Crime News

Law enforcement authorities from 15 EU Member States* and the UK teamed up last month to dismantle a criminal network illegally trading cigarettes. Supported by Europol and the European Anti-Fraud Office (OLAF), the joint operation took place between 2 and 13 November 2020. Led by the customs departments of Lithuania and the UK, the operation was facilitated by intelligence analysis of excise duty suspension abuse. The fraud scheme consisted of illegally diverting cigarettes from EU internal and external transit customs procedures to the black market without paying millions in taxes. The operation led to: 17 suspects arrested; 67 million cigarettes and 2.6 tonnes of tobacco seized worth €35.82 million, with  88% of the cigarettes seized produced in Belarus; the most significant seizures of the illegally traded cigarettes were made in Lithuania (28.75 million), the UK (9 million), Poland (6 million), Ireland (3.5 million), Romania (2.2 million), Sweden (500 000), Latvia (740 000) and Croatia (150 000); Ten vehicles seized in eight of the participating countries. Excise duty fraud mechanism This joint operation targeted a fraud mechanism of duty suspension abuse: cigarettes produced inside the EU and declared for export or intra-EU delivery were moved under VAT and excise suspension. However, the goods never left EU customs territory or were not delivered within the EU as indicated in customs procedures and the relevant documents;  cigarettes withdrawn from transit regime or released into free circulation in the EU under VAT and excise suspension were distributed illegally without payment of these taxes and duties. Europol and OLAF support Europol and OLAF actively supported the operation. Europol facilitated the cross-border cooperation among Member States, set up preparatory operational meetings, enabled information exchange and cross-checks and provided analytical support and operational expertise. During the operation, OLAF also provided the tools for a secure exchange of information between the customs authorities and monitored and crosschecked the information exchanged.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. In 2019, Europol supported 1 874 international operations. *Participating EU Member States: Belgium, Croatia, Cyprus, Denmark, Estonia, Finland, Hungary, Ireland, Latvia, Lithuania, the Netherlands, Poland, Romania, Slovenia, Sweden. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Excise fraud is one of the priorities for the Policy Cycle.  

This week Europol launched an innovative decryption platform, developed in close cooperation with the European Commission's Joint Research Centre. It will significantly increase Europol’s capability to decrypt information lawfully obtained in criminal investigations. The launch of the new decryption platform marks a milestone in the fight against organised crime and terrorism in Europe. In full respect of fundamental rights and without limiting or weakening encryption, this initiative will be available to national law enforcement authorities of all Member States to help keep societies and citizens safe and secure. A virtual inauguration ceremony brought together senior representatives from Europol, the European Parliament, the Council of the EU and the Commission. The event highlighted strong organisational cooperation within the EU and the considerable potential in innovation, research and development of the EU innovation hub for internal security. Ylva Johansson, EU Commissioner for Home Affairs said: This decryption platform will help police to investigate terrorism and serious and organised criminality. It will be important in the fight against online child sexual abuse. National police forces can now send lawfully obtained evidence to Europol for decryption. Addressing the event, Europol’s Executive Director Catherine De Bolle said: Today marks the end of a three-year-long journey. We have made a significant step forward in combating the criminal abuse of encryption with the aim of keeping our society and citizens safe while fully respecting fundamental rights. The new Europol Decryption Platform, funded by the European Commission, will allow us to further enhance our support for Member State investigations. This is the result of successful inter-organisational collaboration within the EU and shows the potential for further joint work and support for the EU innovation hub for internal security. I would like to express my gratitude to the Joint Research Centre for their strong partnership in this project. Europol’s European Cybercrime Centre (EC3) will operate the platform and leverage its in-house expertise in providing the most effective support to national Member State investigations. EC3 is dedicated to strengthening the law enforcement response to cybercrime in the EU and focuses on cybercrime committed by organised crime groups, which generate large profits (online fraud), seriously harm victims (online child sexual exploitation) or impact critical infrastructure and information systems in the EU, including through cyber-attacks. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

On 3 December 2020, Europol supported the Spanish National Police (Policía Nacional), to dismantle an organised crime group smuggling irregular migrants from Morocco to the Canary Islands.  The criminal network, active in Spain and Morocco, was facilitating illegal and often life-threatening crossings from the Moroccan Atlantic Coast towards the Spanish Canary Islands. The irregular migrants crossed the sea in cayucos – wooden boats similar to canoes capable of sailing in open waters – often purchased from those working in the fishing industry in Africa. The suspects arranged accommodation for the irregular migrants on the island of Lanzarote in abandoned houses, campervans and motorhomes, before routing them by plane or ferries to their final destinations within the EU (France, Finland or Italy). For the irregular migrants to move within the EU, the criminal network supplied them with look-alike/forged documents.  The network charged between €1 000 and €1 500 per person depending on the final destination and the means of transport. The Spanish investigators estimated that the criminal group has generated over €100 000 in illegal profits. The operation led to: 3 house searches 19 suspects arrested in the Canary Islands and other Spanish mainland provinces 3 cars seized 8 mobile devices, 2 hard discs and a server seized Europol facilitated the information exchange and provided analytical support. During the action day, Europol deployed an expert on the spot to cross-check operational information in real-time against Europol’s databases and to provide technical support with digital forensic capabilities.  Watch the video JOT MARE, a long-term Europol project, was established in March 2015 as an EU-led response to the increasing sea smuggling activities. The team focuses on operational support and development of intelligence on sea smuggling and sea facilitated secondary movements in line with the dedicated EMPACT action plan.  Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Facilitation of illegal immigration is one of the priorities of the Policy Cycle.  

On 14 December, Europol supported the Spanish National Police (Policiá National) to take down a large Russian-speaking high-risk organised crime network involved in corruption and money laundering in Spain. The large-scale criminal network, implicated in a number of other criminal activities including murder, drug trafficking, arms trafficking, trafficking of human beings and extortion was active across Europe, South America and the United States. Given the high hierarchical position of those investigated, this operation, which began in 2013, is the largest against the Russian-speaking top-level organised crime in Spain in the past 10 years.  The operation led to: 23 arrests 18 house searches   10 weapons seized  23 properties, 16 high-end vehicles, diamonds, and virtual wallets seized bank accounts and property assets worth millions of euros blocked  €300 000 and $35 000 cash seized The large-scale criminal network managed to infiltrate various Spanish public institutions. One of the main targets was able to carry out philanthropic activities in these public institutions, which allowed the criminal group to penetrate the administration. This enabled the network to carry out their business with impunity, overcome legal obstacles and receive a series of administrative favours including protection from police and judicial investigations and facilitation of the acquisition of Spanish residence for the clients of the criminal organisation. Among those ‘investing’ in the group’s activities were eastern European criminals of the highest authority in the underworld – known as ‘thieves-in-law.’ Lawyers, officials, politicians, businesspeople and hackers were connected to the network, increasing their operational capabilities. State infiltration and control over the tourism sector The investigation uncovered how the criminal leaders contacted the investigated individuals to carry out money laundering operations. These activities included various investment projects such as land acquisition to develop luxury real estate projects, and purchasing restaurants, industrial warehouses, plots and boats. To launder the foreign assets the group used a network of bogus companies established in different counties, including South America. The criminals used advanced technologies, such as cryptocurrencies. They were planning to purchase one of the main nightclubs on the island of Ibiza and to take over the nightlife and catering sector, both on the Levantine coast and in the Balearic Islands. This is a clear indication that this dangerous Russian-speaking organised crime network was planning to control key sectors of the Spanish economy, such as the tourism sector, and to infiltrate state institutions.               Europol supported the investigation since its very beginning as a high priority case. Europol facilitated the information exchange and provided analytical support. During the action day, Europol deployed experts on the spot to cross-check operational information in real-time against Europol’s databases and to provide technical support with digital forensic capabilities.  Due to the increased threat posed by the high-risk organised crime groups, Europol is strengthening its activity by delivering agile operational support to the EU Member States or third operational parties, building the strong operational coalitions to tackle top-level organised crime actors. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. Watch the video    

Today the Finnish Customs (Tulli) have shut down the Sipulimarket dark web marketplace and seized all its content. This latest hit against the dark web was done in close cooperation with the Polish Provincial Police Headquarters in Wroclaw (Komenda Wojewódzka Policji we Wroclawiu) and Europol’s European Cybercrime Centre (EC3) and Eurojust.  Drugs and other illegal commodities were sold in large quantities on Sipulimarket which had been operating on the The Onion Router (Tor) network since 2019. It was the only remaining Finnish language dark web marketplace on Tor after the Finnish Customs shut down Silkkitie (Valhalla) in spring 2019.  Europol supported the Finnish Customs by providing operational support and technical expertise, including hosting the seizure banner. Bitdefender, an internet security company, provided assistance by advising Europol's European Cybercrime Centre (EC3).  This is yet another example of how law enforcement continues to successfully target criminal activity on the dark web.   

Europol supported the Moldovan National Anticorruption Centre to dismantle an organised crime group involved in match-fixing in Moldova’s top football division. Club executives, coaches, managers, football players and other intermediates are believed to be part of the network. This large-scale corruption scheme concerns half the football clubs (5 of 10) in the top division. It is believed that over five months nearly 20 football matches were fixed during the current football season (2020-2021). The criminals would influence the outcome of the games and bet mostly on the Asian market. The bets amounted between €10 000 and €20 000 for a single fixed match. Overall, the criminal profits are estimated at €600 000. Links to EU Member States have been also detected. The investigation is ongoing. Results 4 suspects arrested  34 houses searched including the office of a football club 20 mobile phones, documents and bank cards seized Europol facilitated the information exchange and supported the case with operational analysis. On the action day, Europol provided operational support by deploying two experts to Moldova to crosscheck operational information against Europol’s databases and provide links to investigators in the field. Europol also provided forensic technical support for the analysis of the seized electronic devices.  Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

In 2015, Europol set up operation Troika with Customs and Police authorities from Denmark, the Netherlands, Norway, Sweden and the UK. The taskforce focused on drug smuggling (mainly heroin, cocaine, cannabis and synthetic drugs) across Scandinavia and the UK. In the framework of the taskforce officers were able to identify numerous criminals as high-value targets and gather and develop intelligence from all EU countries. Joint days of action identified major drug transport operations to the UK, leading to large cocaine seizures. Operation Troika is still on-going and continues to gather intelligence with the aim to disrupt organised crime groups involved in drug trafficking. Main results related to Taskforce Troika: 11 640kg of drugs worth more than €358 million seized  62 arrests 3 joint investigation teams set up Major drug transport operations discovered  Criminal groups disrupted Numerous high-value targets put under investigation Drug concealment trends identified Troika in a nutshell  Gather, enhance and share information and intelligencEuropol analyses the operational information and  intelligence  Identify and monitor subjects of interest Identify modus operandi and movements Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Drug trafficking is one of the priorities for the Policy Cycle.    

Over 42 000 parcels were checked and hundreds of weapons seized as part as a joint operation targeting the trafficking of firearms to and within the EU through post and courier services. Taking place between 16-20 November, Operation ARMSTRONG VII saw the involvement of police and customs authorities from 26 countries, with international coordination efforts supported by Europol and the European Commission – DG for Taxation and Customs Union (TAXUD) and DG Migration and Home Affairs (HOME) and the Customs Cooperation Working Party (CCWP). This operation took place in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) and implements the EU action plan on firearms trafficking 2020-2025 adopted by the European Commission in July 2020. During the action week, police and customs authorities in the participating countries carried out enhanced controls of suspicious parcels and postal shipments. This operational phase was preceded by an intelligence phase in which Europol and DG TAXUD developed risks indicators, including those relating to purchases via the dark web in order to increase the success rates of parcel controls during the action week. Results of the action week 42 124 parcels checked 416 officers involved 6 firearms, 13 firearms parts and 600 pieces of ammunition seized Seizure of 297 other weapons (knives, pepper spray, tasers, etc.) Participating countries Austria, Bulgaria, Cyprus, Czech Republic, Germany, Denmark, Estonia, Greece, Spain, Finland, France, Hungary, Ireland, Lithuania, Luxembourg, Netherlands, Portugal, Romania, Sweden, United Kingdom, Switzerland, Norway, Albania, North Macedonia, United States.  Europol support Europol has been actively involved from the onset of this operation by collecting intelligence from all participating partners on firearms and ammunition seized from postal packages from November 2019 until October 2020. This intelligence was used as input to identify risk indicators that were shared with law enforcement to prioritise checks and identify packages possibly containing firearms or firearms-related commodities. During the action week, Europol set up a virtual command centre and provided a platform for real time information sharing and cross-checking of intelligence, creating a communication network involving both police and custom authorities. Information collected and shared during the action days will be processed and analysed in post operational phase during which concerned countries will be duly informed about any relevant outcomes. The illicit trade of firearms by parcel mail The use of fast parcels or parcel mail has been identified as a key modus operandi for firearms trafficked to and within the EU. Differences in legislations are exploited by criminals, whereby firearms or firearms components restricted in one country easily and openly can be ordered from another through the internet. Moreover, firearms are frequently traded on online platforms, including dark web marketplaces. This development has resulted in a significant increase in the use of parcel and postal services to traffic firearms and firearm components. Strong police - customs cooperation With millions and millions of parcels crossing the borders, finding the particular shipments containing firearms and other prohibited items constitutes a sizeable challenge for police and customs and other law enforcement authorities across Europe. In this endeavour, the key success defining factor is intelligence: knowing what to look for (i.e. consignor), where (i.e. courier company) and when (i.e. at arrival, during customs clearance, etc.) based on emerging new trends. This can only be achieved through active and continuous operation between police and customs and the private industry (post and express courier services). In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Illicit firearms trafficking is one of the priorities for the Policy Cycle.  

While Europe is hit by the second wave of the COVID-19 pandemic, testing is ongoing for potential new vaccines to treat the virus. The European Medicines Agency (EMA) has announced that it will conclude evaluation of the first conditional marketing authorisation application for a COVID-19 vaccine before the end of the year. Several EU Member States have already published their vaccination plans. Europol urges increased vigilance among Member States and third-party countries on the possible involvement of criminals in the vaccine development and distribution process. Today, Europol has published an early warning notification on Vaccine-related crime during the COVID-19 pandemic. Confirmed crime projections of counterfeit vaccines In April this year, Europol announced the potential harm of offline and online scams offering alleged versions of the COVID-19 vaccine. Projections were also made in relation to the announcement of a genuine vaccine and the reaction of organised crime to adapt its methods to meet demand1. These projections were later confirmed in Europol’s November report, where it was identified that the distribution of substandard and counterfeit pharmaceutical products, including preventative COVID-19 vaccines had remained a consistent pandemic-related criminal activity2. Counterfeit vaccines may pose a significant risk to public health  Owing to the pandemic, the demand for influenza treatments has been higher than usual and there are risks of shortages in numerous countries. This high demand may encourage people to seek the vaccine elsewhere. For this reason, once the legitimate vaccine enters the market, counterfeit versions of the brand are expected to circulate rapidly to meet the high demand. It is feared that criminals will share disinformation to defraud individuals and companies alike. There have already been cases of advertisements on dark web marketplaces using the brands of genuine pharmaceutical companies that are already in the final stages of testing3. These counterfeit vaccines may pose a significant risk to public health if they are ineffective or toxic, given their production in labs without the required hygiene standards. These fake vaccines may circulate on illicit markets or be introduced to the legal market for distribution.  Europol actively encourages Member States to share any relevant information on criminal activities related to COVID-19 or flu vaccines. 1 Europol Report:  Beyond the pandemic – what will the criminal landscape look like after COVID-19? 30 April 2020. 2 Europol Report: How COVID-19 related crime infected Europe during 2020 12 November 2020. 3 Europol information.

Delegates from EU and non-EU countries and international organisations attended the 4th annual Drugs in Europe conference, Enhancing law enforcement responses to high-risk organised crime. The conference focused on Europe's unprecedented drug situation. As organised crime is increasing, they pose the highest and most diverse risk to EU internal security. Drug trafficking is the cornerstone of the criminal activities of these high-risk organised crime groups and neither the COVID-19 pandemic nor related restrictions have had a decreasing impact on their activities. Europol holds this annual conference to offer a platform for senior law enforcement officials to enhance the situational awareness of drugs and to assess and discuss proper operational future responses. Europol's Executive Director Catherine De Bolle remarked in her keynote speech:  “The fight against drug trafficking is one of the top crime priorities in the European Union and a priority of Europol's strategy 2020+ which led to the establishment of a dedicated Drugs Unit. We will continue to support EU Member States in their investigations targeting individuals that constitute the highest risk of serious and organised crime threats. Europol contributes to a measurable reduction to the availability of illicit drugs by providing operational and strategic services to law enforcement.” Five factors that indicate the seriousness of the situation Supply: the supply of all kinds of drugs is increasing and so are the numbers of substantial seizures. The number of cross-border organised crime investigations supported by Europol has increased between 2018 and 2019. This increasing trend has also continued in 2020 despite the COVID-19 pandemic. Recently, Europol supported an investigation that dismantled an international drug trafficking network, which was responsible for the annual importation of at least 45 tonnes of cocaine into main European seaports, with profits exceeding €100 million in six months. Recent intelligence indicates significant changes in trends of cocaine-related trafficking, with the EU becoming the leading destination. High illicit profits: billions of euros in profits from drug trafficking support a vast underground economy that threatens Europeans’ prosperity, particularly in economic downturn situations such as those created by the current pandemic. High-risk organised crime groups are making extensive profits – at least €110 billion a year. Despite comprehensive money laundering legislation in EU Member States, asset-tracing results in terms of confiscations remain at an extremely low level. Of the billions of euros generated by the illicit drug trade in Europe, a low percentage is confiscated and more needs to be done to address this situation. Drug-related deaths: numbers in Europe are at an all-time high. These mostly affect younger, more vulnerable members of society. This situation looks set to worsen as drug purities increase and an increasing number of hazardous substances reach the market. Violence: the involvement of organised crime groups in the drug supply chain brings violence and security threats to our societies.  Europol sees an increase in the number and quality of violent attacks associated with organised crime and, in particular, drug trafficking in the EU over recent months. Contract killings, shootings, bombings and stabbings are used by drug traffickers to intimidate associates, remove competitors and threaten officials and the public. Corruption: drug trafficking is an entire criminal industry that largely relies on corruption to function. Eliminating corruption will go a long way in reducing the supply of drugs in the EU. Europol organised the annual conference for the fourth year in a row to increase the understanding of the latest trends in illicit drug production and trafficking and to agree on bold law enforcement responses to protect the public from the threats posed by illicit drugs. Given the rapid evolution of both crime trends and operational response measures, Europol hosts this drug conference annually. Europol is the European Union Agency for Law Enforcement cooperation; its primary goal is to achieve a safer Europe by coordinating and connecting national law enforcement authorities and providing operational analysis, forensics, and technical support.

Europol, Eurojust and the European Judicial Network publish today the second annual edition of the SIRIUS EU Digital Evidence Situation Report. The report outlines the status of EU authorities in retrieving electronic data held by foreign-based online service providers (OSPs) in 2019. Cross-border access to digital information is paramount to an ever-increasing number of investigations, ranging from economic crimes and drug trafficking to terrorism, cybercrime and child sexual exploitation. In one case mentioned in the report, law enforcement officers were able to find an abducted child after requesting GPS data from a social media platform. This report encompasses extensive information gathered from over 325 surveyed officials of EU Member States’ law enforcement and judicial authorities, together with relevant input coming from a dozen major OSPs and reference to national legislation. Increased relevance of electronic evidence in criminal investigations The volume of cross-border requests submitted by EU authorities to OSPs increased significantly in 2019 with a large majority of them issued by Germany (37.7% of requests), France (17.9%) and the UK (16.4%). Requests to access electronic data doubled in Poland and nearly tripled in Finland. Furthermore, emergency disclosure requests increased by nearly half in one year. Datasets needed and challenges in retrieving them In order to better inform authorities and advance future investigations and prosecutions, the report focuses on the most important types of data in criminal cases. However, the acquisition of basic information on users (such as IP addresses used at registration, email addresses or phone numbers) suffers specific challenges. These relate for example to the length of the procedures in place, the very limited amount of time in which data is available and the fact that companies have different standards when cooperating with authorities. Criminal activity arising from online gaming platforms  In the last two years, EU authorities have observed an increase in the relevance of online gaming platforms in criminal cases. Cybercriminals can use online games to steal and sell data, to groom minors or as an avenue for money laundering, for example. In 2019, a third of law enforcement authorities requested the disclosure of data to foreign-based online game companies at least once. Training, knowledge exchange and a centralised approach To cope with the surge in electronic evidence collected as part of criminal investigations, EU law enforcement authorities have significantly increased the number of officers that receive periodic training. This led to an improved and more successful access to electronic data. At the same time, operating in a quickly developing field commits the EU judicial community to deeper connections and stronger knowledge exchanges. This guarantees a viable ‘toolbox’ of shared investigative and prosecutorial solutions that fill the gaps of the current legislative landscape. In some countries, Single Points of Contacts (SPoCs) in charge of centralising and sending voluntary requests for data disclosure to OSPs have also increased the efficiency of the process and the response time in data disclosure requests. The report finally shows how the vast majority of EU authorities would consider the establishment of the centralised approach with SPoCs for voluntary cooperation. Europol’s Executive Director Catherine De Bolle said: ‘SIRIUS is a flagship Europol project and since its creation in 2017 has become of operational benefit to the Member States in the internet-based investigation and prosecution of crime. With this second annual edition of SIRIUS report we continue our effort to shed light into the access and use of electronic evidence in criminal investigations. The persistent relevance of electronic evidence and their importance in conducting successful investigations propound an even greater need to overcome the obstacles and challenges faced by law enforcement and judicial authorities when collecting and accessing digital data. This can be achieved through a common effort in balancing the need to investigate crimes with upholding the fundamental liberties of our system.’ Eurojust President Mr Ladislav Hamran said: ‘This joint Report clearly shows the great impact of electronic evidence on all partners of the EU’s security chain. Prosecutors and judges from across the continent have helped us to identify the obstacles and opportunities in their daily work, resulting in this overview for policy-makers who want to learn more about how electronic evidence is affecting the judiciary. I am convinced that the SIRIUS project will continue to play a pivotal role as a platform for practical knowledge exchange.’ Created by Europol in October 2017, the SIRIUS Project is a central reference in the European Union for knowledge sharing on digital cross-border investigations for law enforcement and judicial authorities. SIRIUS products and services are currently available to more than 4 500 practitioners, representing all EU Member States and 17 third countries. Eurojust, being partner in the project since early 2018, is expected to become a full co-beneficiary of the funded action by the end of 2020. Moreover, the European Judicial Network also closely collaborates with the project. The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy Instruments under grant agreement No PI/2017/391-896. Read the SIRIUS EU Digital Evidence Situation Report 2020. 

Since the outbreak of the COVID-19 pandemic, Europol identified the potential growth in unlawful sanitary waste treatment and disposal, as a result Europol launched operation Retrovirus. Officers carried out inspections and checks on sanitary waste plants and transportation, which were crucial in halting the illegal trafficking, storage, dumping and shipment of waste and document fraud. Thirty countries took part in operation Retrovirus, including the European Commission’s Directorate-General for the  Environment, the EnviCrime Network, Frontex, INTERPOL, the El PAaCTo project and The European Union Network for the Implementation and Enforcement of Environmental Law (IMPEL). Around 280 000 inspections and 102 arrests so far 278 291 inspections performed 102 arrests made  More than 819 entities and individuals given administrative sanctions €800 000 in assets seized  22 seizures of waste 20 arrests in Spain and assets worth €800 000 seized in Portugal The Spanish Civil Guard’s environmental unit, SEPRONA (Guardia Civil) investigated the activities of an enterprise operating in Barcelona, Madrid, Murcia, Valencia, Tarragona and Zaragosa. The company had links with another organisation operating in Lisbon, Portugal. Spanish officers searched 9 locations and arrested 20 individuals for crimes against the environment, labour rights and public health. The sanitary waste, collected by the company, is normally supposed to be sterilised at high pressure to eliminate all hazardous components. To increase profits, the company reduced the time of treatment. This resulted in the waste not being properly sterilised before disposal; an inadequate treatment which caused high risks for public health. In Portugal, the National Republican Guard (Guarda Nacional Republicana) inspected more than 2 000 companies, hospitals and health centres. The activities led to administrative violations, 30 arrests and the seizures of assets worth almost € 790 000.  Law enforcement authorities also focused on the transport of sanitary waste across the EU. Authorities from Czechia, Poland, Romania and Slovakia checked cargo and identified illegal shipments, which were then sent back to their country of origin.  Another trend identified during the operation was the possible pollution of urban residual waters. The Spanish Civil Guard launched operation Arcovid to investigate the filtering treatments of the water for pollutants and the possible presence of COVID-19. First global operation of its kind Europol identified the need for operational activity on this phenomenon early in the pandemic and launched the operation worldwide. Europol supported the operation by providing analytical and operational support and coordination and facilitated a secure instant communication exchange between the participating authorities. Europol also supported investigators with the extraction of encrypted data from mobile devices and operational analysis in real-time during action days. Thirty countries involved This long-term operation has had the involvement of the following countries: Albania, Austria, Belgium, Bosnia and Herzegovina, Bulgaria, Canada, Colombia, Croatia, Czechia, Estonia, France, Georgia, Germany, Greece, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, North Macedonia, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and Ukraine.   

As part of the international operation ‘In Our Sites’ (IOS) XI, law enforcement authorities from 26 EU Member States and third parties have seized together with Europol and the US National Intellectual Property Rights Coordination Centre over 21 910 domain names offering counterfeit and pirated items over the internet. More than €2.5 million worth of such products have been seized, including counterfeit pharmaceuticals and pirated films, illegal television streaming, music, software and other bogus products.  In its eleventh edition, this joint international operation was facilitated by Eurojust and INTERPOL.  Tackling the website domains selling counterfeit commodities, or involved with online piracy, has become a growing concern for all law enforcement bodies due to the versatility of the criminals, who can easily make large profits and deleting their internet tracks in a very short period of time.  Results of the seizures in brief  22 614 cosmetic products 22 042 accessories for mobile phones 69 657 perfume bottles 8 929 clothing articles 7 480 detergent boxes 4 800 boxes of condoms Participating countries  Albania, Austria, Belgium, Bulgaria, Bosnia and Herzegovina, Colombia, Czech Republic, Denmark, France, Greece, Hungary, Hong Kong- China, Ireland, Italy, Netherlands, Peru, South Korea, Moldova,  Serbia, Romania, Slovakia, Spain, Portugal, Ukraine, United Kingdom, United States of America   Making the internet a safer place for consumers  ‘In Our Sites’ (IOS), launched in 2014, is the continuation of a recurrent joint global operation that has increased significantly year-on-year. The operation is the result of the comprehensive approach which Europol follows with the aim of making the internet a safer place for consumers, by getting even more countries and private sector partners to participate in this operation and providing referrals.  Europol, in cooperation with the European Union Intellectual Property Office (EUIPO), continues to enhance such efforts by successfully supporting many high-priority investigations related to online crimes, providing training related to online investigations, and organising conferences such as the annual Intellectual Property Crime Conference. To raise awareness of this growing threat, Europol’s Intellectual Property Crime Coordinated Coalition IPC3 has developed the Don’t F***(ake) Up prevention campaign. The campaign aims to inform citizens of the risks of buying fake products online and give advice to help identify illicit websites selling counterfeit goods, as well as other means used by counterfeiters, such as fake social media accounts and fake apps.

In the early hours of the morning, over a thousand police officers with the support of Europol carried out coordinated raids against the members of this highly professional criminal syndicate. Some 180 house searches were executed, resulting in the arrest of 45 suspects.  The investigation uncovered that this drug trafficking network was responsible for the annual importation of at least 45 tonnes of cocaine into the main European seaports, with profits exceeding €100 million over the course of 6 months. This international sting, led by the Portuguese, Belgian and Brazilian authorities, was carried out simultaneously by agencies from three different continents, with coordination efforts facilitated by Europol:  Europe: Portuguese Judicial Police (Polícia Judiciária), Belgian Federal Judicial Police (Federale Gerechtelijke Politie, Police Judiciaire Fédérale), Spanish National Police (Policia Nacional), Dutch Police (Politie) and the Romanian Police (Poliția Română) South America: Brazilian Federal Police (Policia Federal) Middle East: Dubai Police Force and Dubai State Security    Results in brief  45 arrests in Brazil (38), Belgium (4), Spain (1) and Dubai (2) 179 house searches Over €12 million in cash seized in Portugal, €300 000 in cash seized in Belgium and over R$1 million and US$169 000 in cash seized in Brazil 70 luxury vehicles seized in Brazil, Belgium and Spain and 37 aircrafts seized in Brazil 163 houses seized in Brazil worth in excess of R$132 million, 2 houses seized in Spain worth €4 million, and two apartments seized in Portugal worth €2.5 million Financial assets of 10 individuals frozen in Spain Global cooperation  In the framework of intelligence activities underway with its operational counterparts, Europol developed reliable intelligence concerning the international drug trafficking and money laundering activities of a Brazilian organised crime network operating in several EU countries.  The criminal syndicate had direct contact with drug cartels in Brazil and other South American source countries who were responsible for the preparation and the shipments of cocaine in maritime containers bound to major European seaports.  The scale of cocaine importation from Brazil to Europe under their control and command is massive and over 52 tonnes of cocaine were seized by law enforcement over the course of the investigation. In April 2020, Europol brought together the involved countries who have since been working closely together to establish a joint strategy to bring down the whole network. The main targets were identified on either sides of the Atlantic Ocean, with the support of Operation EMMA 95/ LEMONT 26, the French and Dutch-led investigation against the Encrochat network.   Since then, Europol has provided continuous intelligence development and analysis to support the field investigators. During the action day, a total of 8 of its officers were deployed on-the-ground in Portugal, Belgium and Brazil to assist there the national authorities, ensuring swift analysis of new data as it was being collected during the action and adjusting the strategy as required.  Commenting on this operation, Europol’s Deputy Director Wil van Gemert said: This operation highlights the complex structure and vast reach of Brazilian organised crime groups in Europe. The scale of the challenge faced today by police worldwide calls for a coordinated approach to tackle the drug trade across continents. The commitment of our partner countries to work via Europol underpinned the success of this operation and serves as a continued global call to action.    Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer

Fifteen people have been arrested in Malta as part of operation Proteus, a highly sophisticated money laundering case, following months of intensive investigations by the Maltese Anti-Money Laundering Section within the Financial Crime Investigations Department. During this operation, the Maltese Police seized: 36 vehicles; €60,000 in cash; a considerable amount of jewellery and designer clothes; mobile phones, computers, and servers; a large number of documents, which are still being analysed; several million euros of laundered money frozen. While investigations into this case are still ongoing, five persons have already been charged in a Maltese Court with money laundering charges and other offences. The Maltese Taskforce was supported by Europol and its European Financial and Economic Crime Centre (EFECC) and its Analysis Project Sustrans, which is involved in cases related to organised crime networks involved in money laundering. Two Europol experts were deployed on-the-spot during the action week in Malta. Highly sophisticated cases of money laundering and fraud that target individuals, companies and the public sector continue to threaten economic growth and the integrity of financial systems. Every year, law enforcement in the EU carries out hundreds of international financial crime investigations, often leading to exceptional results, arrests, and dismantling criminal groups. However, the EU still shows mediocre results when it comes to recovering criminal assets – criminals keep over 98% of their assets. To respond to this threat, Europol has launched EFECC. Europol is the European Union Agency for Law Enforcement cooperation; its primary goal is to achieve a safer Europe by coordinating and connecting national law enforcement authorities and providing operational analysis, forensics, and technical support.

The Spanish National Police (Policía Nacional) supported by Europol, arrested two individuals for their suspected involvement in the facilitation of terrorist financing in the Spanish provinces of Madrid and Toledo. They are believed to be part of the ‘remittance office’ in Europe of the so-called Islamic State. In direct communication with jihadi fighters, this network aimed at transferring assets to conflict zones. The network had contacts in different European countries who were in charge of collecting financial contributions from followers of the so-called Islamic State. The funds were mainly destined to support foreign fighters in Syria. A hawala network facilitated the final transactions sent from Spain to the conflict zones. In the past year and a half, the Spanish National Police, with support from Europol, has carried out three other actions within the same investigation targeting terrorist financing. These have led to the arrests of three other individuals accused of being part of the same ‘remittance office’ in Europe of the so-called Islamic State. Currently, all of them are in prison. Europol facilitated the information exchange and supported the case with operational analysis. During the action day, Europol provided support by deploying an expert to Spain to crosscheck operational information against Europol’s databases and provide links to investigators in the field. Europol also provided technical support for the analysis of the seized electronic devices. Watch the video Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

On 23 November 2020, the EU Internet Referral Unit (EU IRU) hosted their second tabletop exercise in a virtual event held under the umbrella of the European Commission-led EU Internet Forum. The aim of the exercise was to test an EU-led voluntary mechanism to enable a coordinated response to a cross-border massive abuse of the internet in the context of terrorism or violent extremism. The EU IRU’s initial tabletop exercise, held on 11 September 2019, was the first of its kind since the launch of the Christchurch Call to Action and led towards closer cooperation between parties involved in advancing the fight against terrorism online.  Recent acts of terrorism in France and Austria in October-November 2020, have further demonstrated the importance of disrupting the dissemination of terrorist and violent extremist propaganda during, and in the aftermath of, terrorist attacks.  The tabletop exercise forms part of a larger consultation process, through which the EU IRU and Member States are improving their operational response to the dissemination of propaganda linked to acts of terrorism.  The exercise reconfirmed the need for real-time coordination and engagement between EU MS and Online Service Providers in order to support investigations while also containing potentially viral content in light of major terrorist incidents.  The exercise was attended by EU Member States (Austria, Belgium, Bulgaria, Croatia, Cyprus, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Malta, Netherlands, Poland, Portugal, Romania, Slovenia, Spain,), third countries (Norway, Switzerland, United Kingdom) and the European Commission.  The EU IRU will expand their 2021 tabletop exercise to include a wider range of participants, including Online Service Providers.

The Europol Intellectual Property Crime Conference 2020 took place on 23 November in partnership with the International AntiCounterfeiting Coalition. The annual conference brings together experts in intellectual property crime (IP) and addresses the most recent innovations in enforcement strategies of intellectual property rights. The conference offered law enforcement and the private sector views on top intellectual property enforcement issues in Europe, including the importance of IP enforcement during the COVID-19 pandemic.  The conference also covered recommendations and potential resources for public and private stakeholders to fight IP crime. Held as a virtual event for the first time, leading professionals from law enforcement, the private sector and academia attended the conference. Europol's Executive Director Catherine De Bolle, the Executive Director of the European Union Intellectual Property Office, Christian Archambeau, the US IP Enforcement Coordinator, Vishal Amin, and the Chair of the International AntiCounterfeiting Coalition, Dawn Atlas opened the virtual conference.  Catherine De Bolle, Executive Director Europol: Looking back at the last eight months, we can trace how criminals have used uncertainty and change to identify and exploit opportunities targeting individuals, businesses and the public sector. Counterfeit goods sold during the corona crisis do not meet the required quality standards and pose a real threat to public health and safety. In addition, intellectual property crime is linked to other forms of criminality, including money laundering, document fraud, cybercrime, fraud, drug production and trafficking and terrorism. Christian Archambeau, Executive Director of the European Union Intellectual Property Office said: The shocking examples of fake medicines and personal protective equipment circulating during the current pandemic show that IP crime is not a victimless crime. Counterfeiters exploit every vulnerability they can find, no matter what the cost to consumers, and – as our research has shown – use increasingly complex trade routes, with many intermediary points. This makes our joint cooperation even more important. "My congratulations to the esteemed speakers, organizers and attendees of the first virtual EUROPOL IP Crime Conference," said Bob Barchiesi, IACC President. "We are operating in difficult times that require even bolder leadership, more innovative partnerships and collective action to protect legitimate businesses and consumer safety from criminal counterfeiters. We thank our government and industry partners for their continued commitment and look forward to advancing our joint effort to fight fakes."     Europol identified the trade in counterfeit and substandard goods as one of the areas with the immediate impact of the COVID-19 crisis. With the onset of the pandemic, the demand for healthcare and sanitary products (masks, gloves, cleaning products, hand sanitizers) and personal protective equipment increased significantly. The organised crime groups involved in illicit activities related to counterfeit and substandard goods have proven to be highly adaptable in adjusting their business model by shifting product focus and marketing. In 2020, Europol's Intellectual Property Crime Coordinated Coalition (IPC3) experienced an increase of 10% of the contributions received compared to 2019.  In 2021, the Italian Finance Corps (Guardia di Finanza), the Italian law enforcement agency under the authority of the Minister of Economy and Finance, will host the fifth edition of this conference, which will take place in Rome.

After Doha (Qatar), Basel (Switzerland) and The Hague (the Netherlands), the fourth edition of the Global Conference on Criminal Finances and Cryptocurrencies took place online on 18 and 19 November. INTERPOL hosted this year’s conference, which gathered over 2 000 participants from law enforcement and judicial authorities, financial intelligence units, international organisations and the private sector.  Trends and investigations in the crime involving cryptocurrency, trends and evolution of the dark markets, use of cryptocurrencies in ransomware attacks, anti-money-laundering global compliance efforts and detecting money laundering activities in cryptocurrency flows were among the topics discussed during the first day of the conference. On the second day, which was restricted for representatives from national authorities, experts presented recent case examples to exchange knowledge and best practices on investigations related to cryptocurrency facilitated crime and subsequent money-laundering activities. This conference is an initiative of the tri-party working group on cryptocurrencies and criminal finances established in 2016 by Europol, INTERPOL and the Basel Institute on Governance to build a platform for the exchange of knowledge and expertise between cybercrime experts and financial investigators. The cooperation and knowledge sharing between national law enforcement authorities, supported by the private sector, has certainly increased the effectiveness of investigations on cryptocurrency-facilitated crime. Experts have concluded, however, that further information exchange will increase the success rates of the investigations. The conference led to key recommendations on how to solidify a strong response to this criminal threat.  Key recommendations Adopt  tools to extend capabilities on how to investigate Virtual Assets  Apply rules to regulate Virtual Asset Service Providers to prevent money laundering Apply the strategy to “Follow the Money” Strengthen international cooperation Adopt a multidisciplinary approach Promote new technologies applied to the financial investigation on Virtual Assets Adapt investigation strategies Download the recommendations: Recommendations - 4th Global Conference on Criminal Finances and Cryptocurrencies

Two Romanian suspects have been arrested yesterday for allegedly running the CyberSeal and Dataprotector crypting services to evade antivirus software detection. These services have been purchased by more than 1560 criminals and used for crypting several different type of malware, including Remote Access Trojans, information stealers and ransomware. The pair also operated the Cyberscan service which allowed their clients to test their malware against antivirus tools. This operation was led by the Romanian Police (Poliția Română) together with the United States Federal Bureau of Investigation (FBI), the Australian Federal Police (AFP), the Norwegian National Criminal Investigation Service (Kripos) and Europol. It was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).  Results in brief 2 administrators arrested in Romania 4 house searches carried out in Bucharest and Craiova (Romania) Backend infrastructure taken down in Romania, Norway and the United States. How do criminals bypass antivirus software? One common way for hackers to circumvent antivirus detection is through the use of crypters which encrypt or hide the underlying code in a piece of software, typically malware, to masquerade as something harmless until it gets installed on a victim’s computer. The services provided by these two suspects fall under this category and have been offered for sale in the underground criminal market since 2010. Their clients paid between US$40 to US$300 for these crypting services, depending on licence conditions. Their service activity was well structured and offered regular updates and customer support to the clients. The criminals also offered a Counter Antivirus platform allowing criminals to test their malware samples against antivirus software until the malware becomes fully undetectable (FUD). The prices for this service varied between US$7 to US$40. Europol operational support The coordination efforts in this case were led by Europol’s European Cybercrime (EC3) which facilitated the exchange of information and provided forensic, malware and operational analysis in preparation for the action. During the action day, a virtual command post was set up by Europol, allowing for the real-time exchange of information between all involved countries to adjust the operational strategy as required. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime.In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Cybercrime is one of the priorities for the Policy Cycle.  

French Gendarmerie (Gendarmerie Nationale) identified three victims of child abuse and arrested two married offenders. The child of the couple was among the three victims. Social services took the child into their protection while the two other victims remained with their families who were unaware of the abuse. This case was triggered by analysis during Europol Victim Identification Task Force 7. A national expert analysed a collection of linked child sexual exploitation material from a darknet source. They discovered clues pointing to France as a likely location of the victims depicted in the images as well as of their offender. Europol sent a report with the outcome of the analysis to the French experts in the task force. French investigators examined these images in cooperation with US ICE, Australian Federal Police, Europol and INTERPOL. Investigations at national and local level led to the likely location of the abuse and additional clues enabling the identification of the abuser and one victim.  A joint operation, coordinated by the French Gendarmerie, was carried out in Aisne and the Lot-et-Garonne area (France) and led to the arrest of the accused married abusers. The officers were able to identify the three victims after the examination of seized digital storage devices. Europol supported the operation with intelligence analysis and on-the-spot technical and forensic expertise. The victims were made safe and their alleged abusers are currently in prison awaiting judgment in January 2021.

Between 2 and 13 November 2020, Europol’s European Cybercrime Centre (EC3) successfully supported efforts to identify victims of child sexual abuse through its 8th Victim Identification Taskforce. In total, 23 law enforcement experts from EU Member States and non-EU countries participated Results: Nine confirmed victims and another two victims tentatively identified. Participating agencies and countries: Australia, Belgium, Canada, Cyprus, Denmark, Finland, Hungary, INTERPOL, Moldova, Norway, Portugal, Spain, Sweden, Switzerland, US ICE and US FBI. Europol has more than 51 million (unique binary) images and video files in its database. To prepare for the operation, Europol specialists triaged a series of them for the participants to analyse. Together, the specialists assessed content depicting victims of child sexual exploitation. The investigation resulted in the identification of overlaps in cases, which enabled officers to combine efforts to locate the victims. As a direct result of this collaboration, experts managed to evaluate more than 200 series. For 53 of these series, the country of production was likely identified and respective Member States informed so that they could start their individual national investigations. EC3 is now providing support to the partners involved to safeguard the children concerned and apprehend the offenders.  The series have been uploaded to the INTERPOL International Child Sexual Exploitation database, which will allow investigators with access to it to continue working on the datasets and increasing the chances of identifying and protecting the victims. The participating authorities showed a high degree of flexibility in dealing with the travel restrictions due to the COVID-19 pandemic and quickly adapted to the technical support provided by EC3, which allowed them to take part from their respective countries. HOW YOU CAN HELP STOP CHILD ABUSE In June 2017, Europol launched its crowdsourcing Stop Child Abuse - Trace An Object initiative, which stemmed from the work of the taskforce. This initiative invites the public to identify objects and places in the hope that it can lead to the identification of victims down the line. Since then, Europol has received 26 000 tips which have already led to the identification of ten children and the prosecution of three offenders. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime.In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Cybercrime is one of the priorities for the Policy Cycle.  

A total of 24 European countries[1] supported by EU institutions and agencies[2] including Europol, have come together to target alarm and signal weapons of Turkish origin illegally trafficked into the EU via Bulgaria and other countries. To tackle the increase in weapons illegally transformed and traded, the operation was setup and led by the Romanian Police (Politia Romana) within the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). Supported by Europol, authorities collected data and conducted intelligence analysis of the buyers and sellers of firearms earlier this year to enable series of investigations and activities on a national level. Between 2 and 11 November the yearlong operation was concluded by joint action days. During the span of the action days, police officers from Albania, Greece, Portugal and Romania carried out 81 house searches. These investigations led to the following arrests and seizures: 11 arrests; 191 firearms; 3 714 cartridges of ammunition; small quantities of drugs including cannabis and cocaine; unstamped cigarettes packs; 1 vehicle; 164 pieces of pyrotechnics; false ID documents. Previous results: prior to the action days, all participating countries conducted various activities and investigations that led to the additional seizure of 1 585 firearms. Operational set-up The action leader of the EMPACT Firearms activity from the Romanian Police coordinated the operation with the support of Bulgaria, Spain and Europol. The framework for the joint action weeks consisted of an operational upstream work performed by gathering intelligence, databases crosschecking and operational analysis of buyers in the EU of weapons from Bulgarian firearms dealers. Europol provided further support during the course of the action days with the exchange of information and real time communication among the participating countries.  Disarming criminals In recent years, alarm and signal weapons have become extremely popular among criminals and feature in considerable figures in firearm trafficking and seizure cases. This is due to the fact that they can be easily converted into lethal weapons and are cheaper to procure. Europol plays a key role in supporting Member States fight criminal networks involved in illegal weapons and explosives trafficking. As part of a wider strategy to identify the criminal networks supplying terrorist groups with firearms and ammunition, Europol experts work closely with counter terrorism experts on international investigations. Moreover, Europol specialists and analysts combine efforts to assist Member States in developing their own resources to monitor and tackle the dark web phenomenon. [1] Participating countries: Albania, Belgium, Bulgaria, Croatia, Cyprus, Czech Rep, Denmark, Estonia, France, Germany, Greece, Hungary, Latvia, Lithuania, Luxembourg, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, Spain, Sweden, and UK. [2] Participating EU institutions and agencies: European Commission, European Firearms Experts, Eurojust, Europol. In 2010 the European Union set up a four-year Policy Cycleto ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Illicit firearms trafficking is one of the priorities for the Policy Cycle.  

An investigation that involved the Spanish National Police (Policía Nacional), Mossos d’Esquadra and the Spanish Tax Agency (Agencia Tributaria) and supported by Europol, led to the dismantling of a large organised crime group involved arms trafficking and money laundering. The operational action took place on 12 November in the Spanish provinces of Alicante, Barcelona and Valencia. The criminal network, made up of Latvian, Spanish and Ukrainian members, illegally transported weapons and explosives in commercial ships from Ukraine mainly to conflict zones in North Africa and the Middle East, subject to international embargoes. The illegal shipments were concealed in cargo ship transporting legally sourced armaments. The arm traffickers transported weapons and heavy armament, including tanks, through the Mediterranean. The criminal group was well-developed and carried out complex criminal activities internationally, including breaking a ship’s captain out of prison, who had been detained for arms trafficking by Greek authorities. Cracks in the group’s security started to show and a dispute between the group’s leaders over the control of their maritime activities led to their downfall.  Results in brief 7 suspects arrested  7 house searches carried out 18 properties worth about €10 million seized 50+ financial products frozen  The criminal activity generated large profits, which were introduced into the legal economy. The criminal network had set up a well-organised money-laundering scheme which enabled them to invest their criminal proceeds in legal businesses. The profits were sent to tax havens before being sent to countries with lower financial accountability. The assets were then transferred to bank accounts in European countries, mainly Switzerland and the United Kingdom. From there, the criminals transferred the money to Spain where it was used under the camouflage of legal commercial activity. This scheme allowed them to invest the criminal profits in properties and finance their luxury lifestyles. Complex investigation to catch the arms traffickers Europol supported the investigation since its beginning in 2018. The complexity of the criminal activities required the involvement of experts in different fields, including economics, weapons, technology and commercial and international maritime transport.  Europol facilitated the information exchange and supported the case with operational analysis. During the action day, Europol provided support by deploying an expert to Spain to crosscheck operational information against Europol’s databases and provide links to investigators in the field. Europol also provided technical support for the analysis of the seized electronic devices. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. Watch the video

The Spanish National Police (Policía Nacional), supported by Europol, arrested a young woman, inspired by jihadist terrorism, who was willing to join fighters for the so-called Islamic State in Syria’s Idlib area.  The young woman, born and raised in Europe, had been rapidly radicalised showing her desire to become a ‘martyr’ for the so-called Islamic State terrorist organisation. She adhered to the most violent forms of terrorist ideology, showing her support for the recent beheading of a French teacher who showed cartoons of Prophet Muhammad cartoons to his students. The woman was preparing her departure to Syria, where she was going to marry a jihadist terrorist living in the Idlib area. She met the terrorist fighter through social networks at the end of 2019 and actively encouraged him to dedicate his life to fight for the jihad. In January 2020, she travelled to Turkey where she was in contact with members of the terrorist organisation to whom she sent money to support their activities. Since then, she has dedicated her life to procuring money through criminal activities to finance her trip to the conflict area and support terrorist fighters. She planned to leave for Syria in November 2020. Her plan was to procure false ID documents to conceal her Spanish nationality and travel to the border area of Turkey with Syria. A facilitator was supposed to meet her there and smuggle her to the area controlled by jihadists in northwest Syria. Europol facilitated the information exchange and supported the case with operational analysis. On the action day, Europol provided support by deploying an expert to Spain to crosscheck operational information against Europol’s databases and provide links to investigators in the field. Europol also provided technical support for the analysis of the seized electronic devices. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. Watch the video

Today, 12 November, Europol’s Executive Director, Catherine De Bolle and Vittorio Rizzi, Deputy Director-General of Public Security in Italy, co-chaired the third working group on COVID-19 crime threats and law enforcement responses. To coincide with the virtual meeting, Europol published the latest in its series of COVID-19 reports, which analyses how COVID-19 crimes have infected Europe in 2020. Since the beginning of the pandemic, Europol has produced a range of reports for law enforcement partners, policymakers and the public. We are experiencing a second wave of the pandemic and organised crime does not miss the chance to exploit the circumstances to increase its profits by targeting vulnerable communities such as children and legal business activities weakened by the economic crisis. Our new report looks back at the last eight months and we can trace how criminals have used uncertainty and change to identify and exploit opportunities. Catherine De Bolle We are facing a new social and economic reality with our tired and poorer communities. Organised crime is seeking to penetrate this social context of economic recession to pursue its illicit profits. However, we will ready to counter this threat through the strategy that we are building together. Vittorio Rizzi, Deputy Director-General of Public Security in Italy. European chiefs of police from Austria, Belgium, France, Germany, Italy, the Netherlands, Poland, Spain, Switzerland, the United Kingdom and Interpol came together to discuss the pressing topics surrounding criminality and COVID-19. Among the topics discussed, the following areas were identified as a priority for the working group:  given the increased online presence of individuals, there have been growing concerns of potential scams and attacks, notably, surrounding fraud related to health products; some Member States saw a significant increase in online child sexual exploitation material. In some countries the statistics of the distribution of images and explicit videos indicated that it had become six times more frequent; the need to identify and monitor indicators related to the infiltration of organised criminal groups into the legal economy.  The COVID-19 crisis has presented organisational and operational challenges that have forced law enforcement agencies to re-think their business needs and approaches. Agencies are working together to be better prepared to face similar challenges in the future and protect their citizens.  You can download Europol’s recent report: How COVID-19-related crime infected Europe during 2020.

An investigation, led by the Spanish Civil Guard (Guardia Civil) and supported by Europol, led to the dismantling of a large organised crime group involved in wildlife trafficking, document fraud, smuggling and money laundering. Law enforcement authorities from Germany, Italy, the Netherlands and Sweden also supported in the investigation. The suspects smuggled reptiles from Australia, Brazil, Mexico, South Africa and the Middle East. The criminal group used a group of couriers to smuggle the animals across borders. They concealed the reptiles in personal luggage or even under their clothes. The suspects introduced protected species into the legal market by falsifying CITES documents attesting the type of reptile. A network of veterinarians helped the criminals by forging documents to conceal the true origin of the animals. This criminal activity focused on a particular species of tortoise, which ensured a market monopoly for the criminal network. Results in brief 21 suspects arrested (from Spain and the UK) 1 of the leaders among the arrested 355 specimens of reptiles seized Firearms including a submachine gun confiscated Items worth €800 000 seized Information exchange uncovered the links This investigation uncovered a well-implemented criminal group, which abused the free circulation of persons and goods to conceal their illegal activity. The criminal analysis of intelligence in Europol’s information systems meant links could be established between people and events. The involvement of Europol was crucial to linking the suspects with different nationalities to the criminal activity. Europol facilitated the information exchange and supported the case with operational analysis which led to the identification of one high-value target. During the action day, Europol provided support on the spot by deploying an expert to Barcelona to crosscheck operational information and provide links to investigators in the field. In addition, Europol set up a virtual command post to facilitate the coordination of the operational activities. Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. Watch the video In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant.Environmental crime is one of the priorities for the Policy Cycle.  

Europol supported law enforcement from France, Germany, Monaco, the Netherlands and Switzerland to take down an organised crime group involved in intellectual property crime.  Eleven servers taken down in four countries  On the action day, law enforcement officers seized eleven servers in France, Germany, the Netherlands and Switzerland. Officers carried out nine house searches in all involved countries, arrested three suspects and seized eight bank accounts in Switzerland. Swiss police blocked the website, which illegally distributed the multimedia. Europol also prepared the ‘splash’ page appearing on the website after the domain seizure. Europol supported the action day through the coordination centre hosted by Eurojust. Illegal streaming of over 82 000 pieces of multimedia content A Swiss company put a multimedia box, on the market. The box enabled the distribution of over 82 000 movies and TV series, all protected by copyright. The company used a dedicated website to stream the content while advertising their illegal services on social media. An illegal application system enabled viewers to use the system and access the media. According to the first elements of the investigation, around 20 000 boxes have been sold, the payments for which were made via regular gateways and payment systems. The sale and distribution of these boxes has generated a turnover of about €1.9 million. The company also played an active role in the management of the hosting servers broadcasting the content. The investigation was triggered by complaints filed with the Swiss authorities against the Swiss company. Paid TV channels and American film studios also signalled copyright infringement activities. Since 2019, Europol supported the investigation with operational coordination and analysis. Europol supported the action day with the deployment of two virtual mobile offices. These enabled Europol’s experts to cross-check operational information in real time and provide support to the investigators in the field. Europol’s experts also joined the coordination centre hosted by Eurojust. Europol’s IPC3 (Intellectual Property Crime Coordinated Coalition) which supported the investigation is a project co-funded by the EUIPO to combat intellectual property crime.

In the first of its kind, Europol’s European Counter Terrorism Centre coordinated a Europe-wide joint action day to target racist and xenophobic hate speech on the internet. The operation, led by Germany, took place in Czechia, France, Germany, Greece, Italy, Ireland, Norway, Spain and the United Kingdom.  On the action day, 3 November 2020, law enforcement authorities raided 97 locations and interrogated a number of individuals in relation to offences such as dissemination of racist and xenophobic hate speech, calls to violence and incitement to commit offences. In Germany alone, officers searched 81 houses. The coordinated action targeted communities and individuals spreading hate via the internet using different types of content such as posts, comments, and memes that spread hate and propaganda. The operation, targeting no specific organisations or groups, aimed at preventing hate crime, racism and xenophobia circulating online. Law enforcement worked together to also increase awareness of individuals and groups that the World Wide Web is not a legal vacuum. Supposed anonymity does not hinder law enforcement from taking measures against unlawful acts. This first joint action day on hate crimes sends a clear signal to individuals spreading violent hatred on the internet that their actions will be detected. Europol’s European Counter Terrorism Centre supported this initiative of Germany’s Federal Criminal Police Office (Bundeskriminalamt) from the start with operational coordination and facilitation of information exchange. Europol’s European Counter Terrorism Centre monitored all contributions, provided analytical support and an overview on the operational activities in continuous and direct contact with the involved law enforcement authorities. The action was supported also by Finland and other countries through awareness raising on national social media platforms.

Europol, Portugal, Spain and the United Kingdom coordinated a Europe-wide joint action day targeting child trafficking. The operation, also supported by Frontex, took place between 5 and 11 October 2020 and involved 12* countries.  A wide range of law enforcement authorities including police, immigration and border control agencies, transport police, social assistance and child protection services and labour inspectorates participated in the joint action. 388 arrests and 249 potential victims The actions led to 388 arrests, 19 additional suspects identified and 40 new investigations initiated. Overall, 249 potential victims of human trafficking were identified, 61 of which were confirmed to be minors and the ages of 107 victims have not yet been determined. The involved national authorities focused on border crossings and main transport hubs to identify potential victims and suspects of human trafficking. Each country adapted the activities according to the forms of child trafficking which were nationally prevalent.  5 380 officers checked: 59 071 people; 1 529 locations; 15 923 vehicles; 39 860 documents. Underreported crime affecting the most vulnerable Human traffickers target the most vulnerable groups and children are among them. Child trafficking remains, however, underreported. Minors are trafficked for sexual and labour exploitation. Criminals abuse children while forcing them to beg or commit crimes such as smuggling of illegal goods and petty crimes.  Within the EU, children are mostly trafficked by their relatives. These criminal organisations, connected through large clan networks, operate in several countries and move the children on a rotational basis. They abuse them in sexual exploitation, forced begging and forced criminality schemes. Trafficked minors from non-EU countries are also often victims of migrant smugglers collaborating with adults who accompany the children while pretending to be their relatives or legal guardians.  *Participating countries: Austria, Belgium, Croatia, Cyprus, Germany, Lithuania, Portugal, Romania, Slovenia, Spain, the Netherlands and the United Kingdom Europol coordinated the action days and facilitated the information exchange between the participating countries. Europol provided analytical and operational support 24/7 and facilitated the real-time exchange of communication between the participating authorities.   In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime.In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Trafficking in human beings is one of the priorities for the Policy Cycle.  

On 28 October, Europol supported the CGI of the Spanish National Police (Comisaría General de Información de la Policía Nacional) in arresting three suspects linked to a terrorist cell actively recruiting and indoctrinating young people. The individuals, among which feature the alleged leaders of the cell, were arrested as a result of house searches carried out in San Sebastian and Pasaia in northern Spain. They are believed to have created the terrorist structure to carry out jihadist terrorism in support of the so-called Islamic State. 10 000 followers on social media networks This terrorist cell was very active online, disseminating a large amount of jihadist propaganda with the purpose of recruiting and indoctrinating young people. The content included a variety of violent visuals displaying minors involved in Islamic State jihadist combats and promoting them as role models. The suspects used social media accounts to disseminate propaganda. They created multiple profiles on social media networks, which counted numerous followers. Two of the accounts created accumulated over 10 000 followers. Physical training and mental conditioning of minors During planned meetings, the youngest members received physical training and mental conditioning to carry out jihadist terrorism. The terrorist cell enabled the regular practice of contact sports and provided handbooks on the use and handling of weapons such as knives and firearms. Investigators identified the existence of a hierarchy within the organisation structuring the relationship between its members. The suspects used various measures to conceal from the police the criminal activities taking place online and in physical environments. Two-year investigation The arrests of the primary suspects of this terrorist cell was a result of a two–year-long investigation and an exhaustive analysis of information gathered throughout multiple operations conducted in the Spanish province of Guipuzcoa. Europol’s European Counter Terrorism Centre (ECTC) supported the investigation by providing long-term analytical and operational support. During the action day, ECTC experts enabled real-time information exchange and analysis. To ensure an effective response to the challenges posed by the terrorist threat, Europol created in 2016 the European Counter Terrorism Centre, an operations centre and hub of expertise that reflects the growing need for the EU to strengthen its response to terror. Designed as a central hub in the EU in the fight against terrorism, the ECTC focuses on operational support to Member States in terrorist investigations. It cross-checks live operational data against the data Europol already has, quickly bringing financial leads to light, and analyses all available investigative details to assist in compiling a structured picture of the terrorist network.

A total of 352 stolen motor vehicles have been seized on their way to their final destination as a result of the Joint Action Day (JAD) ‘Mobile 3’ supported by Europol. A further 1 077 stolen vehicles parts have been confiscated, and dozens of forged or falsified vehicles documents seized.  Some 44 548 checks were carried out against various databases during this two-week long operation (12-23 October 2020) carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). Led by the European Border and Coast Guard Agency FRONTEX, this operation focused on checks on border crossing points and in-land activities in 17 EU countries and 5 countries in the Balkan region.  In close cooperation with private industry, including the car industry, boats/vessels manufacturers, rental and leasing companies as well as the use of Europol databases, the border control officers at the external EU border prevented many vehicles and boats from being smuggled overseas. As an example the Greek Police seized 15 vehicles from rental companies which criminals attempted to smuggle out from the EU. Activities focused on checks of vehicles and boats resulted also in apprehension of 2 985 illegal migrants on the way to the EU via the land and sea routes. 17 facilitators of migrant smuggling have been located and arrested. The main destination countries of the migrants were Germany and Italy. The facilitators transported the migrants on land routes in trailers, but as well on small boats via the Adriatic Sea.  FRONTEX set up a Coordination Centre at its headquarters in Warsaw, where officers from participating countries exchanged operational and intelligence information efficiently. Europol supported remotely by crosschecking in real time the information collected in the field against its databases.  The following countries and parties were involved in the operation MOBILE 3 and linked operations in the same time period: Albania, Austria, Bosnia Hercegovina, Bulgaria, Croatia, Estonia, France, Germany, Greece, Hungary, Italy, Kosovo*, Latvia, Lithuania, Netherlands, Republic of North Macedonia, Montenegro, Poland, Portugal, Romania, Slovakia, Spain  International organisations and agencies: FRONTEX, Europol, INTERPOL  * This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Organised property crime is one of the priorities of the Policy Cycle.  

The Spanish Civil Guard (Guardia Civil) arrested a supporter of the so-called Islamic State terrorist organisation in an operation developed together with Europol. The suspect was searching, editing and further disseminating terrorist propaganda material to young people online. The terrorist threat is real online On 20 October, officers from the Spanish authorities arrested a Moroccan citizen in Altea, Alicante suspected of spreading terrorist propaganda online. He was attempting to radicalise and recruit new members for the so-called Islamic State. The suspect was targeting young people via social networks and, to avoid detection from security services, he was later redirecting them to a private messaging application. He was then deepening the radicalisation process while sending them more terrorist propaganda material. Virtually integrated into the so-called Islamic State, the individual shared the violent outlook of the terrorist group and spread it to those he was seeking to recruit online. Joint law enforcement actions enabled the detection of these terrorism-inspired online activities of the suspect.  Since 2015, when the terror alert was increased, the Spanish authorities have strengthened their efforts to counter terrorism activities. More intensified investigative and operative actions specifically target individuals immersed in the radicalisation process. Their terrorism-inspired mindset is a precursor for violent behaviour, an imminent threat to the safety of EU citizens. The efforts of the security services were further enhanced during the current pandemic to counter the possible attempts of terrorist groups to abuse the current situation related to the COVID-19 pandemic.

Four of these arrests were carried out on 16 October in the Slovenian municipality of Celje. The arrested individuals are aged between 25 and 51 years old. Two vehicles worth in excess of €100 000 were also seized at the home of one of the suspects. One of the criminal leaders was also arrested in Lithuania earlier in June.  This criminal group, in cooperation with accomplices from Lithuania, organised the smuggling of cigarettes from the Russian Federation into the territory of the European Union through means of forged documents which concealed the real origin of the goods. The tobacco products were mostly transported by cargo ships to ports in Belgium and the Netherlands, where the cargo was loaded onto Slovenian lorries and then brought to Slovenia. The cigarettes were there hidden in other legal cargoes and taken to their final destination - the United Kingdom.  During the investigation which began in September 2019, some major seizures were made, including 1.49 million cigarettes at the border crossing between Ukraine and Hungary (March 2019), as well as 4.35 million cigarettes in two separate seizures in Dover, UK (June 2020).   The value of the seized tobacco products on the illegal market in the United Kingdom is believed to be in the region of €6 million.  Europol’s Analysis Project SMOKE supported this case by facilitating the exchange of information between the different countries involved and by analysing the operational data to identify the main targets. The investigation is still ongoing to try to find potential links to other European countries.   In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Excise fraud is one of the priorities of the Policy Cycle.  

The French Gendarmerie (Gendarmerie nationale/OCLAESP) and the French Customs (Direction générale des douanes et droits indirects), supported by the Financial Division of the Hellenic Police (Διεύθυνση Οικονομικής Αστυνομίας) and Europol, took down a criminal network involved in the production and trafficking of doping substances and counterfeit medicines.  Two underground doping labs dismantled On the action day, French law enforcement officers dismantled two clandestine steroid manufacturing labs and arrested 24 suspects. During raids in several cities across France, the officers made large seizures including €26 400 in cash, two vehicles, production materials, machinery and labels from the dismantled labs, 1 125 full vials and 4 615 tablets. They also confiscated 3kg of raw material, enough to produce 3 000 flasks of doping material with a total market value of €150 000. This multi-layered network was involved in importing, producing and distributing doping substances (steroids, anabolic substances and growth hormones). The majority of the substances came from China and there then redistributed worldwide. Most of the mid-level buyers of these imported illegal substances resold them online. A small number, however, acquired raw materials and manufactured doping substances under their own brand name in underground labs. These counterfeit and illegal medicines pose a serious threat to the health and safety of the buyers since they may contain a different percentage of active ingredients, impure molecules and are produced outside of any medical checks.   Since 2018, Europol has supported these investigations with operational analysis and facilitated the information exchange. On the action day, Europol deployed an expert on the field to provide real-time analytical support to investigators in the field. This action day is the second coordinated action related to the investigation after a hit against a connected network in Greece which took place in December 2019. Europol’s Property Crime Coordinated Coalition (IPC3) is co-funded by EUIPO (European Union Intellectual Property Office) to combat intellectual property crime.   

The French Judicial Police within the National Police (Police judiciaire / Police nationale) and the Colombian Police, supported by Europol, dismantled an organised criminal group involved in human trafficking for sexual exploitation and money laundering.  On the action days, 29 September and 13 October 2020, law enforcement officers raided nine locations in Paris and arrested nine individuals. The officers have so far identified 40 victims coming from Colombia, the Dominican Republican, Paraguay, Spain and Venezuela. The French authorities made multiple seizures including cash in different currencies for a total amount exceeding €121 000.  Clients fished on the internet The organised crime group composed of Colombian nationals has been active since November 2015. The suspects recruited their victims from South America and the EU and exploited them in several rental apartments in Paris and other cities spread over three French regions. Italy, Spain and Switzerland emerged as transit countries during the investigation. The criminal network organised the accommodation and recruited the clients. The suspects used different known websites to advertise the sexual services. The criminal network also operated 14 phone number which were linked to the advertisements. Via these numbers, members of the criminal network informed clients about prices and managed the logistical arrangements between clients and victims. Twice a month, the network collected its profits via physical collection or by money transfer.                               Europol facilitated the information exchange and provided analytical support. During the action day, Europol cross-checked operational information in real-time against Europol’s databases and provided technical support with phone extraction capabilities.    In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Human trafficking is one of the priorities of the Policy Cycle.  

On 16 October the General Commissariat of Information of the Spanish National Police (Policía Nacional - CGI) arrested two individuals for their alleged link to a terrorist organisation and on suspicion of recruiting and indoctrinating for the purpose of jihadist terrorism. During an action day supported by Europol, Spanish police raided the homes of the suspects in the cities of Melilla and Mogán in Las Palmas de Gran Canaria. Law enforcement seized multiple mobile and electronic devices. The terrorist group shared the so-called al-Qaeda ideology and aimed to impose an Islamic caliphate through violent jihad. The terrorist organisation existed and operated as an autonomous structure. The arrested suspects recruited women to expand the terrorist network. These women were then indoctrinated to join the terrorist organisation and become recruiters themselves. The terrorist organisation established polygamous marriages as a way to support its ambition of expanding its members and generating a future generation of terrorists. During the action day, experts from Europol’s European Counter Terrorism Centre (ECTC) were deployed to provide on-the-spot support. This enabled real-time information exchange and analysis  

Modern communication technologies – namely the internet, social media, and mobile applications – have significantly impacted how organised crime groups involved in international trafficking in human beings operate. Technology has broadened criminals’ ability to traffic human beings for different types of exploitation, including sexual and labour exploitation, the removal of organs, illegal adoption of children and forced marriages. Human traffickers are using increasingly modern communication technologies to exploit their victims multiple times over:  from advertising and recruiting victims, to blackmailing them with photos and videos to control their movements. To counter this threat, we have to use the great advantage of shared intelligence and collect more digital evidence to connect the dots between national and international investigations.   Fighting human trafficking is one of the EU and Europol’s top priorities and to mark the EU Anti-Trafficking Day 2020 Europol is publishing The challenges of countering human trafficking in the digital era.  DOWNLOAD REPORT HERE      

Europol supported a cross-border investigation, led by the Spanish Civil Guard (Guardia Civil), involving the Dutch Police (Politie) and US Homeland Security Investigations and Border and Protection that resulted in dismantling an organised crime group trafficking cocaine from South America to Europe.  Self-developed apps to encrypt communications On the action days, 1 and 2 October, law enforcement officers raided locations in the Dutch cities of Amsterdam, Papendrecht, Rotterdam, Utrecht and the Spanish cities of Valencia and Malaga. They arrested eight suspects (five in Spain and three the Netherlands), one of them believed to be a leader of the network. During the operations, the officers from the Spanish police seized six tonnes of cocaine, jewellery, cash and encrypted devices. The suspects are believed to have used self-developed encrypted mobile applications to communicate with their counterparts. Individuals with military training and experience in war missions supported the logistical set-up of the criminal network. Europol facilitated the information exchange and provided analytical support. On then action day, Europol supported the field activities by setting up a virtual command post. This enabled Europol to facilitate the real-time exchange of information between Spain and the Netherlands and support with operational analysis to provide clues to investigators on the ground.     In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime.In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Drug trafficking is one of the priorities for the Policy Cycle.    

The French Judicial Police within the French National Police (Police judiciaire, Police nationale) and the Romanian National Police (Poliția Română) supported by Europol and Eurojust, brought down an organised criminal group involved in human trafficking for sexual exploitation.  Ten arrested in France and Romania On the action day, 12 October 2020, law enforcement officers raided several locations in France and arrested ten individuals (four in France and six in Romania). So far, officers have identified three female victims with Romanian nationality in France. Among the seizures made during the raids were electronic equipment, documents and cash.  From Romania to France via Germany The organised crime group led by two Romanian nationals had been recruiting victims in Romania with the so-called ‘lover boy’ method since 2015. Some of the victims were in fact girlfriends of the suspects. The criminal group sent the women to Germany and then on to Paris, France, where they were sexually exploited. The suspects used websites to find clients while monitoring the activities of their victims by phone. The criminal profits were then channelled to Romania via money transfers and laundered through real estate and luxury items, such as cars.  The lover boy trick  The ‘lover boy’ technique is widely used by criminals to recruit victims confronted with economic and social hardship. The suspects target their victims’ vulnerabilities and seduce them with expensive gifts and promises of a better life abroad. This is how many women leave their families in search of love and new opportunities in other countries. However, once they find themselves in their new home, they are forced into prostitution to earn money for their handler. The victims are lured with affection, violence and threats against them and their families back home. Europol facilitated the information exchange and provided analytical support. Operational activities were funded in the framework of EMPACT supported actions.  Eurojust facilitated the judicial cooperation, funded coordination meetings and set-up a Joint Investigation Team to coordinate the operational activities.   In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Human trafficking is one of the priorities for the Policy Cycle.  

An unprecedented international law enforcement operation involving 16 countries has resulted in the arrest of 20 individuals suspected of belonging to the QQAAZZ criminal network which attempted to launder tens of millions of euros on behalf of the world’s foremost cybercriminals.  Some 40 house searches were carried out in Latvia, Bulgaria, the United Kingdom, Spain and Italy, with criminal proceedings initiated against those arrested by the United States, Portugal, the United Kingdom and Spain. The largest number of searches in the case were carried out in Latvia in operations led by the Latvian State Police (Latvijas Valsts Policija). Bitcoin mining equipment was also seized in Bulgaria. This international sweep follows a complex investigation led by the Portuguese Judicial Police (Polícia Judiciária) together with the United States Attorney Office for the Western District of Pennsylvania and the FBI’s Pittsburgh Field Office, alongside the Spanish National Police (Policia Nacional) and the regional Catalan police (Mossos D’esquadra) and law enforcement authorities from the United Kingdom, Latvia, Bulgaria, Georgia, Italy, Germany, Switzerland, Poland, Czech Republic, Australia, Sweden, Austria and Belgium with coordination efforts led by Europol.  How the QQAAZZ network cleaned dirty money Criminal indictments returned by federal grand juries in Pittsburgh, United States, set forth allegations of how this criminal network operated. It is estimated that the QQAAZZ network laundered, or attempted to launder, tens of millions of euros in stolen funds since 2016. Comprised of several layers of members mainly from Latvia, Georgia, Bulgaria, Romania, and Belgium, the QQAAZZ network opened and maintained hundreds of corporate and personal bank accounts at financial institutions throughout the world to receive money from cybercriminals who stole it from accounts of victims.  The funds were then transferred to other QQAAZZ-controlled bank accounts and sometimes converted to cryptocurrency using ‘tumbling’ services designed to hide the original source of the funds.  After taking a fee of up to 50-percent, QQAAZZ returned the balance of the stolen funds to their cybercriminal clientele.   The QQAAZZ members secured these bank accounts by using both legitimate and fraudulent Polish and Bulgarian identification documents to create and register dozens of shell companies which conducted no legitimate business activity. Using these registration documents, the QQAAZZ members then opened corporate bank accounts in the names of the shell companies at numerous financial institutions within each country, thereby generating hundreds of QQAAZZ-controlled bank accounts available to receive stolen funds from cyber thieves. QQAAZZ advertised its services as a “global, complicit bank drops service” on Russian-speaking online cybercriminal forums where cybercriminals gather to offer or seek specialised skills or services needed to engage in a variety of cybercriminal activities. The criminal gangs behind some of the world’s most harmful malware families (e.g.: Dridex, Trickbot, GozNym, etc.) feature among those having benefited from the services provided by QQAAZZ. International police cooperation International police cooperation coordinated by Europol was central in bringing the perpetrators to justice who were all located in different geographical locations around the world. Europol’s European Cybercrime Centre (EC3) hosted operational meetings, provided digital forensic support and facilitated the information exchange in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol’s headquarters in The Hague. Europol specialists were also deployed to Latvia and the United Kingdom to support the local authorities during the action days. The National Member for Portugal at Eurojust took part in a number of operational meetings. Edvardas Šileris, Head of Europol’s European Cybercrime Centre, said: “Cybercriminals are constantly exploring new possibilities to abuse technology and financial frameworks to victimise millions of users in a moment from anywhere in the world. Today’s operation shows how through a proper law enforcement international coordination we can turn the table on these criminals and bring them to justice.” Carlos Cabreiro, Director of the National Unit for Fighting Cybercrime and Technological Crime of the Polícia Judiciária, said: “Operation 2BaGoldMule has been a highly significant operation involving international law enforcement and prosecutors to tackle top-level cybercriminals who have laundered millions of euros for the world’s foremost criminals. This operation has shown that through this cooperation we can collectively tackle the global nature of cybercrime. This is the only way forward.” Scott W. Brady, United States Attorney for the Western District of Pennsylvania, said: “Cybercrime victimizes individuals and companies all over the world, so our work to identify and disrupt cybercriminals requires global collaboration. For the past several years, law enforcement from 16 countries has been conducting coordinated investigations of this criminal gang, and now parallel prosecutions will commence in the U.S., Portugal, United Kingdom and Spain.  As this case demonstrates, we will be relentless in our pursuit of cybercriminals regardless of where they reside.” Michael Christman, FBI Pittsburgh Special Agent in Charge, said: “This was an extensive investigation that had implications around the world. Partnerships are essential, as no one agency can combat cybercrime alone. This case highlights the FBI’s strategy to target and dismantle the most significant cybercriminal enterprises through a global task force approach. I can assure everyone that the FBI and our partners will continue to work tirelessly to combat these cyber threats.” Download the infographic  In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Cybercrime is one of the priorities of the Policy Cycle.  

As from today, Europol will be training law enforcement officers from Europe and beyond in the complex field of online investigations by using a game created specifically for the task. The SIRIUS game, developed between Europol’s SIRIUS Project and the Centre of Excellence in Terrorism, Resilience, Intelligence and Organised Crime Research (CENTRIC), has been designed for investigators to gain hands-on experience in requesting data from online service providers, such as internet providers and social media platforms. This is a complex issue to navigate, as online service providers can be located outside of Europe and all have specific ways of receiving such requests from law enforcement. As electronic evidence is present in most investigations, this is a very relevant issue: law enforcement and judicial authorities need to know which type of data they can request and how to request it. The SIRIUS game takes the investigator through an immersive scenario where the user will attempt to make such requests following a terrorist attack. About SIRIUS Europol created the SIRIUS project in 2017 to respond to the need of law enforcement and judicial authorities to improve access to electronic evidence during an investigation. SIRIUS is a secure web platform for law enforcement professionals, offering a variety of services to its users, such as guidelines, trainings and tools, to help with accessing data from online service providers. In three years, the SIRIUS platform has grown to 4500 users from 44 countries, representing all EU Member States. The SIRIUS Project has received funding from the European Commission’s Service for Foreign Policy Instruments (FPI) under grant agreement No PI/2017/391-896. Europol is the sole beneficiary of this grant. About CENTRIC CENTRIC is a multi-disciplinary and end-user focused centre of excellence, located within Sheffield Hallam University. The global reach of CENTRIC links both academic and professional expertise across a range of disciplines providing unique opportunities to progress ground-breaking research within security and policing domains.      

The EU Internet Referral Unit (EU IRU), which is part of Europol’s European Counter Terrorism Centre (ECTC), started its operations in the wake of the series of terrorist attacks that shook Europe in 2015. Its mandate includes referring terrorist and violent extremist content to online service providers and providing support to Member States and third parties in the context of internet investigations. The EU IRU also provides support to Europol’s European Migrant Smuggling Centre (EMSC), by flagging detected internet content used by traffickers to offer smuggling services to migrants and refugees. The EU IRU’s mission is to link the virtual face of terrorism to its physical aspect, by bridging the gap between prevention and investigation capabilities. Its ultimate objective is to reduce the accessibility of terrorist content online by providing a resilient referral capability to the Member States, and to provide a core internet-based investigation support capability to respond to their operational needs. The EU IRU is committed to being transparent about its mandate, its legal framework and how it enforces its policies. As part of this commitment, the EU IRU publishes once a year its transparency report, a comprehensive summary of its achievements now at its third edition. This report gives an account of the EU IRU’s major activities in 2019, and more specifically, it sheds light on both the prevention activities and the investigative support the EU IRU provided upon request of EU Member States. Download the EU IRU 2019 report. 

On 7 October, the investigation service of the Dutch tax authorities, FIOD (Fiscale Inlichtingen en OpsporingsDienst), raided an illegal tobacco factory in  West-Betuwe, south of Utrecht. It is one of the largest illegal cigarette factories uncovered in the Netherlands. The factory was in full operation when law enforcement entered the premises. Thirteen suspects were arrested comprising mostly of nationals from Eastern Europe. Investigators seized 3.6 million cigarettes and 32 000 kilos of tobacco along with packaging material, cigarette paper, filters and glue. The tax loss prevented to the Dutch state revenue for the illegal production is estimated at €6 million.  Supported by Europol, this operation is the result of cross-border cooperation between the Dutch authorities and Ukrainian State Border Guard Service. Illegal machinery all in one facility  In general, illegally processing and producing tobacco is dispersed across multiple facilities so criminals can spread the risk. In this case, the entire production cycle took place in one factory. The factory was located in a rural warehouse allowing the criminals to go unnoticed with their illegal activities. Dutch authorities estimated that the machinery could potentially produce one million cigarettes a day. The production is believed to have been destined for the black market in countries where the retail price of cigarettes is high. The factory is presumed to have produced 18 million illegal cigarettes seized abroad in recent months.  Tackling the illegal supply of tobacco and excise fraud  Europol’s Analysis Project Smoke dedicated to investigating the unlawful manufacturing and smuggling of excise goods supported the investigation. The exchange of information between law enforcement authorities and the analysis of operational data contributed to the identification of the potential location of the factory. Links established with recent seizures of tobacco in other countries helped further the investigation. FIOD is also an active member of the ongoing special operational taskforce set up in 2018 between Europol and Member States to tackle top organised crime groups facilitating the supply of tobacco, machinery, skilled workers and non-tobacco material to illicit factories.   In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Excise fraud is one of the priorities of the Policy Cycle.  

On 28 September, French law enforcement authorities arrested nine suspects involved in document fraud and the facilitation of illegal immigration. Supported by Europol, this operation is the result of a cross-border cooperation between law enforcement authorities in France, Germany, Greece and Switzerland. Two leaders of the criminal gang, both Algerian nationals, are among the suspects arrested in France. The criminal network was active in multiple EU countries The criminal network procured and distributed forged and falsified administrative documents to irregular migrants from North Africa based in France, Germany, Switzerland and most likely other EU countries.  The criminal network produced the false documents in Athens and shipped them via courier companies.  The beneficiaries, counterfeiters and suppliers communicated via social media networks. Seizures include: 37 counterfeit, falsified and genuine documents (Algerian, Austrian, Bulgarian, French, German, Greek, and Swiss) including passports, IDs, driving licences, residence cards, birth and marriage certificates; electronic and mobile devices; €2 400 in cash and evidence of international bank transfers between France, Belgium, Germany and Spain. The arrested gang leader who was known to the German and Swiss law enforcement authorities resided in Mulhouse, France. The suspect acted as a central interface between the counterfeiters in Greece and supervised a France-wide network of individuals hunting potential customers of illegal services. Another arrested suspect played a primary role in the recruitment of irregular migrants seeking false documents in the Paris region.   Document fraud is one of the engines of organised crime in the EU. Although document fraud has no direct impact on most citizens in the EU, it facilitates other serious and organised crimes. This operation is the first successful step of an EU-wide investigation that began in December 2018. Europol supported the operation by facilitating the information exchange and analysing operational data and thus identifying cross-border links.  This operation was carried out within the framework of the Joint Operational Team (JOT) Doc Fraud, under the EU EMPACT priority on the facilitation of illegal immigration. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Document fraud and the facilitation of illegal immigration is one of the priorities of the Policy Cycle.  

A referral action day targeting online jihadist propaganda took place on 6 October 2020. The European Union Internet Referral Unit (EU IRU) at Europol organised the operational activities in cooperation with Croatia. Specialised units from Albania, Bosnia and Herzegovina, Croatia, North Macedonia, Montenegro, Serbia and Slovenia participated in the action day. The referral action targeted online content disseminated by members and supporters of al-Qaeda, the so-called Islamic State and affiliated groups. The counter terrorism units from the participating countries, together with the EU IRU, looked into jihadist propaganda material, such as video tutorials, nashids, social media accounts inciting to violence. The content was spread in the languages of the Western Balkan countries mainly by local supporters of the targeted jihadist organisations. The action led to the assessment of 346 URLs on 27 platforms. Europol’s EU Internet Referral Unit collected the contributions sent by Western Balkan countries and stored the content in its database. After cross-checking against Europol databases and performing de-confliction with participant countries, the material was referred to the online service providers.

Stepping up public sector partnerships in the face of increasingly pervasive cybercrime threats was the theme of the 8th INTERPOL-Europol Cybercrime Conference.  Taking place online for the first time, the one-day conference (6 October 2020) saw more than 400 cyber experts from law enforcement, private industry, international organizations, CERTs and academia tune in to discussions on emerging cyber threats, trends and strategies. Recent findings from both INTERPOL and Europol have made clear that cybercriminals around the world have been able to capitalize on the global COVID-19 pandemic, turning the health crisis into an opportunity. At the same time, the pandemic has accelerated the digital transformation and increased our reliance on connectivity and digital tools. With rapid developments in the global cyber landscape, closer collaboration between law enforcement and sectors to deal with the ever-changing nature of cybercrime has become increasingly pressing. Europol’s Executive Director Catherine de Bolle said: “The circumstances of this year have called for a shorter – virtual – event, but the importance of this conference remains unchanged. If anything, the events of this year have served as a sobering reminder that strong partnerships are central in the fight against cybercrime. Such challenges can only be addressed in an agile and pro-active manner, be it through public-public partnerships or cooperation with the private sector. It is about uniting our strengths in light of a common interest – a safer and more secure cyberspace”. The conference not only looked back at 2020 but aimed to address upcoming challenges and invited law enforcement, governments and non-government organisations to add an agile and proactive approach to cybersecurity in their daily work. The event also featured a dedicated presentation on the 2020 edition of the Internet Organised Crime Threat Assessment (IOCTA), detailing some of the findings and recommendations included in the report. The IOCTA was launched on 05 October..  “In a world where more than 4.5 billion people are online, more than half of humanity is at risk of falling victim to cybercrime at any time,” said INTERPOL Secretary General Jürgen Stock. “Information is the key enabler that can bring us together and make us stronger in the fight against cybercrime. Aggregating national datasets on cybercrime on a global scale is therefore crucial and INTERPOL is uniquely placed to lead this global effort together with our member countries and partners,” the INTERPOL Chief added.    

Tomorrow, the European Union Agency for Cybersecurity (ENISA), Europol’s European Cybercrime Centre (EC3) and the Computer Emergency Response Team for the EU Institutions, Bodies and Agencies (CERT-EU) will launch the 4th annual IoT Security Conference series to raise awareness on the security challenges facing the Internet of Things (IoT) ecosystem across the European Union. The series will span three weeks, with each week exploring a different cybersecurity topic: Operational IoT, Artificial Intelligence (AI) and Supply Chain for IoT, respectively. The series will be held in a virtual webinar format, open to public Q&A. EU Agency for Cybersecurity Executive Director, Juhan Lepassaar said: “Fostering trust and security of our connected digital devices, the Internet of Things, is a priority. When discussing IoT security across Europe, we need a common approach to all aspects of cybersecurity that also considers the context in which IoT products and services operate. For example, a smart medical device such as a connected insulin pump undoubtedly carries higher risk than that of a household smart light bulb. This IoT security webinar series will discuss these issues in order to provide input to policy makers, especially on critical infrastructure sectors employing emerging technologies, such as IoT and AI, and possible cybersecurity certification schemes that could support this effort." Head of Europol’s European Cybercrime Centre (EC3) Edvardas Šileris said: “You can secure only what you can understand. The challenge of the Internet-of-Things is understanding what is happening.  Through this conference, we want to contribute to this understanding from our law enforcement perspective, identifying how criminals can and will abuse the potential of IoT.  The complexity of IoT and its resulting cybersecurity challenges call for a smart and multi-stakeholder approach. I invite everyone from law enforcement, industry, government and academia with an interest in cyber security to join us online to reflect on how to increase the cyber resilience of the IoT ecosystem.” Head of CERT-EU Saâd Kadhi said: “CERT-EU and CSIRTs from all over the world have been working very hard to keep threats at bay. As teleworking became the norm in the aftermath of COVID-19, the surface we need to protect grew exponentially. The Internet of Things will contribute, more and more, to this growth as many IoT devices are not designed with security in mind. And now that they are gaining a foothold in critical infrastructure and establishing bridges between the digital and physical worlds, it is vital that security become a requirement and not an option. Otherwise, I’m afraid the challenges ahead of us will be overwhelming.” As vehicles, medical devices, factories and energy plants rely more on the emerging technologies driving forward this increasingly interconnected world, they also become exposed to new threats. The EU Agency for Cybersecurity, Europol and CERT-EU underline the importance of understanding these threats and attacks, and the need to use effective mechanisms to enhance the security of IoT devices. The IoT Security Conference will open discussions into the trustworthiness of IoT with topics about supply chain integrity, AI deployments and regulations surrounding IoT. The webinars will be opened by Mr Kadhi, Mr Šileris and Mr Lepassaar, respectively, and will include high-level speakers such as Mr Andreas Könen, Director General of Cyber and Information Security at the German Federal Ministry of the Interior, Building and Community, representing the Presidency of the Council of the EU. The series, moderated by Europol EC3’s Head of Strategy and Development Team Dr Nicole van der Meulen, is a three-part interactive series featuring discussions by cybersecurity professionals, experts from cybercrime units, computer security incident response teams, international organisations, private industry, regulatory agencies and academia who will share their views on how to overcome current challenges and how to make cyberspace safer for EU citizens. Event Schedule Operational IoT - 7 October 2020 at 15:00 to 16:30 CET Artificial Intelligence - 14 October 2020 at 15:00 to 16:30 CET Supply Chain for IoT – 21 October at 15:00 to 16:30 CET Event registration Background The European Union Agency for Cybersecurity, Europol and CERT-EU have been working intensely on tackling the security challenges of IoT for Europe’s infrastructure, businesses, governments and citizens by identifying good practices and measures to allow IoT to function in a more secure and privacy-respecting manner. The EU Agency for Cybersecurity is dedicated to promoting a culture of security that will improve the ability of EU Member States to respond to cyber-attacks. The Agency has been raising awareness on IoT security through events and summer school courses, and through the publication of in-depth studies, reports and position papers on current cybersecurity matters. Key publications include the Baseline Security Recommendations for IoT and the Good Practices for Security of IoT in the context of Smart Manufacturing. Most recently, the Agency has aggregated these publications and activities on good practices for IoT and smart infrastructure in an online tool to serve as a reference point for IoT security. Europol has been researching the many advantages of the IoT for law enforcement as a tool to fight crime, and is also doing the same in the area of Artificial Intelligence (AI). Data from connected devices at a crime scene can provide crucial evidence to an investigation, but such data require the same safeguards and security standards to ensure the privacy and safety of citizens. At the same time, Europol is researching how AI can also be (part of) the answer to challenges faced by law enforcement in the execution of criminal investigations, namely information processing and other parts of policing. From a threat perspective, Europol, in close cooperation with industry and academia, is looking into the potential use of AI by criminals with a view to better anticipating possible malicious and criminal activities facilitated by AI, as well as to prevent, respond to, or mitigate the effects of such attacks in a pro-active manner. CERT-EU, with many experiences on IoT evolution, has witnessed how the technology has become a major issue in terms of cybersecurity, being the “forgotten” part of the security ecosystem – both by manufacturers and users. It supports operations that allow cybersecurity professionals to respond to daily technical challenges.

Between 14 and 20 September 2020, Europol supported two Europe-wide joint action days against human trafficking for labour exploitation. The operation, also supported by Frontex, involved a wide range of law enforcement authorities including police, immigration and border guards, labour inspectorates, tax authorities and other respective national ministries. Law enforcement authorities from 19 countries, led by the Netherlands, joined forces to target labour exploitation in sectors infamous for exploiting the vulnerable. At the same time, France led parallel joint action days, involving law enforcement authorities from six countries and focused on exploitation in the agricultural sector. Nail salons under inspection Law enforcement authorities carried out inspections in nail salons with some of the investigations specifically targeting the possible exploitation of Vietnamese nationals. Officers also inspected other labour-intensive sectors, which require low-skilled workers, such as the transport and logistics industry and the construction sector. The joint efforts enable an integrated approach between different law enforcement and inspection authorities in the participating countries such as, for example, the simultaneous check of a company in three different countries (Belgium, France and the Netherlands). Overall, law enforcement officers in the 19 participating countries checked 2 921 locations, 33 741 people and 12 193 vehicles. This led to the identification of 535 potential victims and 193 suspects and the initiation of 606 new investigations. Participating countries: Austria, Belgium, Croatia, Cyprus, Denmark, France, Germany, Italy, Lithuania, Malta, the Netherlands, Poland, Romania, Slovenia, Slovakia, Spain Sweden, Switzerland and the United Kingdom. 224 farms and vineyards checked For the agricultural sector, criminals often recruit their victims in the victims’ countries of origin and take them to another country to make them work as modern-day slaves. Usually, the victims come from poorer regions and are coerced into working long hours for a low wage while their ‘employers’ do not pay them or let them travel back to their home countries. EU citizens are mostly exploited in the agricultural sector year-round, while non-EU citizens are employed in seasonal production. During the focused action days, law enforcement authorities checked 224 locations such as farms and vineyards, 81 vehicles, while 180 potential victims and 17 suspects were identified. Participating countries: Bulgaria, Cyprus, France, Italy, Portugal, Spain and the Netherlands. Europol coordinated the action days and facilitated the information exchange between the participating countries. Europol provided analytical and operational support 24/7 and facilitated the real-time exchange of communication between the participating authorities. Watch the video In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Trafficking of human beings is one of the priorities of the Policy Cycle.  

Europol collaborated with the Spanish Guardia Civil in arresting an Algerian national on 30 September suspected of allegedly supporting the so-called Islamic State. On 2 October 2020, the Spanish Civil Guard (Guardia Civil) announced the arrest in Madrid of an Algerian national suspected of supporting the so-called Islamic State. The National Court (Audiencia Nacional) in collaboration with Europol coordinated the operation. The suspect was under investigation for online consumption of propaganda and forgery of identification documents. He was also found in possession of explosive and weapon manuals. The investigation followed the evolution of the individual’s extensive internet activity and affiliation links with the terrorist organisation, as well as his strong interest in weapons and fighting techniques. Hypothesis were drawn in relation to his experience in document forgery, which could have been key to facilitate his international mobility in recent years. The investigation is still on-going pending the thorough expert analysis of the digital materials found in the suspect’s possession. Read Guardia Civil’s press release.

So much has changed since Europol published last year’s Internet Organised Crime Threat Assessment (IOCTA). The global COVID-19 pandemic that hit every corner of the world forced us to reimagine our societies and reinvent the way we work and live. During the lockdown, we turned to the internet for a sense of normality: shopping, working and learning online at a scale never seen before.  It is in this new normal that Europol publishes its 7th annual IOCTA. The IOCTA seeks to map the cybercrime threat landscape and understand how law enforcement responds to it. Although the COVID-19 crisis showed us how criminals actively take advantage of society at its most vulnerable, this opportunistic behaviour of criminals should not overshadow the overall threat landscape. In many cases, COVID-19 has enhanced existing problems. Cross-cutting crime Social engineering and phishing remain an effective threat to enable other types of cybercrime. Criminals use innovative methods to increase the volume and sophistication of their attacks, and inexperienced cybercriminals can carry out phishing campaigns more easily through crime as-a-service. Criminals quickly exploited the pandemic to attack vulnerable people; phishing, online scams and the spread of fake news became an ideal strategy for cybercriminals seeking to sell items they claim will prevent or cure COVID-19. Encryption continues to be a clear feature of an increasing number of services and tools. One of the principal challenges for law enforcement is how to access and gather relevant data for criminal investigations. The value of being able to access data of criminal communication on an encrypted network is perhaps the most effective illustration of how encrypted data can provide law enforcement with crucial leads beyond the area of cybercrime. Malware reigns supreme Ransomware attacks have become more sophisticated, targeting specific organisations in the public and private sector through victim reconnaissance. While the COVID-19 pandemic has triggered an increase in cybercrime, ransomware attacks were targeting the healthcare industry long before the crisis. Moreover, criminals have included another layer to their ransomware attacks by threatening to auction off the comprised data, increasing the pressure on the victims to pay the ransom. Advanced forms of malware are a top threat in the EU: criminals have transformed some traditional banking Trojans into modular malware to cover more PC digital fingerprints, which are later sold for different needs. Child sexual abuse material continues to increase The main threats related to online child abuse exploitation have remained stable in recent years, however detection of online child sexual abuse material saw a sharp spike at the peak of the COVID-19 crisis. Offenders keep using a number of ways to hide this horrifying crime, such as P2P networks, social networking platforms and using encrypted communications applications. Dark web communities and forums are meeting places where participation is structured with affiliation rules to promote individuals based on their contribution to the community, which they do by recording and posting their abuse of children, encouraging others to do the same. Livestream of child abuse continues to increase, becoming even more popular than usual during the COVID-19 crisis when travel restrictions prevented offenders from physically abusing children. In some cases, video chat applications in payment systems are used which becomes one of the key challenges for law enforcement as this material is not recorded. Payment fraud: SIM swapping a new trend SIM swapping, which allows perpetrators to take over accounts, is one of the new trends in this year’s IOCTA. As a type of account takeover, SIM swapping provides criminals access to sensitive user accounts. Criminals fraudulently swap or port victims’ SIMs to one in the criminals’ possession in order to intercept the one-time password step of the authentication process. Criminal abuse of the dark web In 2019 and early 2020 there was a high level of volatility on the dark web. The lifecycle of dark web market places has shortened and there is no clear dominant market that has risen over the past year. Tor remains the preferred infrastructure, however criminals have started to use other privacy-focused, decentralised marketplace platforms to sell their illegal goods. Although this is not a new phenomenon, these sorts of platforms have started to increase over the last year. OpenBazaar is noteworthy, as certain threats have emerged on the platform over the past year such as COVID-19-related items during the pandemic. Catherine De Bolle, Europol’s Executive Director commented: “Cybercrime affects citizens, businesses and organisations across the EU. Europol plays a key role in countering cybercrime by working with our many partners in law enforcement and the private sector and by offering innovative solutions and effective, comprehensive support to investigations. I hope this analysis can inform effective responses to these evolving threats and make Europe safer”. Vice-President for Promoting our European Way of Life, Margaritis Schinas, who is leading the European Commission’s work on the European Security Union, said: «Cybercrime is a hard reality. While the digital transformation of our societies evolves, so does cybercrime which is becoming more present and sophisticated.  We will spare no efforts to further enhance our cybersecurity and step up law enforcement capabilities to fight against these evolving threats. Europol has a major role to play». EU Commissioner for Home Affairs, Ylva Johansson, said: “The Coronavirus Pandemic has slowed many aspects of our normal lives. But it has unfortunately accelerated online criminal activity. Organised Crime exploits the vulnerable, be it the newly unemployed, exposed businesses, or, worst of all, children. This report shows the urgent need for the EU to step up the fight against organised crime [online] and confirms the essential role of Europol in that fight”. Edvardas Šileris, Head of European Cybercrime Centre said: “I am pleased to welcome the 2020 edition of the IOCTA – our flagship document, an essential resource for EU’s law enforcement and policy makers. I am very thankful to all the partners who have contributed to this year’s assessment and have helped us identify the key theme defining the current landscape: cybercrime is an evolution, not a revolution”. The 2020 IOCTA contributes to setting priorities for the 2021 EMPACT operational plans, which follow the priorities defined as: disruption criminal activities, combating child sexual abuse and child sexual exploitation and targeting criminals involved in fraud and counterfeiting of non-cash means of payment. Download the IOCTA 2020 report.

This week a Franco-Belgian investigation supported by Europol uncovered a large criminal network involved in migrant smuggling, trafficking of human beings including minors, forced begging, social benefit fraud and document forgery. Active for several years, the organised crime network illegal profits are estimated at €5 million.  During the coordinated operation, officers from the Belgian Local Police (Lokale Politie Brussel-West, Police Locale  Bruxelles-Ouest) and the French National Police (Police nationale) raided seven locations and seized forged documents including ID cards, passports and counterfeit birth and marriage certificates, mobile devices, gold jewellery and evidences of money transfers. The French authorities arrested 13 individuals in the regions of Paris and Lyon including the believed kingpins of the network. Fifteen minors exploited by their own families were rescued and placed under the protection of the competent judicial authorities.   Thousands of euros a day from begging and benefit fraud Since April 2018, law enforcement investigated the illicit activities of this criminal organisation operating in Belgium and France. The gang facilitated the illegal entry into Europe of Syrian migrants and supplied them with counterfeit documents to fraudulently apply for asylum and social benefits. The fraudulent activities estimated at over €250 000 per family consisted of registering the same children under false identities several times to earn more social benefits in France and Belgium. The criminals exploited their victims by providing them with forged documents and accommodation in exchange for payment. The heads of the network controlled at least 80 begging areas in Paris and its surroundings often resorting to armed violence and blood feuds. Forced child beggars were swapped between multiple begging areas and suffered physical and mental harm. Law enforcement officers estimated the weekly profit from this criminal activity to be around €3000 per family. The high-value goods seized during the house searches hints at how criminals invested their proceeds.  Europol facilitated the operational coordination and provided continuous assistance throughout the different stages of the investigation. An operational task force was set up between the Belgian and French investigators and Europol, allowing frequent operational meetings to coordinate the joint investigation. This operation was carried out within the framework of the Joint Operational Team (JOT) DUNQETT, under the EU EMPACT priority on the facilitation of illegal immigration.   In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Trafficking in human beings, facilitation of illegal immigration and document fraud are one of the priorities for the Policy Cycle.  

A major operation involving law enforcement authorities from Belgium, France, the Netherlands and the United Kingdom, supported by Europol and Eurojust, led to the dismantling of a large network of criminals smuggling migrants in life-threatening conditions through the English Channel.  The action spanned over two days, 28 and 29 September. Law enforcement officers from the Belgian Federal Police (Federale Politie, Police Fédérale), British Immigration Enforcement, the Dutch Royal Marechaussée (Koninklijke Marechaussee) and the French Border Police (OCRIEST/BMR62, Police Aux Frontières) within the French National Police (Police Nationale) worked together and 12 suspects were arrested (seven in France, two in the Netherlands and three in the UK). The overall seizures during the two action days included 12 vehicles, 10 rubber boats and engines, 158 life jackets, a caravan, a boat trailer, jewellery, about €48 000 in cash, documents and mobile devices. This investigation targeted a developing trend of migrant smuggling involving small boats across the English Channel, a criminal activity which has escalated exponentially in recent months with increased interceptions in France and the UK.  Overloaded boats and rough weather This organised crime group consists mainly of Iranian nationals living in France, the Netherlands and the UK. The network was smuggling migrants with small boats from the north coasts of France to the UK. The suspects had connections in different countries to organise their criminal activity. Members of the criminal group purchased inflatable boats and engines from Germany and the Netherlands and transported them to the departure points. There, they taught the migrants how to operate the boats while charging an average of €3 000 per person for the crossings. The various elements gathered during the investigations confirmed that this criminal organisation would have facilitated the illegal sea crossing of a large number of migrants. This transportation in overloaded boats, and often in very difficult weather conditions on one of the busiest commercial shipping lanes in the world, endangered both the lives of the migrants and the law enforcement officers involved in rescue operations at sea.  Europol supported the operation by facilitating the information exchange, organising operational meetings and providing analytical support with two intelligence analysts dedicated to this high-priority case. On the action day, Europol set-up a virtual command post to facilitate the operational coordination and exchange of information between law enforcement officers on the ground in real time.   To support national authorities in this high priority investigation, Eurojust set up in June 2020 a Joint Investigation Team with Belgium, France, the Netherlands, the United Kingdom and Europol. Eurojust further facilitated the successful cooperation of the judicial authorities of the countries involved. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Facilitation of illegal immigration is one of the priorities for the Policy Cycle.  

A total of 34 countries teamed up last week to combat organised and serious international crime originating from Southeast Europe as part of joint action days (JAD). The four-day operation supported by Europol was aimed at tackling the facilitation of illegal immigration and the trafficking of firearms and drugs, which are key priorities of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).  The operation brought together:   EU Member States: Austria, Bulgaria, Croatia, Cyprus, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Hungary, Latvia, Lithuania, Luxembourg, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.  Non-EU Member States: Albania, Bosnia & Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, Switzerland, United Kingdom, Ukraine, United States. EU Agencies: Europol, Eurojust, Frontex International and institutional partners: INTERPOL, UNODC, PCC-SEE, CCWP, PA/2019 countering serious and organised crime in the Western Balkans, SEESAC. 8838 law enforcement officers were involved in the operation and included police officers, land, sea and air border guards and customs agents. Big hit against illicit trafficking During the span of the action week, more than 390 000 individuals and 44 000 vehicles were checked at cross border locations and in suspected hotspots for criminal trafficking.  These controls and investigations have led to the following arrests in several European countries: Firearms trafficking or illegal possession of firearms: 17 Migrant smuggling or illegal immigration: 73 Drug trafficking: 37 Firearms and drug trafficking: 7 Document fraud: 12 International arrest warrant: 1 Other crimes not related to the JAD: 19 In addition, investigators seized 51 weapons of different types and 47 kilograms of a variety of drugs. Operational set up The EMPACT Firearms – led by Spanish Civil Guard (Guardia Civil) coordinated the operation with the support of Europol.  The framework for the JAD consisted of databases crosschecking to help advance investigations, operational analysis, the exchange of information and real time communication and checks. During the course of the operation, Europol set up a virtual coordination centre to enable daily briefings and support the exchange of intelligence among the participants.   Throughout the action days, law enforcement intensified surveillance and controls at selected border-crossing points. The high-risk areas were identified following an upstream work of information gathering and analysis between national law enforcement authorities, Europol and the institutional partners. Several countries also carried out inland criminal investigations and activities in relation to the trafficking of weapons and explosives.  Commenting on this operation, the Lieutenant of Guardia Civil, Pedro García Vazquez said: As action leader for this international JAD implemented in the framework of the EU Policy Cycle/EMPACT operation, Spain and of course my agency Guardia Civil is tremendously pleased with the results achieved. Law enforcement agencies are prepared to fight organised crime internationally by conducting high impact operations, despite the global COVID-19 pandemic, and citizens can be confident that we continue to pursue and innovate in criminal investigations.  This operation shows the results we achieve when national law enforcement authorities across Europe, EU agencies such as Europol and Frontex, and international agencies such as INTERPOL and the United Nations work together. The Head of Europol’s Serious Organised Crime Centre, Jari Liukku, added: “Criminals from the South East Europe region are increasingly expanding their network of influence. Europol is committed to working closely with this region and supporting an international coordinated and mutually supportive approach for tackling serious and organised crime. This operation is an outstanding success and exemplifies this strong law enforcement cooperation.” * This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence. In 2010 the European Union set up a four-year Policy Cycle to ensure greater continuity in the fight against serious international and organised crime. In 2017 the Council of the EU decided to continue the EU Policy Cycle for the 2018 - 2021 period. It aims to tackle the most significant threats posed by organised and serious international crime to the EU. This is achieved by improving and strengthening cooperation between the relevant services of EU Member States, institutions and agencies, as well as non-EU countries and organisations, including the private sector where relevant. Drug trafficking, illicit firearms trafficking and facilitation of illegal immigration are one of the priorities for the Policy Cycle.  

A joint operation between Estonia, Lithuania and Romania, supported by Europol and Eurojust, led to the dismantling of an organised crime group involved in fraud, phishing and money laundering. On the action day, officers from the Romanian Police (Poliția Română) searched four houses and arrested three individuals. Further investigations into the scale of the activity are still ongoing. Almost 600 victims of the phishing attacks The criminal organisation launched phishing attacks via text messages and emails impersonating legitimate banking institutions. The messages contained links to fake banking websites, through which the suspects created either new Smart ID accounts or collected bank account credentials and passwords from their victims. The criminal group used these credentials to make unauthorised wire transfers to several bank accounts they controlled in various EU countries.  The investigation has so far uncovered that the criminal network stole more than €200 000 from almost 600 victims, 500 from Estonia and 100 from Lithuania. The damages could have been higher had it not been for Estonian and Lithuanian banks flagging suspicious transfers of almost €450 000 in total. The current examination of the evidence points towards a larger scale of criminal activity with possible victims also in other countries. Europol supported the operation by facilitating information exchange and providing analytical support. On the action day, Europol deployed an expert to Romania to cross-check in real-time operational information against Europol’s databases and provide leads to investigators in the field. Eurojust facilitated the cooperation between the judicial authorities involved in the case and in 2019 set up a Joint Investigation Team between Estonia, Lithuania, Romania and Europol.

Europe-wide operation Aphrodite has brought together 21 countries* to target counterfeit goods trafficking. The eight-month operation was co-led by the Italian Finance Corps (Guardia di Finanza) and the Irish National Police (An Garda Síochána) with support from Europol. From December 2019 to July 2020, law enforcement authorities tracked online sales of a large variety of counterfeit items, culminating in checks in warehouses, shops and marketplaces in Belgium, Cyprus, Greece, Ireland, Italy, Portugal, Romania and Spain.  Law enforcement find fake COVID-19 medical equipment among the seizures The operation led to 123 social media accounts and 36 websites selling counterfeit products to be taken down. During the operation, law enforcement authorities seized nearly 28 million illegal and counterfeit goods among which were 800 000 counterfeit items of clothing, sportswear, footwear, personal accessories, IPTV set-top boxes and toys. Ten people were arrested in Greece and 37 others were reported to the judicial authorities in Greece, Italy and Portugal. More than €700 000 was also seized.  The COVID-19 outbreak led the involved authorities to adapt the initial scope of the operation to focus on issues triggered by the pandemic. As a result, counterfeit and not compliant medical equipment was also seized, including 27 million medical facemasks, by the Italian Finance Corps (Guarda di Finanza). Fake goods hidden behind online deals  Digital platforms, such as websites, social media and instant messaging services are abused by criminal groups to sell often harmful counterfeit products. Illegal vendors advertise counterfeit goods with pictures and prices of fake products on social media. They also use hidden links in posts on social media to redirect users to marketplaces located outside of the EU. Offers for counterfeit goods also grew on e-commerce platforms and subsequently, their share of the market increased.  Criminals invite unsuspecting buyers to pay with prepaid cards, by wire transfer or other forms of electronic payment and web-based services as the goods are delivered through legal couriers. The COVID-19 pandemic intensified the sale of counterfeit goods on the physical market too.   Europol’s Intellectual Property Crime Coordinated Coalition (IPC3) coordinated the operation and collected the results and detected existing links between the individuals involved.  Europol’s IPC3 facilitated the information exchange and provided technical and analytical support to the participating countries.  Europol’s IPC3 is co-funded by EUIPO (European Union Intellectual Property Office) to combat intellectual property crime.  Participating countries: *Austria, Belgium, Bulgaria, Cyprus, Czechia, Denmark, France, Greece, Hungary, Iceland, Ireland, Italy, Lithuania, Malta, Moldova, the Netherlands, Portugal, Romania, Spain, Ukraine, United Kingdom

Today, the Polish authorities are announcing the arrest of 4 suspected hackers as part of a coordinated strike against cybercrime. Those arrested are believed to be among the most active cybercriminals in the country.   This operation was carried out by the Polish Police Centre Bureau of Investigation (Centralne Biuro Śledecze Policji) under the supervision of the Regional Prosecutor’s Office in Warsaw (Prokuratura Regionalna w Warszawie), together with the cybercrime departments of provincial police headquarters and Europol. These 4 suspects are believed to be involved in a wide variety of cybercrimes, including:  Malware distribution: investigators established that two of the suspects were involved in the distribution of malware, such as Remote Access Tools (RAT) and mobile malware. The malware was distributed through phishing emails impersonating government institutions. Over 1 000 people across Poland are believed to have fallen victim to this particular scam. SIM swapping: The criminals stole personal data, including bank account credentials, from computers and phones infected with malware previously deployed on victims’ devices. They would then use the stolen data to dupe the victims’ mobile phone operators into porting the victims’ phone numbers to other SIM cards in the possession of these individuals. From that moment on, the criminals would receive all incoming calls and text messages, including one-time banking passwords which they used to transfer money out of the victims’ bank accounts into the accounts of money mules or cryptocurrency exchange platforms. Using such a technique, the criminals were able to steal over €147 000 (PLN 662 000) from their victims’ bank accounts. E-commerce fraud: one of the criminals under investigation was also running 50 fake online shops and is believed to have defrauded approximately 10,000 people. A number of these fake e-commerce websites were also used to distribute malware.  Two of those arrested were also behind a series of bomb threats sent to kindergartens across the country, prompting the evacuation of 13 350 people.  Europol’s European Cybercrime Centre (EC3) supported the Polish authorities with operational analysis in order to identify the main targets and inform the overall strategy.

Today, a coalition of law enforcement agencies across the world announced the results of a coordinated operation known as DisrupTor which targeted vendors and buyers of illicit goods on the dark web. This operation follows the takedown in May of last year of Wall Street Market, the world’s then second largest illegal online market in the dark web. Led by the German Federal Criminal Police (Bundeskriminalamt) with the support of the Dutch National Police (Politie) Europol, Eurojust and various US government agencies, this takedown provided investigators with quantitative data and materials to identify suspects behind dark web accounts used for illegal activity.  As a result, 179 vendors who engaged in tens of thousands of sales of illicit good were arrested across Europe and the United States. Over $6.5 million were seized in both cash and virtual currencies, alongside some 500 kilograms of drugs, including fentanyl, oxycodone, hydrocodone, methamphetamine, heroin, cocaine, ecstasy, MDMA, and medicine containing addictive substances; and 64 firearms. The arrests were carried out in the United States (121), Germany (42), the Netherlands (8), United Kingdom (4), Austria (3), and Sweden (1). A number of investigations are still ongoing to identify the individuals behind dark web accounts.    A COLLABORATIVE EFFORT TO TACKLE THE DARK WEB Operation DisrupTor was composed of a series of separate but complementary joint operations coordinated by Europol and Eurojust, all aimed at making a global impact on the sale of illicit goods on the dark web. This operation was the result of a collaborative effort between the law enforcement and judicial authorities of Austria, Cyprus, Germany, the Netherlands, Sweden, Australia, Canada, the United Kingdom and the United States.  Commenting on this operation, the Head of Europol’s European Cybercrime Centre (EC3), Edvardas Šileris, said: Law enforcement is most effective when working together, and today’s announcement sends a strong message to criminals selling or buying illicit goods on the dark web: the hidden internet is no longer hidden, and your anonymous activity is not anonymous. Law enforcement is committed to tracking down criminals, no matter where they operate – be it on the streets or behind a computer screen. THE DARK WEB IS NO FAIRY TALE  The golden age of dark web marketplace is over. Operations such as these highlight the capability of law enforcement to counter encryption and anonymity of dark web market places. Police no longer only takes down such illegal marketplaces – they also chase down the criminals buying and selling illegal goods through such sites. Thinking of buying illegal goods anonymously on the dark web? These are the dangers you are exposed to: Putting your life in danger: dangerous illegal drugs such as fentanyl or counterfeit substances could kill you.  Become a victim of cyber scammers who are only after your money. Exposing your device to damaging malware. Law enforcement can also trace back illicit transactions to both the buyer and seller. An individual who purchased illicit goods from hidden sites is at risk of prosecution in a number of countries.  The dark web is not a fairy tale - vendors and buyers are no longer hidden in the shadow.   The following authorities took part in this operation: Austria: Federal Investigation Bureau (Bundeskriminalamt) Cyprus: Cyprus Police (Αστυνομία Κύπρου) Germany: Federal Criminal Police Office (Bundeskriminalamt), State Criminal Police Offices (Landeskriminalämter), the competent local police forces and Customs Investigation Offices (Zollfahndungsämter) The Netherlands: National Police (Politie), Royal Netherlands Marechaussee (Koninklijke Marechaussee)  Sweden: National Police (Polisen) Australia: Western Australia Police Force, Australian Criminal Intelligence Commission Canada: Royal Canadian Mounted Police United Kingdom: National Crime Agency; Dark Web Intelligence, Collection and Exploitation (DICE) United States: Department of Justice (DOJ), Federal Bureau of Investigation (FBI), Immigration and Customs Enforcement – Homeland Security Investigations (HSI), Drug Enforcement Administration (DEA), US Postal Inspection Service (USPIS), Customs and Border Protection (CBP), Financial Crimes Enforcement Network (FinCEN), Bureau of Alcohol, Tobacco, and Firearms (ATF), Naval Criminal Investigative Service (NCIS) and Department of Defense (DOD)

On Tuesday 15 September, Italian State Police (Polizia di Stato Servizio Centrale Operativo) and Belgian Federal Police (Federale Politie/Police Fédérale) supported by Europol, arrested eight individuals (all Italian nationals, three of whom lived in Belgium) with known ties to the Italian crime syndicate Cosa Nostra. They are suspected of mafia association, attempted murders and trafficking drugs and weapons. This operation puts an end to an infamous and deadly mafia feud that had been going on among alleged members of the Cosa Nostra in Belgium (Liège and Maasmechelen) and Italy (Favara in Sicily) between 2015 and 2018. The violence that arose from this clan war was most likely related to cocaine trafficking disputes. During the joint raid, more than 160 police officers including members of the Belgium Special Weapons and Tactics team, helicopters and police dogs were deployed. The armed suspects and the four firearms found during the house searches (one in Belgium and three in Sicily) hinted to investigators that the feud was likely still ongoing.  Europol supported the investigation by facilitating the information exchange and providing analytical support and operational coordination.  This case was also supported by the EU’s ISF ONNET project (Internal Security Funds), led by the Italian Anti-mafia Directorate (DIA, Direzione Investigativa Antimafia), which provides financial and operational support to tackle all types of organised crime groups.  

The Polish National Police (Policja), supported by Europol, dismantled an organised criminal group involved in the trafficking of counterfeit medicines and money laundering.  On 8 September 2020, law enforcement officers raided 11 locations and arrested 10 suspects, all Polish citizens, including the alleged leader of the group. The seizure included 23 000 pills with an estimated value of €112 000, €16 000 in cash, two luxury cars, properties worth about half a million euros, a gas weapon and specialised cryptocurrency devices. The investigation uncovered that the criminal group, which had been active since 2016, was selling counterfeit erectile dysfunction drugs online. The investigators estimate that the suspects made at least €260 000 in profit, which was then laundered through virtual currencies. Europol facilitated the information exchange and provided analytical support. On the action day, Europol deployed three experts to Poland to cross-check operational information in real-time against Europol’s databases and provided technical support to extract data from the suspects’ mobile phones.  Money laundering and counterfeiting fall under the remit of the European Financial and Economic Crime Centre at Europol. Europol’s new centre increases synergies between economic and financial investigations and strengthens Europol’s ability to support law enforcement authorities in combating this major criminal threat.