Crime News

As consumers prepare for year-end festivities, many are looking for great deals. But a new report from Europol and the European Union Intellectual Property Office (EUIPO) is warning that scammers and organised crime networks use legal entities and loopholes to avoid detection by authorities, and profit from consumers’ appetite for low prices with fake products.The report, 'Uncovering the Ecosystem of Intellectual Property Crime: A Focus on Enablers’, sheds light on the sophisticated methods employed by scammers and organised crime groups to commit intellectual property (IP) crime and exploit consumer behaviours. It underlines the extensive impact of IP crime on broader society, driven by counterfeit goods and pirated content.According to the report, approximately 86 million fake items were seized in the EU in 2022 alone, with an estimated total value exceeding EUR 2 billion. The study emphasises that while consumers are drawn to low-priced goods, their decisions inadvertently support a range of other serious crimes, including cybercrime, money laundering and even environmental crime.João Negrão, Executive Director of the EUIPO, stresses the importance of consumer awareness:"When consumers opt for counterfeit products or are misled into buying fakes, they are not only receiving substandard goods but are also contributing to a shadow economy that undermines legitimate businesses and fuels other criminal activities. It's essential to understand the real cost of counterfeit goods – a cost that extends beyond the price tag and impacts our society's well-being."Consumers’ health and safety are jeopardised as sub-standard or falsified pharmaceuticals emerge from hazardous clandestine laboratories, exposing workers and the public to harmful substances. Moreover, the digital domain has become a battleground, with cybercriminals crafting sophisticated fake web shops that not only sell counterfeit goods but also harvest consumers' sensitive payment information, further entangling IP crime with cybercrime.Catherine De Bolle, Executive Director of Europol, adds:"Organised crime groups are continuously innovating to exploit consumer demand for counterfeit and pirated goods. They are not only selling fake products but are also stealing personal data and exposing consumers to dangerous products. It's a double-edged sword where consumers are victims and, unknowingly, enablers of these criminal networks."Overall, the report highlights the increasing sophistication of IP criminals. Organised crime networks stretch beyond borders, engaging in the import, export and production of counterfeit goods, the majority of which are produced in China, including Hong Kong, and Türkiye.The actors in these operations are no amateurs, according to the report, availing of legal structures at all stages of IP crime, and selecting jurisdictions where it’s difficult for EU law enforcement to shut them down or where penalties are low. In many cases, fake goods are produced outside of the EU and then finalised with tags, fake logos and packaging at sites in Europe.Experts convene at Intellectual Property Crime ConferenceThis new joint EUIPO-Europol report was a focus in the IP crime conference organised in Madrid on 24-25 October 2024 by the EUIPO, Europol and the Spanish Guardia Civil. The event, titled “Follow the Money to Fight IP Crime,” gathered over 240 delegates from law enforcement agencies, government bodies, and private sector representatives across the globe to discuss innovative strategies to combat intellectual property crime (IPC) and its related financial crime implications.The conference underlined the necessity of a multi-sector approach to fighting IPC, focusing on financial tracing and public-private partnerships. Discussions emphasized knowledge-sharing, enhancing investigative capacity, and collaborative asset recovery practices. In addition, Europol and EUIPO representatives reinforced the role of the private sector in supporting law enforcement through data sharing and training. A panel was dedicated to the role of social media influencers, focusing on their impact on counterfeit purchasing behaviours and underscored the importance of awareness campaigns.As a closing highlight, the host country, Bulgaria, for the 2025 Europol/EUIPO IPC Conference was announced, promising further international commitment to combating IP crime through collective innovation and resilience.For more information about the 2024 Europol Intellectual Property Crime Conference, visit the event page. 

Using overcrowded boats, the suspects willingly put the lives and safety of the migrants at risk. After crossing the river, the migrants were clandestinely transported in various types of vehicles. Hiding them in passenger cars or the cargo areas of transport vehicles, the criminals would move the migrants towards Slovenia, Italy, Germany, and other EU countries. It is estimated that the criminals earned at least EUR 80 000 from these activities.Results of the action day conducted simultaneously in Slavonski Brod in Croatia and Brod in Bosnia and Herzegovina include:Croatia:11 arrests10 house searches10 vehicle searchesOne gas pistolBank cards, 38 mobile phones, 5 tablet computersA reflective vest with the inscription “Police” and an electronic toll device for the use on highwaysBosnia and Herzegovina:5 arrests5 house searchesEUR 1,500 in cashEuropol’s supportAt the request of the involved partners, Europol provided on-the-spot support by deploying specialists based in Ogulin, Croatia, to the raids in Slavonski Brod, where they performed cross-checks for persons, phone numbers and other information. Europol’s experts also supported the action day remotely from the Agency’s Headquarters in The Hague, providing analytical support in real time.This operation was conducted under the framework of an Operational Task Force (OTF) established in March 2023. It involves law enforcement authorities from Croatia, Slovenia, and Bosnia and Herzegovina, and focuses on migrant smuggling organised criminal networks active on the Western Balkans route. Europol has been supporting this OTF and its members through analytical and operational support as well as financial support. Relying on Europol’s Secure Information Exchange Network Application, the involved authorities can communicate securely with each other.Participating law enforcement authorities:Croatia:Criminal Police of Brodsko-posavska County Administration (Službenici kriminalističke policije Policijske uprave Brodsko-posavske)National Police Office (PNUSKOK) (Nacionalni policijski ured za suzbijanje korupcije i organiziranog kriminaliteta)State Attorney’s Office for the Suppression of Corruption and Organised Crime (Državno odvjetništvo, Ured za suzbijanje korupcije i organiziranog kriminaliteta (USKOK))Bosnia and Herzegovina:SIPA - State Investigation and Protection Agency (SIPA - Državna agencija za istrage i zaštitu)

The Polish Border Guard, supported by Europol, has successfully targeted a large criminal network smuggling migrants from Belarus and Russia into the EU. The investigation was conducted within the framework of a Europol Operational Task Force, made up of authorities from Austria, Czechia, Germany, Hungary, Lithuania, Poland, Slovakia, and Ukraine. A Europol expert supported the operation on the ground in Poland.The action days between 14 and 16 October led to:11 arrests of mainly Polish, Russian and Ukrainian nationals,11 locations searched,Seizures including electronic equipment and around PLN 80 000 in cash.Over EUR 5 000 to reach the EU with a stopover in Russia and BelarusThe investigation uncovered a criminal network composed of both Polish and non-EU nationals (from Ukraine, Belarus, Russia, and Georgia) residing in Poland and other European countries. The non-EU nationals often acted as drivers, as they typically charge less for their services than EU nationals. Migrants (mainly originating from Afghanistan, Egypt, Iran, Iraq, Syria and Egypt) would transport themselves legally to Belarus, either directly or via Russia. Members of the smuggling network would then transport the migrants to the Polish-Belarusian border, which they crossed illegally. The migrants would be picked up in Poland by other members of the network and smuggled to other EU countries - mainly to Germany - by car.The smuggling network is linked to smuggling incidents concerning around 600 illegal migrants. The criminal network charged smuggling fees of about EUR 5 000 per person, sometimes in cryptocurrency. Migrants each had to pay a further EUR 500 to the drivers in Poland for transporting them to their final destination in Western Europe.The investigation revealed that most of the suspects were involved in recruiting drivers in Poland to transport migrants from the Belarusian border to the German border. One example involved a Russian citizen, who officially ran a car rental business in Poland, but was actually recruiting drivers and providing vehicles for transporting irregular migrants to countries throughout the EU.Dedicated Europol Task ForceIn the past two years, national authorities have identified an intensification of migrant smuggling activities along the Belarus-Lithuania, Latvia, and Poland route, as well as across the so-called Balkan Route. In response to this shift in the criminal landscape, Europol established an Operational Task Force in March 2024, in collaboration with Austria, Czechia, Germany, Hungary, Lithuania, Poland, Slovakia, and Ukraine. The information exchanged within this Task Force, facilitated by Europol, revealed the dynamic operations of criminal networks active in the region. Europol's experts analysed this information, and the international exchange helped clarify the structure of the criminal landscape.The smuggling networks operating in the region consist of members of various nationalities, positioned at different levels of the criminal hierarchy. Some act as drivers for cars used to transport migrants, others are responsible for collecting smuggling fees, and others recruit drivers. At the top, High-Value Targets oversee and organise the overall smuggling operations. 

OPSON XIII results:11 criminal networks dismantled,104 arrest warrants issued,184 search warrants issued,278 persons reported to judicial authorities,5 821 checks and inspections performed.In total, goods valued at over EUR 91 million were taken off the market.Food fraud, the counterfeiting of food and beverages, and the abuse of geographical indications constitutes a significant and serious crime area which needs to be tackled on an international level. Operation OPSON’s goal is to protect public health and safety and to ultimately dismantle the organised criminal networks involved. Europol and all of the involved partners fight on all fronts against this crime area, which includes activities in physical as well as online markets – such as e-commerce platforms - and the complete food supply chain from raw materials to final product.This year’s food crime trendsInvestigators across Europe noticed a continued trend in fraudsters selling expired food. Infiltrating waste disposal companies, they get their hands on masses of expired food that should be destroyed. After simply erasing and re-printing the expiration dates or printing and attaching new labels, they re-introduce the expired products into the supply chain. As far as counterfeit and wrongly designated foods are concerned, olive oil and wines featuring a protected designation of origin (PDO) are the most affected types of products.Highlights from across EuropeThe Spanish Guardia Civil, in collaboration with the Italian Carabinieri and Europol, arrested four persons and seized about 120 000 cans of tuna as well as 45 000 litres of oil. The detained owners of a canning company in La Rioja (Logroño) prepared the canned products with tuna of lower quality than indicated on the label, as well as with sunflower oil or pomace labelled as olive oil, thus managing to market the products at prices much lower than their competitors.Across Spain, the Guardia Civil took action against counterfeiters of products such as oil, ham, or cheese. In Valencia, a pickle production company was investigated for selling products unfit for consumption due to the addition of illegal dyes and preservatives. 80 tonnes of product, much of which was ready for sale and consumption, were seized.The Italian Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri, NAS) in collaboration with other authorities identified and seized approximately 42 tonnes of adulterated oil. The product, marketed as Italian extra virgin olive oil, was either ready for distribution, or - in some cases – had already entered the market. Officers seized searched various locations such as warehouses and also seized 71 tonnes of oily substances, contained in plastic tubs and cans of various sizes as well as 623 litres of chlorophyll used for the adulteration of oils. The total value of the seized items, which includes packaging equipment, labels, a transport vehicle, forklifts, and electronics amounting to EUR 900 000.Also in Italy, the Carabinieri dismantled a criminal network dedicated to counterfeiting wines with a protected designation of origin (PDO) or protected geographic indication (PGI). The criminals falsified electronic cellar registers of a wine quality certification body to mislabel wines with a DOC certificate. As a result of this investigation, around 60 000 litres of counterfeit wine were seized.As reported by Europol before, an investigation led by the French Gendarmerie (Gendarmerie Nationale), involving the Italian Carabinieri and Swiss Federal Police (Police Federale Swiss), supported by Europol and Eurojust, has led to the dismantling of a criminal network counterfeiting French Protected Designation of Origin (PDO) wines in Italy. The criminal network faked French red wine, charging up to EUR 15 000 per bottle. The fake wine was forged in Italy, then delivered to an Italian airport and exported for sale at market value all over the world by honest wine traders. The operation led to six arrests and seizures valued at EUR 1.4 million, as well as over EUR 100 000 in cash and documents. 

To help us determine the best entry out of many stunning submissions to this year's photo competition, we are asking you to take a look and vote for your favourite.There will be three winning photos this year. One winning submission will be selected by the international law enforcement community represented in the Europol Headquarters in The Hague. Another winner will be decided by the Heads of Communication of Europe’s law enforcement agencies. For the final winner, we need your help! Browse the photos and vote for your favourite one via the survey below:https://ec.europa.eu/eusurvey/runner/Photo2024

The two main drugs that were trafficked need to be prescribed by medical professionals and are intended to manage panic and anxiety disorders. As these types of prescription drugs can cause disinhibition, euphoria, and relieve anxiety, they are often misused for recreational purposes. Leading up to the action day, the involved authorities had already arrested several suspects and seized more than two million trafficked pills consisting of two different prescription drugs. The large number of trafficked medicines, which are consumed without medical supervision, could have a significant impact on public health.Coordinated by Europol, investigators from the involved countries analysed the intelligence that had been collected and identified the members of the criminal network involved in this case. Several accomplices were specialised in financing, organising and personally handling the shipments. Helped by Serbian members of the criminal network, other suspects sourced large quantities of psychotropic tablets from Serbia and clandestinely trafficked them to Romania. From there, the pills were concealed in various ways and transported by Romanian drug mules to Estonia, Finland, or Norway. As a last step, Romanian nationals then peddled the tablets on the street.Europol’s roleItems seized during the operation include: large quantities of pills, cash, mobile phones, firearms, and luxury cars. In Romania, two houses have been seized. Eurojust, Europol and the involved countries joined forces in a joint investigation team (JIT) in order to dismantle the criminal network. Europol facilitated the overall operation by liaising with the operating authorities, processing the available data and deploying two specialists with mobile offices to support the action day. Eurojust set up a JIT and supported the investigation by ensuring that European Investigation Orders were executed.Participating authorities: Estonia:Northern District Prosecutor’s Office (Põhja Ringkonnaprokuratuur)Police (Politsei- ja Piirivalveamet - Põhja prefektuuri kriminaalbüroo, narko- ja organiseeritud kuritegude talitus)Finland: Customs (Tulli / Tullen)National Prosecution Authority, Prosecution District of Southern Finland (Syyttäjälaitos, Etelä-Suomen syyttäjäalue / Åklagarmyndigheten, Södra Finlands åklagardistrikt)Police, Helsinki Police Department (Poliisi, Helsingin poliisilaitos / Polisen, Polisinrättningen i Helsingfors)Romania:Central Intelligence Analysis Unit of the Romanian Police (Unitatea Centrală de Analiză a Informațiilor – IGPR)Directorate for Investigation of Organised Crime and Terrorism – Oradea Territorial Office, General Inspectorate of the Romanian Police (Direcția de Combatere a Criminalității Organizate și Terorism - Biroul Teritorial Oradea – IGPR)Directorate for Combating Organised Crime (Direcția de Combatere a Criminalității Organizate)Department for Special Operations (Direcția de Operațiuni Speciale)General Directorate of Internal Protection (Direcția Generală de Protecție Internă)General Inspectorate for Border Police – Bors, Nadlac and Petea Offices (Inspectoratul General al Poliției de Frontiera - Punctele de Trecere Frontiera Borș, Nădlac și Petea)Prosecution Office attached to the High Court of Cassation and Justice (Parchetul de pe lângă Înalta Curte de Casatie si Justiție)Serbia:Criminal Investigations Diectorate (Uprava kriminalističke policije)Department for Combating Organised Drug Smuggling (Odeljenje za suzbijanje organizovanog krijumčarenja droga, Одељење за сузбијање организованог кријумчарења дрога)Public Prosecutor's Office for Organised Crime (Javno tužlaštvo za organizovani criminal, Јавно тужилаштво за организовани криминал)

European Cybercrime ConferenceHeld from 16 to 17 October, Europol’s European Cybercrime Conference provided a platform for discussing the latest trends and challenges in cybercrime.More than 460 participants from 82 countries attended, including law enforcement officials, cybersecurity experts, and industry representatives, all focused on bolstering Europe’s security and resilience in the face of growing cyber threats.This year’s conference featured five key thematic blocks:Impactful operations: Showcasing recent international law enforcement operations, this block highlighted the detection, investigation, and disruption methods employed to tackle cybercrime.Accessing data for early disruption: This block explored opportunities for accessing data and examined the legal, political, and technical obstacles that impact the timely detection, investigation, and disruption of cyber threats.Future cybercrime challenges: Focused on anticipating upcoming challenges in the cybercrime landscape, this block emphasised the need to stay ahead of evolving threats and proposed potential solutions.J-CAT’s 10 years of operational achievements: In celebration of the J-CAT’s 10th anniversary, this block reflected on the taskforce’s creation, key early cases, current priorities, and future direction.Leveraging technology for successful investigations: The final block examined how emerging technologies, such as artificial intelligence, can be leveraged in the fight against cybercrime.10 years of the J-CAT: a decade of progressA key highlight of the Cybercrime Week was the celebration of the 10th anniversary of the Joint Cybercrime Action Taskforce (J-CAT).Established at Europol in 2014, the J-CAT has been instrumental in fostering international cooperation on complex cybercrime cases.The taskforce enables cyber liaison officers from multiple countries to work closely with Europol’s specialists, ensuring swift and coordinated responses to cyber threats.The J-CAT has grown into the largest global model for international law enforcement collaboration in tackling cybercrime. It now hosts 24 law enforcement agencies representing 20 countries in one place at Europol, enabling real-time information sharing and coordination between its member countries on priority cybercrime cases.Over the past decade, the J-CAT has been instrumental in numerous high-profile operations, such as Operation Cronos, Operation EndGame, Operation PowerOFF and Operation Fifth Element.This milestone anniversary offered an opportunity to reflect on the taskforce’s achievements and chart its future and priorities.Learn more about the J-CAT's most successful operations over the past ten years or follow #JCATanniversary on social media.

Europol coordinated the European dimension of the investigation, working closely with law enforcement agencies across Europe to identify victims and suspects, ensuring swift action in multiple jurisdictions.Victims of the attacks include sensitive government and critical infrastructure targets around the world, including the U.S. Department of Justice, the U.S. Department of Defense, the Federal Bureau of Investigation, the U.S. State Department and organisations and governments in Europe. Victims also included major technology platforms and network service providers in the USA.Anonymous Sudan’s DDoS tool was used to launch over 35 000 DDoS attacks in approximately one year, causing more than USD 10 million (EUR 9 145 000) in damages to victims in the USA alone.The European dimension of the investigationEuropol’s coordination ensured that European Member States impacted by the DDoS attacks were represented in the investigation. By facilitating cooperation between national authorities and organising coordination meetings, Europol enabled swift action and effective information-sharing across borders, which helped identify the perpetrators and supported the charges now being brought forward. Europol also provided analytical support, synthesising intelligence from various sources to create a comprehensive understanding of the DDoS network.Authorities in Sweden, Luxembourg and France, alongside the European Union Agency for Cybersecurity (ENISA) and the European Investment Bank, provided crucial intelligence which helped map out the criminal activity and associated infrastructure.These contributions were essential in supporting both Europol’s coordination efforts and the U.S. authorities.Disabling the DDoS networkLaw enforcement agencies have not only focused on the individuals behind these attacks but have also taken steps to disable the infrastructure that supported their criminal activities.Back in March 2024, the U.S. Attorney’s Office and FBI also obtained seizure warrants which authorised the FBI to seize and disable Anonymous Sudan’s powerful DDoS tool, which the group allegedly used to perform DDoS attacks, and sold as a service to other criminal actors.Specifically, the warrants authorised the seizures of computer servers that launched and controlled the DDoS attacks, computer servers that relayed attack commands to a broader network of attack computers, and accounts containing the source code for the DDoS tools used by Anonymous Sudan.A unified international response to DDoSThese law enforcement actions took place as part of Operation PowerOFF, an ongoing, coordinated effort among international law enforcement agencies aimed at dismantling criminal DDoS-for-hire infrastructure worldwide, and holding the administrators and users of these illegal services accountable.In Europe, law enforcement authorities in France, Luxembourg and Sweden took part in the investigation.In the United States, the Federal Bureau of Investigation (FBI), the Defense Criminal Investigative Service, State Department, and the U.S. Attorney’s Office for the Central District of California took part.

As part of an action day conducted in several locations across the Netherlands, France, and Germany, law enforcement also searched car rental companies whose vehicles had been used to flee crime scenes. This particular criminal network was one of the first to use locations in France as hideaway spots and rely on getaway cars rented from a French rental company. These raids led to extensive evidence being secured, thus facilitating the investigations into wider members, logisticians and supporters of the arrested suspects.Unscrupulous attacks with severe collateral damageFor several years now, perpetrators have increasingly been using solid explosives - originating mainly from fireworks - to blow up ATMs. This has significantly augmented the danger and collateral damage of their attacks. The criminals, who are often based in the Netherlands, take extreme risks and act unscrupulously, both at the crime scene and when escaping in high-powered vehicles. As they are often carried out in residential areas, explosive attacks on cash machines and subsequent high-speed escapes can cause serious harm to buildings and residents.To fight this phenomenon, law enforcement agencies from the affected countries are continuously expanding their cross-border collaboration. For this particular operation, Europol brought Dutch, French, and German investigators together to work on an intelligence picture and to plan the coordinated action day. One Europol specialist with a mobile office was deployed to the coordination centre in order to cross-check the operational reslts against Europol’s databases.Participating authorities:France:National Gendarmerie - Central Office for Fighting against Mobile Organised Criminal Groups (Gendarmerie Nationale - L'Office central de lutte contre la délinquance itinérante (OCLDI)Germany:Bundeskriminalamt Wiesbaden (Federal Criminal Police Office)Bamberg Public Prosecutor's Office (Staatsanwaltschaft Bamberg)Bavarian Police (Polizei Bayern)Bavarian State Criminal Police Office (Bayerisches LandeskriminalamtCriminal Police Düsseldorf (Kriminalpolizei Düsseldorf)Frankfurt am Main Public Prosecutor General's Office (Generalstaatsanwaltschaft Frankfurt)Mainz Public Prosecutor's Office (Staatsanwaltschaft Mainz)Police North Rhine-Westphalia (Polizei Nordrhein-Westfalen)Polizei Saxony-Anhalt (Polizei Sachsen-Anhalt)State Criminal Police Office Rhineland-Palatinate (Landeskriminalamt Rheinland-Pfalz)Netherlands:International Cooperation Team of the Public Prosecutor Amsterdam (Internationale Rechtshulp Centra (IRC) Amsterdam)International Cooperation Team of the Public Prosecutor North-Holland (Internationale Rechtshulp Centra (IRC) Noord- Holland)Police Noord-Holland (Politie Noord-Holland) 

The individual was identified after Europol provided crucial intelligence, developed through its ongoing work in analysing encrypted communication platforms frequently used by organised crime groups.The plot was orchestrated by the head of an organised crime group, who played a key role in recruiting the contract killer and coordinating the logistics of the assassination. The leader of the criminal group organised the killer's escape plan, recruited two additional suspects to conduct surveillance on the intended victim, and procured the weapon used for the assassination, which was brought into Serbia specifically for the attack.The victim was killed in Belgrade in 2021. The shooter, who pretended to be an elderly man wearing a silicone mask and walking with a limp, shot the victim in the head as he passed him by.The contract killer was arrested as a result of the action day, together with the organiser and the two accomplices.Europol’s roleEuropol’s involvement in the operation focused on intelligence development and operational support. Its experts worked with the Serbian authorities to decode the suspect’s communications, providing intelligence that led to his identification. Serbian police officers were deployed to Europol’s headquarters in The Hague for this purpose.On the day of the action, Europol deployed a specialised team to Belgrade to assist the national authorities with their enforcement action.   

On 14 October, an investigation led by the French Gendarmerie (Gendarmerie Nationale), involving the Italian Carabinieri Corps (NAS Carabinieri) and Swiss Federal Police (Police Federale Swiss), supported by Europol and Eurojust, has led to the dismantling of a criminal network counterfeiting French Protected Designation of Origin (PDO) wines in Italy. The criminal network faked French red wine, charging up to EUR 15 000 per bottle. The fake wine was forged in Italy, then delivered to an Italian airport and exported for sale at market value all over the world by honest wine traders.The operation led to:6 arrests (one High Value Target);14 location searches in Torino and MilanoSeizures including: large amount of wine bottles from different counterfeited Grand Cru domains, wine stickers and wax products, ingredients to refill wine, technical machines to recap bottles, luxurious goods, and electronic equipment valued at EUR 1.4 million, over EUR 100 000 in cash and documents.The modus operandi of the criminal network, combined with the characteristics of the counterfeits, led investigators to establish a link with a previous investigation supported by Europol targeting the counterfeiting of PDO wine. Forensic operations carried out on these high-value items revealed the techniques the criminal network used to counterfeit the high-quality French wine.Connections between the two investigations were also found while looking into the manufacturers of caps and capsules, and the label printers. This investigation, which had been closed in 2015, involved a Russian national who was also connected to this investigation. Further investigations uncovered commercial transactions carried out between Italy and Switzerland. Other bottles with similar signs of counterfeiting were subsequently discovered.In 2014, a latent trace was discovered on the back of a label, which uncovered a connection to an individual already known to the authorities from a similar previous case. The investigation into an international network counterfeiting luxurious wines led to the arrest of a Russian individual associated with two winemakers, Italian nationals. However, since 2019, new counterfeits have appeared in Europe, specifically in the Swiss and Italian markets. Investigations which were carried out showed that the old fake bottles were still being sold, alongside new ones with copies of the new security features. The investigative leads and the international information exchange through Europol allowed the French Gendarmerie unit in charge of the case to identify this new distribution route of fake bottles using the Grand Cru domains  identity.Europol support and joint actionsEuropol has supported the investigation since 2021, coordinating operational activities, facilitating the exchange of information, and providing analytical support. On the action day, Europol deployed two experts on the spot to cross-check operational information against Europol’s databases to provide national authorities with further investigative leads.Eurojust supported the collaboration between French and Italian judicial authorities and ensured the execution of European Investigation Orders in Italy.The following authorities took part in this action:   France - French Gendarmerie (Gendarmerie Nationale), Court of Dijon – Gendarmerie Nationale (SR Dijon)Italy - Italian Carabinieri Corps (NAS Carabinieri), Public Prosecutors Office Turin; Public Prosecutors Office MilanSwitzerland - State police Geneva (Police cantonale de Genève), State Police Zug (Kantonapolizei Zug), Federal Office for Customs and Border Security (FOCBS), Swiss Federal Police (fedpol)The list of authorities was amended on the 15th of October.  

Europol worked closely with Latvian partners to identify and track the criminal network responsible for the production and distribution of synthetic substances, including synthetic cathinones and other high-risk drugs.The operation, which culminated in coordinated raids across Latvia in the beginning of October, resulted in the arrest of eight individuals suspected of involvement in the production. Among the arrested were key figures within the organisation.Seizures during the actionOver one tonne of finished synthetic drugs;Over 38 000 litres of various chemical liquids, including precursors and base substances for the production of synthetic drugs;Laboratory equipment and various items related to drug production;5 vehicles – 3 passenger cars and 2 lorries;Several mobile phones, SIM cards, routers, a laptop, and other items relevant to the investigation.To support the Latvian authorities, Europol deployed its tactical laboratory dismantling team to Aluksne, close to the Russian border, to assist in taking the laboratory down. There, Europol provided full operational support to quickly and accurately identify the drugs and chemicals on site. This rapid identification was essential in securing crucial evidence.Dismantling such clandestine drug laboratories is a priority for Europol in its fight against the production and distribution of illicit drugs across Europe. These clandestine facilities pose a significant threat to public safety, not only due to the harmful substances they produce, but also because of the environmental and health risks associated with their illegal operations. By targeting these laboratories, Europol and its partners aim to disrupt organised crime groups’ supply chains. This effort is a critical component of Europol's broader strategy to combat drug trafficking.

Europol and its partners are using international cooperation and technological expertise to counter these threats, working to protect vulnerable individuals and dismantle criminal networks. This joint action aimed to identify key indicators of human trafficking on online platforms, explore how legal business structures may be misused by traffickers and advance new criminal investigations.The experts also participated in workshops and training events that addressed pressing challenges such as the criminal use of social networks for organ trafficking, the use of cryptocurrencies and crypto patterns, the identification of trafficking on gaming platforms and other technical aspects of online investigations into human trafficking.Some of the results include:252 entities checked (such as platforms, persons, usernames, locations and phone numbers)40 online platforms checked (for sexual and labour exploitation and organ trafficking)16 suspected human traffickers identified60 potential victims of human trafficking identifiedModern time slavery – ‘home’ boy or girl sold for EUR 20 000During the action days, the investigators focused on gathering knowledge on how criminals use online advertisements to recruit victims and facilitate transport and accommodation. The experts identified a dark web site where hundreds of human traffickers offer a range of services involving both male and female victims of all ages. The prices vary from USD 800 to USD 2 000 an hour, based on the age and ‘skills’ of the victims. A permanent ‘home’ boy or girl is sold for between USD 20 000 and USD 60 000 on the same website.The investigators also aimed to identify platforms that may facilitate human trafficking and exploitation on a crime-as-a-service basis. Their online investigation covered the potential trafficking and exploitation of Ukrainian victims, as well as the use of lesser-known social media platforms to facilitate human trafficking. The experts identified a new phenomenon – e-pimping. This emerging trend is of increasing interest to perpetrators. The investigators detected two platforms that offer ‘lifestyle courses’ and training for men who want to become ‘OnlyFans’ managers, essentially instructing them how to become e-pimps and exploit women.Europol’s supportEuropol supported the coordination of the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed one expert to the coordination centre to facilitate the information exchange in real time and cross-check operational information against Europol’s databases. This provided the participating officers from the national law enforcement authorities with further investigative leads.27 participating countries:EU Member States: Austria, Belgium, Cyprus, Czech Republic, Finland, France, Germany (action co-leader), Hungary, Iceland, Ireland, Lithuania, Netherlands (action co-leader), Poland, Portugal, Romania, Slovakia, Slovenia, Spain, SwedenNon-EU countries: Albania, Brazil, Georgia, **Kosovo, Moldova, Serbia, Ukraine, United Kingdom (action leader)EU Agencies: Europol and Eurojust**This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.------Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.   

Up until now, glass eels were illegally fished in Europe, mainly in France, Spain and Portugal, and then shipped to Asia. In some cases, criminal groups even used mules to transport the eels. Smugglers are still using these routes. However, pressure from law enforcement has forced criminals to look for alternative routes and use Mauritania and Senegal as new countries of transit. Despite the criminals’ adaptability, police authorities managed to seize five tonnes of trafficked eels in the past few months only. Cooperation with the new transit countries on the newly identified smuggling routes is essential to combat organised criminal groups engaged in glass eel trafficking.Europol coordinates this global operation against criminal groups engaged in international glass eel trafficking every year. This year’s operational results led to a milestone in the fight against wildlife trafficking: there have now been 850 arrests and more than 87 tonnes of glass eels and elvers seized since these annual operations began.Protecting wildlife since 2016The trafficking of glass eels is a multifaceted crime, as it involves environmental crime, human health crime, trade in endangered species, document fraud, tax evasion, and also money laundering.Europol has provided support to investigations into glass eel smuggling since 2016. In its commitment to fight environmental crime, Europol created a specialised team in 2017, which has strengthened Europol’s capacity to support the fight against wildlife trafficking. From 2023-2024, Europol coordinated the operational activities of the investigation, hosted virtual command posts and facilitated the information exchange between the national law enforcement authorities involved. Europol’s investigators also provided analytical and forensic support.During the action days, Europol deployed experts to the hot spots to cross-check operational information in real time and provide leads to authorities in the field.More than 40 partners involvedSince its establishment, Europol has developed into a strong enabler that brings the relevant partners together. One of the Agency’s priorities for the upcoming years is to intensify the cooperation with the Schengen Associated Countries and other international organisations.On this occasion, Europol brought together more than 40 partners, including law enforcement from EU Member States and third countries, EU institutions and international organisations:EU Member States: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Spain, Sweden.Third countries: Brazil, Colombia, Moldova, New Zealand, North Macedonia, Norway, Switzerland, Türkiye, Ukraine, US.EU Institutions: Directorate-General for Environment, Directorate-General for Health and Food Safety, Eurojust, European Anti-Fraud Office, European Fisheries Control Agency.International organisations: IFAW, Interpol, TRAFFIC.On 24 and 25 September, Europol already participated in a coordination meeting with the main stakeholders involved in the operation to kick off the period 2024-2025 and keep up with the fight against glass eel smuggling.

LockBit full infrastructure in the crosshairs of law enforcementThese are some of the results of the third phase of Operation Cronos, a long-running collective effort of law enforcement authorities from 12 countries, Europol and Eurojust, who joined forces to effectively disrupt at all levels the criminal operations of the LockBit ransomware group. These actions follow the massive disruption of LockBit infrastructure in February 2024, as well as the large series of sanctions and operational actions that took place against LockBit administrators in May and subsequent months.Between 2021 and 2023, LockBit was the most widely employed ransomware variant globally with a notable number of victims claimed on its data leak site. Lockbit operated on the ransom as a service model. The core group sold access to affiliates and received portions of the collected ransom payments. Entities deploying LockBit ransomware attacks had targeted organisations of various sizes spanning critical infrastructure sectors such as financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing and transportation. Reflecting the considerable number of independent affiliates involved, LockBit ransomware attacks display significant variation in observed tactics, techniques and procedures.No More Ransom to decrypt your filesWith Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise on developing decryption tools designed to recover files encrypted by the LockBit Ransomware.The support from the cybersecurity sector has also proven crucial for minimising the damage from ransomware attacks, which remains the biggest cybercrime threat. Many partners have already provided decryption tools for a number of ransomware families via the ‘No More Ransom’ website.These solutions have been made available for free on the ‘No More Ransom’ portal, available in 37 languages. So far, more than 6 million victims around the globe have benefitted from No More Ransom, which contains over 120 solutions capable of decrypting more than 150 different types of ransomware.Europol’s supportEuropol facilitated the information exchange, supported the coordination of the operational activities and provided operational analytical support, as well as crypto tracing and forensic support. The analysis workflow proposed after the first operation enabled a joint work focused on the identification of the LockBit actors. The advanced demixing capabilities of Europol’s Cybercrime Centre enabled the identification of several targets. Following the initiation operations against LockBit’s infrastructure in the beginning of 2024, Europol organised seven technical sprints, three of which were fully dedicated to cryptocurrency tracing. During the action days, Europol deployed an expert to provide on-the-spot support to the national authorities.The Joint Cybercrime Action Taskforce (J-CAT) at Europol supported the operation. This standing operational team consists of cyber liaison officers from different countries who work from the same office on high-profile cybercrime investigations.Authorities participating in Operation CronosAustralia: Australian Federal PoliceCanada: Royal Canadian Mounted Police/ Gendarmerie royale du CanadaFrance: Gendarmerie - (Gendarmerie Nationale – Unité nationale cyber C3N); Court of Paris JUNALCO (National Jurisdiction against Organised Crime) Cybercrime UnitGermany: State Bureau of Criminal Investigation (Landeskriminalamt Kiel) and Federal Criminal Police Office (Bundeskriminalamt)Japan: National Police Agency of Japan (警察庁)Spain: Spanish Civil Guard (Guardia Civil)Sweden: Swedish Police AuthoritySwitzerland: Switzerland Fedpol – Zurich State PoliceNetherlands: National Police (Politie) Dienst Regionale Recherche Oost-BrabantRomania: National Police Central Cybercrime UnitUnited Kingdom: National Crime Agency, South West Regional Organised Crime Unit (South West ROCU)United States: Federal Bureau of Investigation Newark

Held over two days, from 24 to 25 September 2024, the event brought together more than 450 delegates from 50 countries, focusing on collaborative strategies to combat emerging criminal threats and enhance international cooperation.This year, the EPCC featured two expert workshops in advance, followed by three high-level panels on priority issues: drug trafficking, online fraud and the impact of cyberattacks, disinformation and hybrid threats on policing.Keynote speakers included Laura Kövesi, the European Chief Prosecutor; János Balogh, the High Commissioner of the Hungarian National Police, Drew Harris, Commissioner An Garda Siochana; Hans Leijtens, the Executive Director of Frontex; and Ivan Vyhivskyi, the Head of the National Police of Ukraine. As in previous years, a meeting of the Directors General of Customs Authorities was held alongside the EPCC to strengthen cooperation between law enforcement and customs authorities.Bridging past and future2024 marks Europol’s 25th anniversary, and the agency’s growth over the past quarter of a century has been intrinsically shaped by shifts in the criminal landscape. What began as a small European Drugs Unit in Strasbourg, France, in 1994 has evolved into an organisation with over 1 700 staff members and 295 liaison officers working collaboratively in The Hague towards the shared objective of keeping Europe safe from multiple forms of serious organised crime and terrorism.In this context, discussions at this year’s EPCC focused on the evolving nature of several criminal threats, particularly in terms of their methods, scale and scope. A key overarching theme was the need for lawful access to data. Police chiefs acknowledged that the digital transformation of criminal and terrorist activities has driven a shift towards data-driven investigations. Senior officials concurred on the need to modernise law enforcement tools to access digital information and to refine data retention policies, while ensuring the protection of fundamental rights.Several overarching conclusions emerged as common themes throughout the discussions:There is a critical need to focus on high-value targets to achieve operational success. Investigations that do not address the root causes of criminal organisations may temporarily disrupt their activities, but these activities will inevitably resurface in different forms or areas.While prevention alone is clearly insufficient, it remains a key component in the fight against organised crime. Public awareness was reaffirmed as a foundational element for effective prevention strategies.Technology firms, service providers and AI platforms have become essential players in shaping the landscape of internal security and crime fighting. Strong partnerships with private entities are crucial, along with a reliable framework for lawful access to data and the ability to manage and analyse large and complex datasets.The highly threatening evolution of hybrid threats deserves the attention of police chiefs. Finding a suitable role for law enforcement will be important, working alongside and complementing national security and intelligence services.Celebrating innovation in law enforcementContinuing the tradition of recognising excellence, Europol presented the 2024 Europol Excellence Awards in Innovation to highlight the most innovative projects in law enforcement. This year, law enforcement agencies from Croatia, Estonia and the Netherlands were honoured for their achievements in three categories: the most innovative initiative in ethics, diversity and inclusion; the most innovative operation; and the most innovative technical tool.The winners were carefully selected by a panel that included Ylva Johansson, the European Commissioner for Home Affairs; the Police Chiefs of Hungary, Belgium and Poland; and Europol’s Executive Director, Catherine De Bolle.

This year, the Croatian, Estonian and Dutch Police were recognised for their achievements in three categories: Innovation initiative in ethics, diversity and inclusion; Innovative operation and Innovative technical solution.The Europol Excellence Awards in Innovation are presented annually by Europol to put a spotlight on the law enforcement community’s most innovative initiatives and operations.Europol’s Executive Director Catherine De Bolle, praised the winners, stating:Innovation is essential to staying ahead of today’s criminal networks. The projects recognised today exemplify the ingenuity and dedication of Europe’s law enforcement community in embracing new technologies to protect citizens across the EU.This year’s winners were carefully selected by a panel composed of the European Commissioner for Home Affairs, Ylva Johansson, as well as the Police Chiefs of Hungary, Belgium and Poland, and Europol’s Executive Director Catherine De Bolle.Award for Innovative Technical SolutionWinner: Blue Focus (The Netherlands)BlueFocus is a pioneering service that enhances the efficiency and effectiveness of the Netherlands Police by integrating advanced technology and innovative processes to identify suspects. The BlueFocus application allows police officers to upload and share photos and videos for recognition, leveraging AI to improve accuracy and speed in identifying individuals, goods, and locations.Runners up: Grand Theft API (Germany) and The Nordland Omegle Case – use of facial recognition technology in the prevention and investigation of sexual abuse against children (Norway).Award for Innovative OperationWinner: Operation Phish OFF (Estonia)OP PhishOFF permanently dismantled the Phishing-as-a-Service service “LabHost” through an international joint operation, while also influencing criminals to abandon their activities by creating a sense of immediate pursuit. Estonia played a key role in this effort, creating a series of innovative tools to identify the malicious services, take down the infrastructure, and send personal messages to users of the service. This innovative method is transferable to other law enforcement authorities for future use.Runners up: Operation ENDGAME (Germany) and Operation DRF: Drone as First Responder (Sweden)Award for Innovation in ethics, diversity and inclusionWinner: Project “I Can Like You” (Croatia)The "I Can Like You" project by the Ministry of the Interior of the Republic of Croatia aims to include underrepresented groups and individuals, promote equal opportunities, and foster a sense of belonging through crime prevention, employment initiatives, and community engagement. It targets both external groups and the internal structure of the Ministry to enhance security and inclusion.Runner ups: Project: Inside Out (Ireland) and Project: re_BOOTCMP (The Netherlands)Innovation at EuropolThese awards are overseen by Europol’s Innovation Lab, which focuses on identifying and implementing innovative solutions that enhance the operational capabilities of law enforcement across the European Union. It serves as a platform for collaboration between law enforcement, industry, and academia, aimed at addressing the challenges of modern policing. The Lab develops practical tools and technologies, such as advanced data analytics and AI-driven systems, to strengthen investigations and improve security outcomes. By doing so, it ensures law enforcement agencies are equipped to combat evolving threats.This is the fourth iteration of the Europol Excellence Awards in Innovation.  

The report also delves into the implications of the recently adopted EU Artificial Intelligence Act, which imposes regulations on law enforcement’s use of AI. Key provisions include a ban on certain applications, such as real-time biometric identification in public spaces, and stringent oversight of high-risk AI systems. While these regulations present challenges, they also foster innovation by encouraging the creation of regulatory sandboxes. The report underscores that AI’s advantages must be carefully weighed against potential risks to ensure fairness, transparency, and the protection of privacy. Close collaboration between law enforcement agencies, technology developers, and policymakers will be crucial for the ethical and effective deployment of AI.Europol’s Executive Director Catherine De Bolle said,Artificial intelligence will profoundly reshape the law enforcement landscape, offering unprecedented tools to enhance our ability to safeguard public safety. Europol is committed to staying at the forefront of these technological advancements. This report from the Innovation Lab not only reflects our dedication to the responsible adoption of AI, but also serves as a guide for the broader European law enforcement community as we navigate this new era of digital policing.Key takeaways from the report:Enhanced Law Enforcement Capabilities: AI technologies can significantly improve law enforcement operations, from advanced data analytics to biometric systems.Improved Operational Efficiency: AI’s ability to handle large datasets and utilise Natural Language Processing (NLP) can streamline workflows while upholding privacy standards.Real-Time Insights in Crisis Situations: AI tools can rapidly analyse unstructured data, providing critical insights for decision-making in emergency situations.International Cooperation: AI-driven tools, such as machine translation, are vital for seamless international collaboration in cross-border investigations.Technical Infrastructure and Expertise: The successful development and deployment of AI in law enforcement requires robust technological infrastructure and specialised expertise.Navigating Legal and Ethical Challenges: Integrating AI responsibly requires navigating complex legal frameworks, ensuring accountability, transparency, and protection of civil liberties.Bias Mitigation and Training: Comprehensive training programmes and measures to address bias in AI systems are essential to promote fairness, justice, and impartiality in law enforcement practices.About Europol’s Innovation LabEuropol’s Innovation Lab is dedicated to identifying, promoting, and developing cutting-edge solutions that enhance the operational capacity of EU law enforcement agencies. By leveraging new technologies, the Innovation Lab helps investigators and analysts work more effectively, reducing redundancy, fostering synergies, and optimising resources.Aligned with the strategic goals of Europol's 2020+ Strategy, the Innovation Lab remains at the forefront of law enforcement innovation and research. Its work is structured around four core pillars: managing projects to support operational needs, monitoring technological trends, maintaining networks of experts, and serving as the secretariat for the EU Innovation Hub for Internal Security.Digital ChallengesThis report is part of Europol’s ongoing efforts to highlight how digitalisation has transformed both crime and policing, particularly as technology, encrypted communication and data complexity escalate.By fostering innovation and enhancing international collaboration, Europol is working to equip law enforcement agencies with the tools and knowledge to stay ahead of criminals exploiting digital technology.From AI to encryption, home routing and quantum computing, read more about Europol’s latest publications on digital challenges.

On 19 September, Bulgarian authorities, supported by Europol, dismantled a criminal network smuggling migrants from Türkiye via Bulgaria and Serbia towards Western Southern Europe. The investigation, involving Greek and Romanian authorities, was conducted in the framework of a regional Operational Task Force set up to investigate migrant smuggling networks using Bulgaria as a transit country.The action day led to:8 arrests (one High Value Target)11 location searchesSeizures including: cash, Hawala accountancy notebooks and documentsOne Romanian citizen found during the searches has been identified as a person wanted by Austria.The investigation was initiated at the beginning of 2023 when Bulgarian authorities found migrants smuggled by this network. So far, national authorities have detected 15 smuggling incidents. The smuggling network allegedly facilitated the illegal secondary movements of over 700 irregular migrants towards other parts of the EU. The suspected ringleaders, predominantly Syrian nationals, coordinated the smuggling activities while maintaining contacts with smugglers and hawaladars in Turkey and Greece, as well as in other countries along the smuggling route. The suspects facilitated the transportation of migrants from the Turkish-Bulgarian border to accommodations in the region of Sofia. After a short stay there, they were further transported to the Bulgarian-Serbian border.Migrants had to deposit EUR 3 000 to EUR 5 000 in Hawala offices before going to the borderMigrants had to pay significant deposits before being taken across the green border between Türkiye and Bulgaria. They paid between EUR 3 000 and EUR 5 000 in Hawala offices in Istanbul and were then smuggled by guides connected to the Turkish members of the criminal network. Once on Bulgarian territory, the migrants were picked up by drivers of Bulgarian, Romanian and Syrian nationalities, who transported them to accommodations in Sofia. For the transportation, the smuggling network used different vehicles such as cars, vans and even trucks.In one case, the suspects transported 150 migrants in a lorry. Criminals use this modus operandi to maximise their profits when the demand for smuggling services is high. In this particular case, drivers transported the migrants while driving at fast speeds, to escape police checks. This dangerous modus operandi puts the lives of migrants and bystanders at great risk.Europol support and joint actionsExtensive operational analysis was carried out to identify the different targets and map their criminal activities. Europol also brought together the different countries involved to jointly prepare for the final phase of the investigation.Two Europol experts deployed to Sofia in the framework of the regional Operational Taskforce were on the ground during the action day, helping law enforcement authorities with cross-checks in real-time against Europol’s databases.Police officers from the Hellenic Police, Romanian Border Police and Romanian Police (Service for Combating Organised Crime) were deployed on the spot to support the investigative measures.Europol’s European Migrant Smuggling Centre has been supporting the work of the Task Force since its establishment.The following authorities took part in this action:Bulgaria: General Director for Combating Organised Crime (Главна дирекция Борба с организираната пресъпност), and National Security Agency (Държавна Агенция Национална Сигурност)Greece: Hellenic Police (Ελληνική Αστυνομία)Romania: Border Police (Poliția de frontiera) and National Police (Poliția Română)

Investigators reported 483 000 victims worldwide, who had attempted to regain access to their phones and been phished in the process. The victims are mainly Spanish-speaking nationals from European, North American and South American countries.The successful operation took place thanks to international cooperation between law enforcement and judiciary authorities from Spain, Argentina, Chile, Colombia, Ecuador and Peru.The action week took place between 10 and 17 September and resulted in 17 arrests, 28 searches and 921 items seized, mainly mobile phones but also other electronic devices, vehicles and weapons.A complex criminal webThe administrator of the phishing platform, an Argentinian national, was arrested during the large-scale law enforcement operation. He had been developing and running phishing services since 2018. On this occasion, he had been offering a phishing-as-a-service platform for unlocking mobile phones for the last 5 years.The criminal sold access to his website and charged extra costs for phishing, SMS, emails or call performing. Criminal users of the platform –or “unlockers”– provided phone unlocking services to other criminals in possession of stolen phones.Investigators identified more than 2 000 unlockers who had been registered in the phishing platform over the years. The investigation revealed that the criminal network had unlocked over 1.2 million mobile phones.Europol’s roleFor the first time, Europol’s European Cybercrime Centre (EC3) coordinated an international operation together with the Specialised Cybercrime Centre of Ameripol, the Police Community of the Americas.The action week was the result of a long-run investigation starting in 2022. After receiving information from a private company (Group-IB), Europol provided the affected countries with dedicated packages regarding the case. After months of investigation, the countries managed to identify most of the victims and took action against the criminal network.During the investigation, Europol coordinated the authorities involved in the case and provided them with analytical support. An expert from Europol was deployed to Argentina and Spain to provide their expertise in the field during the action week.Law enforcement authorities involved:Spain: Spanish National Police (Policía Nacional) and Spanish Guardia Civil (Guardia Civil)Argentina: Argentine National Gendarmerie (Gendarmería Nacional Argentina) and Argentine Federal Police (Policía Federal Argentina)Chile: Chilean Investigative Police (Policía de Investigaciones de Chile)Colombia: Colombia National Police (Policía Nacional de Colombia)Ecuador: National Police of Ecuador (Policía Nacional de Ecuador)Peru: National Police of Peru (Policía Nacional de Perú)Other partners involved:Ameripol – AC3, Specialised Cybercrime Centre (Centro Especializado de Cibercrimen)EL PACCTO - Europe Latin America Assistance Program against Transnational Organised Crime (Europa Latinoamérica Programa de Asistencia contra el Crimen Transnacional Organizado)Do not take the baitPhishing refers to fraudulent emails coming from criminals posing as legitimate senders that trick the receivers into taking an action or sharing their personal, financial or security information.The messages usually:look identical to messages from a reputable organisation or service provider;sound urgent;claim to enclose important or breaking news;ask you to take action, such as clicking attachments and links or confirming your login credentials.What can you do if you click something?Use antivirus software on all your electronic devices.Ensure that your security software and operating systems are up-to-date.Set up unique passwords for all your online accounts.Think twice before clicking on any links and attachments as criminals could be trying to phish or smish you. If you’re in doubt, don’t click links, open attachments or reply and certainly don’t give out any financial information.

The theme of this year’s EDEN event, ‘Data Protection & Cyber Security as Law Enforcement Core Business’, highlighted the opportunity for law enforcement to leverage advancing technologies while maintaining ethical standards and meeting legal requirements. The conference explored topics such as the impact of quantum computing, AI in policing, and strategies to combat disinformation, alongside discussions on balancing security concerns and individual rights.The event featured a series of keynote speeches. The European Data Protection Supervisor (EDPS), Wojciech Wiewiorowski, spoke on the critical relationship between the AI Act and data protection regulations, particularly in the context of data-driven investigations and law enforcement. He highlighted the growing importance of collaboration between law enforcement, academics, and scientist to effectively navigate the evolving digital landscape.Europol’s Executive Director, Catherine De Bolle, emphasised:In an operational landscape where risks are constantly evolving, being accountable requires governance and controls by design and applied at the onset. But, it also calls for a permanent adaptation of our data protection processes to the changes in the threat environment. At Europol, the Data Protection Function is at the heart of these efforts. We must continue to support and empower Data Protection Officers as they help us navigate the complexities of managing sensitive information in a way that upholds public trust and the rule of law.During her keynote speech, the President of the Republic of Slovenia, Dr. Nataša Pirc Musar stated:EDEN is not just a conference; it is a beacon for the data protection community, bringing together professionals, law enforcement officials, regulators, academics and representatives from the private sector and NGOs. It is a gathering that reflects the diverse and interconnected world we live in, where the protection of personal data is no longer just a legal requirement but a fundamental aspect of our shared values and a cornerstone of democracy.Data protection at EuropolData protection is fundamental to Europol’s work and forms an important part of its core business. The Data Protection Function, which operates with functional independence, works closely with Europol staff and is the initial point of contact for all data protection matters.Europol upholds both security and privacy as essential elements of its operations, recognising that safeguarding privacy is integral to ensuring security. The organisation’s commitment to data protection lies at the heart of its daily work, reflecting the importance of both privacy and security in maintaining a safe, free society.Through events like the EDEN conference, Europol continuously broadens its understanding of data protection, cybersecurity, law enforcement practices, technology, and fundamental rights, ensuring it remains at the forefront of these critical areas.The EDEN networkFounded in 2015, the Europol Data Protection Experts Network (EDEN) is a collaboration platform that brings together stakeholders from diverse backgrounds. It provides a forum for sharing knowledge, best practices, events, and projects related to data protection within a law enforcement context. EDEN is an invitation-only network and is not suitable for the exchange of operational personal data or classified information.Each year, EDEN organises a conference featuring speakers and participants from law enforcement, the data protection community, private industries, NGOs, academia, and other interested sectors. To date, eight large-scale EDEN events have been held in The Hague (2016, 2018, 2020, 2022, 2024), Copenhagen (2019), Rome (2021), and Madrid (2023). Additionally, EDEN has hosted panels at the International Conference on Computers, Privacy, and Data Protection (CPDP) in Brussels every year since 2020.This year’s EDEN Conference was particularly notable, as it included a dedicated panel for young professionals to share their views on the intersection of data protection, law enforcement, and cybersecurity. Given that these professionals will help shape the future of security, it is crucial that they have a platform to provide their insights and ideas.EDEN is a space where experts across various fields engage in meaningful dialogue with one another rather than simply about one another. Through collaborations with universities, EDEN facilitates the exchange of knowledge and best practices, encouraging students to contribute their unique perspectives to the debates. These collaborations also provide students with opportunities to network with privacy professionals and influential figures in the data protection community, enhancing their understanding of data protection and cybersecurity, and strengthening the links between EDEN and academia.If you are interested in becoming a member of EDEN or want to host an EDEN Community Event, please contact us at eden@europol.europa.eu.

The signatures of these two legal instruments put into practice the Working Arrangement between the International Criminal Court and Europol, which was concluded on 25 April 2023. This will allow the ICC to nominate a Liaison Officer to Europol. The signing will also allow the ICC to establish a SIENA connection with Europol, allowing for the secure exchange of sensitive operational information.Europol’s Executive Director Catherine De Bolle said:The cooperation between Europol and the ICC is of great interest to both parties in the fight against core international crimes. As law enforcement practitioners - and especially for those of us who work in pursuit of international criminal justice, the International Criminal Court is a reference. It is a symbol for the international community efforts to hold accountable those guilty of some of the world’s worst crimes.ICC President Tomoko Akane said:Our two institutions share a fundamental understanding that international cooperation is key to the pursuit of justice. At this challenging time, the objectives of the Court, including the pursuit of an end to impunity in the context of full respect for the rule of law, can be best achieved in close cooperation and partnership with others. Today, we strengthen this cooperation by adopting frameworks for its practical implementation between our two institutions.Europol’s mandate expanded in 2017 to include the crimes of genocide, crimes against humanity and war crimes. Since its inception seven years ago, a dedicated Europol Analysis Project has been providing tailor-made and specialised support to EU Member States’ and Third Parties’ efforts to identify and investigate individuals, networks and groups involved in committing core international crimes. Europol focuses on the analytical part of international crimes investigations, streamlines information exchange, carries out online monitoring, and provides open sources intelligence. To that end, Europol has a secure and dedicated operational data storage capacity, which is compliant to judicial use of evidence. 

Europol’s Executive Director Catherine De Bolle said:Today we have made it clear that no matter how hidden criminal networks think they are, they can’t evade our collective effort. Law enforcement from 9 countries, together with Europol, have dismantled a tool which was a lifeline for serious organised crime. This operation is what Europol is all about: turning collaboration into concrete results by bringing together the right people, tools and expertise to address every aspect of this complex operation. The work carried out is part of our ongoing commitment to tackling organised crime wherever it operates. I want to extend my gratitude to all our global partners who played a vital role in making this operation a success.Ghost had gained traction among criminal organisations due to its advanced security features. Users could purchase the tool without declaring any personal information. The solution used three encryption standards and offered the option to send a message followed by a specific code which would result in the self-destruction of all messages on the target phone. This allowed criminal networks to communicate securely, evade detection, counter forensic measures, and coordinate their illegal operations across borders.Worldwide, several thousand people used the tool, which has its own infrastructure and applications with a network of resellers based in several countries. On a global scale, around one thousand messages are being exchanged each day via Ghost.A multinational effort spanning 9 countriesAs servers were found in France and Iceland, the company owners were located in Australia, and financial assets were located in the United States, a global operation against the phone service started.The takedown involved a series of coordinated raids and technical interventions. Over the course of the investigation, 51 suspects have been arrested: 38 in Australia, 11 in Ireland, one in Canada and one in Italy belonging to the Italian Sacra Corona Unita mafia group.Further arrests are anticipated as the investigation progresses.In addition, a number of threats to life were prevented, and a drug lab dismantled in Australia, together with weapons, drugs and over EUR 1 million in cash seized globally so far.To facilitate investigations into the illegal activities facilitated by this communication platform, an Operational Taskforce (OTF) was established at Europol in March 2022 involving law enforcement authorities from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States.This taskforce has been instrumental in mapping the global technical infrastructure, and was successful in targeting it by identifying key suppliers and users of the platform, monitoring its criminal usage, and executing the coordinated effort to shut it down, all under judicial oversight from the Joint Investigation Team (JIT) countries.Building upon the law enforcement cooperation, a JIT was set up between the French and U.S. authorities in January 2024 with the support of Eurojust and Europol.This complex, global operation was made possible thanks to active cooperation among the different countries involved and Europol, which have been engaged in the different components of the investigative activities, including actions against high-risk criminal organisations and High Value Targets, cyber-investigations, the analysis of cryptocurrencies transactions, frequent intelligence exchange using Europol’s secure channels and dozens of operational meetings arranged in different countries.Over the course of the investigation, Europol deployed experts to Iceland, Ireland and Australia. Due to the complexity of this data-driven investigation, a number of teams at Europol were involved with specialised technical skills, including cyber-related.A Joint Operational Centre was also established at Europol’s headquarters during the action days, where representatives from the OTF members and Europol’s officers provided support and facilitated the coordination of the simultaneous operational activities taking place across the globe.A fragmented and dynamic landscapeThe encrypted communication landscape has become increasingly fragmented as a result of recent law enforcement actions targeting platforms used by criminal networks. Following these operations, numerous once-popular encrypted services have been shut down or disrupted, leading to a splintering of the market.Criminal actors, in response, are now turning to a variety of less-established or custom-built communication tools that offer varying degrees of security and anonymity.  By doing so, they seek new technical solutions and also utilise popular communication applications to diversify their methods. This strategy helps these actors avoid exposing their entire criminal operations and networks on a single platform, thereby mitigating the risk of interception.Consequently, the landscape of encrypted communications remains highly dynamic and segmented, posing ongoing challenges for law enforcement.Lawful access to dataEuropol and its partners continue to prioritise the fight against encrypted communication technologies used by criminals, while also advocating for a balanced approach that respects privacy rights and upholds legal standards.Private companies that wish to ensure their services are used in compliance with the law also have an important role to play. They must ensure that their platforms are not safe havens for criminals and should provide mechanisms for lawful data access under judicial oversight and in full respect of fundamental rights.Law enforcement needs access to communications among suspects to combat serious crimes. This can coexist with privacy protection, while cybersecurity is guaranteed and strong legal safeguards and oversight are in place.The following authorities took part in the investigation:Australia: Australian Federal PoliceCanada: Combined Forces Special Enforcement Unit - Montreal, Federal Policing - Eastern Region, Royal Canadian Mounted PoliceFrance: Cybercrime unit Prosecutor’s office JUNALCO (National Juridiction against organised crime), National Gendarmerie - National Cyber Unit (Gendarmerie Nationale - Unité nationale cyber C3N), National cyberspace command for the Interior Ministry (Commandement du Ministère de l'intérieur pour le cyberespace)Iceland: Reykjavik Metropolitan PoliceIreland: An Garda SíochánaItaly: Central Directorate for Anti-Drugs Services (D.C.S.A.), Polizia di Stato, Squadra Mobile Lecce, District Anti-mafia Directorate Lecce (Direzione Distrettuale Antimafia), National Anti-Mafia and Anti-Terrorism Directorate (Direzione Nazionale Antimafia e Antiterrorismo), Central Operational Service (S.C.O.)The Netherlands: PolitieSweden: Swedish PoliceThe United States: Federal Bureau of Investigation (FBI)A number of technical developments within the investigation were supported by the Internal Security Fund (ISF) ‘Project Overclock’, funded by the European Commission.Press conference

New risks…The presentations and panels revealed emerging ways in which crypto assets and innovations are abused to facilitate organised crime.While cryptocurrencies pose no greater intrinsic risk than more traditional assets and value transfer systems, their unique features can be leveraged to facilitate ransomware attacks and other cybercrime, which can affect critical infrastructure and services.Speakers revealed cases of sophisticated misuse of crypto assets for money laundering, sanctions evasion, terrorist financing and nuclear proliferation, each carrying significant implications for both national and global security.…joint solutionsThe conference also showcased how law enforcement agencies are working collaboratively with crypto asset service providers, blockchain analysis firms and specialist asset recovery and management agencies to fight back.Emphasising the value of such events, Burkhard Mühl, Head of Europol's European Financial and Economic Crime Centre (EFECC), commented:With events such as this Global Conference and the gathering and interaction of so many professionals and experts, we remain at the forefront of providing an appropriate response to the emerging financial crime risks and threats posed by the misuse of crypto assets. Europol will continue to support criminal investigations with all our capabilities and work with our partners to ensure that criminals are brought to justice.These public-private collaborations have enabled officers to trace illicit crypto transactions across multiple blockchains before ultimately seizing the funds, de-anonymising the perpetrators and often being able to return significant quantities of crypto assets to victims.John Brandolino, UNODC Director, Division of Treaty Affairs, emphasised that:Multilateral collaboration is essential to dismantling the finances of criminal organisations and terrorists. UNODC fully supports and promotes efforts to collectively strengthen our ability to prevent and counter the criminal misuse of crypto assets, which in turn contributes to overall global security.Meanwhile, more stringent regulations in the European Union and other jurisdictions are starting to bring the crypto ecosystem firmly into the regulated sphere. If implemented effectively, they will provide a robust framework for law enforcement and asset recovery while also setting clear guidelines for private-sector entities and supervisors.A strategic priorityInvesting in capabilities and effective measures to prevent and combat the misuse of the crypto ecosystem for financial crime should be a strategic priority across all sectors. Iker Lekuona, Director of the Basel Institute’s International Centre for Asset Recovery (ICAR), said:In our work assisting with major transnational corruption and asset recovery cases, we see how money launderers and other criminals systematically target weak links in the chain. All institutions involved in detecting and investigating financial crimes and in recovering assets need to build their capacity to work on crypto-related cases.Mr. Brandolino added:Tackling illicit profits has consistently proven to be one of the most effective strategies for disrupting criminal organisations and preventing the misuse of cryptocurrencies for illegal purposes.As emphasised in the joint Europol–Basel Institute recommendations published earlier in 2024, this includes investing in research and innovation, capacity building and cross-border, multi-stakeholder collaborations.Joint learning and collaborationsPeer learning opportunities like this Global Conference series are vital to advancing all of these areas. They are a key element of the strategic approaches of all three partner organisations for this conference, including Europol’s 2023 Delivering Security in Partnership strategy and the Basel Institute’s strategic pillars of building coalitions and catalysing joint learning.

Despite extensive investigations over the years, the identity of the suspect(s) remains unknown, and authorities are hoping that new information from the public can finally help solve this case.What we knowOn 8 August 1996, a brutal murder occurred in Dümmerlohausen, Germany, where the victim was found next to a stolen red vehicle, riddled with bullets.The victim, a male national from the former Yugoslavia, was involved in criminal circles and was known to law enforcement for his involvement in burglaries in northern Germany.A resident of Hamburg, the victim is believed to been staying in a hotel in Oldenburg at the time of his murder, where he was presumably in hiding.Despite a thorough investigation, the identity of the killer(s) has remained a mystery for the past 28 years.Appeal to the publicRecent advances in forensic technology, combined with renewed investigative efforts, have enabled the German Police to re-examine the case. To widen the investigation’s reach, the German authorities have asked for Europol’s support.The case falls under the work of Europol’s European Serious Organised Crime Centre, whose mandate was recently extended to counter the use of violence by organised crime groups. Europol’s work in this area covers a wide spectrum – from the most recent trends to decades old cold cases.Authorities are now urging anyone with information, no matter how insignificant it may seem, to come forward.The Oldenburg Police Department is offering a reward of EUR 5 000 for information leading to the resolution of the case and the apprehension of the perpetrator(s). This reward will be granted in agreement with the Oldenburg Public Prosecutor’s Office.A short film has been produced by the German authorities, providing previously undisclosed details about the murder case and original photos and excerpts from the investigation files. It is intended to reach potential witnesses or individuals with knowledge of the murder.How to provide informationInformation can be provided anonymously to the German authorities.A tip portal has been set up, allowing witnesses to contact the police anonymously. Users can also upload files and images through this portal.

Among those detained are the five Romanian leaders of the group, who are believed to have been responsible for the logistics and management of the criminal activities. The other suspects were criminal associates in charge of recruiting drivers or accommodating migrants in so-called safe houses, two of which were found in Italy. The criminal group is suspected of having been involved in over 30 smuggling incidents since January 2023, illegally transporting at least 726 migrants across European borders.Results of the action day include:19 suspects detained and presented before public prosecutor’s offices to press charges1 modified van with special compartment for smuggling migrants seized4 vehicles, an all-terrain vehicle, and a motorcycle seized52 mobile phones, 2 laptops and a tablet seizedaround EUR 15 000 in various currencies seizedRomania to Italy for up to EUR 3 000Offering and organising their trips on messenger apps, the criminals would offer to clandestinely take migrants, many of which had a temporary work visa in Romania, from Romania over Hungary and Slovenia to Italy. The Bangladeshi, Indian, Nepali or Pakistani nationals making use of this illicit service paid between EUR 2 500 and EUR 3 000 for the journey. Facing life-threatening conditions, the migrants were often hidden in specially designed compartments – such as double walls – in the cargo space of vans or lorries.Throughout the journey, the criminals deployed additional vehicles as forerunners to accompany the transports and keep a watch out for law enforcement presence. Most of the vehicles used by the suspects were registered under legal businesses such as transport companies. The criminals organised the trips via interconnected cells, each recruiting drivers for individual parts of the journey.Europol’s contributionEuropol facilitated the exchange of information between the involved countries and provided operational coordination as well as analytical support. Intelligence on this case was also provided by Europol guest officers deployed in Galati, Romania. On the action day, a Europol analyst with a mobile office was deployed to cross-check information on the spot.Participating countries:Hungary: Hungarian National Bureau of Investigation – Unit against Illegal Migration (Nemzeti Nyomozó Iroda – Illegális Migráció elleni Osztály)Italy: Italian State Police – Central Operational Service (Polizia di Stato – Servizio Centrale Operativo (SCO)); Italian Border Police of Gorizia (Polizia di Stato – Settore Polizia di Frontiera di Gorizia); Italian Border Police of Gorizia (Polizia di Stato – Settore Polizia di Frontiera di Udine)Romania: Romanian Police – General Directorate for Countering Organised Crime (Poliţiei Române – Direcția de Combatere a Criminalității Organisate (DCCO)); Romanian Border Police – Directorate for Prevention and Countering of Transborder Crime and Illegal Immigration (Poliția de Frontieră - Direcția de Prevenire și Combatere a Migrației Ilegale și Infracționalității Transfrontaliere)Slovenia: Slovenian National Police (Policija)The list of authorities was updated on 4 September 2024 at 10:20 CET.

Results of the action day include:arrest of 7 members of the criminal network;dismantling of the largest laboratory of synthetic opioids ever found in Poland, used to produce methadone in crystalline form;dismantling of 8 multi-laboratories in Poland and Ukraine, used for the production of synthetic cathinones (mephedrone, Alpha-PVP) and methadone;seizure of 195 kilograms of methadone in crystalline form;seizure of 153 kilograms of Alpha-PVP;seizure of over 430 litres of reaction mixtures of different types of drugs prepared for the final production stage;seizure of large quantities of drug precursors and chemicals necessary for the production of synthetic opioids and cathinones.Highly harmful and lethal substances seizedMethadone, a synthetic opioid, is a substance used in the medical field as a painkiller and in the treatment of opioid addiction. However, the substance produced by the criminal network was in a concentrated crystalline form, which is only found on the illegal drug market and the danger of which cannot be overstated.Law enforcement also seized substances such as mephedrone and Alpha-PVP, which belong to the group of synthetic cathinones and represent an increasing problem in several EU Member States. These drugs cause serious psychological and neurological disorders, and their abuse is associated with a high risk of addiction, organ damage, and death. For more information about the reality of the European illicit markets please refer to the EU Drug Markets Report by Europol and the European Union Drugs Agency (EUDA).Synthetic drugs as law enforcement priorityThis operational success involving Polish and Ukrainian law enforcement agencies underscores the effectiveness of cross-border collaboration, which is crucial for safeguarding our societies and protecting the lives and health of citizens from the dangers posed by international organised drug crime.Europol supports its partners in the fight against the production, trafficking and distribution of synthetic drugs. In 2023, Europol sent out an Early Warning Notification to its Member States and partners, warning them about an increase in trafficking of these type of drugs. During the operation’s investigation phase, Europol provided intelligence for cross-checking and analysis to support investigators on the field. As a priority of the EU Policy Cycle - EMPACT, this operation was also financially supported by the platform, which contributed to its successful outcome.Europol maintains the European Illicit Laboratory Comparison System (EILCS), which contains details of equipment and chemicals used in laboratories, storage places, and dumping sites for synthetic drugs. This data enables Europol analysts to compare new incoming information with previous cases. This allows them to find links between illicit sites and to assist EU Member States in cracking down on production facilities across Europe.The equipment needed to carry out this operation was made possible by the ‘Crystal Palace’ project - “Strengthening the Actions of the EMPACT NPS and Synthetic Drugs Platform under the EMPACT 2022+ Instrument” - led by Poland, the Netherlands, and Italy, and funded by the European Union Internal Security Fund.

The agreement includes provisions on the exchange of information and data protection, the rights of data subjects, the establishment of a supervisory authority, and administrative and judicial redress.This is the first agreement of its kind since the Europol Regulation 2017, which allows Europol to transfer personal data to an authority of a third country on the basis of an international agreement between the EU and the third country.The international agreement entered into application on 15 August 2024.Teaming up since 2019This agreement builds on the existing Working Arrangement between the New Zealand Police (Nga Pirihimana O Aotearoa) and Europol, which has been in place since 2019. Under the existing arrangement, New Zealand works closely with Europol and the Member States to exchange specialist knowledge, general situation reports and strategic analysis results, participate in training activities, and provide advice and support in individual criminal investigations.In return, New Zealand has access to Europol’s secure communication channel and has a Liaison Officer stationed at Europol’s headquarters.The press release was updated on 4 September 2024 at 17:30 CET.

The seizures included large quantities of drugs and criminal assets:47 kilograms of freshly processed cocaine hydrochloride;20 kilograms of cocaine base (processed cocaine paste);2 kilograms of marijuana;3 000 litres and 300 kilograms of various chemicals;3 firearms;EUR 245 000 in cash;13 vehicles.Ingenious cross-ocean smuggling techniqueUsing a sophisticated method to avoid detection, the criminals injected cardboard boxes containing legal cargo (such as fruit) with cocaine base. Once successfully shipped in maritime containers from Colombia to Málaga, Spain, the organisation would extract the cocaine base from the cardboard and process it into the final consumable product, ready for distribution.Over the course of this joint law enforcement effort, the logistical and company structure used for developing and maintaining this criminal activity has been dissolved. Europol supported the investigation with analytical support and provided operational support on the two action days. Specialists from Europol’s dedicated Operational Task Force were deployed on the spot, providing forensic support and cross-checking new leads and information in real time against the Agency’s databases.This operation serves as an example of a trend highlighted in the EU Drug Markets Report by Europol and the European Union Drugs Agency (EUDA). Law enforcement authorities across Europe have observed an increase in the number, capacity and sophistication of laboratories set up for the extraction and further processing of the cocaine base (as well as, to a lesser degree, cocaine paste) into the final consumable product (cocaine hydrochloride). Typically, raw cocaine is transported to Europe concealed in a carrier material (such as charcoal) in order to reduce the risk of detection in entry points such as ports and airports.

On 19 August, Bulgarian law enforcement authorities arrested eight suspected members of a gang involved in smuggling migrants into Europe. Four of the suspects arrested during the action day had already been identified as High Value Targets who played a leading role in the criminal activities. The gang charged up to EUR 6 000 per person and smuggled more than 130 people from Turkey into Bulgaria and then on to other European destinations via the Western Balkan route.A total of 15 locations were raided in the region of the Bulgarian city of Plovdiv, with Europol experts as well as Romanian and Moldovan police officers deployed on the ground to support the Bulgarian authorities in their enforcement measures.As a result of these searches, law enforcement authorities seized 13 mobile phones, a weapon and ammunition, and documents for vehicles related to migrant smuggling incidents in Bulgaria.This action was carried out in the framework of a Europol-coordinated regional Operational Taskforce based in Sofia, which focuses on criminal networks smuggling migrants from Türkiye across Bulgaria towards Western Europe.An international network dedicated to migrant smugglingThe smuggling activities resembled a complex enterprise involving leaders, organisers and facilitators of different nationalities.The main leaders were Syrian and Jordanian nationals, who would coordinate the criminal activities with other smugglers located in Türkiye and along the Western Balkan route. Bulgarian nationals were responsible for the logistics, namely finding and purchasing cars used for the transportation of the migrants, and registering them under the names of other individuals in exchange for a small sum of money. The gang would also use Moldovan drivers recruited over the internet.Since April of this year, 17 migrant smuggling incidents linked to this gang have been identified. One of the main ringleaders was already known to law enforcement, having been investigated in the past for migrant smuggling activities in Austria and Croatia.From Türkiye to the Western Balkans using Moldovan driversThe irregular migrants would cross the border between Türkiye and Bulgaria on foot, using the services of guides provided by the organisers in Türkiye. After having crossed the border, they would be met by Moldovan drivers who would transport them to the Bulgarian-Serbian or Bulgarian-Romanian border.The drivers were provided with the cars and GPS coordinates and were sent during the night to pick up the migrants at agreed locations. The drivers would communicate with other members of the gang using mobile apps with disappearing messages. They would receive EUR 100 per person transported, averaging between EUR 700 and EUR 1 000 per journey.The migrants paid around EUR 6 000 to be smuggled into Bosnia and Herzegovina, and more than EUR 4 000 to be transported to Serbia.Europol supportEuropol’s European Migrant Smuggling Centre has been supporting the work of the Taskforce since its establishment.Extensive operational analysis was carried out to identify the different targets and map out their criminal activities. Europol also brought together the different countries involved to jointly prepare for the final phase of the investigation.Two Europol experts deployed to Sofia in the framework of the regional Operational Taskforce were on the ground during the action, helping the law enforcement authorities by providing real-time cross-checks against Europol’s databases.The following authorities took part in this action:Bulgaria: General Directorate Combating Organised Crime (Главна дирекция Борба с организираната пресъпност), National Police (Национална полиция), Border Police (Гранична полиция), State Agency National Security (Държавна агенция Национална сигурност), Gendarmerie Special operations and combating terrorism (Жандармерия, специални операции и борба с тероризма), District Prosecutor’s Office in Plovdiv (Окръжна прокуратура – Пловдив)Moldova: General Police Inspectorate (Inspectoratul General al Poliției)Romania: Border Police (Politia de frontiera) and Romanian Police (Poliția Română)

Leading up to the action day, authorities across Europe had seized counterfeit banknotes of various denominations (mostly 20, 50 and 100 euros) worth around EUR 950 000 before they entered circulation, all traceable to the same producer. Furthermore, the arrested counterfeiter is believed to be responsible for over 27% of all faked euro banknotes discovered and taken out of circulation in 2023 alone. The total face value of these banknotes is estimated at around EUR 8 million.Bunker-like printing laboratory in a private residenceThe Carabinieri’s anti-money forgery investigators, with the support of Europol’s experts, had been zoning in on the sophisticated print shop hidden in the city of Naples. When officers raided the location, they came across an almost industrial-like production line containing 31 digital printing machines and extensive quantities of raw materials used for the production of fake banknotes. The criminal had set up shop in his own home, hiding the production facility behind his garage. Concealed behind a cabinet, the forger had constructed a movable wall part on rails, which allowed him to access the printing lab when actuating a homemade electronic system.Authorities believe that the forger relied on several national and transnational distribution channels, the latter predominantly in France, to sell his counterfeit banknotes in denominations of 20, 50 and 100 euros. Expert analysis, including an assessment by the European Central Bank, confirmed that the counterfeit security features on the banknotes (such as holograms) were of high quality.Europol’s support to Italy and FranceEuropol facilitated the information exchange and financed and coordinated several operational activities. Europol also provided analytical support to identify the countries in which the banknotes were distributed. During the action day, Europol sent an expert to Italy to provide technical support and cross-check the operational information against Europol’s databases and the European Central Bank’s systems.Participating authorities:France: National Police (Police Nationale - Office central pour la répression du faux-monnayage (OCRFM))Italy: Carabinieri (Arma dei Carabinieri - Comando Carabinieri Antifalsificazione Monetaria (CCAFM))

A suspiciously dormant projectThe suspect’s company, which was registered in Spain, had reported hardly any commercial activity since its establishment. It had never developed any project, neither in Spain nor in any other country. However, between 2020 and 2022 the company reported two income streams for a total amount of over EUR 4.5 million. Further investigation showed that individuals close to the Equatorial Guinea government were among the beneficiaries of these sums.These payments were related to a contract signed in 2019 between the government of the African country and the Spanish company in order to start up a fishery products processing plant. Originally, the project was supposed to be completed within two years of the signing. The lawyer and owner of the company is now charged with corruption, money laundering, falsification of accounts and forgery of documents.Europol’s roleUsing SIENA, Spanish authorities shared their first insights with Europol, who then provided analytical support. On the action day, two Europol analysts supported the searches in Spain with a Virtual Command Post that had been set up in Europol’s headquarters in The Hague. Offering real-time operational support, the experts cross-checked the results of the house searches in Spain against Europol’s databases, thus providing further leads to the officers on the spot.Corruption is an insidious and often invisible threat, eroding the rule of law, weakening state institutions, and hindering economic development by distorting fair competition. You can read more about how Europol supports the fight against corruption in the European Financial and Economic Crime Threat Assessment 2023.

Several locations were also searched simultaneously in North Macedonia, where machines for the production of counterfeit currency, thousands of assembled coins, rings and core blanks were seized.The individual arrested is identified as an employee of the Ministry of Interior of North Macedonia. Authorities were alerted to the suspect’s activities through a coordinated intelligence-sharing effort.A joint investigation team (JIT) was established at Eurojust between the Special Prosecution Office of the Republic of Kosovo* on one side, and the Basic Prosecution in Skopje on the other, with the support of the Western Balkans Criminal Justice Project, hosted at Eurojust. Investigative activities carried out were supported by the Kosovo Police, the Investigative Centre of the Public Prosecutor’s Office Skopje and the Ministry of Interior of North Macedonia. Europol’s support was instrumental in this operation, providing critical intelligence analysis, operational coordination, and technical assistance to ensure the successful apprehension of the suspect.The coins seized during the searches will be further examined, comparing them to other coins already withdrawn from circulation to evaluate the real scale of the production.The EU central office for combating euro counterfeitingEuropol serves as the European Union's central office for combating euro counterfeiting, playing a pivotal role in safeguarding the integrity of the Eurozone's currency.As the hub for intelligence and operational support, Europol coordinates efforts across Member States to detect, investigate, and dismantle counterfeiting networks. The Agency provides specialised expertise, facilitates the exchange of critical information, and deploys advanced technological tools to track and analyse counterfeiting activities.The investigation was supported financially by the European Multidisciplinary Platform Against Criminal Threats (EMPACT).*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.

The Spanish National Police (Policía Nacional), supported by Europol, dismantled an organised crime network smuggling migrants with fast boats from Algeria to Spain. The suspects facilitated the further illegal movement of the migrants from Spain to other EU countries.Results from 4 and 5 June 2024:9 locations searched;21 arrests (13 in Madrid, 5 in Almeria, 1 in Guipuzcoa, 1 in Málaga and 1 in Murcia);Seizures including documents, electronic equipment and cash.Migrants paid up to EUR 20 000 to reach the EUInvestigations revealed that the criminal network smuggled at least 1 000 migrants (more than 750 Syrian nationals and over 250 Algerians). The network facilitated the illegal crossings of Syrian nationals along the route Lebanon – Egypt – Tunisia or Libya – Algeria. Upon arrival in Algeria, the migrants were placed in temporary accommodation while awaiting the launch of the boats. The suspects then organised the transport of the migrants with fast boats from Algeria to the Spanish coast. Once in Spain, members of the Algerian criminal cell facilitated the stay of the migrants and their further illegal movement towards other EU countries.Investigators identified two main organisers, one based in Algeria and one in Spain, who coordinated the criminal activities. The criminal network is believed to have had the capacity not only to transport the migrants to Spain but also to supply them with passports and plane tickets for their secondary movements towards other EU countries. In addition to smuggling activities, the criminal network also sold information to other groups on how to organise this type of criminal activity.Over 1 000 migrants on speed boats next to fuel cansThe criminal cell based in Madrid was responsible for organising the criminal activity in coordination with the criminal group based in Oran (Algeria). The latter orchestrated the launch of the fast boats with migrants, departing from the Algerian coasts of Oran and Mostaganem towards Spain. These sea crossings were extremely dangerous – migrants' lives were put at risk in overcrowded vessels that lacked safety equipment as well as food and water supplies and were loaded with fuel canisters. Upon arrival at the Spanish coast, the migrants were picked up by members of the criminal network based in the region. They were then transported to Madrid and placed in unsanitary and overcrowded housing while awaiting onward transport out of Spain. The migrants were charged up to EUR 20 000 for the full facilitation of their passage to the country of final destination. They were obliged to pay at every stage of the smuggling via the hawala underground financial system. Investigators learned that the criminal network used spy cameras and hidden microphones to guarantee the collection of money.Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to Spain to cross-check operational information against Europol’s databases and provide leads to investigators in the field.

The coordinated effort, named Operation GORGON, culminated in a series of raids carried out in Tirana, Albania, on 31 July against key figures within the criminal network. Significant assets were seized as a result, including real estate and EUR 1 million in cash.From contract killings to complex money launderingThis high-profile Albanian organised crime group was hierarchically structured, with branches operating internationally. The gang was mainly composed of family members and associates from the same area in Albania. The group’s members are suspected of being responsible for numerous contract killings, large-scale drug trafficking and the laundering of illicit profits via complex cryptocurrency transactions.Among those arrested features a prominent money launderer based in Tirana, who provided his services to several other top-level criminal groups engaged at an international level in murders, corruption and large-scale drug trafficking, among other criminal activities.The investigation also uncovered how the leader of this organised crime group and his associates ordered the killing of several members of other Albanian criminal groups by contracting hitmen. At least seven murders have been attributed to this specific criminal group between 2019 and 2020, a number of which have been carried out outside of Albania.Intelligence development by EuropolIn the framework of the analysis work carried out on SKY ECC data, Europol developed reliable intelligence on the activities of this gang.This intelligence was provided to the Albanian Special Prosecution Office for Anticorruption and Organised Crime (SPAK), which took immediate action and opened an investigation. Since then, Europol has provided continuous intelligence development and analysis in support of the national investigation, leveraging its comprehensive expertise by mobilising its various specialised centres.During the action day, three experts from Europol’s European Serious Organised Crime Centre and European Cybercrime Centre were deployed to Tirana to support the Albanian authorities with their enforcement actions.The following authorities took part in the investigation:Albania: Special Prosecution Office for Anti-Corruption and Organised Crime (Struktura e Posaçme Anti-Korrupsion), National Bureau of Investigation (Byroja Kombëtare e Hetimit), Albanian State Police (Policia e Shtetit)Belgium: Federal Police (Federale Politie)France: National Police (Police Nationale)The Netherlands: National Police (Politie)

An operation led by the Romanian Police (Poliția Română) and the Romanian Border Police (Poliția de Frontieră), supported by Europol and involving the Bulgarian General Directorate Combating Organised Crime (Главна Дирекция Борба с организираната престъпност), has resulted in the dismantling of an organised crime network involved in migrant smuggling. The suspects were smuggling migrants from Bulgaria to Romania and then to Western Europe. The investigation was also supported by Austria, Germany and Hungary.Results from 29 July 2024:9 locations searched (2 in Arad, 3 in Bucharest, 1 in Oradea and 3 in Timișoara);8 arrests (Romanian and Syrian nationals);32 migrants found in one of the safe houses searched (9 Iraqi and 21 Syrian nationals, as well as 2 others with unknown nationalities);Seizures include documents, electronic equipment and cash.Between EUR 5 000 and EUR 10 000 migrant smuggling fee to reach to Western Europe from TürkiyeThe investigations revealed that the criminal network, consisting mainly of Syrian and Romanian nationals, was operating from Bucharest and was using Timișoara as a hub for housing and facilitating the transport of migrants to Western Europe. The suspects recruited migrants from the Middle East, mainly Syria, who wanted to reach Western European countries, especially Germany.The leader of the criminal network, a Syrian national who had lived in Romania for three years, had strong ties with other key organisers based in Istanbul, Türkiye. He acted as a regional coordinator for migrant smuggling activities along that leg of the route. He allegedly recruited Romanian nationals, who usually worked as private taxi drivers, to transport the migrants. Between February and May alone, the Romanian authorities detected five smuggling incidents with a toral of 70 irregular migrants. The individuals were transported in lorries concealed between merchandises. Each migrant paid between EUR 5 000 and EUR 10 000 for the full smuggling services until the final destination.Cross-border cooperationEuropol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to Romania to cross-check operational information against Europol’s databases and to provide leads to investigators in the field. Europol also facilitated the deployment of investigators from Bulgaria to support the Romanian officers involved in the operational actions in the field.

The report highlights relevant trends in crime areas such cyber-attacks, child sexual exploitation and online and payment fraud schemes. It also provides an outlook of what can be expected in the near future, especially regarding new technologies, payment systems, AI, cryptocurrencies and illicit content online. Millions of victims exploited across the EU on a daily basisRecent law enforcement operations have prompted ransomware groups to splinter and rebrand under different disguises. Furthermore, continuous takedowns of forums and marketplaces on the dark web have shortened the lifecycle of criminal sites. This instability, combined with the surge of exist scams, has contributed to the fragmentation and multiplication of cyber threats. In 2023, millions of victims across the EU were attacked and exploited online on a daily basis:Ransomware groups increasingly target small and medium-sized businesses because they have lower cyber defences;E-merchants and banking institutions are the preferred targets of digital skimming attacks; Users continue to fall victim to phishing campaigns, business email compromise (BEC), investment and romance fraud; The number of cases of online sexual extortion targeting vulnerable minors is increasing.Multi-layered extortion tactics are increasingly common throughout the entire spectrum of cybercrime threats, as stolen data are at risk of being published and auctioned, making re-victimisation a threat. Offenders appear to be underage in many cases, and some have started leveraging AI, which is already becoming a component in their toolbox. The use of cryptocurrencies in a wider variety of crime areas has also become more noticeable. Cybercrime assisted by AI: what to expect in the near future?AI-assisted cybercrime has only begun: AI-assisted child sexual abuse material (CSAM) is a worrisome threat that will need close monitoring. Instances of AI-altered and completely artificial CSAM will pose growing challenges to law enforcement investigations, not only in terms of the volume of CSAM in circulation, but also to the ability of investigators to identify the true identity of victims and offenders.Abusing technologies: Mainstream end-to-end encryption (E2EE) communication platforms are increasingly used by offenders. The current regulatory framework for the protection of personal communications via E2EE creates digital challenges for law enforcement authorities’ lawful access to criminal communications. The future of crypto threats: The use of cryptocurrencies in a number of areas of crime has become more evident. Several developments in the cryptocurrency market are set to have a significant impact on criminals’ abuse of cryptocurrencies in the near future. Scammers could abuse the rise of exchange traded funds (ETFs) related to cryptocurrencies.  Digital challenges: law enforcement need to stay aheadTo tackle the main threats highlighted in the IOCTA 2024 quickly effectively, law enforcement needs the right knowledge, tools and legislation in place. As criminals adapt, law enforcement and legislators must also innovate to stay ahead, and seek to capitalise on new and developing technologies. This in turn requires training to produce the specialised capabilities required to investigate technically challenging or complex cybercrimes, such as those involving the abuse of cryptocurrencies or the dark web.Europol is addressing these digital challenges with its Strategy Delivering Security in Partnership. The agency is at the forefront of law enforcement innovation and acts as a knowledge platform for the provision of EU policing solutions in relation to encryption, cryptocurrencies and other issues. In doing so, Europol expands the toolbox available to law enforcement officers across Europe and beyond, increasing their technical and forensic capabilities. The European Cybercrime Centre (EC3) at Europol is the first port of call for cybercrime investigators. 

On 12 July, a pensioner was found murdered in his home in Herrsching, Upper Bavaria, Germany. The case sent shockwaves through the country, and an investigation was immediately launched by the Bavarian police to locate and arrest the suspected murderer.Through real-time intelligence exchange with its operational partners in Serbia, Europol developed reliable intelligence that the suspect had fled Germany and was hiding in France.Europol immediately provided this actionable intelligence to the German investigators and established coordination between the countries involved. The European Network of Fugitive Active Search Teams (ENFAST) was activated, connecting the different national units dealing with fugitive searches. This international police effort culminated in the arrest of the suspect in a coordinated operation in Aubervilliers, France, on the morning of 18 July. The suspect was taken into judicial detention and is currently awaiting extradition to Germany to face charges.The swift arrest of the alleged murderer underscores the power of international police cooperation, facilitated by Europol. Connecting over 3 000 different law enforcement authorities around the world, Europol provides the network and secure communication channels to close the net on criminals trying to evade justice by crossing borders.The following authorities took part in the investigation:-    France: French FAST team (OCLCO - Brigade Nationale de Recherche des Fugitifs), Judicial Police of the Paris Police Prefecture (BEDJ)-    Germany: Criminal Investigation Department of Fürstenfeldbruck,LKA Bavaria,BKA Germany -    Serbia: Ministry of the Interior of the Republic of Serbia - Police Department of Belgrade (MUP R. Srbije - Policijska uprava za grad Beograd) 

Europol has supported this investigation since August 2023. On 20 December 2023, authorities intercepted a sailboat in international waters off the coast of Martinique with 1 500 kilos of cocaine on board. Eight individuals, including the crew members and some involved through other means, were arrested that same day. Following this operation, in the framework of intelligence activities underway with its operational counterparts, Europol has been able to develop actionable intelligence regarding the drug trafficking activities of this organised crime group. This led to further investigations and operational activities involving 10 countries.The suspects were arrested as part of an international operation against drug trafficking led by the Spanish National Police (Policía Nacional). The Spanish authorities worked closely with the Norwegian Police, the United Kingdom’s National Crime Agency (NCA) and the United States Drug Enforcement Administration (US DEA) in the framework of an Operational Taskforce set up at Europol. The purpose of the taskforce was to target a drug trafficking organisation with links to the Western Balkan region which authorities suspected of shipping large amounts of cocaine to Europe.10 cocaine vessels operating between South America and the EUDuring the investigation, the agents identified a total of 10 vessels used by the organisation along the ‘drug routes’ and that the criminals had different bases of operations in Spain and South America. In Spain, they used Valencia, Alicante, Almería, Málaga and the Canary Islands as logistics points before setting sail to South America. In South America they used Brazil, Colombia, Guyana, Trinidad and Tobago, Saint Lucia, Barbados or Panama, to keep the sailboats ready to sail with the drugs. This system meant shipments could move as soon as the orders from the leader of the criminal network and his lieutenant were received.The cocaine would then be picked off the coast of the Caribbean islands by sailboats which would shortly after set sail towards Spain, from where the cocaine was distributed onwards to different EU countries by overland transport. The crew for the sailboats had been recruited in Norway by one of the leaders of the drug trafficking organisation, who Europol had designated as a High Value Target. This individual was among those arrested in Norway on 24 June.International cooperation via Europol to link drug seizures and traffickersThis operation was the culmination of many months of meticulous planning in preparation of the final phase of the action. The partners have been working closely together in the framework of a Europol Operational Taskforce to establish a joint strategy and to organise the extensive exchange of information.Europol provided continuous intelligence development to map out the targets and their criminal activity. The Agency also financed an operational meeting off-site in Madrid. During the action day, one Europol expert was deployed to Marbella (Spain) to assist with the swift analysis of data as it was been collected, helping adjust the operational strategy as required. In addition, Europol funded the exchange of Spanish and Norwegian police officers for the action day.  

During Pandora VIII, several thousand checks were carried out at countless airports, ports and border crossing points, as well as in auction houses, museums and private residences. Law enforcement also patrolled the web and conducted over 6 000 online checks, which led to the recovery of 580 stolen goods. Across the involved countries, around 113 criminal and 137 administrative cases are still ongoing, with more arrests and seizures anticipated.Operational highlightsPandora VIII led to the recovery of the following stolen artefacts, among others:In an investigation carried out by the Spanish National Police (Policia Nacional) in collaboration with the Security Service of Ukraine (Служба безпеки України), 11 items valued at more than EUR 60 million were recovered. The criminal case involved money laundering and illicit trafficking of archaeological gold items stemming from the ‘Scythian’ culture, which had been stolen in Ukraine and smuggled to Spain.In another case, the Spanish Guardia Civil of Córdoba, with the support and advice of archaeologists from the government of Andalucía as well as the Archaeological Museum of Sevilla, seized a private collection of over 350 objects. The collection consisted of lithic, ceramic and metal pieces from a variety of archaeological periods.Romanian Police (Poliţiei Române) recovered a wooden iconostasis dated between 1850-1880, which had been stolen from a church in Romania and attempted to be sold online. The Bulgarian Customs Agency (Агенция Митници) seized 432 ancient coins that came from Türkiye and were destined for France.In two investigations by the Hellenic Police (Ελληνική Αστυνομία), 43 ancient amphorae were seized and two people arrested.After performing online checks, the Polish National Police (Policja) located and seized 229 objects in an antiques store. Some of the items were made of ivory, and the total value of the 229 objects is estimated to be EUR 140 000.The Italian Carabinieri Command for the Protection of Cultural Heritage (Comando Carabinieri per la Tutela del Patrimonio Culturale) were able to identify and subsequently seize a contemporary painting that was being sold online. If authenticated, the painting would have had a value of approximately EUR 150 000. During the search, officers also found various counterfeit items.In a separate investigation, the Carabinieri seized over 2 000 fragments of ceramic and lithic artefacts such as arrowheads and spearheads. The ancient items stemming from the Neolithic and Bronze Age periods had been offered for sale online.The French Directorate-General of Customs and Indirect Taxes (Direction générale des douanes et droits indirects) seized an illegally-exported painting by the Vietnamese artist Mai Thứ (1906 - 1980) at Paris Charles-de-Gaulle Airport. The painting has an estimated value of EUR 167 440.Cooperating with other national partners, the Czech National Police (Policie České republiky) detected and checked sales of several stolen historical objects. Among others, a wooden statue of Saint Bartholomew (dated between 1658 and 1660) was secured and returned to its original owner. In 1994, this national cultural artefact had been stolen from the ‘Last Supper Chapel’ in Římov (České Budějovice) to be later sold online.International cooperation between countries and agenciesAs a co-leader of this operation, Europol played a key role by facilitating information exchange and providing analytical and operational support to the individual national investigations.INTERPOL supported Pandora VIII by facilitating the exchange of information between participating countries, notably with the Balkan countries. A dedicated officer was also available throughout the operation in order to check frontline seizures against INTERPOL’s Stolen Works of Art Database, and support officers on the ground in their use of the ID-Art App.Operation Pandora, which was first launched in 2016, is an annual law enforcement operation. It is carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).Participating countries:Albania, Austria, Bosnia and Herzegovina, Bulgaria, Czechia, Croatia, Cyprus, France, Germany, Greece, Ireland, Italy, Latvia, Malta, Montenegro, Netherlands, Norway, Poland, Portugal, Romania, Spain, Serbia, Sweden, Ukraine, United KingdomParticipating agencies:Europol, INTERPOL 

This week, Montenegrin authorities have arrested nine High Value Targets holding key positions in Western Balkan drug trafficking organisations. In total, 19 individuals were targeted in this action. Four received charges while in prison, and five others are still on the run. This action is the result of national investigations, cooperation, and information exchange through Europol between the Australian Federal Police and New South Wales Police, the Montenegrin Special Police Division (Specialno Policijsko Odeljenje), and the United States Drugs Enforcement Administration (DEA). The investigation was initiated after law enforcement intercepted 1.8 tonnes of cocaine shipments from Europe to Australia between 2020 and 2021. The targeted individuals were closely linked to various Montenegrin criminal cells active within a larger drug trafficking network spread across the Balkan region and beyond. Some of the suspects allegedly belong to one of the most notorious and violent Montenegrin clans, while others are suspected of leading their own independent criminal groups. One of the suspects, the leader of this criminal group, is allegedly responsible for multiple murders carried out during gang wars. The nine suspects were already known by law enforcement authorities, as they had appeared in a number of previous drug trafficking investigations. Investigators have identified that the networks where they played leading roles had developed a large logistics network to facilitate drug trafficking from the EU to Australia. They were able to supply cocaine from source countries and transport it for final distribution in European and Australian end markets. The action day on 17 July 2024 led to: 15 locations searched in Montenegro9 arrestsSeizures including documents, 22 firearms and 722 pieces of ammunitions, 15 vehicles, 2 vessels, luxury watches and cash. In recent years, Western Balkan criminal networks have increasingly targeted the Australian drug market, as the illegal proceeds of cocaine trafficking there are significantly higher than European markets. The supply route includes Colombia, Ecuador and Brazil, with transhipments via Southern Europe and Africa towards Australia. If one kilo of cocaine costs several thousand euros in the source countries, it could reach more than EUR 100 000 on the Australian black market.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall case coordination among various agencies in the EU and beyond.  

Europol supported two major operations against the trafficking of illegal pesticides in the EU. The first investigation targeted a company importing counterfeit pesticides from China, replicating the products of a well-known multinational company. The investigation involved the Italian Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri, NAS) of Padova, the Romanian National Police (Poliția Română) and Eurojust. In another investigation against illegal pesticides, the Spanish Civil Guard (Guardia Civil) and the Portuguese National Republican Guard (Guarda Nacional Republicana) targeted a Spanish company illegally importing Portuguese pesticides banned in Spain under the cover of fake denomination of the products. Counterfeit pesticides are largely sold on the black market. They are cheaper than the genuine products, but still effective. However, their negative impact on the environment is severe, and often underestimated by consumers.Cheap but toxic fake pesticides taken off the black marketIn January 2022, following an inspection in the framework of operation Silver Axe, the Italian NAS Carabinieri of Padova found counterfeit pesticides imported from China. The counterfeit pesticides were replicas of the genuine products, but contained larger quantities of the active ingredient Lambda-Cyhalothrin.The demand for these counterfeit pesticides on the black market was very high, as they were sold for a significantly lower price than the genuine products. The criminal network operating both in Italy and Romania illegally imported fake or banned products from China and Singapore, selling them as bio or organic fertilisers and pesticides, usingfake labels. The substances were all banned in the European Union due to their high levels of toxicity.The investigation led to two action days on 24 and 25 June in Italy and Romania. During the raids, the national authorities arrested one suspect, searched ten locations and gathered evidence of large-scale fraud, forgery and tax evasion. These actions were executed under a Joint Investigation Team, set up by Eurojust to facilitate the judicial cooperation between authorities. Europol facilitated the information exchange and operational cooperation, leading to the development of further investigative leads. Action against banned pesticides poisoning nature reserves in SpainIn another investigation, Europol supported the Spanish and Portuguese authorities in targeting a Spanish company, which purchased Portuguese pesticides banned in Spain. The ensuing investigations found that the suspects had imported over 12 tonnes of toxic substances banned in Spain, many of which were also banned across the EU, with a potential illegal turnover of up to EUR 7 million. The authorities are now investigating two legal entities and four individuals in connection with this trafficking. The company covered the product with names of products and substances, registered in Spanish databases, to create the appearance of legal merchandise. They also purchased legal pesticides to hide the additional illegal pesticides. The Spanish authorities detected the illegal products and performed laboratory tests to determine their composition, which was later confirmed in a lab test. The tests revealed the illegal substances the fake pesticides contained, one of which was Chlorpyrifos, an organophosphate insecticide which has been banned in the European Union since 2020.The banned pesticides were used in different farming facilities, some of which were located in protected areas, such as the Doñana National Park. This national park is one of the most significant ones in Spain. The illegal use of pesticides was posing significant threat to this park’s habitat, wetlands and underground water reserves. Europol facilitated the exchange of information and provided continuous analytical support to both investigations. On the action days, Europol deployed experts in the field to cross-check operational information in real time and provide experts with possible leads and technical support.

Migrant smuggling and human trafficking networks are highly adaptive and exploit geopolitical events, including economic and social crises to maximise their illegal profits. These networks swiftly identify criminal opportunities offered by the digital environment and take advantage of them to increase their illegal proceeds. Criminals abuse social media platforms, mobile applications, and cryptocurrencies to offer their illegal services, manage logistics and payments, and secure profits.In 2015, the European Union was confronted with an unprecedented migratory crisis. In response, in 2016, Europol increased its support to national law enforcement authorities with the creation of a dedicated hub – Europol’s European Migrant Smuggling Centre – to facilitate closer cross-border cooperation and the rapid exchange of operational information. In 2023 alone, Europol supported 223 operations against migrant smuggling and human trafficking networks. The agency also provided national law enforcement authorities with 1 231 operational reports to advance their investigations in 2023. Europol has further developed the concept of Operational Task Forces (OTFs) in this crime area, with 11 OTFs targeting migrant smuggling and human trafficking networks.    Main threats and developmentsInvestigations into migrant smuggling and trafficking in human beings reveal a complex and dynamic criminal environment in which actors take advantage of existing infrastructures and engage in multiple illegal activities. These criminal networks also engage in a number of other criminal activities, such as drugs and arms trafficking, document fraud and violence. Migrant smuggling and trafficking in human beings are interconnected, especially in cases where irregular migrants are in debt to their smugglers and end up in labour or sexual exploitation schemes to pay the smuggling fees. The links between migrant smuggling, terrorism and the financing of terrorism are of particular concern.The main characteristics of the criminal networks involved in migrant smuggling and human trafficking:Strong links to other crime areas and crime enablers;High flexibility and adaptability;Abuse of geopolitical, economic, environmental and social crises;Intense cooperation with other criminal networks across borders within and outside the EU; Extension of violence towards irregular migrants, law enforcement, competitors and within the criminal networks themselves;Increase in the digitalisation of core components of criminal activities.Strong partnerships to combat criminal networks globally In April 2024, Europol hosted the conference “Tackling migrant smuggling in the digital domain” under the umbrella of the European Commission initiative Global Alliance to Counter Migrant Smuggling. During this event, over 100 experts from EU Member States, third party countries, agencies and international organisations met to discuss the challenges and possible responses to migrant smuggling enabled by the use of online platforms.In June 2024, the Spanish National Police hosted the Europol’s European Migrant Smuggling Centre’s Annual Conference in Madrid, attended by representatives from law enforcement authorities in the Member States and operational partner countries, from EU agencies and bodies, international organisations, as well as from the private sector. The meeting focussed on the current threats and challenges faced by investigators. The conference also furthered the exchange of good practices and difficulties in investigating the digital dimension of migrant smuggling, aiming to strengthen the EU’s tools in the fight against this criminal threat. 

Between 2 and 3 July, a dozen searches of homes, company headquarters, commercial warehouses and restaurants were carried out. The searches involved some hundred Spanish police officers who were supported on the ground by French Judicial Customs investigators and Europol experts. The searches took place in Madrid, Valencia, Alicante, and Barcelona.The head of the criminal network is among those arrested. Close to EUR 160 000 in cash was seized during the searches.The investigation was initiated in February 2021 by the French authorities after the French Customs in Perpignan seized more than half a million euros in cash hidden in a vehicle equipped with a concealed compartment.The investigation conducted by the French National Anti-Fraud Office (ONAF) under the direction of the specialised interregional jurisdiction (JIRS) of Marseille resulted in the  uncovering of a money laundering network. Composed of Chinese nationals, the criminal network is believed to have been operating across Europe since at least 2019. This prolific criminal network is believed to have had the capacity to smuggle over one million euros in cash per day.These sums came from a number of illegal activities, including the trafficking of counterfeit goods, tax and customs fraud, and prostitution. The criminal network relied on a sophisticated network of logistic experts who would facilitate the movement of the cash across Europe.This operation was carried out with the financial support of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).The following authorities took part:France: National Anti-Fraud Office (Office national anti-fraude – ONAF)Spain: National Police (Policía Nacional) 

This coordinated operation, which was led by authorities in Switzerland and the United Kingdom, took place on 27 June 2024. The operation involved law enforcement agencies from 18 countries, working in tandem with Europol’s European Union Internet Referral Unit (EU IRU) and major online service providers.The Referral Action Day targeted a wide range of antisemitic content, including hate speech, Holocaust denial, and the glorification of violence against the Jewish community. The primary objective was to remove illegal content and ensure that online platforms adhere to European regulations concerning hate speech and discrimination.In total, close to 2 000 pieces of antisemitic content were identified and referred by Europol and the participating countries to online service providers for removal.The focus of the Referral Action Day stems from the rise of widespread antisemitism justified and cultivated in Jihadi-spheres and right-wing, as well as left-wing, extremist groups online. This antisemitic content is also spread by non-affiliated individuals on various online platforms. This surge in hate speech was triggered by the 7 October attack by the Hamas terrorist organisation against Israel and the subsequent Israeli military response.National Internet Referral Units and specialised police units from the following countries took part in this Referral Action Day:Albania, Austria, Bosnia-Herzegovina, Denmark, France, Germany, Hungary, Ireland, Italy, Lithuania, Malta, Portugal, Romania, Spain, Sweden, Switzerland, Ukraine and the United Kingdom. 

The paper delves into the problems that Home Routing creates for law enforcement agencies in carrying out their duties, as well as presents possible avenues for safeguarding and maintaining law enforcement’s ability to protect citizens and investigate criminals. What is Home Routing?Home Routing makes it possible for a telecommunication service provider to (continue to) provide a service to a customer when they travel abroad. This means that when a customer travels internationally, their communications (calls, messages and data) are still processed through their home network rather than the network of the country they are visiting.Consequently, this means the service provider abroad is not able to deliver communication data to law enforcement upon a judicial request, if the domestic service provided has enabled PET in Home Routing.Once Home Routing is deployed, any suspect using a foreign SIM card can no longer be intercepted. This problem occurs both when a foreign national uses their own (foreign) SIM card in another country, and when citizens or residents use a foreign SIM card in their own country. The only current exception for this is when a domestic service provider (to whom domestic interception orders can be sent) has in place a cooperation agreement which disables PET in Home Routing with the service provider of another country.Why is this a problem?Criminals know of this loophole, and have been abusing it to evade law enforcement. This creates an uneven equilibrium between malicious actors and law enforcement, whose capabilities at this point do not allow for them to carry out the duties society has entrusted them with.In the case of Home Routing, a national interception order cannot be enforced across borders. Instead, a European Investigation Order can be issued, but a response can take up to 120 days, which is too long when emergency interception is needed. In addition, being dependent on the voluntary cooperation of a foreign service provider for the exercise of national investigatory powers is undesirable.Way forwardWith this position paper, Europol wishes to open the debate on this technical issue, which at present is severely hampering law enforcement’s ability to access crucial evidence.A solution must be found that enables a country’s authorities to lawfully intercept the communications of a suspect within their territory, while not impeding secure communications disproportionately.The paper offers key elements which should be considered as part of the societal response, looking at operational, technical, privacy and policy aspects.Digital challengesThis position paper is part of a series of Europol publications which are pivotal in anticipating technological innovations and the resulting modifications in the security landscape.At Europol, we take our responsibility as the EU Agency for law enforcement seriously; the fundamental role of policing in democratic societies has always been to keep the public safe.To achieve this, we need to strike a balance between harnessing technical innovation for social good, such as protecting privacy rights, while preventing it from being abused for criminal purposes.Find out more about the Digital Challenges.

Abuse by cybercriminals Cobalt Strike is a popular commercial tool provided by the cybersecurity software company Fortra. It is designed to help legitimate IT security experts perform attack simulations that identify weaknesses in security operations and incident responses. In the wrong hands, however, unlicensed copies of Cobalt Strike can provide a malicious actor with a wide range of attack capabilities.Fortra has taken significant steps to prevent the abuse of its software and has partnered with law enforcement throughout this investigation to protect the legitimate use of its tools. However, in rare circumstances, criminals have stolen older versions of Cobalt Strike, creating cracked copies to gain backdoor access to machines and deploy malware. Such unlicensed versions of the tool have been connected to multiple malware and ransomware investigations, including those into RYUK, Trickbot and Conti.Cooperation with the private sector Cooperation with the private sector was instrumental in the success of this disruptive action. A number of private industry partners supported the action, including BAE Systems Digital Intelligence, Trellix, Spamhaus, abuse.ch and The Shadowserver Foundation. These partners deployed enhanced scanning, telemetry and analytical capabilities to help identify malicious activities and use by cybercriminals.  This novel approach is possible thanks to Europol’s amended Regulation which has strengthened the Agency’s capacity to better support EU Member States, including by collaborating with the private sector. Through this novel approach, Europol can gain access to real-time threat intelligence and a broader perspective on cybercriminal tactics. This partnership enables a more coordinated and comprehensive response, ultimately enhancing the overall resilience of the digital ecosystem across Europe.Europol supportEuropol’s European Cybercrime Centre (EC3) has been supporting this case since September 2021 by providing analytical and forensic support, and facilitating the information exchange between all the partners.Law enforcement used a platform, known as the Malware Information Sharing Platform, to allow the private sector to share real-time threat intelligence with law enforcement. Over the span of the whole investigation, over 730 pieces of threat intelligence were shared containing almost 1.2 million indicators of compromise.In addition, Europol’s EC3 organised over 40 coordination meetings between the law enforcement agencies and the private partners. During the week of action, Europol set up a virtual command post to coordinate law enforcement action across the globe. The disruption does not end here. Law enforcement will continue to monitor and carry out similar actions as long as criminals keep abusing older versions of the tool.The following authorities were part of the investigation:Australia: Australian Federal Police (AFP)Canada: Royal Canadian Mounted Police (RCMP)Germany: Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Politie)Poland: Polish Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)United Kingdom: National Crime Agency (NCA)United States: U.S. Department of Justice, Federal Bureau of Investigation (FBI)Authorities in the following countries supported the disruption activity: BulgariaEstoniaFinlandLithuaniaJapanSouth Korea  

Increase of child sexual abuse material onlineThe production and distribution of child sexual abuse material has become increasingly reliant on the Internet, contributing to the proliferation of this crime. Over the past three years, Europol’s database of images and videos has grown by more than 20%. Today, a phone camera has replaced the complex filming setups of past decades, enabling offenders to produce and distribute material almost simultaneously. They use end-to-end encryption applications to exchange child abuse material. Live-streaming platforms facilitate live-streamed child sexual abuse, while encrypted applications enable communication between traffickers and buyers.These technological advancements hinder investigators' efforts to identify victims and perpetrators. Additionally, AI-generated imagery further complicates efforts to safeguard children. The use of encryption by offenders and AI-generated child sexual abuse material highlights how technological developments pose additional challenges to law enforcement in ensuring public safety.Public contributions neededThe exponential increase in online child sexual abuse material means new strategies and techniques are needed in order to combat this crime. Cooperation between private and public actors is crucial to overcoming the digital challenges posed by the criminal use of new technologies. Law enforcement are exploring new technologies to help process the vast amounts of images and videos, identify series imagery depicting the same child, and narrow down the country of production to find the abusers and the children, some of whom are still in harm's way.Despite these efforts, many victims remain unidentified. Victim identification specialists scrutinise images and videos frame-by-frame to find anything that could lead to the origin, location, or identity of the victim. Some background elements, like streets, TV programs, or logos, are easily recognisable, while others are difficult and country-specific. Public assistance through tips sent via the Trace an Object Campaign can help Europol’s victim identification specialists and national law enforcement authorities narrow down the image to a country, identify the offender, and ultimately save a child.

In the early hours of 2 July, law enforcement authorities in Italy, Spain, Germany, Belgium and Ukraine raided 13 properties. As a result, seven suspects were arrested in Italy, three in Spain, one in Belgium, one in Germany and one in Ukraine. The probe was coordinated by Europol and Eurojust, and follows an investigation into large-scale drug trafficking and money laundering.Smuggling, and attempted escapes by roadThe criminal network was composed of individuals of multiple nationalities, including Italians, Spaniards, Argentineans and Colombians, who worked together to carry out their criminal deeds. The investigation uncovered how this Italian criminal network used lorries to smuggle large quantities of hashish from Spain to Italy.One of the main targets, feeling the heat from law enforcement, escaped to Ukraine by car. He hid there for several months, until his hiding place was identified thanks to the cooperation between Europol and the Italian and Ukrainian authorities. He was subsequently arrested on 2 July.Building a case through cooperationEuropol has been actively supporting the case since October 2022, bringing together investigators from across Europe to agree on a joint investigative strategy and prepare for the final phase of the action. The Agency provided continuous intelligence development and analysis to support the national investigations. More than 130 messages have been exchanged by the involved law enforcement authorities and Europol via Agency’s secure platform. Part of that support provided by Europol included the identification of suspects monitored during physical surveillance.During the action day, a Europol expert was deployed to Italy to assist the national authorities with their enforcement measures, and to facilitate the tactical cooperation amongst the concerned countries in real time.Judicial coordination on the dayTo ensure that the criminal group could not avoid justice, Italian authorities used Eurojust’s services to ensure that investigations could take place in other countries and house searches and seizures were executed. During the action, a coordination centre was set up at Eurojust to ensure the smooth running of the actions across Europe.The investigation and the Action Day have been supported by the @ON Network funded by the EU (Project ISF4@ON) led by the Italian Antimafia Investigation Directorate (DIA).The following authorities took part in the investigation:Belgium: Federal Judicial Police (Federale Gerechtelijke Politie, Police Judiciaire Fédérale)Germany: State Criminal Police Office of North Rhine-Westphalia (Landeskriminalamt Nordrhein-Westfalen)Italy: Carabinieri (Arma dei Carabinieri)Spain: National Police (Policía Nacional)Ukraine: National Police (Національна поліція України)

Some of the at least 84 confirmed victims lost their life savings when the criminals coerced them into handing over their money at their doorsteps. Spanish National Police (Policía Nacional), the Mossos d’Esquadra and the Portuguese Judicial Police (Policía Judiciária) conducted 19 raids, seizing important digital and physical evidence of the crimes. One of the main targets was caught red-handed and arrested; when police entered the house, he was sitting in front of his computer with the bank details of one of his victims up on the screen. In addition to collecting computers, laptops, mobile phones, SIM cards and freezing bank accounts, officers on the scene also found cannabis and cocaine in the searched premises.Initial vishing led to pressure tactics at victims’ doorstepsUsing a proven modus operandi and dividing the work between specialised members, the criminal network systematically targeted elderly Spanish citizens. Posing as a bank employee, a criminal would contact the victim and convince them there was a problem with his or her bank account. Referred to as ‘vishing’, a portmanteau of ‘voice’ and ‘phishing’, this criminal tactic is typically conducted over the phone.To learn more about how to avoid falling victim to this type of crime, take a look at our prevention guide.Having extracted some basic information, the impersonator shared it with other members of the criminal network, who would appear at the victims’ doorsteps. Pressuring the victims with scare tactics and social engineering, the fraudsters would take possession of payment or credit cards and extract PIN codes and bank details. In some cases, the criminals also forced their way into victims’ homes, stealing cash and valuables such as jewellery. As a final step in this criminal process, the perpetrators used the stolen cards to make ATM withdrawals or expensive purchases, while the bank details were misused for so-called account takeovers.The funds were deposited into multiple Spanish and Portuguese accounts controlled by the fraudsters, from where they were funnelled into an elaborate money-laundering scheme. An extensive network of money mules overseen by specialist members of the organisation was used to disguise the origin of the illicit funds.Fast and hard action against the criminal groupUsing Europol’s analytical and coordination capabilities, investigators from Spain and Portugal met for operational meetings and worked with Europol experts to draw up an intelligence picture. The criminal network’s structure was unveiled piece by piece, until the decisive blow could be planned and executed. Europol specialists were deployed alongside Spanish law enforcement to provide analytical and forensic support on the action day.As investigators closed in on the suspects and monitored their conversations, they heard them planning to use severe violence as a last resort to rob the victims. To halt and prevent potentially violent home invasions from occurring, the joint law enforcement effort prioritised the dismantling of this dangerous criminal network. This led to a fast-tracked action day in which the fraudsters across Spain and Portugal were taken down. 40 suspects were taken into custody in Spain, and 3 are being detained in Portugal and are awaiting extradition to Spain.Participating countries:Spain: National Police (Policía Nacional); Mossos d’EsquadraPortugal: Judicial Police (Polícia Judiciária)

Between 24 and 28 June 2024, Europol hosted an operational sprint targeting buyers of live distant child abuse material. The sprint brought together representatives from Austria, Belgium, France, Germany, the Netherlands, Spain, Sweden, Norway, the United Kingdom and the United States. During the sprint, 32 investigators processed and developed leads generated from investigations of United States Homeland Security Investigations (US HSI) into criminal networks sexually exploiting children in the Philippines. The investigators analysed tens of thousands of child sexual exploitation images and videos, along with over 10 million lines of online conversations between approximately 12 000 unique criminal customer accounts and 100 seller accounts. The operational sprint resulted in the production of information packages, which may lead national authorities of 24 countries to 197 buyers of live distant child abuse.Global coalition to identify the networks behind live-streamed child sexual abuseThe information analysed during the sprint came specifically from operations against those who produce and distribute child sexual exploitation material through live-streaming platforms. The sprint allowed investigators to learn and collaborate in person, turning raw data into actionable information in real-time.The investigators gathered during the operational sprint worked on huge volumes of data, which had been generated over 12 years. As each criminal buyer and trafficker is arrested, their digital footprint - such as chats, transaction data, location data, and IP addresses - is used to investigate more trafficking networks and rescue more children. The one-week operational sprint at Europol aimed at identifying criminal buyers around the globe who use live-streaming platforms to pay traffickers to abuse children. Some of the abused children are believed to be as young as three to four years of age.Live-streamed child sexual abuse is a growing industry, involving child traffickers in the Philippines and elsewhere who curate a vetted customer base of buyers who pay to watch the live-streamed abuse of children. Criminal buyers direct child traffickers to perform acts of sexual abuse on minor children in real-time during private webcam interactions. Customers also travel to the Philippines to engage in the hands-on abuse of victimised children themselves. Abuse happens over encrypted connections, leaving little digital evidence, which created serious difficulties for investigators targeting child abuse online.With traffickers and victims in one country and criminal buyers living around the world, cooperation between national authorities is crucial to combat online child abuse. Europol hosted the sprint at its Headquarters in The Hague, facilitated the information exchange, and provided analytical support.The US HSI operations have been supported by the Child Rescue Coalition, the Tim Tebow Foundation, and the International Centre for Missing and Exploited Children.National authorities involved:EU Member States:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt)Belgium: Federal Police (Police Fédérale)France: National Police (Police Nationale)Germany: Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Politie)Spain: National Police (Policía National)Sweden: Swedish Police Authority (Polismyndigheten)Denmark: Danish Police (Politi)Non-EU Member States:Norway: National Police (Politiet)The United Kingdom: Metropolitan Police, North Umbria Police, West Midlands PoliceThe Unites States: Homeland Security Investigations

Of the many key milestones along the road, 2010 marks a particularly important date as Europol officially became a full EU Agency within the EU’s competence. Following the terrorist attack in Paris in November 2015, Europol’s Director Rob Wainwright (United Kingdom) set up the counterterrorism Task Force Fraternité. This Task Force led to the launch of the European Counter Terrorism Centre (ECTC) in 2016. Other centres that followed this example were the European Migrant Smuggling Centre (EMSC), European Serious Organised Crime Centre (ESOCC), and the European Financial and Economic Crime Centre (EFECC). The European Cybercrime Centre (EC3) was already created in 2013. In 2019, we were mandated by ministers from all EU Member States to create an Innovation Lab to support the law enforcement community in the area of innovation. Read more about Europol’s history on our website.Serious and organised crime has changed since 1999 and adapted to new technologies and a globalised world. Between 1999 and 2024, we witnessed the advent of the Internet, cybercrime, cryptocurrencies, as well as 3D-weapons printing, and more recently AI and quantum computing. Fast-forward to today, with Executive Director De Bolle at the helm, we continue to provide a first-level response to law enforcement and initiate relevant emergency protocols on a 24/7 basis. One of the many successful cases in which we supported EU Member States was Operation LIMIT, in 2021, in which Europol supported investigators in Belgium, France and the Netherlands in blocking the illegal use of Sky ECC encrypted communication by large-scale organised crime groups. More of our key achievements and ways of working are listed in the Europol In Brief, published today to mark our twenty-fifth anniversary. This publication highlights key facts and figures about Europol in 2024. As of today, we have almost 300 liaison officers from EU Member States and third parties, such as international organisations and law enforcement authorities from outside the EU, working with us. Our workforce now stands at over 1 700 people, and we have over 3 000 secure lines to competent law enforcement authorities via our secure information exchange network application, (SIENA).Our recently-adopted new strategy ‘Delivering Security in Partnership’, provides six objectives that highlight the change in our work since we started 25 years ago. The strategy outlines how Europol will update its capacities to support complex, cross-border law enforcement investigations and analyse an increasing amount of relevant data. Europol’s six objectives will guide the organisation in implementing our main goals and vision, and in delivering a unique set of operational services.Throughout the rest of this special year for Europol, a number of events and activities will take place to celebrate our anniversary. The events will culminate in September with the European Police Chiefs Convention organised at Europol’s headquarters. 

The large-scale law enforcement operation led to the arrest of 42 suspects - including the kingpin of the gang, who was in Spain under a false identity. In addition, 28 searches were conducted at several locations in Granada, Málaga and Sevilla, in both residences and drug production facilities. Six indoor marijuana plantations were also dismantled.Overall, the action resulted in:42 arrests28 searches (20 in Granada, 6 in Málaga, 2 in Sevilla)Seizure of more than 2 tonnes of cannabis and several quantities of other drugs such as hashishThree firearms and a multitude of cartridges sizedSeizure of a dozen luxury vehicles and more than EUR 100 000 in cashEuropol provided law enforcement authorities with analytical support to bring the investigation forward. On the action day, a specialist from Europol’s European Serious Organised Crime Centre was deployed on the spot, where they worked side by side with Spanish, French and Turkish authorities.Shifting from heroin to other drugsThe investigation revealed that the criminals were specialised in the transnational trafficking of narcotics and had been importing drugs to Spain for years, including heroin but also large quantities of cannabis and hashish. Once in Spain, they would distribute them across the EU.Heroin trafficking to the EU currently relies on the use of global container transport and ferries departing from Türkiye. This is because the criminal networks dominating the wholesale trafficking of heroin to the European market mainly originate from there.Investigators believe that the criminal network began its cannabis trafficking after initially focusing on heroin. This shift to other drugs was flagged on the EU Drug Markets Analysis 2024 report as a potential result of the political changes in Afghanistan, the main source of the heroin consumed in Europe. In 2022, the Taliban announced a drug ban that led to market changes, precipitating a decrease in heroin availability in the EU that could lead to market gaps being filled by other drugs.Law enforcement authorities involved:France: French Customs (Douane – Finances)Spain: Spanish Guardia Civil (Guardia Civil)Türkiye: Counter Narcotics Department of the Turkish National Police (Türk Polis Teşkilatı)

Building on the operation’s successful previous iterations, the proven multidisciplinary approach involved Europol, Frontex and INTERPOL along with police forces and border guards from several continents. This year, one aim was to identify and disrupt the most-threatening criminal networks active in the EU, such as mafia-type, ethnicity- and family-based organisations and other structured networks engaged in trafficking of human beings. Within the criminal phenomena of sexual exploitation, forced begging and forced criminality, law enforcement put a special emphasis on targeting cases involving children as victims.Similar to actions carried out in the years prior, this large-scale and jointly-executed action aimed to encourage authorities to conduct targeted activities within their respective countries and collectively with each other for a week, but also to draw attention to this despicable crime. The results of these joint action days reached not only the authorities, but also many other external stakeholders who may have a part to play in reducing the number of victims of human trafficking.Jean-Philippe Lecouffe, Deputy Executive Director of Europol, Operations Directorate, said:Close and efficient cooperation between law enforcement and border protection authorities on an international level is key in targeting those who exploit the most vulnerable among us. The impressive results of this year’s EMPACT joint action days show that the despicable crime of human trafficking is best fought together. For this, I express my gratitude to all countries and partners that once again joined forces with Europol in this global endeavour to take down these criminal networks.Lars Gerdes, Deputy Executive Director for Operations at Frontex, said:Human trafficking is an abhorrent crime that preys on the vulnerable and undermines our shared values of human dignity and freedom. Detecting these crimes is incredibly challenging due to the frequent absence of victim testimonies, leading to a significant number of unreported cases. This is why our international cooperation with Europol, Interpol, Austria and over 39 countries worldwide is so crucial.Richard Chambers, INTERPOL Director, Organized and Emerging Crime, said:Operations such as GLOBAL CHAIN demonstrate that no country or continent is immune to trafficking and exploitation. Whether committed by family members or highly-organised crime groups, the impact on victims is devastating. As a global law enforcement community, we are committed to sharing the vital intelligence needed to bring all perpetrators to justice.276 new investigations launchedOverall results of the EMPACT joint action days:362 suspects identified;219 perpetrators arrested;1 374 (1 221 adults, 153 children) victims identified and assisted;2 074 criminal assets such as cash or devices seized;363 fraudulent documents detected;over 276 new investigations initiated.In addition to the fight against child trafficking and the most-threatening criminal networks, this international law enforcement effort saw several targeted focal points against the trafficking of human beings across the world. This included actions in Latin America, Asia, Africa as well as Eastern Partnership countries and Ukraine.During inspections conducted across the globe, officers would systematically look for signs of trafficking as well as forged documents, then arrest perpetrators and safeguard victims immediately. The inspections also resulted in the launch of several new investigations. In order to cross-check data and allow for the exchange of information between the participants, a coordination centre was established in the Frontex headquarters in Warsaw, Poland. Along with experts from each country, Frontex, Europol and INTERPOL personnel helped coordinate the large-scale action week, which was supported by the EU4FAST project.Successful operations executed across the globeThe following examples provide insight into the diverse nature of the national operations against human trafficking that were successfully conducted in the context of the EMPACT action week.In a particularly gruesome case, officers of the Szabolcs-Szatmár-Bereg Police Department (Szabolcs-Szatmár-Bereg Vármegyei Rendőr-főkapitányság) arrested a Hungarian couple for forcing six of their own children into sex as well as begging on the streets in their village. The underage children were physically, mentally and sexually abused by their own parents, with their own father assaulting them with sticks, belts and his bare hands. Officers found the children neglected, underfed and in an overall bad health condition. Tying them up in a room in the household, the parents offered their children to other persons in the neighbourhood to have sex against payment. Judicial, medical and psychological experts have been involved in confirming the sexual abuse and taking testimony of the traumatised children, who since have been safeguarded and placed under foster care.Officers from the Hungarian National Bureau of Investigation THB Unit (Nemzeti Nyomozó Iroda Emberkereskedelem Elleni Osztály) were deployed to Austria to carry out joint police checks with members of the Austrian Criminal Intelligence Service and Provincial Criminal Police Departments (Bundeskriminalamt; Landeskriminalämter Wien und Niederösterreich). The teams conducted targeted checks in red-light establishments, focusing on Hungarian sex workers. Europol facilitated and financially supported this staff exchange.Officers of the Galati Brigade for Countering Organized Crime of the Romanian Police (Poliţiei Române - Brigada de Combatere a Criminalitatii Organizate Galati) arrested one suspect for recruiting underage victims from disadvantaged backgrounds, forcing them into begging and sexual exploitation. The collected revenue was withheld by the trafficker, who used physical violence to control his victims. In a raid conducted during the action week, officers collected further evidence and questioned suspects and victims. In one of the searched locations, law enforcement officials also found and seized various narcotics.In an effort to raise awareness about this crime area, the Irish National Police (An Garda Síochána) spoke to thousands of passengers as they disembarked their trains in Dublin. Garda members were actively looking for human trafficking indicators and informing the public about the crime area. While no victims were identified, the initiative generated great engagement from the public.The National Police of Ukraine (Національна поліція України) dismantled an organised criminal group targeting vulnerable persons. Three suspects have been identified for controlling and coercing twelve victims and forcing them to beg. In another case, officers arrested a person who forced a disabled person into marriage with a man so he could achieve a deferral of his mobilisation. The victim has been safeguarded by Ukrainian authorities.Vietnamese authorities uncovered a human trafficking scheme involving a Chinese interpreter working for a company in Laos. The suspect lured 14 Vietnamese individuals with promises of high-income overseas jobs, only to force them into creating fraudulent online accounts for financial scams. Victims worked 12-hour workdays, extended to 14 hours if they failed to recruit others, and had their documents confiscated. Families were extorted up to USD 10 000 to secure their return to Vietnam. This case further highlights the trend of human trafficking for forced online fraud, first detected by INTERPOL in Southeast Asia during Operation Storm Makers in March 2022, and later in other regions, leading to the publication of an INTERPOL Orange Notice.Participating countries:Albania, Austria, Belgium, Bosnia and Herzegovina, Brazil, Bulgaria, Colombia, Croatia, Cyprus, Denmark, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Kosovo*, Latvia, Lithuania, Malta, Moldova, Montenegro, Netherlands, Nigeria, North Macedonia, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Thailand, Ukraine, United Kingdom, Vietnam*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.Participating agencies:Europol, Frontex, INTERPOL

The action day on 24 May 2024 in Almería led to:5 arrests including the suspected leader (1 Spanish, 2 Russian and 2 Ukrainian nationals)14 victims identified5 locations searchedSeizures including two luxury vehicles, in cash, electronic equipment, employment contracts for jobs in the service sector, and other various documents linked to the club where the victims were exploitedThe criminal group, active since 2020, recruited its victims online, mainly through social media platforms while presenting themselves as managers in a recruitment agency. The victims were lured with job offers for hostesses and front-of-house roles. The alleged traffickers then exploited the women, mainly Ukrainian, but also Belarusian nationals, in a prostitution club in El Ejido (Almería), Spain.The victims were targeted based on their nationality and brought to Spain with tourist visas, while being promised legitimate work in the entertainment and tourist industry. Once in Spain, they were instructed to apply for temporary protection due to the war in Ukraine. Following this process, the victims were granted residency in Spain. The young women were promised work authorisation benefits that come with this protection.However, they were deceived by the suspects. The victims did not receive any employment contract and they were then exploited through prostitution activities. The criminal group generated vast illegal proceeds through the exploitation of large numbers of women. The victims were accommodated in three homes provided by the same individual who managed the night club. By isolating the victims from the rest of society, the traffickers attempted to minimise the risks of police detection or the escape of the women, allowing them to restrain, control and fully exploit the victims.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. On the action day, Europol deployed an expert in the field to cross-check operational information in real time and provide experts with possible leads and technical support.

The investigation, initiated in April 2023, focused on a criminal network organising multi-tonne shipments to Europe of cocaine sourced in Ecuador and shipped from Colombia, Ecuador, Suriname, Guyana and Paraguay. Investigative leads link the group to possible additional shipments from West Africa. The criminal network operated from Germany, allegedly organising the logistics of their criminal activity through the involvement of large number of front companies, including transport companies and criminal associates such as administrative personnel and drivers. Between April and September 2023, law enforcement authorities in Belgium, Ecuador and Germany seized about 35 tonnes of cocaine linked to the activities of this criminal network.The action days on 31 May (in Cologne) and 5 June (in Hamburg) led to:6 arrests24 house searchesSeizures including high-end vehicles, jewellery, cash, electronic equipment and various documentsThis operation follows EU Member States’ and Europol’s efforts to provide a response to the most threating criminal networks active in the EU, especially the ones operating in the EU’s major ports. Such an operational response aims at bringing together EU Member States to effectively target these logistical networks with close ties to the command-and-control centres affecting the EU’s internal security. To better understand and counter the threat, Europol published a joint analysis report in partnership with the ports of Rotterdam, Antwerp and Hamburg/Bremerhaven that looks into the risk and challenges for law enforcement posed by criminal networks in EU ports.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall case coordination among various agencies. On the action day, Europol deployed two experts in the field to cross-check operational information in real time and provide experts with possible leads and technical support.

The servers supported multiple media outlets linked to Islamic State. They were used to disseminate worldwide propaganda and messages capable of inciting terrorism in at least thirty languages. Eurojust and Europol coordinated and supported the joint operations.This week’s joint operations are part of ongoing efforts and constant vigilance to tackle online terrorist propaganda and communications, including through social media. They targeted key tools and nodes to disseminate radical messages centred on the I'LAM Foundation, which created, operated or supported websites and other communication channels linked to the Islamic State terrorist organisation.Investigations and the continuous monitoring of online activities of terrorist organisations, led by the Spanish Civil Guard (Guardia Civil) in 2022 gave insight into the communications of media linked to the I’LAM Foundation. The traceability was complex, as they operated new and sophisticated technological infrastructures. These were hosted on servers that have since been taken down.The websites and communication channels, such as radio stations, a news agency and social media content, had a global reach. They communicated directives and slogans of Islamic State in over thirty languages, including Spanish, Arabic, English, French, German, Danish, Turkish, Russian, Indonesian and Pashto. Several terabytes of information were uncovered.The latest efforts follow previous actions, in line with the mandates of Eurojust and Europol, to support national authorities in combatting terrorists and monitoring their online activities. The seizure of computer servers in Germany, the Netherlands, the United States and Iceland was initiated by the Spanish authorities and coordinated by Eurojust, bringing in its expertise in this area.To prepare for this week’s actions, Eurojust organised a dedicated coordination meeting and assisted with the execution of European Investigation Orders and requests for Mutual Legal Assistance. The Agency also set up a coordination centre on its premises to support the authorities in all countries concerned to carry out searches and take down servers.Europol’s European Counter Terrorism Centre made its full range of services and expertise available to the investigation. Since the launch of investigative activities, Europol has provided intelligence packages mapping the web infrastructure of the targeted online assets through forensic analysis of the servers. Europol’s expertise on the terrorist propaganda landscape was instrumental in informing judicial proceedings.The Agency also organised several operational meetings, bringing together all the investigators at different critical phases of the investigation. Outreach to the private sector was another important function carried out by Europol in preparation for the action day. Its European Counter Terrorism Centre liaised with technology companies to facilitate the retrieval of electronic evidence central to the investigation. On the action day, a Europol mobile office was deployed to Spain to provide analytical support during the arrests of the suspects.The following authorities participated in the joint operations this week:Spain: Investigative Court no. 1 at Audiencia Nacional; Public Prosecutor’s Office Audiencia Nacional; Civil Guard (Guardia Civil)Germany: Public Prosecutor’s Office Nuremburg – Fürth; Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Public Prosecution Service (Landelijk Parket); National Police (Nationale Politie)United States: Department of Justice; Federal Bureau of InvestigationIceland: National Commissioner of the Icelandic Police and Reykjavik Metropolitan Police

Ten countries joined forces with Europol to disrupt the online propaganda activities of religious and politically motivated terrorist organisations across the ideological spectrum.This joint effort, known as Operation HOPPER II, targeted key assets in the online dissemination of terrorist propaganda, including those of the so-called Islamic State, al-Qaeda and its affiliates, and Hay’at Tahrir al-Sham. The operation specifically targeted terrorist-operated websites used to disseminate terrorist propaganda, thereby limiting the ability of terrorist organisations to recruit, radicalise and mobilise recruiters online.This week, Europol referred a total of 13 websites spreading terrorist propaganda to hosting service providers for removal. This follows the seizure of four servers in Romania, Ukraine and Iceland over the course of the investigation and the removal of associated websites.The referral of websites operated by terrorists, violent extremists and their supporters will continue as new copycat domains are likely to emerge.This operation was coordinated by the European Union Internet Referral Unit (EU IRU) within Europol’s European Counter Terrorism Centre. It involved law enforcement authorities from Albania, Bosnia and Herzegovina, Denmark, Germany, Iceland, Moldova, Romania, the Slovak Republic, Ukraine and the United Kingdom.Operation HOPPER II ran in parallel with the Spanish Guardia Civil’s Operation ALMUASASA, also supported by Europol, with the aim of intensifying the disruption across the terrorist ideological spectrum.Responding to the threat of terrorist-operated websitesThis operation is a crucial part of the EU IRU’s ongoing work against websites operated by terrorists and violent extremists, which serve as key platforms for the dissemination of violent ideologies.These websites enable terrorist organisations and violent extremists to bypass the enhanced moderation and content removal efforts of mainstream online service providers, allowing them to maintain a persistent online presence.They are used not only to spread propaganda and incite violence, but also to recruit members, raise funds and coordinate attacks. The content hosted on these websites often includes manuals for creating explosives and propaganda designed to radicalise and mobilise individuals.Identifying, flagging, investigating and disrupting these websites has become a key function of the EU IRU through the technical solution Europol developed in-house – the EU Platform on illicit content online (PERCI).A single system to facilitate referrals and removal ordersAt the request of the European Commission, Europol has developed a technical solution that facilitates the implementation of the Terrorist Content Online Regulation (TCO Regulation - (EU) 2021/784) by EU Member States.The TCO Regulation, which came into effect from June 2022, provides a legal framework to ensure that hosting service providers are obliged to remove terrorist content within one hour of receiving a removal order from Member State authorities. The Regulation applies to all hosting service providers offering services within the EU, including providers of social media, video, image and audio-sharing services.Europol provides a single system that connects all EU Member States with hosting service providers. Known as PERCI, this platform is managed by the EU IRU and is used to issue and transmit removal orders.In the framework of HOPPER II, PERCI played a pivotal role in centralising and coordinating the transmission of referrals to hosting service providers, thus enabling the alignment of investigative priorities.The following authorities took part in HOPPER II:Albania: State Police (Policia e Shtetit)Bosnia and Herzegovina: State Agency for Investigation and Protection (Državna agencija za istrage i zaštitu), Ministry of Internal Affairs of the Republic of Srpska (Ministarstvo unutrašnjih poslova Republika Srpska)Denmark: Danish Security and Intelligence Service (Politiets Efterretningstjeneste)Germany: Federal Criminal Police Office (Bundeskriminalamt)Iceland: National Commissioner of the Icelandic Police and Reykjavik Metropolitan PoliceMoldova: National Inspectorate of Investigations and Moldovan Informational Security ServiceRomania: Romanian Police (Poliția Română), Romanian Intelligence Service (Serviciul Roman de Informatii)Slovak Republic: Counter Terrorism UnitUkraine: Security Service of Ukraine (Служба безпеки України)United Kingdom: Counter Terrorism Policing

Targeting the full operational chain to dismantle the cocaine cartelThe internationally coordinated actions targeted the criminal network, which was orchestrating multi-tonne cocaine trafficking from Colombia, Brazil and Ecuador to the EU. The suspects arranged the trafficking into the EU through maritime shipments going via logistical hubs in West Africa and the Canary Islands. Once the drugs had reached the EU, the suspects used handling centres in Belgium, Croatia, Germany, Italy and Spain to further distribute cocaine across Europe.The leaders of the drug trafficking organisation were temporarily based in Türkiye and Dubai. From there, they operated the control and command centres of the criminal network. Investigations into this network identified a significant threat; criminal actors’ ability to collaborate closely and deploy criminal associates on a long-term basis on locations to facilitate their large-scale drug trafficking operations. International law enforcement cooperation was therefore crucial in halting the criminal activities.In August 2023, officers from the Spanish Civil Guard intercepted a vessel with 700 kilograms of cocaine on board near the Canary Islands. Intelligence analysis of historical data from the encrypted communication investigations revealed that the Croatian-Italian crew previously imported at least 500 kilograms of cocaine from Brazil to Spain via this vessel. The same operational method helped investigators to identify the coordinators and brokers, originating from the Western Balkan region. They were established as High Value Targets by the Operational Taskforce for their involvement in financing and coordinating both shipments. They are also linked to a previous interception of a tonne of cocaine, seized in September 2020 in the Canary Islands. In addition to the investigations carried out in Spain, the information exchange between countries, led by Europol, showed that investigations led by Belgium, Germany and Serbia targeted the same individuals and their associates.Results of the action day on 12 June 2024:4 arrests in Spain;7 house searches in Spain;Seizures of jewellery and luxury watches, a firearm and ammunition, EUR 109 000 in cash, as well as electronic equipment and other material evidence.Overall results of actions targeting this criminal network:40 arrests (3 of which were High Value Targets) in Brazil, Croatia, Germany, Serbia, Spain and Türkiye;Around 8 tonnes of cocaine seized in Belgium, Netherlands and Spain;Seizures of assets including EUR 12.5 million and USD 3 million in Brazil, and over EUR 50 million frozen in Serbia.Concerted actions disconnect criminal networkA number of worldwide actions had already made significant blows to the criminal network. On 11 May 2023, Serbian and Dutch authorities jointly targeted the cartel’s leadership and distribution infrastructure. Throughout the operation, authorities arrested 13 suspects and seized large amounts of weapons and assets estimated at about EUR 50 million. During another operation in October 2023, Croatian, German, Spanish and Turkish law enforcement authorities carried out a joint action against this cartel. The results included 21 arrests in Croatia and Germany and large seizures of drugs, firearms and liquidities. A month later, Turkish authorities arrested one of the network’s main leaders and his close associate, both Croatian nationals, in Istanbul.Brazilian authorities targeted the Brazilian criminal organisation that had been transporting cocaine inland from source countries to seaports in Brazil and other logistical hubs. They would then deliver cocaine shipments to West Africa, for further shipment operations coordinated by European criminal networks. The Brazilian network provided different criminal networks with a number of criminal services, including logistics, and facilitated money laundering activities. In March 2024, the Brazilian authorities carried out the last phase of an investigation into the laundering of the drug trafficking profits, which revealed that almost 500 bank accounts had handled over two billion BRL (EUR 371 million) in years prior. After the action day, the national authorities arrested two suspects. They also blocked and seized assets estimated at EUR 12 million, as well as USD 3 million in cash.Europol’s support and Operational TaskforceThe takedown of encrypted communication tools used by criminals has given international law enforcement an unprecedented insight into criminal networks and how they function. One trend that emerged was the important role played by criminal networks, largely composed of nationals from countries in the Balkan region, in the global cocaine trade. Europol created an Operational Taskforce in response to this threat. Led by members with experience working with the region, the Operational Taskforce brings together Balkan, EU and global countries, to effectively target these criminal networks.During the three years of investigative activities, Europol coordinated the information exchange between national authorities, bringing them together to efficiently target the entire drug trafficking network. In addition, Europol provided continuous intelligence development and analysis to support the field investigators. This intelligence allowed law enforcement to uncover a full picture of the covert network operating across various countries and continents. Intelligence provided by Europol contributed to some of the seizures made during the course of these investigations. During the action days, Europol deployed experts to Brazil and Spain to provide analytical and technical support to officers in the field.Law enforcement authorities:Brazil: Federal Police (Policía Federal)Belgium: Belgium Federal Police (Federale Politie / Police Fédérale)Croatia: Croatian National Police Office for Suppression of Corruption and Organised Crime; Service in Split and Croatian Drug Crime Service (Policijski nacionalni ured za suzbijanje korupcije i organiziranog kriminaliteta; Služba u Splitu i Služba kriminaliteta droga)Germany: Federal Criminal Police (Bundeskriminalamt)Italy: Public Prosecutor’s Office in Rome (Direzione Investigativa Antimafia – Centro Operativo de Palermo e Roma)Serbia: Criminal Police – Drugs Combating Service (Канцеларија за борбу против дрога)Spain: Civil Guard (Guardia Civil)Türkiye: National Police; Counter Narcotics Department/Istanbul Narcotics Division (Emniyet Genel Müdürlüğü Narkotik Suçlarla Mücadele Başkanlığı/ İstanbul Narkotik Suçlarla Mücadele Şube Müdürlüğü)United Arab Emirates: Dubai Police Force (القيادة العامة لشرطة دبي‎)

Speakers:EuropolSpanish Guardia CivilEurojustCountries involved:Albania, Bosnia and Herzegovina, Denmark, Estonia, France, Germany, Iceland, Moldova, Netherlands, Romania, Slovak Republic, Spain, Ukraine, United Kingdom, United StatesDate: 14 June 2024Time: 15:00 CESTPlace: Europol’s headquarters in The Hague, the Netherlands. This press conference will also be live-streamed on the homepage of Europol’s website.Ground rules: On-the-record press conference.RSVP: Journalists interested in attending this press conference in person at Europol’s headquarters are requested to RSVP to press@europol.europa.eu by Friday 14 June at 12:00 CEST. Please send your full name + date of birth for registration. Valid ID credentials are required for admittance.The conference room will be available for media to set up at 14:15 CEST and everything must be pre-set by 14:45 CEST. Registration is not necessary to follow the livestream. Q&A: The conference will include a Q&A. Journalists following the livestream will be invited to submit their questions via Slido.NOTE: Material for media will be made available on Europol’s and Eurojust’s websites on the day at 15:00 CEST. Inquiries by media regarding the logistics can be addressed to Europol’s press office at press@europol.europa.eu