Top Stories

On 19 September, Bulgarian authorities, supported by Europol, dismantled a criminal network smuggling migrants from Türkiye via Bulgaria and Serbia towards Western Southern Europe. The investigation, involving Greek and Romanian authorities, was conducted in the framework of a regional Operational Task Force set up to investigate migrant smuggling networks using Bulgaria as a transit country.The action day led to:8 arrests (one High Value Target)11 location searchesSeizures including: cash, Hawala accountancy notebooks and documentsOne Romanian citizen found during the searches has been identified as a person wanted by Austria.The investigation was initiated at the beginning of 2023 when Bulgarian authorities found migrants smuggled by this network. So far, national authorities have detected 15 smuggling incidents. The smuggling network allegedly facilitated the illegal secondary movements of over 700 irregular migrants towards other parts of the EU. The suspected ringleaders, predominantly Syrian nationals, coordinated the smuggling activities while maintaining contacts with smugglers and hawaladars in Turkey and Greece, as well as in other countries along the smuggling route. The suspects facilitated the transportation of migrants from the Turkish-Bulgarian border to accommodations in the region of Sofia. After a short stay there, they were further transported to the Bulgarian-Serbian border.Migrants had to deposit EUR 3 000 to EUR 5 000 in Hawala offices before going to the borderMigrants had to pay significant deposits before being taken across the green border between Türkiye and Bulgaria. They paid between EUR 3 000 and EUR 5 000 in Hawala offices in Istanbul and were then smuggled by guides connected to the Turkish members of the criminal network. Once on Bulgarian territory, the migrants were picked up by drivers of Bulgarian, Romanian and Syrian nationalities, who transported them to accommodations in Sofia. For the transportation, the smuggling network used different vehicles such as cars, vans and even trucks.In one case, the suspects transported 150 migrants in a lorry. Criminals use this modus operandi to maximise their profits when the demand for smuggling services is high. In this particular case, drivers transported the migrants while driving at fast speeds, to escape police checks. This dangerous modus operandi puts the lives of migrants and bystanders at great risk.Europol support and joint actionsExtensive operational analysis was carried out to identify the different targets and map their criminal activities. Europol also brought together the different countries involved to jointly prepare for the final phase of the investigation.Two Europol experts deployed to Sofia in the framework of the regional Operational Taskforce were on the ground during the action day, helping law enforcement authorities with cross-checks in real-time against Europol’s databases.Police officers from the Hellenic Police, Romanian Border Police and Romanian Police (Service for Combating Organised Crime) were deployed on the spot to support the investigative measures.Europol’s European Migrant Smuggling Centre has been supporting the work of the Task Force since its establishment.The following authorities took part in this action:Bulgaria: General Director for Combating Organised Crime (Главна дирекция Борба с организираната пресъпност), and National Security Agency (Държавна Агенция Национална Сигурност)Greece: Hellenic Police (Ελληνική Αστυνομία)Romania: Border Police (Poliția de frontiera) and National Police (Poliția Română)

Investigators reported 483 000 victims worldwide, who had attempted to regain access to their phones and been phished in the process. The victims are mainly Spanish-speaking nationals from European, North American and South American countries.The successful operation took place thanks to international cooperation between law enforcement and judiciary authorities from Spain, Argentina, Chile, Colombia, Ecuador and Peru.The action week took place between 10 and 17 September and resulted in 17 arrests, 28 searches and 921 items seized, mainly mobile phones but also other electronic devices, vehicles and weapons.A complex criminal webThe administrator of the phishing platform, an Argentinian national, was arrested during the large-scale law enforcement operation. He had been developing and running phishing services since 2018. On this occasion, he had been offering a phishing-as-a-service platform for unlocking mobile phones for the last 5 years.The criminal sold access to his website and charged extra costs for phishing, SMS, emails or call performing. Criminal users of the platform –or “unlockers”– provided phone unlocking services to other criminals in possession of stolen phones.Investigators identified more than 2 000 unlockers who had been registered in the phishing platform over the years. The investigation revealed that the criminal network had unlocked over 1.2 million mobile phones.Europol’s roleFor the first time, Europol’s European Cybercrime Centre (EC3) coordinated an international operation together with the Specialised Cybercrime Centre of Ameripol, the Police Community of the Americas.The action week was the result of a long-run investigation starting in 2022. After receiving information from a private company (Group-IB), Europol provided the affected countries with dedicated packages regarding the case. After months of investigation, the countries managed to identify most of the victims and took action against the criminal network.During the investigation, Europol coordinated the authorities involved in the case and provided them with analytical support. An expert from Europol was deployed to Argentina and Spain to provide their expertise in the field during the action week.Law enforcement authorities involved:Spain: Spanish National Police (Policía Nacional) and Spanish Guardia Civil (Guardia Civil)Argentina: Argentine National Gendarmerie (Gendarmería Nacional Argentina) and Argentine Federal Police (Policía Federal Argentina)Chile: Chilean Investigative Police (Policía de Investigaciones de Chile)Colombia: Colombia National Police (Policía Nacional de Colombia)Ecuador: National Police of Ecuador (Policía Nacional de Ecuador)Peru: National Police of Peru (Policía Nacional de Perú)Other partners involved:Ameripol – AC3, Specialised Cybercrime Centre (Centro Especializado de Cibercrimen)EL PACCTO - Europe Latin America Assistance Program against Transnational Organised Crime (Europa Latinoamérica Programa de Asistencia contra el Crimen Transnacional Organizado)Do not take the baitPhishing refers to fraudulent emails coming from criminals posing as legitimate senders that trick the receivers into taking an action or sharing their personal, financial or security information.The messages usually:look identical to messages from a reputable organisation or service provider;sound urgent;claim to enclose important or breaking news;ask you to take action, such as clicking attachments and links or confirming your login credentials.What can you do if you click something?Use antivirus software on all your electronic devices.Ensure that your security software and operating systems are up-to-date.Set up unique passwords for all your online accounts.Think twice before clicking on any links and attachments as criminals could be trying to phish or smish you. If you’re in doubt, don’t click links, open attachments or reply and certainly don’t give out any financial information.

The theme of this year’s EDEN event, ‘Data Protection & Cyber Security as Law Enforcement Core Business’, highlighted the opportunity for law enforcement to leverage advancing technologies while maintaining ethical standards and meeting legal requirements. The conference explored topics such as the impact of quantum computing, AI in policing, and strategies to combat disinformation, alongside discussions on balancing security concerns and individual rights.The event featured a series of keynote speeches. The European Data Protection Supervisor (EDPS), Wojciech Wiewiorowski, spoke on the critical relationship between the AI Act and data protection regulations, particularly in the context of data-driven investigations and law enforcement. He highlighted the growing importance of collaboration between law enforcement, academics, and scientist to effectively navigate the evolving digital landscape.Europol’s Executive Director, Catherine De Bolle, emphasised:In an operational landscape where risks are constantly evolving, being accountable requires governance and controls by design and applied at the onset. But, it also calls for a permanent adaptation of our data protection processes to the changes in the threat environment. At Europol, the Data Protection Function is at the heart of these efforts. We must continue to support and empower Data Protection Officers as they help us navigate the complexities of managing sensitive information in a way that upholds public trust and the rule of law.During her keynote speech, the President of the Republic of Slovenia, Dr. Nataša Pirc Musar stated:EDEN is not just a conference; it is a beacon for the data protection community, bringing together professionals, law enforcement officials, regulators, academics and representatives from the private sector and NGOs. It is a gathering that reflects the diverse and interconnected world we live in, where the protection of personal data is no longer just a legal requirement but a fundamental aspect of our shared values and a cornerstone of democracy.Data protection at EuropolData protection is fundamental to Europol’s work and forms an important part of its core business. The Data Protection Function, which operates with functional independence, works closely with Europol staff and is the initial point of contact for all data protection matters.Europol upholds both security and privacy as essential elements of its operations, recognising that safeguarding privacy is integral to ensuring security. The organisation’s commitment to data protection lies at the heart of its daily work, reflecting the importance of both privacy and security in maintaining a safe, free society.Through events like the EDEN conference, Europol continuously broadens its understanding of data protection, cybersecurity, law enforcement practices, technology, and fundamental rights, ensuring it remains at the forefront of these critical areas.The EDEN networkFounded in 2015, the Europol Data Protection Experts Network (EDEN) is a collaboration platform that brings together stakeholders from diverse backgrounds. It provides a forum for sharing knowledge, best practices, events, and projects related to data protection within a law enforcement context. EDEN is an invitation-only network and is not suitable for the exchange of operational personal data or classified information.Each year, EDEN organises a conference featuring speakers and participants from law enforcement, the data protection community, private industries, NGOs, academia, and other interested sectors. To date, eight large-scale EDEN events have been held in The Hague (2016, 2018, 2020, 2022, 2024), Copenhagen (2019), Rome (2021), and Madrid (2023). Additionally, EDEN has hosted panels at the International Conference on Computers, Privacy, and Data Protection (CPDP) in Brussels every year since 2020.This year’s EDEN Conference was particularly notable, as it included a dedicated panel for young professionals to share their views on the intersection of data protection, law enforcement, and cybersecurity. Given that these professionals will help shape the future of security, it is crucial that they have a platform to provide their insights and ideas.EDEN is a space where experts across various fields engage in meaningful dialogue with one another rather than simply about one another. Through collaborations with universities, EDEN facilitates the exchange of knowledge and best practices, encouraging students to contribute their unique perspectives to the debates. These collaborations also provide students with opportunities to network with privacy professionals and influential figures in the data protection community, enhancing their understanding of data protection and cybersecurity, and strengthening the links between EDEN and academia.If you are interested in becoming a member of EDEN or want to host an EDEN Community Event, please contact us at eden@europol.europa.eu.

The signatures of these two legal instruments put into practice the Working Arrangement between the International Criminal Court and Europol, which was concluded on 25 April 2023. This will allow the ICC to nominate a Liaison Officer to Europol. The signing will also allow the ICC to establish a SIENA connection with Europol, allowing for the secure exchange of sensitive operational information.Europol’s Executive Director Catherine De Bolle said:The cooperation between Europol and the ICC is of great interest to both parties in the fight against core international crimes. As law enforcement practitioners - and especially for those of us who work in pursuit of international criminal justice, the International Criminal Court is a reference. It is a symbol for the international community efforts to hold accountable those guilty of some of the world’s worst crimes.ICC President Tomoko Akane said:Our two institutions share a fundamental understanding that international cooperation is key to the pursuit of justice. At this challenging time, the objectives of the Court, including the pursuit of an end to impunity in the context of full respect for the rule of law, can be best achieved in close cooperation and partnership with others. Today, we strengthen this cooperation by adopting frameworks for its practical implementation between our two institutions.Europol’s mandate expanded in 2017 to include the crimes of genocide, crimes against humanity and war crimes. Since its inception seven years ago, a dedicated Europol Analysis Project has been providing tailor-made and specialised support to EU Member States’ and Third Parties’ efforts to identify and investigate individuals, networks and groups involved in committing core international crimes. Europol focuses on the analytical part of international crimes investigations, streamlines information exchange, carries out online monitoring, and provides open sources intelligence. To that end, Europol has a secure and dedicated operational data storage capacity, which is compliant to judicial use of evidence. 

Europol’s Executive Director Catherine De Bolle said:Today we have made it clear that no matter how hidden criminal networks think they are, they can’t evade our collective effort. Law enforcement from 9 countries, together with Europol, have dismantled a tool which was a lifeline for serious organised crime. This operation is what Europol is all about: turning collaboration into concrete results by bringing together the right people, tools and expertise to address every aspect of this complex operation. The work carried out is part of our ongoing commitment to tackling organised crime wherever it operates. I want to extend my gratitude to all our global partners who played a vital role in making this operation a success.Ghost had gained traction among criminal organisations due to its advanced security features. Users could purchase the tool without declaring any personal information. The solution used three encryption standards and offered the option to send a message followed by a specific code which would result in the self-destruction of all messages on the target phone. This allowed criminal networks to communicate securely, evade detection, counter forensic measures, and coordinate their illegal operations across borders.Worldwide, several thousand people used the tool, which has its own infrastructure and applications with a network of resellers based in several countries. On a global scale, around one thousand messages are being exchanged each day via Ghost.A multinational effort spanning 9 countriesAs servers were found in France and Iceland, the company owners were located in Australia, and financial assets were located in the United States, a global operation against the phone service started.The takedown involved a series of coordinated raids and technical interventions. Over the course of the investigation, 51 suspects have been arrested: 38 in Australia, 11 in Ireland, one in Canada and one in Italy belonging to the Italian Sacra Corona Unita mafia group.Further arrests are anticipated as the investigation progresses.In addition, a number of threats to life were prevented, and a drug lab dismantled in Australia, together with weapons, drugs and over EUR 1 million in cash seized globally so far.To facilitate investigations into the illegal activities facilitated by this communication platform, an Operational Taskforce (OTF) was established at Europol in March 2022 involving law enforcement authorities from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States.This taskforce has been instrumental in mapping the global technical infrastructure, and was successful in targeting it by identifying key suppliers and users of the platform, monitoring its criminal usage, and executing the coordinated effort to shut it down, all under judicial oversight from the Joint Investigation Team (JIT) countries.Building upon the law enforcement cooperation, a JIT was set up between the French and U.S. authorities in January 2024 with the support of Eurojust and Europol.This complex, global operation was made possible thanks to active cooperation among the different countries involved and Europol, which have been engaged in the different components of the investigative activities, including actions against high-risk criminal organisations and High Value Targets, cyber-investigations, the analysis of cryptocurrencies transactions, frequent intelligence exchange using Europol’s secure channels and dozens of operational meetings arranged in different countries.Over the course of the investigation, Europol deployed experts to Iceland, Ireland and Australia. Due to the complexity of this data-driven investigation, a number of teams at Europol were involved with specialised technical skills, including cyber-related.A Joint Operational Centre was also established at Europol’s headquarters during the action days, where representatives from the OTF members and Europol’s officers provided support and facilitated the coordination of the simultaneous operational activities taking place across the globe.A fragmented and dynamic landscapeThe encrypted communication landscape has become increasingly fragmented as a result of recent law enforcement actions targeting platforms used by criminal networks. Following these operations, numerous once-popular encrypted services have been shut down or disrupted, leading to a splintering of the market.Criminal actors, in response, are now turning to a variety of less-established or custom-built communication tools that offer varying degrees of security and anonymity.  By doing so, they seek new technical solutions and also utilise popular communication applications to diversify their methods. This strategy helps these actors avoid exposing their entire criminal operations and networks on a single platform, thereby mitigating the risk of interception.Consequently, the landscape of encrypted communications remains highly dynamic and segmented, posing ongoing challenges for law enforcement.Lawful access to dataEuropol and its partners continue to prioritise the fight against encrypted communication technologies used by criminals, while also advocating for a balanced approach that respects privacy rights and upholds legal standards.Private companies that wish to ensure their services are used in compliance with the law also have an important role to play. They must ensure that their platforms are not safe havens for criminals and should provide mechanisms for lawful data access under judicial oversight and in full respect of fundamental rights.Law enforcement needs access to communications among suspects to combat serious crimes. This can coexist with privacy protection, while cybersecurity is guaranteed and strong legal safeguards and oversight are in place.The following authorities took part in the investigation:Australia: Australian Federal PoliceCanada: Combined Forces Special Enforcement Unit - Montreal, Federal Policing - Eastern Region, Royal Canadian Mounted PoliceFrance: Cybercrime unit Prosecutor’s office JUNALCO (National Juridiction against organised crime), National Gendarmerie - National Cyber Unit (Gendarmerie Nationale - Unité nationale cyber C3N), National cyberspace command for the Interior Ministry (Commandement du Ministère de l'intérieur pour le cyberespace)Iceland: Reykjavik Metropolitan PoliceIreland: An Garda SíochánaItaly: Central Directorate for Anti-Drugs Services (D.C.S.A.), Polizia di Stato, Squadra Mobile Lecce, District Anti-mafia Directorate Lecce (Direzione Distrettuale Antimafia), National Anti-Mafia and Anti-Terrorism Directorate (Direzione Nazionale Antimafia e Antiterrorismo), Central Operational Service (S.C.O.)The Netherlands: PolitieSweden: Swedish PoliceThe United States: Federal Bureau of Investigation (FBI)A number of technical developments within the investigation were supported by the Internal Security Fund (ISF) ‘Project Overclock’, funded by the European Commission.Press conference

New risks…The presentations and panels revealed emerging ways in which crypto assets and innovations are abused to facilitate organised crime.While cryptocurrencies pose no greater intrinsic risk than more traditional assets and value transfer systems, their unique features can be leveraged to facilitate ransomware attacks and other cybercrime, which can affect critical infrastructure and services.Speakers revealed cases of sophisticated misuse of crypto assets for money laundering, sanctions evasion, terrorist financing and nuclear proliferation, each carrying significant implications for both national and global security.…joint solutionsThe conference also showcased how law enforcement agencies are working collaboratively with crypto asset service providers, blockchain analysis firms and specialist asset recovery and management agencies to fight back.Emphasising the value of such events, Burkhard Mühl, Head of Europol's European Financial and Economic Crime Centre (EFECC), commented:With events such as this Global Conference and the gathering and interaction of so many professionals and experts, we remain at the forefront of providing an appropriate response to the emerging financial crime risks and threats posed by the misuse of crypto assets. Europol will continue to support criminal investigations with all our capabilities and work with our partners to ensure that criminals are brought to justice.These public-private collaborations have enabled officers to trace illicit crypto transactions across multiple blockchains before ultimately seizing the funds, de-anonymising the perpetrators and often being able to return significant quantities of crypto assets to victims.John Brandolino, UNODC Director, Division of Treaty Affairs, emphasised that:Multilateral collaboration is essential to dismantling the finances of criminal organisations and terrorists. UNODC fully supports and promotes efforts to collectively strengthen our ability to prevent and counter the criminal misuse of crypto assets, which in turn contributes to overall global security.Meanwhile, more stringent regulations in the European Union and other jurisdictions are starting to bring the crypto ecosystem firmly into the regulated sphere. If implemented effectively, they will provide a robust framework for law enforcement and asset recovery while also setting clear guidelines for private-sector entities and supervisors.A strategic priorityInvesting in capabilities and effective measures to prevent and combat the misuse of the crypto ecosystem for financial crime should be a strategic priority across all sectors. Iker Lekuona, Director of the Basel Institute’s International Centre for Asset Recovery (ICAR), said:In our work assisting with major transnational corruption and asset recovery cases, we see how money launderers and other criminals systematically target weak links in the chain. All institutions involved in detecting and investigating financial crimes and in recovering assets need to build their capacity to work on crypto-related cases.Mr. Brandolino added:Tackling illicit profits has consistently proven to be one of the most effective strategies for disrupting criminal organisations and preventing the misuse of cryptocurrencies for illegal purposes.As emphasised in the joint Europol–Basel Institute recommendations published earlier in 2024, this includes investing in research and innovation, capacity building and cross-border, multi-stakeholder collaborations.Joint learning and collaborationsPeer learning opportunities like this Global Conference series are vital to advancing all of these areas. They are a key element of the strategic approaches of all three partner organisations for this conference, including Europol’s 2023 Delivering Security in Partnership strategy and the Basel Institute’s strategic pillars of building coalitions and catalysing joint learning.

Despite extensive investigations over the years, the identity of the suspect(s) remains unknown, and authorities are hoping that new information from the public can finally help solve this case.What we knowOn 8 August 1996, a brutal murder occurred in Dümmerlohausen, Germany, where the victim was found next to a stolen red vehicle, riddled with bullets.The victim, a male national from the former Yugoslavia, was involved in criminal circles and was known to law enforcement for his involvement in burglaries in northern Germany.A resident of Hamburg, the victim is believed to been staying in a hotel in Oldenburg at the time of his murder, where he was presumably in hiding.Despite a thorough investigation, the identity of the killer(s) has remained a mystery for the past 28 years.Appeal to the publicRecent advances in forensic technology, combined with renewed investigative efforts, have enabled the German Police to re-examine the case. To widen the investigation’s reach, the German authorities have asked for Europol’s support.The case falls under the work of Europol’s European Serious Organised Crime Centre, whose mandate was recently extended to counter the use of violence by organised crime groups. Europol’s work in this area covers a wide spectrum – from the most recent trends to decades old cold cases.Authorities are now urging anyone with information, no matter how insignificant it may seem, to come forward.The Oldenburg Police Department is offering a reward of EUR 5 000 for information leading to the resolution of the case and the apprehension of the perpetrator(s). This reward will be granted in agreement with the Oldenburg Public Prosecutor’s Office.A short film has been produced by the German authorities, providing previously undisclosed details about the murder case and original photos and excerpts from the investigation files. It is intended to reach potential witnesses or individuals with knowledge of the murder.How to provide informationInformation can be provided anonymously to the German authorities.A tip portal has been set up, allowing witnesses to contact the police anonymously. Users can also upload files and images through this portal.

Among those detained are the five Romanian leaders of the group, who are believed to have been responsible for the logistics and management of the criminal activities. The other suspects were criminal associates in charge of recruiting drivers or accommodating migrants in so-called safe houses, two of which were found in Italy. The criminal group is suspected of having been involved in over 30 smuggling incidents since January 2023, illegally transporting at least 726 migrants across European borders.Results of the action day include:19 suspects detained and presented before public prosecutor’s offices to press charges1 modified van with special compartment for smuggling migrants seized4 vehicles, an all-terrain vehicle, and a motorcycle seized52 mobile phones, 2 laptops and a tablet seizedaround EUR 15 000 in various currencies seizedRomania to Italy for up to EUR 3 000Offering and organising their trips on messenger apps, the criminals would offer to clandestinely take migrants, many of which had a temporary work visa in Romania, from Romania over Hungary and Slovenia to Italy. The Bangladeshi, Indian, Nepali or Pakistani nationals making use of this illicit service paid between EUR 2 500 and EUR 3 000 for the journey. Facing life-threatening conditions, the migrants were often hidden in specially designed compartments – such as double walls – in the cargo space of vans or lorries.Throughout the journey, the criminals deployed additional vehicles as forerunners to accompany the transports and keep a watch out for law enforcement presence. Most of the vehicles used by the suspects were registered under legal businesses such as transport companies. The criminals organised the trips via interconnected cells, each recruiting drivers for individual parts of the journey.Europol’s contributionEuropol facilitated the exchange of information between the involved countries and provided operational coordination as well as analytical support. Intelligence on this case was also provided by Europol guest officers deployed in Galati, Romania. On the action day, a Europol analyst with a mobile office was deployed to cross-check information on the spot.Participating countries:Hungary: Hungarian National Bureau of Investigation – Unit against Illegal Migration (Nemzeti Nyomozó Iroda – Illegális Migráció elleni Osztály)Italy: Italian State Police – Central Operational Service (Polizia di Stato – Servizio Centrale Operativo (SCO)); Italian Border Police of Gorizia (Polizia di Stato – Settore Polizia di Frontiera di Gorizia); Italian Border Police of Gorizia (Polizia di Stato – Settore Polizia di Frontiera di Udine)Romania: Romanian Police – General Directorate for Countering Organised Crime (Poliţiei Române – Direcția de Combatere a Criminalității Organisate (DCCO)); Romanian Border Police – Directorate for Prevention and Countering of Transborder Crime and Illegal Immigration (Poliția de Frontieră - Direcția de Prevenire și Combatere a Migrației Ilegale și Infracționalității Transfrontaliere)Slovenia: Slovenian National Police (Policija)The list of authorities was updated on 4 September 2024 at 10:20 CET.

Results of the action day include:arrest of 7 members of the criminal network;dismantling of the largest laboratory of synthetic opioids ever found in Poland, used to produce methadone in crystalline form;dismantling of 8 multi-laboratories in Poland and Ukraine, used for the production of synthetic cathinones (mephedrone, Alpha-PVP) and methadone;seizure of 195 kilograms of methadone in crystalline form;seizure of 153 kilograms of Alpha-PVP;seizure of over 430 litres of reaction mixtures of different types of drugs prepared for the final production stage;seizure of large quantities of drug precursors and chemicals necessary for the production of synthetic opioids and cathinones.Highly harmful and lethal substances seizedMethadone, a synthetic opioid, is a substance used in the medical field as a painkiller and in the treatment of opioid addiction. However, the substance produced by the criminal network was in a concentrated crystalline form, which is only found on the illegal drug market and the danger of which cannot be overstated.Law enforcement also seized substances such as mephedrone and Alpha-PVP, which belong to the group of synthetic cathinones and represent an increasing problem in several EU Member States. These drugs cause serious psychological and neurological disorders, and their abuse is associated with a high risk of addiction, organ damage, and death. For more information about the reality of the European illicit markets please refer to the EU Drug Markets Report by Europol and the European Union Drugs Agency (EUDA).Synthetic drugs as law enforcement priorityThis operational success involving Polish and Ukrainian law enforcement agencies underscores the effectiveness of cross-border collaboration, which is crucial for safeguarding our societies and protecting the lives and health of citizens from the dangers posed by international organised drug crime.Europol supports its partners in the fight against the production, trafficking and distribution of synthetic drugs. In 2023, Europol sent out an Early Warning Notification to its Member States and partners, warning them about an increase in trafficking of these type of drugs. During the operation’s investigation phase, Europol provided intelligence for cross-checking and analysis to support investigators on the field. As a priority of the EU Policy Cycle - EMPACT, this operation was also financially supported by the platform, which contributed to its successful outcome.Europol maintains the European Illicit Laboratory Comparison System (EILCS), which contains details of equipment and chemicals used in laboratories, storage places, and dumping sites for synthetic drugs. This data enables Europol analysts to compare new incoming information with previous cases. This allows them to find links between illicit sites and to assist EU Member States in cracking down on production facilities across Europe.The equipment needed to carry out this operation was made possible by the ‘Crystal Palace’ project - “Strengthening the Actions of the EMPACT NPS and Synthetic Drugs Platform under the EMPACT 2022+ Instrument” - led by Poland, the Netherlands, and Italy, and funded by the European Union Internal Security Fund.

The agreement includes provisions on the exchange of information and data protection, the rights of data subjects, the establishment of a supervisory authority, and administrative and judicial redress.This is the first agreement of its kind since the Europol Regulation 2017, which allows Europol to transfer personal data to an authority of a third country on the basis of an international agreement between the EU and the third country.The international agreement entered into application on 15 August 2024.Teaming up since 2019This agreement builds on the existing Working Arrangement between the New Zealand Police (Nga Pirihimana O Aotearoa) and Europol, which has been in place since 2019. Under the existing arrangement, New Zealand works closely with Europol and the Member States to exchange specialist knowledge, general situation reports and strategic analysis results, participate in training activities, and provide advice and support in individual criminal investigations.In return, New Zealand has access to Europol’s secure communication channel and has a Liaison Officer stationed at Europol’s headquarters.The press release was updated on 4 September 2024 at 17:30 CET.

The seizures included large quantities of drugs and criminal assets:47 kilograms of freshly processed cocaine hydrochloride;20 kilograms of cocaine base (processed cocaine paste);2 kilograms of marijuana;3 000 litres and 300 kilograms of various chemicals;3 firearms;EUR 245 000 in cash;13 vehicles.Ingenious cross-ocean smuggling techniqueUsing a sophisticated method to avoid detection, the criminals injected cardboard boxes containing legal cargo (such as fruit) with cocaine base. Once successfully shipped in maritime containers from Colombia to Málaga, Spain, the organisation would extract the cocaine base from the cardboard and process it into the final consumable product, ready for distribution.Over the course of this joint law enforcement effort, the logistical and company structure used for developing and maintaining this criminal activity has been dissolved. Europol supported the investigation with analytical support and provided operational support on the two action days. Specialists from Europol’s dedicated Operational Task Force were deployed on the spot, providing forensic support and cross-checking new leads and information in real time against the Agency’s databases.This operation serves as an example of a trend highlighted in the EU Drug Markets Report by Europol and the European Union Drugs Agency (EUDA). Law enforcement authorities across Europe have observed an increase in the number, capacity and sophistication of laboratories set up for the extraction and further processing of the cocaine base (as well as, to a lesser degree, cocaine paste) into the final consumable product (cocaine hydrochloride). Typically, raw cocaine is transported to Europe concealed in a carrier material (such as charcoal) in order to reduce the risk of detection in entry points such as ports and airports.

On 19 August, Bulgarian law enforcement authorities arrested eight suspected members of a gang involved in smuggling migrants into Europe. Four of the suspects arrested during the action day had already been identified as High Value Targets who played a leading role in the criminal activities. The gang charged up to EUR 6 000 per person and smuggled more than 130 people from Turkey into Bulgaria and then on to other European destinations via the Western Balkan route.A total of 15 locations were raided in the region of the Bulgarian city of Plovdiv, with Europol experts as well as Romanian and Moldovan police officers deployed on the ground to support the Bulgarian authorities in their enforcement measures.As a result of these searches, law enforcement authorities seized 13 mobile phones, a weapon and ammunition, and documents for vehicles related to migrant smuggling incidents in Bulgaria.This action was carried out in the framework of a Europol-coordinated regional Operational Taskforce based in Sofia, which focuses on criminal networks smuggling migrants from Türkiye across Bulgaria towards Western Europe.An international network dedicated to migrant smugglingThe smuggling activities resembled a complex enterprise involving leaders, organisers and facilitators of different nationalities.The main leaders were Syrian and Jordanian nationals, who would coordinate the criminal activities with other smugglers located in Türkiye and along the Western Balkan route. Bulgarian nationals were responsible for the logistics, namely finding and purchasing cars used for the transportation of the migrants, and registering them under the names of other individuals in exchange for a small sum of money. The gang would also use Moldovan drivers recruited over the internet.Since April of this year, 17 migrant smuggling incidents linked to this gang have been identified. One of the main ringleaders was already known to law enforcement, having been investigated in the past for migrant smuggling activities in Austria and Croatia.From Türkiye to the Western Balkans using Moldovan driversThe irregular migrants would cross the border between Türkiye and Bulgaria on foot, using the services of guides provided by the organisers in Türkiye. After having crossed the border, they would be met by Moldovan drivers who would transport them to the Bulgarian-Serbian or Bulgarian-Romanian border.The drivers were provided with the cars and GPS coordinates and were sent during the night to pick up the migrants at agreed locations. The drivers would communicate with other members of the gang using mobile apps with disappearing messages. They would receive EUR 100 per person transported, averaging between EUR 700 and EUR 1 000 per journey.The migrants paid around EUR 6 000 to be smuggled into Bosnia and Herzegovina, and more than EUR 4 000 to be transported to Serbia.Europol supportEuropol’s European Migrant Smuggling Centre has been supporting the work of the Taskforce since its establishment.Extensive operational analysis was carried out to identify the different targets and map out their criminal activities. Europol also brought together the different countries involved to jointly prepare for the final phase of the investigation.Two Europol experts deployed to Sofia in the framework of the regional Operational Taskforce were on the ground during the action, helping the law enforcement authorities by providing real-time cross-checks against Europol’s databases.The following authorities took part in this action:Bulgaria: General Directorate Combating Organised Crime (Главна дирекция Борба с организираната пресъпност), National Police (Национална полиция), Border Police (Гранична полиция), State Agency National Security (Държавна агенция Национална сигурност), Gendarmerie Special operations and combating terrorism (Жандармерия, специални операции и борба с тероризма), District Prosecutor’s Office in Plovdiv (Окръжна прокуратура – Пловдив)Moldova: General Police Inspectorate (Inspectoratul General al Poliției)Romania: Border Police (Politia de frontiera) and Romanian Police (Poliția Română)

Leading up to the action day, authorities across Europe had seized counterfeit banknotes of various denominations (mostly 20, 50 and 100 euros) worth around EUR 950 000 before they entered circulation, all traceable to the same producer. Furthermore, the arrested counterfeiter is believed to be responsible for over 27% of all faked euro banknotes discovered and taken out of circulation in 2023 alone. The total face value of these banknotes is estimated at around EUR 8 million.Bunker-like printing laboratory in a private residenceThe Carabinieri’s anti-money forgery investigators, with the support of Europol’s experts, had been zoning in on the sophisticated print shop hidden in the city of Naples. When officers raided the location, they came across an almost industrial-like production line containing 31 digital printing machines and extensive quantities of raw materials used for the production of fake banknotes. The criminal had set up shop in his own home, hiding the production facility behind his garage. Concealed behind a cabinet, the forger had constructed a movable wall part on rails, which allowed him to access the printing lab when actuating a homemade electronic system.Authorities believe that the forger relied on several national and transnational distribution channels, the latter predominantly in France, to sell his counterfeit banknotes in denominations of 20, 50 and 100 euros. Expert analysis, including an assessment by the European Central Bank, confirmed that the counterfeit security features on the banknotes (such as holograms) were of high quality.Europol’s support to Italy and FranceEuropol facilitated the information exchange and financed and coordinated several operational activities. Europol also provided analytical support to identify the countries in which the banknotes were distributed. During the action day, Europol sent an expert to Italy to provide technical support and cross-check the operational information against Europol’s databases and the European Central Bank’s systems.Participating authorities:France: National Police (Police Nationale - Office central pour la répression du faux-monnayage (OCRFM))Italy: Carabinieri (Arma dei Carabinieri - Comando Carabinieri Antifalsificazione Monetaria (CCAFM))

A suspiciously dormant projectThe suspect’s company, which was registered in Spain, had reported hardly any commercial activity since its establishment. It had never developed any project, neither in Spain nor in any other country. However, between 2020 and 2022 the company reported two income streams for a total amount of over EUR 4.5 million. Further investigation showed that individuals close to the Equatorial Guinea government were among the beneficiaries of these sums.These payments were related to a contract signed in 2019 between the government of the African country and the Spanish company in order to start up a fishery products processing plant. Originally, the project was supposed to be completed within two years of the signing. The lawyer and owner of the company is now charged with corruption, money laundering, falsification of accounts and forgery of documents.Europol’s roleUsing SIENA, Spanish authorities shared their first insights with Europol, who then provided analytical support. On the action day, two Europol analysts supported the searches in Spain with a Virtual Command Post that had been set up in Europol’s headquarters in The Hague. Offering real-time operational support, the experts cross-checked the results of the house searches in Spain against Europol’s databases, thus providing further leads to the officers on the spot.Corruption is an insidious and often invisible threat, eroding the rule of law, weakening state institutions, and hindering economic development by distorting fair competition. You can read more about how Europol supports the fight against corruption in the European Financial and Economic Crime Threat Assessment 2023.

Several locations were also searched simultaneously in North Macedonia, where machines for the production of counterfeit currency, thousands of assembled coins, rings and core blanks were seized.The individual arrested is identified as an employee of the Ministry of Interior of North Macedonia. Authorities were alerted to the suspect’s activities through a coordinated intelligence-sharing effort.A joint investigation team (JIT) was established at Eurojust between the Special Prosecution Office of the Republic of Kosovo* on one side, and the Basic Prosecution in Skopje on the other, with the support of the Western Balkans Criminal Justice Project, hosted at Eurojust. Investigative activities carried out were supported by the Kosovo Police, the Investigative Centre of the Public Prosecutor’s Office Skopje and the Ministry of Interior of North Macedonia. Europol’s support was instrumental in this operation, providing critical intelligence analysis, operational coordination, and technical assistance to ensure the successful apprehension of the suspect.The coins seized during the searches will be further examined, comparing them to other coins already withdrawn from circulation to evaluate the real scale of the production.The EU central office for combating euro counterfeitingEuropol serves as the European Union's central office for combating euro counterfeiting, playing a pivotal role in safeguarding the integrity of the Eurozone's currency.As the hub for intelligence and operational support, Europol coordinates efforts across Member States to detect, investigate, and dismantle counterfeiting networks. The Agency provides specialised expertise, facilitates the exchange of critical information, and deploys advanced technological tools to track and analyse counterfeiting activities.The investigation was supported financially by the European Multidisciplinary Platform Against Criminal Threats (EMPACT).*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.

The Spanish National Police (Policía Nacional), supported by Europol, dismantled an organised crime network smuggling migrants with fast boats from Algeria to Spain. The suspects facilitated the further illegal movement of the migrants from Spain to other EU countries.Results from 4 and 5 June 2024:9 locations searched;21 arrests (13 in Madrid, 5 in Almeria, 1 in Guipuzcoa, 1 in Málaga and 1 in Murcia);Seizures including documents, electronic equipment and cash.Migrants paid up to EUR 20 000 to reach the EUInvestigations revealed that the criminal network smuggled at least 1 000 migrants (more than 750 Syrian nationals and over 250 Algerians). The network facilitated the illegal crossings of Syrian nationals along the route Lebanon – Egypt – Tunisia or Libya – Algeria. Upon arrival in Algeria, the migrants were placed in temporary accommodation while awaiting the launch of the boats. The suspects then organised the transport of the migrants with fast boats from Algeria to the Spanish coast. Once in Spain, members of the Algerian criminal cell facilitated the stay of the migrants and their further illegal movement towards other EU countries.Investigators identified two main organisers, one based in Algeria and one in Spain, who coordinated the criminal activities. The criminal network is believed to have had the capacity not only to transport the migrants to Spain but also to supply them with passports and plane tickets for their secondary movements towards other EU countries. In addition to smuggling activities, the criminal network also sold information to other groups on how to organise this type of criminal activity.Over 1 000 migrants on speed boats next to fuel cansThe criminal cell based in Madrid was responsible for organising the criminal activity in coordination with the criminal group based in Oran (Algeria). The latter orchestrated the launch of the fast boats with migrants, departing from the Algerian coasts of Oran and Mostaganem towards Spain. These sea crossings were extremely dangerous – migrants' lives were put at risk in overcrowded vessels that lacked safety equipment as well as food and water supplies and were loaded with fuel canisters. Upon arrival at the Spanish coast, the migrants were picked up by members of the criminal network based in the region. They were then transported to Madrid and placed in unsanitary and overcrowded housing while awaiting onward transport out of Spain. The migrants were charged up to EUR 20 000 for the full facilitation of their passage to the country of final destination. They were obliged to pay at every stage of the smuggling via the hawala underground financial system. Investigators learned that the criminal network used spy cameras and hidden microphones to guarantee the collection of money.Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to Spain to cross-check operational information against Europol’s databases and provide leads to investigators in the field.

The coordinated effort, named Operation GORGON, culminated in a series of raids carried out in Tirana, Albania, on 31 July against key figures within the criminal network. Significant assets were seized as a result, including real estate and EUR 1 million in cash.From contract killings to complex money launderingThis high-profile Albanian organised crime group was hierarchically structured, with branches operating internationally. The gang was mainly composed of family members and associates from the same area in Albania. The group’s members are suspected of being responsible for numerous contract killings, large-scale drug trafficking and the laundering of illicit profits via complex cryptocurrency transactions.Among those arrested features a prominent money launderer based in Tirana, who provided his services to several other top-level criminal groups engaged at an international level in murders, corruption and large-scale drug trafficking, among other criminal activities.The investigation also uncovered how the leader of this organised crime group and his associates ordered the killing of several members of other Albanian criminal groups by contracting hitmen. At least seven murders have been attributed to this specific criminal group between 2019 and 2020, a number of which have been carried out outside of Albania.Intelligence development by EuropolIn the framework of the analysis work carried out on SKY ECC data, Europol developed reliable intelligence on the activities of this gang.This intelligence was provided to the Albanian Special Prosecution Office for Anticorruption and Organised Crime (SPAK), which took immediate action and opened an investigation. Since then, Europol has provided continuous intelligence development and analysis in support of the national investigation, leveraging its comprehensive expertise by mobilising its various specialised centres.During the action day, three experts from Europol’s European Serious Organised Crime Centre and European Cybercrime Centre were deployed to Tirana to support the Albanian authorities with their enforcement actions.The following authorities took part in the investigation:Albania: Special Prosecution Office for Anti-Corruption and Organised Crime (Struktura e Posaçme Anti-Korrupsion), National Bureau of Investigation (Byroja Kombëtare e Hetimit), Albanian State Police (Policia e Shtetit)Belgium: Federal Police (Federale Politie)France: National Police (Police Nationale)The Netherlands: National Police (Politie)

An operation led by the Romanian Police (Poliția Română) and the Romanian Border Police (Poliția de Frontieră), supported by Europol and involving the Bulgarian General Directorate Combating Organised Crime (Главна Дирекция Борба с организираната престъпност), has resulted in the dismantling of an organised crime network involved in migrant smuggling. The suspects were smuggling migrants from Bulgaria to Romania and then to Western Europe. The investigation was also supported by Austria, Germany and Hungary.Results from 29 July 2024:9 locations searched (2 in Arad, 3 in Bucharest, 1 in Oradea and 3 in Timișoara);8 arrests (Romanian and Syrian nationals);32 migrants found in one of the safe houses searched (9 Iraqi and 21 Syrian nationals, as well as 2 others with unknown nationalities);Seizures include documents, electronic equipment and cash.Between EUR 5 000 and EUR 10 000 migrant smuggling fee to reach to Western Europe from TürkiyeThe investigations revealed that the criminal network, consisting mainly of Syrian and Romanian nationals, was operating from Bucharest and was using Timișoara as a hub for housing and facilitating the transport of migrants to Western Europe. The suspects recruited migrants from the Middle East, mainly Syria, who wanted to reach Western European countries, especially Germany.The leader of the criminal network, a Syrian national who had lived in Romania for three years, had strong ties with other key organisers based in Istanbul, Türkiye. He acted as a regional coordinator for migrant smuggling activities along that leg of the route. He allegedly recruited Romanian nationals, who usually worked as private taxi drivers, to transport the migrants. Between February and May alone, the Romanian authorities detected five smuggling incidents with a toral of 70 irregular migrants. The individuals were transported in lorries concealed between merchandises. Each migrant paid between EUR 5 000 and EUR 10 000 for the full smuggling services until the final destination.Cross-border cooperationEuropol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to Romania to cross-check operational information against Europol’s databases and to provide leads to investigators in the field. Europol also facilitated the deployment of investigators from Bulgaria to support the Romanian officers involved in the operational actions in the field.

The report highlights relevant trends in crime areas such cyber-attacks, child sexual exploitation and online and payment fraud schemes. It also provides an outlook of what can be expected in the near future, especially regarding new technologies, payment systems, AI, cryptocurrencies and illicit content online. Millions of victims exploited across the EU on a daily basisRecent law enforcement operations have prompted ransomware groups to splinter and rebrand under different disguises. Furthermore, continuous takedowns of forums and marketplaces on the dark web have shortened the lifecycle of criminal sites. This instability, combined with the surge of exist scams, has contributed to the fragmentation and multiplication of cyber threats. In 2023, millions of victims across the EU were attacked and exploited online on a daily basis:Ransomware groups increasingly target small and medium-sized businesses because they have lower cyber defences;E-merchants and banking institutions are the preferred targets of digital skimming attacks; Users continue to fall victim to phishing campaigns, business email compromise (BEC), investment and romance fraud; The number of cases of online sexual extortion targeting vulnerable minors is increasing.Multi-layered extortion tactics are increasingly common throughout the entire spectrum of cybercrime threats, as stolen data are at risk of being published and auctioned, making re-victimisation a threat. Offenders appear to be underage in many cases, and some have started leveraging AI, which is already becoming a component in their toolbox. The use of cryptocurrencies in a wider variety of crime areas has also become more noticeable. Cybercrime assisted by AI: what to expect in the near future?AI-assisted cybercrime has only begun: AI-assisted child sexual abuse material (CSAM) is a worrisome threat that will need close monitoring. Instances of AI-altered and completely artificial CSAM will pose growing challenges to law enforcement investigations, not only in terms of the volume of CSAM in circulation, but also to the ability of investigators to identify the true identity of victims and offenders.Abusing technologies: Mainstream end-to-end encryption (E2EE) communication platforms are increasingly used by offenders. The current regulatory framework for the protection of personal communications via E2EE creates digital challenges for law enforcement authorities’ lawful access to criminal communications. The future of crypto threats: The use of cryptocurrencies in a number of areas of crime has become more evident. Several developments in the cryptocurrency market are set to have a significant impact on criminals’ abuse of cryptocurrencies in the near future. Scammers could abuse the rise of exchange traded funds (ETFs) related to cryptocurrencies.  Digital challenges: law enforcement need to stay aheadTo tackle the main threats highlighted in the IOCTA 2024 quickly effectively, law enforcement needs the right knowledge, tools and legislation in place. As criminals adapt, law enforcement and legislators must also innovate to stay ahead, and seek to capitalise on new and developing technologies. This in turn requires training to produce the specialised capabilities required to investigate technically challenging or complex cybercrimes, such as those involving the abuse of cryptocurrencies or the dark web.Europol is addressing these digital challenges with its Strategy Delivering Security in Partnership. The agency is at the forefront of law enforcement innovation and acts as a knowledge platform for the provision of EU policing solutions in relation to encryption, cryptocurrencies and other issues. In doing so, Europol expands the toolbox available to law enforcement officers across Europe and beyond, increasing their technical and forensic capabilities. The European Cybercrime Centre (EC3) at Europol is the first port of call for cybercrime investigators. 

On 12 July, a pensioner was found murdered in his home in Herrsching, Upper Bavaria, Germany. The case sent shockwaves through the country, and an investigation was immediately launched by the Bavarian police to locate and arrest the suspected murderer.Through real-time intelligence exchange with its operational partners in Serbia, Europol developed reliable intelligence that the suspect had fled Germany and was hiding in France.Europol immediately provided this actionable intelligence to the German investigators and established coordination between the countries involved. The European Network of Fugitive Active Search Teams (ENFAST) was activated, connecting the different national units dealing with fugitive searches. This international police effort culminated in the arrest of the suspect in a coordinated operation in Aubervilliers, France, on the morning of 18 July. The suspect was taken into judicial detention and is currently awaiting extradition to Germany to face charges.The swift arrest of the alleged murderer underscores the power of international police cooperation, facilitated by Europol. Connecting over 3 000 different law enforcement authorities around the world, Europol provides the network and secure communication channels to close the net on criminals trying to evade justice by crossing borders.The following authorities took part in the investigation:-    France: French FAST team (OCLCO - Brigade Nationale de Recherche des Fugitifs), Judicial Police of the Paris Police Prefecture (BEDJ)-    Germany: Criminal Investigation Department of Fürstenfeldbruck,LKA Bavaria,BKA Germany -    Serbia: Ministry of the Interior of the Republic of Serbia - Police Department of Belgrade (MUP R. Srbije - Policijska uprava za grad Beograd) 

Europol has supported this investigation since August 2023. On 20 December 2023, authorities intercepted a sailboat in international waters off the coast of Martinique with 1 500 kilos of cocaine on board. Eight individuals, including the crew members and some involved through other means, were arrested that same day. Following this operation, in the framework of intelligence activities underway with its operational counterparts, Europol has been able to develop actionable intelligence regarding the drug trafficking activities of this organised crime group. This led to further investigations and operational activities involving 10 countries.The suspects were arrested as part of an international operation against drug trafficking led by the Spanish National Police (Policía Nacional). The Spanish authorities worked closely with the Norwegian Police, the United Kingdom’s National Crime Agency (NCA) and the United States Drug Enforcement Administration (US DEA) in the framework of an Operational Taskforce set up at Europol. The purpose of the taskforce was to target a drug trafficking organisation with links to the Western Balkan region which authorities suspected of shipping large amounts of cocaine to Europe.10 cocaine vessels operating between South America and the EUDuring the investigation, the agents identified a total of 10 vessels used by the organisation along the ‘drug routes’ and that the criminals had different bases of operations in Spain and South America. In Spain, they used Valencia, Alicante, Almería, Málaga and the Canary Islands as logistics points before setting sail to South America. In South America they used Brazil, Colombia, Guyana, Trinidad and Tobago, Saint Lucia, Barbados or Panama, to keep the sailboats ready to sail with the drugs. This system meant shipments could move as soon as the orders from the leader of the criminal network and his lieutenant were received.The cocaine would then be picked off the coast of the Caribbean islands by sailboats which would shortly after set sail towards Spain, from where the cocaine was distributed onwards to different EU countries by overland transport. The crew for the sailboats had been recruited in Norway by one of the leaders of the drug trafficking organisation, who Europol had designated as a High Value Target. This individual was among those arrested in Norway on 24 June.International cooperation via Europol to link drug seizures and traffickersThis operation was the culmination of many months of meticulous planning in preparation of the final phase of the action. The partners have been working closely together in the framework of a Europol Operational Taskforce to establish a joint strategy and to organise the extensive exchange of information.Europol provided continuous intelligence development to map out the targets and their criminal activity. The Agency also financed an operational meeting off-site in Madrid. During the action day, one Europol expert was deployed to Marbella (Spain) to assist with the swift analysis of data as it was been collected, helping adjust the operational strategy as required. In addition, Europol funded the exchange of Spanish and Norwegian police officers for the action day.  

During Pandora VIII, several thousand checks were carried out at countless airports, ports and border crossing points, as well as in auction houses, museums and private residences. Law enforcement also patrolled the web and conducted over 6 000 online checks, which led to the recovery of 580 stolen goods. Across the involved countries, around 113 criminal and 137 administrative cases are still ongoing, with more arrests and seizures anticipated.Operational highlightsPandora VIII led to the recovery of the following stolen artefacts, among others:In an investigation carried out by the Spanish National Police (Policia Nacional) in collaboration with the Security Service of Ukraine (Служба безпеки України), 11 items valued at more than EUR 60 million were recovered. The criminal case involved money laundering and illicit trafficking of archaeological gold items stemming from the ‘Scythian’ culture, which had been stolen in Ukraine and smuggled to Spain.In another case, the Spanish Guardia Civil of Córdoba, with the support and advice of archaeologists from the government of Andalucía as well as the Archaeological Museum of Sevilla, seized a private collection of over 350 objects. The collection consisted of lithic, ceramic and metal pieces from a variety of archaeological periods.Romanian Police (Poliţiei Române) recovered a wooden iconostasis dated between 1850-1880, which had been stolen from a church in Romania and attempted to be sold online. The Bulgarian Customs Agency (Агенция Митници) seized 432 ancient coins that came from Türkiye and were destined for France.In two investigations by the Hellenic Police (Ελληνική Αστυνομία), 43 ancient amphorae were seized and two people arrested.After performing online checks, the Polish National Police (Policja) located and seized 229 objects in an antiques store. Some of the items were made of ivory, and the total value of the 229 objects is estimated to be EUR 140 000.The Italian Carabinieri Command for the Protection of Cultural Heritage (Comando Carabinieri per la Tutela del Patrimonio Culturale) were able to identify and subsequently seize a contemporary painting that was being sold online. If authenticated, the painting would have had a value of approximately EUR 150 000. During the search, officers also found various counterfeit items.In a separate investigation, the Carabinieri seized over 2 000 fragments of ceramic and lithic artefacts such as arrowheads and spearheads. The ancient items stemming from the Neolithic and Bronze Age periods had been offered for sale online.The French Directorate-General of Customs and Indirect Taxes (Direction générale des douanes et droits indirects) seized an illegally-exported painting by the Vietnamese artist Mai Thứ (1906 - 1980) at Paris Charles-de-Gaulle Airport. The painting has an estimated value of EUR 167 440.Cooperating with other national partners, the Czech National Police (Policie České republiky) detected and checked sales of several stolen historical objects. Among others, a wooden statue of Saint Bartholomew (dated between 1658 and 1660) was secured and returned to its original owner. In 1994, this national cultural artefact had been stolen from the ‘Last Supper Chapel’ in Římov (České Budějovice) to be later sold online.International cooperation between countries and agenciesAs a co-leader of this operation, Europol played a key role by facilitating information exchange and providing analytical and operational support to the individual national investigations.INTERPOL supported Pandora VIII by facilitating the exchange of information between participating countries, notably with the Balkan countries. A dedicated officer was also available throughout the operation in order to check frontline seizures against INTERPOL’s Stolen Works of Art Database, and support officers on the ground in their use of the ID-Art App.Operation Pandora, which was first launched in 2016, is an annual law enforcement operation. It is carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).Participating countries:Albania, Austria, Bosnia and Herzegovina, Bulgaria, Czechia, Croatia, Cyprus, France, Germany, Greece, Ireland, Italy, Latvia, Malta, Montenegro, Netherlands, Norway, Poland, Portugal, Romania, Spain, Serbia, Sweden, Ukraine, United KingdomParticipating agencies:Europol, INTERPOL 

This week, Montenegrin authorities have arrested nine High Value Targets holding key positions in Western Balkan drug trafficking organisations. In total, 19 individuals were targeted in this action. Four received charges while in prison, and five others are still on the run. This action is the result of national investigations, cooperation, and information exchange through Europol between the Australian Federal Police and New South Wales Police, the Montenegrin Special Police Division (Specialno Policijsko Odeljenje), and the United States Drugs Enforcement Administration (DEA). The investigation was initiated after law enforcement intercepted 1.8 tonnes of cocaine shipments from Europe to Australia between 2020 and 2021. The targeted individuals were closely linked to various Montenegrin criminal cells active within a larger drug trafficking network spread across the Balkan region and beyond. Some of the suspects allegedly belong to one of the most notorious and violent Montenegrin clans, while others are suspected of leading their own independent criminal groups. One of the suspects, the leader of this criminal group, is allegedly responsible for multiple murders carried out during gang wars. The nine suspects were already known by law enforcement authorities, as they had appeared in a number of previous drug trafficking investigations. Investigators have identified that the networks where they played leading roles had developed a large logistics network to facilitate drug trafficking from the EU to Australia. They were able to supply cocaine from source countries and transport it for final distribution in European and Australian end markets. The action day on 17 July 2024 led to: 15 locations searched in Montenegro9 arrestsSeizures including documents, 22 firearms and 722 pieces of ammunitions, 15 vehicles, 2 vessels, luxury watches and cash. In recent years, Western Balkan criminal networks have increasingly targeted the Australian drug market, as the illegal proceeds of cocaine trafficking there are significantly higher than European markets. The supply route includes Colombia, Ecuador and Brazil, with transhipments via Southern Europe and Africa towards Australia. If one kilo of cocaine costs several thousand euros in the source countries, it could reach more than EUR 100 000 on the Australian black market.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall case coordination among various agencies in the EU and beyond.  

Europol supported two major operations against the trafficking of illegal pesticides in the EU. The first investigation targeted a company importing counterfeit pesticides from China, replicating the products of a well-known multinational company. The investigation involved the Italian Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri, NAS) of Padova, the Romanian National Police (Poliția Română) and Eurojust. In another investigation against illegal pesticides, the Spanish Civil Guard (Guardia Civil) and the Portuguese National Republican Guard (Guarda Nacional Republicana) targeted a Spanish company illegally importing Portuguese pesticides banned in Spain under the cover of fake denomination of the products. Counterfeit pesticides are largely sold on the black market. They are cheaper than the genuine products, but still effective. However, their negative impact on the environment is severe, and often underestimated by consumers.Cheap but toxic fake pesticides taken off the black marketIn January 2022, following an inspection in the framework of operation Silver Axe, the Italian NAS Carabinieri of Padova found counterfeit pesticides imported from China. The counterfeit pesticides were replicas of the genuine products, but contained larger quantities of the active ingredient Lambda-Cyhalothrin.The demand for these counterfeit pesticides on the black market was very high, as they were sold for a significantly lower price than the genuine products. The criminal network operating both in Italy and Romania illegally imported fake or banned products from China and Singapore, selling them as bio or organic fertilisers and pesticides, usingfake labels. The substances were all banned in the European Union due to their high levels of toxicity.The investigation led to two action days on 24 and 25 June in Italy and Romania. During the raids, the national authorities arrested one suspect, searched ten locations and gathered evidence of large-scale fraud, forgery and tax evasion. These actions were executed under a Joint Investigation Team, set up by Eurojust to facilitate the judicial cooperation between authorities. Europol facilitated the information exchange and operational cooperation, leading to the development of further investigative leads. Action against banned pesticides poisoning nature reserves in SpainIn another investigation, Europol supported the Spanish and Portuguese authorities in targeting a Spanish company, which purchased Portuguese pesticides banned in Spain. The ensuing investigations found that the suspects had imported over 12 tonnes of toxic substances banned in Spain, many of which were also banned across the EU, with a potential illegal turnover of up to EUR 7 million. The authorities are now investigating two legal entities and four individuals in connection with this trafficking. The company covered the product with names of products and substances, registered in Spanish databases, to create the appearance of legal merchandise. They also purchased legal pesticides to hide the additional illegal pesticides. The Spanish authorities detected the illegal products and performed laboratory tests to determine their composition, which was later confirmed in a lab test. The tests revealed the illegal substances the fake pesticides contained, one of which was Chlorpyrifos, an organophosphate insecticide which has been banned in the European Union since 2020.The banned pesticides were used in different farming facilities, some of which were located in protected areas, such as the Doñana National Park. This national park is one of the most significant ones in Spain. The illegal use of pesticides was posing significant threat to this park’s habitat, wetlands and underground water reserves. Europol facilitated the exchange of information and provided continuous analytical support to both investigations. On the action days, Europol deployed experts in the field to cross-check operational information in real time and provide experts with possible leads and technical support.

Migrant smuggling and human trafficking networks are highly adaptive and exploit geopolitical events, including economic and social crises to maximise their illegal profits. These networks swiftly identify criminal opportunities offered by the digital environment and take advantage of them to increase their illegal proceeds. Criminals abuse social media platforms, mobile applications, and cryptocurrencies to offer their illegal services, manage logistics and payments, and secure profits.In 2015, the European Union was confronted with an unprecedented migratory crisis. In response, in 2016, Europol increased its support to national law enforcement authorities with the creation of a dedicated hub – Europol’s European Migrant Smuggling Centre – to facilitate closer cross-border cooperation and the rapid exchange of operational information. In 2023 alone, Europol supported 223 operations against migrant smuggling and human trafficking networks. The agency also provided national law enforcement authorities with 1 231 operational reports to advance their investigations in 2023. Europol has further developed the concept of Operational Task Forces (OTFs) in this crime area, with 11 OTFs targeting migrant smuggling and human trafficking networks.    Main threats and developmentsInvestigations into migrant smuggling and trafficking in human beings reveal a complex and dynamic criminal environment in which actors take advantage of existing infrastructures and engage in multiple illegal activities. These criminal networks also engage in a number of other criminal activities, such as drugs and arms trafficking, document fraud and violence. Migrant smuggling and trafficking in human beings are interconnected, especially in cases where irregular migrants are in debt to their smugglers and end up in labour or sexual exploitation schemes to pay the smuggling fees. The links between migrant smuggling, terrorism and the financing of terrorism are of particular concern.The main characteristics of the criminal networks involved in migrant smuggling and human trafficking:Strong links to other crime areas and crime enablers;High flexibility and adaptability;Abuse of geopolitical, economic, environmental and social crises;Intense cooperation with other criminal networks across borders within and outside the EU; Extension of violence towards irregular migrants, law enforcement, competitors and within the criminal networks themselves;Increase in the digitalisation of core components of criminal activities.Strong partnerships to combat criminal networks globally In April 2024, Europol hosted the conference “Tackling migrant smuggling in the digital domain” under the umbrella of the European Commission initiative Global Alliance to Counter Migrant Smuggling. During this event, over 100 experts from EU Member States, third party countries, agencies and international organisations met to discuss the challenges and possible responses to migrant smuggling enabled by the use of online platforms.In June 2024, the Spanish National Police hosted the Europol’s European Migrant Smuggling Centre’s Annual Conference in Madrid, attended by representatives from law enforcement authorities in the Member States and operational partner countries, from EU agencies and bodies, international organisations, as well as from the private sector. The meeting focussed on the current threats and challenges faced by investigators. The conference also furthered the exchange of good practices and difficulties in investigating the digital dimension of migrant smuggling, aiming to strengthen the EU’s tools in the fight against this criminal threat. 

Between 2 and 3 July, a dozen searches of homes, company headquarters, commercial warehouses and restaurants were carried out. The searches involved some hundred Spanish police officers who were supported on the ground by French Judicial Customs investigators and Europol experts. The searches took place in Madrid, Valencia, Alicante, and Barcelona.The head of the criminal network is among those arrested. Close to EUR 160 000 in cash was seized during the searches.The investigation was initiated in February 2021 by the French authorities after the French Customs in Perpignan seized more than half a million euros in cash hidden in a vehicle equipped with a concealed compartment.The investigation conducted by the French National Anti-Fraud Office (ONAF) under the direction of the specialised interregional jurisdiction (JIRS) of Marseille resulted in the  uncovering of a money laundering network. Composed of Chinese nationals, the criminal network is believed to have been operating across Europe since at least 2019. This prolific criminal network is believed to have had the capacity to smuggle over one million euros in cash per day.These sums came from a number of illegal activities, including the trafficking of counterfeit goods, tax and customs fraud, and prostitution. The criminal network relied on a sophisticated network of logistic experts who would facilitate the movement of the cash across Europe.This operation was carried out with the financial support of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).The following authorities took part:France: National Anti-Fraud Office (Office national anti-fraude – ONAF)Spain: National Police (Policía Nacional) 

This coordinated operation, which was led by authorities in Switzerland and the United Kingdom, took place on 27 June 2024. The operation involved law enforcement agencies from 18 countries, working in tandem with Europol’s European Union Internet Referral Unit (EU IRU) and major online service providers.The Referral Action Day targeted a wide range of antisemitic content, including hate speech, Holocaust denial, and the glorification of violence against the Jewish community. The primary objective was to remove illegal content and ensure that online platforms adhere to European regulations concerning hate speech and discrimination.In total, close to 2 000 pieces of antisemitic content were identified and referred by Europol and the participating countries to online service providers for removal.The focus of the Referral Action Day stems from the rise of widespread antisemitism justified and cultivated in Jihadi-spheres and right-wing, as well as left-wing, extremist groups online. This antisemitic content is also spread by non-affiliated individuals on various online platforms. This surge in hate speech was triggered by the 7 October attack by the Hamas terrorist organisation against Israel and the subsequent Israeli military response.National Internet Referral Units and specialised police units from the following countries took part in this Referral Action Day:Albania, Austria, Bosnia-Herzegovina, Denmark, France, Germany, Hungary, Ireland, Italy, Lithuania, Malta, Portugal, Romania, Spain, Sweden, Switzerland, Ukraine and the United Kingdom. 

The paper delves into the problems that Home Routing creates for law enforcement agencies in carrying out their duties, as well as presents possible avenues for safeguarding and maintaining law enforcement’s ability to protect citizens and investigate criminals. What is Home Routing?Home Routing makes it possible for a telecommunication service provider to (continue to) provide a service to a customer when they travel abroad. This means that when a customer travels internationally, their communications (calls, messages and data) are still processed through their home network rather than the network of the country they are visiting.Consequently, this means the service provider abroad is not able to deliver communication data to law enforcement upon a judicial request, if the domestic service provided has enabled PET in Home Routing.Once Home Routing is deployed, any suspect using a foreign SIM card can no longer be intercepted. This problem occurs both when a foreign national uses their own (foreign) SIM card in another country, and when citizens or residents use a foreign SIM card in their own country. The only current exception for this is when a domestic service provider (to whom domestic interception orders can be sent) has in place a cooperation agreement which disables PET in Home Routing with the service provider of another country.Why is this a problem?Criminals know of this loophole, and have been abusing it to evade law enforcement. This creates an uneven equilibrium between malicious actors and law enforcement, whose capabilities at this point do not allow for them to carry out the duties society has entrusted them with.In the case of Home Routing, a national interception order cannot be enforced across borders. Instead, a European Investigation Order can be issued, but a response can take up to 120 days, which is too long when emergency interception is needed. In addition, being dependent on the voluntary cooperation of a foreign service provider for the exercise of national investigatory powers is undesirable.Way forwardWith this position paper, Europol wishes to open the debate on this technical issue, which at present is severely hampering law enforcement’s ability to access crucial evidence.A solution must be found that enables a country’s authorities to lawfully intercept the communications of a suspect within their territory, while not impeding secure communications disproportionately.The paper offers key elements which should be considered as part of the societal response, looking at operational, technical, privacy and policy aspects.Digital challengesThis position paper is part of a series of Europol publications which are pivotal in anticipating technological innovations and the resulting modifications in the security landscape.At Europol, we take our responsibility as the EU Agency for law enforcement seriously; the fundamental role of policing in democratic societies has always been to keep the public safe.To achieve this, we need to strike a balance between harnessing technical innovation for social good, such as protecting privacy rights, while preventing it from being abused for criminal purposes.Find out more about the Digital Challenges.

Abuse by cybercriminals Cobalt Strike is a popular commercial tool provided by the cybersecurity software company Fortra. It is designed to help legitimate IT security experts perform attack simulations that identify weaknesses in security operations and incident responses. In the wrong hands, however, unlicensed copies of Cobalt Strike can provide a malicious actor with a wide range of attack capabilities.Fortra has taken significant steps to prevent the abuse of its software and has partnered with law enforcement throughout this investigation to protect the legitimate use of its tools. However, in rare circumstances, criminals have stolen older versions of Cobalt Strike, creating cracked copies to gain backdoor access to machines and deploy malware. Such unlicensed versions of the tool have been connected to multiple malware and ransomware investigations, including those into RYUK, Trickbot and Conti.Cooperation with the private sector Cooperation with the private sector was instrumental in the success of this disruptive action. A number of private industry partners supported the action, including BAE Systems Digital Intelligence, Trellix, Spamhaus, abuse.ch and The Shadowserver Foundation. These partners deployed enhanced scanning, telemetry and analytical capabilities to help identify malicious activities and use by cybercriminals.  This novel approach is possible thanks to Europol’s amended Regulation which has strengthened the Agency’s capacity to better support EU Member States, including by collaborating with the private sector. Through this novel approach, Europol can gain access to real-time threat intelligence and a broader perspective on cybercriminal tactics. This partnership enables a more coordinated and comprehensive response, ultimately enhancing the overall resilience of the digital ecosystem across Europe.Europol supportEuropol’s European Cybercrime Centre (EC3) has been supporting this case since September 2021 by providing analytical and forensic support, and facilitating the information exchange between all the partners.Law enforcement used a platform, known as the Malware Information Sharing Platform, to allow the private sector to share real-time threat intelligence with law enforcement. Over the span of the whole investigation, over 730 pieces of threat intelligence were shared containing almost 1.2 million indicators of compromise.In addition, Europol’s EC3 organised over 40 coordination meetings between the law enforcement agencies and the private partners. During the week of action, Europol set up a virtual command post to coordinate law enforcement action across the globe. The disruption does not end here. Law enforcement will continue to monitor and carry out similar actions as long as criminals keep abusing older versions of the tool.The following authorities were part of the investigation:Australia: Australian Federal Police (AFP)Canada: Royal Canadian Mounted Police (RCMP)Germany: Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Politie)Poland: Polish Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)United Kingdom: National Crime Agency (NCA)United States: U.S. Department of Justice, Federal Bureau of Investigation (FBI)Authorities in the following countries supported the disruption activity: BulgariaEstoniaFinlandLithuaniaJapanSouth Korea  

Increase of child sexual abuse material onlineThe production and distribution of child sexual abuse material has become increasingly reliant on the Internet, contributing to the proliferation of this crime. Over the past three years, Europol’s database of images and videos has grown by more than 20%. Today, a phone camera has replaced the complex filming setups of past decades, enabling offenders to produce and distribute material almost simultaneously. They use end-to-end encryption applications to exchange child abuse material. Live-streaming platforms facilitate live-streamed child sexual abuse, while encrypted applications enable communication between traffickers and buyers.These technological advancements hinder investigators' efforts to identify victims and perpetrators. Additionally, AI-generated imagery further complicates efforts to safeguard children. The use of encryption by offenders and AI-generated child sexual abuse material highlights how technological developments pose additional challenges to law enforcement in ensuring public safety.Public contributions neededThe exponential increase in online child sexual abuse material means new strategies and techniques are needed in order to combat this crime. Cooperation between private and public actors is crucial to overcoming the digital challenges posed by the criminal use of new technologies. Law enforcement are exploring new technologies to help process the vast amounts of images and videos, identify series imagery depicting the same child, and narrow down the country of production to find the abusers and the children, some of whom are still in harm's way.Despite these efforts, many victims remain unidentified. Victim identification specialists scrutinise images and videos frame-by-frame to find anything that could lead to the origin, location, or identity of the victim. Some background elements, like streets, TV programs, or logos, are easily recognisable, while others are difficult and country-specific. Public assistance through tips sent via the Trace an Object Campaign can help Europol’s victim identification specialists and national law enforcement authorities narrow down the image to a country, identify the offender, and ultimately save a child.

In the early hours of 2 July, law enforcement authorities in Italy, Spain, Germany, Belgium and Ukraine raided 13 properties. As a result, seven suspects were arrested in Italy, three in Spain, one in Belgium, one in Germany and one in Ukraine. The probe was coordinated by Europol and Eurojust, and follows an investigation into large-scale drug trafficking and money laundering.Smuggling, and attempted escapes by roadThe criminal network was composed of individuals of multiple nationalities, including Italians, Spaniards, Argentineans and Colombians, who worked together to carry out their criminal deeds. The investigation uncovered how this Italian criminal network used lorries to smuggle large quantities of hashish from Spain to Italy.One of the main targets, feeling the heat from law enforcement, escaped to Ukraine by car. He hid there for several months, until his hiding place was identified thanks to the cooperation between Europol and the Italian and Ukrainian authorities. He was subsequently arrested on 2 July.Building a case through cooperationEuropol has been actively supporting the case since October 2022, bringing together investigators from across Europe to agree on a joint investigative strategy and prepare for the final phase of the action. The Agency provided continuous intelligence development and analysis to support the national investigations. More than 130 messages have been exchanged by the involved law enforcement authorities and Europol via Agency’s secure platform. Part of that support provided by Europol included the identification of suspects monitored during physical surveillance.During the action day, a Europol expert was deployed to Italy to assist the national authorities with their enforcement measures, and to facilitate the tactical cooperation amongst the concerned countries in real time.Judicial coordination on the dayTo ensure that the criminal group could not avoid justice, Italian authorities used Eurojust’s services to ensure that investigations could take place in other countries and house searches and seizures were executed. During the action, a coordination centre was set up at Eurojust to ensure the smooth running of the actions across Europe.The investigation and the Action Day have been supported by the @ON Network funded by the EU (Project ISF4@ON) led by the Italian Antimafia Investigation Directorate (DIA).The following authorities took part in the investigation:Belgium: Federal Judicial Police (Federale Gerechtelijke Politie, Police Judiciaire Fédérale)Germany: State Criminal Police Office of North Rhine-Westphalia (Landeskriminalamt Nordrhein-Westfalen)Italy: Carabinieri (Arma dei Carabinieri)Spain: National Police (Policía Nacional)Ukraine: National Police (Національна поліція України)

Some of the at least 84 confirmed victims lost their life savings when the criminals coerced them into handing over their money at their doorsteps. Spanish National Police (Policía Nacional), the Mossos d’Esquadra and the Portuguese Judicial Police (Policía Judiciária) conducted 19 raids, seizing important digital and physical evidence of the crimes. One of the main targets was caught red-handed and arrested; when police entered the house, he was sitting in front of his computer with the bank details of one of his victims up on the screen. In addition to collecting computers, laptops, mobile phones, SIM cards and freezing bank accounts, officers on the scene also found cannabis and cocaine in the searched premises.Initial vishing led to pressure tactics at victims’ doorstepsUsing a proven modus operandi and dividing the work between specialised members, the criminal network systematically targeted elderly Spanish citizens. Posing as a bank employee, a criminal would contact the victim and convince them there was a problem with his or her bank account. Referred to as ‘vishing’, a portmanteau of ‘voice’ and ‘phishing’, this criminal tactic is typically conducted over the phone.To learn more about how to avoid falling victim to this type of crime, take a look at our prevention guide.Having extracted some basic information, the impersonator shared it with other members of the criminal network, who would appear at the victims’ doorsteps. Pressuring the victims with scare tactics and social engineering, the fraudsters would take possession of payment or credit cards and extract PIN codes and bank details. In some cases, the criminals also forced their way into victims’ homes, stealing cash and valuables such as jewellery. As a final step in this criminal process, the perpetrators used the stolen cards to make ATM withdrawals or expensive purchases, while the bank details were misused for so-called account takeovers.The funds were deposited into multiple Spanish and Portuguese accounts controlled by the fraudsters, from where they were funnelled into an elaborate money-laundering scheme. An extensive network of money mules overseen by specialist members of the organisation was used to disguise the origin of the illicit funds.Fast and hard action against the criminal groupUsing Europol’s analytical and coordination capabilities, investigators from Spain and Portugal met for operational meetings and worked with Europol experts to draw up an intelligence picture. The criminal network’s structure was unveiled piece by piece, until the decisive blow could be planned and executed. Europol specialists were deployed alongside Spanish law enforcement to provide analytical and forensic support on the action day.As investigators closed in on the suspects and monitored their conversations, they heard them planning to use severe violence as a last resort to rob the victims. To halt and prevent potentially violent home invasions from occurring, the joint law enforcement effort prioritised the dismantling of this dangerous criminal network. This led to a fast-tracked action day in which the fraudsters across Spain and Portugal were taken down. 40 suspects were taken into custody in Spain, and 3 are being detained in Portugal and are awaiting extradition to Spain.Participating countries:Spain: National Police (Policía Nacional); Mossos d’EsquadraPortugal: Judicial Police (Polícia Judiciária)

Between 24 and 28 June 2024, Europol hosted an operational sprint targeting buyers of live distant child abuse material. The sprint brought together representatives from Austria, Belgium, France, Germany, the Netherlands, Spain, Sweden, Norway, the United Kingdom and the United States. During the sprint, 32 investigators processed and developed leads generated from investigations of United States Homeland Security Investigations (US HSI) into criminal networks sexually exploiting children in the Philippines. The investigators analysed tens of thousands of child sexual exploitation images and videos, along with over 10 million lines of online conversations between approximately 12 000 unique criminal customer accounts and 100 seller accounts. The operational sprint resulted in the production of information packages, which may lead national authorities of 24 countries to 197 buyers of live distant child abuse.Global coalition to identify the networks behind live-streamed child sexual abuseThe information analysed during the sprint came specifically from operations against those who produce and distribute child sexual exploitation material through live-streaming platforms. The sprint allowed investigators to learn and collaborate in person, turning raw data into actionable information in real-time.The investigators gathered during the operational sprint worked on huge volumes of data, which had been generated over 12 years. As each criminal buyer and trafficker is arrested, their digital footprint - such as chats, transaction data, location data, and IP addresses - is used to investigate more trafficking networks and rescue more children. The one-week operational sprint at Europol aimed at identifying criminal buyers around the globe who use live-streaming platforms to pay traffickers to abuse children. Some of the abused children are believed to be as young as three to four years of age.Live-streamed child sexual abuse is a growing industry, involving child traffickers in the Philippines and elsewhere who curate a vetted customer base of buyers who pay to watch the live-streamed abuse of children. Criminal buyers direct child traffickers to perform acts of sexual abuse on minor children in real-time during private webcam interactions. Customers also travel to the Philippines to engage in the hands-on abuse of victimised children themselves. Abuse happens over encrypted connections, leaving little digital evidence, which created serious difficulties for investigators targeting child abuse online.With traffickers and victims in one country and criminal buyers living around the world, cooperation between national authorities is crucial to combat online child abuse. Europol hosted the sprint at its Headquarters in The Hague, facilitated the information exchange, and provided analytical support.The US HSI operations have been supported by the Child Rescue Coalition, the Tim Tebow Foundation, and the International Centre for Missing and Exploited Children.National authorities involved:EU Member States:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt)Belgium: Federal Police (Police Fédérale)France: National Police (Police Nationale)Germany: Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Politie)Spain: National Police (Policía National)Sweden: Swedish Police Authority (Polismyndigheten)Denmark: Danish Police (Politi)Non-EU Member States:Norway: National Police (Politiet)The United Kingdom: Metropolitan Police, North Umbria Police, West Midlands PoliceThe Unites States: Homeland Security Investigations

Of the many key milestones along the road, 2010 marks a particularly important date as Europol officially became a full EU Agency within the EU’s competence. Following the terrorist attack in Paris in November 2015, Europol’s Director Rob Wainwright (United Kingdom) set up the counterterrorism Task Force Fraternité. This Task Force led to the launch of the European Counter Terrorism Centre (ECTC) in 2016. Other centres that followed this example were the European Migrant Smuggling Centre (EMSC), European Serious Organised Crime Centre (ESOCC), and the European Financial and Economic Crime Centre (EFECC). The European Cybercrime Centre (EC3) was already created in 2013. In 2019, we were mandated by ministers from all EU Member States to create an Innovation Lab to support the law enforcement community in the area of innovation. Read more about Europol’s history on our website.Serious and organised crime has changed since 1999 and adapted to new technologies and a globalised world. Between 1999 and 2024, we witnessed the advent of the Internet, cybercrime, cryptocurrencies, as well as 3D-weapons printing, and more recently AI and quantum computing. Fast-forward to today, with Executive Director De Bolle at the helm, we continue to provide a first-level response to law enforcement and initiate relevant emergency protocols on a 24/7 basis. One of the many successful cases in which we supported EU Member States was Operation LIMIT, in 2021, in which Europol supported investigators in Belgium, France and the Netherlands in blocking the illegal use of Sky ECC encrypted communication by large-scale organised crime groups. More of our key achievements and ways of working are listed in the Europol In Brief, published today to mark our twenty-fifth anniversary. This publication highlights key facts and figures about Europol in 2024. As of today, we have almost 300 liaison officers from EU Member States and third parties, such as international organisations and law enforcement authorities from outside the EU, working with us. Our workforce now stands at over 1 700 people, and we have over 3 000 secure lines to competent law enforcement authorities via our secure information exchange network application, (SIENA).Our recently-adopted new strategy ‘Delivering Security in Partnership’, provides six objectives that highlight the change in our work since we started 25 years ago. The strategy outlines how Europol will update its capacities to support complex, cross-border law enforcement investigations and analyse an increasing amount of relevant data. Europol’s six objectives will guide the organisation in implementing our main goals and vision, and in delivering a unique set of operational services.Throughout the rest of this special year for Europol, a number of events and activities will take place to celebrate our anniversary. The events will culminate in September with the European Police Chiefs Convention organised at Europol’s headquarters. 

The large-scale law enforcement operation led to the arrest of 42 suspects - including the kingpin of the gang, who was in Spain under a false identity. In addition, 28 searches were conducted at several locations in Granada, Málaga and Sevilla, in both residences and drug production facilities. Six indoor marijuana plantations were also dismantled.Overall, the action resulted in:42 arrests28 searches (20 in Granada, 6 in Málaga, 2 in Sevilla)Seizure of more than 2 tonnes of cannabis and several quantities of other drugs such as hashishThree firearms and a multitude of cartridges sizedSeizure of a dozen luxury vehicles and more than EUR 100 000 in cashEuropol provided law enforcement authorities with analytical support to bring the investigation forward. On the action day, a specialist from Europol’s European Serious Organised Crime Centre was deployed on the spot, where they worked side by side with Spanish, French and Turkish authorities.Shifting from heroin to other drugsThe investigation revealed that the criminals were specialised in the transnational trafficking of narcotics and had been importing drugs to Spain for years, including heroin but also large quantities of cannabis and hashish. Once in Spain, they would distribute them across the EU.Heroin trafficking to the EU currently relies on the use of global container transport and ferries departing from Türkiye. This is because the criminal networks dominating the wholesale trafficking of heroin to the European market mainly originate from there.Investigators believe that the criminal network began its cannabis trafficking after initially focusing on heroin. This shift to other drugs was flagged on the EU Drug Markets Analysis 2024 report as a potential result of the political changes in Afghanistan, the main source of the heroin consumed in Europe. In 2022, the Taliban announced a drug ban that led to market changes, precipitating a decrease in heroin availability in the EU that could lead to market gaps being filled by other drugs.Law enforcement authorities involved:France: French Customs (Douane – Finances)Spain: Spanish Guardia Civil (Guardia Civil)Türkiye: Counter Narcotics Department of the Turkish National Police (Türk Polis Teşkilatı)

Building on the operation’s successful previous iterations, the proven multidisciplinary approach involved Europol, Frontex and INTERPOL along with police forces and border guards from several continents. This year, one aim was to identify and disrupt the most-threatening criminal networks active in the EU, such as mafia-type, ethnicity- and family-based organisations and other structured networks engaged in trafficking of human beings. Within the criminal phenomena of sexual exploitation, forced begging and forced criminality, law enforcement put a special emphasis on targeting cases involving children as victims.Similar to actions carried out in the years prior, this large-scale and jointly-executed action aimed to encourage authorities to conduct targeted activities within their respective countries and collectively with each other for a week, but also to draw attention to this despicable crime. The results of these joint action days reached not only the authorities, but also many other external stakeholders who may have a part to play in reducing the number of victims of human trafficking.Jean-Philippe Lecouffe, Deputy Executive Director of Europol, Operations Directorate, said:Close and efficient cooperation between law enforcement and border protection authorities on an international level is key in targeting those who exploit the most vulnerable among us. The impressive results of this year’s EMPACT joint action days show that the despicable crime of human trafficking is best fought together. For this, I express my gratitude to all countries and partners that once again joined forces with Europol in this global endeavour to take down these criminal networks.Lars Gerdes, Deputy Executive Director for Operations at Frontex, said:Human trafficking is an abhorrent crime that preys on the vulnerable and undermines our shared values of human dignity and freedom. Detecting these crimes is incredibly challenging due to the frequent absence of victim testimonies, leading to a significant number of unreported cases. This is why our international cooperation with Europol, Interpol, Austria and over 39 countries worldwide is so crucial.Richard Chambers, INTERPOL Director, Organized and Emerging Crime, said:Operations such as GLOBAL CHAIN demonstrate that no country or continent is immune to trafficking and exploitation. Whether committed by family members or highly-organised crime groups, the impact on victims is devastating. As a global law enforcement community, we are committed to sharing the vital intelligence needed to bring all perpetrators to justice.276 new investigations launchedOverall results of the EMPACT joint action days:362 suspects identified;219 perpetrators arrested;1 374 (1 221 adults, 153 children) victims identified and assisted;2 074 criminal assets such as cash or devices seized;363 fraudulent documents detected;over 276 new investigations initiated.In addition to the fight against child trafficking and the most-threatening criminal networks, this international law enforcement effort saw several targeted focal points against the trafficking of human beings across the world. This included actions in Latin America, Asia, Africa as well as Eastern Partnership countries and Ukraine.During inspections conducted across the globe, officers would systematically look for signs of trafficking as well as forged documents, then arrest perpetrators and safeguard victims immediately. The inspections also resulted in the launch of several new investigations. In order to cross-check data and allow for the exchange of information between the participants, a coordination centre was established in the Frontex headquarters in Warsaw, Poland. Along with experts from each country, Frontex, Europol and INTERPOL personnel helped coordinate the large-scale action week, which was supported by the EU4FAST project.Successful operations executed across the globeThe following examples provide insight into the diverse nature of the national operations against human trafficking that were successfully conducted in the context of the EMPACT action week.In a particularly gruesome case, officers of the Szabolcs-Szatmár-Bereg Police Department (Szabolcs-Szatmár-Bereg Vármegyei Rendőr-főkapitányság) arrested a Hungarian couple for forcing six of their own children into sex as well as begging on the streets in their village. The underage children were physically, mentally and sexually abused by their own parents, with their own father assaulting them with sticks, belts and his bare hands. Officers found the children neglected, underfed and in an overall bad health condition. Tying them up in a room in the household, the parents offered their children to other persons in the neighbourhood to have sex against payment. Judicial, medical and psychological experts have been involved in confirming the sexual abuse and taking testimony of the traumatised children, who since have been safeguarded and placed under foster care.Officers from the Hungarian National Bureau of Investigation THB Unit (Nemzeti Nyomozó Iroda Emberkereskedelem Elleni Osztály) were deployed to Austria to carry out joint police checks with members of the Austrian Criminal Intelligence Service and Provincial Criminal Police Departments (Bundeskriminalamt; Landeskriminalämter Wien und Niederösterreich). The teams conducted targeted checks in red-light establishments, focusing on Hungarian sex workers. Europol facilitated and financially supported this staff exchange.Officers of the Galati Brigade for Countering Organized Crime of the Romanian Police (Poliţiei Române - Brigada de Combatere a Criminalitatii Organizate Galati) arrested one suspect for recruiting underage victims from disadvantaged backgrounds, forcing them into begging and sexual exploitation. The collected revenue was withheld by the trafficker, who used physical violence to control his victims. In a raid conducted during the action week, officers collected further evidence and questioned suspects and victims. In one of the searched locations, law enforcement officials also found and seized various narcotics.In an effort to raise awareness about this crime area, the Irish National Police (An Garda Síochána) spoke to thousands of passengers as they disembarked their trains in Dublin. Garda members were actively looking for human trafficking indicators and informing the public about the crime area. While no victims were identified, the initiative generated great engagement from the public.The National Police of Ukraine (Національна поліція України) dismantled an organised criminal group targeting vulnerable persons. Three suspects have been identified for controlling and coercing twelve victims and forcing them to beg. In another case, officers arrested a person who forced a disabled person into marriage with a man so he could achieve a deferral of his mobilisation. The victim has been safeguarded by Ukrainian authorities.Vietnamese authorities uncovered a human trafficking scheme involving a Chinese interpreter working for a company in Laos. The suspect lured 14 Vietnamese individuals with promises of high-income overseas jobs, only to force them into creating fraudulent online accounts for financial scams. Victims worked 12-hour workdays, extended to 14 hours if they failed to recruit others, and had their documents confiscated. Families were extorted up to USD 10 000 to secure their return to Vietnam. This case further highlights the trend of human trafficking for forced online fraud, first detected by INTERPOL in Southeast Asia during Operation Storm Makers in March 2022, and later in other regions, leading to the publication of an INTERPOL Orange Notice.Participating countries:Albania, Austria, Belgium, Bosnia and Herzegovina, Brazil, Bulgaria, Colombia, Croatia, Cyprus, Denmark, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Kosovo*, Latvia, Lithuania, Malta, Moldova, Montenegro, Netherlands, Nigeria, North Macedonia, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Thailand, Ukraine, United Kingdom, Vietnam*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.Participating agencies:Europol, Frontex, INTERPOL

The action day on 24 May 2024 in Almería led to:5 arrests including the suspected leader (1 Spanish, 2 Russian and 2 Ukrainian nationals)14 victims identified5 locations searchedSeizures including two luxury vehicles, in cash, electronic equipment, employment contracts for jobs in the service sector, and other various documents linked to the club where the victims were exploitedThe criminal group, active since 2020, recruited its victims online, mainly through social media platforms while presenting themselves as managers in a recruitment agency. The victims were lured with job offers for hostesses and front-of-house roles. The alleged traffickers then exploited the women, mainly Ukrainian, but also Belarusian nationals, in a prostitution club in El Ejido (Almería), Spain.The victims were targeted based on their nationality and brought to Spain with tourist visas, while being promised legitimate work in the entertainment and tourist industry. Once in Spain, they were instructed to apply for temporary protection due to the war in Ukraine. Following this process, the victims were granted residency in Spain. The young women were promised work authorisation benefits that come with this protection.However, they were deceived by the suspects. The victims did not receive any employment contract and they were then exploited through prostitution activities. The criminal group generated vast illegal proceeds through the exploitation of large numbers of women. The victims were accommodated in three homes provided by the same individual who managed the night club. By isolating the victims from the rest of society, the traffickers attempted to minimise the risks of police detection or the escape of the women, allowing them to restrain, control and fully exploit the victims.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. On the action day, Europol deployed an expert in the field to cross-check operational information in real time and provide experts with possible leads and technical support.

The investigation, initiated in April 2023, focused on a criminal network organising multi-tonne shipments to Europe of cocaine sourced in Ecuador and shipped from Colombia, Ecuador, Suriname, Guyana and Paraguay. Investigative leads link the group to possible additional shipments from West Africa. The criminal network operated from Germany, allegedly organising the logistics of their criminal activity through the involvement of large number of front companies, including transport companies and criminal associates such as administrative personnel and drivers. Between April and September 2023, law enforcement authorities in Belgium, Ecuador and Germany seized about 35 tonnes of cocaine linked to the activities of this criminal network.The action days on 31 May (in Cologne) and 5 June (in Hamburg) led to:6 arrests24 house searchesSeizures including high-end vehicles, jewellery, cash, electronic equipment and various documentsThis operation follows EU Member States’ and Europol’s efforts to provide a response to the most threating criminal networks active in the EU, especially the ones operating in the EU’s major ports. Such an operational response aims at bringing together EU Member States to effectively target these logistical networks with close ties to the command-and-control centres affecting the EU’s internal security. To better understand and counter the threat, Europol published a joint analysis report in partnership with the ports of Rotterdam, Antwerp and Hamburg/Bremerhaven that looks into the risk and challenges for law enforcement posed by criminal networks in EU ports.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall case coordination among various agencies. On the action day, Europol deployed two experts in the field to cross-check operational information in real time and provide experts with possible leads and technical support.

The servers supported multiple media outlets linked to Islamic State. They were used to disseminate worldwide propaganda and messages capable of inciting terrorism in at least thirty languages. Eurojust and Europol coordinated and supported the joint operations.This week’s joint operations are part of ongoing efforts and constant vigilance to tackle online terrorist propaganda and communications, including through social media. They targeted key tools and nodes to disseminate radical messages centred on the I'LAM Foundation, which created, operated or supported websites and other communication channels linked to the Islamic State terrorist organisation.Investigations and the continuous monitoring of online activities of terrorist organisations, led by the Spanish Civil Guard (Guardia Civil) in 2022 gave insight into the communications of media linked to the I’LAM Foundation. The traceability was complex, as they operated new and sophisticated technological infrastructures. These were hosted on servers that have since been taken down.The websites and communication channels, such as radio stations, a news agency and social media content, had a global reach. They communicated directives and slogans of Islamic State in over thirty languages, including Spanish, Arabic, English, French, German, Danish, Turkish, Russian, Indonesian and Pashto. Several terabytes of information were uncovered.The latest efforts follow previous actions, in line with the mandates of Eurojust and Europol, to support national authorities in combatting terrorists and monitoring their online activities. The seizure of computer servers in Germany, the Netherlands, the United States and Iceland was initiated by the Spanish authorities and coordinated by Eurojust, bringing in its expertise in this area.To prepare for this week’s actions, Eurojust organised a dedicated coordination meeting and assisted with the execution of European Investigation Orders and requests for Mutual Legal Assistance. The Agency also set up a coordination centre on its premises to support the authorities in all countries concerned to carry out searches and take down servers.Europol’s European Counter Terrorism Centre made its full range of services and expertise available to the investigation. Since the launch of investigative activities, Europol has provided intelligence packages mapping the web infrastructure of the targeted online assets through forensic analysis of the servers. Europol’s expertise on the terrorist propaganda landscape was instrumental in informing judicial proceedings.The Agency also organised several operational meetings, bringing together all the investigators at different critical phases of the investigation. Outreach to the private sector was another important function carried out by Europol in preparation for the action day. Its European Counter Terrorism Centre liaised with technology companies to facilitate the retrieval of electronic evidence central to the investigation. On the action day, a Europol mobile office was deployed to Spain to provide analytical support during the arrests of the suspects.The following authorities participated in the joint operations this week:Spain: Investigative Court no. 1 at Audiencia Nacional; Public Prosecutor’s Office Audiencia Nacional; Civil Guard (Guardia Civil)Germany: Public Prosecutor’s Office Nuremburg – Fürth; Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Public Prosecution Service (Landelijk Parket); National Police (Nationale Politie)United States: Department of Justice; Federal Bureau of InvestigationIceland: National Commissioner of the Icelandic Police and Reykjavik Metropolitan Police

Ten countries joined forces with Europol to disrupt the online propaganda activities of religious and politically motivated terrorist organisations across the ideological spectrum.This joint effort, known as Operation HOPPER II, targeted key assets in the online dissemination of terrorist propaganda, including those of the so-called Islamic State, al-Qaeda and its affiliates, and Hay’at Tahrir al-Sham. The operation specifically targeted terrorist-operated websites used to disseminate terrorist propaganda, thereby limiting the ability of terrorist organisations to recruit, radicalise and mobilise recruiters online.This week, Europol referred a total of 13 websites spreading terrorist propaganda to hosting service providers for removal. This follows the seizure of four servers in Romania, Ukraine and Iceland over the course of the investigation and the removal of associated websites.The referral of websites operated by terrorists, violent extremists and their supporters will continue as new copycat domains are likely to emerge.This operation was coordinated by the European Union Internet Referral Unit (EU IRU) within Europol’s European Counter Terrorism Centre. It involved law enforcement authorities from Albania, Bosnia and Herzegovina, Denmark, Germany, Iceland, Moldova, Romania, the Slovak Republic, Ukraine and the United Kingdom.Operation HOPPER II ran in parallel with the Spanish Guardia Civil’s Operation ALMUASASA, also supported by Europol, with the aim of intensifying the disruption across the terrorist ideological spectrum.Responding to the threat of terrorist-operated websitesThis operation is a crucial part of the EU IRU’s ongoing work against websites operated by terrorists and violent extremists, which serve as key platforms for the dissemination of violent ideologies.These websites enable terrorist organisations and violent extremists to bypass the enhanced moderation and content removal efforts of mainstream online service providers, allowing them to maintain a persistent online presence.They are used not only to spread propaganda and incite violence, but also to recruit members, raise funds and coordinate attacks. The content hosted on these websites often includes manuals for creating explosives and propaganda designed to radicalise and mobilise individuals.Identifying, flagging, investigating and disrupting these websites has become a key function of the EU IRU through the technical solution Europol developed in-house – the EU Platform on illicit content online (PERCI).A single system to facilitate referrals and removal ordersAt the request of the European Commission, Europol has developed a technical solution that facilitates the implementation of the Terrorist Content Online Regulation (TCO Regulation - (EU) 2021/784) by EU Member States.The TCO Regulation, which came into effect from June 2022, provides a legal framework to ensure that hosting service providers are obliged to remove terrorist content within one hour of receiving a removal order from Member State authorities. The Regulation applies to all hosting service providers offering services within the EU, including providers of social media, video, image and audio-sharing services.Europol provides a single system that connects all EU Member States with hosting service providers. Known as PERCI, this platform is managed by the EU IRU and is used to issue and transmit removal orders.In the framework of HOPPER II, PERCI played a pivotal role in centralising and coordinating the transmission of referrals to hosting service providers, thus enabling the alignment of investigative priorities.The following authorities took part in HOPPER II:Albania: State Police (Policia e Shtetit)Bosnia and Herzegovina: State Agency for Investigation and Protection (Državna agencija za istrage i zaštitu), Ministry of Internal Affairs of the Republic of Srpska (Ministarstvo unutrašnjih poslova Republika Srpska)Denmark: Danish Security and Intelligence Service (Politiets Efterretningstjeneste)Germany: Federal Criminal Police Office (Bundeskriminalamt)Iceland: National Commissioner of the Icelandic Police and Reykjavik Metropolitan PoliceMoldova: National Inspectorate of Investigations and Moldovan Informational Security ServiceRomania: Romanian Police (Poliția Română), Romanian Intelligence Service (Serviciul Roman de Informatii)Slovak Republic: Counter Terrorism UnitUkraine: Security Service of Ukraine (Служба безпеки України)United Kingdom: Counter Terrorism Policing

Targeting the full operational chain to dismantle the cocaine cartelThe internationally coordinated actions targeted the criminal network, which was orchestrating multi-tonne cocaine trafficking from Colombia, Brazil and Ecuador to the EU. The suspects arranged the trafficking into the EU through maritime shipments going via logistical hubs in West Africa and the Canary Islands. Once the drugs had reached the EU, the suspects used handling centres in Belgium, Croatia, Germany, Italy and Spain to further distribute cocaine across Europe.The leaders of the drug trafficking organisation were temporarily based in Türkiye and Dubai. From there, they operated the control and command centres of the criminal network. Investigations into this network identified a significant threat; criminal actors’ ability to collaborate closely and deploy criminal associates on a long-term basis on locations to facilitate their large-scale drug trafficking operations. International law enforcement cooperation was therefore crucial in halting the criminal activities.In August 2023, officers from the Spanish Civil Guard intercepted a vessel with 700 kilograms of cocaine on board near the Canary Islands. Intelligence analysis of historical data from the encrypted communication investigations revealed that the Croatian-Italian crew previously imported at least 500 kilograms of cocaine from Brazil to Spain via this vessel. The same operational method helped investigators to identify the coordinators and brokers, originating from the Western Balkan region. They were established as High Value Targets by the Operational Taskforce for their involvement in financing and coordinating both shipments. They are also linked to a previous interception of a tonne of cocaine, seized in September 2020 in the Canary Islands. In addition to the investigations carried out in Spain, the information exchange between countries, led by Europol, showed that investigations led by Belgium, Germany and Serbia targeted the same individuals and their associates.Results of the action day on 12 June 2024:4 arrests in Spain;7 house searches in Spain;Seizures of jewellery and luxury watches, a firearm and ammunition, EUR 109 000 in cash, as well as electronic equipment and other material evidence.Overall results of actions targeting this criminal network:40 arrests (3 of which were High Value Targets) in Brazil, Croatia, Germany, Serbia, Spain and Türkiye;Around 8 tonnes of cocaine seized in Belgium, Netherlands and Spain;Seizures of assets including EUR 12.5 million and USD 3 million in Brazil, and over EUR 50 million frozen in Serbia.Concerted actions disconnect criminal networkA number of worldwide actions had already made significant blows to the criminal network. On 11 May 2023, Serbian and Dutch authorities jointly targeted the cartel’s leadership and distribution infrastructure. Throughout the operation, authorities arrested 13 suspects and seized large amounts of weapons and assets estimated at about EUR 50 million. During another operation in October 2023, Croatian, German, Spanish and Turkish law enforcement authorities carried out a joint action against this cartel. The results included 21 arrests in Croatia and Germany and large seizures of drugs, firearms and liquidities. A month later, Turkish authorities arrested one of the network’s main leaders and his close associate, both Croatian nationals, in Istanbul.Brazilian authorities targeted the Brazilian criminal organisation that had been transporting cocaine inland from source countries to seaports in Brazil and other logistical hubs. They would then deliver cocaine shipments to West Africa, for further shipment operations coordinated by European criminal networks. The Brazilian network provided different criminal networks with a number of criminal services, including logistics, and facilitated money laundering activities. In March 2024, the Brazilian authorities carried out the last phase of an investigation into the laundering of the drug trafficking profits, which revealed that almost 500 bank accounts had handled over two billion BRL (EUR 371 million) in years prior. After the action day, the national authorities arrested two suspects. They also blocked and seized assets estimated at EUR 12 million, as well as USD 3 million in cash.Europol’s support and Operational TaskforceThe takedown of encrypted communication tools used by criminals has given international law enforcement an unprecedented insight into criminal networks and how they function. One trend that emerged was the important role played by criminal networks, largely composed of nationals from countries in the Balkan region, in the global cocaine trade. Europol created an Operational Taskforce in response to this threat. Led by members with experience working with the region, the Operational Taskforce brings together Balkan, EU and global countries, to effectively target these criminal networks.During the three years of investigative activities, Europol coordinated the information exchange between national authorities, bringing them together to efficiently target the entire drug trafficking network. In addition, Europol provided continuous intelligence development and analysis to support the field investigators. This intelligence allowed law enforcement to uncover a full picture of the covert network operating across various countries and continents. Intelligence provided by Europol contributed to some of the seizures made during the course of these investigations. During the action days, Europol deployed experts to Brazil and Spain to provide analytical and technical support to officers in the field.Law enforcement authorities:Brazil: Federal Police (Policía Federal)Belgium: Belgium Federal Police (Federale Politie / Police Fédérale)Croatia: Croatian National Police Office for Suppression of Corruption and Organised Crime; Service in Split and Croatian Drug Crime Service (Policijski nacionalni ured za suzbijanje korupcije i organiziranog kriminaliteta; Služba u Splitu i Služba kriminaliteta droga)Germany: Federal Criminal Police (Bundeskriminalamt)Italy: Public Prosecutor’s Office in Rome (Direzione Investigativa Antimafia – Centro Operativo de Palermo e Roma)Serbia: Criminal Police – Drugs Combating Service (Канцеларија за борбу против дрога)Spain: Civil Guard (Guardia Civil)Türkiye: National Police; Counter Narcotics Department/Istanbul Narcotics Division (Emniyet Genel Müdürlüğü Narkotik Suçlarla Mücadele Başkanlığı/ İstanbul Narkotik Suçlarla Mücadele Şube Müdürlüğü)United Arab Emirates: Dubai Police Force (القيادة العامة لشرطة دبي‎)

Speakers:EuropolSpanish Guardia CivilEurojustCountries involved:Albania, Bosnia and Herzegovina, Denmark, Estonia, France, Germany, Iceland, Moldova, Netherlands, Romania, Slovak Republic, Spain, Ukraine, United Kingdom, United StatesDate: 14 June 2024Time: 15:00 CESTPlace: Europol’s headquarters in The Hague, the Netherlands. This press conference will also be live-streamed on the homepage of Europol’s website.Ground rules: On-the-record press conference.RSVP: Journalists interested in attending this press conference in person at Europol’s headquarters are requested to RSVP to press@europol.europa.eu by Friday 14 June at 12:00 CEST. Please send your full name + date of birth for registration. Valid ID credentials are required for admittance.The conference room will be available for media to set up at 14:15 CEST and everything must be pre-set by 14:45 CEST. Registration is not necessary to follow the livestream. Q&A: The conference will include a Q&A. Journalists following the livestream will be invited to submit their questions via Slido.NOTE: Material for media will be made available on Europol’s and Eurojust’s websites on the day at 15:00 CEST. Inquiries by media regarding the logistics can be addressed to Europol’s press office at press@europol.europa.eu

During the raid, officers seized the print shop used to counterfeit euro banknotes of various denominations (5, 10, 20 and 50). It was equipped with the tools and materials used to produce highly sophisticated counterfeits. Officers at the scene confiscated printing and cutting machines, as well as raw materials for the banknotes and their security features. Analysis by the European Central Bank confirmed that the forged security features on the banknotes, such as holograms, were of high quality. The Carabinieri also seized the vendors’ electronic devices as well as their online channel used to advertise and sell the fake banknotes.Payment in cryptocurrencies and delivery via postFollowing reports of high-quality counterfeit banknotes in Austria, France, Germany, Italy, Luxembourg and Spain, Europol supported these countries in developing an intelligence picture. Tracing over 170 sales activities, investigators discovered that buyers could order counterfeit euro notes of various denominations via a dedicated communication channel. The producers would accept payment in cryptocurrencies and arrange for the fake bills to be sent via post.In addition to facilitating the information exchange, Europol financed and coordinated several operational activities. Europol also provided analytical support to identify countries where the counterfeit currency was distributed. On the action day, a Europol expert was deployed in Italy to provide technical support and cross-check the operational information against Europol’s databases and the systems of the European Central Bank.Participating countries:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt)France: National Police (Police Nationale - Office central pour la répression du faux-monnayage (OCRFM))Germany: Federal Criminal Police Office (Bundeskriminalamt)Italy: Carabinieri (Arma dei Carabinieri - Comando Carabinieri Antifalsificazione Monetaria (CCAFM))Luxembourg: Grand–Ducale Police (Police Grand-Ducale)Spain: National Police (Policía Nacional)

Encryption represents an important means of securing private communications. However, at the same time, it also enables threat actors to manage their malicious activities below the radar of law enforcement. Understanding the needs and challenges of stakeholders in the Justice and Home Affairs (JHA) community is the foundation of adopting the necessary measures to keep Europe safe, while safeguarding fundamental rights.Today, the EU Innovation Hub for Internal Security publishes its first report on encryption, with contributions from Europol, Eurojust, eu-LISA, the EU Counterterrorism Coordinator as well as the European Commission’s Directorate-General Joint Research Centre (DG JRC) and Directorate-General for Migration and Home Affairs (DG HOME). The report highlights that endorsing the benefits of encryption for privacy while acknowledging the challenges that this technology poses to combat serious organised crime and terrorism is of utmost importance. The objective is to advance a constructive discussion on encryption and to identify a balanced solution to protect individuals and society from malicious actors.Five key conclusions of the report:Introducing legal frameworks for lawful access to data and the use of encrypted communications in judicial proceedings is paramount for achieving the right balance between privacy and security.Further research and monitoring on technologies using cryptography, such as telecommunications (5G, 6G networks), biometrics, DNS, the blockchain, and quantum computing, are needed to ensure both lawful access to data and privacy.Collaboration with academia and private industry is essential for the creation of new tools to both serve law enforcement investigations without compromising the overall security of communications.Artificial intelligence solutions can both help and hinder law enforcement efforts to fight serious and organised crime, requiring a multi-faceted and collaborative approach.While quantum computing can significantly improve investigations, it also poses a significant threat to encryption, requiring a swift transition to post-quantum cryptography. Europol’s recent report on quantum computing can be found here.Europol’s Executive Director, Catherine De Bolle, said:A decade ago, one of our main challenges was the availability of data. Today, one of our main challenges is the accessibility of data. Law enforcement agencies and judicial authorities need lawful access to data to prevent and investigate serious crimes and terrorism, because our citizens and victims of crime deserve better.Privacy and security – the balancing of protectionMost significantly, operations targeting encrypted communications platforms such as EncroChat and SkyECC have uncovered the extent to which large-scale criminal organisations use this technology. The rapid increase of the criminal use of encrypted communication led to the implementation of new legal provisions in a number of EU Member States to allow law enforcement to lawfully access encrypted communication in criminal investigations. However, end-to-end encryption currently being rolled out will stop tech companies from seeing any offending that occurs on their platforms. This is why during an informal meeting on 18 April 2024 in London, European Chiefs of Police have agreed upon a Joint Declaration calling for industry and governments to take urgent action to ensure public safety across social media platforms.The access to encrypted communications and their admissibility as evidence in judicial procedures is instrumental for the functioning of law enforcement and judicial procedures. In that respect, the newly adopted EU electronic evidence package is a step in the right direction towards successful cross-border investigations and prosecution. On 30 April 2024, the Court of Justice of the European Union issued a ruling in which the Court clarified conditions under which EU Member States could request and transmit intercepted data from encrypted communication channels and use as evidence in criminal proceedings. From the technical side, new developments and tools represent both challenges and opportunities for law enforcement. This new report looks into quantum computing, cryptocurrencies, biometric data, telecommunication, artificial intelligence and how the development of these technologies can enable or hinder criminal investigations.The EU Innovation Hub for Internal SecurityThe EU Innovation Hub for Internal Security is a collaborative network of EU internal security actors including CEPOL, Europol, Eurojust, eu-LISA, EMCDDA, EIGE, EUAA, Frontex, FRA, General Secretariat of the Council of the European Union (including the EU Counterterrorism Coordinator’s Office) and the European Commission (DG JRC and DG HOME). Europol hosts the secretariat of the EU Innovation Hub, a multi-agency group of EU agencies’ staff who run its daily operations. The Hub coordinates projects in the wider field of internal security, including border management, criminal justice and the security aspects of migration.Europol’s Innovation LabThe Innovation Lab aims to identify, promote and develop concrete innovative solutions in support of the EU Member States’ operational work. This helps investigators and analysts to make the most of opportunities offered by new technologies to avoid the duplication of work, create synergies and pool resources.The activities of the Lab are directly linked to the strategic priorities as laid out in the Europol Strategy 2020+, which states that Europol shall be at the forefront of law enforcement innovation and research.The work of the Europol Innovation Lab is organised around four pillars: managing projects to serve operational needs of the EU law enforcement community; monitoring technological developments that are relevant for law enforcement; maintaining networks of experts; acting as the secretariat of the EU Innovation Hub for Internal Security.Europol’s European Cybercrime CentreEuropol set up the European Cybercrime Centre (EC3) in 2013 to strengthen the law enforcement response to cybercrime in the EU and thus to help protect European citizens, businesses and governments from online crime. The centre focusses on cybercrime committed by organised crime groups, which generate large profits (online fraud), seriously harm victims (online child sexual exploitation) or impact critical infrastructure and information systems in the EU, including cyber-attacks. Since its establishment, Europol’s EC3 has made a significant contribution to the fight against cybercrime: it has been involved in hundreds of high-profile operations and hundreds on-the-spot operational-support deployments resulting in hundreds of arrests.

This year, Europol’s photo competition is open to more entrants than ever before. As well as participants from law enforcement agencies in the EU Member States, we now also invite officers from all countries with agreements and working arrangements with Europol to participate!Three categories showcasing contemporary law enforcementThe 2024 edition of the Europol photo competition will have three themed categories, each emphasising a different aspect of modern law enforcement. While the first category aims to capture the essence of diversity in law enforcement and the communities it protects, another category invites photographers to submit images depicting innovation, cutting-edge technologies and modern approaches to policing. In the true spirit of Europol’s mandate, the third category seeks submissions that showcase the indispensable collaboration across borders in law enforcement.For full details on each category and how to participate, please visit the competition page. The deadline for submissions is Thursday, 15 August 2024.Law enforcement officers are invited to submit up to FIVE photos. Whether you are a professional police photographer or a passionate amateur, we want to see your photography skills in action! So get out there, capture the best moments of law enforcement in action, and show us why they deserve our respect and gratitude.Entries will be used in Europol publications, including calendars, social media and other communication products.

A series of raids were carried out on 21 and 27 May in France, Italy and Romania. They resulted in 11 detentions, including the mastermind behind the money laundering scheme. Law enforcement authorities also carried out 15 house searches and seized several electronic devices, jewellery and cryptocurrencies.The organised crime group under investigation carried out classic ‘rip-deal’ scams, targeting millionaires looking to invest or sell properties. Investigators uncovered how the criminals outsourced the money laundering to two other criminal networks. These networks recruited money mules – people who receive money from a third party in their bank account and transfer it to another account or withdraw it in cash, giving it to someone else in exchange for a commission. Europol warned of this trend in its report Decoding the EU’s most threatening criminal networks.In this case, the main perpetrators of the scam lacked the technical expertise to launder their profits, which exceeded EUR 10 million. That is why they delegated part of the criminal process to external service providers. This crime-as-a-service business model further increased their threat, as all their needs could be met by other criminal actors through financial exchange.An elusive labyrinthLaw enforcement authorities investigated the case for two years, as the criminal scheme was complex and challenging for investigators to unravel. The main criminals running the scam were members of families originally from the Balkans, although most of them were based in France.However, the crypto-tracing analysis performed by the investigators and supported by Europol revealed that two money-laundering rings, involving multiple nationalities and geographical locations to try to hide from law enforcement, were linked to the main group of criminals.The investigation revealed that criminals were running a rip deal scam. In this scam, a suspect lures a victim interested in investing or selling property by pretending to belong to an international investment fund, builds trust and carries out the deception at the time of payment. This time, however, they used cryptocurrencies and different apps to accomplish the scam.The criminals contacted the victims, scheduled an appointment at luxury restaurants or hotels, and instructed them to download applications to manage cryptocurrencies. As soon as the victims installed the app, the criminals used sophisticated technical tools to take control of the crypto wallets. It was only when the payments were made using these applications that the victims realised that all their funds had disappeared from their crypto wallets.As the criminals were targeting millionaires and generating huge profits from their activities, investigators were led down a completely new path – that of the money mules.European coordinationDuring the investigation, Europol provided analytical support to law enforcement authorities by disseminating analytical reports and carrying out crypto tracing for the investigators in the field to help advance the investigations. The agency also brought together the investigators to establish an intelligence picture and prepare the action days.A team of Europol experts was deployed in Italy to facilitate the exchange of information between the countries involved in the investigation and to provide ongoing forensic support on the spot.Eurojust supported the investigation by enabling cooperation between the judicial authorities involved in the operation. The coordination meetings at Eurojust helped the authorities to exchange information and prepare for the Action Day. Additionally, Eurojust supported the execution of European Investigation Orders, European Arrest Warrants, and freezing orders.Money-mule prevention campaignEuropol developed the #DontBeaMule prevention campaign to raise awareness about the use of money mules. The campaign is available in all EU languages and informs the public about how money mules operate, who the most targeted individuals are and how to recognise the warning signs.Law enforcement authorities involved in the investigation:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt);France: French National Police (Police Nationale);Germany: Federal Criminal Police Office (Bundeskriminalamt) and Hessian Police (Hessische Polizei);Italy: Italian National Police (Polizia di Stato);Portugal: Portuguese Criminal Investigation Police (Polícia Judiciária);Romania: Romanian Police (Poliția Română);Spain: Spanish Guardia Civil (Guardia Civil), Spanish National Police (Policía Nacional);Switzerland: Federal Office of Police (fedpol), Zürich City Police (Stadtpolizei Zürich).The list of participating authorities was updated on 31 May 2024 at 15:30 CET.

The international operation began as a Spanish investigation, initiated when car rental and leasing companies in the Málaga area reported missing luxury cars. Investigators soon uncovered a criminal network that was using the driving licences or passports of vulnerable persons to rent or lease prestigious cars. Europol formed an operational task force with France, Spain, Poland and Ukraine to thwart these criminal activities. On the judicial side of the operation, Eurojust launched a joint investigation team with the same countries.Corporate-like criminal enterpriseOver the course of a year and a half, the authorities involved drew up an intelligence picture of the criminal network’s operations across Europe. The organisation, mainly based in Ukraine, hired Ukrainian citizens to travel to the EU to rent or lease luxury cars using their real identities. In other cases, forged identity documents were used. With the criminals arranging flights, hotel rooms and other logistics, each person would rent one to two cars, mainly in Spain or France.Once rented or leased, the cars were handed over to contact persons who arranged for the vehicles to be taken, by land or sea, to various countries, including Lithuania, Germany and Poland. At these processing locations, a separate branch of the organisation, consisting of specialised car mechanics, prepared the cars for export. This included disabling the GPS transmitters installed in the vehicles and the forgery and replacement of licence plates and other numbered parts of the vehicle. In some cases, the cars were completely disassembled for sale on the spare parts market.After the changing of the identification numbers, members of another branch used corrupted officials to legalise the cars and register them under their personal documents. This would enable them to sell the vehicles within the EU and abroad, to countries as far away as the United Arab Emirates or destinations in Asia. The whole process was financed by another branch of the organisation, mainly based in Spain.A High Value Target successfully taken downGiven the scale of the investigation surrounding Operation Matador, as well as the advanced criminal expertise of its members, Europol classified the main leader as a High Value Target (HVT). He was in contact with other organisations specialising in vehicle theft, which could be taken down in the coming weeks. On the action day, one Armenian, one Lithuanian, two French, six Russian and three Ukrainian nationals were arrested, including the HVT.Leading up to the action day, nine in-person and online operational meetings were held between the authorities and agencies involved. Europol created criminal analysis intelligence packages and shared them with the national investigating units. On 21 May 2024, an operational centre was set up in Málaga, Spain, to coordinate the action day at the police level, liaising with the judicial coordination centre that had been established at Eurojust.Participating countries:France: National Gendarmerie (Gendarmerie Nationale)Latvia: Central Criminal Department of the State Police (Valsts policija)Germany: Police (Polizei) Baden-Württemberg, Police (Polizei) North Rhine-Westphalia, Police (Polizei) Niedersachsen, Public Prosecutor’s Office (Staatsanwaltschaft) EssenPoland: The Police Central Bureau of Investigation (Centralne Biuro Śledcze Policji Zarząd w Warszawie), Public Prosecutor’s Office Warsaw (Prokuratura Okręgowa Praga w Warszawie)Spain: National Police (Policía Nacional), Investigative Court no. 1 Málaga; Public Prosecutor’s Office MálagaUkraine: Strategic Investigation Department of the National Police of Ukraine (Департамент стратегічних розслідувань Національної поліції України), Main Investigative Department of the National Police of Ukraine (Головне слідче управління Національної поліції України), Prosecutor General's Office (Офіс Генерального прокурора)Participating agencies:Europol, Eurojust

Overall, the results of the action include:15 313 officers from law enforcement and labour and tax authorities participated in the action165 896 entities checked (including 63 649 persons, 9 564 locations, 20 556 vehicles and 76 670 documents)160 persons suspected of trafficking human beings identified (of which 93 for labour exploitation)51 persons arrested for various crimes (of which 30 for labour exploitation)334 potential victims of human trafficking identified (of which 279 potential victims of labour exploitation)476 new investigations in various crimes launched (of which 80 in labour exploitation)The aim of the week-long activity was for authorities to target the forms of labour exploitation most relevant or prevalent in their respective countries. Countries performed inspections in a broad range of sectors such as catering, gastronomy, food delivery, food and meat processing, beauty services, domestic health services, logistics and distribution, agriculture, construction and mining.Following its previous iterations, the action featured a prominent multidisciplinary approach. The work of national and regional police bodies, border guards, tax authorities, labour authorities and labour inspectorates was coordinated and supported by Europol and the European Labour Authority. Several inspections with enforcement authorities from different countries jointly inspecting companies were facilitated. As a result, the operation benefitted from better flow of information and raised awareness of human trafficking indicators. This close collaboration between various authorities and law enforcement significantly contributed to the success of the action week fighting labour exploitation.Europol supported the Joint Action Days around the clock, with analysts processing data shared by participating authorities. Apart from coordinating operational activities and facilitating information exchange, Europol provided analytical and operational support 24/7. It facilitated real-time exchange of communication between participating authorities and deployed experts to help investigators on the ground.Participating Member States:Netherlands (action leader), France, Italy and Romania (co-leaders), Albania, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Finland, Germany, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Moldova, North Macedonia, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, Switzerland, Ukraine, United KingdomParticipating agencies:Europol, European Labour Authority

Between 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The actions focused on disrupting criminal services through arresting High Value Targets, taking down the criminal infrastructures and freezing illegal proceeds. This approach had a global impact on the dropper ecosystem. The malware, whose infrastructure was taken down during the action days, facilitated attacks with ransomware and other malicious software. Following the action days, eight fugitives linked to these criminal activities, wanted by Germany, will be added to Europe’s Most Wanted list on 30 May 2024. The individuals are wanted for their involvement in serious cybercrime activities.This is the largest ever operation against botnets, which play a major role in the deployment of ransomware. The operation, initiated and led by France, Germany and the Netherlands was also supported by Eurojust and involved Denmark, the United Kingdom and the United States. In addition, Armenia, Bulgaria, Lithuania, Portugal, Romania, Switzerland and Ukraine also supported the operation with different actions, such as arrests, interviewing suspects, searches, and seizures or takedowns of servers and domains. The operation was also supported by a number of private partners at national and international level including Bitdefender, Cryptolaemus, Sekoia, Shadowserver, Team Cymru, Prodaft, Proofpoint, NFIR, Computest, Northwave, Fox-IT, HaveIBeenPwned, Spamhaus, DIVD, abuse.ch and Zscaler.The coordinated actions led to:4 arrests (1 in Armenia and 3 in Ukraine)16 location searches (1 in Armenia, 1 in the Netherlands, 3 in Portugal and 11 in Ukraine)Over 100 servers taken down or disrupted in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, the United States and Ukraine Over 2 000 domains under the control of law enforcementFurthermore, it has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware. The suspect’s transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtained.What is a dropper and how does it work?Malware droppers are a type of malicious software designed to install other malware onto a target system. They are used during the first stage of a malware attack, during which they allow criminals to bypass security measures and deploy additional harmful programs, such as viruses, ransomware, or spyware. Droppers themselves do not usually cause direct damage but are crucial for accessing and implementing harmful softwares on the affected systems.SystemBC facilitated anonymous communication between an infected system and a command-and-control servers. Bumblebee, distributed mainly via phishing campaigns or compromised websites, was designed to enable the delivery and execution of further payloads on compromised systems. SmokeLoader was primarily used as a downloader to install additional malicious softwares onto the systems it infects. IcedID (also known as BokBot), initially categorised as a banking trojan, had been further developed to serve other cybercrimes in addition to the theft of financial data. Pikabot is a trojan  used to get initial access to infected computers which enables ransomware deployments, remote computer take-over and data theft. All of them are now being used to deploy ransomware and are seen as the main threat in the infection chain.Droppers’ operation phasesInfiltration: Droppers can enter systems through various channels, such as email attachments, compromised websites, they can also be bundled with legitimate software.Execution: Once executed, the dropper installs the additional malware onto the victim's computer. This installation often occurs without the user's knowledge or consent.Evasion: Droppers are designed to avoid detection by security software. They may use methods like obfuscating their code, running in memory without saving to disk, or impersonating legitimate software processes.Payload Delivery: After deploying the additional malware, the dropper may either remain inactive or remove itself to evade detection, leaving the payload to carry out the intended malicious activities.Endgame doesn’t end hereOperation Endgame does not end today. New actions will be announced on the website Operation Endgame. In addition, suspects involved in these and other botnets, who have not yet been arrested, will be directly called to account for their actions. Suspects and witnesses will find information on how to reach out via this website.Command post at Europol to coordinate the operational actionsEuropol facilitated the information exchange and provided analytical, crypto-tracing and forensic support to the investigation. To support the coordination of the operation, Europol organised more than 50 coordination calls with all the countries as well as an operational sprint at its headquarters.Over 20 law enforcement officers from Denmark, France, Germany and the United States supported the coordination of the operational actions from the command post at Europol and hundreds of other officers from the different countries involved in the actions. In addition, a virtual command post allowed real-time coordination between the Armenian, French, Portuguese and Ukrainian officers deployed on the spot during the field activities.The command post at Europol facilitated the exchange of intelligence on seized servers, suspects and the transfer of seized data. Local command posts were also set up in Germany, the Netherlands, Portugal, the United States and Ukraine. Eurojust supported the action by setting up a coordination centre at its headquarters to facilitate the judicial cooperation between all authorities involved. Eurojust also assisted with the execution of European Arrest Warrants and European Investigation Orders.National authorities at the core of Operation EndgameEU Member States:Denmark: Danish Police (Politi)France: National Gendarmerie (Gendarmerie Nationale) and National Police (Police Nationale); Public Prosecutor Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit; Paris Judicial Police (Préfecture De Police de Paris)Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General's Office Frankfurt am Main – Cyber Crime CenterNetherlands: National Police (Politie), Public Prosecution Office (Openbaar Ministerie)Non-EU Member States:The United Kingdom: National Crime AgencyThe United States: Federal Bureau of Investigation, United States Secret Service, The Defense Criminal Investigative Service, United States Department of JusticeAuthorities involved in local coordination centres for Operation Endgame:Portugal: Judicial Police (Polícia Judiciária)Ukraine: Prosecutor General’s Office (Офіс Генерального прокурора); National Police (Національна поліція України); Security Service (Служба безпеки України)The list of participating authorities was updated on 30 May 2024 at 12:10 CET.The list of private partners was updated on 30 May 2024 at 17:00 CET.

Europol’s Executive Director, Catherine De Bolle, said:Over the past quarter of a century, Europol has evolved remarkably. Our history is one of constant adaptation and transformation. We have continually adapted to the changing landscape of organised crime and terrorism, to the evolving operational needs of law enforcement in Member States and to the geopolitical trends that impact the operational context of policing. In this complex environment, Europol has transformed into a cornerstone of European security and cooperation. As we celebrate this milestone, we reaffirm Europol’s driving force: every operation we undertake, every partnership we forge, and every innovation we embrace is ultimately aimed at ensuring the safety and security of our communities.The European Commissioner for Home Affairs Ylva Johansson said:25 years Europol, 25 years supporting Member States to fight crime. Increased police cooperation is essential in dismantling criminal networks and to fight terrorism. Europol is the foundation of that cooperation. During this mandate we have equipped the EU with stronger tools to protect European citizens. Today is for discussing how far we come and what more we need to do to meet future threats.Key milestonesAs Europe’s criminal landscape has evolved over the last quarter of a century, so has Europol. The Agency has undergone a significant transformation over the years to ensure that it can always offer cutting-edge support to Member States and their investigations. Some key milestones include:1993: Europol Drugs Unit is established by ministerial agreement. It starts its operations in 1994 in The Hague, the Netherlands2001: Signature of the first cooperation agreements with non-EU Member States (Iceland and Norway)2010: On 1 January, Europol becomes a full EU Agency2011: First annual European Police Chiefs Convention (EPCC)2013: Opening of the European Cybercrime Centre at Europol (EC3)2016: Establishment of European Counter Terrorism Centre (ECTC) at Europol2016: Europol launches the Europe’s Most Wanted Fugitives website2016: Deployment of guest officers to hotspots in Greece and Italy2019: Europol is mandated by the Justice and Home Affairs ministers from all the EU Member States to create an Innovation Lab to support the law enforcement community in the area of innovation2020: Europol supports investigators in France and the Netherlands in blocking the illegal use of EncroChat encrypted communication by large-scale organised crime groups2020: Europol launches the European Financial and Economic Crime Centre (EFECC)2020: Europol extends its global reach as, for the first time, Europol’s agreements with third countries outnumber those with EU Member States2021: Europol supports investigators in Belgium, France and the Netherlands in blocking the illegal use of Sky ECC encrypted communication by large-scale organised crime groups2022: Europol launches its Digital Forensics Unit, significantly enhancing its ability to support Member States in processing and analysing digital evidence for law enforcement investigations2024: The number of law enforcement authorities connected to Europol through SIENA exceeds 3 000, from more than 70 countries and international entities2024: Europol appoints its first Artificial Intelligence Officer to steer the adoption of cutting-edge AI technologies, ensuring they align seamlessly with the Agency's mission, as well as with strong data protection safeguardsA year of celebrationsThroughout the year, a number of events and activities will take place to celebrate Europol’s anniversary.The festivities kicked off on 28 May at the EU versus Crime conference co-organised by Europol and the European Commission. Europol’s Executive Director Catherine De Bolle and the European Commissioner for Home Affairs Ylva Johansson, together with panellists from law enforcement, policymaking and civil society, looked back at the internal security achievements of the last five years.Event: EU versus Crime (including agenda and recording)The events will culminate in September with the European Police Chiefs Convention organised at Europol’s headquarters. Europol has also updated its logo for its anniversary year – it now proudly wears its 25-year badge.Read more about Europol’s history on our website and follow us on social media to learn more about the Agency’s past, present and future.

It will include an opening speech from Commissioner Ylva Johansson and Executive Director of Europol Catherine De Bolle, followed by three moderated panel discussions:Panel I: Serious and Organised Crime: Disrupting Global Criminal Networks - focused on organised crime and the security threat from current high risk criminal networks.Panel II: Shaping the Future: Counteracting Terrorism and Radicalisation in the Digital Age - addressing the evolving landscape of terrorism and radicalisation, particularly in the context of the digital era.Panel III: Data at a Crossroads: Europol as a hub against crime - focused on the security in light of the misuse of technology by criminals and the need for law enforcement to access data to investigate crime and bring justice to victims of crime.The conference will be followed by a Q&A open to the press.WhenTuesday 28 May 2024, 09:30 - 13:10 (CEST)WhereThe conference will be livestreamed.AccreditationIf you would like to ask questions at the press point, please note that you will have to attend physically in order to do so.Media wishing to be accredited for in-person attendance of the Q&A are asked to register. In case of questions, please feel free to reach out to press@europol.europa.eu. 

Such a complex investigation had to be conducted in two phases: in the first, Spanish law enforcement authorities arrested 35 suspects for belonging to a criminal organisation, facilitating illegal immigration and forging documents. Following these arrests, the Spanish police arrested 34 more suspects for allegedly issuing fraudulent documentation to facilitate the legalisation of the migrants. Results of the operation:69 arrests7 luxury vehicles seizedEUR 80 000 in cash seizedSeizure of electronic devices and documentationEuropol provided operational analysis support during throughout the investigation and, on the action day, deployed an analyst on-site to Toledo to provide on-the-spot assistance and forensic expertise.From fake work contracts to sham marriagesThe investigation revealed that the two dismantled organisations were established in Guadalajara, Madrid and Toledo (Spain) but had branches scattered throughout Spain, including Barcelona, Coruña, San Sebastián, Seville and Valencia. They carried out their criminal activities independently, although they occasionally cooperated when necessary.The criminal organisations provided victims with fraudulent work contracts and fake registrations in municipalities where they never lived in order to obtain legal status in Spain. They even arranged sham marriages and provided advice on how to successfully pass the interviews during the application procedures.Several law firms collaborated with the criminals by helping them draft the fake documentation. These firms received between EUR 500 and EUR 1 000 in exchange for each victim.Links to Europe’s largest Chinese prostitution ringThe case is connected to an operation task force that Europol has been supporting since 2020 and which led to the dismantling of Europe’s largest Chinese criminal network involved in trafficking in human beings for sexual exploitation.The case is also linked to an operation targeting a criminal organisation trafficking human beings for the purposes of sexual and labour exploitation in Mallorca (Spain). The operation took place in March 2024 and resulted in 17 arrests and the protection of 13 victims.

Between 29 April and 10 May 2024, over 30 participants from 24 partner countries as well as Europol and INTERPOL took part in the 14 Victim Identification Task Force (VIDTF), hosted at Europol’s Headquarters in The Hague, the Netherlands. The operation focused on supporting the identification of victims and perpetrators present in over 68 million media files containing child sexual abuse material seized by various law enforcement authorities and submitted to Europol.The participants analysed over 404 datasets depicting specific unidentified victims of child sexual abuse. The specialists managed to identify the countries where the crimes were likely to have been executed for over 180 of the datasets analysed during the operation. Europol has already disseminated over 70 of these datasets to the competent authorities while this process is still ongoing. In 15 of the datasets, experts included identification information on the victims or offenders. So far, four of the victims have been identified and safeguarded by the relevant national authorities.During the VIDTF, experts analysed different datasets, including very recently produced child sexual exploitation material, some of which from 2024, but also so-called ‘cold cases’ with pictures and videos made more than five years ago. The images and videos depicted male and female victims of varying ages originating from different countries around the world. The victims abused in images and videos ranged from toddlers (aged three years and younger) to pubescents.Since 2014, Europol has been regularly bringing together victim identification experts from around the world to focus on unsolved cases of child sexual abuse. Over 700 children have been safeguarded and 230 offenders arrested with support from VIDTF operations.The following countries took part of the VIDTF 14:EU Member States: Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Malta, Netherlands, Poland, Portugal, Romania, Spain, SwedenNon-EU Member States: Australia, Colombia, Moldova, Switzerland, the United Kingdom, the United States, UkraineEU agencies and international organisations: Europol, INTERPOLPublic appeal for helpYou can help us identify the origin of certain objects as part of Europol’s Trace an Object initiative. Visit Stop Child Abuse to see if you recognise any identifiable features or individuals in the publicly released images. Europol periodically releases new series of pictures containing non-confrontational details of images extracted from child sexual abuse cold cases in the hope that someone will recognise a detail that will help narrow down the location of the victim. No clue is too small.Note to media:Europol encourages you to use the term ‘child (sexual) abuse material’ and not ‘child pornography’ in your reporting.The use of the term ‘child pornography’ helps child sex abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child pornography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation where a child has been abused. This is not pornography.---Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The investigation was led by the Italian State Police (Polizia di Stato), with the support of the Italian Financial Police (Guardia di Finanza) and the Turkish National Police (Emniyet Genel Müdürlüğ).In total, 17 individuals – all Turkish nationals – were arrested.The investigation was initiated in Como, Italy, in October 2023 after three members of a criminal organisation were arrested in possession of firearms. The head of the criminal organisation featured among those arrested.The criminal organisation was involved in multiple illegal activities, including murders across Europe, the transport of migrants, the trafficking of drugs and the smuggling of counterfeit cigarettes.The investigation also revealed how financial flows coming from abroad financed the illegal activities of this criminal organisation in Europe.Europol deployed two experts to Viterbo, Italy, to assist in the analysis of intelligence and the coordination of the actions. Since the end of 2022, Europol has had a new mandate which allows the Agency to focus its activities on violence, including killings connected with serious and organised crime groups.The list of participating countries was updated on 23 May 2024 at 14:34 CET.

Between December 2017 and February 2018, the scammers pretended to have set up a genuine online trading company which had issued a new cryptocurrency. The initial coin offering (ICO) amounted to an offer of 10 million tokens – or respective rights to the new currency. Investors paid them in established cryptocurrencies such as Bitcoin or Ethereum. In order to gain credibility with investors, the Austrian fraudsters also claimed to have developed their own software and a unique algorithm for the sale of the tokens.Suspicious behaviour and exit scamTraditionally, an ICO will build upon transparency and communicate clearly about each team member responsible for it. In this instance, there was a lack of transparency regarding both the team members involved and the algorithm underpinning the cryptocurrency. In February 2018, the perpetrators suddenly closed all the project’s social media accounts and took the fake company’s website offline. Following this exit scam, it became apparent to investors they had been defrauded. At this stage of the investigation, not all victims of this scheme have yet been identified.Collaborative law enforcement effortEuropol’s specialists organised five operational meetings and worked hand-in-glove with the Austrian desk at Eurojust, providing a holistic analysis picture of the investigation. Europol also deployed a specialist with mobile office to Cyprus to support the operational activities and facilitate the exchange of information.Eurojust supported the action day with a coordination centre, enabling real time communication between all judicial authorities involved and the rapid execution of European Arrest Warrants and search warrants. Europol supported the coordination centre with a setup of our core technical operational product, the Virtual Command Post, at Eurojust. Austrian police officers were present on the ground during operations in Cyprus, providing advice on cryptocurrency seizure and supporting the interrogation of the main suspect.Participating authorities:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt - Cybercrime Competence Center (C4)); Specialised Prosecution Office for the Fight Against Economic Crimes and Corruption (Wirtschafts- und Korruptionsstaatsanwaltschaft)Cyprus: Cyprus Police in LarnacaCzechia: Police of the Czech Republic, National Organised Crime Agency (Národní centrála proti organizovanému zločinu – NCOZ)Participating agencies:Europol, Eurojust

The administrator and developer of LockBit, a Russian national, is now subject to a series of asset freezes and travel bans issued by the UK Foreign, Commonwealth and Development Office, alongside the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Australian Department of Foreign Affairs and Trade.Prosecutors in the United States have also unsealed an indictment against him based on his alleged role as the creator, developer, and administrator of the LockBit ransomware variant. Additionally, authorities in the United States are offering a reward of up to USD 10 million for information leading to his arrest and/or conviction.These measures follow a first phase of action in February 2024 which was led by the UK’s National Crime Agency and resulted in the compromise of LockBit’s primary platform and other critical infrastructure. The sanctions form part of a concerted campaign supported by Europol and Eurojust to severely damage the capability and credibility of the LockBit ransomware group.The true impact of LockBit’s criminality was previously unknown, but data obtained from their systems showed that more than 7 000 attacks were built using their services between June 2022 and February 2024. The top five countries hit were the United States, United Kingdom, France, Germany and China.Europol disseminates some 3 500 victim intelligence packagesLaw enforcement is now in possession of over 2 500 decryption keys and are continuing to contact LockBit victims to offer support.Europol has been exploiting the vast amount of data gathered during the investigation and the first phase of action to identify these victims, who are located all over the world. Its European Cybercrime Centre (EC3) has disseminated some 3 500 intelligence packages containing information about Lockbit victims to 33 countries.With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit ransomware.These solutions have been made available for free on the No More Ransom portal, available in 37 languages.NCA-controlled leak siteAfter seizing control in February, the ransomware group’s leak site on the dark web was redesigned by law enforcement to instead host a series of articles exposing the different actions undertaken against LockBit.The NCA-controlled leak site is once again being used to host a range of information exposing the criminal group.It can be accessed via Tor using the below links:lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onionlockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onionlockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onionThis investigation continues to identify affiliates – those who used LockBit services and carried out attacks – and ensure they face law enforcement action.Taskforce Operation CronosThe concerted campaign by the international Operation Cronos taskforce to target and disrupt LockBit ransomware is ongoing. The following authorities are part of this taskforce:France: National Gendarmerie (Gendarmerie Nationale – Unité nationale cyber C3N)Germany: State Bureau of Criminal Investigation Schleswig-Holstein (LKA Schleswig-Holstein), Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Team Cybercrime Zeeland-West-Brabant, Team Cybercrime Oost-Brabant, Team High Tech Crime), Public Prosecutor’s Office Zeeland-West-BrabantSweden: Swedish Police AuthorityAustralia: Australian Federal Police (AFP)Canada: Royal Canadian Mounted Police (RCMP)Japan: National Police Agency (警察庁)United Kingdom: National Crime Agency (NCA), South West Regional Organised Crime Unit (South West ROCU)United States: U.S. Department of Justice (DOJ), Federal Bureau of Investigation (FBI) NewarkSwitzerland: Swiss Federal Office of Police (fedpol), Public Prosecutor's Office of the canton of Zurich, Zurich Cantonal Police

Officers from the Guardia Civil, working together with Europol and the US Drug Enforcement Administration (DEA), seized 21 drums of liquid and solid chemicals used to extract and process cocaine after discovering the laboratory near Madrid.The operation, which included searches of 27 properties in the provinces of Pontevedra, A Coruña and Madrid, also led to the seizure of EUR 3 million in cash. An additional EUR 10 million worth of assets were seized, such as luxurious houses, vehicles and recreational vessels.The individuals arrested, of which 19 are Spanish nationals and one is from Colombia, are suspected of having imported tonnes of cocaine and coca leaves from South America to Spain using recreational vessels. They are believed to have chartered sailboats and catamarans from Galicia to South America to transport their illicit cargo into Europe. To carry out this activity, they recruited young men with maritime experience and no criminal record.The cocaine would be smuggled into different entry points on the Galician coast, before being smuggled inland and to other EU Member States using vehicles equipped with sophisticated hidden compartments.In order to maximise their profits, the Galicia-based criminal organisation also allegedly ran a cocaine laboratory, installed in an isolated area in the suburbs of Madrid. There they would extract cocaine from the coca leaves.During the action day, authorities seized large quantities of drugs, including:50 kg of cocaine,1 kg of heroin,1.7 tonnes of hashish,1 kg of Tusi,10 kg of marijuana,750 g of MDMA,10 000 ecstasy pills,700 grammes of amphetamine.In the framework of intelligence activities underway with its operational counterparts, Europol developed reliable intelligence concerning the international drug trafficking activities of this Spanish criminal organisation. Since then, Europol has provided continuous intelligence development and analysis to support the field investigators. During the action day, a Europol specialist was deployed to Spain to assist with the swift analysis of new data as it was being collected during the action.This case confirms a new trend in cocaine trafficking, whereby the unprocessed drug is exported to be chemically processed in clandestine laboratories in destination countries. This allows the criminal organisations to reduce their losses in the event of possible police seizures.

On 29 and 30 April 2024, experts from law enforcement, prosecution, judiciary, the EU and international organisations gathered at Europol headquarters to discuss the digital aspect of migrant smuggling, the first of a series of meetings as a follow-up to the Global Alliance to Counter Migrant Smuggling launched in November.Over 100 participants from 23 EU Member States and 12 non-EU countries, as well as representatives from the European Commission, Eurojust, the European External Action Service, Frontex, Interpol and UNODC took part in the meeting.The discussions held during the meeting focussed on prevention, response, international cooperation and how to work with the private sector to tackle migrant smuggling activities enabled by the use of online platforms. The objective of the meeting was to identify the most suitable operational responses to this increasing threat, at both EU and global levels.An effective response to tackle migrant smuggling in the digital domainThe criminal market for migrant smuggling activities has continued to grow, alongside existing and new crises worldwide. At the same time, it has become apparent that while offering 'safe trips' online, migrant smugglers are ruthless in their lack of regard for the lives and safety of migrants. Their lack of respect for human life has resulted in a number of tragic deadly incidents while transporting migrants during both sea crossings and on land. Migrant smugglers have quickly adjusted their modus operandi to profit from the opportunities offered by digital technologies to advertise and organise their illegal services and operations.Tackling migrant smuggling in the digital space presents significant challenges for law enforcement and judicial authorities. Migrant smugglers have identified readily accessible digital tools often free of charge, the use of which facilitates their illegal operations. This toolbox used by smugglers is composed of online platforms, including social media applications, encrypted communications and cryptocurrencies.Digitalisation enhances all aspects of this type of crime, such as the recruitment, advertisement and coordination of smuggling activities, as well as the laundering of illegal profits, and enables criminal actors to organise their illegal activities under law enforcement’s radar. Criminal actors are quick to take advantage of the opportunities provided by the online environment, encrypted communication solutions and easily accessible digital tools. Taking advantage of these opportunities offered by the digital world allows criminal organisations to become more efficient, agile and resilient against law enforcement intervention.During the two-day conference, experts discussed the challenges they encounter in criminal investigations and shared knowledge and best practice. The participants identified common needs to tackle more effectively the challenges posed by the online component of migrant smuggling activities.In that context, Europol’s Deputy Director Operations, Jean-Philippe Lecouffe said:As technologies evolve and criminals adapt their business models, we need to stay one step ahead and continue to develop our policy and legislative frameworks, setting the right scene to tackle digital migrant smuggling activities more effectively. Increasing our technical capabilities, creating informal networks of experts and building effective cooperation with the private sector are crucial to combat migrants smuggling networks and prevent them from putting migrants’ lives migrants at risk.Key conclusions of the meetingTo use evidence uncovered in the digital realm more effectively in court, an informal network of experts trained in online monitoring should be created in all EU Member States and non-EU countries. This informal network will share information, good practices, IT solutions in cooperation with the judiciary. Cooperation among law enforcement and judiciary from EU and non-EU countries should be strengthened, with private parties to facilitate online investigations within the legally established framework, giving due respect to privacy.Law enforcement’s technical capabilities should be developed to improve and upgrade online monitoring and evidence-gathering in criminal investigations.Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Operation PANDORA started with a bank teller in Freiburg, Germany. When in December 2023 a customer asked to withdraw over EUR 100 000 in cash, the bank teller grew suspicious and quickly learned the customer had fallen victim to a ‘fake police officer scam’. He informed the real police, which prevented the victim from handing the money over to the fraudsters.Instead receiving the massive sum of cash, the collectors were arrested by Freiburg Police (Polizeipräsidium Freiburg) officers. Subsequently, surveillance was placed on the victim's phone line. Looking into this individual case, investigators soon realised that the telephone numbers used by the perpetrators could be linked to over 28 000 scam calls in only 48 hours.From fake investment opportunities to shock callsAs the investigation expanded, it was handed over to the Baden-Württemberg State Criminal Police Office (Landeskriminalamt Baden-Württemberg), which was supported by the Federal Criminal Police Office (Bundeskriminalamt) throughout the operation. Early findings showed that the perpetrators, located in a variety of countries, conducted all kinds of telephone fraud. Scam callers would pose as close relatives, bank employees, customer service agents, or police officers. Using a variety of manipulation tactics, they would shock and cheat their victims out of their savings. Ranging from fake promises of lottery pay-outs, investment opportunities, debt collection demands, prepaid card fraud, or shock-calls, scammers relentlessly targeted their next potential victims.To learn more about how to protect yourself from scams such as these, read our cyber scam prevention guide.As the investigation grew in size and complexity, law enforcement experts were closing in on call centres located in Albania, Bosnia-Herzegovina, Kosovo* and Lebanon. The criminal network responsible for the fraudulent calls set up its operation in a coordinated manner, focusing on a different priority in each country. While debt collection fraud was predominantly conducted from Bosnia-Herzegovina, online banking fraud calls were made from Kosovo. Investment fraudsters called mostly from Albania and the criminals specialised in prepaid card fraud sat at desks in Lebanon.Countering call centres with a call centreGerman investigators managed to track the actual conversations coming from the many call centres in real time. From December 2023 on, over a hundred officers were deployed around the clock in the Baden-Württemberg State Criminal Police Office and subsequently secured the content of over 1.3 million nefarious conversations. In consultation with the Freiburg Public Prosecutor's Office (Staatsanwaltschaft Freiburg) and later the Karlsruhe Public Prosecutor's Office (Generalstaatsanwaltschaft Karlsruhe), the aim was to prevent this crime throughout Germany.The posted officers monitored up to 30 conversations of varying lengths at the same time. The State Criminal Police Office had set up its own call centre to counter the international criminal activities. Investigators worked in shifts and had one primary goal: to prevent fraud from happening. As soon as it materialised that anyone who had received a call could fall victim to the scams, the police reached out to warn potential victims.In just four months, over 7 500 calls surpassed the threshold that warrants authorities to initiate criminal proceedings. In total, the deployed officers managed to prevent financial losses for the victims in over eighty percent of these indicted crimes. In total, the potential damages would have amounted to over EUR 10 million.Swooping down on call centresApart from preventing crime, investigators mapped the locations where the calls were coming from. Obtaining information about the phone numbers, the owners, and the technical infrastructure such as servers, the plan was to eventually take down the perpetrators' entire call centre infrastructure. Europol supported this investigation by providing tailored analytical support, thus contributing to the overall intelligence picture.Leading up to the action day, Europol hosted several operational meetings, providing operational coordination and financial support in preparation of the planned raids. When the time came to shut down the criminals’ operation across several countries, Europol hosted the operational coordination centre in its headquarters. Apart from providing operational support on the action day, Europol also deployed officers with mobile offices to locations abroad, thus facilitating the collection and analysis of forensic evidence.Over 60 German law enforcement officers, supported by hundreds of their colleagues in Albania, Bosnia and Herzegovina, Kosovo* and Lebanon, as well as Europol specialists, swarmed dozens of residential and business premises. Apart from arresting 21 persons, officers were able to secure extensive evidence such as data carriers, documents, cash and assets amounting to EUR 1 million. A large number of electronic evidence was also seized, which should enable the investigating authorities to obtain information about possible further call centres and more fraudsters.Participating countries:Germany, Albania, Bosnia and Herzegovina, Kosovo*, Lebanon*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence

The investigation, initiated in mid-2023 under the General Prosecutor’s Office in Frankfurt, Germany, targeted a criminal network currently going by the name Bandidos. The gang are suspected of trafficking large amounts of cannabis and cocaine from Málaga, Spain, to Germany. The group also smuggled weapons along the same route. The leader of the network, a German national based in Spain, is considered a High Value Target in this investigation. Investigators from the German Federal Police and the Spanish National Police, working jointly on this case, have identified him as a high-ranking member of the outlaw motorcycle gang Hells Angels in Marbella.During the action day on 21 March, officers from the Spanish National Police raided the ring leader’s private villa as well as his car rental business offices. Information exchanged through Europol uncovered that Romanian authorities also had a case opened against the same individual and, as a result of the international cooperation and information exchange, Romania issued a European Arrest Warrant against him in relation to their national case. Following this judicial warrant, Spanish and German officers conducted the joint action day.Europol facilitated the exchange of information and provided support during the course of this joint investigation. Europol also provided analysis and intelligence, and coordinated operational activities. On the action day, Europol deployed an expert in the field to cross-check operational information in real time and provide experts with possible leads.Funding through EU financial mechanismsOfficers from the Spanish National Police, supported by Europol, carried out these joint operations in partnership with Germany and Romania in line with the EU Security Union Strategy. The EU Security Union Strategy focuses on four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime, and a strong European security ecosystem. To reach these goals, the European Commission’s DG HOME, EU agencies and dedicated EU funding including the Internal Security Funds, support EU Member States in tackling criminal threats through coordinated operations that target criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combatting criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.