism and xenophobia from proliferating online and offline. Law enforcement also worked together to increase awareness of individuals and groups that the internet is not a legal vacuum. Supposed anonymity does not hinder law enforcement from taking measures against unlawful acts; this second joint action day on hate crime sends a clear signal to individuals spreading violent hatred on the internet that their actions will be detected and attributed.The ECTC supported this initiative of French Gendarmerie / OCLCH from the start, providing operational coordination and facilitating the exchange of information between the participating authorities. The ECTC monitored all contributions, provided analytical support, and gave a continuous overview on the operational activities through direct contact with the involved law enforcement authorities. 

We are therefore proud that our commitment to sustainability has been recognised through the EU Eco-Management and Audit Scheme (EMAS) registration, which was obtained in February of this year. EMAS is recognised across Europe as the highest and most robust level of certification for environmental management.  Europol’s EMAS registration follows the award of an ISO 14001 certification in November 2021 for the Environmental Management System in place and in recognition of our commitment for reducing our impact on the local and wider environment.  Europol employs over 1 400 people at two sites in The Hague, the Netherlands. Europol is the first Justice and Home Affairs EU Agency to receive both the ISO 14001 certification and EMAS registration, paving the way to sustainability for other EU Agencies. Europol’s Executive Director Catherine de Bolle said: We are proud to be awarded the EMAS seal of approval. This achievement is attributable to Europol-wide efforts and acknowledges our ongoing commitment to mitigating the environmental impact of work in making Europe safer. What is EMAS?  The European Eco-Management and Audit Scheme (EMAS) is a management instrument developed by the European Commission that provides environmentally conscious organisations with the tools they need to manage the challenges of climate change and environmental protection. Europol has taken an environmentally responsible approach to operating for many years. Since 2018, we have successfully implemented an Environmental Management System in accordance with the EMAS Regulation. EMAS and its four key principles - Plan, Do, Check and Act - help us to get an overview of what each part of our organisation is doing to become more sustainable. Green milestones In 2020: Europol’s carbon footprint was reduced by 82.3% compared to the 2018 baseline year which was partly due to the COVID-19 pandemic; Total water consumption fell by 45% compared to 2018 as a result of improvement action and less people being in the building; Total paper consumption fell by 21.8% compared to 2018 as a result of eco-friendly printer settings and teleworking; Total waste production was reduced by 17% compared to 2018. Environmental Statement  We are continuously measuring, managing and improving our environmental impact (energy, waste, water use etc.) and actions to reduce them. Our first Environmental Statement is publicly available and presents our environmental performance for 2020 in the areas of:  electricity use; energy for heating; water consumption; paper consumption; waste generation; CO2 emissions from business travel. Read Europol’s Environmental Statement 2021.

Today, Europol hosted an EMPACT meeting to focus on intelligence and operational actions linked to threats of serious and organised crime, which have emerged as a result of the war in Ukraine. This meeting follows the mobilisation of the EMPACT framework by the French Presidency of the Council of the European Union and the European Commission to address these threats. EU Ministers of the Interior endorsed this initiative at the extraordinary Justice and Home Affairs Council on 28 March 2022, as set out in the 10-Point Plan for stronger European coordination on welcoming people fleeing the war against Ukraine. Immediately afterwards, Europol, together with the French Presidency, started organising today’s meeting at Europol’s headquarters in The Hague to discuss coordinated operational actions. During the EMPACT meeting at Europol, representatives of the EU Member States, including the drivers of the operational action plans for 15 crime areas, discussed concrete steps to address the development of serious and organised crime threats linked to the war in Ukraine. This includes the gathering of more intelligence, the implementation of emergency operational actions based on EMPACT flexibility and adaptation culture, the possibility of setting up ad hoc joint action days and the potential allocation of additional grants to fund operational activities targeting these crimes. Initial intelligence analysis of these criminal threats identified crime patterns in a number of areas including human trafficking, online fraud, cybercrime and firearms trafficking. The evolution of the situation in Ukraine may potentially lead to an increase of criminal activities in all 10 EMPACT priority crime areas. Therefore, it is necessary to mobilise resources and increase the preparedness of the EMPACT community in order to respond in a swift and coordinated manner to these evolving threats.  EU Member States and operational partners are actively sharing all available information and criminal intelligence with Europol, which cross-checks and analyses the information and turns it into actionable operational intelligence notifications, such as early warning notifications and threat assessments, which is shared with all partners.  The operational cooperation approach of the EMPACT framework gathers different national authorities together, including police, gendarmerie, customs and border guards, as well as judicial authorities. Non-EU countries, international organisations, and other public and private partners may also be associated. This multidisciplinary approach, which includes both intelligence analysis and operational actions, plays a central role in the joint EU response to the prevention, detection and tackling of serious and organised crime affecting the European Union and its citizens.     The European Multidisciplinary Platform Against Criminal Threats (EMPACT) tackles the most important threats posed by organised and serious international crime affecting the EU. EMPACT strengthens intelligence, strategic and operational cooperation between national authorities, EU institutions and bodies, and international partners. EMPACT runs in four-year cycles focusing on common EU crime priorities.   

An investigation by the Upper Austrian Regional Criminal Office (Landeskriminalamt Oberösterreich), the Austrian Federal Police (Bundeskriminalamt), the German Bavarian State Police (Polizei Bayern), the Hungarian National Police (Magyar Rendorseg) and the Romanian Police (Poliția Română), supported by Europol and Eurojust, led officers to dismantle an organised crime group involved in human trafficking for forced begging. The criminal network was particularly violent and it was abusing extremely vulnerable individuals. Results from 6 April 2022 7 locations searched (1 in Austria, 2 in Germany, 1 in Hungary and 3 in Romania) 4 arrests (1 in Germany, 1 in Hungary, 1 in Austria and 1 in Romania) Seizures included: phones and other electronic devices, more than EUR 90 000 and RON 9 400 in cash, 1 kg of gold. Two victims died during this time Since 2017, national authorities of the four countries concerned have investigated this family-based organised crime group. This has included investigating group members of Romanian and Hungarian origin who were trafficking and exploiting victims in Austria and Germany. The victims of Hungarian and Romanian origin were particularly vulnerable as a result of alcohol addiction and homelessness. They were forced to beg in specific locations in a number of cities including the German cities of Ingolstadt, Nurnberg and Berlin and the Austrian cities of Feldkirch, Linz, Bad Hall and Stayer. They were completely dependent on the criminal network and their documents were taken from them on arrival in foreign countries in which they did not speak the language. The criminal network provided them with a sandwich or just enough alcohol to survive the day, while simultaneously earning over EUR 200 000 from the activities of the 11 victims. The victims were subjected to inhumane treatment and living environments and endured violent behaviour at the hands of the suspects. Two of the victims died because of health-related issues while being exploited in extremely degrading conditions. The criminal gang also forced a similarly vulnerable person to work at their house and treated him as domestic slave. Europol facilitated the exchange of information and provided analytical support in this investigation. On the action day, Europol deployed a virtual command post to enable the real-time exchange of information between investigators, Europol and Eurojust.  Eurojust set up a Joint Investigation Team between Germany, Hungary, Romania and Europol in 2021. Participating Authorities: Austria: Regional Criminal Office of Upper Austria (Landeskriminalamt Oberösterreich) and Criminal Intelligence Service Vienna, Trafficking in Human Beings Unit (Bundeskriminalamt, Zentralstelle zur Bekämpfung des Menschenhandels). Germany: CID Ingolstadt (Kriminalpolizeiinspektion Ingolstadt) ), the German Bavarian State Police (Polizei Bayern). Hungary: Rapid Response and Special Police Services, National Bureau of Investigation, Trafficking in Human Beings Unit (Készenléti Rendőrség Nemzeti Nyomozo Iroda, Emberkereskedelem Elleni Osztály). Romania: Directorate for Investigating Organised Crime and Terrorism within the Romanian Police (Poliția Română, Serviciul de Combatere a Criminalității Covasna).  

The forum targets organised crime threats against the NextGenerationEU recovery fund. Representatives from EU Member States, the European Commission, the European Public Prosecutor's Office (EPPO), Eurojust, the European Anti-Fraud Office (OLAF), the European Union Agency for Law Enforcement Training (CEPOL), and the Recovery and Resilience Task Force attended the forum. The forum had an operational approach, focusing on prevention and enforcement while maintaining and stepping up cooperation among the EU Member States and relevant EU bodies and agencies. Special attention was paid to the 'green transition' and the 'digital transformation' elements of the recovery plan, given the scope of NextGenerationEU funds distributed in these two key areas. Europol also presented its operational work that has taken place since September 2021 under Operation Sentinel. NextGenerationEU NextGenerationEU is the European Union's EUR 806.9 billion temporary recovery instrument to help repair the immediate economic and social damage brought about by the COVID-19 pandemic. Currently, the NextGenerationEU funds are progressively allocated to the European Union Member States.   Operation Sentinel In October 2021, Europol launched Operation Sentinel to draw an overall risk map of the relevant emerging threats to the NextGenerationEU Recovery and Resilience Facility allocation. The 12-month operation aims to map vulnerabilities inherent to the national allocation systems and identify the fraud schemes used to target the NextGenerationEU fund.  First NextGenerationEU - Law Enforcement Forum The first meeting of the NextGenerationEU - Law Enforcement Forum was held in Rome in September 2021. Attending justice and law enforcement institutions agreed that any threat to the European Recovery Funds equates to hindering the financial well-being of the European Union.  

Coming at the request of these countries, Europol now has operational teams in Lithuania, Poland, Romania, Slovakia and Moldova, with an upcoming deployment planned to Hungary.  These teams, comprised of Europol specialists and guest officers, support the national authorities with secondary security checks and investigations at the European external borders to identify criminals and terrorists trying to enter the EU in the refugee flow and exploit the situation. These operational teams are also gathering information in the field, which is used to develop criminal threat assessments at the European level and to support investigations.  These secondary security checks are an important tool to manage the large incoming influx of refugees fleeing Ukraine. Europol has already carried out such a service at the request of EU Member States in the migration hotspots in the Mediterranean as of 2016.  This complements Europol’s active engagement with Ukrainian law enforcement through the Ukrainian liaison officer present at Europol’s headquarters in the Netherlands.  All this intelligence gathering activity is allowing Europol to anticipate developments and coordinate operational activities with EU Member States to respond to the activities of criminal groups seeking to take advantage the war in Ukraine.   

The Romanian Police (Poliția Română) and the United Kingdom Intelligence Directorate, supported by Europol and Eurojust, dismantled a criminal network involved in human trafficking for sexual exploitation and money laundering. The suspects were also involved in other criminal activities including aggravated property crime and drug trafficking.  The action day on 29 March led to: 18 house searches (11 in Romania and 7 in the UK); 14 suspects (4 in Romania and 10 in the UK) were subject to judicial measures; Four victims, most of whom were Romanian nationals, identified in the UK; Seizures included several mobile phones, drugs, weapons, bullets of different calibres, over EUR 60 000 in cash and 20 credit cards. Criminals earned up to EUR 1 800 per victim per day Active since 2020, the criminal network lured vulnerable Romanian females into prostitution in the UK. The members of the network promised victims employment or relationships, and targeted individuals from poor backgrounds seeking a way to earn money to send back home to support their families. Young and impressionable, many of the victims met the Romanian males via social media platforms and believed they had a romantic relationship with them. Once tricked, the female victims were forced into prostitution. The members of the criminal network controlled their behaviour by taking their documents and money and threatening to harm or kill their family members and children back in Romania. It is believed that the criminal network was earning up to EUR 1 800 per day per victim. The large amount of criminal proceeds generated was transferred back to Romania via cash couriers. The investigation suggests that more than 100 females have become victims of the criminal network since 2020. The lover boy trick  The lover boy technique is widely used by criminals to recruit victims confronted with economic and social hardship. The suspects target their victims’ vulnerabilities and seduce them with expensive gifts and promises of a better life abroad. This is the reason many women leave their families in search of love and new opportunities in other countries. However, once they find themselves in their new home, they are forced into prostitution to earn money for their handler. The victims are lured with affection, violence and threats against them and their families back home.  Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed an expert to Luton, United Kingdom to cross-check operational information in real time and support the investigators on the ground.     Eurojust set up a joint investigation team (JIT) between the United Kingdom and Romania in 2021 to coordinate the judicial cooperation.  

On 15 March, over 40 judicial customs investigators, with the support of special intervention teams of the French National Police (RAID) and two Europol experts deployed on the ground, simultaneously searched 13 sites, including industrial premises as well as private residences, in and around the city of Lyon. In addition to the arrests, over 2.5 tonnes of counterfeit cigarettes were seized, worth about EUR 1 250 000 in France, alongside EUR 100 000 in cash and EUR 150 000 in winning lottery tickets bought by the criminals to launder the profits. Four guns and many types of ammunition were seized. The French investigators have since then been able to uncover that the counterfeit cigarettes were imported from different European countries, before being stored in warehouses located in industrial areas and then sold on the black market in several French cities.  Coordination by Europol Europol’s EFECC supported the investigation by providing its secure communication platform and facilitating international cooperation between France and a number of other European countries, running cross-checks and providing analytical support and operational expertise. Two of its experts were deployed to Lyon to support the French Customs on the action day.  Excise fraud is currently an EU law enforcement priority. Strategic and operational plans have been developed under the European Multidisciplinary Platform Against Crime Threats (EMPACT) Excise Fraud Project. Under this umbrella, a total of 24 countries led by Belgium are working together on countering the illicit production of cigarettes in the European Union.    

On 24 and 25 March hundreds of officers, including special intervention teams, raided a total of three call centres belonging to the same organised crime group. Its members are accused of defrauding victims across the world. Under their orders, an army of up to 200 fake ‘traders’, speaking English, Russian, Polish and Hindi, would call unsuspecting victims to persuade them to part with their savings, promising lucrative investment opportunities. However, the investments in bitcoin, commodities and foreign currencies were all fake.  According to preliminary calculations, the suspects arrested are believed to have turned an illegal profit of over EUR 3 million per month with this scam.  The coordinated strike against them resulted in: 80 people detained in Latvia and 28 detained in Lithuania; Seizure of cash, bank accounts and luxury vehicles; EUR 95 000 in cryptocurrencies seized.  Europol’s European Financial and Economic Crime Centre supported the investigation from the onset by bringing together the national investigators from Latvia and Lithuania to establish a joint strategy and to organise the intensive exchange of evidence needed to prepare for final phase of the investigation. Europol experts from both its European Financial and Economic Crime Centre and European Cybercrime Centre were deployed to Latvia and Lithuania to assist the national authorities with the action days.  Eurojust supported by setting up a joint investigation team (JIT) into the case within one week and organising a rapid coordination meeting. Further assistance was given with the execution of a European Investigation Order during the action day. 

Between October 2021 and 31 January 2022, Europol coordinated operation Ludus II targeting trafficking of counterfeit toys and other goods. Ludus II, led by the Spanish Civil Guard (Guardia Civil), Spanish National Police (Policia Nacional) and the Spanish Customs authorities (DAVA) and co-led by the Romanian Police, involved law enforcement authorities from 21 countries in total. The EU Anti-Fraud Office (OLAF) and the European Union Intellectual Property Office (EUIPO) also supported the operation, while the World Customs Organisation (WCO) took part as an observer and provided secure communication with its members to support the operational activities. The seizures made during the operation include counterfeit and illegal puzzle games, video games and related characters, board and card games, dolls and puppets from famous TV series, bricks for children and clothing and accessories from famous brands. The seized goods contain risks such as chemical exposure, strangulation, choking, electric shock, damage to hearing and fire hazards. This was the outcome of an analysis of the EUIPO on these alerts, which led to the setting up of the first operation Ludus in 2020. Read Europol’s analysis report on this first edition. During the operational phase of Ludus II, law enforcement authorities performed checks and inspections to detect illegal shipments and storage. A number of raids followed online investigations initiated on e-commerce platforms. The majority of fake toys were imported from East Asia to the EU, UK and the US. Authorities detected intellectual property rights violations, lack of CE markings and EU Declarations of Conformity and the presence of undesirable dangerous substances.  Operation Ludus II in a nutshell Seizures worth nearly EUR 18 million  More than 5 million counterfeit toys 2 600+ administrative/health prevention cases opened 99 individuals reported to judicial authorities 1 459 individuals reported to administrative/health authorities 72 online markets checked 30 websites shut down Operational highlights In the Lazio and Campania regions, the Italian Financial Corps (Guardia di Finanza) intercepted and seized a large amount of illegal puzzle games coming from an Asian country. The toys were stored in two warehouses. The French Customs authorities (Direction Générale des Douanes et Droits Indirects) disrupted a regular supply of counterfeit toys, which were sold via a famous e-commerce platform. The investigation, named Pokezone, allowed authorities to detect a large amount of products, which were being sold on the internal markets of France and six other countries.  International front against fake toys Europol coordinated the operational activities, facilitated the communication exchange and provided operational analysis. Europol also supported the activities with technical expertise.  Europol’s IPC3 (Intellectual Property Crime Coordinated Coalition), which supported the investigation, is a project to combat intellectual property crime co-funded by the EUIPO (European Union Intellectual Property Office). Participating EU Member States: Belgium, Bulgaria, Croatia, Czechia, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, the Netherlands, Portugal, Romania, Slovakia, Slovenia, Spain. Third-party countries: Cote d’Ivoire, North Macedonia, United Kingdom and United States.

The French National Police (Police Nationale), the Romanian Police (Poliția Română) and the Spanish National Police (Policía Nacional), supported by Europol and Eurojust, dismantled a criminal network involved in human trafficking for sexual exploitation. For the purposes of this investigation, Europol established an operational task force which led to the identification of the leader of the criminal gang. He was also recognised as a high-value target for this investigation.  The action day on 22 March led to: 16 house searches (10 in France and 6 in Romania); 7 arrests (2 in France and 5 in Romania,  including the high-value target identified by the law enforcement authorities involved); 32 victims identified, most of whom were Romanian nationals (13 in France and 19 in Romania); Seizures included digital equipment and mobile phones, cannabis from an indoor lab, luxury vehicles and over EUR 23 000 in cash.   The evidence collected during the investigation suggests that the criminal network had been active since 2014. The members of the criminal gang manipulated their victims into prostitution for the financial benefit of the criminal network. They targeted vulnerable victims from financially and emotionally unstable situations using the so-called lover boy method. The criminal network forced victims to continue working by using threats and acts of violence against them or their family members. The investigators have already identified 28 victims exploited by the gang in France. Based in France, Spain and Romania, the members of the criminal network operated out of rented locations in France and Romania. Evidence suggests that the criminal network channelled around EUR 1.3 million in illegal proceeds to Romania via money transfer companies, and transferred more assets via cash couriers. This money originated from 250 localities in 25 different states. 80 % of the money transfers were made from internet cafes in Barcelona and addressed to the leaders of the organisation in Romania. They laundered the criminal proceeds in Romania through investments in real estate and luxury goods. They also used part of the illegal profits to finance different criminal activities.  The lover boy trick  The lover boy technique is widely used by criminals to recruit victims confronted with economic and social hardship. The suspects target their victims’ vulnerabilities and seduce them with expensive gifts and promises of a better life abroad. This is the reason many women leave their families in search of love and new opportunities in other countries. However, once they find themselves in their new home, they are forced into prostitution to earn money for their handler. The victims are lured with affection, violence and threats against them and their families back home. In this particular case, the victims were captured in Ploiesti (Romania) using the lover boy trick and transferred by plane to Barcelona (Spain), where they were housed in flats for several days which had been arranged by the organisation. This gave the organisers enough time to buy suggestive clothes for the victims. They were then transferred to accommodations rented by the organisation in different locations, including the south of France (Marseille, Nice) and Spain (Costa Brava and Ibiza). The victims were then ‘advertised’ on internet platforms specialising in sexual services. Cross-border coordination In 2020, together with France, Spain and Romania, Europol established an operational task force to jointly target this criminal network. The specific set-up of this task force enabled the investigators to easily identify the modus operandi of the criminal group and use the intelligence gathered to identify the leaders and their associates. Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. Europol deployed an expert to Romania to cross-check operational information in real time and support the investigators on the ground.     Eurojust set up a joint investigation team (JIT) between France and Romania. Five suspects were arrested as a result of five European arrest warrants.   

Fourteen workers mainly from Eastern Europe were arrested, and the Belgian authorities seized the complete cigarette manufacturing machinery. Some four tonnes of tobacco and two million counterfeit cigarettes were also seized at the premises in Arlon. An additional 40 million counterfeit cigarettes presumably manufactured at the illegal factory in Arlon were seized in trailers in an industrial area in Duffel, Belgium. These cigarettes were most likely destined for the black market in France and the United Kingdom. The tax loss in Belgium alone is estimated at EUR 20 million. The action on 15 March was the result of intensive international cooperation via Europol. French Customs (Douane) were also involved in the investigation and seized over 25 tonnes of counterfeit cigarettes and 16 tonnes of tobacco belonging to the same organised crime group in the city of La Longueville.  The organised crime group under investigation is involved in the large-scale production and distribution of counterfeit cigarettes. A number of investigations are ongoing against them in several European countries.  European coordination Europol’s EFECC supported the investigation by providing its secure communication platform and facilitating international cooperation between Belgium and France ,running cross-checks and providing analytical support and operational expertise. One of its experts was deployed to Arlon to assist the Belgian authorities with the action day.  Excise fraud is currently an EU law enforcement priority. Strategic and operational plans have been developed under the European Multidisciplinary Platform Against Crime Threats (EMPACT) Excise Fraud Project. Under this umbrella, a total of 24 countries led by Belgium are working together on countering the illicit production of cigarettes in the European Union.    

The criminal network, led by a mother and son of Lithuanian origin, was composed of members mainly of Spanish, Lithuanian and Moroccan origin. The gang counterfeited EUR 20 and EUR 50 banknotes in Spain using three different printing machines, having purchased the paper and guillotine on a well known e-commerce platform. The counterfeiters were disseminating the fake notes by selling them on the dark web. The suspects used the illegal profits from the currency counterfeiting to invest in the production and trafficking of marijuana. Members of the network were also involved in different scams and identity theft. In one such scheme, they published false job offers for drivers and used the driving licence of the job applicants to rent high-end vehicles, which they never returned. Europol facilitated the information exchange, operational coordination and provided analytical support. During the action day, Europol supported with technical expertise and cross-checked operational information against Europol’s databases and the systems of the European Central Bank.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

In light of the worsening situation in Ukraine and the hundreds of thousands of people fleeing to the neighbouring countries for safety, Europol is continuing to work at all levels to support the EU Member States geographically close to the conflict.  On the same occasion, Europol’s Director also met with the Executive Director of the European Border and Coast Guard Agency (Frontex), Fabrice Leggeri, to discuss on operational cooperation between the two agencies, in particular in the fight against migrant smuggling and the trafficking of human beings.  Conflict creates opportunities for organised crime to flourish and amplifies the threat that criminal groups may pose to internal security. At the heart of the European’s security architecture, Europol is uniquely placed to support EU Member States at the frontline. Europol provides:  Support with secondary security checks at European external borders to identify criminals and terrorists trying to enter the EU; Support in collecting and assessing information to detect criminal offences and threats, in particular in the areas of migrant smuggling and trafficking in human beings; A full intelligence picture and consolidated data analysis; A secure platform for the exchange of information with Europol, operational actors in the field and with other Member States and partner agencies.   Europol is in permanent dialogue with the neighbouring countries most affected by the conflict in Ukraine.   

Catherine De Bolle, Executive Director of Europol: I am confident that the AP4AI Project will offer invaluable practical support to law enforcement, criminal justice and other security practitioners seeking to develop innovative AI solutions, while respecting fundamental rights and being fully accountable to citizens. This report is an important step in this direction, providing a valuable contribution in a rapidly evolving field of research, legislation and policy. Professor Babak Akhgar, Director of CENTRIC: The AP4AI project will draw upon a huge range of expertise and research to develop world-first accountability principles for AI. Police and security agencies across the globe will be able to adopt a robust AI Accountability Framework, so that they can maintain a balanced, proportionate and accountable approach. About the EU Innovation Hub for Internal Security The EU Innovation Hub for Internal Security is a collaborative network of innovation labs that works to provide the latest innovation updates and effective solutions to support the work of internal security actors in the EU and its Member States, including justice, border security, immigration, asylum and law enforcement practitioners.  Click here to download the AP4AI Framework Roadmap report.  Learn more about AP4AI at www.ap4ai.eu and on Twitter @AP4AI_Project.  

EU Justice and Home Affairs Agencies support the work of EU institutions and Member States as they help Ukraine and its people now that war once again touches Europe.   By working together and utilising each agency’s particular expertise, we engage as a matter of urgency to assist EU Member States in terms of humanitarian support, respect for fundamental rights, management of EU external borders, visa measures, anticipation of hybrid threats, and reception of people fleeing war. This includes establishing a temporary protection mechanism for the displaced persons from Ukraine. Such support is in line with the measures agreed at the Justice and Home Affairs Council meeting on 3-4 March, as well as with the outcomes of the extraordinary Justice and Home Affairs Council meeting on 27 February in response to Russia’s military aggression over Ukraine.   We also encourage all staff of EU Agencies to help people in need and appreciate the support some colleagues already provide. The EU's Agency for Law Enforcement Cooperation (Europol) issues this statement as part of the network of nine EU agencies working on freedom, security and justice in the EU.   The nine Agencies are: the European Institute for Gender Equality (EIGE), the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA), the European Union Agency for Asylum (EUAA), the EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), the EU Agency for Criminal Justice Cooperation (Eurojust), the EU’s Law Enforcement Agency (Europol), the EU Agency for Fundamental Rights (FRA), the European Border and Coast Guard Agency (Frontex) and the European Agency for Law Enforcement Training (CEPOL). 

The latest Intellectual Property Crime Threat Assessment, produced jointly between Europol and the European Union Intellectual Property Office (EUIPO), reveals that the distribution of counterfeit goods has been thriving during the COVID-19 pandemic. The health crisis has presented new opportunities for trade in counterfeit and pirated products, and criminals have adjusted their business models to the meet the new global demand. The report, based on EU-wide data and Europol’s operational information, confirms that counterfeiting and piracy continue to pose a serious threat to the health and safety of consumers, as well as to the European economy. Imports of counterfeit and pirated goods reached EUR 119 billion in 2019, representing 5.8 % of all goods entering the EU, according to the latest data from OECD and EUIPO.  In addition to the categories of counterfeited clothes and luxury products seized, there is a growing trade in fake products which have the potential to damage human health, such as counterfeit medicines, food and beverages, cosmetics and toys. Counterfeit pharmaceutical products, ranging from a variety of medicines to personal protective equipment or face masks, have been increasingly identified in  recent years. Distribution has shifted almost entirely from physical to online markets, raising public health concerns. These illicit products largely continue to originate from outside the EU, but they may also be produced in illegal laboratories within the EU, which are difficult to detect and can be set up with relatively few resources. The production of illicit food products, and especially drinks, has become more professional and sophisticated, with some counterfeiters covering the whole supply and distribution chain. Violations of protected geographical indications continue to be widely reported too. The report also shows some key trends in various product sectors primarily targeted by counterfeiters. Clothes, accessories and luxury goods remain among the most popular product categories for counterfeit goods, sold both online and in physical marketplaces. They are one of the top categories of the approximatively 66 million counterfeit items seized by authorities in the EU in 2020. How criminal networks operate The threat assessment highlights that the distribution of counterfeit products mostly relies on digital platforms, a trend which has been reinforced by the pandemic and widespread online consumption. Counterfeit goods are offered on online marketplaces, via live-streaming, videos and advertising on social media platforms, and instant messaging services, usually targeting customers with misleading discounts or low-price branded products. Counterfeiting is a highly lucrative activity for the criminal networks involved, which reap large profits while running relatively few risks.  IP crime has been included as one of the EU’s priorities in the fight against serious and organised crime from 2022 to 2025 as part of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). The assessment underlines that, although the majority of counterfeits in the EU market are produced outside Europe, mainly in China and other parts in Asia, domestic manufacturing within the EU is an increasing trend. The increasing importation of counterfeit packaging materials and semi-finished products into the EU clearly points to the presence of illegal manufacturing facilities in the EU. Criminal networks based in Europe involved in IP crime carry out the distribution of imported counterfeits and, in some cases, operate modern production facilities that assemble semi-finished products. Europol’s Executive Director, Catherine De Bolle, said: The COVID-19 pandemic has presented new business opportunities for criminals to distribute counterfeit and substandard goods. At best, these products will not perform as well as authentic ones. At worst, they can fail catastrophically. Law enforcement seizures indicate that the production of these goods is increasingly taking place within the EU, while the COVID-19 pandemic has further entrenched the criminals’ reliance on the digital domain to source and distribute their illegal goods. This report shines a light on the extent of this criminal phenomenon and calls for concerted, cross-border action in response as we enter the post-COVID economic recovery. The unscrupulous counterfeiters should be the only ones paying a steep price. The Executive Director of the EUIPO, Christian Archambeau, said: This new threat assessment report casts new light on the scope, magnitude and trends of counterfeiting and piracy in the EU, and the damage it can cause to consumers’ health and to legitimate businesses, particularly during these challenging times of the COVID-19 pandemic. Through our close collaboration with Europol, we will continue to support the efforts of law enforcement authorities in the fight against IP crime. Other fake goods in the market Mobile phones, their accessories and components are also among the top categories of fake goods seized, and are sold in great numbers during sales events such as Black Friday and Cyber Monday. Counterfeiters have recently been exploiting the global supply shortage in semiconductor chips.  In the case of perfumes and cosmetics, the illicit production relates to everyday goods, such as shampoo, toothpaste, or detergents.  The trade in illicit pesticides remains a low-risk, high-profit activity, sustained by a high demand and low sanctions for the offenders. The COVID-19 pandemic also led to an increased offer of illicit digital content, which is often linked to other cybercriminal activities. Piracy is now mostly a digital crime, and websites illegally distributing audio-visual content are hosted on servers across Europe, Asia and the Middle East. Note to Editors The Intellectual Property Crime Threat Assessment  has been drawn up in partnership between Europol and the EUIPO and is intended to update policymakers, law enforcement authorities, businesses and the public in general about the latest trends of IP crime within the EU and, particularly, in the context of the COVID-19 pandemic. It provides information on the threat posed by counterfeiting and piracy in several product sectors, as well as the modus operandi of criminal networks, the enabling factors, the geographical and financial dimensions of IP rights infringements, and the emerging threats. The report builds on the findings of a previously developed Threat Assessment, published in 2019. About Europol Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner countries and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  About the EUIPO The EUIPO is a decentralised agency of the EU, based in Alicante, Spain. It manages the registration of the European Union trade mark (EUTM) and the registered Community design (RCD), both of which provide intellectual property protection in all EU Member States. The EUIPO also carries out cooperation activities with national and regional intellectual property offices of the EU, as well as research and activities to combat IP rights infringement through the European Observatory on Infringements of Intellectual Property Rights. The EUIPO ranked most innovative IP office in the world in the World Trademark Review's IP Office Innovation Ranking 2021. Media contact Europol Corporate Communications Unit Tel. : +31 70 302 5001  press@europol.europa.eu  EUIPO Communication Service Tel.: +34 653 674 113 press@euipo.europa.eu  

Europol supported an international investigation into tens of thousands of accounts possessing and sharing child sexual abuse material online. The operation, led by the Te Tari Taiwhenua Department of Internal Affairs, has so far involved law enforcement authorities from Australia, Austria, Canada, Croatia, Czechia, Greece, Hungary, Slovenia, Spain, the UK and the US. The international coordination of the investigative activities facilitated the identification of a large number of individuals tied to these accounts.  The investigation was initiated in 2019, following a report from an online service provider, which indicated that a large number of offenders used the platform to exchange particularly disturbing child abuse images, including imagery depicting sadistic acts of sexual abuse of infants and children. The review of the information led to the discovery of 32 GB of files, the equivalent memory necessary to stream approximately 90 minutes of video. To date, the international investigation has led to the opening of 836 cases internationally, the arrests of 46 individuals across New Zealand, the identification of more than 100 suspects across the EU and the safeguarding of 146 children across the globe. The operational activities led to the identification of users worldwide and this information was shared with the relevant national authorities for further action. In two of the cases in Austria and Hungary, the suspects were offenders abusing their own children, who were six and eight years old respectively. Both children were subsequently safeguarded. Another investigation in Spain uncovered that the suspect possessed and disseminated child sexual exploitation material, while also filming naked and sexual images of adults without their consent. A large number of investigations are still ongoing across the EU. Europol facilitated the exchange of information and coordinated the partner agencies. The agency also provided analytical support by cross-checking the data and providing greater detail for the investigative intelligence packages, which were then disseminated to the national law enforcement authorities participating in this operation. Participating authorities  International and EU organisations: Europol and Interpol EU Members States Austrian Criminal Police Office Croatian National Police Czech National Police Hellenic Police Hungarian National Bureau of Investigation  Slovenian Police  Slovakian National Police Spanish National Police  Third party countries New Zealand Department of Internal Affairs (lead agency) New Zealand Police New Zealand Customs Service Australian Federal Police Royal Canadian Mounted Police  Toronto Police Service/Canada Vancouver Police Service/Canada UK National Crime Agency US Federal Bureau of Investigation Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

An investigation by the French Border Police (Police aux Frontières/Police Judiciaire which forms part of the National Police) and the Spanish National Police (Policía Nacional), supported by Europol, led officers to the dismantling of an organised crime group involved in the procurement and distribution of forged ID documents and travel documents in France, Germany, Italy and Spain. Georgian authorities also supported the investigation through information exchange.    Results from the action days in France and Spain (between 31 January and 16 February 2022) 6 houses searched (3 in France and 3 in Spain); 17 arrests (3 main suspects in France and 14 suspects in Spain); Seizures include electronic equipment (computers, smartphones and storage devices), counterfeit and genuine ID documents and photocopies of ID documents, labour certificates, administrative documents, payment cards and cash. The criminal network was distributing forged ID and travel documents in France, Germany, Italy and Spain. The documents were used by other criminals involved in the smuggling of migrants to the US, the UK and Ireland and other criminal activities (such as property crimes, trafficking in human beings, drug trafficking). The criminal network was directly involved in migrant smuggling activities and logistical arrangements in return for payments starting at EUR 8 000 per person.  The members of the criminal network, mainly originating from Eastern European countries, were operating in several countries including France, Germany, Georgia, Italy, Lithuania, and Spain. The criminal network largely distributed the counterfeit documents on the dark web, but also on instant messaging applications and postal services. They counterfeited mainly French, Romanian, Georgian, Lithuanian and Polish IDs. They also counterfeited residence permits, driver’s licenses, vehicle registration documents and travel documents. The suspects used messaging applications to communicate and to exchange pictures of documents, vehicles and money transfer slips. Analysts at Europol were able to use the information from this case to reveal many links with other ongoing investigations, based on information they already had. Europol prioritised the case at an early stage and assigned a dedicated analyst and a specialist to support the national investigations. Europol facilitated the secure exchange of information and the organisation of operational meetings between the investigators, also providing the law enforcement partners with regular intelligence analysis packages. On the action day, Europol deployed an expert to Spain to assist with the cross-checking of operational information against Europol’s databases, and to provide technical support with data extraction and analysis of digital evidence.  Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

A total of 4 properties were searched in Dortmund. As a result, 3 suspects were arrested in and around Dortmund (Germany).  This criminal network comprised Bosnian nationals who were residing illegally in Germany and committing crimes in the federal states of Lower Saxony, North-Rhine Westphalia and Hesse.   They are suspected of breaking into residential buildings at night in order to steal the keys of expensive vehicles before driving off with them. The total value of the stolen vehicles exceeds EUR 1.5 million.  This investigation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT), together with the support of the EU funded project ‘Countering Serious Crime in the Western Balkans – IPA 2019’ implemented by the Italian, German and Dutch authorities which provided financial support for the organisation of operational meetings and the deployment of German investigators to Austria on the action day.  Europol coordination  Europol brought together the national investigators who have since been working closely together to establish a joint strategy to bring down this network. Since then, Europol has provided continuous intelligence development and analysis to support the field investigators. During the action day, Europol’s European Serious Organised Crime Centre deployed a mobile office to the operational centre in Dortmund, enabling a direct connection between investigators in all three countries involved.

The increased digitalisation brought about by the pandemic has significantly influenced the functioning of every aspect of our society. Since the beginning of the COVID-19 pandemic, criminals have adapted to the new rules and restrictions and exploited those most vulnerable as a result. Migrant smugglers and human traffickers in particular have continued to thrive in spite of these changes, and they have adapted the way they recruit, transport and exploit victims. Europol’s Executive Director Catherine De Bolle said:  “Migrant smuggling and human trafficking networks are highly dynamic and use any crisis as an opportunity to increase their illegal profits. More digitalised than ever, they abuse social media platforms, mobile applications and encrypted communication tools to offer their illegal services, organise their logistics and secure their profits. Swift information exchange, cross-border cooperation and online referrals, facilitated by Europol, have proven instrumental in tackling these smugglers and traffickers. The information shared by Member States with Europol has been the backbone of the analytical support we have provided to more than 800 priority investigations over the past six years. Europol will further strengthen its partnership with the authorities of Member States and other EU bodies and will forge new alliances in Europe and beyond to curb these crimes, both in the digital and the physical space.” The Head of the European Migrant Smuggling Centre Robert Crepinko added: “There are numerous reasons to believe that the law enforcement community has never been better connected, better trained, or better equipped to counter the criminal activities of migrant smugglers and human traffickers. Yet there is still a lot to be done. Rapid technological developments in particular are forcing Europol’s EMSC to join forces in order to shape new investigative techniques. Europol remains the perfect platform for fostering law enforcement innovations.” 2021 has seen an increase of the role that digital technologies play in migrant smuggling and the trafficking of human beings. Migrant smugglers have expanded their use of social media platforms and mobile applications in order to offer their illegal services. Human traffickers have abused the anonymity of the internet environment to target vulnerable individuals and then exploit them via both escort websites and even dating platforms. To respond to this new threat, Europol has coordinated the first referral action day targeting the facilitation of illegal immigration services offered online, amongst other responses.   Highlights of the European Migrant Smuggling Centre’s activities in 2021  6 139 new cases of migrant smuggling and trafficking in human beings supported by Europol in 2021; 55 on-the-spot action days with Europol experts; 1 246 operational reports produced; 26 high-value targets identified. New developments Increase of border crossings into the EU and in secondary movements within the EU; Enhanced use of digital technologies in both facilitation of illegal immigration and trafficking in human beings; Increased number of arrivals has placed Cyprus ahead of Greece as the prominent landing area on the Eastern Mediterranean; The migratory pressure on the eastern borders route via Belarus has influenced the increase of the presence of criminal networks facilitating secondary movement along that route; Smuggling activities on the passage by sea to Italy almost doubled, while the fee for this journey jumped from EUR 6 000 to EUR 12 000; Increased poly-criminality of migrant smuggling networks active along the Western Mediterranean and Western African routes; The process of human trafficking, including recruitment and logistical arrangements, is becoming increasingly digitalised while the locations of physical abuse remain the same.   The new report by the European Migrant Smuggling Centre (EMSC) at Europol looks back at the operations supported by the centre in 2021 and the intelligence gathered. This report provides a clear outlook into the evolution of these crime areas and anticipates possible developments. It offers recommendations for enhanced preparedness in the fight against these criminal activities threatening which directly threaten the lives and dignity the lives of the victims. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

On 16 February, over a hundred officers simultaneously raided addresses on either side of the border, resulting in: Eight suspects detained 2 tonnes of cut tobacco and tobacco strips seized Over 10 000 counterfeit cigarettes seized, alongside equipment for tobacco cutting and drying  EUR 37 800 in cash recovered Property searches were carried out in the province of Sevilla (Spain) and in the cities of Coimbra, Lisbon, Leiria and Aveiro (Portugal).  The criminals are suspected of having illegally imported from Spain to Portugal large quantities of tobacco leafs and strips, destined to produce counterfeit cigarettes. This criminal network had tobacco storage and production facilities scattered across both countries.  It is believed that these criminals have smuggled over 7 tonnes of tobacco products from Spain to Portugal in 2021 alone.  The revenue loss generated by this illegal activity is estimated at over EUR 163 000 in Portugal.  Europol support Europol’s support was instrumental in the success of the case: Europol brought together the national investigators on both sides who have since been working closely together to establish a joint strategy to bring down this network. Since then, Europol has provided continuous intelligence development and analysis to support the field investigators. During the action day, Europol’s European Financial and Economic Crime Centre deployed a mobile office to Sevilla and provided financial support for the deployment of two Portuguese officers in the operational centre in Spain. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).   

An extensive investigation involving the Brazilian Federal Police (Polícia Federal), Spanish Civil Guard (Guardia Civil), the US Drugs Enforcement Administration and the Paraguayan SENAD, coordinated by Europol, has led to the dismantling of a major criminal organisation involved in large-scale cocaine trafficking and money laundering. The criminal network was shipping cocaine in maritime shipping containers. Since September 2020, authorities from Belgium, Brazil, Italy, Netherlands and Spain have seized about 10 tonnes of cocaine and BRL 11 million (about EUR 1.85 million). The action day on 15 February 2022 led to:Around 40 locations searched in Brazil, Paraguay, and SpainAround 30 arrests (in Rio De Janeiro, São Paulo, Santos e Volta Redonda, Brazil and 7 in Barcelona, Spain)Seizures included: drugs, vehicles, firearms, cash and several bank accounts in Brazil, Paraguay and SpainMulti-tonne cocaine trafficking to the EUThe investigative activities revealed that the criminal organisation could ship several multi-tonne cocaine consignments to Europe every few months. Authorities discovered a production infrastructure based in Bolivia with logistical and supply lines in Brazil, Paraguay and Uruguay. The investigation also uncovered the command and control centres of the organisation in Dubai. The members of the network used encrypted communications to coordinate their criminal activities. This included SKY ECC, a platform which was taken down in 2021. The suspects used these encrypted communications platforms to supply drugs to Europe and launder the criminal assets. The criminal organisation set up a network of companies to enable the import of drugs from South America and the laundering of the related proceeds. Front men in the payroll of the organisation controlled this network of companies.The exchange and proactive collection of criminal intelligence, supported by Europol, led to the discovery of a distribution network based in Valencia and Barcelona which was responsible for receiving the cocaine shipments and circulating them on the European market. Brazilian and Spanish authorities then intercepted a number of these shipments and identified some of the companies involved in the criminal scheme.Europol facilitated the exchange of information and provided continuous analytical support. The intelligence developments provided by Europol allowed the investigators in the field to create a detailed picture of the networks operating across countries and continents. On the Action Day, Europol deployed officers to Brazil and to Spain to support intelligence developments during the field activities.   Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. 

Colombia and Europol have a close partnership built and developed over the last two decades. The Agreement signed between the two parties is the most comprehensive one to date that Europol has concluded with a Latin American country and is considered a model for international law enforcement cooperation.  Colombia deploys to Europol’s headquarters liaison officers from the National Police of Colombia to work side by side with counterparts from over 40 countries. In discussions with Europol’s Executive Director, the President was briefed on how Europol’s global security architecture assists the Colombian authorities. Identifying areas for increased cooperation and additional operational support to tackle cross-border crimes, particularly drugs trafficking, was a key topic in the discussions.  Catherine De Bolle said: “Colombia is a key regional player for Europol in Latin America and we work closely with the Colombian National Police in a number of key areas, including the fight against drug trafficking, the identification of high-value targets and cybercrime. Against the backdrop of international crime becoming more interconnected, the need to reinforce this cooperation is paramount. Europol will continue working closely with its trusted Latin American partner to address transnational crime from all corners of the world.” On the occasion of this visit, medals were presented to Europol and its Executive Director by the Colombian President in recognition of Europol’s support to the National Police of Colombia in the fight against serious organised crime. Recent examples of cooperation with Colombia include: September 2021: Over 60 charged in crackdown on Balkan cartel behind cocaine pipeline to Europe  March 2021: Spanish Police seize first ever narco-submarine made in Europe November 2019: International crackdown on RAT spyware which takes control of victims’ PCs  

The suspects allegedly imported cocaine from Latin America to various European ports, organising the transport via planes, vessels, cars and lorries and running the wholesale trade. Spain and other EU Member States were used, to launder the proceedings of their trade.   During the Action Day, over 600 law enforcement officers in close cooperation with prosecutors and investigative officers carried out raids against the members of this network in Spain and Belgium. A number of parallel actions also took place in Croatia, Germany, Italy and the Netherlands.   Eurojust set up a coordination centre to enable rapid cooperation between the judicial authorities involved. Europol organised the intensive exchange of information and evidence needed to prepare for the final phase of the investigation. Two experts were deployed to facilitate the transnational police operations, using mobile offices on the spot. Today’s operation, coordinated at the international level by Europol and Eurojust, was the culmination of many months of meticulous planning between law enforcement and judicial authorities in preparation for the action. A joint investigation team (JIT) was set up between Belgium and Spain last year, with active assistance of Eurojust and Europol. Investigations in Spain started in 2018, with the arrest of a high-ranking member of the organised crime group, who is currently in pre-trial detention. In addition, an Operation Taskforce (OTF) was set up at Europol to pool investigative resources and expertise and develop the investigation internationally. In Belgium, investigations commenced following the seizure in September 2020 of drugs and large quantities  of chemicals, used to transform and preserve cocaine for trading purposes. Large quantities of cocaine seized during various searches all over Europe over the last years are to be linked to the suspects. This high-level criminal network had set up a string of enterprises in various countries to launder the profits, including Croatia and Spain, often using strawmen. Its members travelled regularly to Dubai, Mexico and Colombia to arrange their illegal business and used encrypted communication tools to coordinate activities. The following authorities took part in this investigation: Belgium: Federal Prosecutor’s Office (Parquet Fédéral, Federaal Parket), Investigative Judge of Brussels (Juge d’Instruction Bruxelles, Onderzoeksrechter Brussel), Federal Judicial Police (Federale Gerechtelijke Politie, Police Judiciaire Fédérale) Croatia: County State Attorney’s Office  Zagreb, Police Office for the Suppression of Organised Crime and Corruption (Policijski nacionalni ured za suzbijanje korupcije i organiziranog kriminala) Germany: Federal Criminal Police Office (Bundeskriminalamt), State Criminal Police Office of Hamburg (Landeskriminalamt Hamburg) Italy: District Anti-mafia Directorate  of Florence (Direzione Distrettuale Antimafia di Firenze), Anti-mafia Investigation Department (Direzione Investigativa Antimafia), Carabinieri (Arma dei Carabinieri) Spain: Investigative Court no. 2 (Jugado de Instrucción no. 2) of Palma de Mallorca; Public Prosecutor’s Office of Balearic Islands (Fiscalía de Islas Baleares), Public Prosecutor Office against Corruption and Organised Crime (Fiscalía Especial contra la Corrupción y la Criminalidad Organizada), Civil Guard (Guardia Civil), National Police (Policía Nacional)  The Netherlands: National Prosecutor’s Office (Landelijk Parket), National Police (Politie) United States: Federal Bureau of Investigation (FBI) United Kingdom: National Crime Agency The investigations and the action day itself have been supported by the @ON network with the use of funding granted by the ISF project nr. 101052683 ISF4@ON.

These arrests have taken place in the framework of two separate anti-terrorist investigations looking into the activities of Islamist militant cells operating on Spanish soil.  The first investigation, known as Operation KITAL, resulted in the arrest of three individuals in the cities of Barcelona, Girona and Valencia for terrorist financing. The main suspect has allegedly used a complex network of companies with international presence to divert funds to a terrorist militant group based in Libya with links to the Islamic State. He is believed to be himself related to the leadership of this militant group. The second investigation, known as Operation FARCOL, resulted in the arrest of two individuals for allegedly recruiting young fighters for the Islamic State in the Spanish city of Melilla. The Spanish National Police began the investigation two years ago after discovering indoctrination videos for the Islamic State believed to have been created and distributed by the two suspects.  The five suspects have been presented to a judge.   Europol’s support  These two investigations were supported by Europol’s Counter Terrorism Centre which provided continuous intelligence development and analysis to support the Spanish investigators. Europol experts were also deployed to Spain on the occasion of the two action days to assist the investigators with the cross-checking of operational information gathered during the raids.   

The criminal network, which has been active since 2020, predominantly consists of Syrian nationals. The suspects smuggled migrants mainly via flights from Athens to destinations in Germany. When the COVID-19 pandemic resulted in the limitation of flights, the criminals shifted their smuggling routes, opting for transportation via boat across the Mediterranean. The suspects used lookalike documents, taken from people they knew, to migrants mainly from Syrian origin. The network charged between EUR 3 500 and EUR 4 500 for each person they smuggled from Greece to their final destination in Western Europe.  Europol facilitated the exchange of information and provided analytical support. On the action day, Europol coordinated the police activities and crosschecked operational information against Europol’s databases in real time to provide leads to investigators in the field.  Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The referral activity targeted online content on explosive chemical precursors which was being shared among terrorist supporting networks, including jihadist, right-wing and left-wing terrorist networks.  The action day resulted in 563 pieces of content on 106 websites and platforms being assessed for referral to online service providers for their voluntary consideration against their terms and conditions.  The content included manuals and tutorials which gave instructions, among other things, on how to make bombs with the use of precursors and how to prepare and carry out terrorist attacks.  This action was part of a series of similar joint actions which have taken place in the past and will continue to be organised frequently. To know more about the work of the EU IRU, read the dedicated feature story.  

Initiated in October 2020, the investigation focused on an organised crime group involved in the illicit production and distribution of cigarettes. After two successful action days in France in April and May 2021 targeting the criminals involved in the distribution of these counterfeit cigarettes, the Slovenian authorities started a mirror investigation, aimed at arresting the suspects responsible for the production of these illegal products.  Following several coordination meetings between the French and Slovenian judicial and law enforcement authorities under the aegis of Eurojust and Europol, it was agreed to organise an action day in Slovenia.  On 25 January, over a hundred officers from the Slovenian National Police Force (Policija) and Financial Administration (Finančna Uprava) simultaneously raided 11 sites, including industrial premises and private residences. They were assisted in the field by officers from the French Gendarmerie (Gendarmerie Nationale), as well as French magistrates from the Bordeaux Interregional Specialised Court (JIRS) and Europol officers.   This action made it possible to find several production sites established in warehouses located in remote areas of Slovenia. In total, over 26 tonnes of tobacco were seized in Slovenia, as well as 29 million filters, several machines intended for the cigarette manufacture and ten tonnes of printed papers for packaging. The amount of cigarettes which could have been produced with the seized merchandise would have had a value of €13 million on the French market.  Two leaders of the criminal network in charge of the manufacture of cigarettes were arrested on the ground of European arrest warrants, one in Croatia, one in Slovenia. They will be handed over to the judicial authorities of the Bordeaux JIRS. Earlier in the same case, the Slovenian Financial Administration seized in November 2021 some additional 12 tonnes of cut tobacco. Europol’s European Financial and Economic Crime Centre (EFECC) has supported the investigation by providing its secure communication platform and facilitating international cooperation between France, Slovenia and other Member States, running cross-checks and providing analytical support and operational expertise. One of its experts was deployed to Maribor in Slovenia to assist the national authorities with the action day. 

Judicial and law enforcement authorities in Bulgaria, supported by Europol and Eurojust, have taken down a network of online investment fraudsters involved in money laundering. On the action day on 26 January, officers from the Bulgarian National Police (ГД Национална Полиция) arrested one suspect for defrauding mainly German and Greek investors of at least EUR 10 million. During the action day, a total of 24 locations were searched, while officers interrogated 66 witnesses in Sofia and Burgas. Furthermore, a variety of electronic equipment, financial information and recordings were seized.   Europol deployed two experts on the ground in Bulgaria to facilitate the information exchange and provide real-time operational analysis and technical expertise. Eurojust coordinated the joint action day and provided cross-border judicial support. The national authorities deployed around one hundred officers and prosecutors during the action day. The scam was exposed after complaints were made by German and Greek investors who had lost all of the deposits they had invested in the online scam. The organised crime group responsible had set up websites and call centres that appeared to be legitimate but were actually fraudulent.   The fraudulent activity was conducted by two call centres. While acting as financial consultants, call operators speaking German, Greek, English and Spanish contacted potential investors with promises of significant profits. As a result, several hundred victims made substantial investments but subsequently lost all of their money.   In 2019, Bulgarian authorities started investigations and Eurojust set up a joint investigation team (JIT) between Bulgaria, Germany, Greece, Serbia and Europol. Following five coordination meetings with Europol and Eurojust, the JIT members were able to identify the two fraudulent call centres in Bulgaria. The Bulgarian police, supported by the Serbian authorities, dismantled both call centres on the action day.  In 2020, a similar modus operandi was used in another case and a coordinated action day led to the dismantling of two other call centres. The following authorities participated in the operation: Law enforcement authorities:  Bulgaria: Economic Crime Department, General Directorate National Police; National State Security Authority and Regional Directorate of the Ministry of Interior - Burgas. Germany: Criminal Investigation Department Bayreuth: Federal Criminal Police Office, Wiesbaden Greece: Cybercrime Division of the Hellenic Police Serbia: Criminal Police Directorate, Service for Combating Organized Crime, Department for Cyber Crime Judicial authorities: Bulgaria: Specialised Prosecution Office of Sofia Germany: Office of the Public Prosecutor General of Bamberg; Bavarian Central Office for Prosecution of Cybercrime Greece:  General Prosecutor's Office of the Supreme Court;  Greece: Special Investigative Judge for Mutual Legal Assistance in criminal matters at the Court of First Instance of Athens, the competent Investigative Judge of the Court of First Instance of Athens, the competent Investigative Judge of the Court of First Instance of Thessaloniki Serbia: Republic Public Prosecution Office and Special Prosecution Office for High-Tech Crime of Serbia  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

 Myth #1 – Cryptocurrencies have become the payment method of choice for criminals The use of cryptocurrency as part of criminal schemes is increasing, and the uptake of this payment medium accelerating. However, the overall number and value of cryptocurrency transactions related to criminal activities still represent only a limited share of the criminal economy when compared to cash and other forms of transactions. A range of constraints are related to the use of cryptocurrencies, with high volatility a major factor in criminals’ reluctance to use cryptocurrencies for long-term investments.  Myth #2 – The criminal use of cryptocurrency is limited to cybercrime The criminal use of cryptocurrency is no longer primarily confined to cybercrime activities, but now relates to all types of crime that require the transmission of monetary value, including fraud and drug trafficking. However, the scale and share of the illicit use of cryptocurrencies as part of criminal activities is difficult to estimate. Criminal networks involved in serious and organised crime also continue to rely on traditional fiat money and transactions to a large degree, in addition to emerging value transfer opportunities.  Myth #3 – Illicit funds flow straight from wallet to wallet Criminals have become more sophisticated in their use of cryptocurrencies. The illicit funds increasingly travel through a multi-step process involving financial entities, many of which are novel and are not yet part of standardised, regulated financial and payment markets. Obfuscation methods and other countermeasures continue to be developed and used by criminals.  Myth #4 – Cryptocurrencies provide anonymity  Cryptocurrencies are not anonymous. Every single transaction is logged onto the blockchain, which is a ledger of all transactions distributed to all users in the network. Most blockchains are publicly available, making transactions traceable.  This gives law enforcement access to substantially more information than a case involving cash. While privacy coins and a number of services and techniques may hinder law enforcement investigations, it does by no means stop law enforcement from finding out who is hiding behind the crime.  Recent Europol examples are testimony to this: October 2020: 20 arrests in QQAAZZ multi-million money laundering case May 2021: Trading scheme resulting in €30 million in losses uncovered June 2021: Europol helps Belgian and Swiss authorities unravel Vitae Ponzi scheme   Download Cryptocurrencies: tracing the evolution of criminal finances Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner countries and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol is doing its part in making Europe safer.   

The searches in the morning of 18 January led to: Three arrests EUR 124 620 in cashPackaging material (such as plastic containers, paper packaging and stickers)Documents containing orders placed, customer names, and drug pricesNumerous courier delivery slips Offensive weapons including a pistol, a knife, and a knuckle-dusterThree winning gambling tickets worth just under EUR 20 000 Nine mobile phones and one SD cardLaw enforcement believes that the criminal operation began in 2017, offering for-profit storage, marketing, distribution and supply of banned anabolic steroids and counterfeit medicines, such as anti-erectile dysfunction drugs. The criminals, who were based in Greece, sourced their illicit substances mainly via China and Eastern Europe. The criminals also sourced packaging for the illicit substances in these countries, even securing counterfeit authenticity tapes of Greece’s National Medicines Agency. The suspects are alleged to have had an international clientele that included dozens of professional athletes, while deliveries were done using international courier services based on false sender information. Profits were then laundered using bank accounts made with stolen identities, and via gambling tickets. Europol supported the operation with the deployment of a specialist to the headquarters of Greece’s Financial Police Directorate. Europol’s Property Crime Coordinated Coalition (IPC3) is co-funded by EUIPO (European Union Intellectual Property Office) to combat intellectual property crime. 

Hundreds of millions of euros for smuggling more than 1 100 migrants into the EU Authorities believe that the suspects, mainly of Iraqi and Syrian origin, are part of a criminal network of about 80 members that is allegedly responsible for at least 30 sea smuggling operations. The criminal group operated migrant smuggling activities from Turkey to the Salento coast of Italy via Albania and Greece, then to other EU countries. The investigation started with the detection of an ongoing smuggling operation, which saw the successful rescue of the transported migrants and the arrest of eight low-level smugglers. The criminal networks primarily used sea routes for the transfer of migrants from Turkey, via the Eastern Mediterranean road, to their final EU destinations. The sea transfers were performed with the use of leisure vessels, mainly yachts, acquired or rented by the criminal network and skippered by novice seamen purposely recruited by the network. The suspects used informal money transfer services such as the hawala system to receive payments from migrants, with their illegal profits estimated at several hundred million euros.   Cross-border cooperation to increase detections Europol supported this investigation for over 18 months, facilitating the secure exchange of information and the organisation of operational meetings between the investigators, also providing the law enforcement partners with regular intelligence analysis packages. On the action day, Europol deployed two experts to Albania, one to Italy and one to Greece to assist with the crosschecking of operational information against Europol’s databases, and to provide technical support with data extraction and analysis of digital evidence. In addition, Europol facilitated the exchange of investigators to ensure effective tactical support to the operation during its last phase and on the action day. Further operational activities are ongoing on internationally, aimed at unearthing the location and identities of additional suspects involved in the criminal network. To facilitate the judicial cooperation, Eurojust set up a Joint Investigation Team (JIT) between Albania, Greece, Italy and Europol in January 2021. Eurojust set up a coordination centre during the action day and provided cross-border judicial support via the Italian and Greek desks at its headquarters, as well as the Liaison Prosecutor for Albania at the Eurojust. Eurojust facilitated and supported the exchanged of information among the JIT partners and Europol, and promoted five coordination meetings. Participating law enforcement authorities:  -    Albanian Criminal Police  -    Hellenic Police - Aliens Division of Attica -    Italian Financial Corps (Guardia di Finanza) - Organized Crime Investigation Group (GICO) of Lecce and the Central Organised Crime Investigation Service (SCICO)  Participating judicial authorities:  -    District Anti-Mafia Directorate of the Public Prosecutor's Office of Lecce in Italy -    General Prosecutor's Office of the Court of Appeal of Athens -   Special Anti-Corruption and Organised Crime Prosecutor's Office of Tirana (SPAK)    

A provider of choice for cybercriminals VPNLab.net was established in 2008, offering services based on OpenVPN technology and 2048-bit encryption to provide online anonymity for as little as USD 60 per year. The service also provided double VPN, with servers located in many different countries. This made VPNLab.net a popular choice for cybercriminals, who could use its services to carry on committing their crimes without fear of detection by authorities. Law enforcement took interest in the provider after multiple investigations uncovered criminals using the VPNLab.net service to facilitate illicit activities such as malware distribution. Other cases showed the service’s use in the setting up of infrastructure and communications behind ransomware campaigns, as well as the actual deployment of ransomware. At the same time, investigators found the service advertised on the dark web itself. As a result of the investigation, more than one hundred businesses have been identified as at risk of cyberattacks. Law enforcement is working directly with these potential victims to mitigate their exposure.  Closing in on VPN service used for criminal purposes Commenting on the VPNLab.net takedown, the Head of Europol’s European Cybercrime Centre, Edvardas Šileris, remarked: The actions carried out under this investigation make clear that criminals are running out of ways to hide their tracks online. Each investigation we undertake informs the next, and the information gained on potential victims means we may have pre-empted several serious cyberattacks and data breaches. Chief of Hanover Police Department Volker Kluwe stated: One important aspect of this action is also to show that, if service providers support illegal action and do not provide any information on legal requests from law enforcement authorities, that these services are not bulletproof. This Operation shows the result of an effective cooperation of international law enforcement agencies, which makes it possible to shut down a global network and destroy such brands. Europol’s European Cybercrime Centre (EC3) provided support for the action day through its Analysis Project ‘CYBORG’, which organised more than 60 coordination meetings and 3 in-person workshops, as well as providing analytical and forensic support. The information exchange was facilitated in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol’s headquarters in The Hague. Eurojust organised a coordination meeting to prepare for the operational actions and provided support to enable cross-border judicial cooperation between all Member States concerned. The following authorities took part in this operation:  Germany: Hanover Police Department (Polizeidirektion Hannover) - Central Criminal Office and Verden Public Prosecutor's Office Netherlands: The Dutch National Hi-Tech Crime Unit Canada: Royal Canadian Mounted Police, Federal Policing Czech Republic: Cyber Crime Section – NOCA (National Organized Crime Agency) France: Sous-Direction de la Lutte Contre la Cybercriminalité à la Direction Centrale de la Police Judiciaire (SDLC-DCPJ) Hungary: RSSPS National Bureau of Investigation Cybercrime Department Latvia: State Police of Latvia (Valsts Policija) - Central Criminal Police Department  Ukraine: National Police of Ukraine (Національна поліція України) - Cyberpolice Department  United Kingdom: The National Crime Agency United States: Federal Bureau of Investigation Eurojust Europol: European Cybercrime Centre (EC3)  

This operation, known as Conversus, was led by the Romanian National Police (Poliția Română) in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). It focused around an action week coordinated by Europol between 13-17 December 2021 and involved law enforcement from 24 countries, alongside Eurojust and the European Commission. Results House searches conducted: over 260 Gas/alarm pistols seized: 1 534 Ammunition seized: 17 464 pieces  Pyrotechnics seized: 6 550 kg Intelligence-led action  Until recently, most of the blank firing weapons seized in Europe were imported into the EU from Turkey. The Turkish authorities have since changed their legislation to address this threat. Once in the EU, these weapons are typically purchased for a low price from legal markets, before being illegally trafficked to other countries where a permit is required to acquire, import and possess such a firearm.  The action week was preceded by operational upstream work earlier in the year to identify the buyers and dealers involved in this illegal trade. The Romanian National Police, together with its Bulgarian and North Macedonian counterparts, collected data on the sellers which was then analysed by Europol to pin down buyers and suspicious transactions.   The following countries took part in this coordinated action: Romania, Bulgaria, Belgium, Cyprus, Czechia, Germany, Denmark, Estonia, Greece, Spain, France, Finland, Croatia, Hungary, Lithuania, Luxembourg, Latvia, Netherlands, Poland, Portugal, Sweden, Albania, Bosnia and Herzegovina, Switzerland, Norway, Montenegro, North Macedonia, Serbia, Ukraine and Kosovo*  * This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence. Eurojust stands ready to support national authorities with the cross-border judicial cooperation, at their request.  

Overall results of the operational activities 7 house searches 11 arrests (2 in France and 9 in Spain) Seizures include Drugs: 2 400 kg hashish, 112 kg marijuana Vehicles and petrol:  6 cars, 4 motorbikes, 2 trucks, 2 trailers, 4 helicopters modified to transport cannabis, 4 000 litres of petrol Armaments: 1 submachine gun, 2 guns, 1 shotgun, 2 bulletproof vests Electronics: 2 money counting machines, 1 frequency inhibitor, 1 frequency detector, 30 phones €2 355 in cash Smuggling cannabis on helicopters across the Mediterranean  The criminal network was involved in the trafficking of hashish and marijuana from Morocco to the South of Spain before smuggling the drugs to France. The investigators detected that the suspects used up to five false identities per person. The suspects transported the drugs from Morocco with the use of modified helicopters. The network then smuggled the drugs to France with the ‘go fast’ method (using vehicles with false number plates) or by concealing the cannabis in legal cargos transported by heavy trucks. A car chase in Spain led to the discovery of 329 kg of hashish hidden in a private vehicle. The driver reached speeds of up to 180 km/h while trying to escape the Spanish guard. Finally, he was arrested together with three other individuals. The Spanish officers discovered 266 kg of hashish at the address where the car was registered.  The criminal organisation used the profits from the drug trafficking to enhance this technical set-up and expand their trafficking capabilities. Shell companies were used to launder the money and disguise all details related to the origin and ownership of the funds.  Since joining this investigation in 2020, Europol has supported operational activities, facilitated the exchange of information and provided analytical support and operational coordination. Europol also supported the action days, with real-time cross-checking of operational information against Europol’s databases to provide leads to investigators in the field.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.   Watch video

Officers from the Spanish National Police (Policía Nacional), supported by Europol, dismantled an organised crime group involved in property crime, facilitation of illegal immigration and drug trafficking. Results from the action day on 14 December 2021: 9 house searches, 24 arrests in Spain, Seizures include: 4 vehicles, 3.5 kg of ecstasy pills (around 6 500 pills) valued at about €152 600, 56 grams of phencyclidine, 710 boxes of smuggled tobacco, stolen goods (61 mobile devices, competition bikes, electric scooters), electronic equipment, documents and about €40 000 in cash. Smuggling and trafficking goods and people to both Europe and the Middle East The investigation uncovered that the criminal network was smuggling migrants from Algeria to Spain, but also fugitives from Europe to the Middle East, taking advantage of the boats on their way back to Algeria. The network was involved in other criminal activities including trafficking of synthetic drugs, property crime, tobacco smuggling and trafficking of documents. On the first action day, investigators found a warehouse that was being used by the suspects. Inside the warehouse, they discovered a large number of stolen items that were being prepared to be smuggled to Algeria. The warehouse was sealed off as a result of the action. The investigators proved that the criminal network facilitated the smuggling of 250 irregular migrants into Spain in 54 separate incidents in the last few months. The criminal group was very well structured, with some members solely involved in management tasks, and others in accommodation, transportation. Hawaladars connected to the network sponsored the illegal trips of migrants but charge high rates of interest. The officers from the Spanish Police also discovered that the leader of the gang and his wife used their nine-year-old son as a drug courier. Migrants were charged €5 000 for the crossing from Algeria to Almería, Spain and between €700 and €1 000 from Spain to France. The suspects used forerunner cars to cross the border with France. Europol facilitated the exchange of information and provided analytical support. On the action day, Europol deployed an expert to Spain to assist with the cross-checking of operational information against Europol’s databases and to provide technical support with data extraction and analysis of digital evidence. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Published as a follow-up of the communication published on 08/09/2020 Further to the information previously provided therein, Europol would like to inform you that – due to lack of available resources combined with other developments on this matter - the invitation to tender related to the pension entitlements of the (last) four former Local Staff members for the period 2015-2017 has not been launched yet.  It is expected that the tender will be launched before the end of 2021, with a final result in Q2 2022. The outcome of the tender is determinant for calculating the exact balance of the ‘Local Staff Pension Fund’. Consequently, at this stage it is unknown if the balance has a deficit or a surplus.  Europol wishes to inform you that – in view of the delay in the tender procedure and the expected time for its finalisation – a more conclusive outcome is expected to be provided by Q3 2022.  A further update on this topic is expected to be published on Europol’s website as soon as the tender process is finalised and more concrete details can be shared. In case you are still in contact with former Local Staff, please feel free to share this update.

The Working Arrangement introduces a secure system for the exchange of information between the parties, linking the Republic of Korea with law enforcement authorities of the Member States of the European Union, as well as with third countries and organisations associated with Europol.  The cooperation may, additional to the exchange of information, include the exchange of specialist knowledge, general situation reports, results of strategic analysis, the participation in training activities as well as providing advice and support in individual criminal investigations.  Based on this Working Arrangement, the Republic of Korea can deploy a liaison officer to Europol’s headquarters in the Netherlands to join its unique community of liaison bureaux of law enforcement authorities from more than 40 countries across the world. The Korean National Police Agency's Commissioner General Kim Chang-yong said: “Transnational organised crime has been fortified with the development of technology and globalisation. Now, one country's effort is not enough in the fight against crime. Law enforcement agencies should stand together. On behalf of the Korean Government, I sincerely welcome this working arrangement, which will allow the law enforcement agencies in both the Republic of Korea and the European Union to strengthen their collaborative efforts and realise practical solutions to curb crime.” Europol’s Executive Director Catherine De Bolle said: “Against the backdrop of international crime becoming more violent and interconnected, the need and potential for cooperation between Europol and the Republic of Korea on global security is important. I welcome this working arrangement, which will connect law enforcement authorities from the Republic of Korea with all of Europol’s Member States and associated partners. Leveraging these relationships represents an invaluable opportunity to enhance regional efforts to combat the threats posed by transnational crime.” After entry into force of the Arrangement, this new level of cooperation will be important for tackling priority crime areas affecting both the European Union and the Republic of Korea.  

Europol’s European Migrant Smuggling Centre (EMSC), together with the European Union Internet Referral Unit (EU IRU) within Europol’s European Counter Terrorism Centre (ECTC) coordinated the referral activity which involved law enforcement authorities from Lithuania, Latvia, Estonia, Finland, Poland and Germany.  The referral action focused on the collection of online content promoting illegal immigration services from Belarus to Europe, such as social media accounts advertising the sale of counterfeit ID documents, passports, visas or illegal transportation services. These accounts have been referred to the Online Service Providers with the request to review them against the terms of service. The new Belarusian migratory route is heavily advertised to migrants on social media and instant messaging applications, which represents a significant pull factor. The misuse of these online platforms by facilitators led to a large increase of departures and irregular border crossings.  The organisation of this referral action has taken place in the context of the wider support that Europol is providing to EU Member States in countering migrant smuggling from Belarus to the EU.     

The action days on 14 and 15 December 2021 led to: 16 house searches (in Barcelona, Cadiz and Galicia) 17 individuals arrested (11 Spanish and 6 Moroccan nationals)  The leader of the criminal network among the suspects arrested Large seizures worth more than €6 million including:  10 luxury watches worth about €2.1 million, 8 real estate properties worth about €1.9 million,  more than €1 million in cash,  26 cars worth about €1 million,  1 vessel valued at approximately  €100 000,  760 lottery tickets with a value of €15 200,  a banknote counter, a large number of smartphones and electronic equipment,  33 bank accounts. Large-scale drug trafficking via the African route The criminal network was involved in large-scale drug trafficking, mainly of cocaine and hashish, to Southern Spain using speedboats. Two seizures made earlier in 2021, consisting of 4 300 kg hashish and 1 300 kg cocaine respectively, are connected to this criminal organisation. Two of the 17 arrested on 14 and 15 December had an international arrest warrant against them in connection to a seizure of 1 004 kg cocaine made in 2018 in Morocco. The alleged leader of the organisation is believed to be one of the major importers of cocaine and hashish from Morocco to the Iberian Peninsula. Spanish Civil Guard officers arrested him while he was coordinating a number of seaborne drug trafficking operations. Using legal businesses to wash the drug money The organised crime group created and misused a large network of companies, including several cash-intensive businesses such as two restaurants in Barcelona. These businesses served to launder the drug-trafficking proceeds. The profits were also laundered through the payment of mortgages and simulated loans. The suspects also used cash to cover costs related to facilitating their drug trafficking activities and buying the required equipment, such as cars and vessels. A large number of the assets owned by the suspects and their families were not justified by any legally obtained and declared resource.  On-the-spot deployments to support investigators Since joining the operation in July 2020, Europol supported the operational activities, facilitated the exchange of information and provided analytical support and operational coordination. During the action days, Europol deployed an expert to Spain to cross-check in real time operational information against Europol’s databases to provide leads to investigators in the field. Europol also deployed a second expert to Spain to provide further technical assistance.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The suspect – a 41-year-old Romanian national - was arrested today at his home in Craiova, Romania, in the early hours of the morning. Ransomware with blackmail  The criminal is suspected of having compromised the network of a large Romanian IT company delivering services to clients in the retail, energy and utilities sectors. He is then believed to have deployed ransomware and stolen sensitive data from the IT company’s clients located in Romania and abroad, before encrypting their files. The information stolen included the companies’ financial information, personal information about employees, customers’ details and other important documents.  The suspect would then ask for a sizeable ransom payment in cryptocurrency, threatening to leak the stolen data on cybercrime forums should his demands not be met. Europol’s support Europol’s EC3 supported this investigation by:  Providing analytical, cryptocurrency tracing, malware analysis and forensic support; Deploying two of its experts to Romania to provide advance forensic support and to help with crypto-asset forfeiture.  This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).   

Out of hundreds of entries submitted from a variety of countries, only two talented photographers could be selected as the prizewinners. In the ‘Making Europe safer’ category, Antonio José Pedrosa Padial’s photo of a police dog looking lovingly at a Spanish police officer was chosen as the winning entry. The police officer and her dog are part of the border control team at Valencia, Spain, and the photo serves as a reminder that not only humans work hard to make Europe safer. In the ‘Re-opening Europe’ category, Valerio Giannetti’s photograph of the the Polizia di Stato music band entertaining young patients at the Agostino Gemelli Polyclinic in Rome, Italy was chosen as the winning entry. It includes one person dressed as Spiderman and, combined with the joviality of the band, this photograph provides a moving image of the many ways in which law enforcement officers support their local communities. Follow Europol on Instagram to see these winning photographs plus a selection of the best entries.

The SIRIUS project, a cross-border intelligence-sharing platform co-implemented by Europol and Eurojust, in close partnership with the European Judicial Network, concluded its fourth annual conference this week. Among the more than 800 participants in the online conference were law enforcement and judicial authorities, plus representatives from Online Service Providers. More than half of all criminal investigations today involve a cross-border request for electronic evidence, such as from email or messaging services. As the world has embraced several new technologies due to the pandemic and remote working, criminals have skilfully adapted to and exploited these developments. Accordingly, more international criminal investigations than ever are dependent on fast, secure and legal means of sharing electronic evidence across borders. This purpose is what guided this year’s SIRIUS conference. The remote challenges of a physical pandemic The pandemic-associated rise in online criminality has underscored the importance in international judicial cooperation on sharing electronic evidence. Over the course of the three days, participants discussed areas where gathering electronic evidence has become increasingly important since the outset of the COVID-19 pandemic, such as in relation to cryptocurrencies and crypto-exchanges used in money laundering. Other sessions covered increased European cooperation with law enforcement counterparts in Asia and North America, and the developments in European technical capabilities in fighting cybercrime. Welcoming delegates to the start of the SIRIUS Conference, Europol Executive Director Catherine De Bolle remarked: “Since 2017, we have seen key stakeholders and some of the major global tech companies on our stage for the SIRIUS Conference to address topics related to cross border access to electronic evidence. Promoting knowledge sharing, creating opportunities for the real exchange of experiences, and improving the capacity to deal with digital data in the context of criminal investigations is now more important than ever.” Eurojust President Ladislav Hamran stated: “What clearly emerged from the SIRIUS Conference is the notion that our success in the fight against cross-border crime depends on the strength of our mutual partnerships in a digital landscape with fragmented legal frameworks. As long as we work together, I am convinced that we can strike the right balance between obtaining access to electronic evidence and upholding the fundamental rights and liberties of our citizens.” The SIRIUS Conference Programme As in previous years, each day of the SIRIUS Conference had its own thematic focus. The first day saw a wide-ranging dialogue with technology companies and policy experts to explore the latest judicial developments in the field of e-evidence, as well as to discuss the future implications of a rapidly and dynamically involving field. The first day also highlighted the progress that the SIRIUS project has achieved over the past years, reflected by an exponential growth of its membership base and the growing popularity of its key products and services.   The latter two days of the event, which were restricted to participants from law enforcement and judicial authorities, explored the process of obtaining electronic evidence in various jurisdictions, as well as the latest developments in the rapidly developing field of Open Source Intelligence (OSINT).  The SIRIUS project, co-implemented by Europol and Eurojust, is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by online service providers. These services are available to law enforcement and judicial authorities via a platform and an application. To this day, SIRIUS serves a community of competent authorities from 44 countries, representing all EU Member States and a growing number of third countries. The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under grant agreement No PI/2017/391-896.  

Virtual assets-based money laundering and other crypto-enabled crimes are threats not only to users and financial markets, but also to the dynamism and innovation of the sector itself. Protecting citizens and the global economy from the risks of abuse of cryptocurrencies and other virtual assets is a task that requires concerted and sustained effort by governments, law enforcement, regulators and the private sector. This positive sentiment was at the heart of the 5th Global Conference on Criminal Finances and Cryptocurrencies, held virtually on 7–8 December 2021. A joint initiative of the Basel Institute on Governance, INTERPOL and Europol, the Conference saw several thousand participants tuning in to learn about the latest trends, strategies and tactics in tackling crimes and threats involving virtual assets. Sharing knowledge and building bridges  Around 2,000 cryptocurrency and anti-money laundering experts from the public and private sectors, policy institutions and academia attended the first day of the conference, which saw a series of presentations on emerging themes and topics in the virtual assets sector.  These include the fast-evolving fields of decentralised finance and non-fungible tokens (NFTs), regulatory developments affecting anti-money laundering compliance, crypto-enabled fraud and the possibilities that governments have to recover illicit assets even if they are virtual.  On the second day of the conference, which was restricted to members of law enforcement bodies and related public authorities, speakers shared their experiences of investigating cryptocurrency-enabled crime and money laundering cases with over 1,500 participants. This kind of knowledge-sharing between the public and private sectors, as well as between law enforcement representatives in different countries and institutions, is crucial in global efforts to protect the virtual assets industry from malicious actors. It also helps to foster the multidisciplinary approach that is essential to tackling virtual assets-based money laundering and related crimes, by bringing together expertise in technology, financial investigation and asset recovery.  The annual conferences help to create a network of practitioners and professionals who can collectively establish best practices and provide assistance and recommendations in this fast-evolving field. Forthcoming recommendations on combating virtual assets-based money laundering and crypto-enabled crime A set of Recommendations will be issued jointly by the Basel Institute on Governance, INTERPOL and Europol in the days following the Conference. They will set out several approaches that all stakeholders should consider taking to address emerging risks and keep the industry safe for all, covering: International cooperation Virtual asset recovery Public-private cooperation Harmonised regulation and its effective implementation Investigative techniques and technologies Capacity building Multidisciplinary approach, including through specialised law enforcement units When taken in the spirit of open collaboration, such approaches will help all stakeholders to address emerging areas of concern raised during the conference, from DeFi to dark net marketplaces. About the conference  The annual conference is organised by the Working Group on Criminal Finances and Cryptocurrencies, a tripartite initiative of the Basel Institute on Governance, INTERPOL and Europol that dates back to 2014 and was formally established in 2016.  The three institutions take turns to host the conference each year. This year’s conference was hosted by the Basel Institute on Governance. Next year, Europol will be organising the event.

Europol has supported the Maltese Authorities in investigating an organised crime group suspected of having laundered over €20 million through Malta. Other foreign jurisdictions were partners in the investigation. A total of 7 suspects of Libyan and Maltese origin were arrested across the Maltese islands on 29 November for their involvement in this money-laundering scheme.  The suspects are believed to have laundered millions in illicit funds through five Maltese companies which the criminal group controlled. The funds were for the most part sent to Turkey using both cash couriers and the informal hawala money transfer system. The investigation is ongoing to identify the origin of these ill-acquired funds, believed to be linked with tax evasion and other criminal offences. On the occasion of the action day, some €70 000 in cash was seized, alongside a considerable amount of jewellery, branded clothing and watches, luxurious vehicles, foreign number plates and electronic equipment with an approximate value of €5 million. Europol support      Europol’s European Financial and Economic Crime Centre (EFECC) has supported this investigation since June 2020, providing continuous analysis to support the Maltese investigators in developing the intelligence on this criminal group. During the action day, Europol deployed a specialist to Malta to support the investigators with real-time cross-checks and document analysis. 

Over roughly two and a half months of operations, EMMA 7 saw law enforcement, financial institutions and the private sector, including Western Union, Microsoft and Fourthline, cooperate in a concerted effort against money laundering in Europe, Asia, North America, Colombia and Australia. As well as targeting the laundering of profits through money muling networks, investigators also sought intelligence on the sources of these illicit profits, shedding more light on the size and nature of the criminal economies that money mules serve. Results from 15 September – 30 November18 351 money mules identified;324 recruiters/herders identified;1 803 arrested individuals;2 503 investigations initiated;7 000 fraudulent transactions reported;€67.5 million prevented losses.Collaborating in the fight on money launderingThis was the seventh iteration of the European Money Mule Action, or ‘EMMA’, which was established in 2016 on the initiative of Europol, Eurojust and the European Banking Federation. It is the largest international operation of its kind, built around the idea that public-private information sharing is key to fighting complex modern crimes. Around 400 banks and financial institutions supported the action, reporting 7000 fraudulent transactions and preventing a total loss estimated at nearly €70 million.EMMA 7 works based on private sector actors reporting incidences of suspicious or possibly illegal financial conduct to national law enforcement authorities. Similarly, law enforcement can ask financial actors to look into its own intelligence on potential money mules. With these inputs, law enforcement can paint a picture of laundering networks and then decide in each case how to react to the possible money muling activity.EMMA provides a means for all these actors to confer, sharing intelligence that will help identify possible money mules and potentially lead to arrests. Europol supports each stage of the preparation by connecting the law enforcement partners and private sector partners and facilitating information exchange between them. In the operational phase, Europol provided analytical support that connected the transnational cases with the money muling networks behind them.Most of the investigations under EMMA 7 focused on the international dimension of muling. Money muling operations see mules not only transferring money between countries, but also travelling between countries themselves in order to set up bank accounts overseas. Criminals can then use these accounts later on in support of the money laundering process. Awareness as important as actionThe complexity of money muling operations, and law enforcement’s response to them, reflect how muling networks are created. Unlike many financial crimes, money mules can be recruited unknowingly into the criminal operation. The organised crime groups do this by preying on groups such as students, immigrants, and those in economic distress, offering easy money through legitimate-looking job adverts and social media posts.Ignorance is not an excuse when it comes to the law and money muling; they are breaking the law by laundering the illicit proceeds of crime. For this reason, Europol coordinated the ‘#DontBeAMule’ awareness campaign with all participant countries, law enforcement and the EBF on behalf of the European banks, as a means to prevent more innocent bystanders being exploited by criminals and putting themselves at risk. Eurojust participated in the operation via its dedicated liaison officer and stands ready to support cross-border investigations and judicial cooperation at the request of the national authorities involved.EMMA is under the EMPACT Sub Priority Cybercrime NCPF (Non Cash means of Payment Fraud), and is led by the Netherlands.Participating countries: Australia, Belgium, Bulgaria, Colombia, Czech Republic, Estonia, Finland, Greece, Germany, Hong Kong, Hungary, Ireland, Italy, Moldova, Netherlands, Poland, Portugal, Romania, Singapore, Slovak Republic, Slovenia, Sweden, Switzerland, Spain, United Kingdom, United States. 

Between 8 and 12 November, Europol supported large-scale international action against trafficking in human beings. 29 countries*, led by Austria and Romania, took part in the action days, which were coordinated by Europol and Frontex. The activities saw more than 14 000 law enforcement officers target trafficking routes on roads and at airports. This resulted in 212 arrests and the identification of a further 89 trafficking suspects. The action days aimed to combat human trafficking for the purposes of sexual exploitation, forced criminality and forced begging. Europol coordinated the five action days from its 24-hour Operational Centre, which provided the participant countries with informational crosschecking, secure communication channels, and a range of analytical capabilities throughout the operation. The action days took place under the umbrella of the EMPACT security mechanism/framework. Results from 8-12 November** 212 arrests, for offences including trafficking in human beings, money laundering, pimping and fraud 147 668 persons and 91 856 vehicles checked 327 additional investigations initiated Casting the net wide in pursuit of traffickers The action days sought to identify and arrest human trafficking suspects as they transited across Europe, as well as to identify and protect trafficking victims and prevent associated document fraud. Europol coordinated national police, passenger information units, border guards and national agencies that counter human trafficking. Together they created a tight net around trafficking routes, with national police and border agents performing roadside checks, while the passenger information units checked airline passengers. This led to law enforcement identifying 593 adults and 57 minors as potential human trafficking victims, which included nationals from countries in four continents. Officers stations at EU airports were able to identify a large number of victims as vulnerable to trafficking and exploitation. Those identified were either successfully referred to the UK’s National Referral Mechanism, or returned them to their home countries with welfare checks or police assistance put in place upon their return. There were also seizures of goods such as false driver’s licenses, weapons, and hard drugs. The information gleaned from these action days has led to the opening of 327 new cases, along with the possible identification of further suspects and of human trafficking. This enhancement of cooperation between EU agencies, national law enforcement, and actors such as passenger information units, will inform similar future investigations into these serious criminal activities. Law enforcement also targeted a wide range of possible locations for human traffickers, such as bars, brothels, nightclubs, nail bars, massage studios, and strip clubs. This diverse range of target areas was the result of intelligence showing that traffickers were deploying multiple methods for recruiting their victims, such as the ‘lover boy’ method and threats of violence against victims’ relatives. *Countries involved: Austria (Action Leader), Belgium, Croatia, Cyprus, Denmark, Finland, Germany, Hungary, Iceland, Ireland, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania (Action Co-Leader), Slovakia, Slovenia, Spain, Sweden, Switzerland, United Kingdom, North Macedonia, Albania, Kosovo***, Serbia, Montenegro, Bosnia-Herzegovina **Results are still to be collated from activities in Luxembourg and Malta. *** This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence.

Terrorism is a constant threat to societies all over the world and terrorists’ use of the internet and social media has increased enormously in recent years. Jihadist groups, in particular, have demonstrated a sophisticated understanding of how social networks operate and have launched well-organised, concerted social media campaigns to recruit followers. These campaigns promote or glorify acts of terrorism and violent extremism and have led to viral online content in the past. As a response to this, in 2015 the Justice and Home Affairs Council mandated Europol to create the EU Internet Referral Unit (EU IRU), as part of the wider EU Internet Forum, to reduce the impact of internet content promoting terrorism or violent extremism. Monitoring terrorist content online In recent years, the international community has been dealing with largely uncharted territory when it comes to online extremist content. However, the adoption of the EU(2021)/784 Regulation of April 2021, which addresses the dissemination of online terrorist content, will change the European Counter Terrorism Centre’s working relationship with Member States and tech companies and the responsibilities of the EU IRU will evolve along with this legislative change. In the coming months, Member States will be in a position to demand the removal of content from Online Service Providers themselves through a platform called PERCI. This platform is a technical solution built by Europol and managed by the EU IRU to facilitate the implementation of the new regulation. Before this, the process to take down terrorist content online was entirely voluntary on the part of the tech companies. ‘This is a historic moment because it touches upon the fundamental aspects of human rights and freedoms,’ says a specialist from the EU IRU. ‘On one hand we need to be sure, as Europeans, that we do not impact these rights and securitise the area; but at the same time we have to take real action to control the abuse of the internet by malicious actors. It’s a difficult balance to strike, but it has to be done.’ The vast majority of tech companies have taken significant steps to protect their platforms against terrorist abuse. Nevertheless, the online environment remains an attractive space for terrorist criminal networks who continue to target the services offered by the tech companies for recruitment, fundraising and propaganda purposes. Fighting terrorism and migrant smuggling But how exactly does the EU IRU help keep online spaces safe? ‘It’s a round-the-clock operation,’ says the specialist, ‘once we identify terrorist content itself, we try to map its trace on the internet. We collect all publicly available information around this content and create a ‘referral package’ to be exploited for different purposes: to assess the threat, to support investigations and to suggest eventual referral to Online Service Providers.’ Referral is the transmission of a notification of internet content by Europol or Member States to the Online Service Providers.  Based on these referrals, the EU IRU also coordinates Referral Action Days. These are organised on a regular basis, both on Europol premises and remotely. Referral Action Days facilitate direct cooperation with law enforcement representatives in EU Member States and are imperative in Europol’s ongoing fight against terrorism. Since 2015, the EU IRU has organised a total of 23 Referral Action Days. The EU IRU consists of four separate teams and employs a number of specialists with a variety of skills, including operational, linguistic, technical and research expertise. Specialists who work with Arabic, for example, are hired not only for these capabilities but also for their acute understanding of how the process of radicalisation to violent extremism works. ‘Language is very important in the phenomenon of jihadism,’ explains a specialist in this field, ‘but you also need to have a deep understanding of how the jihadist networks abuse the online environment to recruit and radicalise people.’  The scope of the EU IRU is not just limited to jihadist content either. Since the attack in Christchurch, New Zealand in 2019, there has been a surge in right-wing extremist content online. The EU IRU has recently taken steps to address non-jihadist content and has brought in experts to build this capacity within the European Counter Terrorism Centre at Europol. The EU IRU additionally provides support to Europol’s European Migrant Smuggling Centre by flagging content used by traffickers offering smuggling services to migrants and refugees. Collaboration and trust The EU IRU is in a unique position whereby it can map terrorist networks across borders and see how they are linked to cases in a variety of Member States. It is this global view that is instrumental in dismantling criminal networks and providing information for investigations. The establishment of the EU Internet Forum, and subsequently the EU IRU, has greatly enhanced the voluntary cooperation between government, tech companies and civil society to counter online terrorism and violent extremism as part of the public-private partnership. ‘In the EU IRU, the European Counter Terrorism Centre, and Europol more generally, we respect fundamental rights and freedoms within a robust legal framework,’ says the specialist, ‘and this is why we are trusted by the international community, the companies we engage with, and Member States. We are very committed to building this trust- and trust is our biggest achievement at Europol.’

A total of 50 websites dedicated to the distribution of online terrorist propaganda and promoting violent jihadist ideology were targeted over the course of a referral action that took place in the last week of October. The European Union Internet Referral Unit (EU IRU)  at Europol’s European Counter Terrorism Centre (ECTC) coordinated the referral activity, which involved law enforcement authorities from Germany and the United Kingdom. The referral action targeted terrorist-operated and violent jihadist websites by referring them to Online Service Providers (OSP) supporting web infrastructure, such as registrars, hosting companies and Internet infrastructure companies, with a request to review content against their terms of service. Out of 50 websites, including sites supporting the so-called Islamic State and al-Qaeda terrorist organisations and their affiliates, 21 were suspended following referrals to the relevant OSP.  Terrorist groups traditionally relied on self-administered websites for the storage and dissemination of their propaganda. With mainstream social media companies intensifying their efforts to suspend offending content from their platforms, terrorist groups and their online supporters increasingly use websites as a vital tool to broadcast their message and create archives for their propaganda releases. In spite of frequent suspensions, these websites continue to move their content to new domains.  The referral action championed a consistent and systematic approach to the referral of websites, based on voluntary cooperation with the tech industry. It allowed practitioners to detect and assess new instances of terrorist-operated and violent jihadist websites with the aim of raising awareness of the extent of the phenomenon and draw attention to new patterns of abuse. Effective and sustained disruption of these sites requires heightened cooperation between Europol and law enforcement agencies and an enriched international public private partnership with OSPs supporting web infrastructure. To know more about the work of the EU IRU, read the dedicated feature story. 

The Italian Financial Corps (Guardia di Finanza), the German Duisburg Police (Polizei Duisburg) and the Swiss Police of the Canton of Lucerne (Kantonspolizei Luzern), supported by Europol and Eurojust, dismantled a criminal network involved in fraud with public funds. The fraud was perpetrated through the use of so-called ‘white’ energy efficiency certificates, with criminals then laundering the illicit proceeds.  The action day on 23 September 2021 led to: 20 arrests (4 in Germany, 15 in Italy and 1 in Switzerland)     Assets valued at up to €41 million were frozen, including bank accounts, financial assets, real estate and cryptocurrency €27 million defrauded from energy efficiency funds Between 2016 and 2020, the criminal network illegally obtained certifications for energy efficiency (“white” certificates), while receiving subsidies through fictitious projects. The so-called TEE certificates are attributed for energy efficiency by the national Italian regulators. The suspects used fake invoices as support documents, while requesting subsidies from the Italian authorities. In total, the criminal network illegally obtained about €27 million in subsidies from nationally distributed funds. Then, they transferred the illicit proceeds to bank accounts in Germany, Switzerland and other European countries.  The payments were made based on fictitious invoices, purporting to show transactions such as the acquisition of solar panels. The criminal profits were then withdrawn and the cash transported back to Italy, while a percentage went to an affiliated money-laundering network. The suspects used that scheme to launder more than €14 million. Investigators identified 113 individuals suspected to be involved in this criminal scheme.  Analysis and technical expertise to support fraud investigations Europol supported the operational activities, facilitated the exchange of information and provided analytical support. During the action day, Europol provided real-time analytical support from its headquarters, cross-checking operational information against Europol’s databases and thus providing leads to investigators in the field. Europol also deployed two forensic experts to Germany to provide technical support to investigators from the national authorities.  Europol recently created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

Europol, Eurojust and the European Judicial Network publish today the third annual edition of the SIRIUS European Union Digital Evidence Situation Report. This year, the report goes beyond a comprehensive status update by including an assessment of the impact of the COVID-19 pandemic on the access of EU authorities to electronic evidence held by foreign-based online service providers (OSPs) in 2020.  Cross-border access to digital evidence is crucial to most investigations, and it became even more relevant during the pandemic, when there was an acceleration in the digitalization of everyday life. In one case mentioned in the report, for instance, law enforcement officers had to react quickly to prevent phishing scams for digital signatures – a crime area on the rise because of the pandemic. The third joint report reflects the complexity of cross-border investigations involving electronic evidence, offering extensive information gathered from over 250 surveyed officials of EU Member States’ law enforcement and judicial authorities, together with relevant inputs coming from a dozen of major online service providers.   The SIRIUS platform appears as the highest-ranked source of information For the first time, the SIRIUS platform, hosted on the Europol Platform for Experts, is the number one source of information for law enforcement practitioners seeking assistance in relation to data requests under voluntary cooperation. It was selected ahead of Single Points of Contacts and national units, and cements the SIRIUS project as a centre of reference in the field of electronic evidence. Impact of the COVID-19 pandemic on requests for electronic evidence  Criminals took advantage of the pandemic, adapting cybercrime activity like phishing campaigns, ransomware, or sales of counterfeit products. Almost half of police officers surveyed stated that their need for electronic evidence increased during the pandemic, but about 25% reported that their capacity to request e-evidence decreased, most likely caused by the transition to remote working. Similarly, social distancing measures and lockdowns had an impact on the daily work of judicial authorities:  35% of respondents reported delays in procedures caused by reduced capacity. However, some of the solutions, such as acceptance of electronic documents, were embraced by the judicial community as a positive outcome. Overall, the rise in digitalisation has increased the need for electronic evidence, and authorities have had to adapt very quickly. Increased relevance of electronic evidence in criminal investigations. The volume of cross-border requests submitted by EU authorities to eight large OSPs increased 27% in 2020 in comparison with the previous year, with a large majority of them issued by Germany and France, and mainly to Facebook and Google. There was a very significant increase of 112% in emergency disclosure request in 2020 compared to 2019, with Facebook receiving most of them, among the OSPs analysed.  Europol’s Executive Director Ms Catherine de Bolle said:  “Effective policing in the digital age largely relies on harnessing the potential of online processes, alongside the ability to handle electronic evidence securely and verifiably. Nothing has made it clearer that the COVID-19 crisis which saw law enforcement having to adapt quickly to an unprecedented situation, relying on both existing digital solutions already in place and those deployed in response to the reality of a global pandemic. This joint report with Eurojust and the European Judicial Network is timely in that it provides all the partners of the EU security chain a better understanding of the challenges and opportunities related to digital evidence.” Eurojust President Mr Ladislav Hamran stated: ‘This third joint Report reflects the complexity that results from a constantly evolving digital landscape and fragmented legal framework. It also shows how the global COVID-19 pandemic forced the EU’s judiciary to develop innovative approaches and adapt existing processes. We clearly see, as well, that our success in the fight against organised crime depends on the strength of our mutual partnerships. As long as we work together, we can strike the right balance between obtaining access to electronic evidence and upholding the fundamental rights and liberties of our citizens.’ Download the SIRIUS European Union Digital Evidence Situation Report 2021 The SIRIUS project, co-implemented by Eurojust and Europol, is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by online service providers. These services are available to law enforcement and judicial authorities via a platform and an application. To this day, SIRIUS serves a community of competent authorities from 44 countries, representing all EU Member States and a growing number of third countries.  The SIRIUS Project has received funding from the European Commission’s Service for Foreign Policy Instruments (FPI) under grant agreement No PI/2017/391-896.  

A total of 18 children have been tentatively identified and two offenders apprehended as a result of the 10th edition of Europol’s Victim Identification Taskforce (VIDTF). Nine of these young victims have already been rescued by the competent authorities, with investigations ongoing to safeguard the others. The VIDTF is a Europol initiative which this year gathered specialists from 26 countries and partner agencies to identify victims and offenders depicted in child sexual abuse material.  Between 25 October and 5 November 2021, these experts combed through some 580 sets of images and video files depicting unknown victims of child sexual abuse, some as young as a few days old. They were supported by Europol specialists and intelligence analysts in the field of combating the sexual exploitation of children.  In addition to the 18 children identified, the likely country of production has been located in 211 instances and intelligence packages sent by Europol to the relevant countries for investigation.  Officers from Australia, Belgium, Canada, Croatia, Cyprus, Denmark, Estonia, France, Germany, Hungary, Ireland, Latvia, Malta, Moldova, the Netherlands, Norway, Portugal, Romania, Slovak Republic, Slovenia, Spain, Sweden, Switzerland, the United Kingdom, Ukraine, the United States, Europol and INTERPOL took part in the 10th VIDTF.  Combining efforts to rescue children  Since 2014, Europol has been gathering victim identification specialists from across the world on a regular basis in order to focus on unsolved cases of child sexual abuse.  The VIDTF is the largest recurring operation of its kind in the world, and has inspired a number of similar initiatives at the national and regional levels, such as in Italy and Australia.  Now in its 10th iteration, the VIDTF has yielded the following results since it was first convened:  290 specialists from over 35 countries have taken part in this operational activity; A likely country of production was identified in 1 726 instances; Over 533 children have been safeguarded and 182 offenders arrested as a result of the VIDTF operations. Europol’s Executive Director Catherine de Bolle said: “Changing global circumstances in recent decades have changed the way child abusers commit their crimes and hide their tracks. Results such as these from the VIDTF show that law enforcement has kept up with these changes and built a formidable united front against this type of crime. This is echoed by the public’s support through the Trace An Object initiative, and together we can hopefully rescue more children and infants from abuse and sexual exploitation.” Public appeal for help  You can help us identify the origin of certain objects as part of Europol’s Trace An Object initiative. Non-confrontational details of images extracted from child sexual abuse cold cases are regularly made public, in the hope that someone recognises a detail that will help narrow down the location of the victim. 27 000 tips have already been sent to Europol, which have led to the identification of 23 children and to the prosecution of 5 offenders.   Europol is releasing today a new set of images in the hope that these can be identified by the general public.  View the new Trace an Object images.   

The latest actions under Operation Trivium, a multi-country operation against organised property crime on Europe’s road networks, has resulted in 174 arrests and the seizure of goods throughout Europe. The three-day operation saw law enforcement from 17 countries carrying out roadside checks on people and vehicles, as well as searching premises. Europol supported the operation by sharing information on the subjects, vehicles and modus operandi behind the criminal groups in real-time. Operation Trivium is organised under the umbrella of the EMPACT security initiative. Results from 3-5 November** 174 suspects arrested 27 cars confiscated More than 200 other goods seized, including weapons and drugs Almost 25 000 persons checked More than 16 000 vehicles checked Around 800 locations checked Three days of sweeping action across Europe In the space of only a few days, law enforcement authorities were able to carry out several interventions that disrupt organised property crime. 783 specific targets, consisting of individuals and properties, were identified and checked by law enforcement as part of the operation. These checks happened along with wider roadside checks of over 16 000 vehicles and 25 000 individuals, which meant criminal activity could be intercepted in a number of areas. Although most arrests related to organised property crime, arrests were also made in relation to drugs, weapons, and violations of immigration legislation.  Police also deployed methods such as automatic number plate recognition (ANPR) and monitoring drivers for suspicious behaviour as part of Operation Trivium XV. In one case in Belgium, a car caught investigators’ attention for driving aggressively; police found thousands of euros in cash, as well as large quantities of cocaine and cannabis, and an alarm pistol. In a separate search, Belgian police uncovered over EUR 70 000 divided into several small bundles; the driver later admitted the unexplained cash was the result of trafficking drugs between Belgium and Germany. Speedy Information Sharing Operation Trivium first started in 2013, and seeks to disrupt organised property crime on Europe’s road networks. This fifteenth iteration of Operation Trivium follows similar large-scale actions made in April of this year, which resulted in over 200 arrests and significant seizures of criminal assets. The success of its multi-country approach relies on speedy information sharing between participating law enforcement agencies, particularly regarding suspects, persons related to crimes, and vehicle data. *Countries involved: Albania, Austria, Belgium, Cyprus, Denmark, France, Germany, Greece, Lithuania, Malta, The Netherlands, Poland, Portugal, Romania, Serbia, Spain and Sweden. **With further results to be reported from actions in France, Lithuania and Malta.

The accelerated digitalisation related to the COVID-19 pandemic has significantly influenced the development of a number of cyber threats, according to the new edition of Europol’s Internet Organised Crime Threat Assessment. Criminals have been quick to abuse the current circumstances to increase profits, spreading their tentacles to various areas and exposing vulnerabilities, connected to systems, hospitals or individuals. While ransomware groups have taken advantage of widespread teleworking, scammers have abused COVID-19 fears and the fruitless search for cures online to defraud victims or gain access to their bank accounts. The increase of online shopping in general has attracted more fraudsters. With children spending a lot more time online, especially during lockdowns, grooming and dissemination of self-produced explicit material have increased significantly.  Grey infrastructure, including services offering end-to-end encryption, VPNs and cryptocurrencies continue to be abused for the facilitation and proliferation of a large range of criminal activities. This has resulted in significant challenges for the investigation of criminal activities and the protection of victims of crime.  In addition to expanding the efforts to tackle these threats from a law enforcement perspective, it is crucial to add another level of protection in terms of cybersecurity. The implementation of measures such as multi-factor authentication and vulnerability management are of utmost importance to decrease the possible exposure to cyber threats. Awareness raising and prevention are key components in reducing the effectiveness of cyberattacks and other cyber enabled criminal activities.  Europol’s Executive Director Catherine De Bolle highlighted: “Worldwide operations, such as the successful takedown of EMOTET botnet, have demonstrated the effectiveness of international cooperation. Ransomware groups have attempted to disrupt critical infrastructures, such as service providers and government institutions, to increase their profits with no concern for the possible damages such interceptions may cause to public safety and security. To this, the collective response of our international law enforcement community is clear: the authorities and the private sector worldwide stand strong and ready to mitigate together any threat that blackmails the stability of our societies.” The key threats Ransomware affiliate programs enable a larger group of criminals to attack big corporations and public institutions by threatening them with multi-layered extortion methods such as DDoS attacks.  Mobile malware evolves with criminals trying to circumvent additional security measures such as two-factor authentication.   Online shopping has led to a steep increase in online fraud.  Explicit self-generated material is an increasing concern and is also distributed for profit. Criminals continue to abuse legitimate services such as VPNs, encrypted communication services and cryptocurrencies. The new edition of Europol’s Internet Organised Crime Threat Assessment, launched today, looks into the (r)evolutionary development of these trends, catalysed by the expanded digitalisation of recent years. The report was presented during the Europol-INTERPOL Cybercrime Conference. The conference gathered about 100 experts together to share their insights into the latest cybercrime trends and threats and to discuss how innovation is essential in countering cybercrime acceleration. “Cybercrime is a reality and law enforcement worldwide needs to catch up,” said Edvardas Šileris, Head of Europol’s European Cybercrime Centre, ”Events like this bring together public and private entities in recognising the threat and identifying ways to combat it effectively. Only by working together can we create innovative ideas and practical approaches that can put a halt to cybercrime acceleration. It is essential to establish the environment and resources required to do so,” he added.  High value targets: the new victims of malware attacks   Ransomware groups have used the pandemic to their advantage to launch more sophisticated and targeted attacks. While mass distributed ransomware seems to be in decline, cybercrime groups and their affiliates opt for well-orchestrated manual attacks against large corporations and government institutions. Always driven by opportunities for larger profits, in the past criminals have targeted companies which have both the financial capability to pay large ransoms and the need to rapidly resume operations in case of a successful cyberattack, which affects their main activities. The attacks on Kaseya and SolarWinds show how criminals have realised the potential in attacking digital supply chains, often going for the ‘weakest link’. However, many of the most infamous groups have reduced the attacks on governments and social services in an attempt to limit the attention of law enforcement on them. DDoS attacks have re-emerged and are targeting service providers, financial institutions and businesses. Claiming to be part of two well-known threat groups, they have asked for significant ransoms. The pandemic has also facilitated the breakthrough of other threats, which were already making significant attempts to penetrate the cyberspace. Mobile malware and specifically banking Trojans have also been equipped with capabilities to intercept text messages on Android devices, compromising the two-factor authentication security protocols. Alarming rise of self-produced explicit material Child abusers have exploited the increased, unsupervised presence of children online during the pandemic in order to increase their grooming activities. The acceleration of production and dissemination of child sexual exploitation material is also fuelled by the proliferation of encrypted messaging applications and social media platforms. Online gaming and communication, the reduction of real-life social activities and the normalisation of sexual behaviour online are circumstances, which are abused by predators to target a larger number of victims. These factors create conditions for the victimisation of children online during a longer period. A key threat is the production of self-generated material, an alarming trend, which younger children are also exposed to. Lured by offenders using fake identities on gaming platforms and social media, more and more young children are falling into the trap of producing and sharing explicit material. Recording without the knowledge of the victims and the further dissemination of live-streamed sexual material is another alarming threat, referred to as ‘capping’. Peer-to-peer networks remain a key channel for the exchange of child abuse material, along with the Dark Web.

Operation Mobile 4, a two-week operation targeting multiple forms of organised property crime and fraud, has successfully concluded its November action days after thousands of border and roadside checks across Europe. Taking place in 16 European countries and further 6 Balkan states, operatives successfully intercepted hundreds of stolen vehicles and vehicle parts, as well as 1 000 irregular migrants and 31 people smugglers. Operation Mobile 4 is a wide-ranging international operation co-led by Greece, Germany, Poland, Frontex, and Europol. Police Officers and Border Guards from 23 European and West Balkan states* were involved in the investigation. Europol provided remote support by crosschecking in real-time the information collected in the field against its databases. Results from joint action days between 11-22 October  518 stolen vehicles 400 stolen car parts 140 fraudulent documents 4 stolen boats 10 000 database checks 1 000 irregular migrants 31 people smugglers A multi-pronged operation against smuggling Operation Mobile 4 is a wide-ranging international operation co-led by Greece, Germany, Poland, Frontex, and Europol. Police Officers and Border Guards from 23 European and West Balkan states* were involved in the investigation. Europol provided remote support by crosschecking in real-time the information collected in the field against its databases. During the two weeks of actions from law enforcement, officers pursued criminal activity on multiple fronts, carrying out vehicle checks, border searches and database analysis. The main focus related to stolen vehicles, vehicle parts, and migrant smuggling, with investigators also targeting trafficking in drugs, firearms and endangered species. The activities led to the seizure of 518 stolen vehicles. Officers also recovered several stolen luxury cars from Western Europe they found in Poland, the Czech Republic, Lithuania, and Slovakia, as well as 4 stolen boats. The authorities that took part in Mobile 4 observed an increasing trend of smuggling of stolen trucks, buses, agriculture machinery, and holiday cars such as campervans. Officers simultaneously raided chop shops, which dismantle stolen vehicles and facilitate parts smuggling, and performed roadside checks. This yielded 400 stolen vehicle parts, as well as 140 forged IDs and vehicle documents.  Further checks by law enforcement on road vehicles and boats detected 1 000 irregular migrants being smuggled into the EU, leading to the arrest of 31 migrant smugglers. Large scale cooperation and information sharing The close cooperation of law enforcement agencies enabled investigators to successfully target a wide range of criminal activity under Operation Mobile 4. Law enforcement also received support from private actors in the vehicle manufacturing and rental sector, which helped investigators be more efficient and precise on the action days. *Countries involved: Austria, Bulgaria, Croatia, Estonia, Finland, France, Germany, Hungary, Italy, Latvia, Lithuania, The Netherlands, Portugal, Romania, Slovakia, Spain, Albania, Bosnia and Herzegovina, Kosovo**, Republic of North Macedonia, Montenegro, and Serbia were involved in the operation on the spot. ** This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence.

On 5 November 2021, Europol, in cooperation with the European Commission, organised a tabletop exercise to test the implementation of the EU Crisis Protocol.  The exercise took place in the framework of the EU Internet Forum and examined the collaboration between government authorities and the tech industry to contain the viral spread of terrorist and violent extremist content online in the aftermath of a terrorist event. Among the tested elements was real-time communication between governments and online service providers and the interaction of processes when more than one crisis mechanism (sector/geography-specific) is initiated. Who was involved? The exercise brought together law enforcement representatives from EU Member States and third party countries, online service providers, the Global Internet Forum to Counter Terrorism (GIFCT), the Christchurch Call, the Aqaba Process, as well as policy makers from governments, EU bodies and international organisations. Claudio Galzerano, Head of Europol’s Counter Terrorism Centre, said: “This tabletop exercise was an excellent opportunity to firmly establish our public-private partnership with members of the technology industry in our ongoing fight against terrorism. It is imperative that we work together to share information in real time and use the latest technological advances to curtail terrorist and extremist content on online platforms.” A rapid, coordinated response to terrorist content online The EU Crisis Protocol, adopted by the Justice and Home Affairs Ministers in October 2019, is a voluntary mechanism that allows EU Member States and online platforms to respond rapidly and in a coordinated manner to the dissemination of terrorist content online in the event of a terrorist attack, while ensuring strong data protection and fundamental rights safeguards.  The development of the Protocol came about in the aftermath of the terrorist attack in Christchurch, New Zealand in 2019, whereby leaders from governments, tech industry, civil society and the EU Commission agreed on the ‘Christchurch Call for Action’. Since then, other crisis mechanisms have been developed both at a national level and by the tech sector. Yolanda Gallego-Casilda Grau, EU Commission representative and Head of the Prevention of Radicalisation Unit, said: “Terrorist attacks in Christchurch, Halle and Conflans-Sainte-Honorine serve as strong reminders that the online dimension can be an integral part of a terrorist attack, with the aim of further spreading the messages and objectives of terrorists. Our partnerships with tech companies facilitate the rapid assessment of the online impact of terrorist attacks, and the secure and timely sharing of critical information necessary for effective crisis response”. Tom Thorley, GIFCT Director of Technology, said: “A vital component of fulfilling GIFCT’s mission to prevent terrorist and violent extremist exploitation of digital platforms is how we strengthen our members’ collective efforts to respond to terrorist and violent extremist attacks. GIFCT’s Incident Response Framework streamlines how our tech company members can communicate and share situational awareness as an incident unfolds in order to identify any online dimension to an offline attack. In this inherently dynamic space, it’s critical to continue refining our efforts and how we engage with our partners, including through tabletop exercises like this one.” Europol has undertaken a central role in the EU Crisis Protocol implementation by managing the coordination of information exchange and communication among relevant stakeholders in a rapid and secure manner.  Recent acts of terrorism in France and Austria in October-November 2020 have further demonstrated the importance of disrupting the dissemination of terrorist and violent extremist propaganda during, and in the aftermath of, terrorist attacks, while at the same time supporting investigations. In order to enhance cross-sector collaboration and further advance the EU Crisis Protocol processes, Europol is hosting targeted tabletop exercises.

Updated on 8 November at 18:30 On 4 November, Romanian authorities arrested two individuals suspected of cyber-attacks deploying the Sodinokibi/REvil ransomware. They are allegedly responsible for 5 000 infections, which in total pocketed half a million euros in ransom payments. Since February 2021, law enforcement authorities have arrested three other affiliates of Sodinokibi/REvil and two suspects connected to GandCrab. These are some of the results of operation GoldDust, which involved 17 countries*, Europol, Eurojust and INTERPOL. All these arrests follow the joint international law enforcement efforts of identification, wiretapping and seizure of some of the infrastructure used by Sodinokibi/REvil ransomware family, which is seen as the successor of GandCrab. Anti-REvil team set up in Europe Since 2019, several large international corporations have faced severe cyber-attacks, which deployed the Sodinokibi/REvil ransomware. France, Germany, Romania, Europol and Eurojust reinforced the actions against this ransomware by setting up a Joint Investigation Team in May 2021. Bitdefender, in collaboration with law enforcement, made a tool available on the No More Ransom website that would help victims of Sodinokibi/REvil restore their files and recover from attacks made before July 2021. In the beginning of October, a Sodinokibi/REvil affiliate was arrested at the Polish border after an international arrest warrant was issued by the US. The Ukrainian national is suspected of perpetrating the Kaseya attack, which affected up to 1 500 downstream businesses and for which Sodinokibi/REvil asked a ransom of about €70 million. Additionally, in February, April and October 2021 authorities in South Korea arrested three affiliates involved in the GandCrab and Sodinokibi/REvil ransomware families, which had more than 1 500 victims. On 4 November, Kuwaiti authorities arrested another GandGrab affiliate, meaning a total of seven suspects linked to the two ransomware families have been arrested since February 2021. They are suspected of attacking about 7 000 victims in total. GoldDust’ links to GandCrab  Since 2018, Europol has supported a Romanian-led investigation which targets the GandCrab ransomware family and involved law enforcement authorities from a number of countries, including the United Kingdom and the United States. With more than one million victims worldwide, GandCrab was one of the world’s most prolific ransomware families. These joint law enforcement efforts resulted in the release of three decryption tools through the No More Ransom project, saving more than 49 000 systems and over €60 million in unpaid ransom so far. The investigation also looked at the affiliates of GandCrab, some of whom are believed to have moved towards Sodinokibi/REvil. Operation GoldDust was also built up on leads from this previous investigation targeting GandCrab. Decrypt with No More Ransom The support from the cybersecurity sector has proven crucial for minimising the damage from ransomware attacks, still the biggest cybercrime threat. Many partners have already provided decryption tools for a number of ransomware families via the No More Ransom website. Bitdefender supported this investigation by providing key technical insights throughout the entire investigation, along with decryption tools for both of these highly prolific ransomware families to help victims recover their files. KPN and McAfee Enterprises are other private sector partners that have also supported this investigation, by providing technical expertise to law enforcement. Currently, No More Ransom has decryption tools for GandCrab (V1, V4 and V5 up to V5.2 versions) and for Sodinokibi/REvil. The Sodinokibi/REvil decryption tools helped more than 1400 companies decrypt their networks, saving them almost €475 million in potential losses. The tools made available for both ransomware families enabled more than 50 000 decryptions, for which cybercriminals had asked about €520 million in ransom. Europol’s support Europol facilitated the information exchange, supported the coordination of operation GoldDust and provided operational analytical support, as well as cryptocurrency, malware and forensic analysis. During the action days, Europol deployed experts to each location and activated a Virtual Command Post to coordinate the activities on the ground. The international cooperation enabled Europol to streamline victim mitigation efforts with other EU countries. These activities prevented private companies from falling victim to Sodinokibi/REvil ransomware. The Joint Cybercrime Action Taskforce (J-CAT) at Europol supported the operation. This standing operational team consists of cyber liaison officers from different countries who work from the same office on high profile cybercrime investigations. *Participant countries: Australia, Belgium, Canada, France, Germany, the Netherlands, Luxembourg,  Norway, Philippines, Poland, Romania, South Korea, Sweden, Switzerland, Kuwait, the United Kingdom, the United States * Participating organisations: Europol, Eurojust and Interpol Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.