Top Stories

On 18 June 2019, the French Judicial Police (Police Judiciaire), with the support of the Belgian Federal Judicial Police (Police Judiciaire Fédérale) and Europol, swooped on the members of a Russian-speaking organised crime group behind an illegal cigarette smuggling business. As a result of this action day, 15 individuals were arrested, including the ringleaders, and 2 million cigarettes were seized.   The stings follows a complex investigation looking into the activities of this criminal network, composed mainly of Armenian and Ukrainian nationals, which smuggled cigarettes and other prohibited goods from Belgian to the Paris region and Western France. This organised crime group is believed to have been very prolific: this network is responsible for 70 importations of smuggled cigarettes since October 2018, with a total resale value estimated at around €4 million.  On the action day, one of the Ukrainian ringleaders was arrested in France while driving a lorry loaded with 500 cartons of cigarettes of various brands, alongside € 10 000 in cash. Ten of his accomplices involved in various ways in this illegal traffic were arrested in the Ile-de-France region, and one in Nantes (France). In France, the searches led to the seizure of 3 386 cartons of cigarettes, and over €55 800 in cash. The other Ukrainian ringleader was arrested by the Belgian Federal Judicial Police of Liège, in execution of a European Arrest Warrant issued by the competent French prosecutor. During the searches, €90 000 in cash were seized at his house, alongside 117 sports bag filled with 6 000 cartons of cigarettes. In total, no less than €1.1 million have been seized as criminal assets. This investigation was coordinated in close cooperation with Europol, which allowed for the identification of the main organiser of the transport – and subsequently, the resale of large quantities of cigarettes within the Russian-speaking community in the Paris region.

On Tuesday 18 June, the Spanish National Police (Policia Nacional) disrupted a criminal organisation which was financing Al Qaeda terrorist militias. The complex operation was carried out in the Spanish cities of Madrid, Valencia and Toledo. Ten individuals were arrested,  and 14 house and premises searches were carried out, involving more than 350 police officers. Europol supported the Spanish authorities with three experts from the European Counter Terrorism Centre and two experts equipped with mobile offices and Universal Forensic Extraction Devices (UFED) to support the investigations on-the-spot. Information gathered during the operation was analysed and exchanged in real time and immediately cross-matched against Europol's databases. The leaders of the organisation form a family clan which committed tax fraud and money laundering crimes through the massive use of false invoices obtained by an illegal business they had been running for years. The proceeds of their illegal business was sent to Syria via the Hawala system, allowing the transfer of money without any physical transportation of cash, in order to support Al Qaeda terrorist militias in the Syrian region of Idlib. The organisation is part of a huge international clandestine structure, with the aim of attacking the Western economic system as a form of terrorism.

The Belgian judicial authorities, in effective cooperation with Eurojust and Europol, targeted a terrorist group involved in the recruitment and training of Kurdish terrorist fighters. Two suspects were apprehended by the Belgian authorities for hearings, following a number of houses searches, conducted simultaneously in 5 countries.  Eurojust, the EU’s Judicial Cooperation Unit, facilitated the issuance and transmission of several European Investigation Orders that were swiftly executed in Austria, Belgium, France, Germany and Switzerland. Europol’s European Counter Terrorism Centre set up a coordination centre on a joint action day to support the operations of the law enforcement authorities in all countries concerned. The Belgian Federal Prosecutor’s Office, in close collaboration with the investigative judge of Liège, specialised in terrorism matters, initiated a criminal investigation into the alleged terrorist organisation in 2017. Several operational meetings and one coordination meeting at Eurojust served as a platform to swiftly exchange case-related information and efficiently coordinate the next judicial and operational steps. The members of the terrorist organisation allegedly belong to some of the military wings, (including People’s Defence Forces (HPG)) of the Kurdistan Workers’ Party (PKK). They are suspected of recruiting and training terrorist fighters, using training camps and sessions in various countries.

A new milestone for one of Europol’s annual operations, supported by the European Anti-Fraud Office (OLAF) and involving nearly 30 countries. Operation Silver Axe began in 2012 to target the illegal trade of pesticides. Since its launch, 1222 tonnes of illegal and fake counterfeit products have been seized. In 2019, 550 tonnes of goods have been confiscated in Europe and three individuals arrested. Now in its fourth year, operation SILVER AXE IV saw law enforcement officers carry out checks at major seaports, airports and land borders. Production and repackaging facilities were also checked in the 29 participating countries: Austria; Belgium; Bulgaria; Croatia; Cyprus; Czechia; Denmark; Estonia; Finland; France; Germany; Greece; Hungary; Ireland; Italy; Latvia; Lithuania; Luxembourg; Malta; Netherlands; Poland; Portugal; Romania; Slovakia; Slovenia; Spain; Switzerland; Ukraine; United Kingdom. Environment and health at risk Pesticides must undergo rigorous testing before being put on the market. Illegal pesticides are not tested so pose a threat to the environment and the health and safety of users and consumers. Operation Silver Axe focuses on the sale and market availability of counterfeit pesticides, (including infringements of intellectual property rights like trademarks, patents and copyright) and targets the illegal trade of pesticides. During the action phase, Europol experts exchanged and analysed data received from the countries participating in the operation and liaised with stakeholders from 34 private companies involved in the production and commerce of pesticides. Alongside this analytical support, Europol deployed six experts on-the-spot to support actions in Member States.   OLAF provided Europol and the participating countries with information on 120 suspicious shipments of pesticides shipped into the European Union. Private-sector and public-sector cooperation Cooperation with private industries and other European and international bodies was crucial to the success of the operation. Private-sector partners CropLife International, the European Crop Protection Association (ECPA) and the European Crop Care Association (ECCA) represented the plant protection industry during the operation. The European Commission’s Directorate-General for Health and Food Safety DG SANTE, OLAF, INTERPOL and the Food and Agriculture Organization of the United Nations (FAO) from the public sector also participated in the preparation phase and the operation. Catherine De Bolle, Europol’s Executive Director: "This is only the fourth time this operation has taken place and we have beaten previous records again. With operation Silver Axe, Europol underlines that the public’s health and safety comes first. It is of critical importance that we team up with our partners to tackle these types of crimes together head on and bring those who are responsible to justice." Hans Mattaar, Technical Director of ECCA: "Every new Silver Axe operation shows how improving cooperation between law enforcement agencies leads to more efficiency in the fight against illegal pesticides. ECCA is pleased to see the result of Silver Axe IV, but at the same time concerned about the ongoing illegal business. We look forward to continuing our contribution to Europol in broadening the scope of Silver Axe. To increasing the pressure is the only way to discourage to discourage the criminal organisations behind this illegal trade." Christian Archambeau, EUIPO executive director said: "Counterfeit pesticides can have serious damaging effects for the environment and for the health and safety of citizens and consumers. EUIPO is committed to continue developing research to substantiate the impact of IPR infringement, analysis of the trends of counterfeiting as well as support enforcers’ efforts in the fight against fakes”. EUIPO’s research shows an economic loss of EUR 1.3 billion in the EU every year, due to counterfeit pesticides."

Colombia and Europol co-led operation Tayrona, a transnational operation targeting the trafficking of cocaine and firearms between America and the EU. During the operation, law enforcement conducted over 75 investigations and seized 19 552 kgs of cocaine; arrested 583 people; checked 36 vessels; and seized 140 shipments of cocaine in cargo and parcels. Additionally, more than 3 000 firearms were traced, 133 firearms seized, over 14 600 cartridges of ammunition, parts and components of weapons, several rocket launchers and hand grenades were seized. The core action of operation Tayrona took place between 8 March and 16 June. The operation was supported by INTERPOL and Frontex, the European Border and Coast Guard Agency.

Under the supervision of the Bulgarian Supreme Prosecutor’s Office of Cassation, police officers from the Bulgarian Cybercrime Department from the General Directorate Combating Organized Crime of the Ministry of Interior carried out a joint action against five cable operators in Bulgaria (in the cities of Burgas, Kardzhali, Blagoevgrad, Dupnitsa, Kyustendil, Gotse Delchev, Sandanski and Petrich). The operation was supported by Europol’s Intellectual Property Crime Coordinated Coalition – IPC3 and the Audiovisual Anti-Piracy Alliance (AAPA).   The five cable operators were illegally intercepting and distributing more than 60 premium TV channels (both foreign and Bulgarian), without the consent of the rights–holders. The financial damage is estimated to be more than 10 million Bulgarian leva (approximately €5 million). More than 700 000 subscribers received the illegal broadcasted signal from the criminal network. The entire illegal hardware infrastructure used for the criminal activity was seized during the house searches. The suspects had also been distributing TV channels worldwide through mobile applications whose servers were traced and seized. Europol’s IPC3 supported the investigation on the ground by deploying an analyst and a specialist to Bulgaria equipped with a mobile office. Europol’s officers carried out real-time information exchange and cross-checks of the data gathered during the course of the action against Europol’s databases. IPC3 is hosted at Europol and funded by the European Union Intellectual Property Office (EUIPO).

French and Romanian authorities arrested 11 members of an organised crime group (OCG) involved in the smuggling of 308 migrants to the UK in a joint action day. Eighteen house searches were carried out in Romania, where firearms and around €480 000 in cash were seized during the searches. The operation was supported by Europol and Eurojust. Europol’s European Migrant Smuggling Centre (EMSC) supported this investigation by providing analysis of operational data and hosting an operational meeting prior to the arrest phase. Joint Operational Team (JOT) Dunqett, under the EU EMPACT priority on the facilitation of illegal immigration, allowed for eight French investigators to travel to Romania and exchange information directly between the two authorities. Organised crime group: The OCG was composed mainly of Romanian truck drivers, intermediaries and leaders. Targets: Smuggled migrants were mostly from Afghanistan, Iran, Iraq and Palestine*. Modus operandi:  The OCG used trucks that belonged to Romanian companies. The migrants were transferred to transit sites in northern France, Belgium and the Netherlands, hoping to reach the UK as their final destination. Fees for smuggling: The truck drivers promised ‘guaranteed transit’ to the migrants and charged them a fee between €11 000 and €14 500. The total illegal proceeds amounted to approximately €3.4 million. So far, 59 active OCG members have been identified. The criminals are suspected of illegal migrant smuggling, participating in a criminal organisation and money laundering. France took the lead in the investigation in August 2018, followed by the Romanian and UK authorities in March 2019 and the Dutch investigation in May 2019. In 2010 the EU set up a four-year Policy Cycle  to ensure greater continuity in the fight against serious international and organised crime. In March 2017 the Council of the EU decided to continue the EU Policy Cycle for organised and serious international crime for the 2018 - 2021 period. This multiannual Policy Cycle aims to tackle the most significant threats posed by organised and serious international crime to the EU in a coherent and methodological manner. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Migrant smuggling  is one of the priorities for the Policy Cycle. * This designation shall not be construed as recognition of a State of Palestine and is without prejudice to the individual positions of the Member States on this issue.

A large-scale joint investigation, led by the French Gendarmerie Nationale in cooperation with the Romanian DIICOT (Directorate for the Investigation of Organised Crime and Terrorism), and supported by Europol and Eurojust, has resulted in the dismantlement of an international organised crime group involved in trafficking young Romanian women to France for the purpose of sexual exploitation. As a result of this investigation, 13 individuals were arrested, including the suspected ring leader, and 13 victims of sexual exploitation safeguarded. In a coordinated law enforcement action, 150 French officers from the Gendarmerie Nationale in Rennes and 60 Romanian officers from the Craiova Brigade for Combating Organised Crime, as well as the Craiova Mobile Gendarmerie and Special Action Service, were deployed during the simultaneous operations. The criminal gang aimed at gaining total control over the prostitution industry in the regions of Nantes and Rennes in Western France. They recruited vulnerable women in Romania by luring them with the promise of a better life, either by abusing their precarious financial situation or by resorting to other known recruitment methods like the ‘lover boy’. The gang used violence and threats against the victims and their families as methods of coercion. The estimated total value of the criminal proceeds is €1.2 million for the period 2017-2019. Europol and Eurojust have provided support throughout the entire investigation. Europol facilitated information exchange, provided analytical support including financial intelligence analysis and organised operational meetings to plan and prepare the executive actions. On the action day, Europol provided on the spot support by deploying a human trafficking expert to France, equipped with a mobile office, while a money laundering expert was deployed to Romania. This allowed for real-time intelligence analysis and cross-checks against Europol’s databases. Eurojust facilitated the issuing of European Arrest Warrants by the French authorities, which were executed in Romania, Germany and Italy.

On 17 June, a new decryption tool for the latest version of the most prolific ransomware family GandCrab has been released free of charge on www.nomoreransom.org. This tool allows victims of ransomware to regain access to their information encrypted by hackers, without having to pay demanded ransoms. The tool is released in partnership with law enforcement agencies from Austria (Bundeskriminalambt – BMI), Belgium (Federal Computer Crime Unit), Bulgaria (General Directorate Combating Organized Crime - Cybercrime Department), France (Police Judiciaire de Paris – Befti), Germany (LKA Baden-Württemberg), the Netherlands (High Tech Crime Unit), Romania (DIICOT), the United Kingdom (NCA and Metropolitan Police), the United States (FBI) and Europol and its Joint Cybercrime Action Taskforce (J-CAT), together with the private partner Bitdefender. The decryption tool counters versions 1 and 4 and versions 5 to 5.2, which are the latest to be used by cybercriminals. Previous decryptors for the GandCrab ransomware have helped more than 30 000 victims recover their data and save roughly $50 million in unpaid ransoms. Most importantly, the joint efforts have weakened the operators’ position on the market and have led to the demise and shutdown of the operation by law enforcement. This shutdown was a global law enforcement effort supported by Bitdefender and McAfee.   Launched in January 2018, GandCrab quickly became the go-to tool for hackers for affiliate-based ransomware, holding 50% share of all the ransomware market by mid-2018. Set as a ransomware-as-a-service licensing model, distributors could buy the ransomware on dark web markets and spread it among their victims. In exchange, they would pay 40% of their profit to the GandCrab developers and keep 60% for themselves. The GandCrab operators recently claimed that they have extorted more than $2 billion from victims. It is likely that they subjected over 1.5 million victims all over the world to this ransomware. Better safe than sorry The best cure against ransomware remains diligent prevention. Users are strongly advised to: always keep a copy of their most important files somewhere else: in the cloud, on another drive, on a memory stick, or on another computer; use reliable and up-to-date anti-virus software; not download programs from suspicious sources; not open attachments in emails from unknown senders, even if they look important and credible; don’t pay the ransom if you are a ransomware victim!　 Find more information and prevention tips on www.nomoreransom.org  

Yesterday, Europol’s European Cybercrime Centre (EC3) signed a Memorandum of Understanding (MoU) with NTT Security, one of the world's leading providers of IT security solutions. The MoU was signed by Kai Grunwitz, Senior Vice President EMEA & Global Business Development at NTT Security and the Head of EC3, Steven Wilson, at Europol’s headquarters in The Hague. With this agreement, the two organisations are combining their efforts to make cyberspace safer for individuals, businesses, and governments and prevent cybercrime. NTT Security is one of the world’s leading telecommunications operators with over 1.500 security experts and over 150 Mio. attacks defended annually. NTT Security is committed to sharing its threat intelligence data with industry partners and law enforcement agencies such as Europol in a secure and trusted way, as a means of better protecting global customers from the rapidly expanding cyber-crime industry. The Memorandum of Understanding defines a framework for NTT Security and Europol to exchange threat data as well as information relating to cyber security trends and industry best practice.   On the signing of the Memorandum of Understanding, the Head of Europol's EC3, Steven Wilson, commented:"As criminals increasingly threaten citizens’ and businesses’ digital lives, it is vital for the law enforcement community to work closely with the global industry players to create a safe environment on the internet. We are honoured to collaborate with one of the top global telecommunication players to fight cybercrime. I am confident that the high-level of technical expertise that NTT Security will bring will result in a significant benefit to our work. Working co-operation of this type between Europol and industry is the most effective way in which we can hope to secure cyberspace for European citizens and businesses.’’ Kai Grunwitz, Senior Vice President EMEA & Global Business Development at NTT Security, said: ‘’The threat of cybercrime constantly takes on new global dimensions.  Combating evolving threats requires cooperation between our public and private sectors.  Law enforcement and private industry must work together to understand these threats and provide a collective approach to stemming the tide of cybercrime.  With the Memorandum of Understanding with EC3, NTT Security continues to take an active role in the global fight against cybercrime.’’  He also added: ‘’The relationships we build today will prove to be valuable in the fight against cybercrime tomorrow.’’ Background: NTT Security is the specialized security company and enables companies to deliver resilient business solutions for digital transformation needs. NTT Security has 10 SOCs, seven R&D centres, over 1,500 security experts and handles hundreds of thousands of security incidents annually across six continents. Europol is the European Union’s law enforcement agency. Headquartered in The Hague, the Netherlands, Europol supports the 28 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. With over 1 200 staff members, Europol uses state-of-the art tools to support some 40 000 international investigations each year, serving as a centre for law enforcement cooperation, analytical expertise and criminal intelligence.

New research by Europol’s European Counter Terrorism Centre reveals the terrorist organisation’s efforts to attract women to their cause. Women became indispensable to the so-called Islamic State (IS), both in conflict areas and in the West. They played their role in the organisation’s state-building enterprise and were granted more proactive roles on the battlefields. This increase in the involvement of women could pave the way for potentially different roles of jihadi women in the future. Europol’s report, the first in a new series, Europol Specialist Reporting, aims to shed light on how IS – a group that supports a patriarchal authority – attempted to appeal to and recruit women. IS’s ambition of building a functional state required the active and voluntary participation of women. Women were granted roles as doctors, teachers, ‘moral policers’ and – more controversially – combatants. Nevertheless, IS stressed that their main role remained that of stay-at-home wives and mothers. Women also featured noticeably more in IS propaganda than in the material of earlier jihadi organisations. IS clearly recognised the importance of women and their role in producing and disseminating propaganda. Official propaganda was itself aimed at women as IS soon realised the necessity of investing resources into reaching out to its female constituents. Five key findings from Europol’s report The incentives put across by IS to recruit women are in many ways gender-neutral. Its propaganda focuses on ideas and concepts that speak to the emotions of both men and women in equal measure, namely the revival of the Islamic caliphate and the defence of the umma.1 IS propaganda presents female jihadis to be as ideologically motivated as their male counterparts. Women are portrayed as seeking martyrdom and divine compensation, with their sense of empowerment lying in contributing to the building of an Islamic state. To quote one IS female propagandist: ‘Let these crusaders take heed, for just as the [caliphate] is filled with men who love death more than the crusaders love life, likewise are the women of the Islamic State’. IS online content was forthright in stressing the hazards of life in the caliphate; however, IS portrayed the suffering and adversity as part of God’s plan and as a stepping-stone to paradise.　 IS states that offensive jihad is not obligatory for women, and that a woman’s honour lies in being a producer of jihadis, rather than a warrior herself; nevertheless, the organisation encouraged women to carry out attacks against the enemy. As of late 2017, IS explicitly called on women to become actively engaged in battles and legitimised combative jihad for women. Examples of women who either carried out terrorist attacks or were arrested preventively prove that women are willing to use violence if the ideology allows them to do so. For now, it is not yet their role, but this balance may easily shift depending on the organisation’s strategic needs and developments. The study looked exclusively at the incentives put across for this purpose within the organisation’s propaganda. It does not claim to analyse the manifold psychological and sociological factors that could motivate individual women to join IS or subscribe to its ideology. This report is the first in a new series, Europol Specialist Reporting – a collection of reports published by our in-house experts on priority crime areas. NB: The propaganda analysed covers the period from June 2014 to August 2018. Download the report> ----- 1 The umma is a concept that encompasses the Muslim community worldwide, eliminating cultural, ethnic or national identities and adopting instead an identity based exclusively on religion.

Over 300 cryptocurrency experts from both law enforcement and the private sector attended the sixth Cryptocurrency Conference hosted at Europol’s headquarters from 12 to 14 June 2019. The event, organised by Europol’s European Cybercrime Centre (EC3), is the largest law enforcement cryptocurrency event in Europe. The conference looked at opportunities for closer cooperation and new partnerships to prevent and detect cryptocurrency-facilitated crime and to assist asset recovery. Experts shared best practices and law enforcement techniques using examples such as investigations into phishing, thefts of funds and DDoS extortion. The conference also included lessons learned from some recent investigations like the takedown of Wall Street Market and Bestmixer. Private sector experts specialising in the lawful use of cryptocurrencies also actively participated in the event to further enhance cooperation with law enforcement. Cryptocurrency wallets, exchanges and payment processors, including Binance, BitBay, Bitcoin.de, Bitfinex, BitFlyer Europe, Bitnovo, Bitonic, Bitpanda, BitPay, Bitstamp, CEX, Coinbase, Coinfloor, Coinhouse, Coinpayments, CoinsPaid, Ledger, Litebit, LocalBitcoins, OKCoin, Shapeshift, SpectroCoin, Tether and Xapo demonstrated their best practices in implementing Know Your Customer (KYC) policies and mechanisms, and risk-based approaches to suspicious transactions. Participants reflected on the legitimate use of blockchain technologies, including the use of cryptocurrencies for trading and investment activities, payment method and as a store of value. Like last year, Europol issued all speakers with traceable certificates permanently stored in the Bitcoin Blockchain, practically demonstrating the benefits of the tamper-proof, decentralised ledger technology. The transaction referring to the index that contains hashes of all certificates awarded to speakers is publicly available. New computer training game for investigators At the conference, Europol also announced the ongoing development of a cryptocurrency-tracing serious game, developed and co-created in close cooperation with CENTRIC (Centre of Excellence in Terrorism, Resilience, Intelligence and Organised Crime Research). The game, planned to be launched in October at the seventh Europol-INTERPOL Cybercrime Conference, will be the first law enforcement training opportunity on cryptocurrency and investigation using gamification. It will allow law enforcement officers to get hands-on training and advice on tracing cryptocurrencies in criminal investigations.

More than 4.7 million counterfeit products seized, over 16 400 social media accounts suspended and 3 300 websites closed in the EU-wide operation Aphrodite II against trafficking of counterfeit goods. A joint investigation carried out by law enforcement authorities from 18 countries and supported by Europol, resulted in the seizure of 4.7 million counterfeit products. During the operation, 16 470 social media accounts and 3 400 websites selling counterfeit products were closed. The online fake goods marketers were selling a large variety of counterfeit items including clothes and accessories, sports equipment, illegal IPTV set-top boxes, medicines, spare car parts, mobile phones, miscellaneous electronic devices and components, perfumes and cosmetics. The operation led to the arrest of more than 30 suspects and reported 110 others to respective judicial authorities. A select number of suspects are part of two distinct criminal networks responsible for producing and trafficking counterfeit products online. Several investigations are still ongoing. Europol’s Intellectual Property Crime Coordinated Coalition (IPC3) and the Italian Finance Corps (Guardia di Finanza) coordinated the joint investigation, with cooperation from the private sector. The European Union Intellectual Property Office (EUIPO) supported the activities of IPC3 with a grant. Law enforcement agencies from Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Greece, Hungary, Ireland, Italy, Malta, Netherlands, Portugal, Romania, Slovakia, Spain, Ukraine and the United Kingdom are all involved in the operation. Digital platforms – no safe haven for counterfeits Criminal groups continuously abuse the communication opportunities of digital platforms such as websites, social media and instant messaging to traffic and sell counterfeit products. The exponential growth of internet platforms has also affected the development of online marketplaces (known as e-stores) that are considered as alternative retail channels. These new markets also take advantage of social channels to perpetrate illicit activities. Law enforcement, supported by the private sector, is therefore extending its response to online trafficking of counterfeit products. To counter the threat, Europol is examining the scale of the problem, gathering evidence and monitoring social media and sales platforms. Selling fakes on social media Sellers can advertise counterfeit goods through overt social media posts – with photos of the product and price – or through hidden links to other marketplaces located outside the EU. In the latter case, details of the transaction are arranged through other communication channels such as instant messaging applications or even by telephone under different names. Couriers deliver the packages while the payment is made with prepaid cards, money transfer companies or other forms of electronic payment and web-based services. Fake products sold on social media can be extremely dangerous. Lacking any quality control and not complying legal norms, fake toys, medicines, body care products, fake spare car parts, inks and material used to produce imitation luxury products and clothes can be harmful to consumer health. IPC3 intends to promote their recurrent operation, operation Aphrodite, to encourage more countries and private countries to get on board and contribute their expertise and explore new operational methodologies.

Most criminal activity involving counterfeiting is carried out by increasingly professionalised organised crime networks, which can reap large profits while running relatively few risks. That is according to the first EU-wide intellectual property crime threat assessment from Europol and the European Union Intellectual Property Office (EUIPO). The report also underlines that, although the majority of counterfeits in the EU market are produced outside Europe, in particular in parts of Asia, domestic manufacturing within Europe is an increasing trend. The threat assessment, carried out using EU-wide data and strategic intelligence analysis, also stresses that, as well as the traditional categories of counterfeited clothes, footwear and luxury products, there is a growing trade in fake products which have the potential to damage human health. An example of this would be the trade in counterfeit medicines for the treatment of serious illnesses, which appears to be increasing. In addition, fake goods are increasingly shipped via small parcels and express couriers, which are more difficult for enforcement authorities to detect. Online, illegal digital content continues to be distributed through BitTorrent portals and peer-to-peer networks, but also, increasingly, via cyberlockers, the threat assessment finds. The owners of these platforms generate profit through digital advertisements, which often include mainstream adverts from major brands. In many cases, these websites are also used to target consumers using phishing techniques or the dissemination of malware. The Executive Director of the EUIPO, Christian Archambeau, said: This threat assessment paints a stark picture of the scope and range of counterfeiting and piracy in the EU, and the damage it can cause to legitimate business and to consumers. Through our collaboration with Europol, we aim to support the efforts of law enforcement authorities in their fight against IP Crime, particularly in the online environment. Europol’s Executive Director, Catherine De Bolle, said: This report clearly shows that counterfeiting and piracy are not victimless crimes. Organised crime groups who produce and sell these goods have no respect for the quality of products which very often pose health and safety risks. Europol is dedicated to continuing its efforts, together with EU Member States and partners, to stop the criminal networks behind this dangerous and illegal trade. The health and safety of European consumers is of the utmost importance to us! The threat assessment will be released at the IP Enforcement Forum (co-organised by the OECD, the European Commission and the EUIPO) which aims to facilitate a coherent strategy to support effective IPR enforcement at EU and international level. This high-level forum will also study ways to reinforce cooperation in the fight against counterfeiting and piracy at all levels, including bridging governance gaps. The EUIPO will also release the new IP Enforcement Portal (a single EU platform for the enforcement of intellectual property rights) at the event, to support the IP enforcement community. This new powerful tool aims to facilitate the communication between rights holders and enforcement authorities, providing a central access point for most of the searchable databases for IP-related material, including TMview and DesignView. The portal combines the Enforcement Database (EDB), the Anti-Counterfeiting Intelligence Support Tool (ACIST) and the Anti-Counterfeiting Rapid Intelligence System (ACRIS) in a single platform.

The Commissioner of the New Zealand Police,  Mike Bush and Europol’s Executive Director, Catherine De Bolle, have signed a Working Arrangement and Memorandum of Understanding. The Memorandum of Understanding signed yesterday in The Hague will allow the New Zealand Police to  deploy a permanent liaison officer to Europol’s headquarters in The Hague, the Netherlands. The system of liaison officers at Europol ensures that the interests of law enforcement agencies in the EU Member States and non-EU partners, such as New Zealand, are represented at Europol. The Memorandum of Understanding will also  enable New Zealand Police to use SIENA - the Secure Information Exchange Network Application, managed by Europol. SIENA enables a swift and secure communication and exchange of operational and strategic crime-related information and intelligence. SIENA, as an operative instrument allows law enforcement authorities to collaborate effectively on a daily basis. Over the course of 2017, more than one million SIENA messages were exchanged among Europol, EU Member States and third parties. The possibility to share safely information among close to 1,200 competent national authorities from almost 50 countries and many international partners such as INTERPOL has shown its importance in fighting serious and organised international crime. In April 2019, Europol and the New Zealand Police already signed a working arrangement, which established a framework for cooperation and allowed to enhance strategic cooperation. Europol sees strong potential for the cooperation with New Zealand in many areas, including on online child sexual exploitation, Organised Motorcycle Gangs and drug trafficking. Furthermore, the  heinous attacks in Christchurch have shown the importance of increasing international cooperation also in the area of counter terrorism.

Less profit? Less crime! Organised crime is profit-driven. Depriving criminals of their profit is one of the most effective deterrents. Reinforcing cooperation between anti-money laundering experts worldwide is key to combating many crime areas. The concept of ‘no gain, no crime’ formed the basis of the Anti-Money Laundering Operational Network (AMON) meeting in Sofia, which was attended by experts from 37 countries. Participants were from EU Member States, Albania, Australia, Bosnia and Herzegovina, Colombia, Georgia, Israel, North Macedonia, Serbia, Switzerland, Ukraine, the USA. Prevention and disruption before prosecution  Experts discussed how law enforcement authorities ought to be ready to explore all possible avenues to fight money laundering, by being proactive and identifying the weaknesses and deficiencies, which allow the misuse of the financial systems. Law enforcement should endeavour to find all available opportunities and instruments to disrupt money laundering, including strong cooperation with the financial sector. Three dedicated workshops provided the opportunity to go deeper into the core topics in money laundering – underground banking and trade-based money laundering, the misuse of new payments methods to launder proceeds and complex financial crimes. The event was organised under the Bulgarian Presidency of AMON and was supported by AMON’s steering group (Belgium, France, Netherlands, Spain, and the UK). DG HOME, the Directorate-General of the European Commission responsible for migration and home affairs, endorses the effort to build and maintain a network of anti-money laundering practitioners. The initiative is funded by a grant from ISF Police (Internal Security Fund - Police).  The Financial Intelligence Unit at Europol hosts the permanent secretariat of AMON as part of Europol’s efforts to enhances the effectiveness of cross-border investigations into money laundering by providing fast responses and pooled expertise.

Today, the Executive Directors of Europol and Frontex, the European Border and Coast Guard Agency, have signed a new joint Action Plan that will guide their cooperation in the coming years to strengthen their common efforts in enhancing the security of EU citizens. The action plan was signed by Europol Executive Director, Catherine de Bolle, and Frontex Executive Director, Fabrice Leggeri, at the margins of the Justice and Home Affairs Council in Luxembourg. The ceremony took place in the presence of the Romanian Minister of Interior Affairs and Chair of the JHA Council, Carmen Daniela Dan, and the Director-General of the Directorate-General for Migration and Home Affairs of the European Commission, Paraskevi Michou. Europol’s databases and criminal investigations will be strengthened by information gathered by Frontex during operational activities at the external borders. Information from Europol will facilitate more efficient management of the EU’s external borders and intelligence-based, targeted action against criminal groups and terrorists. This structural exchange of information between the two agencies will improve the work of border guards and support investigations. Efforts of both agencies in the fields of research and development of new technologies will also be closely coordinated, for instance for the introduction of the European Travel Information and Authorisation System (ETIAS). Frontex will set up and manage the ETIAS Central Unit, which will provide operational support, as well as reinforcing and coordinating border control activities in Member States. Europol and Frontex also plan to hold annual meetings of executive management and exchange liaison officers.　

On 4 June, the Portuguese Immigration and Borders Service (Serviço de Estrangeiros e Fronteiras), supported by Europol, arrested eight suspected members of an international organised criminal group trafficking human beings for sexual exploitation. The Portuguese authorities arrested eight suspects in the Aveiro area, Albergaria-a-Velha, Ílhavo and Gafanha da Nazaré. During the operation, 20 women were identified as victims of sexual exploitation. During the operation, the Portuguese authorities searched twelve houses, twelve vehicles, two money transfer agencies and a travel agency. Six vehicles, gold, jewellery, money and false documents were seized. The criminal group operated in Portugal and other EU Member States. The group exploited victims from unstable social and economic backgrounds, such as those with a fragile home life or suffering from alcohol, drug or domestic abuse. The women, considered as objects, were threatened and forced into prostitution to pay for the debts and commissions imposed on them by the leader of the organised criminal group. Europol supported the investigation by coordinating the information exchange, holding operational meetings and providing on-the-spot expertise. Europol’s in-house experts also cross-checked operational information and produced an analytical report, which showed the criminal network’s geographical reach and exploited victims.

On 4 June, the Belgian Customs and Excise Administration (Administration générale des Douanes et Accises) dismantled a large criminal network in an operation supported by the Belgium Federal Police (Police Fédérale belge) and Europol. The criminals illegally produced cigarettes in the surroundings of the Belgian cities of Namur and Charleroi.  The Customs and Excise Investigation Team of Charleroi discovered professional cigarette manufacturing machines during a raid on a warehouse. The facility was also fully furnished with beds, a kitchen and even a gym. The Belgian authorities searched six other warehouses and one private property. A printing set-up was seized from one of the warehouses.  During the operation, the Belgian authorities seized 10 tonnes of tobacco and 25 million cigarettes, ready to sell. Other seizures of cigarette components such as filters, glue, paper, aluminium foil and packaging were also made. Europol supported the Belgian customs authorities by providing expertise and deploying a mobile office for crosschecks against Europol’s databases.   

Europol supported police officers in south-east England during the Hells Angels Euro Run 2019, which was held at a private venue on the border of East Surrey and West Sussex to mark 50 years of the Hells Angels in the UK. The event attracted around 3 000 Hells Angels members from all over the world.Police in Surrey and Sussex once again made public safety their main priority and subsequently introduced powers under the Criminal Justice and Public Order Act to stop and search individuals within a designated area of Surrey and Sussex during the event. The special order was granted as police received information that some attendees were likely to be carrying offensive weapons. In total, 49 people were arrested in connection with the event for possession of offensive weapons and drug offences; a number of them have already been sentenced in court.An event of this scale and nature had never been held in the UK before and required careful planning to ensure public safety. The policing operation involved law enforcement agencies in the UK, the EU and beyond. Police in Surrey and Sussex benefited from information shared by international colleagues about some of the attendees and the risks they posed. Twenty-seven people were refused entry to the UK, all of whom were international members of Hells Angels and deemed to pose a risk to the wider public with previous convictions for serious crimes including murder, kidnapping, torture, drug dealing, violent assaults and firearms offences. Events like the Hells Angels Euro Run do not usually occur without serious incident when they have taken place in other countries.Europol plays a key role in combatting the criminal activities of outlaw motorcycle gangs (OMCGs). Europol’s Analysis Project (AP) Monitor and its project partners support EU Member States with expertise, knowledge and on-the-spot support with mobile offices in policing major biker events to ensure public order and protection.For this year’s Hells Angels Euro Run, Europol deployed officers with mobile offices and created a team of international observers from eight European countries, Canada and the USA to support on the spot and in the command centre. Europol would like to highlight the excellent professional cooperation with the British authorities involved and colleagues from other Member States, who supported the operation in the UK. Europol will continuously monitor OMCGs in criminal investigations and support EU Member States during major outlaw biker events.

An international operation against the illegal trade in reptiles has seen hundreds of seizures and 12 arrests in the EU. Europol coordinated information sharing between EU members States which led to the identification of almost 200 suspects worldwide. Operation Blizzard, carried out between 12 April and 22 May 2019, targeted the criminal networks behind the illegal global trade of reptiles. The operation, coordinated by Europol and INTERPOL, involved agencies from 22 countries and led to seizures ranging from live animals to high-end fashion products. The operational activities targeted aircraft passengers, commercial cargo, pet shops and those legally allowed to keep reptile. Europol supported the operation and provided technical support, coordinated information exchange, seizures and inspections in the EU. Thousands of animals saved from becoming wallets Almost 1 500 live snakes, lizards and geckos were seized from right across Europe. The inspections lead also to 12 arrests, six in Italy and six in Spain. Globally, operation Blizzard resulted in the seizure of 4 419 live animals including 2 703 turtles and tortoises, 1 059 snakes, 512 lizards and geckos and 20 crocodiles and alligators. Competent authorities seized 152 handbags, wallets, watchstraps, medicines and taxidermies derived from reptiles. Gathering intelligence to catch the criminals Europol supported participating countries to exchange information and intelligence ahead of the operation. This information was used to build the profiles of offenders and their associates and track their activity.   Europol and INTERPOL worked together to enhance international efforts in tackling the illegal trade of reptiles. Partners of Europol’s project Naultinus and member countries of the INTERPOL Wildlife Crime Working Group developed the operation based on the growing need to share and collaborate on organised crime groups trading in live reptiles and reptile products. Countries which took part in operation Blizzard include Australia, Belgium, Bosnia and Herzegovina, Canada, Denmark, Estonia, France, Germany, Hungary, Israel, Italy, Latvia, Netherlands, New Zealand, Poland, Portugal, South Africa, Spain, Sweden, Switzerland, Ukraine, and the USA. Pedro Felício, head of Europol’s Economic and Property Crime Unit, said “Wildlife trafficking has increased significantly in recent years to the point where we have now thousands of reptiles, worth millions of euros, being seized every year by EU law enforcement agencies with the support of Europol. Globally coordinated police operations like operation Blizzard are now at the forefront of environmental preservation. Nevertheless, despite the various efforts made, the threat of environmental crime remains high.” Environmental crime: an EU priority In 2017, Europol opened Analysis Project (AP) EnviCrime following with the discussions of the new EMPACT priority on environmental crime. This dedicated team has been working to fight wildlife and waste crimes. Operation Lake is just one example of a recent successful operation.   In March 2018, AP EnviCrime launched project Naultinus, as a direct outcome of operation Jungla V2, which focused on wildlife trafficking in the EU and, more specifically, the illegal trade of reptiles and birds in the EU. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In March 2017 the Council of the EU decided to continue the EU Policy Cycle for organised and serious international crime for the 2018 - 2021 period. This multiannual Policy Cycle aims to tackle the most significant threats posed by organised and serious international crime to the EU in a coherent and methodological manner. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Environmental crime is one of the priorities for the Policy Cycle. 

With the support of Europol, the French National Police (OCBC - National Unit in charge of Cultural goods trafficking) and the Spanish Guardia Civil (UCO) have dismantled an organised crime group suspected of stealing maps in the archival collections of libraries throughout Europe. On 20 May, 6 properties were searched simultaneously in France and Spain and 3 suspects arrested. 3 vehicles and €6 000 in cash have also been seized. The modus operandi was well defined: one of the member of the organised crime group would enter a library pretending to be a researcher interested in consulting the archives. The individual would then distract the attention of the librarian, making the most of this opportunity to cut sheet out of XVIth century books, mainly old maps. These maps were then sold for several tens of thousands of euros on the criminal market for cultural goods. Europol provided analytical support to prepare for the action, and deployed a mobile office on-the-spot in Montpellier (France) to extract and analyse mobile phone data on the action day itself.

Law enforcement and judicial authorities from France, Poland and Ukraine, working together in a joint investigation team (JIT), took action last week against an organised crime group involved in international trafficking of a heroin substitute. Eurojust and Europol actively supported the operation that led to 9 arrests and 20 house and car searches. More than 7 200 pills of a total value of $100 000 on the Ukrainian illegal market were seized, along with cars, cash, equipment, and other valuable evidence of the criminal activities. Europol actively supported the action day by deploying a mobile office to Marseille (France), allowing for the real-time of information against the Agency’s databases. Eurojust, the EU’s Judicial Cooperation Unit, facilitated the operation in real time by coordinating the exchange of information and helping solve judicial issues. The criminal proceedings against members of the OCG, involved in international trafficking of a heroin substitute, were initiated by an investigative judge of the Specialised Section for Public Health of the Court of Paris. Some members of the OCG were targeted by parallel investigations that were carried out by the Ukrainian Prosecutor’s Office of the Ivano-Frankivsk Region, with the assistance of the Security Service of Ukraine, as well as by the Silesian Division of the National Public Prosecutor’s Office of Poland. More than 150 magistrates and law enforcement officers were deployed during the joint operation, including the French Gendarmerie Nationale, the Central Bureau of Investigation of Katowice Police Department and Special Surveillance Team in Poland, as well as the National Police, State Fiscal Service and State Border Guard Service of Ukraine.

How can we better counter the illegal trade of dangerous doping substances? Anti-doping agencies and law enforcement authorities met today in Budapest to reinforce their joint response. Europol today shared best practices with the World Anti-Doping Agency (WADA), Eurojust, national anti-doping agencies and law enforcement authorities at a workshop organised by the Hungarian National Anti-Doping Organization (HUNADO) in Budapest, the European Capital of Sport 2019.     Fair sport means fair play Regulators need to examine athletes and stop the supply of doping substances to keep sport fair. To defend the rights of clean athletes, WADA has created standardised doping control procedures for every national anti-doping organisation to implement. Checks are, however, not the only measure to be taken. It is also crucial to combat trafficking these dangerous substances and to eliminate their supply.  Several European countries implemented a separate criminal offence for trafficking of doping substances due to its severe health hazards. The use of such substances is punishable in several countries, both inside and outside the EU.  Enhancing the international response to doping  The cooperation between anti-doping organisations and law enforcement authorities was enhanced in 2015 by adopting the UNESCO international convention against doping in sport. This Convention, along with the World Anti-Doping Code, obliges anti-doping organisations and law enforcement authorities to cooperate.  Moreover, the Europol-coordinated project Viribus was launched in 2018 to fight the traffic of doping substances across the EU. Information sharing and close cooperation between law enforcement and anti-doping agencies have already resulted in a more coordinated international response to the trafficking of doping substances. 

Europol’s European Cybercrime Centre (EC3) has successfully supported efforts to identify several victims of child sexual abuse through its sixth Victim Identification Task Force (VIDTF). The efforts have led to three victims being tentatively identified: one in Europe, one in the USA and one in Russia with another investigation ongoing to identify a European victim and an offender. VIDTF 6, hosted at Europol headquarters from 13 to 24 May 2019, saw experts from around the world working to identify victims of child sexual abuse and exploitation using advanced techniques, software and their knowledge and expertise. As a result, victims of this damaging crime have been located as living in several countries in the EU and beyond. Law enforcement authorities in those countries are currently working to finalise the identification of the children and save them from further harm. The taskforce saw 34 experts in victim identification from 24 countries and 29 agencies coming together to work on shared materials at Europol’s headquarters over 12 days. They were supported by Europol staff, all specialists and intelligence analysts in this crime area. The unique combination of collaborative work, image and video analysis meant that the experts worked through millions of files to find and exploit vital clues. Added to this is Europol’s criminal intelligence analysis conducted by experts dedicated to the taskforce bringing extra information and clues to identify offenders. The uploading of groups of linked images and video files to the International Child Sexual Exploitation Database (ICSE) hosted at INTERPOL is an integral part of the VIDTF model. This allows investigators with access to the database to contribute to the effort while it is taking place and afterwards. During VIDTF 6, the participants have uploaded 466 new datasets to ICSE and made more than 280 additions to existing datasets, therefore increasing the chances for the victims to be identified and safeguarded. Another significant part of the work is using existing techniques and developing new techniques to gather information from images and video files. Experts worked extensively on this and shared the new knowledge with their colleagues. Steven Wilson, Head of the European Cybercrime Centre at Europol: “The life and dignity of every child is of the utmost importance to us all. Over the past two weeks at Europol, we have worked closely with specialist child abuse investigators from our international partners as part of VIDTF 6 to identify the location and identities of children that are being sexually abused across the world. The combined efforts of this team of investigators can make a huge difference to the lives of children through providing information to law enforcement colleagues in specific countries enabling them to start investigations and ultimately rescue the children from abuse.”  Victim identification experts participated from law enforcement agencies in Australia, Belgium, Bosnia and Herzegovina, Canada, Croatia, Denmark, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, Moldova, the Netherlands, Portugal, Romania, Serbia, Slovak Republic, Spain, Sweden, Switzerland, UK, USA and INTERPOL.

23 EU Member States[1], Iceland, Norway and Switzerland, supported by Europol, conducted an extensive operation targeting trafficking in human beings for the purpose of labour exploitation. This coordinated action, which took place between 8 and 14 April 2019, is part of the EMPACT operational action plan on trafficking in human beings for 2019. Experts from law enforcement agencies, labour inspectorates, immigration services, tax authorities, social inspections services and other competent authorities joined forces to identify and investigate the labour exploitation of vulnerable workers. The action targeted different business sectors, such as transportation, agriculture, construction, food processing, catering and care provision. Participating countries adopted a multidisciplinary approach at national level that resulted in the identification of cases of trafficking in human beings, as well as violations of the labour legislation, use of forged documents and other offenses. This extensive and targeted mobilization of resources involved the checking of more than 50.000 individuals, over 17.000 vehicles, as well as the visit of 5000 business premises and other locations. The action week resulted in the arrest of 46 suspects and the identification of 90 individuals suspected of human trafficking. A further 227 persons were detained or arrested for other offenses, including illegal immigration and forgery of documents. In total, 323 potential victims of trafficking were identified. This intense operational activity has led to the launch of 100 new investigations, aiming at the identification of other suspects and victims linked to human trafficking cases across the EU. Europol contributed to the preparation of the operational activity and facilitated competent authorities with information exchange and real time checking of the information generated in the field against the Europol’s centralised databases. Europol will continue to support Member States to further develop internationally the investigations that were triggered during the action week. [1] Austria, Belgium, Bulgaria, Cyprus, Czechia, Denmark, France, Germany, Greece, Ireland, Italy, Lithuania, Netherlands, Poland, Portugal, Croatia, Romania, Slovakia, Slovenia, Spain, Malta, Sweden, UK

Today, the Dutch Fiscal Information and Investigation Service (FIOD), in close cooperation with Europol and the authorities in Luxembourg, clamped down on one of the world’s leading cryptocurrency mixing service Bestmixer.io. Initiated back in June 2018 by the FIOD with the support of the internet security company McAfee, this investigation resulted in the seizure of six servers in the Netherlands and Luxembourg. One of the largest mixing services Bestmixer.io was one of the three largest mixing services for cryptocurrencies and offered services for mixing the cryptocurrencies bitcoins, bitcoin cash and litecoins. The service started in May 2018 and achieved a turnover of at least $200 million (approx. 27,000 bitcoins) in a year’s time and guaranteed that the customers would remain anonymous. Nature of the service A cryptocurrency tumbler or cryptocurrency mixing service is a service offered to mix potentially identifiable or 'tainted' cryptocurrency funds with others, so as to obscure the trail back to the fund's original source. The investigation so far into this case has shown that many of the mixed cryptocurrencies on Bestmixer.io had a criminal origin or destination. In these cases, the mixer was probably used to conceal and launder criminal flows of money. Follow-up The Dutch FIOD has gathered information on all the interactions on this platform in the past year. This includes IP-addresses, transaction details, bitcoin addresses and chat messages. This information will now be analysed by the FIOD in cooperation with Europol and intelligence packages will be shared with other countries.

Trafficked vehicles worth €150 000 Operation Puledro began in April 2017 when law enforcement authorities found a car stolen from Poland on Spanish roads. Investigations revealed that members of a criminal ring dismantled in 2014 were operating again, this time with a new scheme to avoid paying taxes. Criminals first bought luxury cars in Switzerland then took them to Spain, thereby evading all the checks and border controls. Once the vehicles passed their annual safety tests in Spain, the members of the network registered the cars with fake documents, pretending they bought them in Italy. After two years of investigation, police searched ten houses in Spain, arrested twenty individuals and seized eleven vehicles. It is estimated that the trafficked vehicles were worth around €150 000. Europol’s support Europol supported this operation from the beginning by cross-checking information and deploying an analyst on-the-spot with a Universal Forensic Extraction Device (UFED) which allowed real-time cross-checks of the data gathered during the course of the operation. Europol’s experts were able to extract information from nine devices, while the remaining three are being analysed at Europol’s forensic lab.

The international operation, code-named Postbox II, took place in March 2019 and involved customs experts from 22 Member States and Europol. Focusing on criminals working on both the open and the Dark Web, Postbox II led to 2320 seizures, the opening of 50 case files and identification of 30 suspects in Member States. Spearheaded by OLAF and Belgian Customs, operation Postbox II was carried out in cooperation with customs services from 22 Member States and Europol. The set-up and use of an international cyber patrol with customs services as the main actors makes the operation a first for Europe. OLAF provided participants with access to its Virtual Operation Coordination Unit, a secure communication system facilitating intelligence exchange in real time. Europol provided on the spot deployment during the days of action at OLAF’s headquarters in Brussels to assist with the crosschecking of data and forensic support. In the initial phase of the operation, customs authorities checked mail and courier service packages for prohibited items. More than 500 packages were seized in Belgium only, followed by Italy with 460 and Ireland with 304 seizures. What followed was the assembly of an expert cyber patrol which raided both the open web and the dark net, as well as social media sites, in search of the perpetrators of the crimes. Investigators used special software and techniques to pierce the sellers' online veil of anonymity. The main findings reveal that Asian e-commerce platforms are still responsible for the majority of counterfeit sales. Drug trafficking takes place mainly through the Dark Web, where technology is used to keep buyers and sellers anonymous. The success of operation Postbox II is built on the shared expertise of all participating parties. Law enforcement bodies, working together at a pan-European level, make it increasingly difficult for fraudsters and traffickers to break the law and evade justice. Background The illegal trade in endangered animal and plant species (CITES) damages the environment and threatens the biodiversity of our planet. CITES is a priority area for European customs authorities. Investments made in new technology to identify online platforms used for this type of traffic are vital to facilitating legal and sustainable trade, whilst ensuring that illicit trade can be identified and intercepted.   The trade of counterfeit products results in vast illicit profits and significant losses of tax revenues. The smuggling of counterfeit products harms the European economy, damages legitimate business and stifles innovation, putting many jobs at risk. Counterfeiting also poses serious risks to health and safety, as well as the environment.

As one of their annual flagships training events, Europol and CEPOL together with the Polish Forensic Institute (CLKP) organised between 13-24 May 2019 the advanced training course on dismantling illicit synthetic drugs laboratories at the premises of the Polish Training Academy/ITCCCL. This training was attended by 32 participants from 22 EU Member States, Iceland and Europol. Experts from Europol’s EU Drugs and Organised Crime Unit,  together with their counterparts from Belgium, Poland and the Netherlands as well as partner EU agencies such as the EMCDDA conducted the training to enhance the knowledge on the methodology and risks potentially encountered by law enforcement and forensic officers during the dismantling of illicit synthetic drugs/NPS laboratories. The objectives of the course were to recognise the production methods of illicit drugs, especially synthetic substances; to identify the production equipment/chemicals seized in the production units; implement precautions and safety measures to protect themselves during raid operations on illicit drug laboratories, including decontamination process; to plan and organise future raids as well as the collection of evidence and to understand the new trends and developments in the area of synthetic drugs. The participants also carried out a series of practical exercises in real-life conditions, including in a simulated illicit synthetic drugs laboratory environment.

An unprecedented, international law enforcement operation has dismantled a complex, globally operating and organised cybercrime network. The criminal network used GozNym malware in an attempt to steal an estimated $100 million from more than 41 000 victims, primarily businesses and their financial institutions. A criminal Indictment returned by a federal grand jury in Pittsburgh, USA charges ten members of the GozNym criminal network with conspiracy to commit the following: infecting victims’ computers with GozNym malware designed to capture victims’ online banking login credentials; using the captured login credentials to fraudulently gain unauthorised access to victims’ online bank accounts; stealing money from victims’ bank accounts and laundering those funds using U.S. and foreign beneficiary bank accounts controlled by the defendants.     Over the course of the international operation, searches were conducted in Bulgaria, Georgia, Moldova and Ukraine. Criminal prosecutions have been initiated in Georgia, Moldova, Ukraine and the United States. This operational success is a result of the international law enforcement cooperation between participating EU Member States (Bulgaria and Germany) as well as Georgia, Moldova, Ukraine and the United States (in alphabetical order). Europol, the European Agency for Law Enforcement Cooperation as well as Eurojust, the European Union's Judicial Cooperation Unit supported the case. This operation showcases how an international effort to share evidence and initiate criminal prosecutions can lead to successful operations in multiple countries. Cybercrime as a service The GozNym network exemplified the concept of “cybercrime as a service,” with different criminal services such as bulletproof hosters, money mules networks, crypters, spammers, coders, organizers, and technical support. The defendants advertised their specialised technical skills and services on underground, Russian-speaking online criminal forums.  The GozNym network was formed when these individuals were recruited from the online forums by the GozNym leader who controlled more than 41 000 victim computers infected with GozNym malware. The leader of the GozNym criminal network, along with his technical assistant, are being prosecuted in Georgia by the Prosecutor’s Office of Georgia and the Ministry of Internal Affairs of Georgia. See the infographic Highly Specialised and International Criminal Network A member of the network who encrypted GozNym malware to enable it to avoid detection by anti-virus tools and protective software on victims’ computers is being prosecuted in Moldova by the Prosecutor General of the Republic of Moldova and the General Police Inspectorate of the Republic of Moldova. Another member from Bulgaria was already arrested by the Bulgarian authorities and extradited to the United States in December 2016 to face prosecution in Pittsburgh.  His primary role in the conspiracy was that of a “casher” or “account takeover specialist” who used victims’ stolen online banking credentials captured by GozNym malware to access victims’ online bank accounts and attempt to steal victims’ money. Several members of the network provided money-laundering services and were known as “cash-outs” or “drop masters.”  These individuals, including two from Russia and one from Ukraine, provided fellow members of the conspiracy with access to bank accounts they controlled that were designated to receive stolen funds from GozNym victims’ online bank accounts. The five Russian nationals charged in the Indictment remain on the run.  In addition to the two “drop masters” referenced above, these defendants include the developer of GozNym malware who oversaw its creation, development, management and leasing to other cybercriminals.  Another Russian GozNym member conducted spamming operations on behalf of the conspiracy.  The spamming operations involved the mass distribution of GozNym malware through “phishing” emails.  The phishing emails were designed to appear legitimate to entice the victim recipients into opening them and clicking on a malicious link or attachment which facilitated the downloading of GozNym onto the victims’ computers.  Another Russian-born member of the network was a “casher” or “account takeover specialist.”  Like the Bulgarian defendant, he used victims’ stolen online banking credentials captured by GozNym malware to access victims’ online bank accounts and attempt to steal victims’ money through electronic funds transfers into bank accounts controlled by fellow conspirators.  Avalanche Network Bulletproof hosting services were provided to the GozNym criminal network by an administrator of the “Avalanche” network.  The Avalanche network provided services to more than 200 cybercriminals, and hosted more than twenty different malware campaigns, including GozNym.  The administrator’s apartment in Poltava, Ukraine, was searched in November 2016 during a German-led operation to dismantle the network’s servers and other infrastructure.  Through the coordinated efforts being announced today, this alleged cybercriminal is now facing prosecution in Ukraine for his role in providing bulletproof hosting services to the GozNym criminal network.  The prosecution will be conducted by the Prosecutor General’s Office of Ukraine and the National Police of Ukraine. The whole operation was conducted by the United States Attorney’s Office for the Western District of Pennsylvania, the FBI’s Pittsburgh Field Office, the Public Prosecutor’s Office Verden (Germany), the Prosecutor’s Office of Georgia, Prosecutor General’s Office of Ukraine, Office of the Prosecutor General of the Republic of Moldova, Office of the General Prosecutor of Bulgaria, the Luneburg Police of Germany, Ministry of Internal Affairs of Georgia, National Police of Ukraine, General Police Inspectorate of the Republic of Moldova, and Bulgaria’s General Directorate for Combatting Organized Crime.  Europol and Eurojust played critical roles in supporting this coordinated law enforcement operation. The U.S. Department of Justice’s Office of International Affairs also provided significant assistance.

Pickpocketing has established itself as an ubiquitous phenomenon, driving crime numbers and affecting the perceived security of citizens all over Europe. Although sometimes still considered petty crime, a huge share of the offences are committed by highly professional groups, who use their mobility across borders to challenge established law enforcement practices and often gain millions of illegal profit. While the group leaders use this money to finance a luxury lifestyle, many of the acting pickpockets, among them also minors, are exploited “foot soldiers” and not seldom victims of trafficking of human beings. It has, more than ever, become necessary for law enforcement to coordinate and cooperate on an international level, focussing on the structures of the groups, including instigators and facilitators as well as carrying out financial investigations with the aim to identify beneficiaries and recover assets. As a follow-up to previous conferences, Europol once again hosted and supported the European Pickpocketing Conference, organised and conducted by Germany's Munich Police Headquarters, from 6 to 8th of May at Europol's headquarters in The Hague. More than 170 experts from police, prosecution offices and universities, representing Europol as well as the following 23 European countries participated in the event: Albania, Austria, Belgium, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Luxembourg, the Netherlands, Norway, Portugal, Romania, Spain, Sweden, Switzerland and the United Kingdom. Chile also sent two delegates to support the European countries in tackling this phenomenon. More and more offenders are travelling to Europe from outside the continent to commit property crime, which is why the Chilean presence was of great value for the European pickpocketing investigators. In an effort to combat organised pickpocketing crime, participants shared experience gained from investigations conducted against mobile organised crime groups in their respective countries. Several operations against specific groups of pickpockets were presented, displaying not only the need for, but also the success of tight collaboration between the European states affected. The participants also exchanged knowledge in several workshops on different pickpocketing-related issues. Among the topics were best practice tactics, prevention and technological innovations, but also more abstract subjects focussing on psychological aspects, such as new approaches to behavioural science. Along with the presentations and discussions, some officers took part in a hands-on workshop that was carried out in the streets Amsterdam. The aim of the conference was to facilitate and encourage an even stronger international cooperation. All participants agreed to further strengthen existing networks for exchanging information and to support each other in investigations, operations and regarding strategic approaches.

The two suspected administrators of a website known as DeepDotWeb have been arrested on 6 May 2019 in Paris, France and Israel. Authorities in the US have charged the two individuals after an internationally coordinated operation today, supported by Europol. At the same time, the DeepDotWeb website was seized by law enforcement and judicial authorities. The two suspects, both Israeli citizens, have been charged by a US federal jury with money laundering conspiracy, relating to millions of dollars in kickbacks they received for purchases of fentanyl, heroin and other illegal goods, by individuals referred to dark web marketplaces by DeepDotWeb. The two suspects had allegedly owned and operated DeepDotWeb since 2013. The website provided users with direct access to numerous online dark web marketplaces, where vendors sold illegal drugs, firearms, malicious software and hacking tools, stolen financial information and payment cards and other illegal counterfeit goods. It is estimated that the website referred hundreds of thousands of users to dark web marketplaces. The two men are suspected of receiving kickback payments, representing a portion of the proceeds from each purchase of illegal goods made on a dark web marketplace linked to the DeepDotWeb site. The payments were made in virtual currency and paid into a bitcoin wallet controlled by DeepDotWeb. To conceal the illegal proceeds, they transferred the money to other bitcoin accounts and to bank accounts they controlled in the name of shell companies. In total, more than 8 150 bitcoins in kickback payments were received. Due to bitcoin’s fluctuating exchange rate, the value of the DeepDotWeb bitcoin wallet amounted to approximately €7,5 million, when adjusted for the trading value of bitcoin at the time of each transaction. This case was led by the US Department of Justice and was brought in conjunction with the Joint Criminal Opioid Darknet Enforcement (J-CODE) Team within the FBI’s Hi-Tech Organized Crime Unit. Europol’s European Cybercrime Centre (Dark Web Team) provided operational support to the investigation, as did law enforcement in France, Germany (German Federal Criminal Police Office, Polizeidirektion Zwickau and Saxon Police), the Netherlands (Dutch National Police), the United Kingdom (National Crime Agency), Brazil (Federal Police Cyber Division) and Israel (Israeli National Police). Only a few days after the announcement of the takedown of two prolific dark web markets (Wall Street Market and Valhalla), this is yet another law enforcement success in the fight against the sale of illegal goods on the dark web.

Europol has supported Spain in dismantling a criminal organisation providing large-scale crypto money laundering services to other criminal organisations. The criminals carried out several money laundering schemes involving the transfer from fiat currency to virtual assets to hide the illegal origin of the proceeds. Some of the identified modi operandi used crypto ATMs and smurfing, a criminal method used to split illicit proceeds into smaller sums and placing these small amounts into the financial system to avoid suspicious transaction reporting. The Spanish Civil Guard (Guardia Civil) arrested eight people and charged eight more for involvement in the crypto money laundering ring. Seven houses were searched, including a money exchange office and an indoor cannabis cultivation plant. Eleven vehicles, €16 800, close to 200 cannabis plants, two crypto ATMs, computers, devices, jewels and relevant documents were seized. Spanish authorities froze four ‘cold wallets’ and 20 ‘hot wallets’, to which €9 million was transferred, as well as several bank accounts. Some of the identified modi operandi were: The organisation managed a cryptocurrency exchange business, including two crypto ATMs to deposit criminal cash and transform it into cryptocurrency for other criminal groups; Cash pick-ups carried out by cash-carriers followed by smurfing techniques to deposit the criminal cash in several bank accounts controlled by the organisation. The funds were moved through several accounts in the process of layering. Afterwards, the money was exchanged into cryptocurrency; Large transfers to bank accounts controlled by the organisation coming from corporate entities owned by gangs using their criminal money laundering services. Immediate overseas transfers were then wired to crypto exchange platforms.   The operation was a follow-up of operation Guatuzo also supported by Europol in which 23 people were arrested in summer 2018 in Spain and Colombia. Europol supported the investigation by facilitating the exchange of information. On the action day, Europol experts were deployed to Spain to allow for real-time exchange of information and cross-checks of the data gathered in the course of the action against Europol’s databases. In the European Union Serious and Organised Crime Threat Assessment (SOCTA) 2017, Europol stated that an increasing number of individual criminal entrepreneurs offer Crime as a Service (CaaS). The online trade in services enables individual criminals to operate their own criminal business without the need for the infrastructures maintained by ‘traditional’ organised crime groups.   In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Criminal finances and money laundering is one of the priorities for the Policy Cycle.

Since 2016, the Criminological Research Institute of Lower Saxony (KFN) has been conducting research to highlight the importance of the link between domestic burglaries and organised crime. As one of the partners of the project, Europol cooperated with the KFN by providing interviews, expertise and carrying out comprehensive analyses of cases in this particular crime area. On 25 April, the results of the study were presented at a conference in Hannover, Germany. The study, which is partly funded by the EU Internal Security Fund, shows that groups of perpetrators are composed in different ways: loose networks; flat-structured Mobile Organised Crime Groups (MOCGs); MOCGs with a strict hierarchy; family clans; mafia-type structures, with particular reference to Georgian groups (albeit, more rarely). The study clearly highlights that the perpetrators of organised burglaries come from the organised crime area and are active all over the world. Despite a decrease in the number of cases in the area of domestic burglary in Germany, cross-border organised property crime continues to be present in Europe and, therefore, international police cooperation needs to be further promoted and embedded to tackle the groups behind these crimes. At the conference, Europol’s Deputy Executive Director, Oldřich Martinů, reported on Europol’s efforts and achievements in this field of crime. In his statement during the event, Mr Martinů emphasised the efforts being made at EU-level to continue providing EU Member States with the best possible support in combating this international crime. The study is available in both English and German.

Two prolific dark web marketplaces have been taken down in simultaneous global operations, supported by Europol: the Wall Street Market and the Silkkitie (known as the Valhalla Marketplace) Those responsible for the world’s second largest illegal online market in the dark web, Wall Street Market, were also arrested in Germany, and two of the highest-selling suppliers of narcotics were arrested in US. Finnish authorities shut down Silkkitie earlier this year. When the same traders moved their activities to another illegal trade site on Tor, German authorities brought their illegal activities to an end The German Federal Criminal Police (Bundeskriminalamt) shut down the Wall Street Market, under the authority of the German Public Prosecutor’s office. They were supported by the Dutch National Police (Politie), Europol, Eurojust and various US government agencies (Drug Enforcement Administration, Federal Bureau of Investigation, Internal Revenue Service, Homeland Security Investigations, US Postal Inspection Service, and the US Department of Justice). The Silkkitie (known as the Valhalla Marketplace) and its contents was also seized by Finnish Customs (Tulli) in close cooperation with the French National Police (La Police Nationale Française) and Europol. Europol was assisted by Bitdefender, an internet security company advising Europol's European Cybercrime Centre (EC3).  Europol supported coordinated law enforcement approach across Europe and the US was key to the success of these two investigations. Europol’s Executive Director, Catherine De Bolle, commented: “These two investigations show the importance of law enforcement cooperation at an international level and demonstrate that illegal activity on the dark web is not as anonymous as criminals may think.” Over 1 150 000 users and 5 400 vendors on the Wall Street Market The online marketplace Wall Street market was the world's second largest dark web market, enabling the trade in drugs (including cocaine, heroin, cannabis and amphetamines), stolen data, fake documents and malicious software. The illegal platform was exclusively accessible via the Tor network in the so-called Darknet and aimed at international trade in criminal goods. Most recently, more than 63 000 sales offers were placed on the online marketplace and more than 1 150 000 customer accounts and more than 5 400 sellers registered. For payment, the users of the online marketplace used the crypto currencies Bitcoin and Monero. The alleged marketplace officials are said to have received commission payments of 2 to 6 percent of the sales value for the settlement of illegal sales of the platform. This operation lead by the German authorities has seen the arrest of three suspects and as part of the house searches carried out, the police officers seized over €550 000 in cash, alongside cryptocurrencies Bitcoin and Monero in 6-digit amounts, several vehicles and other evidences, such as computers and data storage. In the US, during the investigation by the Attorney General in Los Angeles, two of the highest-selling suppliers of narcotics were arrested.  Finnish Customs seized entire web server and contents of Valhalla The Silkkitie has been operating on the The Onion Router (Tor) network since 2013. Based on the findings of the investigation, Finnish Customs also made a significant Bitcoin seizure.  For several years, narcotics and other illicit goods have been sold via this marketplace. Silkkitie is one of the oldest and internationally best-known Tor trade sites. After the Silkkitie (Valhalla) site was shut down by the authorities, some of the Finnish narcotics traders moved their activities to other illegal trade sites in the Tor network, such as Wall Street Market.  Dedicated Dark Web Team in Europol’s EC3 One of Europol’s initiatives is to create a coordinated law enforcement approach to tackle crime on the dark web with the participation of law enforcement agencies from across EU Member States, operational third parties and other relevant partners, such as Eurojust.   To achieve this goal, Europol has established a dedicated Dark Web Team to work together with EU partners and law enforcement across the globe to reduce the size of this underground illegal economy. It will deliver a complete, coordinated approach:  sharing information; providing operational support and expertise in different crime areas; developing tools, tactics and techniques to conduct dark web investigations; identifying threats and targets.  The team also aims to enhance joint technical and investigative actions, organise training and capacity-building initiatives, together with prevention and awareness-raising campaigns – a 360° strategy against criminality on the dark web. A shared commitment across the law enforcement community worldwide and a coordinated approach by law enforcement agencies has once again proved their effectiveness. The scale of the operation at Europol demonstrates the global commitment to tackling the use of the dark web as a means to commit crime. 

On 17 April 2019, some 400 police officers from the Romanian Directorate for Investigation of Organised Crime and Terrorism (DIICOT) and the Dutch National Police, with the support of Europol and Eurojust, swooped on suspects in both these countries believed to be part of an organised crime group involved in fake carrier fraud. The targeted criminals are believed to have caused damages estimated at €2 million for the period 2017-2019. 12 house searches took place in the Netherlands, and 46 in Romania, resulting in the arrest of 6 individuals. The sting follows a complex investigation initiated in March 2018 looking into the activities of this criminal network, composed mainly of Romanian nationals. The members of the OCG ‘spoofed’ real e-mail addresses of cargo companies, pretending to be the companies’ representatives. They then received offers for cargo services from various victims, signed the counterfeit contracts, and scheduled the date and place of the cargo delivery. Once they received the cargo, the members of the OCG appropriated the prepayment for the cargo service and the cargo itself, using forged documents and vehicles with fake licence plates. The stolen cargo, which was later resold within the European Union at a lower price, contained a variety of goods, ranging from solar panels to aluminium bars and clothing. Europol supported the investigation for the past year by facilitating the exchange of information. On the action day, Europol experts were deployed to Romania to allow for real-time exchange of information and cross-checks of the data gathered in the course of the action against Europol’s databases.

Beyond the crime: your health and safety at stake. As has been the case for years, Europol is taking part in World Intellectual Property Day. The fight against intellectual property crime is of high importance to our agency as it not only impacts businesses and economy, but also the health and safety of many European consumers. In 2018 Europol’s IPC3 (Intellectual Property Crime Coordinated Coalition), supported and coordinated more than 45 operations related to the trade of fake pharmaceuticals, food and beverages, pesticides, luxury goods, car spare parts, IPTV, music and movie piracy. Europol also provided Member States with on–the-spot operational and forensic support more than 20 times during their operations and organised upwards of 30 operational meetings. On 4 April 2019, Europol’s Intellectual Property Crime Coordinated Coalition (IPC3) was presented with the Intellectual Property Excellence Award in Enforcement from the International Federation of the Phonographic Industry (IFPI). The award is in recognition for the outstanding contribution to the recording industry worldwide related to the unit's activity in anti-piracy enforcement. With funding from the European Union Intellectual Property Office (EU IPO), Europol’s IPC3 could intensify its fight against intellectual property crime. By buying counterfeited products, consumers support huge financial benefits to criminal organisations.  They may not even realise the serious problems to health and safety when using counterfeit products like pharmaceuticals, cosmetics, electrical devices or even car spare parts. Spare car parts Worldwide, the trade value of fake spare parts was up to $10 billion and spare car parts are also frequently traded in the European Union. Very often fake spare car parts are offered on websites at knock-down prices — so order your spare parts on official websites or through registered dealers. If not, fake spare car parts can pose serious safety risks both to you and other road users.  

After almost 18 months of investigation, Europol supported the State Criminal Police Office Vienna (Landeskriminalamt Wien, LKA) in bringing down a Serbian organised criminal group involved in a series of residential burglaries and other illegal activities across Europe. In total, 12 members of the Serbian mobilised organised criminal group (MOCG) were identified during LKA’s investigation. The criminal group carried out more than 31 residential burglaries and were detected by police services in Austria, Belgium, France, Germany and Switzerland. The group was well-organised, operated across Europe and regularly swapped its members. The MOCG often used minors to carry out their criminal activities. Two female members of the Serbian MOCG were arrested while attempting to commit another theft in Austria. The two women initially claimed they were underage and gave false identities to the authorities, which is why they were released shortly after by the Austrian authorities. Later on, police determined their true identities and European Arrest Warrants were issued for their arrest by the Vienna Public Prosecutor’s Office. The women were found to be 16 and 18 years old and were apprehended in Germany in May 2018 when committing another burglary. In October 2018 they were delivered from the German judicial authorities to Austria. In the meantime, two more members of the Serbian MOCG were arrested in Belgium when committing similar cases as they had done in Austria. A driver involved with the gang was identified in October 2017 by the Austrian authorities and a European Arrest Warrant was issued for his arrest.   Europol’s role During 2018 Europol organised, chaired and funded two operational meetings in Vienna between representatives from Austria, Germany and Switzerland. The first meeting established that the criminal group had been carrying out similar illegal activities across various Member States. The second meeting brought together Belgium, France, Germany, Serbia and Switzerland with the Austrian Criminal intelligence Service (Bundeskriminalamt, BK.), to share information and strengthen cooperation in the fight against property crime. This resulted in the creation of an analysis report, which led to a conviction on organised crime instead of the usual gang crime penalty. This is a milestone in domestic burglary as this type of conviction on the matter is rare. Europol supported the investigation from the beginning by providing operational and analytical support, this helped to identify links from the offences made in several EU Member States, such as Austria, Belgium, France, Germany and Switzerland.  Europol Analysis Project (AP) FURTUM, is responsible for all areas of property crime such as major burglaries, armed robberies (banks, jewellery, money transporters and depots), motor vehicle crimes, cargo crime, metal theft, organised pickpocketing.   In 2010 the EU set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In March 2017 the Council of the EU decided to continue the EU Policy Cycle for organised and serious international crime for the 2018 - 2021 period. This multiannual Policy Cycle aims to tackle the most significant threats posed by organised and serious international crime to the EU in a coherent and methodological manner. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Organised property crime is one of the priorities for the EU Policy Cycle.

On 16 and 17 April, Europol and the Italian Anti-Mafia Investigation Directorate (Direzione Investigativa Antimafia) are hosting the first operational high-level conference Countering Strategies Against Transnational Organised Crime as part of the @ON Operational Network to counter mafia-style serious and organised crime groups in the European Union. Conference participants are high-ranking police officers from EU Member States and non-EU countries. Europol’s Deputy Executive Director, Wil van Gemert, is opening the conference and the Director General of the Italian Anti-Mafia Investigation Directorate, Giuseppe Governale, and Jari Liukku, Head of Europol’s European Serious and Organised Crime Centre, are chairing the conference. The highest risk for EU internal security Currently, organised crime constitutes the highest risk for EU internal security. This is the result of long-term development. Over recent years, organised crime has not stopped evolving. At the same time, results of asset tracing and confiscation are still at an extremely low level. Europol’s report ‘Does crime still pay?’ concluded that from 2012 to 2014 just 2.2% of the estimated proceeds of crime were seized or frozen and only 1.1% ultimately confiscated across the EU. Organised crime groups take advantage of this gap in law enforcement resources and continuously look for opportunities to expand their illicit operations. To increase operational impact by dismantling increasingly poly-criminal organised crime groups, Europol is developing an agile operational support model, building on its existing experience to allow the identification of poly-criminals, High Value Targets (HVT), new criminal trends and crime hubs.　 Organised crime groups in the 21st century are highly diverse, flexible and fast Organised crime affecting the EU is highly diverse. It ranges from large ‘traditional’ groups to smaller ones and loose networks supported by individual criminals, who are hired and collaborate spontaneously. Many organised crime groups are highly flexible and display great adaptability in the speed with which they adjust their modi operandi or whole business models to changes in the environment. Their criminal activities are increasingly complex and require a variety of skills and technical expertise. Top-level organised crime groups also use corruption to infiltrate public and private sector organisations, relying on bribery, conflicts of interest, trading in influence and collusion to facilitate their criminal activities. The objective of the conference is to achieve advanced international operational police cooperation by exchanging information, monitoring high-level criminals and addressing international investigations.　 The @ON Operational Network The @ON Operational Network strengthens international police cooperation on mafia-style criminal groups, making it possible for Member States to request, in coordination with Europol, the deployment of specialised investigators. The Italian Anti-Mafia Investigation Directorate prepared the project and were supported by Europol and authorities from Belgium, France, Germany, the Netherlands and Spain. The main criminal groups to be addressed are mafia-style Italian organised crime groups, Eurasian and Albanian criminal networks and Outlaw Motorcycle Gangs. Within the @ON Operational Network, the ONNET project, financed by the European Commission for 24 months, aims to provide operational support with specialised investigative units in Member States and relevant third parties accredited by Europol. Investigators from the project who are specialised in this criminal phenomenon can be deployed to the Member States involved. The project was officially launched on 1 November 2018 at Europol’s headquarters in The Hague, the Netherlands. General Governale leads the project together with the international partners of ONNET and Europol representatives.

The suspected criminal gang is accused of murder, trafficking in human beings for sexual exploitation, money laundering and for being members of an organised crime group. The network, active in northern Europe since 2009, ran its human trafficking operation in Denmark and Poland. The criminal group had evaded Polish law enforcement authorities – the Polish Central Bureau of Investigation and prosecutors from Gdansk – and shifted their criminal activities to large-scale marijuana cultivation upon moving to Spain to fund their illegal activities back in the two other Member States. Criminals tattooed their victims Over the course of several years, the criminal gang was one of the main targets for Polish authorities, who considered them a highly specialised and violent group: usually armed with knives, machetes and baseball bats. The network forced their trafficking victims into prostitution in Denmark and Poland and tattooed them to identify their ‘owner’. Five arrests in Spain and two arrests in Poland Based on the information gathered after a two-year investigation by the Polish authorities, Europol was called this year to support this transnational and demanding operation by coordinating information exchange and establishing direct contacts between the investigators in Denmark, the Netherlands, Poland and Spain. This international cooperation was essential to dismantle this poly-criminal organised network operating in different countries. On the action day, which happened simultaneously in Poland and Spain, Europol deployed one of its experts to assist the Spanish National Police (Policía Nacional) on-the-spot with checks of the evidence found in searches with the information stored in Europol’s centralised databases. In two house searches carried out in Spain, law enforcement officers seized over 2 500 marijuana plants, 220 kg of hashish, a cannabis plantation and several electronic devices. As a result, five suspects were detained in Spain and two in Poland.     Watch the Video 

The Spanish National Police (Policía Nacional) with the support of Europol experts in weapons and explosives arrested one individual in Seville on suspicion of being a member of a firearms-trafficking network with several links to North America. The second phase of operation Alpes is the follow-up phase of an original investigation that saw the involvement of the the Federal Agency for State Protection and Counter Terrorism of Austria and the ringleader of the criminal network detained. The investigations after the first phase revealed that the criminal group had different facilitators in the United States in illegally supplying the ring with parts of weapons to assemble and produce new ones. The Spanish National Police understand that the detained suspect is one of the network’s main perpetrators and is accused of illicit firearms trafficking and for being a member of an organised crime group. Europol’s support Europol experts played a key role during this phase of the operation by exchanging information and cross-checking data. A mobile office was also deployed to Spain for on-the-spot support on the day of the operation. Operation Alpes was launched as part of the operational action plan EMPACT illicit firearms trafficking, which strives to respond to the threat originating from firearms trafficking, as reflected in the EU Policy Cycle 2018-2021.   Watch the video In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In March 2017 the Council of the EU decided to continue the EU Policy Cycle for organised and serious international crime for the 2018 - 2021 period. This multiannual Policy Cycle aims to tackle the most significant threats posed by organised and serious international crime to the EU in a coherent and methodological manner. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Illicit firearms trafficking is one of the priorities for the Policy Cycle. It aims to disrupt OCGs involved in the illicit trafficking, distribution and use of firearms.

Today the J-CAT (Joint Cybercrime Action Taskforce) welcomed Poland as its newest member to strengthen the fight against cybercrime. In October 2018, Sweden was also accepted as a part of the Taskforce. Both members have officially deployed their cyber Liaison Officers to Europol to enhance further cooperation against cyber threats. The Taskforce is hosted within Europol’s European Cybercrime Centre (EC3) and comprises cyber liaison officers from 15 EU Member States and non-EU partners and 17 law enforcement agencies. The Taskforce is continuously growing and other countries have also expressed interest in the J-CAT Law Enforcement Attachment Scheme, a new initiative set up by J-CAT and EC3. The Scheme allows non-J-CAT countries with operational agreements with Europol to join the Taskforce temporarily to benefit from the J-CAT and EC3 platforms and if the case is of mutual interest. Key successes of 2018 Handling over 40 high profile cyber cases and holding numerous operational coordination meetings, the main objective of the J-CAT is to continue to enhance collaboration between law enforcement authorities and drive intelligence-led, coordinated actions to tackle major cybercrime threats and facilitate cross-border investigations by its partners. Notable successes include taking down the Luminosity-Link Remote Access Trojan, the webstresser platform and dismantling an organised crime group involved in banking fraud. Cybercrime knows no borders and remains a significant threat, which is why this type of stronger cooperation is necessary. Patrick Corder, Head of the Swedish Cybercrime Centre, said, "To answer the rapidly growing numbers of cybercrimes, Sweden is now joining the J-CAT. We look forward to contributing to the task force and being part of the important work to counter high-tech crime, online sexual exploitation of children and payment fraud. The combined effort of the countries involved, the constant support of EC3 and their allies in the private sector are all key components in a successful answer to the challenges posed by this complex, borderless criminality. Sweden is proud to be part of the J-CAT!" Mr Mariusz Lenczewski, Head of the Cybercrime Bureau of the Polish National Police Headquarters, stated: "Fighting against cybercrime every day becomes more and more difficult. Criminals resign of commonplace forms of offences and are using sophisticated methods more frequently to commit crimes in cyberspace. Only close international cooperation will allow law enforcement agencies to succeed in this difficult fight. We are happy that we could become a member of the J-CAT hosted by EC3 and undertake new challenges alongside specialised experts from around the world." Other J-CAT activities J-CAT-EC3 Roadshows: as part of the J-CAT strategy for 2018-2019, the J-CAT and EC3 have launched a pilot project to raise awareness and increase operational collaboration with regional and local cyber police units from the current J-CAT member countries. This is done through dedicated roadshows. Overall, two roadshows were held in December 2018 for Dutch cyber police and interested cyber prosecutors. In February 2019, a roadshow was held for the Swiss cyber police and cyber prosecutors, and in March 2019 the Norwegian cyber police benefited from the J-CAT roadshow. These events have already led to increased operational contributions to the EC3 and the J-CAT. The next roadshows will be in Germany and the UK. CEPOL webinars on the J-CAT: four webinars on J-CAT are planned for 2019 to raise awareness among law enforcement agencies about the Taskforce and how to cooperate with it. The first one was held in March in English, where close to 300 participants attended. The following three will be in German, French and Spanish over the coming months.

More than 250 experts from the public and private sector and academia will focus on topics linked to terrorism and its manifestations in Europe on 9 and 10 April 2019 at the third annual conference of the European Counter Terrorism Centre Advisory Network on terrorism and propaganda. In recent years, events outside Europe have had a significant impact on domestic extremist communities triggering an unprecedented number to travel to conflict zones and engage in violence abroad and at home upon their return. Mental health, social pressure or personal barriers: what does (or does not) make a person an extremist and what drives the radicalised individual to make the jump and become involved in violent extremism? The factors leading individuals to implicate themselves in terrorist organisations have become a major topic. Research can help us to better understand and ultimately counter and prevent homemade terrorism. The conference focuses on three main questions. How do geopolitics influence the development of terrorism? Changes outside Europe, be they on the political, military or ideological level, directly influence the security situation in Europe. But Europe also has its own history of terrorism and radicalisation to violence. What drives the extremist to become a terrorist? Often the borders between extremism and terrorism are difficult to define. Extremist communities, online and offline, evolve at the same time creating and being shaped by particular narratives and offering different roles for their members. However, if only a small proportion of European extremists turn to terrorism, what exactly triggers the transition from extremism to terrorism? In addition, the line between lone actor terrorist attacks and violent incidents by mentally ill individuals is increasingly blurred. How to tackle terrorist content online? With the increase of removals of terrorist content from the internet, online terrorist communities seek out new, less patrolled platforms. This challenges the monitoring and drives the constant adjustment of the monitoring strategies. Public-private partnerships are crucial to combating online terrorist content and develop advanced technology for detecting and removing of terrorist content. The respect of privacy in all this is extremely important to maintain the public’s trust and avoid creating new grievances. Sharing knowledge and capabilities is essential to effectively combating terrorism. To counter the constant evolution of the terrorist threat, Europol has initiated a close collaboration between law enforcement experts, the private sector and academia through the creation of the European Counter Terrorism Centre Advisory Network on terrorism and propaganda in 2016. This close collaboration contributes to better knowing and responding to rapidly shifting threats to public security. The work of the network has already resulted in the publishing of eight research papers presented during the first two conferences of the network.

On Thursday 4 April, the Fiscal Action Unit of the Portuguese Republican National Guard (Guarda Nacional Republicana, GNR) carried out a successful operation against an illegal sports betting network based in Portugal. The GNR seized assets of more than €1 million on the action day, which was coined operation Showdown. Operation Showdown in numbers 41 houses searched in Braga, Porto and Vianna do Castelo 9 suspects arrested 50 motor vehicles confiscated with an estimated value of over €1 million More than 80 computers and devices and 7 gambling machines seized The crime group was taken down for illicit online gambling, forming a criminal association and tax fraud. Europol supported the operation by providing analytical support, organising and funding operational meetings between the involved countries and by deploying one of its mobile offices to the city of Porto during the operation. Given the transnational dimension of the investigation, the operation not only involved Europol but also Eurojust to coordinate international judicial cooperation.

Today, Europol’s European Cybercrime Centre (EC3) signed a Memorandum of Understanding (MoU) with the European Merchant Risk Council (MRC Europe), an independent and not-for-profit business association engaged in fighting e-commerce fraud in Europe. The MoU was signed by Una Dillon, Managing Director of MRC Europe and the Head of EC3, Steven Wilson, at the Europol headquarters in The Hague. MRC Europe is a close partner of EC3 in taking action against e-commerce fraud in the European market landscape. As such, MRC Europe is a key stakeholder in the recurrent Europol e-Commerce Action, an international EMPACT operation targeting fraudsters and serious organised crime groups with the help of national competent authorities, as well as MRC’s network of 535 e-merchants. “An excellent platform to facilitate cooperation with hundreds of private sector partners in Europe” On signing the agreement, Steven Wilson commented “Partners like the Merchant Risk Council provide an excellent platform to facilitate cooperation with hundreds of private sector partners in Europe in the fight against serious organised crime groups. Combined with EC3’s network of law enforcement partners this MOU with the MRC is an important step forward to protecting the citizens of Europe.” Una Dillon said "The signing of this Memorandum of Understanding today further strengthens this relationship.　Over the past ten years, e-commerce fraud has become increasingly sophisticated and our working relationship with Europol is of great strategic importance to both the public and private sector in helping to reduce and prevent this crime."

With the support of Europol, 64 members of an Albanian-speaking organised crime network were arrested between 3-5 April during a simultaneous operation carried out in Belgium, France, the Netherlands and Italy and which saw the involvement of some 600 law enforcement officers. The suspects are believed to have been illegally producing and trafficking drugs, with links to trafficking in human beings, prostitution and money laundering. This sting follows a complex investigation looking into the activities of this organised crime group operating in Belgium, France, the Netherlands, Italy and the UK. The suspects are believed to have been managing at least a dozen cannabis plantations distributed across Belgium and in the north of France. Some of the same suspects were also involved in a case of trafficking of human beings in France. 55 individuals were arrested in Belgium, including the leaders of the OGG, 7 in the Netherlands and a further 2 in France in this investigation led by the Belgian Police Fédérale (Federal Police) in cooperation with the French Gendarmerie Nationale (National Gendarmerie), the Dutch Politie (National Police), the Italian Direzione Investigativa Antimafia (Anti-Mafia Investigation Directorate) and the British Metropolitan Police.  Europol supported the investigation from the outset by facilitating the exchange of information. On the action day, six Europol experts were deployed on-the-spot in Belgium, France and the Netherlands to allow for the real-time exchange of information, cross-checks of the data gathered in the course of the action against Europol’s databases, as well as providing technical support when dismantling the drugs production sites as well as forensic support, extracting 14 mobile devices seized. To this day, this operation has resulted in 39 premises searches, the dismantlement  of 15 indoor cannabis plantations and seizure of: 8255 cannabis plants; Around € 100.000 in cash and gold; 4 luxury vehicles; 63 electronic devices. This investigation is part of the Italian Direzione Investigativa Antimafia Project ONNET, an EU-financed initiative to tackle mafia-type organised crime groups active in Europe. The project was launched last November at Europol’s headquarters and comprises 6 Member States (Italy, Belgium, France, Germany, the Netherlands and Spain) and Europol. Project ONNET targets the mafia-style criminal groups in their entirety, rather than one or more of their specific criminal activities.  Albanian organised crime continues to remain a concern for countries across Europe, a threat which Europol takes very seriously. Back in March, experts on Albanian speaking organised crime convened at Europol’s headquarters in The Hague to discuss ways to better tackle these poly-criminal violent mafia-type clans. Further operations of this type are expected to take place in the near future as law enforcement ramps its response to this criminality.

The Spanish National Police (Policía Nacional) have dismantled the most active counterfeit euro print shop in Spain with the support of Europol. The specialised crime ring, based in Tenerife, manufactured fake banknotes in 10 and 20 euro denominations, earning the gang around €7 500 every month. Four arrests and €15 500 in counterfeit banknotes seized Operation Malla began in July 2018 when investigators from the Brigade of Investigation of the Bank of Spain noted a significant increase in fake €10 banknotes in the Tenerife, Spain. The criminals circulated the money as legal currency exploiting all kinds of businesses in the Canary Islands, as the owners did not notice it was fake. The investigators noticed that the euro counterfeit banknotes produced by the criminal network was not only circulated in Spain, but also across Europe. On the day of the operation police arrested the four individuals responsible for producing the fake banknotes and carried out one house search in Tenerife, where a print shop producing fake €10 and €20 banknotes and ID cards was dismantled. A variety of printing equipment such as inkjet printers, computers, and the inks and paper needed to create the counterfeit banknotes was seized.In total, €15 500 in counterfeit banknotes (in 10 and 20 denominations) were confiscated: €9 000 during the search in Tenerife and €6 500 in circulation. Europol: the European Union's Central Office for Combating Euro Counterfeiting Europol supported this operation by providing financial, technical and analytical support from the beginning and deploying a mobile office on the action day for on-the-spot support. As the European Union's Central Office for Combating Euro Counterfeiting, Europol facilitates the exchange of information and provides expertise, criminal and forensic analysis, training, financial and technical support to law enforcement agencies inside and outside the European Union.   Watch the video

The Italian Postal and Communications Police (Polizia Postale e delle Comunicazioni) with the support of Europol’s European Cybercrime Centre (EC3) hosted the first Victim Identification Taskforce (VIDTF) workshop at the Criminal Police Central Directorate in Italy. The aim of the workshop was to enhance cooperation at national and international level when identifying child sexual abuse victims and perpetrators. It was the first time that an EU Member State organised a national VIDTF workshop with the support of Europol. Postal and Communications Police brought together 25 specialists in Rome from both regional departments and the Central Service of Postal and Communications Police. For 11 sets of images analysed during this workshop depicting 6 victims, the specialists were able to determine the likely countries of production. These countries were informed and started investigations to identify perpetrators and safeguard the victims. The specialists used a specific collaborative approach, analysing together over 224 000 images and videos targeted for this event, along with criminal intelligence, to find and exploit vital clues. More than 100 specific sets of analysed data have been uploaded to the International Child Sexual Exploitation Database (ICSE) hosted at Interpol. This allows investigators with access to ICSE to contribute to further investigative efforts. Identifying victims of child sexual exploitation and abuse is a priority for police services across the world. Child victims are re-victimised when their abusers record the crimes, and even further when these recordings are disseminated online across the globe. Law Enforcement’s efforts are challenged by the huge and increasing amount of child abuse material circulated online and by the technical resources available to hide the criminal traces and identities of both victims and perpetrators. Moreover, the number of children being sexually exploited is rising, as the offenders often organised in criminal networks are increasingly disseminating online child sexual abuse material depicting new victims. By gathering and coordinating a group of national specialists in victim identification, the rollout of the national VIDTF in Italy aims to develop tactics and investigative techniques that can be implemented across the country, so that children victims of this heinous crime will have a better chance of being identified and safeguarded.

From 26 March to 27 March, Europol hosted a joint meeting of the EC3 Advisory Groups on Financial Services, Internet Security and Communication Providers, gathering 70 industry representatives to discuss the cyber-threat of phishing. Over the course of two days, global financial institutions, internet security companies and telecommunications providers shared insights into how phishing affects their respective industries and what can be done together with law enforcement to combat this type of cybercrime. The Joint Advisory Group meeting featured keynotes on phishing and machine learning and on business email compromise (BEC), as well as group discussions on potential solutions to this problem. Focusing on technical, operational and awareness-related solutions to mitigate phishing, law enforcement and industry experts came up with a number of recommendations and conclusions on what can be done collectively: Improve information-sharing across industries, as well as with law enforcement and other relevant public sector organisations; Implement the basics: secure authentication, domain blacklisting and blocking of common exploits; Train and educate users on a permanent basis, and not as a one-time effort; Embrace innovation such as machine learning to automatically detect phishing emails; Regularly review anti-phishing measures to keep up to date with ever-evolving criminal MOs.  On the basis of these conclusions, further guidance and recommendations will be published at a later stage this year, outlining the problem of phishing and possible mitigation measures from a law enforcement-centric perspective. Steven Wilson, Head of the European Cybercrime Centre, said: “Phishing is the engine and enabler of many cybercrimes, and can be used to cause significant harm to European citizens and their organisations. Only by working closely and across key industries with some of the leading experts in their field, can we ensure that we are able to counter this threat and keep the EU safe.” “Phishing is a persistent threat to data protection, used by everyone from entry-level criminals to sophisticated nation-state adversaries. This Europol cross-industry forum is a one-of-a-kind gathering of Advisory Groups from Internet Security, Banking, and Infrastructure to enhance awareness and share cybersecurity best practices.”, said Drew Bagley, VP & Counsel, Privacy & Cyber Policy at Crowdstrike. Bruce Nikkel, Director of Cybercrime Intelligence & Forensic Investigation at UBS, as well as Chairman of the European FI-ISAC, said: “Europol is a leader in leveraging private sector engagement to help fight cybercrime. This is demonstrated in the great success of EC3’s Advisory Groups which facilitate the sharing of new criminal trends observed by industry. Public-private partnerships like this ultimately improve the safety and security of our society.” EC3 established the Advisory Groups on Financial Services, Internet Security and Communication Providers to foster trust and cooperation between key private sector industries and law enforcement in their joint fight against cybercrime. They meet separately three times a year at Europol’s headquarters in The Hague to share strategic information related to cybercrime threats and trends in their respective business areas, as well as to agree on joint initiatives alongside law enforcement. A current list of members can be found here.  

A road haulage company based in Madrid is under investigation by the Spanish Guardia Civil (Civil Guard), and four people have been arrested, after roadside checks uncovered high levels of use of cheat devices which disable pollution control system on lorries. 30 diesel vehicles from that company were caught with such cheat devices – called emulators. Adblue is an additive which converts harmful nitrogen oxide from a diesel vehicle exhaust into harmless nitrogen and water steam. This process considerably reduces the emission of nitrogen oxide, which is a major source of air pollution. The emulators work by tricking the lorry’s electronic system into “thinking” that the selective catalytic reduction (SCR) control system is functioning correctly, when in reality it is not functioning at all. Operators using these devices do not have to bear the cost of purchasing Adblue fluid or maintaining the complex SCR system on their vehicles. These emulators however allows the lorries to produce unregulated amounts of harmful nitrogen oxides well above the safe level. Initiated over a year ago by a regional unit of SEPRONA, this investigation was made possible thanks to the collaboration between the Spanish Guardia Civil, Europol, transport companies, lorry manufacturers and Adblue.  Intelligence uncovered during this investigation has been passed on to Europol as several connections were made with France and the United Kingdom.        

Law enforcement from Europe, Canada and the United States joined forces early 2019 to target vendors and buyers of illegal goods on dark web marketplaces. During the course of this operation, international law enforcement agencies made 61 arrests and shut down 50 dark web accounts used for illegal activity. Law enforcement executed 65 search warrants, seizing 299,5 kg of drugs, 51 firearms, and over €6,2 million (almost €4 million in cryptocurrency, €2,2 million in cash, and €35 000 in gold). They also conducted 122 interviews. By coordinating efforts and acting simultaneously, a strong signal has been sent to those active in selling and buying drugs, counterfeit goods, firearms, etc. on the dark web. This coordinated hit shows that if you are conducting illegal activities on the dark web, you can and will be tracked down by law enforcement. The dark web is a part of the internet that is only accessible through special software such as Tor (The Onion Router). While it provides a safe environment for personal privacy and freedom, it is also a fertile environment for criminals and individual illegal activities. Investigating these illegal activities online has become a priority for law enforcement all over the world. While you may have a higher level of anonymity on the dark web, you still have an identity; dark web applications are not an invisibility cloak or an immunity vaccine against the law. Cyber Patrol Action Week These global actions were launched during last year’s Cyber Patrol Action Week at Europol’s headquarters in The Hague. Between 2 and 5 July 2018, the second coordinated action week brought together a diverse group of online investigators and subject matter experts to patrol the surface web and dark web. Overall, 60 experts from 19 countries1, Eurojust and Europol looked for the illegal sale and signs of counterfeit goods and money, drugs, cybercrime, document fraud, non-cash payment fraud, trafficking in human beings and trafficking in firearms and explosives. The experts identified 247 high-value targets and developed intelligence packages that were disseminated to the concerned countries for further handling. Based on this information, hundreds of investigations are currently underway. Today we can already announce some results of recent law enforcement successes. Police and customs authorities in Germany have started investigations against 39 dark web users who were active on 21 different dark web markets. The 19 vendors and 20 buyers were trading illicit goods such as narcotics, firearms, counterfeit money, documents and pharmaceuticals and child sexual abuse material. These investigations are currently still ongoing. On 13 February, as part of a larger investigation, the State Police of Saxony-Anhalt and the Prosecutors Office of Halle arrested several suspects of drugs trafficking. They were selling their merchandise via the dark web. This led to the seizure of 36 kg of marijuana, amphetamines, cocaine and ecstasy tablets and packaging material and firearms. Large amounts of cash and cryptocurrencies were also seized. On 1 February 2019, in a joint operation, the German Public Prosecutor’s Office in Münster, the German Customs’ Investigation Office, the Dutch Specialised Prosecution Office for Fraud and Environmental Crime in Zwolle and the Dutch Fiscal Intelligence and Investigation Service  dismantled an organised crime group involved in international drug trafficking and money laundering. The suspects in the Netherlands prepared parcels or envelopes with drugs, which were sent to Germany. The perpetrators in Germany used various mailboxes and post offices to ship the packages on to recipients around the world. The orders were made online through the dark web, using cryptocurrency. In November 2018, the Austrian Federal Criminal Police Office (Bundeskriminalamt, .BK), special intervention units Cobra and Wega and the Vienna State Criminal Police Office arrested young men living a luxurious lifestyle, suspected of selling over 1 800 parcels of cocaine, heroin, amphetamine, methamphetamine and cannabis to customers all over the world, under the name Pablos Kitchen. The drugs were ordered through a dark web market and then sent by post. Considerable amounts of cash and drugs were seized during the house searches. A few weeks later, in December 2018, a group of Serbian perpetrators was halted who had been selling ecstasy tablets from Vienna to the US and Europe for almost ten years. The investigation revealed the main suspect received the profits of the dark web shop in the form of virtual currencies for almost €13 million. In total, 91 000 tablets were seized during the arrest of the main suspect. The Portuguese Judiciary Police have opened 13 new investigations which have led to five arrests and nine house searches so far. Ecstasy tablets, raw MDMA and LSD stamps and dark web market account details were also discovered. French Customs (Direction générale des douanes et droits indirects) was able to identify a vendor of firearms and 9 mm ammunition on a French dark web marketplace. Further investigations, as well as information received from Europol, led to the identification of the user. The perpetrator admitted to having sold between 350 and 400 9 mm cartridges. Several US agencies (FBI, DEA, HSI, CBP, USPIS, DOJ, DOD), with the support of Europol, conducted Operation SaboTor, a coordinated international effort targeting dark web drug trafficking organisations operating on the dark web. The operation aimed to detect and disrupt the most prolific opioid vendors on the dark web and dismantle the criminal enterprises facilitating their opioid trafficking. This was the second coordinated action of J-CODE, the Joint Criminal Opioid and Darknet Enforcement team. Europol’s Executive Director, Catherine De Bolle, commented: “The dark web is not as dark as you think. When you buy or sell illegal goods online, you are not hidden from law enforcement and you are putting yourself in danger. This international coordinated approach demonstrates law enforcement’s determination to tackle crime on the dark web and to reduce the number of people who fall victim to criminals selling life endangering products or scamming them for their own gain.” Perception versus reality Do you access hidden services on the dark web because you want to buy illegal goods anonymously? Then you should know that the risks are actually higher than those on the surface web. What actually happens after pressing the buy button from the comfort of your own home?  You expose your sensitive data to scammers who are only after your money and your personal details. You expose your device to some of the most damaging malware around. You may receive counterfeited products or nothing at all: drugs that could kill you, malfunctioning weapons, or cybercrime services that work against you. If you fall victim to a scam on the dark web, you have no one to turn to. Criminals don’t have a customer service department. Your usual digital consumer rights do not apply on the dark web. Dark web criminals know more about you than you know about them when you place an order. You give them personal information, while they remain hidden behind avatars. Any dispute can put your life in danger. In 2010 the EU set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In March 2017 the Council of the EU decided to continue the EU Policy Cycle for organised and serious international crime for the 2018 - 2021 period. This multiannual Policy Cycle aims to tackle the most significant threats posed by organised and serious international crime to the EU in a coherent and methodological manner. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Cybercrime is one of the priorities for the Policy Cycle and the Cyber Patrol was delivered under this framework. 1Austria, Belgium, Canada, Czech Republic, Finland, France, Germany, Greece, Hungary Italy, Latvia, the Netherlands, Poland, Portugal, Romania, Spain, Sweden, the United Kingdom, the United States.

The conference is part of a two-year project coined BeCaNet (best practice, capacity building and networking initiative among public and private actors against terrorism financing). The BeCaNet initiative brings together public and private players and is directed by the German Federal Criminal Police (Bundeskriminalamt, BKA). Official partners of BeCaNet are the police state security units from France (Sous-Direction Anti-Terroriste, SDAT), the Spanish National Police (Comisaría General de Información, CGI), the United States Federal Bureau of Investigation (FBI) and Europol. Reflecting the complexity and importance of the topic of terrorism financing and looking for professional and flexible responses and solutions, the project brings together expertise from counter terrorism and financial intelligence. The event provided the participants with the opportunity to join two workshops: the first was led by a global money service business and focused on the possibilities and benefits of cooperating with the public sector. The second workshop was led by the project coordinator BKA and dealt with challenges in CTF investigations. Lively discussions demonstrated the dedication of the participants in enhancing the work in the field. The operational focus during the final day showcased real case examples and raised relevant issues, such as the risks associated with NGOs and charitable organisations and disentangling the funds flowing towards conflict or war zones. The relevance of the misuse of the informal value transfer services lies in the fact that criminal threats in money laundering, human trafficking and migrant smugglings as well as terror financing overlap. In addition, the experts noted the misuse of new payment methods and virtual currencies by the terror-support systems, as well as the misuse of social media platforms for propaganda with a high level of sophistication. The development of the two-year-long BeCaNet project will continue further with dedicated workshops and training sessions on financial data analysis for counter terrorism financial investigators. Seven one-week training sessions will support more than 100 CTF investigators and analysts to improve their analytical skills and thinking to better investigate CTF cases. In 2020, a follow-up conference will focus on public-private cooperation in the fight against terrorism financing. The BeCaNet project is funded by the European Union’s Internal Security Fund – Police. The content of this press release represents the views of the author only and is his/her sole responsibility for use that may be made of the information it contains. About Europol To ensure an effective response to the challenges of international terrorism, Europol created the European Counter Terrorism Centre (ECTC), an operations centre and hub of expertise that reflects the growing need for the EU to strengthen its response to terror. The ECTC is designed as a central hub in the EU in the fight against terrorism and provides operational support for investigations.The Financial Intelligence Unit within Europol has a broad mandate in the area of supporting investigations in the area of organised crime, cybercrime and terrorism with financial intelligence information. It also provides Member States with intelligence and forensic support to prevent and combat international money laundering activities, counter-financing of terrorism and support recovery of the proceeds of crime.

A cross-border crime group smuggled drugs from Spain to Germany and the UK and from Poland to Norway and Sweden. Over several years, the group managed to smuggle up to four tons of narcotic substances and psychotropic drugs across Europe. Officers of the Polish Central Bureau of Investigation brought down the crime group, with support from law enforcement officers from the Netherlands, Norway and Sweden, coordinated by Europol. The joint law enforcement operation stopped the smuggling of nearly 800 kg of hashish and 50 kg of cocaine. Thirteen people have been detained by the National Prosecutor's Office in Poland. The operation to take down the criminals required extensive international coordination: officers from the Central Bureau of Investigation in Gdansk, Poland, supported by officers from the Maritime Border Guard Department in Gdansk, from Norwegian and Swedish Customs Services, as well as law enforcement from the Netherlands, Norway and Sweden, worked together on the case for three years. This cross-border investigation coordinated by Europol revealed that since 2013 the group had smuggled nearly four tons of hashish, marijuana and cocaine from Italy and Spain to Denmark, Germany, Latvia, Norway, Poland, Sweden and the United Kingdom. Centralising the investigation Over the last three years, law enforcement confiscated several hundred kilos of drugs from the crime group, including 390 kg of hashish in Norway, 355 kg of hashish in Sweden, 50 kg of cocaine in the Netherlands and 50 kg of hashish in Poland. The cases from these countries were combined into one investigation and led by officers from the Central Bureau of Investigation in Gdansk, with prosecutors from the Pomeranian Branch of the Department of Organised Crime and Corruption of the National Prosecutor's Office in Gdansk. Europol coordinated the operational activities from the very beginning and supported the investigation in both EU and non-EU countries with analysis, operational meetings, mobile office and preparing the action days.

At times of reduced migration flows at EU external borders, the facilitation of illegal immigration within the EU poses a particular growing challenge. Law enforcement agencies across Europe also have to cope with increasingly exploitative criminal activities, associated with violence and serious harm to the life of irregular migrants. These are some of the findings of the European Migrant Smuggling Centre (EMSC)’s Annual Activity Report, released today on the occasion of the Annual Conference of Heads of Counter Migrant Smuggling Units, hosted by Europol at its headquarters in The Hague. The European Union continues to be a target for migrant smuggling services. This is reflected in the increasing number of cross-border criminal investigation supported by the EMSC’s – more than 5 258 new cases in 2018 alone. Europol’s Executive Director, Catherine de Bolle, said: “The growing number of victims should worry us all and be a sign that the fight against this heinous form of crime needs to continue. Europol as the EU criminal information hub meets the need for cooperation and for sharing information within EU agencies as well as with the countries of destination, origin and transit affected by illegal migration”.  EMSC – 2018 at a glance The EMSC third year activity report details how 26 215 operational messages were submitted to the Centre via Europol’s secure communication network SIENA. These messages contained data on over 42 790 items serving to identify migrant smugglers and traffickers, helping launch 5 258 new international investigations. The EMSC’s 49 experts helped Member States law enforcement agencies in tackling criminal networks during 53 Action Days on the ground, leading to more than 600 arrested suspects of migrant smuggling in 2018. Intelligence picture Hand in hand with the specialists and analysts providing direct support to Member States’ investigations, the EMSC delivered throughout the year strategic intelligence reports on migrant smuggling and human trafficking trends and modi operandi. This year’s activity report reveals that: Facilitated secondary movements gained significance specifically along the Balkan routes and across the English Channel, with France gaining in importance as a destination country. Migrants hidden in concealments of cars, vans or lorries remains the most common modus operandi. More than 6,600 detections of irregular migrants in vehicles via the Balkans have been reported to Europol in 2018; almost 80% were hidden in concealments or transported with in high-risk circumstances. Intra-Schengen flights to Northern EU countries by use of fraudulent document remains a frequently used modus operandi, with a steady increase in the number of migrants attempting to move directly from Greece to other parts of the EU’s Schengen area by using air routes, especially during the holiday season. Misuse of asylum procedures have been increasingly detected by EU Member States; irregular migrants are, usually in an organised manner, taking advantage of the freedom of movement that comes with the status of recognised refugee and leave reception centres to move to other (EU) countries. Visa free schemes or simple visa procedures between EU neighbouring countries and third countries may contribute to a rise of numbers of irregular migrants and victims of human trafficking. The introduction of the EU visa-free regime in June 2017 for Ukrainians did have an effect and is likely to further increase the number of trafficking from Ukraine as well as from Vietnam as it is an important transit country for Vietnamese migrants. Europol receives regular notifications of children being sold to criminal networks by their families for trafficking purposes. In some cases, they engage directly in the trafficking and exploitation of their own children. Female suspects play a key role in the trafficking and exploitation of minors, much more than in criminal networks that traffic adult victims. The need for tackling OCGs and their callous and inhuman business is higher than ever. Europol’s EMSC will keep on gathering relevant intelligence and provide agile and tailor-made operational support to Member States' investigations and to connect and coordinate among law enforcement agencies. Read the full report here: EMSC 3rd ANNUAL ACTIVITY REPORT – 2018

As our society evolves, so does our reliance on telecommunications technology. Cybercriminals prey on our daily use of electronic devices and continuously seek out new ways to exploit vulnerabilities and access information. Cooperation and information-sharing between law enforcement and the private sector has therefore become essential in the fight against these types of crime. One example of this collaboration is the joint Cyber-Telecom Crime Report 2019, published by Europol and Trend Micro today. The report gives an overview of how telecom fraud works and serves as a technical guide for stakeholders in the telecoms industry. Over €29 billion per year This report highlights that telecom fraud is becoming a low-risk alternative to traditional financial crime. The reduced cost and increased availability of hacking equipment means this type of fraud is on the rise. The cost of telecommunications fraud is estimated to be €29 billion a year. At its heart, this fraud is the abuse of telecommunications products (mainly telephones and mobile phones) or services with the intention of illegally acquiring money from a communication service provider or its customers. The main goal of criminals is to gain access to customers’ or carriers’ accounts, where debt can be incurred in the criminal’s favour. The most common methods can be broken into different categories ranging from crude to highly sophisticated scams: Vishing calls. Vishing (a combination of the words Voice and Phishing) is a phone scam in which fraudsters trick victims into divulging their personal, financial or security information or into transferring money to them. One (ring) and cut or Wangiri -Japanese for ‘one ring and drop the call’ – is a telephone scam where criminals trick victims into calling premium rate numbers. A fraudster will set up a system to dial a large number of random phone numbers. Each call rings just once then hangs up, leaving a missed call on the recipients’ phones. Users often see the missed call and, believing it to be legitimate, call the premium rate number back. International Revenue Sharing Fraud (IRSF) has been the most damaging fraud scheme to date. It involves transferring monetary value from one carrier to another, based on the inter-carrier trust between telecom operators. Patient fraudsters wait for the logs to expire before executing any further money laundering steps. The cyber-telecom intelligence fusion The Europol EC3 CyTel working group, created in 2018, brings together more than 70 experts from law enforcement and global partners from the telecommunications industry, in order to share intelligence, knowledge and experience, and the techniques required to combat this type of fraud. The concept of a global telecom network, with unified telecommunications service providers and law enforcement, is essential for this fusion of cyber-telecom intelligence. ‘Telecommunications fraud is another example of criminals “hacking the system” in order to abuse legitimate enterprises for criminal gain,’ said Steven Wilson, Head of the Europol’s European Cybercrime Centre, ‘While this is not a new crime area, it does represent a new challenge for many law enforcement agencies throughout the European Union.’ Craig Gibson, Principal Threat Defence Architect at Trend Micro, added how vulnerable telecommunications can be and how it impacts  our daily life: ‘We trust that our phones will work, that we can work from home, that we can be paid through our ATM accounts, and that we can shop online. We tend not to think about what is under the covers of the unseen global network we rely on so much.’ Craig Gibson, Principal Threat Defence Architect at Trend Micro, added how vulnerable telecommunications can be and how it impacts  our daily life: ‘We trust that our phones will work, that we can work from home, that we can be paid through our ATM accounts, and that we can shop online. We tend not to think about what is under the covers of the unseen global network we rely on so much.’ Spot a scammer Want to know how to avoid fend off fraudsters or find out more about telecom fraud? Alongside the report, we have launched our #TelecomFraud awareness webpage.  

Europol has supported the Greek authorities in dismantling an organised crime group responsible for at least 28 domestic burglaries across Athens. Four suspects of the crime gang — made up of Georgian nationals — have been arrested; one of them is a high-ranking criminal (known as a ‘thief in law’) of the Eurasian criminal underworld. Another two suspects have been identified and the arrest warrants will be issued in due course. In five house searches on 13 March 2019, law enforcement seized four weapons, together with numerous stolen goods and burglary tools. The group used a specific modus operandi to break into the properties: unlocking security locks with a master key. Since October 2018, law enforcement officers have established 28 burglaries as being committed by this criminal group and the investigation is still ongoing. Europol has supported the investigation with analysis and deployment of its mobile office in Greece during the arrests.

The possibility of a large-scale cyber-attack having serious repercussions in the physical world and crippling an entire sector or society, is no longer unthinkable. To prepare for major cross-border cyber-attacks, an EU Law Enforcement Emergency Response Protocol has been adopted by the Council of the European Union. The Protocol gives a central role to Europol’s European Cybercrime Centre (EC3) and is part of the EU Blueprint for Coordinated Response to Large-Scale Cross-Border Cybersecurity Incidents and Crises1. It serves as a tool to support the EU law enforcement authorities in providing immediate response to major cross-border cyber-attacks through rapid assessment, the secure and timely sharing of critical information and effective coordination of the international aspects of their investigations. In 2017, the unprecedented WannaCry and NotPetya cyber-attacks underlined the extent to which incident-driven and reactive responses were insufficient to address rapidly evolving cybercriminal modus operandi effectively. The EU Law Enforcement Emergency Response Protocol determines the procedures, roles and responsibilities of key players both within the EU and beyond; secure communication channels and 24/7 contact points for the exchange of critical information; as well as the overall coordination and de-confliction mechanism. It strives to complement the existing EU crisis management mechanisms by streamlining transnational activities and facilitating collaboration with the relevant EU and international players, making full use of Europol’s resources. It further facilitates the collaboration with the network and information security community and relevant private sector partners. Only cyber security events of a malicious and suspected criminal nature fall within the scope of this Protocol; it will not cover incidents or crises caused by a natural disaster, man-made error or system failure. Therefore, in order to establish the criminal nature of the attack, it is fundamental that the first responders perform all required measures in a way to preserve the electronic evidence that could be found within the IT systems affected by the attack, which are essential for any criminal investigation or judicial procedure. Multi-stakeholder process The protocol is a multi-stakeholder process and entails in total seven possible core stages from the early detection and the threat classification to the closure of the Emergency Response Protocol. “It is of critical importance that we increase cyber preparedness in order to protect the EU and its citizens from large scale cyber-attacks”,  Wil van Gemert, Deputy Executive Director of Operations at Europol, said. “Law enforcement plays a vital role in the emergency response to reduce the number of victims affected and to preserve the necessary evidence to bring to justice the ones who are responsible for the attack.” As the EU Agency for law enforcement cooperation, Europol is mandated to support the Member States’ endeavours to effectively detect, investigate, disrupt and deter large-scale cyber incidents of a suspected criminal nature. -- 1Commission Recommendation (EU) 2017/1584 of 13 September 2017 on coordinated response to large-scale cybersecurity incidents and crises C/2017/6100

7 suspects were arrested in France on 26 February as a result of operation involving the French Gendarmerie Nationale (National Gendarmerie) targeting a criminal group suspected of importing firearms into France. An associate was also arrested on American soil earlier in the month. 60 handguns, 20 rifles and 9 sticks of dynamites were seized as a result of coordinated raids throughout France (Loiret, Nièvre, Savoie, Seine-et-Marne and Val-de-Marne). A Europol mobile office was deployed to Nemours, allowing for the real-time exchange of information between all involved parties. The inquiry was sparked in June 2018 after evidence was found during an unrelated house search which led to the identification of this organised crime group importing firearms into France. The firearms were bought legally in the United States by an associate, before being shipped illegally to France, broken down in parts spread across dozens of packages. It is believed that this organised crime group trafficked into France over 450 weapons for the year 2018 alone.  

This week, over 230 participants from over 60 different countries convened at Europol’s headquarters in The Hague, the Netherlands, for the 3rd Global Conference on Criminal Finances and Cryptocurrencies. The participants comprised representatives from law enforcement and judicial authorities, Financial Intelligence Units (FIU), international organisations as well as representatives from the private sector. An initiative of the Working Group on cryptocurrencies and money laundering established in 2016 by Europol, INTERPOL and the Basel Institute on Governance, this conference focused on discussing the vulnerabilities and threats in cryptocurrencies leading to their misuse for money laundering and terrorism financing purposes. The event zeroed down not only on the threats but also on the innovations, solutions, tools, and building coalitions to combat these threats. The first day was open for participation from the private sector. The potential and solutions of the blockchain analysis to combat the criminal use of cryptocurrencies and other distributed ledger technologies were presented. This sector is expanding exponentially: while money launderers explore new ways to obscure the direct link with the proceeds of their crimes, private companies develop new solutions to follow these transactions, helping law enforcement in their investigations. The second day, restricted to public sector involved in this phenomenon saw investigators from different countries presenting and discussing case studies, sharing knowledge, experience, identified modi operandi and best practices on how to target the criminal abuse of virtual assets. The speakers reinforced the message that in cryptocurrencies-related investigations, following the financial trail albeit not appearing the traditional format is still a financial investigation – a successful approach leading to the identification of the perpetrators. Another important message was that virtual assets are exactly this – assets and as such, considering their criminal nature should be traced, seized and confiscated. The conference provided an excellent platform, to discuss and learn from recent developments and the current state of play in legal, technical, and investigate methods perspective. The event was closed by Europol’s Deputy Executive Director Operations, Wil van Gemert, who urged the participants to be bold and proactive, to build coalitions and become the respected gatekeepers ensuring an environment in which crime does not pay.