Crime News

The action days on 14 and 15 December 2021 led to: 16 house searches (in Barcelona, Cadiz and Galicia) 17 individuals arrested (11 Spanish and 6 Moroccan nationals)  The leader of the criminal network among the suspects arrested Large seizures worth more than €6 million including:  10 luxury watches worth about €2.1 million, 8 real estate properties worth about €1.9 million,  more than €1 million in cash,  26 cars worth about €1 million,  1 vessel valued at approximately  €100 000,  760 lottery tickets with a value of €15 200,  a banknote counter, a large number of smartphones and electronic equipment,  33 bank accounts. Large-scale drug trafficking via the African route The criminal network was involved in large-scale drug trafficking, mainly of cocaine and hashish, to Southern Spain using speedboats. Two seizures made earlier in 2021, consisting of 4 300 kg hashish and 1 300 kg cocaine respectively, are connected to this criminal organisation. Two of the 17 arrested on 14 and 15 December had an international arrest warrant against them in connection to a seizure of 1 004 kg cocaine made in 2018 in Morocco. The alleged leader of the organisation is believed to be one of the major importers of cocaine and hashish from Morocco to the Iberian Peninsula. Spanish Civil Guard officers arrested him while he was coordinating a number of seaborne drug trafficking operations. Using legal businesses to wash the drug money The organised crime group created and misused a large network of companies, including several cash-intensive businesses such as two restaurants in Barcelona. These businesses served to launder the drug-trafficking proceeds. The profits were also laundered through the payment of mortgages and simulated loans. The suspects also used cash to cover costs related to facilitating their drug trafficking activities and buying the required equipment, such as cars and vessels. A large number of the assets owned by the suspects and their families were not justified by any legally obtained and declared resource.  On-the-spot deployments to support investigators Since joining the operation in July 2020, Europol supported the operational activities, facilitated the exchange of information and provided analytical support and operational coordination. During the action days, Europol deployed an expert to Spain to cross-check in real time operational information against Europol’s databases to provide leads to investigators in the field. Europol also deployed a second expert to Spain to provide further technical assistance.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The suspect – a 41-year-old Romanian national - was arrested today at his home in Craiova, Romania, in the early hours of the morning. Ransomware with blackmail  The criminal is suspected of having compromised the network of a large Romanian IT company delivering services to clients in the retail, energy and utilities sectors. He is then believed to have deployed ransomware and stolen sensitive data from the IT company’s clients located in Romania and abroad, before encrypting their files. The information stolen included the companies’ financial information, personal information about employees, customers’ details and other important documents.  The suspect would then ask for a sizeable ransom payment in cryptocurrency, threatening to leak the stolen data on cybercrime forums should his demands not be met. Europol’s support Europol’s EC3 supported this investigation by:  Providing analytical, cryptocurrency tracing, malware analysis and forensic support; Deploying two of its experts to Romania to provide advance forensic support and to help with crypto-asset forfeiture.  This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).   

Out of hundreds of entries submitted from a variety of countries, only two talented photographers could be selected as the prizewinners. In the ‘Making Europe safer’ category, Antonio José Pedrosa Padial’s photo of a police dog looking lovingly at a Spanish police officer was chosen as the winning entry. The police officer and her dog are part of the border control team at Valencia, Spain, and the photo serves as a reminder that not only humans work hard to make Europe safer. In the ‘Re-opening Europe’ category, Valerio Giannetti’s photograph of the the Polizia di Stato music band entertaining young patients at the Agostino Gemelli Polyclinic in Rome, Italy was chosen as the winning entry. It includes one person dressed as Spiderman and, combined with the joviality of the band, this photograph provides a moving image of the many ways in which law enforcement officers support their local communities. Follow Europol on Instagram to see these winning photographs plus a selection of the best entries.

The SIRIUS project, a cross-border intelligence-sharing platform co-implemented by Europol and Eurojust, in close partnership with the European Judicial Network, concluded its fourth annual conference this week. Among the more than 800 participants in the online conference were law enforcement and judicial authorities, plus representatives from Online Service Providers. More than half of all criminal investigations today involve a cross-border request for electronic evidence, such as from email or messaging services. As the world has embraced several new technologies due to the pandemic and remote working, criminals have skilfully adapted to and exploited these developments. Accordingly, more international criminal investigations than ever are dependent on fast, secure and legal means of sharing electronic evidence across borders. This purpose is what guided this year’s SIRIUS conference. The remote challenges of a physical pandemic The pandemic-associated rise in online criminality has underscored the importance in international judicial cooperation on sharing electronic evidence. Over the course of the three days, participants discussed areas where gathering electronic evidence has become increasingly important since the outset of the COVID-19 pandemic, such as in relation to cryptocurrencies and crypto-exchanges used in money laundering. Other sessions covered increased European cooperation with law enforcement counterparts in Asia and North America, and the developments in European technical capabilities in fighting cybercrime. Welcoming delegates to the start of the SIRIUS Conference, Europol Executive Director Catherine De Bolle remarked: “Since 2017, we have seen key stakeholders and some of the major global tech companies on our stage for the SIRIUS Conference to address topics related to cross border access to electronic evidence. Promoting knowledge sharing, creating opportunities for the real exchange of experiences, and improving the capacity to deal with digital data in the context of criminal investigations is now more important than ever.” Eurojust President Ladislav Hamran stated: “What clearly emerged from the SIRIUS Conference is the notion that our success in the fight against cross-border crime depends on the strength of our mutual partnerships in a digital landscape with fragmented legal frameworks. As long as we work together, I am convinced that we can strike the right balance between obtaining access to electronic evidence and upholding the fundamental rights and liberties of our citizens.” The SIRIUS Conference Programme As in previous years, each day of the SIRIUS Conference had its own thematic focus. The first day saw a wide-ranging dialogue with technology companies and policy experts to explore the latest judicial developments in the field of e-evidence, as well as to discuss the future implications of a rapidly and dynamically involving field. The first day also highlighted the progress that the SIRIUS project has achieved over the past years, reflected by an exponential growth of its membership base and the growing popularity of its key products and services.   The latter two days of the event, which were restricted to participants from law enforcement and judicial authorities, explored the process of obtaining electronic evidence in various jurisdictions, as well as the latest developments in the rapidly developing field of Open Source Intelligence (OSINT).  The SIRIUS project, co-implemented by Europol and Eurojust, is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by online service providers. These services are available to law enforcement and judicial authorities via a platform and an application. To this day, SIRIUS serves a community of competent authorities from 44 countries, representing all EU Member States and a growing number of third countries. The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under grant agreement No PI/2017/391-896.  

Virtual assets-based money laundering and other crypto-enabled crimes are threats not only to users and financial markets, but also to the dynamism and innovation of the sector itself. Protecting citizens and the global economy from the risks of abuse of cryptocurrencies and other virtual assets is a task that requires concerted and sustained effort by governments, law enforcement, regulators and the private sector. This positive sentiment was at the heart of the 5th Global Conference on Criminal Finances and Cryptocurrencies, held virtually on 7–8 December 2021. A joint initiative of the Basel Institute on Governance, INTERPOL and Europol, the Conference saw several thousand participants tuning in to learn about the latest trends, strategies and tactics in tackling crimes and threats involving virtual assets. Sharing knowledge and building bridges  Around 2,000 cryptocurrency and anti-money laundering experts from the public and private sectors, policy institutions and academia attended the first day of the conference, which saw a series of presentations on emerging themes and topics in the virtual assets sector.  These include the fast-evolving fields of decentralised finance and non-fungible tokens (NFTs), regulatory developments affecting anti-money laundering compliance, crypto-enabled fraud and the possibilities that governments have to recover illicit assets even if they are virtual.  On the second day of the conference, which was restricted to members of law enforcement bodies and related public authorities, speakers shared their experiences of investigating cryptocurrency-enabled crime and money laundering cases with over 1,500 participants. This kind of knowledge-sharing between the public and private sectors, as well as between law enforcement representatives in different countries and institutions, is crucial in global efforts to protect the virtual assets industry from malicious actors. It also helps to foster the multidisciplinary approach that is essential to tackling virtual assets-based money laundering and related crimes, by bringing together expertise in technology, financial investigation and asset recovery.  The annual conferences help to create a network of practitioners and professionals who can collectively establish best practices and provide assistance and recommendations in this fast-evolving field. Forthcoming recommendations on combating virtual assets-based money laundering and crypto-enabled crime A set of Recommendations will be issued jointly by the Basel Institute on Governance, INTERPOL and Europol in the days following the Conference. They will set out several approaches that all stakeholders should consider taking to address emerging risks and keep the industry safe for all, covering: International cooperation Virtual asset recovery Public-private cooperation Harmonised regulation and its effective implementation Investigative techniques and technologies Capacity building Multidisciplinary approach, including through specialised law enforcement units When taken in the spirit of open collaboration, such approaches will help all stakeholders to address emerging areas of concern raised during the conference, from DeFi to dark net marketplaces. About the conference  The annual conference is organised by the Working Group on Criminal Finances and Cryptocurrencies, a tripartite initiative of the Basel Institute on Governance, INTERPOL and Europol that dates back to 2014 and was formally established in 2016.  The three institutions take turns to host the conference each year. This year’s conference was hosted by the Basel Institute on Governance. Next year, Europol will be organising the event.

Europol has supported the Maltese Authorities in investigating an organised crime group suspected of having laundered over €20 million through Malta. Other foreign jurisdictions were partners in the investigation. A total of 7 suspects of Libyan and Maltese origin were arrested across the Maltese islands on 29 November for their involvement in this money-laundering scheme.  The suspects are believed to have laundered millions in illicit funds through five Maltese companies which the criminal group controlled. The funds were for the most part sent to Turkey using both cash couriers and the informal hawala money transfer system. The investigation is ongoing to identify the origin of these ill-acquired funds, believed to be linked with tax evasion and other criminal offences. On the occasion of the action day, some €70 000 in cash was seized, alongside a considerable amount of jewellery, branded clothing and watches, luxurious vehicles, foreign number plates and electronic equipment with an approximate value of €5 million. Europol support      Europol’s European Financial and Economic Crime Centre (EFECC) has supported this investigation since June 2020, providing continuous analysis to support the Maltese investigators in developing the intelligence on this criminal group. During the action day, Europol deployed a specialist to Malta to support the investigators with real-time cross-checks and document analysis. 

Over roughly two and a half months of operations, EMMA 7 saw law enforcement, financial institutions and the private sector, including Western Union, Microsoft and Fourthline, cooperate in a concerted effort against money laundering in Europe, Asia, North America, Colombia and Australia. As well as targeting the laundering of profits through money muling networks, investigators also sought intelligence on the sources of these illicit profits, shedding more light on the size and nature of the criminal economies that money mules serve. Results from 15 September – 30 November18 351 money mules identified;324 recruiters/herders identified;1 803 arrested individuals;2 503 investigations initiated;7 000 fraudulent transactions reported;€67.5 million prevented losses.Collaborating in the fight on money launderingThis was the seventh iteration of the European Money Mule Action, or ‘EMMA’, which was established in 2016 on the initiative of Europol, Eurojust and the European Banking Federation. It is the largest international operation of its kind, built around the idea that public-private information sharing is key to fighting complex modern crimes. Around 400 banks and financial institutions supported the action, reporting 7000 fraudulent transactions and preventing a total loss estimated at nearly €70 million.EMMA 7 works based on private sector actors reporting incidences of suspicious or possibly illegal financial conduct to national law enforcement authorities. Similarly, law enforcement can ask financial actors to look into its own intelligence on potential money mules. With these inputs, law enforcement can paint a picture of laundering networks and then decide in each case how to react to the possible money muling activity.EMMA provides a means for all these actors to confer, sharing intelligence that will help identify possible money mules and potentially lead to arrests. Europol supports each stage of the preparation by connecting the law enforcement partners and private sector partners and facilitating information exchange between them. In the operational phase, Europol provided analytical support that connected the transnational cases with the money muling networks behind them.Most of the investigations under EMMA 7 focused on the international dimension of muling. Money muling operations see mules not only transferring money between countries, but also travelling between countries themselves in order to set up bank accounts overseas. Criminals can then use these accounts later on in support of the money laundering process. Awareness as important as actionThe complexity of money muling operations, and law enforcement’s response to them, reflect how muling networks are created. Unlike many financial crimes, money mules can be recruited unknowingly into the criminal operation. The organised crime groups do this by preying on groups such as students, immigrants, and those in economic distress, offering easy money through legitimate-looking job adverts and social media posts.Ignorance is not an excuse when it comes to the law and money muling; they are breaking the law by laundering the illicit proceeds of crime. For this reason, Europol coordinated the ‘#DontBeAMule’ awareness campaign with all participant countries, law enforcement and the EBF on behalf of the European banks, as a means to prevent more innocent bystanders being exploited by criminals and putting themselves at risk. Eurojust participated in the operation via its dedicated liaison officer and stands ready to support cross-border investigations and judicial cooperation at the request of the national authorities involved.EMMA is under the EMPACT Sub Priority Cybercrime NCPF (Non Cash means of Payment Fraud), and is led by the Netherlands.Participating countries: Australia, Belgium, Bulgaria, Colombia, Czech Republic, Estonia, Finland, Greece, Germany, Hong Kong, Hungary, Ireland, Italy, Moldova, Netherlands, Poland, Portugal, Romania, Singapore, Slovak Republic, Slovenia, Sweden, Switzerland, Spain, United Kingdom, United States. 

Between 8 and 12 November, Europol supported large-scale international action against trafficking in human beings. 29 countries*, led by Austria and Romania, took part in the action days, which were coordinated by Europol and Frontex. The activities saw more than 14 000 law enforcement officers target trafficking routes on roads and at airports. This resulted in 212 arrests and the identification of a further 89 trafficking suspects. The action days aimed to combat human trafficking for the purposes of sexual exploitation, forced criminality and forced begging. Europol coordinated the five action days from its 24-hour Operational Centre, which provided the participant countries with informational crosschecking, secure communication channels, and a range of analytical capabilities throughout the operation. The action days took place under the umbrella of the EMPACT security mechanism/framework. Results from 8-12 November** 212 arrests, for offences including trafficking in human beings, money laundering, pimping and fraud 147 668 persons and 91 856 vehicles checked 327 additional investigations initiated Casting the net wide in pursuit of traffickers The action days sought to identify and arrest human trafficking suspects as they transited across Europe, as well as to identify and protect trafficking victims and prevent associated document fraud. Europol coordinated national police, passenger information units, border guards and national agencies that counter human trafficking. Together they created a tight net around trafficking routes, with national police and border agents performing roadside checks, while the passenger information units checked airline passengers. This led to law enforcement identifying 593 adults and 57 minors as potential human trafficking victims, which included nationals from countries in four continents. Officers stations at EU airports were able to identify a large number of victims as vulnerable to trafficking and exploitation. Those identified were either successfully referred to the UK’s National Referral Mechanism, or returned them to their home countries with welfare checks or police assistance put in place upon their return. There were also seizures of goods such as false driver’s licenses, weapons, and hard drugs. The information gleaned from these action days has led to the opening of 327 new cases, along with the possible identification of further suspects and of human trafficking. This enhancement of cooperation between EU agencies, national law enforcement, and actors such as passenger information units, will inform similar future investigations into these serious criminal activities. Law enforcement also targeted a wide range of possible locations for human traffickers, such as bars, brothels, nightclubs, nail bars, massage studios, and strip clubs. This diverse range of target areas was the result of intelligence showing that traffickers were deploying multiple methods for recruiting their victims, such as the ‘lover boy’ method and threats of violence against victims’ relatives. *Countries involved: Austria (Action Leader), Belgium, Croatia, Cyprus, Denmark, Finland, Germany, Hungary, Iceland, Ireland, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania (Action Co-Leader), Slovakia, Slovenia, Spain, Sweden, Switzerland, United Kingdom, North Macedonia, Albania, Kosovo***, Serbia, Montenegro, Bosnia-Herzegovina **Results are still to be collated from activities in Luxembourg and Malta. *** This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence.

Terrorism is a constant threat to societies all over the world and terrorists’ use of the internet and social media has increased enormously in recent years. Jihadist groups, in particular, have demonstrated a sophisticated understanding of how social networks operate and have launched well-organised, concerted social media campaigns to recruit followers. These campaigns promote or glorify acts of terrorism and violent extremism and have led to viral online content in the past. As a response to this, in 2015 the Justice and Home Affairs Council mandated Europol to create the EU Internet Referral Unit (EU IRU), as part of the wider EU Internet Forum, to reduce the impact of internet content promoting terrorism or violent extremism. Monitoring terrorist content online In recent years, the international community has been dealing with largely uncharted territory when it comes to online extremist content. However, the adoption of the EU(2021)/784 Regulation of April 2021, which addresses the dissemination of online terrorist content, will change the European Counter Terrorism Centre’s working relationship with Member States and tech companies and the responsibilities of the EU IRU will evolve along with this legislative change. In the coming months, Member States will be in a position to demand the removal of content from Online Service Providers themselves through a platform called PERCI. This platform is a technical solution built by Europol and managed by the EU IRU to facilitate the implementation of the new regulation. Before this, the process to take down terrorist content online was entirely voluntary on the part of the tech companies. ‘This is a historic moment because it touches upon the fundamental aspects of human rights and freedoms,’ says a specialist from the EU IRU. ‘On one hand we need to be sure, as Europeans, that we do not impact these rights and securitise the area; but at the same time we have to take real action to control the abuse of the internet by malicious actors. It’s a difficult balance to strike, but it has to be done.’ The vast majority of tech companies have taken significant steps to protect their platforms against terrorist abuse. Nevertheless, the online environment remains an attractive space for terrorist criminal networks who continue to target the services offered by the tech companies for recruitment, fundraising and propaganda purposes. Fighting terrorism and migrant smuggling But how exactly does the EU IRU help keep online spaces safe? ‘It’s a round-the-clock operation,’ says the specialist, ‘once we identify terrorist content itself, we try to map its trace on the internet. We collect all publicly available information around this content and create a ‘referral package’ to be exploited for different purposes: to assess the threat, to support investigations and to suggest eventual referral to Online Service Providers.’ Referral is the transmission of a notification of internet content by Europol or Member States to the Online Service Providers.  Based on these referrals, the EU IRU also coordinates Referral Action Days. These are organised on a regular basis, both on Europol premises and remotely. Referral Action Days facilitate direct cooperation with law enforcement representatives in EU Member States and are imperative in Europol’s ongoing fight against terrorism. Since 2015, the EU IRU has organised a total of 23 Referral Action Days. The EU IRU consists of four separate teams and employs a number of specialists with a variety of skills, including operational, linguistic, technical and research expertise. Specialists who work with Arabic, for example, are hired not only for these capabilities but also for their acute understanding of how the process of radicalisation to violent extremism works. ‘Language is very important in the phenomenon of jihadism,’ explains a specialist in this field, ‘but you also need to have a deep understanding of how the jihadist networks abuse the online environment to recruit and radicalise people.’  The scope of the EU IRU is not just limited to jihadist content either. Since the attack in Christchurch, New Zealand in 2019, there has been a surge in right-wing extremist content online. The EU IRU has recently taken steps to address non-jihadist content and has brought in experts to build this capacity within the European Counter Terrorism Centre at Europol. The EU IRU additionally provides support to Europol’s European Migrant Smuggling Centre by flagging content used by traffickers offering smuggling services to migrants and refugees. Collaboration and trust The EU IRU is in a unique position whereby it can map terrorist networks across borders and see how they are linked to cases in a variety of Member States. It is this global view that is instrumental in dismantling criminal networks and providing information for investigations. The establishment of the EU Internet Forum, and subsequently the EU IRU, has greatly enhanced the voluntary cooperation between government, tech companies and civil society to counter online terrorism and violent extremism as part of the public-private partnership. ‘In the EU IRU, the European Counter Terrorism Centre, and Europol more generally, we respect fundamental rights and freedoms within a robust legal framework,’ says the specialist, ‘and this is why we are trusted by the international community, the companies we engage with, and Member States. We are very committed to building this trust- and trust is our biggest achievement at Europol.’

A total of 50 websites dedicated to the distribution of online terrorist propaganda and promoting violent jihadist ideology were targeted over the course of a referral action that took place in the last week of October. The European Union Internet Referral Unit (EU IRU)  at Europol’s European Counter Terrorism Centre (ECTC) coordinated the referral activity, which involved law enforcement authorities from Germany and the United Kingdom. The referral action targeted terrorist-operated and violent jihadist websites by referring them to Online Service Providers (OSP) supporting web infrastructure, such as registrars, hosting companies and Internet infrastructure companies, with a request to review content against their terms of service. Out of 50 websites, including sites supporting the so-called Islamic State and al-Qaeda terrorist organisations and their affiliates, 21 were suspended following referrals to the relevant OSP.  Terrorist groups traditionally relied on self-administered websites for the storage and dissemination of their propaganda. With mainstream social media companies intensifying their efforts to suspend offending content from their platforms, terrorist groups and their online supporters increasingly use websites as a vital tool to broadcast their message and create archives for their propaganda releases. In spite of frequent suspensions, these websites continue to move their content to new domains.  The referral action championed a consistent and systematic approach to the referral of websites, based on voluntary cooperation with the tech industry. It allowed practitioners to detect and assess new instances of terrorist-operated and violent jihadist websites with the aim of raising awareness of the extent of the phenomenon and draw attention to new patterns of abuse. Effective and sustained disruption of these sites requires heightened cooperation between Europol and law enforcement agencies and an enriched international public private partnership with OSPs supporting web infrastructure. To know more about the work of the EU IRU, read the dedicated feature story. 

The Italian Financial Corps (Guardia di Finanza), the German Duisburg Police (Polizei Duisburg) and the Swiss Police of the Canton of Lucerne (Kantonspolizei Luzern), supported by Europol and Eurojust, dismantled a criminal network involved in fraud with public funds. The fraud was perpetrated through the use of so-called ‘white’ energy efficiency certificates, with criminals then laundering the illicit proceeds.  The action day on 23 September 2021 led to: 20 arrests (4 in Germany, 15 in Italy and 1 in Switzerland)     Assets valued at up to €41 million were frozen, including bank accounts, financial assets, real estate and cryptocurrency €27 million defrauded from energy efficiency funds Between 2016 and 2020, the criminal network illegally obtained certifications for energy efficiency (“white” certificates), while receiving subsidies through fictitious projects. The so-called TEE certificates are attributed for energy efficiency by the national Italian regulators. The suspects used fake invoices as support documents, while requesting subsidies from the Italian authorities. In total, the criminal network illegally obtained about €27 million in subsidies from nationally distributed funds. Then, they transferred the illicit proceeds to bank accounts in Germany, Switzerland and other European countries.  The payments were made based on fictitious invoices, purporting to show transactions such as the acquisition of solar panels. The criminal profits were then withdrawn and the cash transported back to Italy, while a percentage went to an affiliated money-laundering network. The suspects used that scheme to launder more than €14 million. Investigators identified 113 individuals suspected to be involved in this criminal scheme.  Analysis and technical expertise to support fraud investigations Europol supported the operational activities, facilitated the exchange of information and provided analytical support. During the action day, Europol provided real-time analytical support from its headquarters, cross-checking operational information against Europol’s databases and thus providing leads to investigators in the field. Europol also deployed two forensic experts to Germany to provide technical support to investigators from the national authorities.  Europol recently created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

Europol, Eurojust and the European Judicial Network publish today the third annual edition of the SIRIUS European Union Digital Evidence Situation Report. This year, the report goes beyond a comprehensive status update by including an assessment of the impact of the COVID-19 pandemic on the access of EU authorities to electronic evidence held by foreign-based online service providers (OSPs) in 2020.  Cross-border access to digital evidence is crucial to most investigations, and it became even more relevant during the pandemic, when there was an acceleration in the digitalization of everyday life. In one case mentioned in the report, for instance, law enforcement officers had to react quickly to prevent phishing scams for digital signatures – a crime area on the rise because of the pandemic. The third joint report reflects the complexity of cross-border investigations involving electronic evidence, offering extensive information gathered from over 250 surveyed officials of EU Member States’ law enforcement and judicial authorities, together with relevant inputs coming from a dozen of major online service providers.   The SIRIUS platform appears as the highest-ranked source of information For the first time, the SIRIUS platform, hosted on the Europol Platform for Experts, is the number one source of information for law enforcement practitioners seeking assistance in relation to data requests under voluntary cooperation. It was selected ahead of Single Points of Contacts and national units, and cements the SIRIUS project as a centre of reference in the field of electronic evidence. Impact of the COVID-19 pandemic on requests for electronic evidence  Criminals took advantage of the pandemic, adapting cybercrime activity like phishing campaigns, ransomware, or sales of counterfeit products. Almost half of police officers surveyed stated that their need for electronic evidence increased during the pandemic, but about 25% reported that their capacity to request e-evidence decreased, most likely caused by the transition to remote working. Similarly, social distancing measures and lockdowns had an impact on the daily work of judicial authorities:  35% of respondents reported delays in procedures caused by reduced capacity. However, some of the solutions, such as acceptance of electronic documents, were embraced by the judicial community as a positive outcome. Overall, the rise in digitalisation has increased the need for electronic evidence, and authorities have had to adapt very quickly. Increased relevance of electronic evidence in criminal investigations. The volume of cross-border requests submitted by EU authorities to eight large OSPs increased 27% in 2020 in comparison with the previous year, with a large majority of them issued by Germany and France, and mainly to Facebook and Google. There was a very significant increase of 112% in emergency disclosure request in 2020 compared to 2019, with Facebook receiving most of them, among the OSPs analysed.  Europol’s Executive Director Ms Catherine de Bolle said:  “Effective policing in the digital age largely relies on harnessing the potential of online processes, alongside the ability to handle electronic evidence securely and verifiably. Nothing has made it clearer that the COVID-19 crisis which saw law enforcement having to adapt quickly to an unprecedented situation, relying on both existing digital solutions already in place and those deployed in response to the reality of a global pandemic. This joint report with Eurojust and the European Judicial Network is timely in that it provides all the partners of the EU security chain a better understanding of the challenges and opportunities related to digital evidence.” Eurojust President Mr Ladislav Hamran stated: ‘This third joint Report reflects the complexity that results from a constantly evolving digital landscape and fragmented legal framework. It also shows how the global COVID-19 pandemic forced the EU’s judiciary to develop innovative approaches and adapt existing processes. We clearly see, as well, that our success in the fight against organised crime depends on the strength of our mutual partnerships. As long as we work together, we can strike the right balance between obtaining access to electronic evidence and upholding the fundamental rights and liberties of our citizens.’ Download the SIRIUS European Union Digital Evidence Situation Report 2021 The SIRIUS project, co-implemented by Eurojust and Europol, is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by online service providers. These services are available to law enforcement and judicial authorities via a platform and an application. To this day, SIRIUS serves a community of competent authorities from 44 countries, representing all EU Member States and a growing number of third countries.  The SIRIUS Project has received funding from the European Commission’s Service for Foreign Policy Instruments (FPI) under grant agreement No PI/2017/391-896.  

A total of 18 children have been tentatively identified and two offenders apprehended as a result of the 10th edition of Europol’s Victim Identification Taskforce (VIDTF). Nine of these young victims have already been rescued by the competent authorities, with investigations ongoing to safeguard the others. The VIDTF is a Europol initiative which this year gathered specialists from 26 countries and partner agencies to identify victims and offenders depicted in child sexual abuse material.  Between 25 October and 5 November 2021, these experts combed through some 580 sets of images and video files depicting unknown victims of child sexual abuse, some as young as a few days old. They were supported by Europol specialists and intelligence analysts in the field of combating the sexual exploitation of children.  In addition to the 18 children identified, the likely country of production has been located in 211 instances and intelligence packages sent by Europol to the relevant countries for investigation.  Officers from Australia, Belgium, Canada, Croatia, Cyprus, Denmark, Estonia, France, Germany, Hungary, Ireland, Latvia, Malta, Moldova, the Netherlands, Norway, Portugal, Romania, Slovak Republic, Slovenia, Spain, Sweden, Switzerland, the United Kingdom, Ukraine, the United States, Europol and INTERPOL took part in the 10th VIDTF.  Combining efforts to rescue children  Since 2014, Europol has been gathering victim identification specialists from across the world on a regular basis in order to focus on unsolved cases of child sexual abuse.  The VIDTF is the largest recurring operation of its kind in the world, and has inspired a number of similar initiatives at the national and regional levels, such as in Italy and Australia.  Now in its 10th iteration, the VIDTF has yielded the following results since it was first convened:  290 specialists from over 35 countries have taken part in this operational activity; A likely country of production was identified in 1 726 instances; Over 533 children have been safeguarded and 182 offenders arrested as a result of the VIDTF operations. Europol’s Executive Director Catherine de Bolle said: “Changing global circumstances in recent decades have changed the way child abusers commit their crimes and hide their tracks. Results such as these from the VIDTF show that law enforcement has kept up with these changes and built a formidable united front against this type of crime. This is echoed by the public’s support through the Trace An Object initiative, and together we can hopefully rescue more children and infants from abuse and sexual exploitation.” Public appeal for help  You can help us identify the origin of certain objects as part of Europol’s Trace An Object initiative. Non-confrontational details of images extracted from child sexual abuse cold cases are regularly made public, in the hope that someone recognises a detail that will help narrow down the location of the victim. 27 000 tips have already been sent to Europol, which have led to the identification of 23 children and to the prosecution of 5 offenders.   Europol is releasing today a new set of images in the hope that these can be identified by the general public.  View the new Trace an Object images.   

The latest actions under Operation Trivium, a multi-country operation against organised property crime on Europe’s road networks, has resulted in 174 arrests and the seizure of goods throughout Europe. The three-day operation saw law enforcement from 17 countries carrying out roadside checks on people and vehicles, as well as searching premises. Europol supported the operation by sharing information on the subjects, vehicles and modus operandi behind the criminal groups in real-time. Operation Trivium is organised under the umbrella of the EMPACT security initiative. Results from 3-5 November** 174 suspects arrested 27 cars confiscated More than 200 other goods seized, including weapons and drugs Almost 25 000 persons checked More than 16 000 vehicles checked Around 800 locations checked Three days of sweeping action across Europe In the space of only a few days, law enforcement authorities were able to carry out several interventions that disrupt organised property crime. 783 specific targets, consisting of individuals and properties, were identified and checked by law enforcement as part of the operation. These checks happened along with wider roadside checks of over 16 000 vehicles and 25 000 individuals, which meant criminal activity could be intercepted in a number of areas. Although most arrests related to organised property crime, arrests were also made in relation to drugs, weapons, and violations of immigration legislation.  Police also deployed methods such as automatic number plate recognition (ANPR) and monitoring drivers for suspicious behaviour as part of Operation Trivium XV. In one case in Belgium, a car caught investigators’ attention for driving aggressively; police found thousands of euros in cash, as well as large quantities of cocaine and cannabis, and an alarm pistol. In a separate search, Belgian police uncovered over EUR 70 000 divided into several small bundles; the driver later admitted the unexplained cash was the result of trafficking drugs between Belgium and Germany. Speedy Information Sharing Operation Trivium first started in 2013, and seeks to disrupt organised property crime on Europe’s road networks. This fifteenth iteration of Operation Trivium follows similar large-scale actions made in April of this year, which resulted in over 200 arrests and significant seizures of criminal assets. The success of its multi-country approach relies on speedy information sharing between participating law enforcement agencies, particularly regarding suspects, persons related to crimes, and vehicle data. *Countries involved: Albania, Austria, Belgium, Cyprus, Denmark, France, Germany, Greece, Lithuania, Malta, The Netherlands, Poland, Portugal, Romania, Serbia, Spain and Sweden. **With further results to be reported from actions in France, Lithuania and Malta.

The accelerated digitalisation related to the COVID-19 pandemic has significantly influenced the development of a number of cyber threats, according to the new edition of Europol’s Internet Organised Crime Threat Assessment. Criminals have been quick to abuse the current circumstances to increase profits, spreading their tentacles to various areas and exposing vulnerabilities, connected to systems, hospitals or individuals. While ransomware groups have taken advantage of widespread teleworking, scammers have abused COVID-19 fears and the fruitless search for cures online to defraud victims or gain access to their bank accounts. The increase of online shopping in general has attracted more fraudsters. With children spending a lot more time online, especially during lockdowns, grooming and dissemination of self-produced explicit material have increased significantly.  Grey infrastructure, including services offering end-to-end encryption, VPNs and cryptocurrencies continue to be abused for the facilitation and proliferation of a large range of criminal activities. This has resulted in significant challenges for the investigation of criminal activities and the protection of victims of crime.  In addition to expanding the efforts to tackle these threats from a law enforcement perspective, it is crucial to add another level of protection in terms of cybersecurity. The implementation of measures such as multi-factor authentication and vulnerability management are of utmost importance to decrease the possible exposure to cyber threats. Awareness raising and prevention are key components in reducing the effectiveness of cyberattacks and other cyber enabled criminal activities.  Europol’s Executive Director Catherine De Bolle highlighted: “Worldwide operations, such as the successful takedown of EMOTET botnet, have demonstrated the effectiveness of international cooperation. Ransomware groups have attempted to disrupt critical infrastructures, such as service providers and government institutions, to increase their profits with no concern for the possible damages such interceptions may cause to public safety and security. To this, the collective response of our international law enforcement community is clear: the authorities and the private sector worldwide stand strong and ready to mitigate together any threat that blackmails the stability of our societies.” The key threats Ransomware affiliate programs enable a larger group of criminals to attack big corporations and public institutions by threatening them with multi-layered extortion methods such as DDoS attacks.  Mobile malware evolves with criminals trying to circumvent additional security measures such as two-factor authentication.   Online shopping has led to a steep increase in online fraud.  Explicit self-generated material is an increasing concern and is also distributed for profit. Criminals continue to abuse legitimate services such as VPNs, encrypted communication services and cryptocurrencies. The new edition of Europol’s Internet Organised Crime Threat Assessment, launched today, looks into the (r)evolutionary development of these trends, catalysed by the expanded digitalisation of recent years. The report was presented during the Europol-INTERPOL Cybercrime Conference. The conference gathered about 100 experts together to share their insights into the latest cybercrime trends and threats and to discuss how innovation is essential in countering cybercrime acceleration. “Cybercrime is a reality and law enforcement worldwide needs to catch up,” said Edvardas Šileris, Head of Europol’s European Cybercrime Centre, ”Events like this bring together public and private entities in recognising the threat and identifying ways to combat it effectively. Only by working together can we create innovative ideas and practical approaches that can put a halt to cybercrime acceleration. It is essential to establish the environment and resources required to do so,” he added.  High value targets: the new victims of malware attacks   Ransomware groups have used the pandemic to their advantage to launch more sophisticated and targeted attacks. While mass distributed ransomware seems to be in decline, cybercrime groups and their affiliates opt for well-orchestrated manual attacks against large corporations and government institutions. Always driven by opportunities for larger profits, in the past criminals have targeted companies which have both the financial capability to pay large ransoms and the need to rapidly resume operations in case of a successful cyberattack, which affects their main activities. The attacks on Kaseya and SolarWinds show how criminals have realised the potential in attacking digital supply chains, often going for the ‘weakest link’. However, many of the most infamous groups have reduced the attacks on governments and social services in an attempt to limit the attention of law enforcement on them. DDoS attacks have re-emerged and are targeting service providers, financial institutions and businesses. Claiming to be part of two well-known threat groups, they have asked for significant ransoms. The pandemic has also facilitated the breakthrough of other threats, which were already making significant attempts to penetrate the cyberspace. Mobile malware and specifically banking Trojans have also been equipped with capabilities to intercept text messages on Android devices, compromising the two-factor authentication security protocols. Alarming rise of self-produced explicit material Child abusers have exploited the increased, unsupervised presence of children online during the pandemic in order to increase their grooming activities. The acceleration of production and dissemination of child sexual exploitation material is also fuelled by the proliferation of encrypted messaging applications and social media platforms. Online gaming and communication, the reduction of real-life social activities and the normalisation of sexual behaviour online are circumstances, which are abused by predators to target a larger number of victims. These factors create conditions for the victimisation of children online during a longer period. A key threat is the production of self-generated material, an alarming trend, which younger children are also exposed to. Lured by offenders using fake identities on gaming platforms and social media, more and more young children are falling into the trap of producing and sharing explicit material. Recording without the knowledge of the victims and the further dissemination of live-streamed sexual material is another alarming threat, referred to as ‘capping’. Peer-to-peer networks remain a key channel for the exchange of child abuse material, along with the Dark Web.

Operation Mobile 4, a two-week operation targeting multiple forms of organised property crime and fraud, has successfully concluded its November action days after thousands of border and roadside checks across Europe. Taking place in 16 European countries and further 6 Balkan states, operatives successfully intercepted hundreds of stolen vehicles and vehicle parts, as well as 1 000 irregular migrants and 31 people smugglers. Operation Mobile 4 is a wide-ranging international operation co-led by Greece, Germany, Poland, Frontex, and Europol. Police Officers and Border Guards from 23 European and West Balkan states* were involved in the investigation. Europol provided remote support by crosschecking in real-time the information collected in the field against its databases. Results from joint action days between 11-22 October  518 stolen vehicles 400 stolen car parts 140 fraudulent documents 4 stolen boats 10 000 database checks 1 000 irregular migrants 31 people smugglers A multi-pronged operation against smuggling Operation Mobile 4 is a wide-ranging international operation co-led by Greece, Germany, Poland, Frontex, and Europol. Police Officers and Border Guards from 23 European and West Balkan states* were involved in the investigation. Europol provided remote support by crosschecking in real-time the information collected in the field against its databases. During the two weeks of actions from law enforcement, officers pursued criminal activity on multiple fronts, carrying out vehicle checks, border searches and database analysis. The main focus related to stolen vehicles, vehicle parts, and migrant smuggling, with investigators also targeting trafficking in drugs, firearms and endangered species. The activities led to the seizure of 518 stolen vehicles. Officers also recovered several stolen luxury cars from Western Europe they found in Poland, the Czech Republic, Lithuania, and Slovakia, as well as 4 stolen boats. The authorities that took part in Mobile 4 observed an increasing trend of smuggling of stolen trucks, buses, agriculture machinery, and holiday cars such as campervans. Officers simultaneously raided chop shops, which dismantle stolen vehicles and facilitate parts smuggling, and performed roadside checks. This yielded 400 stolen vehicle parts, as well as 140 forged IDs and vehicle documents.  Further checks by law enforcement on road vehicles and boats detected 1 000 irregular migrants being smuggled into the EU, leading to the arrest of 31 migrant smugglers. Large scale cooperation and information sharing The close cooperation of law enforcement agencies enabled investigators to successfully target a wide range of criminal activity under Operation Mobile 4. Law enforcement also received support from private actors in the vehicle manufacturing and rental sector, which helped investigators be more efficient and precise on the action days. *Countries involved: Austria, Bulgaria, Croatia, Estonia, Finland, France, Germany, Hungary, Italy, Latvia, Lithuania, The Netherlands, Portugal, Romania, Slovakia, Spain, Albania, Bosnia and Herzegovina, Kosovo**, Republic of North Macedonia, Montenegro, and Serbia were involved in the operation on the spot. ** This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence.

On 5 November 2021, Europol, in cooperation with the European Commission, organised a tabletop exercise to test the implementation of the EU Crisis Protocol.  The exercise took place in the framework of the EU Internet Forum and examined the collaboration between government authorities and the tech industry to contain the viral spread of terrorist and violent extremist content online in the aftermath of a terrorist event. Among the tested elements was real-time communication between governments and online service providers and the interaction of processes when more than one crisis mechanism (sector/geography-specific) is initiated. Who was involved? The exercise brought together law enforcement representatives from EU Member States and third party countries, online service providers, the Global Internet Forum to Counter Terrorism (GIFCT), the Christchurch Call, the Aqaba Process, as well as policy makers from governments, EU bodies and international organisations. Claudio Galzerano, Head of Europol’s Counter Terrorism Centre, said: “This tabletop exercise was an excellent opportunity to firmly establish our public-private partnership with members of the technology industry in our ongoing fight against terrorism. It is imperative that we work together to share information in real time and use the latest technological advances to curtail terrorist and extremist content on online platforms.” A rapid, coordinated response to terrorist content online The EU Crisis Protocol, adopted by the Justice and Home Affairs Ministers in October 2019, is a voluntary mechanism that allows EU Member States and online platforms to respond rapidly and in a coordinated manner to the dissemination of terrorist content online in the event of a terrorist attack, while ensuring strong data protection and fundamental rights safeguards.  The development of the Protocol came about in the aftermath of the terrorist attack in Christchurch, New Zealand in 2019, whereby leaders from governments, tech industry, civil society and the EU Commission agreed on the ‘Christchurch Call for Action’. Since then, other crisis mechanisms have been developed both at a national level and by the tech sector. Yolanda Gallego-Casilda Grau, EU Commission representative and Head of the Prevention of Radicalisation Unit, said: “Terrorist attacks in Christchurch, Halle and Conflans-Sainte-Honorine serve as strong reminders that the online dimension can be an integral part of a terrorist attack, with the aim of further spreading the messages and objectives of terrorists. Our partnerships with tech companies facilitate the rapid assessment of the online impact of terrorist attacks, and the secure and timely sharing of critical information necessary for effective crisis response”. Tom Thorley, GIFCT Director of Technology, said: “A vital component of fulfilling GIFCT’s mission to prevent terrorist and violent extremist exploitation of digital platforms is how we strengthen our members’ collective efforts to respond to terrorist and violent extremist attacks. GIFCT’s Incident Response Framework streamlines how our tech company members can communicate and share situational awareness as an incident unfolds in order to identify any online dimension to an offline attack. In this inherently dynamic space, it’s critical to continue refining our efforts and how we engage with our partners, including through tabletop exercises like this one.” Europol has undertaken a central role in the EU Crisis Protocol implementation by managing the coordination of information exchange and communication among relevant stakeholders in a rapid and secure manner.  Recent acts of terrorism in France and Austria in October-November 2020 have further demonstrated the importance of disrupting the dissemination of terrorist and violent extremist propaganda during, and in the aftermath of, terrorist attacks, while at the same time supporting investigations. In order to enhance cross-sector collaboration and further advance the EU Crisis Protocol processes, Europol is hosting targeted tabletop exercises.

Updated on 8 November at 18:30 On 4 November, Romanian authorities arrested two individuals suspected of cyber-attacks deploying the Sodinokibi/REvil ransomware. They are allegedly responsible for 5 000 infections, which in total pocketed half a million euros in ransom payments. Since February 2021, law enforcement authorities have arrested three other affiliates of Sodinokibi/REvil and two suspects connected to GandCrab. These are some of the results of operation GoldDust, which involved 17 countries*, Europol, Eurojust and INTERPOL. All these arrests follow the joint international law enforcement efforts of identification, wiretapping and seizure of some of the infrastructure used by Sodinokibi/REvil ransomware family, which is seen as the successor of GandCrab. Anti-REvil team set up in Europe Since 2019, several large international corporations have faced severe cyber-attacks, which deployed the Sodinokibi/REvil ransomware. France, Germany, Romania, Europol and Eurojust reinforced the actions against this ransomware by setting up a Joint Investigation Team in May 2021. Bitdefender, in collaboration with law enforcement, made a tool available on the No More Ransom website that would help victims of Sodinokibi/REvil restore their files and recover from attacks made before July 2021. In the beginning of October, a Sodinokibi/REvil affiliate was arrested at the Polish border after an international arrest warrant was issued by the US. The Ukrainian national is suspected of perpetrating the Kaseya attack, which affected up to 1 500 downstream businesses and for which Sodinokibi/REvil asked a ransom of about €70 million. Additionally, in February, April and October 2021 authorities in South Korea arrested three affiliates involved in the GandCrab and Sodinokibi/REvil ransomware families, which had more than 1 500 victims. On 4 November, Kuwaiti authorities arrested another GandGrab affiliate, meaning a total of seven suspects linked to the two ransomware families have been arrested since February 2021. They are suspected of attacking about 7 000 victims in total. GoldDust’ links to GandCrab  Since 2018, Europol has supported a Romanian-led investigation which targets the GandCrab ransomware family and involved law enforcement authorities from a number of countries, including the United Kingdom and the United States. With more than one million victims worldwide, GandCrab was one of the world’s most prolific ransomware families. These joint law enforcement efforts resulted in the release of three decryption tools through the No More Ransom project, saving more than 49 000 systems and over €60 million in unpaid ransom so far. The investigation also looked at the affiliates of GandCrab, some of whom are believed to have moved towards Sodinokibi/REvil. Operation GoldDust was also built up on leads from this previous investigation targeting GandCrab. Decrypt with No More Ransom The support from the cybersecurity sector has proven crucial for minimising the damage from ransomware attacks, still the biggest cybercrime threat. Many partners have already provided decryption tools for a number of ransomware families via the No More Ransom website. Bitdefender supported this investigation by providing key technical insights throughout the entire investigation, along with decryption tools for both of these highly prolific ransomware families to help victims recover their files. KPN and McAfee Enterprises are other private sector partners that have also supported this investigation, by providing technical expertise to law enforcement. Currently, No More Ransom has decryption tools for GandCrab (V1, V4 and V5 up to V5.2 versions) and for Sodinokibi/REvil. The Sodinokibi/REvil decryption tools helped more than 1400 companies decrypt their networks, saving them almost €475 million in potential losses. The tools made available for both ransomware families enabled more than 50 000 decryptions, for which cybercriminals had asked about €520 million in ransom. Europol’s support Europol facilitated the information exchange, supported the coordination of operation GoldDust and provided operational analytical support, as well as cryptocurrency, malware and forensic analysis. During the action days, Europol deployed experts to each location and activated a Virtual Command Post to coordinate the activities on the ground. The international cooperation enabled Europol to streamline victim mitigation efforts with other EU countries. These activities prevented private companies from falling victim to Sodinokibi/REvil ransomware. The Joint Cybercrime Action Taskforce (J-CAT) at Europol supported the operation. This standing operational team consists of cyber liaison officers from different countries who work from the same office on high profile cybercrime investigations. *Participant countries: Australia, Belgium, Canada, France, Germany, the Netherlands, Luxembourg,  Norway, Philippines, Poland, Romania, South Korea, Sweden, Switzerland, Kuwait, the United Kingdom, the United States * Participating organisations: Europol, Eurojust and Interpol Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Spanish National Police (Policía Nacional), together with law enforcement authorities from Bosnia and Herzegovina, Croatia, Italy, Romania and Slovenia and supported by Europol and Eurojust, dismantled a criminal network facilitating illegal immigration along the Balkan route. The suspects used vans and trucks to hide the irregular migrants while transporting them in life-threatening conditions. The operation against this criminal group took place under the Operational Task Force Crafter, set-up by Europol.  The two action days on 22 April in Madrid and 7 May 2021 in Bucharest led to 15 arrests (12 in Spain and 1 in Romania, 1 in Slovenia, 1 in Croatia). 77 migrants detected in overcrowded truck  The investigation into this criminal network started in August 2020, when Slovenia reported the arrest of a suspect intercepted while transporting 53 irregular migrants in a van. Mainly Pakistani, but also Colombian, Spanish and Romanian suspects, were among the 17 identified members of the criminal network. So far, 15 of them have been arrested: 13 during the two action days in April and May, with a further two arrested in Croatia and Slovenia. The suspect arrested in Romania is the leader of the network considered a High Value Target by Europol.  The suspects recruited mainly Pakistani migrants from locations close to refugee camps in Bosnia and Herzegovina and would transport them via van to Italy, or in some cases Spain. While transporting them through the Balkan route, the criminals used separate cars as scouts to check the route and alert the ringleaders in case of police checks. In total, law enforcement authorities detected eight migrant smuggling attempts, four of which were aborted by the smugglers due to heavy police presence. Law enforcement authorities in Croatia intercepted a truck smuggling 77 migrants in life-threatening conditions, four of whom were minors. They also detected two other vehicles carrying 47 and 21 migrants respectively. The investigators estimate that the suspects have smuggled at least 400 migrants, earning about €2 million in illegal profits. Up to €20 000 per person from Pakistan to the EU Criminal organisations are extensively involved in facilitating secondary movements across the EU. Transportation through the Balkan route is increasing, with more countries such as Spain investigating networks active along this trafficking route. These secondary smuggling movements along internal European roads are extremely dangerous, with many cases of migrants being harmed along the way. Transported in life-threatening conditions in cars, van or trucks, they often spend days confined with little or no supplies. The amounts charged by the smugglers were also very high; in this case the suspects asked would-be migrants for between €5 000 to €8 000 for transporting one person from Bosnia and Herzegovina to Italy or Spain. They asked €3 000 for just the “trip” from Bosnia and Herzegovina to Slovenia. In total, Pakistani migrants would have paid the suspects up to €20 000 to reach their final European destination. Europol facilitated the exchange of information and provided analytical support. Europol additionally set-up an Operational Task Force to coordinate investigative efforts and support financially operational activities. On one of the action days, Europol deployed an expert to Madrid to cross-check in real-time operational information against Europol’s databases, provide technical support and thus give direct leads to investigators in the field. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The European Investment Bank (EIB) and Europol have signed a Working Arrangement that facilitates the sharing of information and expertise in the fight against fraud and corruption in Europe. Europol today hosted European Investment Bank Vice-President Kris Peeters for the signing of a Working Arrangement between our two organisations. Mr. Peeters was joined at Europol’s headquarters in The Hague by Europol’s Executive Director, Catherine De Bolle. The Arrangement provides a legal framework for the exchange of information and expertise relating to serious crime, with the objective of preventing organised crime in multiple areas - including financial crime, terrorism, and cybercrime. Today’s official signing seals the integration and cooperation the two parties, particularly relating to the prevention of fraud and corruption risks arising from the post-pandemic economic recovery. Money laundering and the financing of terrorist groups, as well as other forms of serious crime, pose serious threats to the security of the EU and its financial infrastructure. Working Arrangements such as this with the European Investment Bank and other European institutions will foster collaboration that protects rights and prevents criminal activities. Working together on common ground Kris Peeters, Vice-President of the European Investment Bank, said: “The cooperation with Europol reinforces the EIB capacity to prevent and combat fraud and corruption globally. This agreement takes even more relevance in the context of the recovery from the COVID-19 pandemic. While such crisis times require extraordinary measures, zero tolerance of fraud and corruption should remain central for multilateral institutions like the EIB. Resources released to support the recovery must reach their intended beneficiaries and not be diverted by fraud and corruption. Thanks to Europol’s extensive network of law enforcement agencies both within and outside of the EU, we will have more tools to ensure that we as a bank identify and prevent any sources of serious crime. Together the two institutions can make a difference in the international fight against fraud and corruption”. Catherine De Bolle, Europol’s Executive Director, said: “Cooperation between EU institutions is important for combatting organised crime, and for keeping communities across Member States safe. This Working Arrangement with the European Investment Bank enhances our abilities to fight crime on all fronts, especially our shared priorities in tackling fraud and corruption. As the information hub for European law enforcement, we are glad to be able to connect the EIB with expertise and resources to identify and fight back against serious crime.”

A total of 12 individuals wreaking havoc across the world with ransomware attacks against critical infrastructure have been targeted as the result of a law enforcement and judicial operation involving eight countries. These attacks are believed to have affected over 1 800 victims in 71 countries. These cyber actors are known for specifically targeting large corporations, effectively bringing their business to a standstill. The actions took place in the early hours of 26 October in Ukraine and Switzerland. Most of these suspects are considered high-value targets because they are being investigated in multiple high-profile cases in different jurisdictions. As the result of the action day, over USD 52 000 in cash was seized, alongside 5 luxury vehicles. A number of electronic devices are currently being forensically examined to secure evidence and identify new investigative leads. The ticking time bomb of undetected malware The targeted suspects all had different roles in these professional, highly organised criminal organisations. Some of these criminals were dealing with the penetration effort, using multiple mechanisms to compromise IT networks, including brute force attacks, SQL injections, stolen credentials and phishing emails with malicious attachments. Once on the network, some of these cyber actors would focus on moving laterally, deploying malware such as Trickbot, or post-exploitation frameworks such as Cobalt Strike or PowerShell Empire, to stay undetected and gain further access. The criminals would then lay undetected in the compromised systems, sometimes for months, probing for more weaknesses in the IT networks before moving on to monetising the infection by deploying a ransomware. These cyber actors are known to have deployed LockerGoga, MegaCortex and Dharma ransomware, among others. The effects of the ransomware attacks were devastating as the criminals had had the time to explore the IT networks undetected. A ransom note was then presented to the victim, which demanded the victim pay the attackers in Bitcoin in exchange for decryption keys.  A number of the individuals interrogated are suspected of being in charge of laundering the ransom payments: they would funnel the Bitcoin ransom payments through mixing services, before cashing out the ill-gotten gains.; International cooperation International cooperation coordinated by Europol and Eurojust was central in identifying these threat actors as the victims were located in different geographical locations around the world. Initiated by the French authorities, a joint investigation team (JIT) was set up in September 2019 between Norway, France, the United Kingdom and Ukraine with financial support of Eurojust and assistance of both Agencies. The partners in the JIT have since been working closely together, in parallel with the independent investigations of the Dutch and U.S. authorities, to uncover the actual magnitude and complexity of the criminal activities of these cyber actors to establish a joint strategy. Eurojust established a coordination centre to facilitate cross-border judicial cooperation during the action day. In preparation of this, seven coordination meetings were held. Europol’s European Cybercrime Centre (EC3) hosted operational meetings, provided digital forensic, cryptocurrency and malware support and facilitated the information exchange in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol’s headquarters in The Hague. More than 50 foreign investigators, including six Europol specialists, were deployed to Ukraine for the action day to assist the National Police with conducting jointly investigative measures. A Ukrainian cyber police officer was also seconded to Europol for two months to prepare for the action day. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). The following authorities took part in this operation: Norway: National Criminal Investigation Service (Kripos) France: Public Prosecutor’s Office of Paris, National Police (Police Nationale - OCLCTIC) Netherlands: National Police (Politie), National Public Prosecution Service (Landelijk Parket, Openbaar Ministerie) Ukraine: Prosecutor General’s Office (Офіс Генерального прокурора), National Police of Ukraine (Національна поліція України) United Kingdom: Police Scotland, National Crime Agency (NCA) Germany: Police Headquarters Reutlingen (Polizeipräsidium Reutlingen) Switzerland: Federal Police (fedpol), Polizei Basel-Landschaft United States: United States Secret Service (USSS), Federal Bureau of Investigations (FBI)  Europol: European Cybercrime Centre (EC3) Eurojust 

A joint investigation by Spain’s Civil Guard (Guardia Civil) and the French National Gendarmerie (Gendarmerie Nationale), supported by Europol, led officers to dismantle an organised crime group involved in migrant smuggling. The group is believed to have facilitated secondary movements, which is the process of moving irregular migrants from their country of arrival to another destination within the European Union. Incidence of secondary movements is growing, with new organised criminal groups forming in Europe’s transit cities in order to exploit irregular migrants. Results from 14 and 15 October 2021 Simultaneous raids in Spanish cities of Bilbao and Pamplona 2 house searches conducted in Navarra, Spain 7 arrests (6 Moroccan nationals, 1 Malian national), including the group’s three-person leadership New criminal uses for historic tobacco smuggling routes The organised crime group would firstly seek newly-arrived irregular migrants in southern and eastern Spanish coastal areas such as Murcia, Alicante, Vizcaya, Guipuzcoa, Navarra and Barcelona. The migrants arrived by boat from destinations in North and West Africa. Those irregular migrants would then be taken by road to France via former tobacco smuggling routes in Guipuzcoa and Navarra. The main destination point from there would be Bordeaux, France, with the organised crime group facilitating further illegal immigration from Bordeaux to countries across the European Union. The criminal group used at least two vehicles to cross the borders. The first transported the irregular migrants, while the second acted as a scout to warn in advance of possible police checkpoints. The suspects instructed the migrants to step out of the car and pretend to hitchhike in case of police checks. Using historic tobacco smuggling routes between Spain and France, the group was operating for about six months. The criminals charged between €100 and €330 for each border crossing. The investigation suggests that they have facilitated at least 60 border-crossings, with three to four migrants per transit. Europol facilitated the information exchange and provided analytical assistance during the investigation. During the action days, Europol deployed an expert to Pamplona, Spain, to provide operational, analytical and technical support to officers on the ground. The investigation was developed under the umbrella of EMPACT’s Joint Operational Team Dunquett. This project seeks to disrupt migrant smuggling networks active in Europe’s Atlantic coast. Watch the video

The Belgian Federal Police, the Italian Guardia di Finanza and Luxembourgish Judicial Police, supported by Europol, dismantled a large organised crime group involved in fraud and money laundering. The action day on 19 October led to: 34 locations searched (22 in Belgium, 10 in Italy and 2 in Luxembourg) 12 suspects arrested (10 in Belgium and 2 in Italy) Seizures include 32 high-end cars, real estate, luxury objects, money in 350 bank accounts and €400 000 cash totalling at least €3.5 million. In addition, €10.6 million were frozen in 16 bank accounts in Italy. 20 subcontractors used in Belgium The criminal organisation, managed by a single Italian family, had several companies in Italy, Romania and Slovakia, which recruited workers locally. The workers were then send to in the construction sectors in Western European countries, mainly in Belgium and Luxembourg. In Belgium, about 20 local subcontractors then hired the workers. They working conditions were often poor and the working legal conditions were not met including limit of working hours per day/week, minimum salary and annual leave. The investigation uncovered that the hiring companies had no activity in the countries they were based in and the employees they hired had never actually worked for the original companies. The fraud is estimated at €20 million without the possible VAT losses. Cross-border cooperation Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed two experts to Belgium and Italy to cross-check operational information against Europol’s databases to provide leads to investigators in the field. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Trafficking in human beings is a key threat perpetrated by criminal networks across the EU and harms victims through different forms of exploitation. Sexual exploitation is carried out in clandestine settings and public environments, targeting both adults and minors of all genders. The origins of victims of trafficking in human beings used for sexual exploitation in the EU are highly diverse, with more than 55 different reported nationalities inside and outside the EU. Labour exploitation occurs in various sectors of the economy, with more loosely regulated sectors being particularly vulnerable. Victims are typically exploited as low-wage and low-skilled seasonal workers. Traffickers also abuse their victims through several other forms of exploitation such as forced begging and  forced criminality. Child trafficking is a particularly serious crime as it targets such vulnerable members of society. The trafficking and exploitation of underage victims occurs across the EU and targets both EU and non-EU victims, for various types of exploitation. Human trafficking has a severe impact on the life of victims, often leaving them exposed to long-term social, physical and psychological harm. Law enforcement authorities have been increasing efforts in tackling traffickers and bringing victims to safety. Additional efforts have been invested as part of the EU’s European Multi-Disciplinary Platform Against Criminal Threats (EMPACT) framework. In 2021, three action weeks specifically focused on combating child trafficking, labour exploitation and labour exploitation in the agricultural sector. These EMPACT activities strengthen the cross-border and multi-agency cooperation in tackling human trafficking. In 2021, the three action weeks led to 416 arrests, more than 130 suspected traffickers identified in addition and the identification of almost 900 potential victims of exploitation.

A new EU-wide operation will target fraud against COVID-19 EU recovery funds being offered under the framework of the NextGenerationEU initiative. Operation Sentinel, launched on 15 October 2021 at Europol’s headquarters, involves the European Public Prosecutor’s Office (EPPO), Eurojust, the European Anti-Fraud Office (OLAF) and 19 EU Member States*. The activities will run for at least a year and will focus on proactive intelligence sharing, information exchange and supporting the coordination of operations to tackle fraud against COVID-19 EU recovery funds. Europol’s Executive Director Catherine de Bolle said: ‘The COVID-19 pandemic has profoundly affected our social and economic structures globally. NextGenerationEU, part of the largest stimulus package released in the European Union, will support Member States adversely impacted by the COVID-19 pandemic. Preventing serious cross-border crime is at the heart of Europol’s mandate, and we are fully committed to supporting the Member States in fighting any attempt by organised crime to infiltrate the EU legal economy and the NextGenerationEU fund. Our message is clear: any threat to the NextGenerationEU is a direct threat to the financial well-being of the European Union and its people. Operation Sentinel will strengthen our joint response to fraud and protect the reconstruction of our communities.’ Ensuring the € 806.9 billion fund is directed towards resilience  Through NextGenerationEU, the European Union will release a total of € 806.9** billion to support EU Member States in repairing the negative economic and social effects of the COVID-19 pandemic. The larger part of this funding, equivalent to € 723.8 billion, will be released in loans and grants to support investments focused on greener, more sustainable and more resilient societies. Recent experience from the evolution of the criminal landscape during the COVID-19 pandemic suggests these efforts will attract criminal groups active in the European Union and beyond. Criminals have shown themselves to be quick in adapting to the pandemic and its impact, and they are using every opportunity to maximise illegal profits. Therefore, Europol has set up Operation Sentinel to anticipate the expected wave of fraud against these recovery funds. For this purpose, Europol will establish a dedicated internal mechanism to process operational data, steer information exchanges and support ongoing cases. The joint activities will target fraud, as well as tax evasion, excise fraud, corruption, embezzlement, misappropriation and money laundering. Four EU entities and authorities from 19 EU Member States have joined forces as part of Operation Sentinel to ensure the recovery funds are directed towards strengthening our economies and the resilience of our communities. *Participating countries Austria, Belgium, Croatia, Denmark, Estonia, Finland, France, Greece, Ireland, Italy, Lithuania, Malta, the Netherlands, Poland, Portugal, Romania, Slovenia, Spain, Sweden **This figure is in current prices. It amounts to €750 billion in 2018 prices.

With the active support of Europol’s European Counter Terrorism Centre, the Spanish National Police (Policía Nacional) has arrested in Barcelona and Madrid five suspected members of an Islamic State cell. The suspects – all Algerian nationals, are believed to have been preparing a terrorist attack. The police swooped on the members of this terrorist cell after it became known that they were trying to acquire a Kalashnikov rifle. Several rounds of ammunition were seized at their homes, alongside several large machetes. Known as Operation ARBAC, this investigation began in December 2020 after the Spanish Police detected the entry into Spain of a member of the Islamic State. He and two accomplices were arrested in Barcelona in January of this year on suspicion on preparing a terrorist attack. The investigators were able to link these three suspects to an individual in Algeria known as “Sheikh” who was believed to be leading this terrorist cell. This individual was already known to law enforcement: he had been arrested in Turkey in 2016 while trying to join the Islamic State terrorist group. Once released, this individual toured several countries, such as Malaysia, Tanzania and Algeria where he allegedly recruited members for the Islamic State. In March 2021, he was detected entering into Spain. Special surveillance measures were put in place which allowed for the identification in Barcelona of a group of young, highly-radicalised Algerian nationals surrounding him. All these individuals, including the one known as “Sheikh” were arrested after trying to acquire a Kalashnikov rifle. The evidence seized during the course of the action day is now being analysed to identify further investigative leads across Europe. Europol’s support Europol’s European Counter Terrorism Centre has provided continuous intelligence development and analysis to support the Spanish investigators Two of its experts was deployed to Spain to assist the investigators with the cross-checking of operational information gathered during the action day.

Law enforcement and judicial authorities from Bulgaria, Cyprus, Germany, the Netherlands and Ukraine, supported by Europol and Eurojust, teamed up against an organised crime group involved in binary fraud. The group was behind an online trading platform for financial services with binary options. Europol set up an Operational Task Force to support the cross-border investigation. The Action day on 6 October 2021 in Kiev, Limassol and Sofia led to: 8 house searches (5 in Bulgaria, 1 in Cyprus, 2 in Ukraine) 17 individuals questioned in Bulgaria One high value target arrested in Cyprus Seizures included phones, electronic equipment, bank accounts and data back-ups  At least € 15 million lost on fake options Operating between May 2019 and September 2021, the criminal network lured German investors into making transactions worth a total of at least € 15 million. The suspects advertised the financial services online and via social media, while using over 250 domain names. The criminal network connected to a company, based in Ukraine, set up a call centre in Bulgaria. The approximately 100 employees of the two call centres, located in Sofia, contacted “clients” and advertised pretend financial services in the field of binary options under the guise of financial advisers. To undertake the scam, the call centre employees had scripts containing predefined conversations and key messaging to convince clients to release more funds. However, a subsequent investigation suggests that most of the employees were not aware that the company they were working for was involved in a fraud scheme. Initial profits shown in the user interface encouraged the clients to invest large sums of money. However, clients did not receive payment of their winnings or credit balance once they requested it. The investigation has so far led to 246 criminal proceedings across 15 German federal states. To support the investigation, Europol set up a dedicated Operational Task Force through which it facilitated the information exchange and provided analytical support. During the action days, Europol deployed six experts to Bulgaria, Cyprus and Ukraine to cross-check operational information in real-time against Europol’s databases so as to provide leads to investigators in the field. The experts also provided technical expertise to enable the extraction of information from mobile devices and IT infrastructure. Eurojust hosted a coordination centre to facilitate the information exchange and support cooperation between involved authorities during the action day.

Officers from the Spanish National Police (Polícia Nacional) and the Barcelona City Police Force (Guàrdia Urbana de Barcelona), supported by Europol, dismantled an organised crime group involved in property crime, facilitation of illegal immigration and document fraud. Results from 28 July 2021 3 locations searched  3 arrests  Seizures:  mobile devices almost 2 000 forged passports and ID cards of 56 different nationalities about € 13 000 in cash notebook containing accounting records of the criminal activity (orders, prices, deliveries) equipment for forging documents, including two printers, one machine for laminating and one scanner, a dedicated laptop, a press machine, tools to professionally cut the documents, UV inks, sprays, plastics with official security measures, kinegrams, chips for ID cards, needles and threads to sew passport booklets 11 000 fake ID documents were on their way The criminal network was involved in the counterfeiting and distribution of forged documents. It was also trafficking genuine documents, stolen in Spain. These were used by people with similar physical characteristics from Middle Eastern countries to facilitate their illegal entry into the EU. During the action day in July, a raid in the house of the main suspect in Barcelona led to the dismantling of a printing shop for fake documents. He produced the fake documents with high-quality security features such as UV holograms. The investigation uncovered that he had ordered 1 000 similar features for the manufacturing of French ID documents and 10 000 for Spanish ID documents. Europol facilitated the exchange of information and provided analytical support. On the action day, Europol deployed a virtual command post to enable the real-time exchange of information and cross-checking of operational information against Europol’s databases to provide leads to investigators in the field. Europol also deployed an expert to Barcelona to provide technical support with data extraction and analysis of digital evidence. The investigation was developed as part of EMPACT’s Joint Operational Team Doc Fraud to combat document fraud in the EU, targeting organised crime groups involved in the production of fakes and the trafficking of forged or illegally obtained documents.

The Budapest Metropolitan Police (Budapesti Rendőr-főkapitányság), supported by Europol, dismantled an organised crime group involved in fraud and money laundering. The operation was supported by the judicial and law enforcement authorities of the Dominican Republic via Interpol. The operational activities targeting this criminal group were initiated in 2017. Between September 2020 and September 2021, Europol supported five of the ten action days, which led to the complete dismantling of the network. The leader of the network was arrested in the Dominican Republic in June 2021, where he was hiding while using fake ID documents. After the action day in June, authorities froze his bank accounts and seized a number of electronic assets. He was extradited to Hungary on 28 September. Overall results: 130 suspects identified 116 searches conducted 477 victims identified € 3.5 million in estimated financial damage since 2014 Fake flat advertisement to steal banking details The criminal organisation defrauded its victims using fake advertisements of real estate properties for rent or sale. Some 100 flats are believed to have been misused for that purpose. The criminal group did not own any of the flats and the real owners did not have ties with the gang. The suspects created fake advertisements for the flats to con victims into sending them deposit money and rent. In a connected fraudulent activity, the suspects were also able to take control of the victims’ computers and intercept their financial details and perform transactions without their knowledge. The suspects also used the COVID-19 pandemic as a reason to install remote control software onto the computers of their victims.  To launder the proceeds, the suspects recruited Hungarian nationals for different jobs, luring them into becoming money mules during a probation period. The job applicants were tasked during that period with different activities such as opening bank accounts, receiving and transferring money, carrying out transactions in cryptocurrencies, and getting involved in the fake sale or rent of real estate. The illegal proceeds were sent to the Dominican Republic. Europol supported and facilitated the information exchange, the operational coordination and provided analytical support for this investigation, which lasted over a year. During the operational activities, Europol deployed a virtual command-post application to facilitate secure communication and real-time analytical support and deployed an expert on the ground during one of the action days. Europol’s specialists also supported the investigation by providing cryptocurrency expertise. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The German Federal Police (Bundespolizei) and the Romanian Police (Poliția Română), supported by Europol and Eurojust, dismantled an organised crime group involved in the migrant smuggling of predominantly Afghan nationals. Results from 5 October 2021 19 locations searched (14 in Timisoara, 4 in Timiş county and 1 in Bucharest) 27 suspects identified, of which 21 suspects arrested (16 Afghan, 1 Iranian and 4 Romanian nationals) Seizures include cash, 83 mobile phones, other electronic equipment and 10 morphine vials) Up to € 2 000 to jump off a lorry in Western Europe The investigative activities suggest that the network had been operating in the Romanian counties Timiş and Arad since May 2020. The criminal network, composed mainly of Afghan nationals, was smuggling Afghan migrants recruited from refugee camps and other places where asylum seekers gather. The suspects are believed to have smuggled about 200 migrants from Romania to countries in Western Europe, mainly France and Germany. The network facilitated the illegal transport and accommodation at transit points. Migrants were paying between € 1 000 and € 2 000 for the dangerous trip in the back of large lorries. Hidden between goods such as tree trunks and pallets, the migrants endured low temperatures and inhuman conditions during several days of transport. German investigators from Rosenheim and Munich detected about 50 similar cases. According to the investigations, the truck drivers were not aware that they had people in the back of their trucks. While the drivers took their sleep breaks in Romania, the smugglers released the sealed ropes covering the doors of the trailers to make an opening. From there, the migrants were able to enter the loading area unnoticed. Once in Germany, they jumped off the truck when the drivers took breaks or unloaded the cargo. Cross-border cooperation Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol enabled a virtual command post to facilitate the real-time exchange of information. Europol also deployed an analyst to Romania to cross-check operational information against Europol’s databases to provide leads to investigators in the field. Eurojust set up a joint investigation team (JIT) between Germany, Romania and Europol to facilitate the judicial cooperation. National authorities involved: Germany: Federal Police Inspectorate Rosenheim (Bundespolizeiinspektion Rosenheim), Federal Police District Office for Crime Control Munich , (Bundespolizeiinspektion Kriminalitaetsbekämpfung München), Public Prosecution  Office Traunstein (Staatsanwaltschaft Traunstein) Romania: Specialized Units in Countering Organised Criminality  from Timis, Arad and Caras-Severin Counties within Romanian Police (Poliția Română) and the Directorate for the Investigation of Organised Crime and Terrorism (Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism (DIICOT) in Timișoara Watch video Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Following a complex investigation supported by Europol, the Dutch National Police (Politie) together with the Czech National Organised Crime Agency (Národní centrála proti organizovanému zločinu) and the Slovak National Crime Agency (Národná kriminálna agentúra) swooped on a gun trafficking gang, arresting 6 of its members this past month in the framework of Operational Taskforce LOS. Two members of the criminal gang were arrested in Slovakia on 13 September, followed by the arrest on 5 October of 4 other members in the Netherlands (2) and the Czech Republic (2). All these suspects were considered as High-Value Targets by Europol. The criminal syndicate under investigation specialised in the conversion of so-called Flobert guns into lethal live-firing ones. They are believed to have supplied over 1 500 firearms to criminal groups in the Netherlands, Austria, Denmark, Germany, Portugal, Sweden and the Czech Republic. The investigation was initiated after 22 firearms were seized in February 2020 in Hoek van Holland, the Netherlands, in a transport vehicle on its way to the United Kingdom. The weapons were all in a live-firing state. In order to bring these gun traffickers to justice, an Operational Taskforce was established at Europol between the Netherlands, Slovakia, Belgium, Spain, Germany, Austria, Poland and the United Kingdom. Since then, over 350 weapons sold by these criminals have been recovered, including submachine guns and assault rifles, alongside several thousand rounds of ammunition. Twelve other suspects have also already been arrested in the framework of this Taskforce for their involvement in this illegal-gun running operation. The evidence seized during the course of the latest action day is now being analysed to identify further investigative leads across Europe. Europol deployed three of its own experts to the action day in the Czech Republic, while also funding the deployment of three Dutch investigators. This action day was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

The German Tax Office for Investigation and Criminal Matters (Finanzamt für Fahndung und Strafsachen) and the Italian Finance Corps (Guardia di Finanza), supported by Europol, dismantled an organised crime group involved in VAT fraud through the manipulation of cash registers. The action day on 21 September 2021 led to: 93 house searches  23 individuals facing criminal proceedings   Seizure of cash registers, a server and € 275 000 in cash  ‘Tuned’ cash registers hid income The joint operation, supported by Europol, targeted a criminal network selling software solutions for cash registers enabling businesses to manipulate their daily sales records. Cash-intensive businesses such as restaurants were able to use these ‘tuned’ registers to manipulate their income and diminish their output VAT and corporate tax liability. The customers, mainly Italians established in Germany, acquired both the hardware (cash registers and back offices) and the software from an Italian supplier, who had developed this product. This IT solution enabled the businesses to access the database of the cash register securely and decide how much of their daily income to hide and how much to declare to the tax authorities. More than 300 owners of Italian restaurants across Germany have allegedly bought this solution, which is priced significantly higher than an ordinary cash register that cannot manipulate financial records. Analysis and technical expertise to support investigations Europol supported the operational activities, facilitated the exchange of information and provided analytical support. During the action day, Europol deployed two experts to Italy to cross-check in real time operational information against Europol’s databases to provide leads to investigators in the field. Europol also deployed a forensic expert to Italy to provide technical support to take down the server. Europol recently created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Between 09 and 16 September 2021, Europol supported Europe-wide coordinated action days against human trafficking for labour exploitation in the agricultural sector. The operation, led by France, involved a wide range of law enforcement authorities including police, immigration and border guards, labour inspectorates and tax authorities from Bulgaria, Cyprus, Finland, Italy, Latvia, the Netherlands and Spain. The European Labour Authority also supported the action days. Almost 2 050 officers from national authorities took part in the operational activities on the ground. The action week resulted in: 12 arrests (8 in France and 4 in Spain) 54 suspected traffickers identified (27 in France, 21 in Italy, 2 in Latvia, 4 in Spain) 269 possible victims of exploitation identified, 81 of which of trafficking of human beings (17 in Cyprus, 91 in France, 134 in Italy, 24 in Spain and 3 in Latvia) 704 locations (vineyards, farms and others) checked 273 vehicles checked 4 014 people checked 126 new investigations initiated (14 in Finland, 93 in France, 2 in Italy, 9 in Latvia, 4 in the Netherlands and 4 in Spain) Focus on seasonal workers Law enforcement authorities carried out inspections in working places identified as more vulnerable to exploitation, such as farms and vineyards. The checks focused on the working conditions of the employees. Non-EU nationals have been identified as most vulnerable to exploitation in seasonal employments, while EU nationals are reported to be exploited in the agricultural sector year-round. The action days targeted criminal networks and facilitators involved in the trafficking of human beings, specialised in ‘brokering’ employment on the illegal market. Labour exploitation is a very lucrative criminal activity, damaging the health and rights of the victims. A successful operation in France dismantled a criminal network, which has generated an estimated € 5 million in damages for victims and authorities. During the actions against this network, authorities searched 25 locations and arrested winegrowers, service providers and intermediaries. The fight against human trafficking for labour exploitation requires a consolidated, cross-border effort by different authorities. During this action week, the European Labour Authority organised the first joint inspection, which took place in France and involved officers from the Bulgarian General Labour Inspectorate. Europol coordinated the action days and facilitated the information exchange between the participating countries. Europol provided analytical and operational support 24/7 and facilitated the real-time exchange of communication between the participating authorities. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

During 29-30 September, European Police Chiefs convened at Europol's headquarters in The Hague to discuss future threats to the internal security of the European Union. Europol's European Police Chiefs Convention (EPCC) is the most significant law enforcement convention taking place in the European Union. Co-hosted by the Slovenian National Police in the context of Slovenia's Presidency of the Council of the European Union, the EPCC covered serious and organised crime and terrorism, and its manifestations and infiltration within European society. Under the leadership of Europol's Executive Director Catherine De Bolle, police chiefs and high-level representatives from the EU Member States exchanged assessments of current and emerging criminal threats, challenges and opportunities across three panels and hundreds of bilateral and multilateral meetings. In their conclusions, the police chiefs addressed the issues of international police cooperation, emerging threats arising from the COVID-19 pandemic, and policing in a digital world.  

For the first time, Europol awarded the Europol Excellence Award in Innovation during the annual European Police Chiefs Convention 2021. With this award, Europol aims to put in the spotlight the law enforcement community's most innovative initiatives and operations. Over the past weeks, 105 nominations from law enforcement organisations across 25 nations in Europe and beyond have reached Europol, out of which two have been selected - one award for the most innovative law enforcement project and one award for the most innovative law enforcement operation. Europol’s Executive Director Catherine De Bolle: For us at Europol, innovation is at the heart of modern policing. Having received over 105 nominations, we consider this first Europol Excellence Award in Innovation a great success. Therefore, we want to turn it into a recurrent project linked to the annual European Police Chiefs Convention at our headquarters. Our Innovation Lab team will also create a network and invite all nominees for a follow-up event to exchange innovative ideas. The Excellence Award for the most Innovative Project Fortnite undercover avatar: an innovative tool to fight child abuse online (French Police Nationale) – A creative approach based on the creation of an online avatar in the video game Fortnite to which children could report if they were sexually harassed at home. After validation from the Central Unit for Minors Protection within the Central Directorate of the Judiciary Police, a team of 50 volunteers and psychologists connected to the game 14 hours a day, seven days a week from April to May 2020 to assist children asking for help. During this period, 1 200 children asked for help, out of which thirty percent were in a dire situation. Investigations were opened in a number of cases, and the children safeguarded. The Excellence Award for the most Innovative Operation EMOTET: world’s most dangerous malware disrupted through global action (US Federal Bureau of Investigation) - from 2014, the Emotet malware-infected millions of computers worldwide—enabling cybercriminals to steal victim information, cripple compromised networks and cause hundreds of millions of dollars in damage. Emotet targeted critical industries, including banking, e-commerce, healthcare, academia, government, and technology, and was designed to deliver additional malware to infected computers. In January 2021, the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada and Ukraine, Europol and Eurojust coordinated a multinational operation to disrupt Emotet's infrastructure. By using lawful authorities in several countries to seize command & control servers, neutralise malware distribution servers, and untether thousands of victim computers from the botnet. They also alerted authorities in more than 50 countries that Internet companies hosted hundreds of Internet Protocol addresses that Emotet compromised in their respective jurisdictions. Innovation in international Law Enforcement cooperation The Europol Excellence Award in Innovation highlights how effective modern-day law enforcement requires partnership and collaboration, whether in teams of officers and staff, between forces, in multi-agency operations or through wider public sector involvement. The award also recognise that accomplishments arise from a blend of innovative, committed and well-trained personnel, serving, engaging and protecting the public while using technology efficiently and effectively. We are convinced the award will inspire the European law enforcement community by providing insights into successful innovation. Europol was mandated by the Justice and Home Affairs ministers from all the EU Member States at the end of 2019 to create an Innovation Lab to support the law enforcement community in innovation. The Lab aims to identify, promote and develop innovative concrete solutions supporting the EU Member States' operational work. These will help investigators and analysts to make the most of the opportunities offered by new technologies to avoid duplication of work, create synergies and pool resources. The activities of the Lab are directly linked to the strategic priorities as laid out in Europol Strategy 2020+, which states that Europol shall be at the forefront of law enforcement innovation and research.

A joint investigation team (JIT) between the Dutch and German authorities has taken down an organised crime group specialised in explosive attacks against Automatic Teller Machines (ATMs). A total of 9 suspects have been taken into custody as a result of this 18-month investigation coordinated by Europol and Eurojust. The criminals were producing step-by-step tutorials on how to blow up cash machines, and have been linked to at least 15 ATM attacks in Germany. The cash machines were blown open using homemade explosive devices, posing a serious risk for residents and bystanders. During one of the test runs of an explosion, one of the suspects died, with the other suspect getting seriously injured. The investigation was initiated in February 2020 after authorities in Osnabrück, Germany, identified suspicious orders of ATMs machines from a German company. Special surveillance measures were put in place, which led the investigators to Utrecht, the Netherlands, where a 29 year-old individual and his 24 year-old accomplice were running an illegal training centre for ATM attacks. There, the pair was ordering different models of ATMs and recording tutorials on how to most effectively blow them up. In the framework of this investigation, links were also established between this criminal organisation and at least 15 ATM attacks in Germany. The total damage, including both the loot and the property damage, is estimated at approximately EUR 2.150.000. The investigation culminated in a series of police raids on 28 September for which two Europol experts were deployed in the field. Seven house searches were carried out in the Netherlands in the triangle of Utrecht, Amsterdam and the Hague, resulting in the arrest of three suspects. These three individuals are currently in custody in the Netherlands and are to be extradited to Germany. Given the cross-border nature of this case, a Joint Investigation Team (JIT) was set-up in April 2021 between the Dutch and German authorities with the assistance and financing of Eurojust. Furthermore, the Agency organised the judicial cooperation and supported the execution of European Investigation Orders (EIOs). In addition, an Operational Taskforce (OTF) was set up between Europol, Germany and the Netherlands to pool investigative resources and expertise. In the framework of this OTF, 18 operational meetings were held at Europol to prepare for the final phase of the action. Explosive attacks against ATMs are a growing concern, as they often put local residents’ and bystanders’ lives in danger. In order to prevent and tackle this type of crime, a close cooperation between law enforcement and the ATM industry is paramount. In this regard, Europol and the European Crime Prevention Network (EUCPN) have worked on a number of recommendations to prevent physical attacks against ATMs. Read more in the Preventing physical ATM attacks report. 

Spain, supported by Europol, coordinated Europe-wide joint action days targeting facilitation of illegal immigration, drug trafficking and trafficking of firearms. The operation took place between 15 and 18 September 2021. The operational activities involving 27 countries (17 EU Member States and 10 non-EU countries) were also supported by Eurojust, Frontex, INTERPOL and other international organisation.* The intelligence-led and multidisciplinary approach of these EMPACT Joint Action Days contributed to the results of this successful cooperation between a wide range of law enforcement authorities including police, immigration agencies and border control agencies.    330 arrests and 37 new investigations The operational activities took place mainly in Southeast Europe, while other countries from across Europe participated by sharing intelligence and conducting operational actions at the national level. The actions, involving almost 11 000 officers on the ground, led to 330 arrests related to different crimes including drug trafficking, the facilitation of illegal immigration, document fraud and the trafficking of firearms. The investigated activities also led to the detection of a number of offences related to the facilitation of illegal immigration and related crimes and legal violations such as visa fraud. Following the concerted actions, law enforcement authorities initiated 37 new investigations. Overall results: 33 418 people checked 724 locations searched 22 605 vehicles inspected Seizures including 154 firearms (65 pistols, 86 rifles and assault rifles, 3 gas alarms), 57 hand grenades and explosives, 2125 pieces of ammunition, 719 kg of cannabis and 920 marijuana plants) Where there are drugs, there are weapons The Western Balkans region is a key hub for the trafficking of firearms into the EU. Multi-national criminal groups source the weapons predominantly from countries form the Western Balkans, where human resources with expertise in firearms are widely available. The firearms are then trafficked to the EU, mainly to Belgium, France, Germany, Spain and the Netherlands. The illegal trade in weapons is closely connected to the trafficking of drugs, specifically to cocaine trafficking. In some cases, criminal networks exchange weapons for drugs. They also use the weapons to gain and maintain control over the lucrative drugs markets. Weapons traffickers offer high quantities and a wide range of firearms, including old and new military grade weapons. Some of the firearms are converted blank-firing weapons, imported from Turkey. Weapons are often smuggled as part of multi-commodity shipments or hidden in vehicles. Their prices in the Western Balkan are currently on the rise, though they are still a lot cheaper than in Western Europe. Coordination centre set up at Europol Europol supported the coordination of the action days and facilitated the exchange of information between the participating countries. During the course of the operation, Europol set up an operational centre to enable the swift exchange of operational information between the participants and provide live analytical support to field operatives. During the action week, Europol also deployed two experts to Montenegro and Bosnia and Herzegovina to facilitate the real-time exchange of communication between the participating authorities. *Participants EU Member States: Austria, Bulgaria, Croatia, Denmark, France, Germany, Greece, Hungary, Italy, Luxembourg, Malta, the Netherlands, Portugal, Romania, Slovenia, Spain, Sweden. Non-EU Countries: Albania, Bosnia and Herzegovina, North Macedonia, Serbia, Moldova, Montenegro, Kosovo*, Switzerland, Ukraine, USA. EU Agencies: Europol, Eurojust, Frontex International and institutional partners: Customs Cooperation Working Party (CCWP) CCWP, IPA/2019  (Instrument for Pre-Accession Assistance) countering serious and organised crime in the Western Balkans, INTERPOL, PCC-SEE (Police Cooperation  Convention For Southeast Europe Secretariat), SEESAC (The South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons), UNODC. * This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

An unprecedented international law enforcement operation involving 8 countries has resulted in criminal reports being filed against 61 suspects  belonging to a Balkan drug cartel flooding Europe with cocaine. A number of actions have been carried out in the past year in the framework of an Operational Taskforce between Spain, Croatia, Serbia, Germany, Slovenia, Bosnia and Herzegovina, the United States and Colombia, with coordination efforts led by Europol’s European Serious Organised Crime Centre. This highly mobile criminal organisation had branches active in several European countries and was composed mainly of criminals from Serbia, Croatia, Montenegro and Slovenia. An Operational Taskforce was established by Europol in July 2020 to bring together all the involved countries to coordinate a joint strategy to bring down the whole network. Since then, Europol has been provided continuous intelligence development and analysis to support the field investigators. Results of the Operational Taskforce Balkan Cartel 61 members have been charged, out of which 23 have been arrested (13 in Spain and 10 in Slovenia) Seizure of 2,6 tonnes of cocaine Seizure of 324 kilos of marijuana Seizure of €612 000 in cash Seizure of 9 luxury vehicles and 5 motorbikes A coordinated strike In the framework of intelligence activities carried out with their international counterparts, the Spanish investigators developed reliable intelligence that this cartel was preparing a major cocaine importation from South America into Europe in spring of this year. Special surveillance measures were put in place as the criminals moved back and forth between Spain and South America to finalise the details of the cocaine importation, totalling over 1,25 tonnes. The investigation gathered pace in March of this year when the leaders of this cartel travelled to Spain to prepare for the arrival of the cocaine shipment. These two individuals – considered as High-Value Targets by Europol, had until then avoided attending meetings in person in order to evade law enforcement. This was too good of an opportunity for law enforcement to miss: in the early hours of 10 March 2021, officers from the Spanish National Police (Policia Nacional) carried out simultaneous raids in the cities of Tarragona, Barcelona, Gerona and Valencia, arresting thirteen individuals, including the two kingpins and a police officer who collaborated with the criminal organisation. The Spanish investigators also dismantled the cartel’s alternative revenue streams, such as the production and trafficking of marijuana and the sale of luxury vehicles. In a follow-up action in May 2021 some 48 other members of the organised criminal group were charged in Slovenia by the National Police (Policija) for their involvement in the distribution of the cocaine and marijuana throughout Europe. A total of 10 of these suspects are now under arrest. The following law enforcement authorities were involved in this crackdown: Spain: National Police (Policia Nacional) Croatia:  National Police Office for Suppression of Corruption and Organised Crime (Policijski nacionalni ured za suzbijanje korupcije i organiziranog kriminaliteta - PNUSKOK) Serbia: Criminal Investigation Directorate of Serbia (Uprava kirminalisticke policije) Germany: Federal Criminal Police Office (Bundeskriminalamt), Police Headquarters Frankfurt am Main (Polizeipräsidium Frankfurt am Main) Slovenia: National Bureau of Investigation Bosnia and Herzegovina: Federal Police Sarajevo United States: United States Drugs Enforcement Administration  Colombia: National Police (Policia Nacional) This Operational Taskforce was part of Europol’s strategy in countering serious organised crime originating from the Western Balkans. Watch the video

The Spanish National Police (Policía Nacional), supported by the Italian National Police (Polizia di Stato), Europol and Eurojust, dismantled an organised crime group linked to the Italian Mafia involved in online fraud, money laundering, drug trafficking and property crime. The suspects defrauded hundreds of victims through phishing attacks and other types of online fraud such as SIM swapping and business email compromise before laundering the money through a wide network of money mules and shell companies. Last year alone, the illegal profit is estimated at about € 10 million. Overall results: 106 arrests, mostly in Spain and some in Italy  16 house searches 118 bank accounts frozen Seizures include many electronic devices, 224 credit cards, SIM cards and point-of-sale terminals, a marihuana plantation and equipment for its cultivation and distribution. This large criminal network was very well organised in a pyramid structure, which included different specialised areas and roles. Among the members of the criminal group were computer experts, who created the phishing domains and carried out the cyber fraud; recruiters and organisers of the money muling; and money laundering experts, including experts in cryptocurrencies. Most of the suspected members are Italian nationals, some of whom have links to mafia organisations. Located in Tenerife (Canary Islands, Spain), the suspects tricked their victims, mainly Italian nationals, into sending large sums to bank accounts controlled by the criminal network. They then laundered the criminal proceeds through a wide network of money mules and shell companies. Europol experts to support the field activities Europol facilitated the information exchange, the operational coordination and provided analytical support for this investigation, which lasted over a year. During the operational activities, Europol deployed two analysts and one forensic expert to Tenerife, Spain and one analyst to Italy. Additionally, Europol funded the deployment of three Italian investigators to Tenerife to support the Spanish authorities during the action day. The Joint Cybercrime Action Taskforce (J-CAT) at Europol supported the operation. This standing operational team consists of cyber liaison officers from different countries who work from the same office on high profile cybercrime investigations. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

On 16 September, Europol and Armenia signed a strategic cooperation agreement to expand cooperation to combat cross-border criminal activities. The agreement will enable both partners to work on some key areas such as migrant smuggling, cybercrime, drug trafficking, asset recovery, money laundering, organised property crime and trafficking in human beings. The agreement allows for the exchange of general strategic intelligence as well as strategic and technical information and operational information with the exception of personal data, and will lead to the secondment of a Armenian Liaison Officer to Europol. The signing of the Agreement on Strategic Cooperation concludes the successful negotiations between Armenia and Europol on how to effectively join forces to fight serious and organised crime. After entry into force of the agreement, this new level of cooperation will be important for tackling priority crime areas affecting both the European Union and Armenia.

The Italian Carabinieri Corps (Arma dei Carabinieri) and the Moldavian National Police (Poliția Republicii Moldova), supported by Europol and Eurojust, dismantled a criminal network involved in human trafficking for labour exploitation. The actions on 4 September 2021 led to: 6 house searches in Italy  6 arrests 5 Moldavian  nationals and 1 Italian  87 victims identified Seizures include 27 passports of victims and documentation revealing payments from the victims made since 2018, digital equipment and mobile phones and cash The investigation was initiated in 2019 when the Italian authorities detected a family-based criminal association, which recruited Moldavian women and transported them to Italy with tourist visas. The network then placed the women to work for local families without wages or any social benefits such as health insurance. The investigation uncovered that only between January and May 2021 and despite the travel restriction related to the global COVID-19 pandemic, the suspects had arranged at least 16 trips between Moldova and Italy. No rest, no proper bed, nor payment The criminal network composed of six Moldavian and one Italian nationals lured the vulnerable Moldavian women living in precarious social and economic conditions by promising them work as housekeepers in Italy. Once in Italy, the women were forced to work to pay a debt the network was collecting for transporting them and finding them employment. The jobs they were given involved long hours, however, few breaks and extremely poor living conditions. Some of the women were forced to sleep on the floor or to share a bed with several other people, even when they were sick. The network collected the ID cards and passports of victims pending full payment of the ‘debt’, which was often close to impossible due to the additional interest charged by the suspects. The criminal group also used their victims’ documents for fraudulent activities, such as false COVID-19 health certificates and employment contracts. Europol supported the operational activities, facilitated the exchange of information and provided analytical support. During the action days, Europol and Eurojust set up a virtual command post to enable the real-time exchange of information between investigators. Europol’s analysts also cross-checked operational information against Europol’s databases to provide leads to investigators in the field. The investigation was coordinated through a joint investigation team set up by Eurojust and led by Italy, which also involved Moldova and Europol.

More violent, diverse and competitive: these are the main characteristics of the cocaine trade in Europe. The new Cocaine Insights Report, launched today by Europol and UNODC, outlines the new dynamics of the cocaine market, which represents a clear threat to European and global security. The report was launched as part of the work programme of CRIMJUST – Strengthening criminal justice cooperation along drug trafficking routes within the framework of the Global Illicit Flows Programme of the European Union. The fragmentation of the criminal landscape in source countries has created new opportunities for European criminal networks to receive a direct supply of cocaine, cutting out the intermediaries. This new competition in the market has led to the increased supply of cocaine and consequently to more violence, a trend developed in Europol’s Serious and Organised Crime Threat Assessment 2021. Previously dominant monopolies in the wholesale supply of cocaine to European markets have been challenged by new trafficking networks. Western Balkan criminal networks, for instance, have established direct contacts with producers and secured a prominent place in the wholesale supply of cocaine. The report highlights the importance of intervention at the source as this market very much driven by the supply chain. Strengthening cooperation and further increasing the exchange of information between law enforcement authorities will enhance the effectiveness of investigations and the detection of shipments. The report highlights the importance of money laundering investigations to trace the illegal profits and of the confiscation of assists related to criminal activities. These financial investigations are at the core of the fight against cocaine trafficking, ensuring that the criminal activities do not pay. Julia Viedma, Head of Department of the Operational and Analysis Centre at Europol said: “Cocaine trafficking is one of the key security concerns we are facing in the EU right now. Nearly 40% of the criminal groups active in Europe are involved in drugs trafficking, and the cocaine trade generates multi-billion-euro in criminal profits. Understanding better the challenges we face will help us to counter more effectively the violent threat that cocaine trafficking networks represent to our communities.” Chloé Carpentier, Chief of the Drug Research Section at UNODC, highlighted how “the current dynamics of diversification and proliferation of cocaine supply channels, criminal actors and modalities are likely to continue, if left unchecked.”

An organised criminal network composed mainly of Albanian-speaking criminals, suspected of illegally trafficking drugs, has been dismantled with the support of Europol. 107 persons were arrested during an action day on 13 July which involved law enforcement authorities in Spain, Germany and Albania. The criminal group is believed to have been managing cannabis plantations in Spain where they cultivated and processed the marijuana, before it was transferred to other European countries for further distribution. On the action day, some 400 police officers on the ground carried out simultaneous raids in 42 different locations in Spain (Tarragona, Barcelona, Girona and Castellón). An additional 9 searches were carried out a few days later. These property searches led to the following results: 107 individuals arrested, including Albanian, Spanish, Slovak and Greek nationals 51 cannabis farms uncovered 25 000 cannabis plants seized €70 000 in cash and two-high end vehicles seized This clan-based organised crime group was hierarchically structured, with branches operating internationally. Some of its members arrested have a history of drug trafficking in different countries. The criminals were diverting the electricity supply to illegally cultivate the plants indoors. It is estimated that the stolen electricity amounts to over €1.6 million in lost utility revenue. Europol supported this investigation by providing tailored expertise and extensive analysis support and facilitating the exchange of information through its secure channels. On the action day, a virtual command post was set up by Europol to ensure seamless coordination between all the authorities involved. One of its experts was deployed on-the-spot to Spain to allow for crosschecks against Europol’s databases of the data gathered in the course of the action. Three Albanian investigators were also deployed to Spain in the framework of the Project IPA2019 aimed at countering serious organised crime in the Western Balkans. The following law enforcement authorities took part in this investigation: Spain: National Police (Policia Nacional), regional Catalan Police (Mossos D’esquadra) Germany: Customs investigation Office of Berlin-Brandenburg Zollfahndungsamt Berlin-Brandenburg Albania: State Police (Policia e Shtetit) Europol: European Serious Organised Crime Centre  Watch the video

Capture21 is this year's edition of Europol's photo competition. Unfortunately, 2020 was a devastating year. Millions of people were out of work and left struggling to pay their bills. Meanwhile, more than a billion children missed out on crucial schooling. To make matters worse, criminals adapted their techniques to exploit our fears around the COVID-19 pandemic, with the aim of profiting by any means necessary. Despite the challenging circumstances, the 2021 competition comes at a time of great hope, together with unpredicted levels of resilience from our communities and the law enforcement officers protecting them. As we enter this new environment, it’s time to frame the new normal. Europol invites professional and amateur photographers working with law enforcement authorities to show the evolving and increasingly innovative nature of their day-to-day work while designing the new normality.Law enforcement officers with a passion for photography can submit up to five photos under two different categories: Making Europe safer. EU law enforcement officers at work to make Europe a safer place. Operational insights into the fight against organised crime, e.g. drugs and weapons trafficking, people smuggling, counterfeiting, etc. Training exercises and manoeuvres. Law enforcement pictured in abstract and artistic form. Re-opening Europe. As vaccination programmes are rolled out across the continent, Europe is slowly reopening. Travel is picking up again. Businesses are opening their doors, and communities are coming back together. We're calling on photographers to share their stories from this latest episode of the COVID-19 pandemic. Also, show us how police forces are adapting, taking on new tasks and helping communities through the next phase. Closing date: 30.9.2021 For full details on how to participate, please visit the competition page. Entries will be used in Europol publications, including calendars, social media and other communication products, as has been the case previously.

A sophisticated fraud scheme using compromised emails and advance-payment fraud has been uncovered by authorities in Romania, the Netherlands and Ireland as part of an action coordinated by Europol. On 10 August, 23 suspects were charged as a result of a series of raids carried out simultaneously in the Netherlands, Romania and Ireland. In total, 34 places were searched. These criminals are believed to have defrauded companies in at least 20 countries of approximately €1 million. The fraud was run by an organised crime group which prior to the COVID-19 pandemic already illegally offered other fictitious products for sale online, such as wooden pellets. Last year the criminals changed their modus operandi and started offering protective materials after the outbreak of the COVID-19 pandemic. This criminal group – composed of nationals from different African countries residing in Europe, created fake email addresses and webpages similar to the ones belonging to legitimate wholesale companies. Impersonating these companies, these criminals would then trick the victims – mainly European and Asian companies, into placing orders with them, requesting the payments in advance in order for the goods to be sent. However, the delivery of the goods never took place, and the proceeds were laundered through Romanian bank accounts controlled by the criminals before being withdrawn at ATMs. Europol has been supporting this case since its onset in 2017 by: Bringing together the national investigators on all sides who have seen been working closely together with Europol’s European Cybercrime Centre (EC3) to prepare for the action day; Providing continuous intelligence development and analysis to support the field investigators; Deploying two of its cybercrime experts to the raids in the Netherlands to support the Dutch authorities with cross-checking in real-time information gathered during the operation and with securing relevant evidence. Eurojust coordinated the judicial cooperation in view of the searches and provided support with the execution of several judicial cooperation instruments. This action was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). The following law enforcement authorities were involved in this action: Romania: National Police (Poliția Română) The Netherlands: National Police (Politie) Ireland: National Police (An Garda Síochána) Europol: European Cybercrime Centre (EC3)

Europol has assisted the Polish authorities in dismantling an organised crime group involved in the production of illegal cigarettes. An action day was organised in Poland on 27 July which saw over 100 officers from the Border Guard (Straż Graniczna) searched a number of locations across the province of Warsaw. An illicit factory was dismantled, and 16 suspects charged for their involvement in this illegal tobacco activity. The leader of the criminal organisation features among those arrested. Over 1.6 million counterfeit cigarettes were seized on site by the Polish authorities, alongside 13 tonnes of tobacco which could have been used to produce a further 13 million cigarettes. The tax loss for the Polish Treasury is assessed at about €3.8 million. The estimated factory’s production capacity was of approximately 1 million cigarettes per day. The counterfeit cigarettes were destined predominantly for the UK and Germany markets, where they would have had a value of up to €9.7 million. Europol support Europol’s Analysis Project (AP) Smoke has supported the providing its secure communication platform and facilitating international cooperation between Poland and other Member States, running cross-checks and providing analytical support and operational expertise. AP Smoke deployed its experts to Warsaw to assist the Polish authorities with their action day. This action day was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). Watch the video

Officers from the Romanian Police (Poliția Română) and Border Police (Poliția de Frontieră Română), supported by Europol, dismantled an organised crime group involved in migrant smuggling across the so-called Balkan route. The action day on 29 July 2021 led to: 22 house searches 18 suspects arrested Seizure of munitions, five vehicles car, mobile phones and €22 000 in cash The criminal network, active since October 2020, consisted of Egyptian, Iraqi, Syrian and Romanian citizens. The criminal group had cells in the countries across the Balkan route from where regional facilitators managed the recruitment, accommodation and transport of migrants from Jordan, Iran, Iraq and Syria. Several criminal cells based in Romania facilitated the border crossing from Bulgaria and Serbia of groups of migrants and arranged their temporary accommodation in the area of Bucharest and in western Romania. The migrants were then smuggled to Hungary on their way to Germany as a final destination. In total, 26 illegal transports of migrants were intercepted and 490 migrants were detected in an attempt to illegally cross the Romanian border. Very well organised, the criminal group was involved in other criminal activities as well, such as drug trafficking, document fraud and property crime. Up to € 10 000 per migrant Migrants were paying between € 4 000 and € 10 000 depending on the trafficking segment. For example, the price for facilitating the crossing from Romania to Germany was between € 4 000 and € 5 000. The migrants, some of which were families with young children, were accommodated in extremely poor conditions, often with no access to toilets or running water. For the safe houses, the suspects rented accommodations or used the residences of group members, mainly situated in the areas of Călărași County, Ialomița County and Timișoara. In one of the safe houses, measuring about 60 m2, the suspects hid 100 people at the same time. The migrants were then transferred in risky conditions in overcrowded lorries between merchandise and in vans hidden in concealments without proper ventilation. Europol facilitated the exchange of information and provided analytical support. On the action day, Europol deployed one analyst to Romania to cross-check operational information against Europol’s databases in real time to provide leads to investigators in the field. Watch the video

With the support of Europol, the Spanish Civil Guard (Guardia Civil) and Tax Agency (Agencia Tributaria), in cooperation with the Portuguese Judicial Police (Polícia Judiciária) have dismantled an organised crime network involved in large-scale drugs trafficking, arresting eight of its members. These criminals were about to smuggle 15 tonnes of hashish into Spain when they were arrested. The investigation began at the end of last year after the Spanish investigators uncovered an organised crime group smuggling hashish from Morroco to Spain using different types of vessels. Europol’s European Financial and Economic Crime Centre (EFECC) assisted with the analysis of the criminals’ financial transactions, mapping out the full network spread out across Spain and Portugal. The investigation quickly focused on one particular vessel – known as the SEEFUCHS acquired by the criminal group in November 2020. The vessel was moved by the criminals to the Portuguese town of Portimao, where they changed its colour and increased its storage capacity. In June of this year, the SEEFUCHS set sail to Morocco, under close surveillance from law enforcement. Once the drugs were loaded onto the vessel, the criminals sailed back towards the Gibraltar Strait. The vessel was stormed by Spanish law enforcement some 100 nautical miles south of the Spanish coast. During the assault, five individuals were arrested and 15 tonnes of hashish seized in the boat’s cargo. Five house searches were carried out simultaneously across Spain, resulting in the arrest of three other members of this same gang, together with the seizure of €60 000 in cash. A luxury yacht which was also used for drugs transportation was seized in Lanzarote. A Europol specialist was deployed to Spain during the action day to support the authorities with the cross-checking in real time of operational information gathered during the raids carried out on that day. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

With the support of Europol, the Polish authorities have arrested two individuals committing so-called ‘Black Box’ attacks against ATMs, in which criminals connect electronic devices to a cash machine and remotely force it to spew out all its cash. The two suspects - both Belarusian nationals, were arrested in Warsaw on 17 July. The investigation uncovered that these criminals committed dozens of ATM attacks in at least seven European countries, stealing an estimated €230 000 in cash. The criminals were always targeting the same brand and model of ATM. The criminals would gain access to the ATM wires by drilling holes or melting parts of it in order to physically connect the machine to a laptop which was then used to send relay commands that caused the machine to dispense all its cash. Europol support Europol, supported by the Joint Cybercrime Action Taskforce (J-CAT), brought together the national investigators on both sides who have since been working closely together to prepare for the action day; Since then, Europol has provided continuous intelligence development and analysis to support the field investigators; Europol has been working closely with the ATM manufacturer targeted by these criminals, making the link with the different law enforcement authorities involved in the investigation. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). The following law enforcement authorities took part in the investigation: Poland: Provincial Police of Bydgoszcz and District of Żnin Germany: Federal Criminal Police Office (Bundeskriminalamt), Police Headquarters Brandenburg (Polizeipräsidium Brandenburg) Austria: Regional Criminal Police of Niederosterreich (Landeskriminalamt Niederosterreich) Switzerland: Federal Police (fedpol) Czech Republic: Bureau of Criminal Police and Investigation Service (Urad sluzby kriminalni policie a vysetrovani) Slovakia: Police Force of the Slovak Republic (Policajný zbor Slovenskej republiky)

The Portuguese Guarda Nacional Republicana led an EMPACT Joint Action Day targeting illegal fishing. The action day, co-led by the Spanish Guardia Civil and the European Fisheries Control Agency (EFCA)and supported by Europol, Eurojustand Frontex, involved authorities from Bulgaria, Croatia, Cyprus, France, Italy, Malta, Portugal, Romania, Spain and Sweden. Law enforcement and fisheries control agencies took part in the actions. Means mobilised: 3 162 inspectors (from police, fisheries, customs, agriculture and health agencies); 260 vehicles; 189 vessels; 18 aerial assets; 2 explosives detection dogs; Overall results: 2 248 persons, 12 vehicles and 194 vessels checked; 64 crimes detected; 185 administrative infringements; 8 arrests; Seizures included plastic explosives, detonating caps and wick, almost 11 tonnes of fish, crustaceans and clams (4.5 tonnes of trout, 6 tonnes of sardines, 50 kg of immature fish, 48 kg of bluefin tuna, 80 kg of fine clams, 31 kg of Norway lobsters), high-tech equipment, computers and documents, 167 illegal fishing nets and 20 other illegal tools. Europol facilitated the information exchange and the operational coordination and provided analytical support. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Working from home, the beach or a café is a reality for many people today. Everything we need is stored in our digital devices, such as personal computers, laptops and mobile phones, which contain important information about our personal and professional lives. Digitalisation has created a flexible living environment that gives us the freedom to easily access a universe of information. It also provides us with the space to store hundreds of thousands of different files: pictures of our kids and pets, electronic tickets, projects, important matrixes we have worked on for weeks, archives filled with decades of knowledge and memories. Ransomware enables criminals to steal all this in an instant. That is why it is crucial to beware, be aware and protect your digital world. Locked? Check the No More Ransom website for a key The decryptors available in the No More Ransom repository have helped more than six million people to recover their files for free. This prevented criminals from earning almost a billion euros through ransomware attacks. Currently offering 121 free tools able to decrypt 151 ransomware families, it unites 170 partners from the public and private sector. The portal is available in 37 languages. A new No More Ransom website has been launched to mark the project’s fifth year. Modern and more user-friendly, the new home of the Crypto Sheriff offers updated information on ransomware, as well as advice on how to prevent a ransomware infection. Read before you click The best way to stay healthy is not to get sick. That obvious statement also applies to ransomware attacks. Anyone can be a target – individuals and companies of all sizes. So, what can we do? Regularly back up data stored on your electronic devices. Watch your clicks – do you know where a link will take you? Beware of attachments in emails. Ensure that your security software and operating system are up to date. If you become a victim, do not pay! Report the crime and check No More Ransom for decryption tools. For the full picture: read all the prevention advice on the No More Ransom website. Join us in our fight against ransomware The partnership between law enforcement and private industry has contributed to the success of No More Ransom by helping victims and reducing criminal profits. Do you have an innovative solution for ransomware families not covered yet in the portal? We want to hear from you!

An investigation by the Bulgarian General Directorate for Combating Organised Crime (Главна дирекция Борба с организираната престъпност), the Hellenic Police (Ελληνική Αστυνομία) and the Hungarian National Police (Magyar Rendőrség), supported by Europol and Eurojust, led to the dismantling of an organised crime group involved in migrant smuggling. The leaders of the gang were arrested during the recent action day. Results from 21 July 2021: Simultaneous raids in Bulgaria, Greece and Hungary 15 location searches 12 suspects arrested (6 in Bulgaria, 5 in Greece and 1 in Hungary) Seizures included 25 vehicles (including 15 high-end cars), electronic equipment (laptops, GPS devices, tablets), more than 40 mobile phones, more than 100 SIM cards, crypto-mining equipment and cash Up to 15 migrants in a car The criminal network was smuggling migrants from Turkey to Greece through the Evros border region. During two years of investigation, law enforcement authorities detected more than 100 high-end cars serving the criminal activity, of which 66 were seized before the action day. The criminal group used vehicles which had been registered in Bulgaria and sometimes in Georgia. The cars were then transported to Northern Greece and Hungary, where they were used to smuggle migrants while driving at up to 250 kilometres per hour to avoid police detection. The suspects were collecting between € 2 000 and € 2 500 per person for the journey, and were transporting up to 15 migrants at a time. Both migrants and smugglers were injured in several speeding incidents. While the smugglers were racing with police at dangerous speeds, migrants were also concealed in the trunks of the vehicles. In the course of the investigation, 43 smugglers were arrested before the action day, while 1 smuggler died in a car accident. In total, 442 migrants were smuggled, of which 13 were injured. Northern Greece is an important hub for migrant smuggling due to the reinforced border protection along the Evros river. Following the crisis situation at Evros in February 2020, several mass migratory movement attempts were disrupted. The operation was carried out under the umbrella of the Greek National Operational Plan signed by Europol and the Hellenic Police in June 2016. The aim of the plan is to disrupt organised criminal networks involved in migrant smuggling and to reinforce secondary security controls in migration hotspots. Europol facilitated the exchange of information and provided analytical support. On the action day, Europol deployed two experts on the spot to enable the real-time exchange of information between investigators, Europol and Eurojust, and to cross-check operational information against Europol’s databases, providing leads to investigators in the field. Watch the video

Spanish and Serbian authorities have dismantled a large-scale drug trafficking network through a joint investigation team (JIT). In both countries, 43 members of a Serbian organised crime group have been arrested for their involvement in producing and distributing marijuana and hashish. During a major action day in Serbia and Spain on 28 June 2021 and during interventions against the organised crime group in January, the Spanish Guardia Civil and the Serbian Police carried out 19 searches and seized over 17 000 marijuana plants, over 880 kilos of marijuana buds, and at least 130 kilos of produced marijuana and hashish resins. Approximately EUR 250 000 in cash was also seized. Europol’s and Eurojust’s support of Operation Mitikas Europol, as a platform for European policing solutions, was involved in the case since March 2020. Throughout 2020 and early 2021, European Serious and Organised Crime Centre (ESOCC) of Europol supported Operation MITIKAS through the Drugs Unit by cross-checking information received, providing analytical support, and facilitating the coordination of the information exchange between Spain and Serbia. Two Europol specialists were deployed to Spain and Serbia equipped with a mobile office and a Universal Forensic Extraction Device. Information gathered during the operation was analysed and exchanged in real-time and immediately cross-matched against Europol's databases. Eurojust, the European Union Agency for Criminal Justice Cooperation initiated the cross-border judicial cooperation in November 2020, leading to the setting up of the first JIT between Spain and Serbia. It was the first time the Spanish authorities had initiated a JIT with a third country. Operation Mitikas was developed in the framework of the European Multidisciplinary Platform against Criminal Threats (EMPACT) and the operational action plan on cross-border drug trafficking sourced by large-scale herbal cannabis production in the EU. The cannabis market in the European Union The cannabis market remains the largest drug market in the EU, and cannabis trafficking will remain a significant source of income for a wide range of criminal networks. The trade in cannabis but also in other drugs such as cocaine and synthetic drugs is a key threat to the EU due to the levels of violence associated, the multibillion euro profits generated and the substantial harm caused by it. Herbal cannabis is extensively produced within the EU, with estimates indicating that at least 20 000 cultivation sites are dismantled each year, and is a major source of income for the criminal economy. Although herbal cannabis is produced in each EU Member State, this may not be sufficient to satisfy local demand; therefore, intra-EU trafficking exists as it has been shown in Operation Mitikas.

Europol and INTERPOL coordinated operation OPSON 2020, which targeted trafficking of counterfeit and substandard food and beverage. The operation, the tenth of its kind, ran from December 2020 to June 2021 and involved law enforcement authorities from 72* countries, including 26 EU Member States. The operation was also supported by the European Anti-Fraud Office (OLAF), the European Commission Directorate-General for Health and Food Safety (DG SANTE) and the European Union Intellectual Property Office (EUIPO), as well as national food regulatory authorities and private-sector partners. OPSON X in brief: 15 451 tonnes of illicit products seized with a value of about € 53.8 million About 68 000 checks 663 arrest warrants 2 409 location searches 42 criminal networks disrupted What are the main illegal products seized? (in order of quantity) Alcoholic beverage Food supplements and additives Cereals, grains and derived products Fruits and vegetables Sugar and sweet products Meat and meat products Seafood  Dairy products Poultry products Livestock Condiments Cooking oil Non-alcoholic beverages Coffee and tea  Canned food Animal food Case examples Trade of bivalves unfit for human consumption: eight arrests, seven companies investigated, seizures of € 120 000, 25 vehicles and 12 vessels; operation of the Spanish Civil Guard (Guardia Civil) and the Portuguese National Guard (Guarda Nacional Republicana), supported by Europol Adulteration of alcohol beverages: the criminal network used colourants to change the quality of the beverages; 14 arrests; seizures included 47 660 litres of whiskey and 9 550 litres of alcohol for the manufacture of fraudulent products; operation of the Guardia Civil and customs authorities, supported by Europol Counterfeiting of wine: five house arrest and three residence obligations, operation of the Italian Carabinieri Corps (NAS Carabinieri), supported by the Swiss Police and Europol #1 Honey or not: corn syrup and sugarcane alterations Targeted action on honey in: Austria, Belgium, Bulgaria, Cyprus, Czechia, France, Germany, Greece, Italy, Liechtenstein, Lithuania, Portugal, Serbia, Spain, Switzerland, the United Kingdom (Scotland), the United States. Fake honey has been in circulation since the 1970s when high-fructose corn syrup became widely available. To increase volumes and illegal profits, criminals add much cheaper corn syrup and sugarcane to genuine honey. This activity affects the market, which becomes inundated with counterfeits that are priced much lower than the genuine product. Consequently, beekeepers are forced to gradually lower the prices of genuine products. This can endanger their activities, leading them to decrease production as well as the bee populations that they maintain. Europol requested that national authorities perform checks on illegal products that could be detected in the supply chain. Dedicated food safety authorities performed checks on the internal markets, including livestock direct sales, collection and processing of bee products, wholesale trades, distributors, deposits, street markets, retail trades and productions of ready-to-eat foods. The authorities mainly checked the analytical detection of sugar syrup and corn syrup. Results: 495 checks 7 % non-compliant products, implying the seizure of more than  51 000 kg of fraudulently treated honey  #2 Fake in a glass Targeted action on alcohol and wine in: Belgium, Bulgaria, Croatia, Czechia, Estonia, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, the Netherlands, Northern Macedonia, Norway, Poland, Portugal, Romania, Spain, the United Kingdom (Scotland). Alcohol counterfeiting remains a serious threat to consumers while negatively affecting legitimate producers. OLAF coordinated the activities targeting fraud relating to alcohol and wine. Results: 1.7 million litres of wine, beer and alcoholic beverages seized Most infringements related to wine and vodka Reported also: food safety frauds and fiscal infringements #3 Focus on the sale of illegal horse meat Targeted action on horse passports and horse meat in: Belgium, Croatia, Denmark, France, Ireland, Italy, Spain. Operation OPSON IX saw the launch of a dedicated project to support national authorities in combating the sale of illegal horse meat. This action was led by Belgium, Ireland and the Netherlands and supported by DG SANTE. The follow-up activities during OPSON X led to the opening of three new investigations in EU countries. Europol’s Intellectual Property Crime Coordinated Coalition (IPC3) coordinated OPSON IX together with INTERPOL, facilitated the information exchange and provided technical and analytical support to participating countries. Europol also organised the targeted actions. Europol’s IPC3 is co-funded by EUIPO to combat intellectual property crime. Catherine De Bolle, Europol’s Executive Director, highlighted that Counterfeit and substandard food and beverage can be found both on the physical market and sold online. The increased health risk for consumers is proportional to the reduced quality of raw materials used in the food processing system. Europol sees a recent development: low-quality products have infiltrated the food supply chain, an evolution possibly related to the repercussions of the COVID-19 pandemic. With more than 15 000 tonnes of illegal products seized, operation OPSON X illustrates the importance of cooperation between national authorities and the private sector in protecting consumers’ rights and the quality of the products we put on our tables. Jürgen Stock, INTERPOL Secretary General said: Removing such an enormous quantity of illegal and often dangerous products from the market is a concrete example of how international police cooperation is making the world a safer place. Food crime may not always seem like a top policing priority but operations like OPSON X demonstrate the massive profits these products generate, which can then fund other organized crime activities. Ville Itälä, OLAF’s Director General, said: OLAF once again played a leading role in one of the key actions under Operation OPSON, focused on illicit wine and alcohol. The risks posed by these products to EU citizens and businesses are very real, and OLAF is proud to have worked hand-in-hand with Europol and national customs and police authorities in identifying, tracking and stopping the counterfeiters and fraudsters in this important part of the food and drink sector. OPSON X participating countries: * Afghanistan, Armenia, Australia, Austria, Belarus, Belgium, Bosnia and Herzegovina, Botswana, Bulgaria, Burkina-Faso, Burundi, Central African Republic, China, Colombia, Croatia, Cyprus, Czechia, Denmark, Djibouti, Ecuador, Eritrea, Estonia, Eswatini, Ethiopia, Finland, France, Ghana, Germany, Greece, Guatemala, Hungary, India, Indonesia, Ireland, Italy, Jordan, Kenya, Latvia, Liechtenstein, Lithuania, Luxembourg, Moldova, Montenegro, Morocco, Mozambique, Namibia, Netherlands, North Macedonia, Norway, Peru, Poland, Portugal, Romania, Russia, Rwanda, Serbia, Seychelles, South Africa, South Sudan, Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Tanzania, Timor-Leste, Trinidad and Tobago, Uganda, the United Kingdom, the United States, Vietnam, Zimbabwe.

A Referral Action Day (RAD) targeting online jihadist propaganda took place on 14 July 2021. The European Union Internet Referral Unit (EU IRU) at Europol organised the operational activities, which involved law enforcement authorities from Denmark, Germany, Hungary, Portugal, Slovenia, Spain and the United Kingdom. The Referral Action Day targeted online jihadist propaganda disseminated on the Internet Archive platform by referring these materials to the provider with the request to review them against the terms of service. This Referral Action Day focused on strengthening cooperation between Europol and law enforcement agencies together with the Internet Archive platform. It gave the opportunity to identify and assess terrorist content with the aim of raising awareness about the extent of the platform’s abuse by jihadists and their supporters. Among the referred content were propaganda material (videos, audios and digital magazines) of the so-called Islamic State and Al-Qaeda terrorist organisations and their affiliates. The Referral Action Day improved the knowledge about the patterns of abuse by terrorist groups. It also provided insights, which would enhance the content moderation policies in view of the Regulation on addressing the dissemination of Terrorist Content Online (TCO Regulation). The organisation of the Referral Action Day by the EU IRU has taken place in the context of the public-private partnership aiming to address the terrorist abuse of the Internet, prevent online radicalisation and safeguard fundamental rights and freedoms.

Europol, Portugal, Spain and the United Kingdom coordinated Europe-wide joint action days targeting child trafficking. The operation, also supported by Frontex, took place between 28 June and 4 July 2021 and involved 18* countries. A wide range of law enforcement authorities including police, immigration and border control agencies, transport police, social assistance and child protection services, and labour inspectorates participated in the joint action. The action days focused on potentially unaccompanied minors or minors who had escaped from shelters, as this group of children are frequently reported for their use of forged or false documents. The focus included minors detected at borders as well as those travelling within EU or Schengen associated countries. Another focus was intra-EU trafficking, where children are often trafficked by family members who are part of large family clans. These victims are mainly trafficked for the purpose of begging, forced criminality and sexual exploitation. The action days also targeted criminal networks and enablers involved in the trafficking of human beings that use fraudulent documents. 175 arrests and 187 potential victims The actions led to 175 arrests, 78 additional suspects identified and 181 new investigations initiated. Overall, 187 potential victims of human trafficking were identified, 92 of whom were confirmed to be minors. The involved national authorities focused on border crossings and main transport hubs to identify potential victims and suspects of human trafficking. Each country adapted their activities according to the types of child trafficking, which were nationally prevalent. 12 511 officers across Europe checked approximately: 186 400 people 12 200 locations 22 500 vehicles 72 850 documents The most vulnerable victims of an underreported crime Child trafficking remains underreported. Human traffickers target the most vulnerable groups and children are among them. Minors are trafficked for sexual and labour exploitation. Criminals force children to beg or commit different crimes, such as the smuggling of illegal goods and petty crimes. Within the EU, children are mostly trafficked by their relatives. These criminal organisations, connected through large clan networks, operate in several countries and move the children across borders. Children are being abused in different ways, including sexual exploitation, forced begging and other types of forced criminality. Minors from non-EU countries can become victims of migrant smugglers collaborating with the adults who accompany the children while pretending to be their relatives or legal guardians. *Participating countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Germany, Iceland, Latvia, Lithuania, Netherlands, Poland, Portugal, Romania, Slovenia, Spain, Sweden, Switzerland and the United Kingdom Europol coordinated the action days and facilitated the information exchange between the participating countries. Europol provided analytical and operational support 24/7 and facilitated the real-time exchange of communication between the participating authorities.

An investigation led by the Spanish National Police, with close cooperation with the Albanian Police and law enforcement and immigration authorities in Austria, France, Italy, Slovenia, Kosovo*, Portugal, the United Kingdom and the United States and supported by Europol, led officers to dismantle an organised crime group involved in migrant smuggling and document fraud. Results from the action day on 29 June 2021, Tarragona, Spain 18 arrests 2 house searches Seizures include: counterfeited documents, financial documentation, records of the illegal activities, electronic equipment, cash and various drugs (cannabis, cocaine and synthetic drugs) Since 2019, the investigation has examined the growing use of specific types of falsified documents by Western Balkan immigrants. Previous phases of the investigation led to the dismantling of a group of criminals identified on the Caribbean island of Saint Maarten who smuggled Albanian immigrants with falsified documents to the United States. Couriers travelling to Kosovo and Albania to distribute the falsified documents were also arrested in December 2020. Four print shops for forged documents in Kosovo were dismantled in March 2021. So far, the investigation has led to 46 arrests, more than 400 migrants identified at airports and 1 000 false documents seized. Eventually, the investigation targeted a criminal network based in the United Kingdom and Ireland, which managed the flights and the reception of the migrants into those countries. Intelligence shared by the US Department of Homeland Security, Homeland Security Investigations (HSI) led to the identification of a high-value target in Spain. From there, the suspect and his accomplices facilitated the illegal entry of migrants through various airports in Spain and Portugal into the United Kingdom, while providing them with forged French identity cards. The operation in Europe is also connected to three ongoing criminal investigations in the United States. Europol coordinated the investigation, facilitated the exchange of information, and provided analytical and forensic support. On the action day, Europol deployed a virtual command post to enable the real-time exchange of information between investigators and deployed an expert to Spain to cross-check operational information against Europol’s databases and provide leads to investigators in the field. Europol also financed the deployment of officers from the Albanian State Police who took part in the action day in Spain. * UN Security Council Resolution 1244.

The Romanian Police (Poliția Română) and the Spanish National Police (Policía Nacional), supported by Europol and Eurojust, dismantled a criminal network involved in human trafficking for sexual exploitation. The investigation resulted in two action days, one in Spain in February 2021 and one in Romania in June 2021. The two actions led to: 16 house searches (12 in Romania and 4 in Spain) 13 arrests (6 in Romania and 7 in Spain, 8 of whom were Romanian and 2 Spanish nationals) 25 victims (24 Romanian nationals and 1 Bulgarian national) identified in Romania (9) and Spain (16) Seizures include digital equipment and mobile phones, 5 bank accounts and over € 40 000 in cash The organised crime group – with branches in Romania and Spain – was luring victims into prostitution with the so-called ‘lover boy’ method. The victims were sexually exploited in night clubs in Spain. To avoid detection, the criminal group did not use money transfer services. Instead, Romanian gang leaders smuggled the cash out of the country themselves. The suspects also did their best to avoid using regular mobile networks and traveling by plane. Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. Europol financed the deployment of two Spanish agents in Romania for operational meetings and participation in the action day.

This week, law enforcement and judicial authorities in Europe, the US and Canada have seized the web domains and server infrastructure of DoubleVPN. This is a virtual private network (VPN) service which provided a safe haven for cybercriminals to attack their victims. This coordinated takedown, led by the Dutch National Police (Politie), under jurisdiction of the National Public Prosecutor’s Office (Landelijk Parket), with international activity coordinated by Europol and Eurojust, has now ended the availability of this service. Servers were seized across the world where DoubleVPN had hosted content, and the web domains were replaced with a law enforcement splash page. This coordinated takedown was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). DoubleVPN was heavily advertised on both Russian and English-speaking underground cybercrime forums as a means to mask the location and identities of ransomware operators and phishing fraudsters. The service claimed to provide a high level of anonymity by offering single, double, triple and even quadruple VPN-connections to its clients. DoubleVPN was being used to compromise networks all around the world. Its cheapest VPN-connection cost as little as €22 ($25). International coordination International cooperation was central to the success of this investigation as the critical infrastructure was scattered across the world. Europol’s European Cybercrime Centre (EC3) supported the investigation from the onset, bringing together all the involved countries to establish a joint strategy. Its cybercrime specialists organised over 30 coordination meetings and four workshops to prepare for the final phase of the takedown, alongside providing analytical and crypto-tracing support. A virtual command post was set up by Europol on the action day to ensure seamless coordination between all the authorities involved in the takedown. Eurojust facilitated the judicial cross-border cooperation and coordination, to ensure an adequate response in order to take down the network. For this purpose, and since October last year, six dedicated coordination meetings took place, organised by Eurojust, and set up a coordination centre during the action day, during which the operation was rolled on the ground by the various national authorities involved. The leading Dutch Public Prosecutor Ms Wieteke Koorn stated: This criminal investigation concerns perpetrators who think they can remain anonymous, while facilitating large-scale cybercrime operations. By taking legal action, including the special investigatory power for digital intrusion, we want to make it very clear there cannot be any safe havens for these kind of criminals. Their criminal acts damage the digitalised society and erode the trust of citizens and companies in digital technologies, therefore their behaviour has to be stopped. The Head of Europol’s EC3, Edvardas Šileris, commented: Law enforcement is most effective when working together and today’s announcement sends a strong message to the criminals using such services: the golden age of criminal VPNs is over. Together with our international partners, we are committed to getting this message across loud and clear. Participating authorities and agencies:  The Netherlands: National Police (Politie), National Public Prosecutor’s Office (Landelijk Parket) Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center United Kingdom: National Crime Agency (NCA) Canada: Royal Canadian Mounted Police (RCMP) United States: Federal Bureau of Investigation (FBI), US Secret Service (USSS), US Department of Justice (DOJ) Sweden: Swedish Police Authority (Polisen), Swedish Prosecution Authority (Åklagarmyndigheten) Italy: State Police (Polizia di Stato, Servizio Polizia Postale e delle Comunicazioni Roma, Compartimento Polizia Postale e delle Comunicazioni Lombardia), Public Prosecutor’s Office of Milan (Procura della Repubblica di Milano) Bulgaria: General Directorate for the Fight against Organised Crime of the Bulgarian Ministry of Internal Affairs (Главна дирекция "Борба с организираната престъпност" при Министерството на вътрешните работи на Република България) Switzerland: Cantonal Police Ticino (Polizia Cantonale del Cantone Ticino), Public Prosecutor’s Office Ticino (Ministero Pubblico del Cantone Ticino) Europol: European Cybercrime Centre (EC3) Eurojust

With the support of Europol, the Belgian Federal Judicial Police (Federale Gerechtelijke Politie, Police Judiciaire Fédérale) under the jurisdiction of the Belgian Federal Prosecutor’s Office (Federaal Parket, Parquet Fédéral) has taken action against the alleged members of an organised crime group running a worldwide Ponzi scheme. This criminal syndicate was using the social media platform ‘Vitae.co’ and website ‘Vitaetoken.io’ to trick people into investing into a Ponzi scheme. It is believed that some 223 000 individuals from 177 countries have fallen victim to this investment scam. On 22 June, house searches were carried out in 17 different locations in Belgium, mainly in Antwerp, West Flanders and Limburg. A total of five individuals were detained for their alleged involvement in this fraud scheme. The members of this organised crime group are for the most part Belgian nationals who were making use of a company under Swiss jurisdiction. A number of house searches were carried out in parallel by the Swiss Federal Police (fedpol). A total of €1,1 million in cash was seized, alongside €1,5 million worth in cryptocurrencies and 17 luxury vehicles. Europol deployed four of its experts to Belgium and Switzerland to assist the national authorities with the actions in the field. The website and social media platform have now been rendered inaccessible. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).