Crime News

The investigation started in April 2022 after police discovered that a restaurant in Deurne, Antwerp, was being used as a cover for drugs sales. Many alleged members of criminal networks were known to use the restaurant as a meeting place. The lead suspect was managing a family-structured criminal group, composed of several relatives and other contacts playing various roles at all levels of the organisation. Most of the suspects have both Belgian and Albanian or Belgian and Kosovar* nationalities. This network was discovered to have close contacts with a second criminal network led by a Spanish national living in Sint-Gillis-Waas, Belgium. This criminal group was connected to the importation of hashish from Spain and extraction of cocaine shipments from Antwerp harbour. The network had access to several corrupt employees working in the area of the port. The investigation also showed that relatives of this individual, based in Spain, were active in money laundering in the regions of Almería and Granada. To avoid detection, the suspects used encrypted communication, fake identity documents and vehicles registered under false identities. They are also suspected of laundering their criminal profits through legal companies and real estate businesses based across Albania, Kosovo*, Belgium and Spain. The action day on 10 May led to: 42 house searches (35 in Belgium and 7 in Spain) 30 arrests in Belgium A restaurant closed Seizures include drugs (cocaine, hashish and cannabis); weapons, ammunition, silencers and bulletproof vests; forged documents and mobile phones; assets including 14 vehicles, a camper, luxury watches, EUR 50 000 in a bank account and about EUR 60 000 in cash.  Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. Europol additionally provided an in-depth analysis of the encrypted communication datasets, as well as financial support for the organisation of the operational activities. On the action day, Europol deployed two experts to Antwerp, Belgium, to cross-check operational information in real-time and support the investigators on the ground. The investigation and the Action Day itself have been supported by the @ON Network funded by the EU (Project ISF4@ON) led by the Italian Antimafia Investigation Directorate (DIA). *This designation is without prejudice to positions on status, and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.   

Arrests: 4 arrests in Germany  House searches: 8 house searches (5 in Bulgaria and 3 in Germany) Seizures: Cash, jewellery and gold as well as narcotics, dangerous objects, data carriers and suspected manipulated slot machines  Modus operandi: Human trafficking for sexual exploitation: the members of the clan-based criminal network forced their victims into street prostitution in Heilbronn, Germany. The suspects allegedly abused, restrained and inflected physical violence on their victims. Europol’s contribution: Europol facilitated the information exchange and provided intelligence and analytical supported. Europol also provided coordination and financial support to the operational activities. EMPACT: Trafficking in human beings  For additional information, please reach out to Europol’s Press Office.   

Known as Pandora VII, this operation was led by Spain (Guardia Civil), with the support of Europol and INTERPOL. This iteration of the annual Pandora operation consisted of an operational phase which ran between 13 to 24 September 2022 and which saw several thousands of checks being carried out at various airports, ports and border crossing points, as well as in auction houses, museums and private houses.  Two cyber patrol weeks were organised in the course of Pandora VII, in May and October respectively, with over 8 495 checks being conducted online and 4 017 stolen goods seized. Some 130 investigations are still ongoing, as a result of which more seizures and arrests are anticipated as investigators around the globe go after those spoiling and destroying cultural heritage. Operational highlights  Pandora VII led to the recovery of the following stolen artefacts, among others:  77 ancient books in Italy which the Italian Command for the Protection of Cultural Heritage (Arma dei Carabinieri) seized from an online marketplace. The books had been stolen from the archives of a monastery.  A Roman marble bust of a woman which was recovered by the Civil Guard (Guardia Civil) in Sevilla, Spain. The sculpture is believed to represent Salonia Matidia, the niece of the emperor Traian. 3 073 ancient coins, seized from an online sales platform by the Polish Police Service. An additional 117  Dacian and Roman coins were also recovered by Romanian law enforcement after an archaeological site was looted.  48 religious sculptures and other religious artefacts were recovered by the Portuguese authorities. These objects are believed to have been linked to a series of 15 robberies carried out in churches across northern Portugal between 1992 and 2003. An additional 41 religious and liturgical objects (icons, altarpieces mouldings, etc.) were also confiscated by the Hellenic Police after a house search in Greece.  13 archaeological artefacts (jewellery, among other things) from the Russian Federation were seized at a post office in Bosnia and Herzegovina.  International cooperation  The following countries took part in Pandora VII: Austria, Bulgaria, Czech Republic, Croatia, Cyprus, Greece, Ireland, Italy, Poland, Portugal, Romania, Spain, Sweden and Bosnia and Herzegovina. Europol played a key role in implementing the entire operation by facilitating information exchange and providing analytical and operational support.  INTERPOL, through its I-24/7 secure communication system, connected countries in the Balkans and the European Union participating in the exchange of information, supporting the entire operation with a dedicated expert to double check searches against INTERPOL’s Stolen Works of Art Database in order to locate and identify items that had been stolen and items that were still missing. Officers on the ground also made use of ID-Art, INTERPOL’s mobile app. Operation Pandora, which was first launched in 2016, is an annual law enforcement operation. It is carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). 

The criminal network under investigation was led by several powerful ‘Ndrangheta families based mainly in the town of San Luca, which is in the Italian province of Reggio Calabria. Some of these families have been involved in decades-long clan violence known as San Luca feud, culminating in massive shootings in Italy and abroad, such as the Duisburg massacre in Germany in 2007. Members of the criminal network were engaged in criminal conspiracy not only by being part of a mafia-style organisation, but also by being responsible for drug trafficking, firearms trafficking, illegal firearms possession, money laundering, fraudulent asset registration, tax fraud and tax evasion, as well as the aiding and abetting of fugitives (who have since been arrested). Two of these fugitives had been on the EU Most Wanted list.   Staggering list of criminal activities The Italian criminal network was mainly devoted to international drug trafficking from South America to Europe, as well as Australia. Authorities uncovered that the network was working in partnership with the Colombian organised crime group ‘Gulf Clan’ and a crime group operating in Ecuador and multiple European Countries. Furthermore, the ‘Ndrangheta clans were involved in international firearms trafficking from Pakistan to South America, providing weapons to the notorious criminal group PCC (Primeiro Comando da Capital) in exchange for cocaine shipments. Investigators tracked the flow of money in an extensive global money laundering system, with massive investments in Belgium, Germany, Italy, Portugal, Argentina, Uruguay and Brazil. The criminal group was investing its profits in real estate, restaurants, hotels, car wash companies, supermarkets, and other commercial activities. In order to pay for cocaine or to transfer illicit assets, the criminals often relied on facilitators using the hawala system. Police and judicial authorities in lockstep Eurojust supported the involved authorities by establishing and funding two joint investigation teams. The agency also hosted ten coordination meetings and set up a coordination centre to enable rapid cooperation between the judicial authorities involved in the action day. Three linked cases were opened at Eurojust at the request of the Italian, German and Belgian authorities. Eurojust also facilitated the transmission and execution of European Investigation Orders. Europol’s Analysis Project on Italian Organised Crime supported the investigation as a priority case. It provided intelligence packages and cross-match reports to the national investigative units involved. In total, more than 200 SIENA messages were exchanged among the countries involved. Besides supporting the investigation itself, the Analysis Project also supported the searches for the three fugitives. The agency also hosted case officers appointed by national investigative units, in order to analyse the encrypted communication that had been gathered. On the action day itself, Europol deployed specialists with mobile offices on the spot in all three countries. The investigation and the Action Day itself have been supported by the @ON Network funded by the EU (Project ISF4@ON) led by the Italian Antimafia Investigation Directorate (DIA). Participating authorities: Italy: PPO Reggio Calabria, National Antimafia and Counterterrorism Directorate, Carabinieri in Locri Germany: PPO Düsseldorf, PPO Koblenz, PPO Munich, PPO Saarbrücken, State Criminal Police Office North Rhine-Westphalia, State Criminal Police Office Rhineland-Palatinate, Bavarian State Criminal Police Office, State Criminal Police Office Saarland, Federal Criminal Police Office Wiesbaden (for analysis) Belgium: Federal PPO in close collaboration with PPO Limburg, Investigating judge Court 1ste Instance  Limburg/section  Tongeren, Federal Judicial Police of Limburg Portugal: Departamento Central de Investigação e Ação Penal (Central PPO),  Polícia Judiciária- UNCT and Gabinete de Recuperação de Ativos (ARO) France: GPO Aix en Provence, PPO Nice Directorate for Investigating Organized Crime and Terrorism, Prosecutor’s Office attached to Court of Appeal AIX en PROVENCE, prosecutor ‘s office of tribunal of Nice , and the attached  Police Directorate for Criminal Investigation    Romania: Directorate for Investigating Organized Crime and Terrorism, Prosecutor’s Office attached to Court of Appeal Timisoara, Police Directorate for Criminal Investigation, Arad Police Service for Criminal Investigation Slovenia: Investigative Judge Nova Gorica, PPO Nova Gorica and National Police, Central Directorate for Criminal Police Spain: Investigative Court in Torremolinos (num 4), Central Court num 3 at Audiencia Nacional; International Cooperation Sections of the Spanish Prosecution Service in Málaga and Antidrug PPO

This operation, codenamed SpecTor, was composed of a series of separate complementary actions in Austria, France, Germany, the Netherlands, Poland, Brazil, the United Kingdom, the United States, and Switzerland.  Intelligence packages as basis for investigations Europol has been compiling intelligence packages based on troves of evidence provided by German authorities, who successfully seized the marketplace’s criminal infrastructure in December 2021. These target packages, created by cross-matching and analysing the collected data and evidence, served as the basis for hundreds of national investigations. The vendors arrested as a result of the police action against Monopoly Market were also active on other illicit marketplaces, further impeding the trade of drugs and illicit goods on the dark web. As a result, 288 vendors and buyers who engaged in tens of thousands of sales of illicit goods were arrested across Europe, the United States and Brazil. A number of these suspects were considered high-value targets by Europol. The arrests took place in the United States (153), the United Kingdom (55), Germany (52), the Netherlands (10), Austria (9), France (5), Switzerland (2), Poland (1) and Brazil (1). A number of investigations to identify additional individuals behind dark web accounts are still ongoing. As law enforcement authorities gained access to the vendors’ extensive buyer lists, thousands of customers across the globe are now at risk of prosecution as well. Marketplace operator arrested in Austria and extradited to the United States A national of Croatia and Serbia, suspected of launching and operating “Monopoly Market” in 2019, has been extradited from Austria to the United States in June 2023. The suspect had been located and arrested in Vienna in November 2022 and was detained awaiting possible extradition to the United States since then. He was responsible for launching and operating the darknet marketplace for the purpose of selling drugs, and had been identified following this complex international law enforcement investigation supported by Europol. As the marketplace’s operator, the suspect reviewed and approved vendor applications and received commissions on sales executed through his platform. In order to launder his illicit cryptocurrency, the suspect used at least two cryptocurrency exchange services to move the illicit proceeds between blockchains in order to “clean” them, before selling them to Serbia-based traders in exchange for fiat currency. Illicit marketplaces on the dark web In the run-up to this coordinated operation, German and U.S. authorities also shut down ‘Hydra’, which was the highest-grossing dark web market with an estimated revenue of EUR 1.23 billion, in April 2022. The Hydra takedown saw EUR 23 million in cryptocurrencies seized by German authorities.  In terms of arrests, the operation was even more successful than previous operations codenamed DisrupTor (2020) with 179 and Dark HunTor (2021) with 150 arrests. It shows once more that international collaboration between police authorities is key for combatting crime on the Dark Web. Commenting on Operation SpecTor, Europol’s Executive Director, Catherine De Bolle, said: Our coalition of law enforcement authorities across three continents proves that we all do better when we work together. This operation sends a strong message to criminals on the dark web: international law enforcement has the means and the ability to identify and hold you accountable for your illegal activities, even on the dark web.  Europol‘s role Europol’s European Cybercrime Centre facilitated the information exchange in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at the Europol headquarters in The Hague, the Netherlands. After cross-checking evidence through the Europol databases, Europol analysts prepared target packages and cross-matched reports containing valuable data to identify vendors on the dark web. Europol also coordinated the international law enforcement action. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer. Authorities taking part in Operation SpecTor: Austria: Criminal Intelligence Service Austria with various Provincial Criminal Police Departments (Bundeskriminalamt und Landeskriminalämter) France: French Customs (Douane) Germany: Federal Criminal Police Office (Bundeskriminalamt), Central Criminal Investigation Department of Oldenburg (Zentrale Kriminalinspektion Oldenburg), General Prosecutor’s Office in Frankfurt/Main – Cybercrime Center (Generalstaatsanwaltschaft Frankfurt/Main, Zentralstelle zur Bekämpfung der Internetkriminalität), Berlin Police (Polizei Berlin), various police departments (Dienststellen der Länderpolizeien), German Customs Investigation (Zollfahndungsämter) Netherlands: National Police (Politie) Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości) Brazil: Civil Police of the State of Piauí (Polícia Civil do Estado do Piauí), Civil Police of the Federal District (Polícia Civil do Distrito Federal), National Secretariat of Public Security - Directorate of Integrated Operations and Intelligence - Cyber Operations Laboratory (Laboratório de Operações Cibernéticas da Diretoria de Operações Integradas e de Inteligência – Secretaria Nacional de Segurança Pública) Switzerland: Zurich Cantonal Police (Kantonspolizei Zürich) and Public Prosecutor's Office II of the Canton of Zurich (Staatsanwaltschaft II) United Kingdom: National Crime Agency (NCA), National Police Chiefs’ Council (NPCC)  United States: The Department of Justice (DOJ), Federal Bureau of Investigation (FBI), U.S. Drug Enforcement Administration (DEA), U.S. Postal Inspection Service (USPIS), U.S. Immigration and Customs Enforcement (ICE)’s Homeland Security Investigations (HSI), U.S. Customs and Border Protection (CBP), Financial Crimes Enforcement Network (FinCEN), Bureau of Alcohol, Tobacco, and Firearms (ATF), Naval Criminal Investigative Service (NCIS), Department of Defense (DOD), U.S. Food and Drug Administration (FDA) Office of Criminal Investigations, Internal Revenue Service Criminal Investigation (IRS-CI)  

Arrests: 9 arrests   Victims safeguarded:  5  Assets seized: Assets worth over EUR 1.1 million, including cash, high value vehicles and property Modus operandi: The suspects – all Bulgarian nationals, are believed to have trafficked young women to the United Kingdom for sexual exploitation. They targeted their victims on social media and used the loverboy method to lure them to the United Kingdom. Once there, the girls were advertised by this criminal organisation on adult services websites. The criminals routinely used violence to coerce their victims.  Europol’s contribution: Europol has been supporting this case since 2021 by facilitating the information exchange between the authorities involved and providing analytical support to map out the key targets and criminal activity. A Europol officer was deployed to Bulgaria on the action day to assist the investigators with the live analysis of data as it was being collected. 

ICC President Piotr Hofmański said: I look forward to the enhanced cooperation and interaction which will take place under this Working Arrangement. Europol’s expertise and specialist knowledge is world-leading and the ICC is fortunate to be able to benefit from it. I am confident that the strengthened relationship between the ICC and Europol can enhance the capacity of both our organisations to discharge their respective mandates aimed at ensuring that serious crimes do not go unpunished. Europol Executive Director Catherine De Bolle said: The signature of this working arrangement is an important step forward for the international efforts to hold to account those guilty of some of the world’s worst crimes. At Europol, war crimes, crimes against humanity and genocide have been part of our mandate since 2017. We have received contributions on war crimes from over 20 different areas of conflict, such as Syria, Iraq, Libya and most recently Ukraine. This new level of cooperation with the ICC will allow for a more effective response to core international crimes, with all relevant actors working together and sharing information and resources to end impunity. Under this arrangement, the cooperation may include the exchange of specialist knowledge, evidence gathering, general situation reports, results of strategic analysis, information on criminal investigation procedures, information on crime prevention methods, the participation in training activities as well as providing advice and support in individual criminal investigations. The ICC is the first permanent, treaty-based, international criminal court established to help end impunity for the perpetrators of the most serious crimes of concern to the international community, namely war crimes, crimes against humanity, genocide and the crime of aggression.  Europol is the European Union’s Agency for Law Enforcement Cooperation. It serves as the centre for law enforcement cooperation, analytical expertise and criminal intelligence in Europe.  

In April 2022, the České Budějovice Branch of the Czech National Organised Crime Agency, the National Investigation Team for Trafficking in Human Beings of the Helsinki Police Department, and the Criminal Intelligence Department of the Hungarian National Bureau of Investigation jointly participated in an action day targeting the criminals behind this sexual exploitation network. Europol coordinated first action day, which was followed by further action days, during which the Finnish and Czech authorities executed additional arrest warrants. Overall results of the operation include: 13 suspects arrested  15 victims identified during the action days 90 victims identified during the investigation timeframe 10 houses searched EUR 200 000 in cash, 4 luxury vehicles, 3 apartments, 40 mobile phones, 4 laptops and 4 tablets seized as well as 8 bank accounts frozen a shotgun and ammunition seized Victims faced despicable treatment by “operators” So-called “call operators” within the organised criminal network kept the victims in control. The operators’ role was to advertise the victims on ‘adult service websites’ and manage their online profile. These Czech women would then also set up the victims’ meeting agendas and control the types of sexual services that would be provided. In some cases, the main perpetrators also used specific victims, known as ‘Alphas’, to exercise control over the others.  The 400 victims forced into sexual exploitation were mostly advertised as Czech women regardless of their true nationality. They often worked under extreme duress, deprived of their earnings and kept in constant check by the criminals. In the event they were allowed to return home, members of the criminal network would take large parts of their savings and extort more money using threats and violence.  Internet and the pandemic as catalysts for sexual exploitation The criminal network was well-organised and capable of acting remotely from different locations, mostly in the Czech Republic and Finland. It had a good understanding of the sex market in Finland and other Scandinavian countries and actively tried to balance the women offered by rotating them throughout different locations. As people spent more time on the internet during the COVID-19 pandemic, the medium gained importance in the facilitation of trafficking of human beings.  Sexual exploitation activities did not stop during the mandated lockdowns during the height of the pandemic. The victims were advised and supported by the perpetrators to make use of ‘boyfriend invitations’ in order to circumvent the strict entry rules enforced by certain countries. In some cases, the so-called boyfriend invited several women and received free sexual services in exchange. Investigations also show an increased trend of female suspects working within the exploitation chain. Certain women escaped being subject to exploitation and violence by applying their digital skills and exploring new roles as ‘Alphas’, thus becoming an active part of the criminal network.  The role of Europol and Eurojust Eurojust established a joint investigation team in August 2021, and Europol supported the operation by deploying members of Analysis Project Phoenix with a mobile office to perform rapid, on-the-spot cross-checking as well as providing forensic support during the action days. Europol’s Analysis Project Phoenix deals with different forms of exploitation, with current priority areas linked to sexual and labour exploitation, forced criminality and begging, forced marriages, child trafficking and human organ trafficking.

Overall results include: 50 arrests Seizures of almost 5 tonnes of hashish and 2 tonnes of cocaine Seizure of equipment, including boats, 350HP engines, almost 4 000 litres of gasoline, vehicles, trailers, jams detectors and beacons used for tracking shipments. The year-long investigation discovered that the criminal network had established a multi-product trafficking scheme with a two-way supply chain. This consisted of the trafficking of hashish from Morocco to South America, and cocaine back across the Atlantic and via the west coast of Africa before being transported to the Spanish mainland. The cocaine was smuggled in containers and transported using fast boats that were also used for smuggling hashish. Initially, the investigators identified members of the organisation, based in Huelva and the Gibraltar area, as being involved in maritime drug trafficking throughout the Iberian Peninsula. The investigation revealed that the leaders of the organisation were also based in these two areas, while other members were operating in Morocco, Portugal and the Canary Islands. This investigation shed light on a new development: hashish-trafficking networks have established links with cocaine-trafficking organisations and are using their existing supply chain to diversify their drug portfolio and optimise their logistics in the drive for higher profits.  Europol facilitated the exchange of information and provided continuous analytical support to the investigation. On the two action days, Europol deployed experts to Spain to cross-check operational information in real time and provide leads to officers in the field.

Arrests: 17 arrested (mainly Albanian nationals) in the provinces of Cadiz, Malaga, Madrid and Toledo; 20 individuals searched for Seizures: luxury cars and watches, mobile phones, computers, hard drives, firearms, gold cutlery, jewels and luxury items, EUR 142 000 cash; important amount of drugs seized throughout the investigation (10 tonnes of cocaine and 10 tonnes of hashish) Assets frozen: 25 vehicles and 22 properties with an estimated value of EUR 4.2 million as well as bank accounts of 14 individuals and 30 companies Modus operandi: Drug trafficking: smuggling of hashish from Morocco and smuggling of cocaine from South America (Ecuador) to the EU in shipment containers via EU ports. Well-structured family-based organised crime network. Laundering of illicit profits through the misuse of legal business structures Europol’s contribution: Europol’s European Financial and Economic Crime Centre provided intelligence and analytical and operational support since the onset of the case. On the action day, Europol deployed two money laundering specialists to Spain to cross-check in real-time operational information against Europol’s databases and provide leads to investigators in the field. EMPACT: Criminal Finance, Money Laundering and Asset Recovery For additional information, please reach out to Europol’s Press Office. 

The members of the criminal network purchased various legal goods and exported them to other countries in trucks. This served as a cover for concealing drugs in the transport vehicles. Swedish law enforcement authorities identified two such shipments, one consisting of 200 kilos of cannabis bound for Gothenburg, and another consisting of 300 kilos of cannabis headed for Stockholm. This led to the arrests of six members of the criminal network in Sweden in mid-February, as well as to the arrest of a seventh suspect in Spain and seizures including more than EUR 200 000 in cash, jewellery, watches and electronic equipment.  Two weeks following these arrests, authorities detected another drug shipment. A special operation targeting this shipment was soon instigated, leading to the seizure of 44 kilos of marijuana, the arrests of the drivers, and the interception of additional accomplices involved in the drug trafficking operation. The home searches related to these actions uncovered indoor cultivation of cannabis and saw the seizures of 250 marijuana plants. In total, Spanish and Swedish authorities arrested 14 (7 in Spain and 7 in Sweden) individuals for their suspected involvement in this drug trafficking network. Previously, five other suspects connected to this network were arrested in Sweden. Europol facilitated the exchange of information and provided tailor-made 24/7 tactical and analytical support. Furthermore, Europol supported the operational coordination related to this investigation. 

These coordinated actions in 2021 led to a wealth of new information and evidence, which enabled the operations of March 2023. Previously, the financial damage caused by the scam was estimated to be at least EUR 15 million. However, based on the new information, the criminal network behind the fraudulent scheme has caused much more financial damage and created many more victims. Eurojust supported the actions by setting up a joint investigation team to look into the online fraud scheme in January 2023, and by organising two dedicated coordination meetings to prepare for the new actions. Eurojust also assisted with the execution of European Arrest Warrants, European Investigation Orders and requests for Mutual Legal Assistance. During the action days, 33 German police officers and investigators participated in the actions on the ground in Bulgaria, Romania, Georgia and Israel, supported by Europol specialists. To support the investigation, Europol set up a dedicated Operational Task Force, through which it facilitated information exchanges and provided analytical support. During the most recent action days, Europol deployed experts to Israel and – remotely – to the coordination centre at Eurojust. During the actions, a range of high-value assets were seized, including luxury watches, electronic equipment, cash, bitcoins, bank cards and numerous documents and data carriers. The criminal network behind the fraud attracted investors with professional-looking banners on websites and publicity via social media, using call centres in various European countries. The scammers encouraged their victims to make small initial investments of between EUR 200 and 250, showing high profits via fake graphics and software.  The victims were then contacted by so-called personal financial advisors, who promised even higher profits on bigger investments. These higher investments were then subsequently lost, and the illegal profits were paid into the perpetrators’ bank accounts. The fraud scheme allegedly ran between 2019 and 2021, with the suspects of the operations in 2021 or their associates recently setting up call centres in Bulgaria and Romania.  Due to low interest rates during this period, investors were attracted to investing in high-risk financial instruments, such as binary options. These are often susceptible to fraud and are therefore used in online scams. Such options are, in most cases, fixed amounts of money, serving as a guarantee for risky financial transactions or theoretical asset pricing.  The operation was carried out on the ground by: Germany: Public Prosecutor’s Office Göttingen; Central Criminal Investigation Department Braunschweig  Bulgaria: Sofia City Prosecutor’s Office, General Directorate National Police to the Ministry of Interior Romania: Directorate Investigating Organised Crime and Terrorism; General Inspectorate Romanian Police Georgia: Prosecutor General’s Office of Georgia Israel: National Cybercrime Unit in LAHAV 433  

During a coordinated action day in March 2023, law enforcement arrested five suspects in Belgium, another suspect in Spain, and seized various criminal assets. The criminal network had relied on investments in cryptocurrencies and the distribution of cash via an underground banking system. A main money laundering method was via investment in luxurious real estate projects in the EU, as well in several Moroccan cities. Results of the operation include: 1 person arrested in Belgium1 person arrested in SpainEUR 1.2 million in cryptocurrencies seized3 real estate properties seized EUR 50 000 in cash, one luxury car, several luxury watches and jewellery seized 23 phones, three safe boxes, and a money counting machine seizedCross-border collaboration of police forcesLaw enforcement started to look into the case in October 2021, after analysing decrypted SKY ECC messages indicating the presence of a large-scale criminal network importing cocaine and laundering illicit profits. The investigation revealed large amounts of cocaine trafficked from various South American ports to several maritime ports and airports in Europe. By using contact persons at these various entry points, the organisation succeeded in importing several tonnes of cocaine and selling it on for a massive profit. Using a professional and flexible approach, involving methods such as the use of cover companies, the criminals managed to evade the authorities until the decryption of the SKY ECC network. Europol has been providing analytical and operational support since March 2022, by confirming links with other countries and identifying new connections. An Operational Task Force was set up to tackle criminal organisations working as underground banks, thus financing criminal activities and laundering illegal profits of other criminal organisations. On the action day, a Joint Coordination Centre was established in Leuven (Belgium), where members of Europol and the Spanish Guardia Civil were deployed. Specifically, Europol provided support on location by deploying a money-laundering specialist, an analyst and a cryptocurrency specialist.

Simultaneous actions were also carried out across the globe against the users of this platform, resulting in 119 arrests, 208 property searches and 97 knock and talk measures.  This international sweep was led by the U.S. Federal Bureau of Investigation (FBI) and the Dutch National Police (Politie), with a command post set up at Europol’s headquarters on the action day to coordinate the different enforcement measures being carried out across the globe.  Genesis Market was considered one of the biggest criminal facilitators, with over 1.5 million bot listings totalling over 2 million identities at the time of its takedown.  Why was Genesis Market so dangerous?  Genesis Market’s main criminal commodity was digital identities. This marketplace would offer for sale what the market owners referred to as ‘bots’ that had infected victims’ devices through malware or account takeovers attacks.  Upon purchase of such a bot, criminals would get access to all the data harvested by it such as fingerprints, cookies, saved logins and autofill form data. This information was collected in real time – the buyers would be notified of any change of passwords, etc.  The price per bot would range from as little as USD 0.70 up to several hundreds of dollars depending on the amount and nature of the stolen data. The most expensive would contain financial information which would allow access to online banking accounts.  The criminals buying these special bots were not only provided with stolen data, but also with the means of using it. Buyers were provided with a custom browser which would mimic the one of their victim. This allowed the criminals to access their victim’s account without triggering any of the security measures from the platform the account was on. These security measures include recognising a different log-in location, a different browser fingerprint or a different operating system.  In addition, unlike other criminal marketplaces, Genesis Market was accessible on the open web, although obscured from law enforcement behind an invitation-only veil. Its accessibility and cheap prices greatly lowered the barrier of entry for buyers, making it a popular resource among hackers.  The law enforcement response The takedown of Genesis Market was a priority for law enforcement given the platform’s ability to facilitate all types of cybercrime.  Europol’s European Cybercrime Centre (EC3) has been supporting this investigation since 2019 by coordinating the international activity with the help of the Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol. EC3’s support included data analysis, the organisation of operational meetings and the facilitation of the information exchange. A command post was also set-up at Europol’s headquarters in The Hague, the Netherlands to ensure the smooth running of the action day across the world.  Eurojust actively facilitated the cross-border judicial cooperation between the national authorities involved. The Agency hosted a coordination meeting in March 2023 to prepare for this week’s operation and hosted a command center on 4 April to resolve any legal issues arising during the parallel operations in 13 countries. Commenting on this operation, the Head of Europol’s European Cybercrime Centre, Edvardas Šileris, said: Through the combined efforts of all the law enforcement authorities involved, we have severely disrupted the criminal cyber ecosystem by removing one of its key enablers. With victims located across the globe, the strong relationships with our international partners were critical in the success of this case. How to tell whether your data was stolen  With over 1.5 million bots listed on Genesis Market, chances are that your credentials have already ended up for sale on this criminal marketplace.  The Dutch Police has developed a portal to check whether your information has been compromised. Visit https://www.politie.nl/checkyourhack and fill in your email address to control whether it is part of a Genesis Market leak.  If your digital identity has been stolen, here are the steps you should take: Run your antivirus programme. In most cases, your antivirus will catch the malware and remove it. Only then should you change all your passwords – not before if you do not want the cybercriminals getting their hands on them.  Notify relevant stakeholders. Your bank, insurance company and any other important third party should be made aware of your identify theft. Remember that cybercriminals are quick at adapting their techniques to benefit from any opportunity. There are simple preventive actions you can take to make it more difficult for them to access your devices and data:  If available, use antivirus software on all your electronic devices. Keep your software updated, including your browser, antivirus and operating system. Browse and download only official versions of software and always from trusted websites. Be wary while browsing the internet and do not click on suspicious links, pop-ups or dialog boxes. Think twice before clicking on links or attachments within unexpected emails. Set up unique passwords. Generate strong passwords or passphrases for each individual website and service. This is where the use of a password manager comes in handy. Activate multifactor authentication functionality whenever possible for all of your accounts. The following law enforcement authorities took part in this investigation:  Australia: Australian Federal Police (AFP), State and Territory Police Forces Canada: 25 Law Enforcement Agencies supported by Sûreté du Québec (SQ) & Royal Canadian Mounted Police (RCMP) Denmark: National Police (Politi) Estonia: Police and Border Guard Board (Politsei ja Piirivalveamet) Finland: National Bureau of Investigation (Keskusrikospoliisi/ Centralkriminalpolisen) France: National Police (Police Nationale) Germany: Federal Criminal Police Office (Bundeskriminalamt) Italy: National Police (Polizia di Stato) Netherlands: National Police (Politie) New Zealand: New Zealand Police - Ngā Pirihimana o Aotearoa Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości) Romania: National Police (Poliția Română) Spain: National Police (Policia Nacional) and Civil Guard (Guardia Civil) Sweden: Swedish Police Authority (Polisen) Switzerland: Federal Police (fedpol), Cantonal Police of Zurich (Kantonspolizei Zürich) United Kingdom: National Crime Agency (NCA) United States: Federal Bureau of Investigation (FBI)

The EU’s critical infrastructure - notably highways, railways and ports - enable the EU way of life, where free movement of goods and people is a foundational and major factor for economic growth, personal freedom and prosperity. Criminal networks however, driven by the constant desire of growing profits and expansion of their illegal activities, are increasingly working toward the infiltration of and control over major logistical points. EU ports are examples of such major hubs, which is why the Security Steering Committee of the ports of Antwerp, Hamburg/Bremerhaven and Rotterdam, together with Europol, agreed to draft a joint analysis report assessing the threat of infiltration of port infrastructure by organised crime in the EU. Main findings: The use of misappropriated container reference codes (or so-called PIN code fraud) is gaining traction among criminal networks as a modus operandi for extracting illicit goods from ports.  Criminal networks arrange the infiltration of ports by coordinating local networks of corrupted port insiders. As a side effect of the criminal operations in ports and the rivalry it entails, violence often spills out of major transportation hubs onto the streets of surrounding cities, where competition for distribution takes place. Main recommendations: International information exchange on the criminal networks’ activities in ports with Europol and amongst EU Member States should be further enhanced. Continuous attention must be paid to the integration of security features in the design of port infrastructure. Implementing public-partnerships to involve all port actors essential for tackling the infiltration of criminal networks in EU ports. Ylva Johansson, Commissioner for Home Affairs said: The Europol report on criminal networks in ports illustrates what we are up against. It lays bare the sophistication of criminal drug gangs, their strength, and their savagery. The drug traffickers promote corrupt actions and practices sometimes by bribery, sometimes by intimidation. We are working with authorities at all levels to strengthen systems in the fight against the criminal activity this report outlines. Europol’s Executive Director Catherine De Bolle said: Criminal networks work closely to evade security at land borders and at air and maritime ports. They have one thing in mind – profit. An effective response is closer collaboration between the public and private sector; this will make both sides stronger. This report, the first ever created in cooperation with the ports of Antwerp, Rotterdam, Hamburg/Bremerhaven, is part of building this common front. This information exchange has led to deeper knowledge, which is the most effective weapon against organised crime. Vulnerabilities of EU ports Maritime ports in the EU handle some 90 million containers each year, but authorities are able to inspect only between 2% and 10% of them. Meanwhile, it is estimated that in the last few years, at least 200 tonnes of cocaine have been trafficked trough the ports of Antwerp and Rotterdam alone. This logistical hurdle represents a challenge for law enforcement and an opportunity for criminal networks needing to access logistical hubs to facilitate their criminal activities. Such criminal networks have therefore infiltrated ports in all continents.  Europe’s three biggest ports, namely those in Antwerp, Rotterdam and Hamburg, are among the most-targeted by criminal infiltration. The main way criminals do this is through the corruption of shipping companies’ personnel, port workers, importers, transport companies, and representatives of national authorities among other actors, whose actions are necessary to secure the entry of illegal shipments. However, this approach requires corruption of a large number of accomplices.  In order to focus their efforts and minimise the risks of losing merchandise, organised criminals are seeking new modus operandi that require the corruption of far fewer individuals. Europol’s analysis report on criminal networks in EU ports looks into one specific technique, which exploits misappropriated container reference codes. This requires the corruption of just one individual, along with either the corruption or a Trojan horse style infiltration of extraction teams, who are then paid between 7 and 15% of the value of the illegal shipment.   Download and read the report.     

Arrests: 12 Assets recovered: 2.2 tons of marijuana, 8.7 tons of hashish, and 942 kg of cocaine worth around EUR 165 million  Modus operandi: A high-risk criminal network consisting of different organised crime groups responsible for smuggling drugs from Morocco and South America and setting up a wholesale distribution network has been disrupted. The criminal network had a long history of operating across multiple EU jurisdictions, with its main operations in Poland, Spain, Germany, Denmark, Sweden, Switzerland, and the Netherlands. The network used lorries to transport large quantities of drugs for further distribution in other countries. Polish citizens residing in Spain or working as drivers in Polish transport companies were the main actors. Among the detainees is a man suspected of organising the smuggling of 3.2 tons of cocaine in 2020. The cocaine was found in barrels containing frozen pineapple pulp. Europol’s contribution: Europol supported this investigation by delivering extensive analytical support, the establishment of an Operational Task Force, organising operational meetings and providing operational coordination between the involved Member States. It delivered relevant and valuable intelligence that helped to reveal the network, the role of each member, and the dominant position of the high-value target. Lastly, Europol coordinated the action day against the criminal network and deployed an expert with a mobile office. For additional information, please reach out to Europol’s Press Office. 

Most of the seized alarm and signal weapons were models produced in Türkiye before a change in national legislation related to their production. These weapons had been imported into the EU and legally offered for sale in Bulgaria and other Member States. Once sold however, they were often trafficked across borders and converted into lethal weapons in other countries within or outside the EU. This conversion process involves modifying the weapons to make them capable of firing live ammunition, which is illegal. Once converted, the weapons are distributed via illicit channels, contributing to the proliferation of illegal firearms. Operational results 143 house searches 22 arrests 129 firearms seized 1 492 unconverted and converted alarm and signal weapons seized 24 735 rounds of unconverted, converted, and live ammunition seized 6 hand grenades, 276 kilos of dynamite, 299 detonators, and over 21 kilos of gun powder seized Common effort against illegal firearms This operation, known as Conversus, was led by the Romanian National Police (Poliția Română) in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). It culminated in an action week coordinated by Europol between 20-24 February 2023, involving law enforcement from 31 countries, alongside Eurojust and the European Commission. EMPACT activity concerning illicit firearms aims to build an intelligence picture of the situation of convertible weapons in the EU. This allows Member States to take operational measures against persons who illegally purchase, convert or traffic alarm and signal weapons. Coordinated hit against weapons traffickers The Romanian National Police, together with the other participating countries, collected data on suspected weapons traffickers. At the same time, data collection activities were carried out in certain Member States where these types of weapons can be legally purchased without prior authorisation. Europol analysed the collected data and drafted intelligence packages to inform the countries on targets and sales of weapons. These packages served as input for the coordinated action days in February this year. The following countries took part in this coordinated action: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Latvia, Luxembourg, Netherlands, Poland, Portugal, Romania, Slovenia, Spain, Sweden, Albania, Kosovo*, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, United Kingdom * This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ Opinion on the Kosovo declaration of independence.  

 On 30 March, simultaneous actions were carried out in Brazil with Europol’s support to dismantle the criminal group that reached from Paraguay to Europe. A total of 15 individuals were arrested, and over EUR 80 million worth of assets were seized.  Over the course of the investigation, over 17 tonnes of cocaine linked to this criminal organisation were seized, with an estimated street value of several billions of euros.  Bringing down the whole network  Known as Operation HINTERLAND, this two-year long investigation culminated in a series of actions carried out simultaneously on 30 March to bring down the entire criminal infrastructure linked to this group.   Enforcement measures were carried out against the criminal organisation responsible for the multiple cocaine shipments, its suppliers as well as its money-laundering structure. This action day was coordinated from two command centres in Porte Alegre and Rio Grande (Brazil).   The operation in Brazil resulted in:  37 property searches 15 arrests The seizure of 173 vehicles and one aircraft The freezing of bank accounts of 147 individuals and 66 companies In addition, steps are being taken in Spain to locate and seize assets belonging to members of the criminal organisation.  Intelligence-led operation The investigation was initiated in Brazil after the Brazilian Federal Police received intelligence from the German Customs on a seizure in December 2020 of 316 kilograms of cocaine in Hamburg (Germany). The initial information suggested that a Brazilian company was being used for shipping cocaine from Brazil to Europe.  Based on the analysis carried out by Europol and the French authorities (OFAST), the Brazilian Federal Police was able to fully map out the criminal network which had until then mostly operated under the radar.  The investigators were able to uncover how this Brazilian drug trafficking organisation was importing cocaine from Paraguay concealed in lorries, before exporting it to Europe.  A first arrest was carried out in October 2022 by the Brazilian Federal Police. A priority target was arrested in Paraguay for his alleged involvement in running the logistics between Paraguay and Brazil, and negotiating directly with the suppliers in Paraguay and Bolivia.  The final rounds of arrests on 30 March was the culmination of many months of surveillance, intelligence gathering and coordination between the various law enforcement authorities involved in preparation for the action.  Europol support  Europol’s European Serious Organised Crime Centre has been supporting this case from the onset, bringing together the countries involved to uncover the actual magnitude of the criminal activity, to establish a joint strategy and to organise the exchange of evidence needed to prepare for the final phase of the investigation.  In addition, Europol has been providing continuous intelligence development and analysis to support the investigators in the field.  The following authorities took part in this investigation:  Brazil: Federal Police (Polícia Federal) France: National Police (Police Nationale – OFAST) Germany: Customs (Zoll) Spain: Civil Guard (Guardia Civil)

Influential clients contribute to criminal activities worth EUR 1.5 million The criminal network was found to be supplying a large number of clients across Romania and the European Union. The Romanian suspect had close ties with gyms in Romania, which the networks supplied with the illegal goods. Some of their clients were well-known social media influencers with popular dietary and nutrition channels, as well as prominent entertainment personalities who often appeared in broadcast media. The suspects used instant messaging applications and dark web marketplaces to reach customers in other EU countries. To disguise the origin of the products, they used labels from famous e-commerce marketplaces to package the parcels. They then received payments in cryptocurrencies and used crypto-mixers to launder the criminal assets. Based on Europol’s analysis and the information provided by the investigators, it is estimated that the criminal profits may have reached EUR 1.5 million. Results of the action day on 29 March 2023:  37 house searches (22 in Moldova in the counties of Chisinau, Briceni, Telenesti and 15 in the counties of Iași, Bacău, Bucharest, Constanța and Sibiu in Romania); 11 arrests in Romania (4 main organisers and 7 facilitators);  Illegal lab dismantled and over 1 million pills found at the production site; 42 litres of injectable anabolic steroids;  6.5 kg of various active powders; 20 000 vials with multiple doses of Trenox, Trenbolone H, Boldenone, Primobolan, Terstosterone, Masteron, Sustanon, Clenbuterol;  28 000 vials Mastera, Tren Mix, Testoviron, Evogene, Stanoject; 340 000 anabolic steroid tablets containing various products such as Danamed, Testomed, Decamed, Provimed, Anadrol, Stanobol, Dianabol, Vikalis; 433 syringes and 8 500 labels; Assets seized include 5 cars, luxury watches, EUR 47 000, USD 15 000, over MDL 190 000, over ROL 40 000, luxury watches and precious stones, electronic equipment, two crypto “cold” wallets and bank cards. Special surveillance leads to the arrests  The national authorities deployed special investigative techniques to gain a better understanding of the criminal activities. Through these techniques, the investigators discovered that the criminal activity was logistically well-planned and had an effective overall organisation. There were four main organisers, one Romanian and three Moldovans. The investigations revealed that every Tuesday, all three Moldovans travelled by car in Romania. From Wednesday to Thursday or Friday, they produced the illegal pharmaceuticals in the factory. Once the production was ready, the Moldovan suspects supplied the Romanian suspect in charge of distribution.  Europol supported the investigation with operational coordination and analysis and, during the action day, deployed one expert to Romania and one to Moldova to cross-check operational information in real-time and provide leads to officers in the field. During the course of the investigation, Europol also provided financial and cryptographic analysis.  Eurojust supported the authorities involved by setting up and funding a joint investigation team. Europol’s IPC3 (Intellectual Property Crime Coordinated Coalition), which supported the investigation, is a project co-funded by the EUIPO to combat intellectual property crime.

During the raids, investigators uncovered a large number of mobile devices in both Belgium and Spain, which were used by the suspects to communicate with clients and send instructions to victims. This reveals that there was no direct victim-client communication and that the suspects could retain control over the victims. The victims had no choice but to accept any client, with the services to provide, location and payment already arranged by the criminal network. In total, authorities identified more than 200 victims. Over the past 3 years, the investigators monitored about 3 000 advertisements linked to that network, suggesting that the real number of the victims is much higher.  Forensic sub-focus of the operational taskforce Lotus  The online aspect was an important facilitation factor in the functioning of this sexual exploitation ring. The joint investigative activities enabled by Task Force Lotus has led to the dismantling of an important part of this network. The investigations are however not over; as part of this task force, Europol organised a one-week forensic sprint to coordinate and speed up the follow-up investigations.  During this week, 15 experts from Belgium, Denmark, Germany, The Netherlands, Norway, Poland, Spain and Switzerland extracted together tens of terabytes of data from hundreds of seized devices. By carrying out this extraction jointly, as opposed to each participating country performing this work for itself, the process took a few days instead of potentially months. The result of these common efforts will serve operational analysis and further investigations into the activities of this human trafficking network. 

Arrests: 104 individuals arrested Seizures: 3 500 tons of non-compliant pallets (estimated sale value of EUR 2 000 000) and other packaging that did not meet mandatory legal requirements for their use in international trade and shipment. Modus operandi: 148 criminal offenses detected, including crimes against natural resources and the environment, crimes against industrial property, crimes of misappropriation, belonging to a criminal organisation, theft, and fraud. Europol’s contribution: Operational coordination, information exchange with Spanish authorities, operational analysis. For additional information, please reach out to Europol’s Press Office.

Their insights are compiled in Europol’s first Tech Watch Flash report published today. Entitled ‘ChatGPT - the impact of Large Language Models on Law Enforcement’, this document provides an overview on the potential misuse of ChatGPT, and offers an outlook on what may still be to come.  The aim of this report is to raise awareness about the potential misuse of LLMs, to open a dialogue with Artificial Intelligence (AI) companies to help them build in better safeguards, and to promote the development of safe and trustworthy AI systems.  A longer and more in-depth version of this report was produced for law enforcement only.  What are large language models?  A large language model is a type of AI system that can process, manipulate, and generate text.  Training an LLM involves feeding it large amounts of data, such as books, articles and websites, so that it can learn the patterns and connections between words to generate new content.  ChatGPT is an LLM that was developed by OpenAI and released to the wider public as part of a research preview in November 2022. The current publicly accessible model underlying ChatGPT is capable of processing and generating human-like text in response to user prompts. Specifically, the model can answer questions on a variety of topics, translate text, engage in conversational exchanges (‘chatting’), generate new content, and produce functional code.  The dark side of Large Language Models As the capabilities of LLMs such as ChatGPT are actively being improved, the potential exploitation of these types of AI systems by criminals provide a grim outlook. The following three crime areas are amongst the many areas of concern identified by Europol’s experts:  Fraud and social engineering: ChatGPT’s ability to draft highly realistic text makes it a useful tool for phishing purposes. The ability of LLMs to re-produce language patterns can be used to impersonate the style of speech of specific individuals or groups. This capability can be abused at scale to mislead potential victims into placing their trust in the hands of criminal actors. Disinformation: ChatGPT excels at producing authentic sounding text at speed and scale. This makes the model ideal for propaganda and disinformation purposes, as it allows users to generate and spread messages reflecting a specific narrative with relatively little effort. Cybercrime: In addition to generating human-like language, ChatGPT is capable of producing code in a number of different programming languages. For a potential criminal with little technical knowledge, this is an invaluable resource to produce malicious code.  As technology progresses, and new models become available, it will become increasingly important for law enforcement to stay at the forefront of these developments to anticipate and prevent abuse.  Read Europol’s recommendations and the full findings of the report here. *** Important notice: The LLM selected to be examined in the workshops was ChatGPT. ChatGPT was chosen because it is the highest-profile and most commonly used LLM currently available to the public. The purpose of the exercise was to observe the behaviour of an LLM when confronted with criminal and law enforcement use cases. This will help law enforcement understand what challenges derivative and generative AI models could pose. *** About the Europol Innovation Lab  The Europol Innovation Lab helps the European law enforcement community to make the most of emerging technologies by finding synergies and developing innovative solutions to improve the ways in which they investigate, track and disrupt terrorist and criminal organisations. The Lab leads several research projects and coordinates the development of investigative tools with national law enforcement authorities.  Read more about the Lab’s work.

Europol supports national authorities through operational coordination, cross-border investigations and establishing links between field actors. This is also Europol’s role in such exercises; helping Member States improve connections and build up common operational capabilities.  Following the successful conclusion of the exercise, Europol’s Deputy Executive Director Jean-Philippe Lecouffe remarked: Europol is well-placed to bring networks together. Europol hosts ATLAS and supports numerous other Europe-wide networks such as the European Surveillance Group. Common exercises are fundamental to increasing the preparedness of Special Intervention Units for cross-border operations. Their readiness directly translates into making Europe safer. Surveillance and intervention units – the ones you (almost) never see Terrorist plot foiled. Kidnapped child retrieved. These are the results, but how they are achieved is something that we (almost) never see. Can criminals and terrorists escape by crossing a border? Can a potentially dangerous suspect be tracked while travelling in another country to commit an attack?  Intervention and surveillance units are on the ground every day, sometimes 24/7. We almost never see them: this is a job well done. There is of course a challenge – special units from different countries have to cooperate closely, communicate swiftly, and coordinate all activities in real time. The use of common systems facilitates this coordination, permits joint exercises and - most importantly – builds operational networks that bring together specialised units from across the EU.   Tracking suspected terrorists across Europe The exercise focused on a fictional terrorist plot. The scenario started in Ireland, from where two suspects took a plane to Austria. Surveillance teams from Ireland and Austria were then joined by counterparts from Belgium, France, Switzerland, Germany, and Luxembourg, who followed the targets across borders while gathering information about the individuals’ nefarious plans. This coordination and exchange of information led to the final assault, which took place in the Netherlands – fictional arrests of the two suspects for planning a terrorist attack. Coordinated from Europol’s headquarters, this exercise put all national teams in a real time situation. This was the first time the two networks had worked this closely together, successfully coordinating an operation across fifteen national borders. The ATLAS network is a cooperation platform of 38 Special Intervention Units of EU Member States and associated countries, Iceland, Switzerland, Norway and the United Kingdom. The development of the EU security landscape in recent years has highlighted the need of well-trained and EU-wide interoperable Special Intervention Units to strengthen law enforcement responses in Europe. Europol has hosted the Support Office of the ATLAS network at its headquarters since 2019, in order to enhance that close cooperation.  The European Surveillance Group is a network of covert surveillance units from the EU Member States and associated countries Norway, UK and Switzerland. Europol has been supporting the network since its foundation in 2007.   

Arrests: 49 arrests and 87 house searches – including repetitive criminals, CSEM producers and child sexual molesters. Seizures: In total 92 computers and 170 storage devices – so far within seized digital media about 170 thousands of files depicting sexual abuse of children had been recovered. The forensic review is ongoing.  Modus operandi: Production, possession and distribution online of pictures and videos depicting child sexual abuse and exploitation Europol’s contribution: Europol provided most of the data to Poland, Europol provided analytical and operational support since the onset of the case.  For additional information, please reach out to Europol’s Press Office.

ChipMixer, an unlicensed cryptocurrency mixer set up in mid-2017, was specialised in mixing or cutting trails related to virtual currency assets. The ChipMixer software blocked the blockchain trail of the funds, making it attractive for cybercriminals looking to launder illegal proceeds from criminal activities such as drug trafficking, weapons trafficking, ransomware attacks, and payment card fraud. Deposited funds would be turned into “chips” (small tokens with equivalent value), which were then mixed together - thereby anonymising all trails to where the initial funds originated.  A service available both on the clear and on the darkweb, ChipMixer offered full anonymity to their clients. This type of service is often used before criminals’ laundered crypto assets are redirected to cryptocurrency exchanges, some of which are also in the service of organised crime. At the end of the process, the ‘cleaned’ crypto can easily be exchanged into other cryptocurrencies or directly into FIAT currency though ATM or bank accounts.  EUR 2.73 billion in crypto assets laundered with “chips” The investigation into the criminal service suggests that the platform may have facilitated the laundering of 152 000 Bitcoins (worth roughly EUR 2.73 billion in current estimations) in crypto assets. A large share of this is connected to darkweb markets, ransomware groups, illicit goods trafficking, procurement of child sexual exploitation material, and stolen crypto assets. Information obtained after the takedown of the Hydra Market darkweb platform uncovered transactions in the equivalent of millions of euros.  Ransomware actors such as Zeppelin, SunCrypt, Mamba, Dharma or Lockbit have also used this service to launder ransom payments they have received. Authorities are also investigating the possibility that some of the crypto assets stolen after the bankruptcy of a large crypto exchange in 2022 were laundered via ChipMixer.  Europol facilitated the information exchange between national authorities and supported the coordination of the operation. Europol also provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through operational analysis, crypto tracing, and forensic analysis. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. National authorities involved: Belgium: Federal police (Police Fédérale/Federale Politie) Germany: Federal Criminal Police Office (Bundeskriminalamt) and General Prosecutors Office Frankfurt-Main (Generalstaatsanwaltschaft Frankfurt/Main, Zentralstelle zur Bekämpfung der Internetkriminalität) Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości) Switzerland: Cantonal Police of Zurich (Kantonspolizei Zürich) USA – Federal Bureau of Investigation, Homeland Security Investigation, Department of Justice  

According to the investigation, the perpetrators used a Romanian company to purchase the precursors (raw materials) and incorporate them into two pharmaceutical products, 50 and 120 milligram tablets of ephedrine and pseudoephedrine. They used a formula that allowed them to quickly extract these precursors afterwards for the production of methamphetamine in clandestine laboratories. One of the suspects was partner and director of this company. The tablets produced in Romania were shipped to companies in several European countries that purchased them without having a marketing authorisation in those countries. The tablets did not reach their declared destination, but were sent to various locations in Poland. From there, the shipments were split into smaller quantities and delivered to the Czech Republic and Slovakia, where they were distributed to clandestine laboratories.  Using the 'Czech method' of producing methamphetamine in clandestine laboratories, approximately 0.70 kg of methamphetamine was obtained from one kilogram of ephedrine/pseudoephedrine hydrochloride. Between January 2021 and February 2023, the members of the criminal group allegedly organised the transport and delivery of 168 788 870 tablets containing ephedrine and pseudoephedrine (approximately 6.7 tonnes of ephedrine hydrochloride), from which a total quantity of at least 4.7 tonnes of methamphetamine could be produced. During joint action days from 26 February until 2 March, 16 suspects were arrested in the four countries involved.  In Poland, 3 184 500 pills containing ephedrine for a value of approximately EUR 840 000 (PLN 4 012 470) and 121 776 pills containing pseudoephedrine were seized. Additionally, PLN 366 200, EUR 177 215, USD 260 and CZK 1 400 were also seized. A total of EUR 148 163, CZK 711 082 and PLN 22 433 were seized from bank accounts in the Czech Republic. Cash was also found and seized during the searches. In Slovakia, EUR 1 129 220 was seized. A joint investigation team (JIT) among involved countries was set up in November 2022 with the support of Eurojust. The Agency also hosted three coordination meetings to facilitate judicial cooperation and provide support for the coordinated investigative efforts. Europol has been supporting the investigation since August 2022 by facilitating the information exchange, cross-checking operational information against its databases and providing analytical support. A Europol mobile office was also deployed to Slovakia on the day of action to assist the national authorities with their investigative measures.   The following authorities took part in this investigation: Czech Republic: Regional Public Prosecutor´s Office in Ostrava, Czech Police, National Anti Drug Unit  Poland: The National Prosecutor´s Office Department for Organized Crime and Corruption in Katowice and Wroclaw, Police Central Bureau of Investigation in Katowice and Wroclaw and Polish Border Guard in Nowy Sacz Romania: Prosecutor’s Office attached to the High Court of Cassation and Justice – Directorate for Investigating Organised Crime and Terrorism – Central Structure – Department for Combatting Drug Trafficking; Romanian National Police Directorate for Countering Organised Crime – Central Antidrug Service, and the Directorate for Special Operations Slovakia: Regional Public Prosecutor´s Office in Žilina, Presidium of the Police Force National Crime Agency Drug Headquarters  

The main motive for organised crime is financial gain. Identifying and confiscating the profits of international criminal networks is therefore a top priority for law enforcement, and Europol has provided significant support in the field of asset recovery in recent years. This is a crucial mechanism for deterring criminal activity, and law enforcement agencies worldwide are investing great resources into asset recovery than ever before.  This is what led to the establishment of Europol’s European Economic and Financial Crime Centre (EFECC) by Executive Director Catherine De Bolle in 2020. While providing operational and analytical support to Member States and Europol’s partners, EFECC is also primarily focused on tracing, identifying, and freezing criminal assets. This has proven to be invaluable in light of the growing complexity of investigating criminal networks, a development influenced by improvements in technology and growing instances of cross-border crime. The pandemic also illustrated that a key characteristic of criminal networks is their agility in adapting to and capitalising on changes in the environment in which they operate. According to EU Directive 2014/42/EU Tracing and identification means any investigation by competent authorities to determine instrumentalities, proceeds, or property that may be derived from criminal activities;   Freezing means the temporary prohibition of the transfer, destruction, conversion, disposal or movement of property or temporarily assuming custody or control of property;  Confiscation means a final deprivation of property ordered by a court in relation to a criminal offence.  But how are criminal assets defined? Assets are any property, movable or immovable, tangible or intangible, held by an individual or a legal entity. They are criminal whenever their origin is tainted. This can include, inter alia, the: direct proceeds of a crime (e.g. the jewellery stolen from a shop); indirect proceeds of a crime (e.g. a car purchased thanks to the money from the stolen jewels); instrumentalities of crime (e.g. the car used to commit the jewellery robbery).  Financial investigations determine what assets are criminal, and which assets are eligible for recovery proceedings. This is where Europol’s asset recovery unit can provide essential expertise. Cracking down on criminals’ lavish lifestyles Most criminals are motivated by financial gain. Criminals aim to use stolen funds to create lavish lifestyles and often go to extreme measures to hide the origins of their illicit gains. In 2018, Europol aided the French Gendarmerie in arresting a suspect behind an international corruption and money laundering scheme. The suspect had initially faked his own death, fled his country of origin, and was found living in a French castle. In 2022, the suspect was sentenced in France to four and a half years in prison, including six months suspended and a fine of EUR 100 000. The estate he had purchased was also confiscated as it was considered an indirect proceed of his crimes. More recently, Europol provided analytical and operational support to the Spanish police in an operation that took down a criminal network involved in drug trafficking across multiple member states. Europol was decisive in uncovering a variety of methods used to transfer and launder the illicit profits generated by drug trafficking. These include the clandestine transport of large amounts of cash, the use of the informal value transfer systems and investments in luxury goods such as yachts, watches, vehicles or real estate and property renovations. The criminal network further invested in companies located in several European countries and used loans and mortgages to businesses to launder illicit funds. Europol’s resources in asset recovery were also deployed in the context of the Russian invasion of Ukraine in 2022. Operation Oscar, conducted with the support of Eurojust and Frontex, supported financial investigations by EU Member States targeting criminal assets owned by individuals and legal entities that had been sanctioned in relation to the conflict. As well as targeting criminal assets themselves, Operation Oscar supports Member State investigations into circumvention of sanctions. But how does Europol make these operations happen on the ground? Who are the people doing the investigating, and what tools do they use for their work? Asset recovery offices Each EU country has an asset recovery office and these offices can communicate directly with each other and with Europol via SIENA, Europol’s secure messaging platform for use by law enforcement. The decision to create a network of asset recovery offices was established in 2008 by the EU Commission as a new approach for connecting law enforcement authorities dealing with asset recovery in different countries. As part of this decision, all EU Member States were required to have an asset recovery office. According to the 2021 SOCTA, from 2016 to 2020 the volume of information exchanged among asset recovery offices in the EU doubled, while staffing levels increased by 18 % on average, displaying the need for these specialised teams and the importance of international cooperation. This network is particularly effective as each office has a legal requirement to answer any request from another office within one week. Europol co-chairs this platform with the EU Commission and performs a crucial role in connecting the different offices. Creating international asset recovery networks Criminals transfer and spread their assets across multiple jurisdictions and make it increasingly difficult for national authorities to trace, freeze and confiscate them. They then use these assets to invest in further criminal activity or to facilitate ostentatious lifestyles that they cannot sustain. Most of the time, criminals do not necessarily hide their profits, they simply reinvest them in further criminal activities. When it comes to laundering money, criminals use numerous techniques including investing in works of art and real estate, amongst other options. CARIN Another important network in the field of asset recovery is the Camden Assets Recovery Inter-Agency Network. CARIN’s mission is to enhance efforts that deprive criminals of their profits. This network was established in 2004, with the permanent secretariat located at Europol and staffed with Europol specialists. As part of this network, members can gather to discuss strategic topics related to asset recovery and ways to improve cases. In 2022, CARIN worked on the following topics: best practices in asset management; asset recovery and anticorruption; asset recovery in response to international aggressions; strengthening ARINs (Financial Action Task Force projects). CARIN’s membership comprises 61 jurisdictions - EU and non-EU - and 13 organisations that are either members or observers. As of 2023, CARIN (together with the other alike asset recovery networks created worldwide) can reach out to 174 jurisdictions.  As part of CARIN, there are points of contact in all participating countries. One of the main advantages of this is that law enforcement is able to quickly and effectively contact their counterparts in different jurisdictions all over the globe. For example, CARIN specialists from countries that are continents apart can rapidly get in touch via the network and successfully recover stolen assets. Through CARIN we have a very trusted community of asset recovery practitioners, and this enables us to connect the dots as never before. Frédéric Pierson, European Financial and Economic Crime Centre Legislation All activity by law enforcement regarding asset recovery is subject to a robust legal framework which is currently under revision, as policymakers look to enhance its strength. The pillars of the EU regime are Council Decision 2007/JHA/845 and Directive 2014/EU/42 which sets minimum rules for the freezing, management, and confiscation of criminal assets. Member States have various interpretations and applications of laws related to asset recovery. There is currently a proposed Directive on asset recovery and confiscation which will make it easier for police to identify, freeze and manage assets. It will also cover all relevant criminal activities carried out by organised crime groups, enabling confiscation of all relevant assets.  Ensuring crime doesn’t pay Europol functions as the central hub around which international asset recovery offices and networks revolve, and it links countries so that they can clearly see patterns of criminal activity. Each of the instruments described in the article is part of a bigger picture, targeting the financial incentives that spur organised crime.  This international cooperation, and Europol’s role in creating it, is therefore crucial in ensuring that crime doesn’t pay.  

This ransomware appeared in 2019, when cybercriminals started using it to launch attacks against organisations and critical infrastructure and industries. Based on the BitPaymer ransomware and part of the Dridex malware family, DoppelPaymer used a unique tool capable of compromising defence mechanisms by terminating the security-related process of the attacked systems. The DoppelPaymer attacks were enabled by the prolific EMOTET malware. The ransomware was distributed through various channels, including phishing and spam emails with attached documents containing malicious code — either JavaScript or VBScript. The criminal group behind this ransomware relied on a double extortion scheme, using a leak website launched by the criminal actors in early 2020. German authorities are aware of 37 victims of this ransomware group, all of them companies. One of the most serious attacks was perpetrated against the University Hospital in Düsseldorf. In the US, victims payed at least 40 million euros between May 2019 and March 2021.  During the simultaneous actions, German officers raided the house of a German national, who is believed to have played a major role in the DoppelPaymer ransomware group. Investigators are currently analysing the seized equipment to determine the suspect’s exact role in the structure of the ransomware group. At the same time, and despite the current extremely difficult security situation that Ukraine is currently facing due to the invasion by Russia, Ukrainian police officers interrogated a Ukrainian national who is also believed to be a member of the core DoppelPaymer group. The Ukrainian officers searched two locations, one in Kiev and one in Kharkiv. During the searches, they seized electronic equipment, which is currently under forensic examination.  Europol on-site to speed up forensic analysis of seized data On the action days, Europol deployed three experts to Germany to cross-check operational information against Europol’s databases and to provide further operational analysis, crypto tracing and forensic support. The analysis of this data and other related cases is expected to trigger further investigative activities. Europol also set up a Virtual Command Post to connect the investigators and experts from Europol, Germany, Ukraine, the Netherlands and the United States in real time and to coordinate activities during the house searches. Europol’s Joint Cybercrime Action Taskforce (J-CAT) also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. From the beginning of the investigation, Europol facilitated the exchange of information, coordinated the international law enforcement cooperation and supported the operational activities. Europol also provided analytical support by linking available data to various criminal cases within and outside the EU, and supported the investigation with cryptocurrency, malware, decryption and forensic analysis. 

Specialised counter terrorism units from 17 countries worked hand in hand with Europol’s European Counter Terrorism Centre to restrict access to instructions online on how to use high-risk chemical for terrorist attacks.  A number of chemicals routinely used in industrial processes or professional functions can react upon mixing, producing hazardous substances that could be used to carry out chemical terrorist attacks. Investigators scoured the clear and dark web to identify and refer for removal propaganda and instructions on the use of high-risk chemicals, and the toxic gases they generate, in terrorist material and online fora.  As a result, over 120 individual pieces of content were referred to 21 online service providers to secure their swift removal.  The referred content covered five languages and was disseminated by terrorist supporting networks, including jihadist, right-wing and left-wing terrorist groups. The findings of this Referral Action Day will feed into the analysis of the current threat picture on high-risk chemicals in the impact assessment produced by the European Commission.  Participating countries  Albania, Bosnia-Herzegovina, Colombia, Czechia, Denmark, France, Georgia, Germany, Greece, Luxembourg, Moldova, Montenegro, Portugal, Romania, Slovak Republic, Spain, the United Kingdom

Results of the operation include: 6 houses searched in Seville, Spain  20 suspects arrested assets seized worth an estimated at EUR 5.5 million 2 luxury watches and EUR 16 545 in cash seized 2 500 kilograms of hashish and 45.6 kilograms of marijuana seized criminal infrastructure seized including lorries, a boat, tools for marijuana cultivation and hashish production, and 34 mobile phones  large marijuana plantation and drug lab discovered forged travel and identification documents seized Criminals relied on false identities As the Italian leaders of the criminal network were subjects of European Arrest Orders, they used falsified documents to veil their identities. Residing in towns between Seville and Malaga, they attempted to avoid detection by taking various security measures and by frequently changing their addresses.  The criminal network used a variety of money laundering methods to obfuscate their drug trafficking proceeds. These included the channelling of money - through business bank accounts using fake invoices, loans, or other debts - among a network of companies involved in the transport of drugs. Other methods used were investments in luxury real estate, rentals, luxury goods and vehicles, as well as cash payments.  Drug lab and marijuana plantation Investigations in this case were kicked off in October 2021, when a hashish shipment was found hidden in a lorry transporting pallets of onions. Law enforcement arrested the two drivers and seized 468 kilograms of hashish. This was followed by another seizure of 194 kilograms of hashish and 30 kilograms of marijuana in May 2022. In the same month a boat chartered by the criminal organisation was intercepted by law enforcement on the open sea, resulting in the arrest of its three occupants, as well as the seizure of 1 800 kilograms of hashish and the vessel itself. The interception of this large shipment from Morocco shows that is has become increasingly difficult for criminals to import drugs via the sea. To circumvent this issue, the organisation had built a laboratory for hashish production and set up a large marijuana plantation in southern Spain. These were discovered in the course of the operation, which involved more than 150 law enforcement officials. Europol provided operational expertise as well as analytical and operational support from the very beginning of the investigation. Furthermore, a Europol specialist was deployed on location in Spain during the main action day.

The operation resulted in: 30 searches 15 people detained and 18 people formally charged considerable amounts of cash seized in zlotys, euros and US dollars silver and gold coins and bars, gold jewellery, watches and 7 luxury cars seized electronics and evidence of the use of cryptocurrencies, cash remittances and currency conversions gathered total value of seizures amounts to EUR 2 million Europol’s intelligence packages provide new leads Europol’s dissemination of intelligence packages has given investigators new insight into the criminal network. In addition to identifying tobacco smuggling as a source of income, investigators were now able to trace the illicit profits. Analysis of encrypted data intercepted from criminals’ phones also revealed locations used to hide large sums of cash. Europol provided an analyst and a specialist on-site to assist the 200 Polish law enforcement officers involved in the operation. 

The five action days resulted in: 8 house searches in France and Israel The arrest of the main organiser in Israel 8 suspects arrested (6 in France and 2 in Israel) Seizures include: electronic equipment and vehicles, about EUR 3 million from Portuguese bank accounts, EUR 1.1 million from Hungarian bank accounts, EUR 600 000 from Croatian bank accounts, EUR 400 000 from Spanish bank accounts, EUR 350 000 in virtual currencies  The total value of the seizures is estimated at about EUR 5.5 million International search for the EUR 38 million lost in few days The criminal network, comprised of French and Israeli nationals, targeted companies located in France. In early December 2021, one of the suspects impersonated the CEO of a company specialised in metallurgy, based in the department of Haute-Marne in north-eastern France. The fraudster asked the company’s accountant to make an urgent and confidential transfer of EUR 300 000 to a bank in Hungary. The fraud was discovered a few days later when the accountant, thinking he was acting on behalf of the company’s CEO, attempted to make a transfer of EUR 500 000. The company filed a complaint, and the investigators subsequently found that the call from the alleged CEO came from a number in Israel.  In late December 2021, a real estate developer based in Paris also felt victim to fraud with a similar modus operandi. The damages were much more significant in this case, however. To perpetrate the fraud, the suspects impersonated lawyers, saying they worked for a well-known French accounting company. After gaining the victim’s trust, the fraudster requested a large, urgent and confidential transfer. Pretending to be consultants, they persuaded the Chief Financial Officer (CFO) to transfer millions of euros abroad. In total, they defrauded the company of almost EUR 38 million in a matter of days. Using a pre-existing money laundering scheme, these funds were quickly transferred to different European countries, then to China and finally to Israel. A link between these two scams was established in January 2022 when the Parisian real estate company filed a complaint. The information exchange and international cooperation facilitated by Europol led to the discovery of accomplices, modi operandi and funds. The criminal investigation in Croatia contributed to the discovery of the real identity of the money mules used by the criminal network. The competent authorities in Croatia blocked and froze over EUR 600 000 in several bank accounts. The Portuguese investigation led to the seizure of approximately EUR 3 million held in multiple bank accounts. The Hungarian authorities discovered that more than EUR 7 million had been received in Hungarian bank accounts before being withdrawn in cash or transferred to bank accounts in other countries. The Hungarian authorities interrogated 16 individuals, two of whom had been arrested previously and are currently under criminal supervision. They seized more than EUR 1 million in several bank accounts. Europol’s support in tracing money movements  Since January 2022, Europol has facilitated the exchange of information and provided specialised analytical support, including financial and cryptocurrency analysis and expertise. The analysis led to the identification of links between countries to enable the urgent seizure of criminal assets before the suspects could launder them. On the action days, Europol deployed experts to France, Hungary and Israel to cross-check operational information against Europol’s databases in real-time and provide forensic support on the ground.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating this major criminal threat.  

The criminals advertised their illicit activities on various social media platforms to lure as many migrants as possible to be smuggled across the borders. To that end, videos of successful transports were published. Migrants would be moved along two main routes, either from Croatia via Slovenia to Italy, or from Serbia via Hungary to Austria. The operation resulted in: 13 suspects arrested (Slovenian, Serbian and Bosnian-Herzegovinian) at least 212 migrants smuggled in at least 16 separate incidents seizures include: weapons (an automatic rifle, a semi-automatic pistol, silencers, a hunting rifle with an optical sight fitted and over 2 300 pieces of different types of ammunition), various illegal drugs, illegal doping substances, electronic devices and cash  Over 3 million in illegal profits Migrants using the criminals’ services had to pay exorbitant prices to cross into the European Union clandestinely. An illegal trip from Serbia to Austria would require a payment of around EUR 5 000 per person. The entire journey from the country of origin to the EU would cost between EUR 15 000 to 20 000, thus making an enormous profit for the smugglers. In total, investigators believe the criminals obtained at least EUR 100 000 for the transports from Serbia to Austria and at over EUR 3 180 000 in total. The migrants usually entered Hungary through the Serbian-Hungarian green border on foot with the help of guides. The suspects then picked them up in vehicles. Investigations show that up to 37 people may have been transported in the same vehicle, which exposed them to extreme risks to their health and lives. The migrants were then taken across Hungary and dropped off close to the Austrian border. After crossing the border into Austria on foot, they would surrender to the police and apply for asylum.  

This action is the biggest hit to date against Chinese human trafficking in Europe.  On 7 February, some 34 house searches were carried out in Belgium (Brussels, Antwerp and Charleroi) and Spain (Alicante and Barcelona). These actions follow earlier actions against members of this group which led to 7 arrests in Switzerland in May 2022.  A total of 28 individuals were arrested (27 in Belgium and one in Spain).  Among those arrested in Belgium feature five Chinese nationals considered as high-value targets by Europol due to their involvement in multiple high-profile cases in Europe.  This international sweep follows a complex investigation led by the Belgian Federal Prosecutor (Federaal Parket) and Federal Judicial Police East Flanders (Federale Gerechtelijke Politie Oost-Vlaanderen), working together with their counterparts in  Spain, Germany, Poland and Switzerland, with the coordination of Europol and Eurojust. A conveyor belt for sexual exploitation  The investigation uncovered how hundreds of Chinese women were forced into prostitution after being lured to Europe by the promise of a legitimate job. The perpetrators would use popular messaging apps in China to ensnare their victims. They would then smuggle their victims to Europe using forged EU ID documents and residence permits which were either falsified or obtained using falsified supporting documents.  Once in Europe, the victims were held in bondage and forced to work as prostitutes to pay off debts.    The criminals would advertise the women online and set them up in hotels across Europe, rotating their victims between EU countries.  Over the course of the three year-long investigation, over 3 000 online advertisements linked to this ring have been monitored by law enforcement. The investigators were able to identify over 200 victims so far, with the actual number believed to be much higher.  International police cooperation  With cells scattered across Europe, international police cooperation was central in breaking up this Chinese prostitution ring. Initiated in 2020 by the Belgian authorities, this operation rapidly grew in scale, with targets being investigated simultaneously in multiple European jurisdictions.  In order to bring all these perpetrators to justice, an Operational Taskforce (OTF) was set up at Europol in December 2021 between Belgium, Spain, the Netherlands, Poland and Switzerland. This OTF was later joined by Germany at the end of 2022.  Europol has been supporting this high-priority case from its onset in 2020. Its experts coordinated the operational activities, mapped out the different targets and their criminal activities and brought together the investigators on all sides to agree on a joint strategy.  Investigators from the OTF Member States were also deployed to Europol’s premises to work jointly with Europol on the case. Six Europol officers were deployed in February to Belgium and Spain to assist the national authorities with their investigative measures.  Europol also funded the deployment of two German and two Spanish investigators to the coordination centre in Belgium. The case was opened at Eurojust in October 2020 at the request of the Belgian authorities. Two coordination meetings were hosted by the Agency to facilitate judicial cooperation and provide support for the coordinated investigative efforts. The following authorities took part in this operation:  Belgium: Federal Prosecutor (Federaal Parket), Federal Judicial Police East Flanders (Federale Gerechtelijke Politie Oost-Vlaanderen) Germany: Federal Criminal Police Office (Bundeskriminalamt) Poland: National Police HQ (Komenda Główna Policji) The Netherlands: National Police (Politie) Spain: National Police (Policía Nacional)  Switzerland: Federal Police (fedpol)

The 2022 competition comprised the following three categories: Making Europe safer; Caring for the community; On the road. In the ‘Making Europe safer’ category, photographer Pedro Manuel Reis Valongo of the Polícia de Segurança Pública submitted the winning photo of a Portuguese police officer on patrol in a railway station. The officer stands on the platform as the trains pass by, demonstrating the steadfast presence of police in Europe’s public spaces as citizens go about their daily lives. In the ‘Caring for the community’ category, the Guardia Civil’s Ricardo Rueda Fernandez’s winning photo of a Spanish police officer helping a Moroccan citizen safely to shore is poignant and powerful. This police officer’s diving gear shows the versatility and variety of police work, both on shore and at sea. Finally, the ‘On the road’ category was won by photographer Florin Jugravu of the General Inspectorate of Romanian Police for the image of a police officer on duty in Bucharest traffic. This image perfectly encapsulates the frenetic nature of modern life in Europe and the reliability of the police on Europe’s roads and streets. These winning photographs will be on display at Europol headquarters in The Hague. Follow Europol on Instagram to see these winning photographs plus a selection of the best entries.

These arrests took place in November 2022 in several Spanish provinces - Badajoz, Cádiz, Ciudad Real, Córdoba, Tenerife and in the Autonomous City of Ceuta- and follow the arrest of 21 other members of the same criminal organisation in 2021. Known as Operation Conifera, this investigation into match-fixing was carried out by the Spanish National Police (Policía Nacional) in a joint operation with Europol and INTERPOL.  A total of thirty football matches are currently being investigated in this case. The profits generated are estimated at over half a million euros.  Inside the fixing  The investigators were able to uncover with Europol’s support how this betting syndicate operated. The criminal organisation operated a top-down operational business model. At the top of the criminal structure were the two leaders of this criminal gang who had close connections with football players and backroom staff. The intermediaries were responsible for the coordination of the match-fixing schemes, while the corrupted athletes would provide confidential information in order to influence matches. This organised crime group also relied on mules who would place sports bets at bookmakers and collect the prize money, and a network of procurers responsible for providing identities for online betting on rigged matches. The procurers were paid between  EUR 4 000 and EUR 24 000 per online account.   The criminals used encrypted means of communication in order to avoid police detection.  Europol and match-fixing Europol’s support was central in the development of the Spanish investigation. Europol’s European Financial and Economic Crime Centre has been providing continuous intelligence development and analysis to map out the different targets and their criminal activity.  A specialised officer was deployed to Spain to provide on-the-spot operational and analytical support to the national investigators.  Europol has a team of experts working with law enforcement authorities across the EU to identify links between suspicious matches and suspects, and to uncover the organised crime groups orchestrating these multi-million euro frauds against sport. Read Europol’s latest report on the role of organised crime in sports corruption.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

In the last year, HIVE ransomware has been identified as a major threat as it has been used to compromise and encrypt the data and computer systems of large IT and oil multinationals in the EU and the USA. Since June 2021, over 1 500 companies from over 80 countries worldwide have fallen victim to HIVE associates and lost almost EUR 100 million in ransom payments. Affiliates executed the cyberattacks, but the HIVE ransomware was created, maintained and updated by developers. Affiliates used the double extortion model of ‘ransomware-as-a-service’; first, they copied data and then encrypted the files. Then, they asked for a ransom to both decrypt the files and to not publish the stolen data on the Hive Leak Site. When the victims paid, the ransom was then split between affiliates (who received 80 %) and developers (who received 20 %).  Other dangerous ransomware groups have also used this so-called ransomware-as-a-service (RaaS) model to perpetrate high-level attacks in the last few years. This has included asking for millions of euros in ransoms to decrypt affected systems, often in companies maintaining critical infrastructures. Since June 2021, criminals have used HIVE ransomware to target a wide range of businesses and critical infrastructure sectors, including government facilities, telecommunication companies, manufacturing, information technology, and healthcare and public health. In one major attack, HIVE affiliates targeted a hospital, which led to severe repercussions about how the hospital could deal with the COVID-19 pandemic. Due to the attack, this hospital had to resort to analogue methods to treat existing patients, and was unable to accept new ones.   The affiliates attacked companies in different ways. Some HIVE actors gained access to victim’s networks by using single factor logins via Remote Desktop Protocol, virtual private networks, and other remote network connection protocols. In other cases, HIVE actors bypassed multifactor authentication and gained access by exploiting vulnerabilities. This enabled malicious cybercriminals to log in without a prompt for the user’s second authentication factor by changing the case of the username. Some HIVE actors also gained initial access to victim’s networks by distributing phishing emails with malicious attachments and by exploiting the vulnerabilities of the operating systems of the attacked devices.  About EUR 120 million saved thanks to mitigation efforts Europol streamlined victim mitigation efforts with other EU countries, which prevented private companies from falling victim to HIVE ransomware. Law enforcement provided the decryption key to companies which had been compromised in order to help them decrypt their data without paying the ransom. This effort has prevented the payment of more than USD 130 million or the equivalent of about EUR 120 million of ransom payments. Europol facilitated the information exchange, supported the coordination of the operation and funded operational meetings in Portugal and the Netherlands. Europol also provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through cryptocurrency, malware, decryption and forensic analysis.  On the action days, Europol deployed four experts to help coordinate the activities on the ground. Europol supported the law enforcement authorities involved by coordinating the cryptocurrency and malware analysis, cross-checking operational information against Europol’s databases, and further operational analysis and forensic support. Analysis of this data and other related cases is expected to trigger further investigative activities. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations. *Law enforcement authorities involved Canada – Royal Canadian Mounted Police (RCMP) & Peel Regional Police France: National Police (Police Nationale) Germany: Federal Criminal Police Office (Bundeskriminalamt) and Police Headquarters Reutlingen – CID Esslingen (Polizei BW) Ireland: National Police (An Garda Síochána) Lithuania: Criminal Police Bureau (Kriminalinės Policijos Biuras) Netherlands – National Police (Politie) Norway: National Police (Politiet) Portugal: Judicial Police (Polícia Judiciária) Romania: Romanian Police (Poliția Română – DCCO) Spain: Spanish Police (Policía Nacional) Sweden: Swedish Police (Polisen) United Kingdom – National Crime Agency USA – United States Secret Service, Federal Bureau of Investigations Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The criminal groups were allegedly responsible for the large-scale trafficking of cocaine, cannabis and heroin mainly from Albania to Italy. Today’s operation is part of a longer-term investigation carried out jointly by the Italian and Albanian authorities, which has already led to the arrest of 62 persons and the seizure of assets worth approximately EUR 1 million (in Italy), as well as to the seizure of huge quantities of drugs. The case was opened at Eurojust and Europol in 2019. Eurojust organised two coordination meetings in which representatives of the involved authorities came together to discuss the case, exchange information and agree on further steps. The Agency also supported the authorities by setting up and funding a joint investigation team (JIT). Over the course of the investigation, Europol provided in-depth analytical support and expertise, mapping out the different high-profile targets and their criminal activities. The investigation was supported by the Countering Serious Crime in the Western Balkans – IPA 2019 project, which – for the first time – was able to financially support operational activities. The following authorities took part in the investigation: Italy: Public Prosecutor’s Office of Bergamo, Central Investigation Service on Organised Crime of the Guardia di Finanza, Economic-Financial Police of Brescia of the Guardia di Finanza, Central Directorate for Anti-Drug Services, Italian International Police Cooperation Service Albania: Special Prosecution Office Against Corruption and Organised Crime (SPAK), Albanian State Police - International Cooperation Office of Tirana

As part of the campaign, ENFAST and Europol directed EU citizens to the EU Most Wanted website to view images of the fugitives and check if they recognised any of them. The campaign appeared across social media and there was a call to action in all EU languages to reach as wide an audience as possible. As part of the campaign, murals were unveiled in Brussels and Barcelona to increase awareness of the campaign and to attract more media attention. The campaign imagery focused on a house of cards, as the removal of a key figure in the criminal network by an anonymous tip could cause the whole organisation to fall. Key successes During this year’s campaign, 14 fugitive cases were successfully solved. This made the 2022 campaign the most successful since 2019. Five fugitive cases were solved as a direct result of the publication of the fugitive profiles on the EU Most Wanted website. This would not have been possible without both the expertise of the ENFAST network and Europol’s far-reaching communications campaign, as both complemented each other in the search for these dangerous fugitives.  Crucial influence of the EU Most Wanted website The EU Most Wanted campaign has experienced significant success in the past with a number of anonymous tips leading to actual arrests. The website was originally launched in 2016, and since then 392 profiles of fugitives have been listed on the website. Out of this figure, 136 fugitives have been arrested with 49 of those arrests directly influenced by the fact that the fugitive profile had been published on the website.  

Almost half of all Bitzlato transactions linked to criminal activities Targeting crucial crime facilitators such as crypto exchanges is becoming a key priority in the battle against cybercrime. Bitzlato allowed the rapid conversion of various crypto-assets such as bitcoin, ethereum, litecoin, bitcoin cash, dash, dogecoin and USDT into Russian roubles. It is estimated that the crypto exchange platform has received a total of assets worth EUR 2.1 billion (BTC 119 000).  While the conversions of crypto-assets into fiat currencies is not illegal, investigations into the cybercriminal operators indicated that large volumes of criminal assets were going through the platform. The analysis indicated that about 46 % of the assets exchanged through Bitzlato, worth roughly EUR 1 billion, had links to criminal activities.  Cryptanalysis uncovered that the majority of suspicious transactions are linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), with others linked to cyber scams, money laundering, ransomware and child abuse material. For example, investigations showed that 1.5 million BTC transactions have been made directly between Bitzlato users and the Hydramarket, taken down in April 2022.  This exchange platform, available both in Russian and English language, rented dedicated servers from a hosting company in France. The coordinated action of the judicial and law enforcement authorities from the different involved countries led to the takedown of the platform, seizures of present financial assets, and further technical analysis. Overall results 5 individuals arrested so far (1 in Cyprus, 3 in Spain and 1 in the US); 1 individual questioned in Portugal; The main administrator arrested in the US; CEO, Financial director and Marketing director arrested in Spain; 8 house searches (4 in Spain, 1 in Cyprus, 2 in Portugal, 1 in US); Takedown of the digital infrastructure of the service, enabling further analysis and investigation; Seizures include crypto wallets worth about EUR 18 million in cryptocurrency at the time of writing, vehicles and electronic equipment; 100+ accounts at other crypto exchange frozen, involving a total of EUR 50 million.   Cryptoanalysis and international coordination to uncover links During the first phases of the investigative activities, Europol facilitated the information exchange, provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through the analysis of millions of cryptocurrency transactions.  On the action day, Europol deployed 13 of its experts on the spot (10 in France, 1 in Cyprus, 1 in Spain and 1 in Portugal) and supported the deployment of national investigators in other countries taking part in the operational activities. Europol supported the law enforcement authorities involved with coordination related to cryptocurrency analysis, cross checking of operational information against Europol’s databases, and operational analysis. At this moment, already over 3 500 bitcoin addresses and over a 1 000 Bitzlato user details showed links with various criminal cases reported in Europol’s systems. Analysis of this data and other related cases is expected to trigger further investigative activities.  Law enforcement authorities involved Cyprus: Cyprus Police Belgium: Federal Police (Federale Politie/Police Fédérale) France: National Gendarmerie (Gendarmerie Nationale) United States: Federal Bureau of Investigation Spain: Civil Guard (Guardia Civil)  Netherlands: National Police (Politie) and the Fiscal Information and Investigation Service (FIOD) Portugal: Judicial Police (Policia Judiciaria) Judicial authorities involved Belgium: Federal prosecutor office (Parquet fédéral) France: Paris Prosecutor / JUNALCO (Parquet de Paris / JUNALCO) United States: United States Department of Justice (US DOJ) Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The action day on 16 January led to: 92 persons charged 624 locations checked  4 202 vehicles checked 7 019 persons checked Up to EUR 10 000 to cross Bulgaria The joint actions took place across Bulgaria and focused on a number of networks smuggling migrants from Türkiye, via Bulgaria, to Serbia and then Western Europe. The main organisers of the networks active along this route are based in Bulgaria, Serbia and Türkiye. They have created their own national networks of members responsible for the transport and accommodation in their respective countries. The main modes of transportation used by the smugglers were vans, campers and buses. The prices for the full smuggling service in larger groups varied between EUR 2 000 and 3 000 per person. If the migrants were smuggled in a smaller group of 5-6 people, the payments were reaching up to EUR 10 000. Payments for the full trip would be made after the main organiser from Türkiye had confirmed that the migrants had reached the Bulgarian-Serbian border. Increased migratory pressure on the Bulgarian – Turkish border Bulgarian authorities have reported an increase in migrant smuggling activities on their southern border. In August 2022 an incident, which involved a bus transporting irregular migrants, led to the death of two police officers on duty. Later the same year, an officer from Bulgaria’s Border Police was shot dead during regular patrol at the green border with Türkiye. These incidents suggest an increase of both the smuggling activities and the violence of the involved criminal networks.  At the end of last year, Europol increased its support for Bulgarian authorities with the deployment of dedicated analyst. On the action day, 16 January, Europol deployed an expert to Sofia to provide real-time analytical support and cross-check operational information against Europol’s databases.   

During the raids last week, the French officers arrested nine suspects, most of them Moldovan nationals. The gendarmes discovered a quasi-industrial set-up for the production of counterfeit cigarettes in large quantities. They discovered three separate zones in the targeted factory. One of the zones was dedicated to the processing of raw tobacco to produce boxes of cigarettes labelled as well-known brands sold on the legal market. Another zone was dedicated to the storage of large boxes of counterfeit cigarettes. The third zone was used as a living area for the workers with some 15 beds, a kitchen and a living room. This allowed the workers to live at the factory, completely cut off from the external world.  During the raids, the officers seized more than 100 tonnes of illegal products including 55 tonnes of cigarettes in boxes (19.4 million cigarettes and 15 tonnes of cut tobacco), 50 tonnes of packaging materials such as paper, filters and labels, as well as 18 tonnes of waste from the cigarette production process. The estimated value of the seized tobacco is about EUR 17 million. Further to this, the officers seized vehicles, factory machinery and electronic equipment. The seizures also included over a tonne of food products, later donated to food banks. The seized tobacco and counterfeit products were destroyed.  Europol facilitated the information exchange and provided specialised analytical support. On the action day, Europol supported the French authorities by cross-checking operational information against Europol’s databases in real-time and providing leads to investigators in the field.  In 2020, Europol created the European Financial and Economic Crime Centre (EFECC) to increase synergies between economic and financial investigations and to strengthen its ability to support law enforcement authorities in effectively combating major criminal threats. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

The Action day on 11 January 2023 led to: 15 arrests, 14 in Serbia and one in Germany; 261 individuals questioned, some of whom are awaiting prosecution (42 in Bulgaria, 2 in Cyprus, 3 in Germany and 214 in Serbia);     22 locations searched (5 in Bulgaria, 2 in Cyprus, 15 in Serbia) including: 4 call centres and 11 residences in Serbia; 2 residences in Cyprus; 2 companies and 3 residences in Bulgaria. Seizures include 3 hardware wallets with about USD 1 million in cryptocurrencies on it and about EUR 50 000 in cash, 3 vehicles, electronic equipment and data back-ups, documents.   At least EUR 2 million in losses  The suspects used advertisements on social networks to lure victims to websites covertly operated by the criminals, which offered seemingly exceptional investment opportunities in cryptocurrencies. The victims, mainly from Germany, would first invest low, three-digit sums. Fake price hikes leading to supposedly lucrative profits for investors then persuaded them to make transfers of higher amounts. Currently, it is estimated that the financial damage to German victims is over two million euro, while other countries such as Switzerland, Australia and Canada also have victims. The investigation suggests that the number of unreported cases is likely to be much higher. This would mean that the illegal gains generated by the criminal groups, with at least four call centres in eastern Europe, may be in the hundreds of millions of euro.  Europol has supported this investigation since June 2022 following an initial request from Germany. During the course of the investigation, Europol facilitated the information exchange, provided analytical support and coordinated operational activities. During the action day, Europol deployed two experts to Bulgaria and Serbia to cross-check operational information in real time against Europol’s databases in order to provide leads to investigators in the field. The experts also provided technical expertise to enable the extraction of information from mobile devices and IT infrastructure. On the day of the action, Eurojust hosted a coordination centre to facilitate the information exchange and support cooperation between involved authorities during the operational activities.     --- Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.  

Support to Ukraine Following the Russian invasion of Ukraine in February, Europol united with the EU and its Member States in our unwavering support of our Ukrainian friends and colleagues. Russia’s war of aggression caused a humanitarian crisis and prompted large numbers of people to flee from Ukraine to the EU, meaning that opportunistic criminal networks could exploit this situation to further their illicit activities. Europol, alongside the Member States, remains strongly committed to identifying and tackling these criminal threats and working at all levels to support the EU Member States impacted by the conflict.  As part of this ongoing support, the agency is in close communication with the Member States bordering Ukraine, and is currently deploying experts and guest officers to support local law enforcement authorities in these countries. Europol is also actively engaging with Ukrainian law enforcement through the Ukrainian Liaison Officer at Europol headquarters. International hit against Brazilian narcos An extensive investigation involving authorities in Brazil, Spain, Paraguay and the United States, coordinated by Europol’s European Serious and Organised Crime Centre, led to the dismantling of an international criminal organisation shipping Bolivian cocaine into the EU.  The investigative activities revealed that the criminal organisation had developed a production infrastructure in Bolivia, with logistical and supply lines in Brazil, Paraguay and Uruguay, which enabled the shipment of several multi-tonne cocaine consignments to Europe every few months. Investigators also uncovered a distribution network based in Valencia and Barcelona that was responsible for receiving the cocaine shipments and circulating them on the European market. The members of the network used encrypted communications to coordinate their criminal activities, including supplying drugs to Europe and laundering the criminal assets. Listen to the Europol Podcast episode on this case. Hanging up on call centre scams Call centre scams have become more prevalent in recent years, with fake ‘traders’ persuading victims to part with their savings by promising lucrative investment opportunities. However, these too-good-to-be-true opportunities are typically scams.  In March 2022, Europol’s European Financial and Economic Crime Centre supported an investigation by Lithuanian and Latvian authorities into one such scam. The operation led to raids of three call centres belonging to the same organised crime group. More than 100 people in Riga and Vilnius were detained on suspicion of being involved in an international call centre scam that was believed by investigators to have turned an illegal profit of over EUR 3 million per month. Listen to the Europol Podcast episode on this case. Cutting power to world’s biggest hacker forum Operation TOURNIQUET, which took place in April, was coordinated at the international level by Europol’s European Cybercrime Centre that culminated in the shutdown of ‘RaidForums’ – one of the world’s biggest hacker forums. The operation was the culmination of a year of meticulous planning between U.S., UK, Swiss, Portuguese and Romanian law enforcement authorities.  At its peak, the forum had a community of more than a million users. It made a name for itself by selling access to high-profile database leaks belonging to a number of US corporations across different industries. These contained information for millions of credit cards, bank account numbers and routing information, and the usernames and associated passwords needed to access online accounts. In addition to the domain seizure, the forum’s administrator and two of his accomplices were arrested, and additional infrastructure seized. Disrupting migrant smuggling across the English Channel The smuggling of migrants across the English Channel is a very dangerous modus operandi that increased shortly before the start of the COVID-19 pandemic. Europol’s European Migrant Smuggling Centre (EMSC) has been actively monitoring and supporting law enforcement efforts to effectively tackle these developments by establishing Operational Task Force Dune. The OTF includes authorities from Belgium, France, Germany, the Netherlands and the UK, and is coordinated by Europol. Authorities focus on a number of high-level smugglers, known as High-Value Targets, whose prosecution could seriously disrupt or even halt the functioning of this criminal network. In July 2022, more than 39 suspects were arrested across France, Germany, the Netherlands and the UK, including 3 High-Value Targets. Investigators estimated that the network could have smuggled up to 10 000 migrants in the past year and a half, with as much as EUR 15 million in criminal profits. Confronting labour exploitation across EU  During an EU-wide coordinated action week in July 2022, authorities identified more than 500 employers linked to labour infringements and over 480 possible victims. Europol supported the action days, which were led by the Netherlands and co-led by France, Italy, Romania and the United Kingdom and involved 29 countries. The actions were implemented as part of the European multidisciplinary platform against criminal threats, known as EMPACT. The action week mobilised nearly 18 500 officers, who searched more than 10 467 locations, 32 525 vehicles and more than 86 000 persons to detect different administrative infringements and criminal offences. These checks led to the detection of a significant number of companies linked to infringements of employment law. This year’s inspections focused on a number of labour-intensive sectors such as mining, home healthcare services, nail bars, cleaning services, restaurants and food delivery services. Vietnamese nationals are especially vulnerable to labour exploitation, predominantly in nail bars. Home healthcare is also a sector that is susceptible to exploitation. This is especially difficult to detect as it happens behind the closed doors of households. Eastern European nationals often fall victim to domestic servitude with reports of cases in Spain, Italy, the Netherlands and the United Kingdom. Authorities also focused on detecting the possible exploitation of Ukrainian refugees.    Super cartel controlling one-third of Europe’s cocaine trade taken down There is no safe haven for drug lords. This was the message sent by Operation Desert Light, a series of coordinated raids carried out across Europe and the United Arab Emirates in November 2022. The raids targeted both the command-and-control centre and logistical drug trafficking infrastructure in Europe. A total of 49 suspects were arrested during the course of the investigation, which were run in parallel in Spain, France, Belgium, the Netherlands and the UAE. The suspects had come together to form what was known as a ‘super cartel’ that controlled around one-third of the cocaine trade in Europe. The scale of cocaine importation into Europe under the suspects’ control and command was massive and over 30 tonnes of drugs were seized by law enforcement over the course of the investigations.

The report confirms that the need for cross-border digital evidence is on the rise The report reflects on the complexity of cross-border investigations involving digital evidence, offering extensive feedback from officials of EU Member States’ law enforcement and judicial authorities.  It shows that there was a 36% increase in the volume of requests for data to OSPs in 2021, while the number of Emergency Disclosure Requests increased by 29%.  The success cases presented in this report also show how digital evidence is crucial in all crime areas. The SIRIUS platform remains the leading source of knowledge The report confirms that the SIRIUS platform, hosted on the Europol Platform for Experts, remains the number one source of information for law enforcement and judicial practitioners seeking know-how in relation to data acquisition methods in cross-border circumstances.   Ongoing technological transformation While the relevance of Online Gaming Platforms in criminal investigations is stable, there is growing concern that technology linked to the metaverse will pose considerable challenges for law enforcement in the near future. For instance, the use of the metaverse is conceptually different from existing mainstream platforms, meaning that user behaviour could become more important than user generated content in future investigations. The need for strengthening capacity and mutual trust  Advances in technology and the ever-expanding digital landscape are the sources of many challenges, including the risk of losing digital data and difficulties in establishing the applicable jurisdiction. For judicial and law enforcement practitioners to tackle these challenges successfully, they will need to join forces, share knowledge and commit to daily interoperability. These collaborative efforts will lead to a ‘toolbox’ of shared investigative and prosecutorial solutions that aim to evolve in tandem with legislative developments.  The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under contribution agreement No PI/2020/417-500.

Pioneering AI technology Europol used this AI tool to specifically generate portraits of law enforcement officers inspired by the style of renowned artists. This experimentation led to new and innovative representations of law enforcement that contrast with some of the default imagery generated by AI on this subject in the past. Human oversight This technology was carefully used by Europol to generate ideas, but the final version of the calendar was ultimately as a result of the decisions made by the designers during the creative process. Each image was created using a particular sequence and combination of written prompts. This method was applied in an iterative approach, with a view to creating a detailed image in a certain style as already envisioned by the designer.  Responsible innovation AI is becoming invaluable for law enforcement authorities all over the world and Europol embraces this type of responsible innovation. Rather than a tool to replace human design skills, AI technology functions as an extension of the designer. The ideas generated by this technology have inspired the designer’s free and creative choices for the final versions of the images included in this calendar. It is an example of how the combination of AI and human oversight can result in the creation of a unique and memorable final design. The calendar can be ordered for free and citizens need only pay the postage costs. Calendars are available for delivery from 22 December 2022.  

The investigators uncovered that an estimate of 250 tonnes of fireworks were stored in a bunker complex in Germany, about 20 kilometres from the border with the Netherlands. The suspects involved in this illegal scheme attempted to circumvent the strict regulations for the sale of fireworks by hiding behind the façade of legal company, registered for the sale of authorised fireworks. In fact, the trade of fireworks is very highly regulated due to the dangerous aspect of the merchandise. The free sale of heavy fireworks is strictly forbidden. Criminal networks also use the heaviest categories of fireworks, such as the ones seized during the action day, to perpetrate violence or to facilitate their criminal activities during, for example, ATM attacks.   The year-long investigation exposed a Dutch criminal network illegally trading with dangerous, highly explosive fireworks. The investigation was initiated in 2021 based on an anonymous tip coupled with intelligence from other investigations into the trafficking of illegal fireworks. The suspects stored the heavy fireworks in unsecured locations, while illegally selling these extremely dangerous goods to the public – despite such fireworks being banned for open sale. The illegal storage and sale of such highly regulated explosive materials poses a serious risk to the safety of users, and also to unaware people living in the areas surrounding the storage facilities.  The illegal sale of fireworks targeted A dedicated taskforce was also set up at Europol to target the trafficking of illegal fireworks. 350 tonnes of illegal heavy fireworks, with a commercial value of up to EUR 25 million, were already seized in November this year. Back then, stockpiles of cash were also discovered at the same time. Europol coordinated operational activities, facilitated information exchange and provided analytical support.  During this new operation also targeting the trafficking of heavy fireworks, Europol deployed two experts to provide real-time technical and analytical support to the investigators on the spot.  Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

During the operation, law enforcement officers dismantled 59 criminal groups and arrested or reported to the judicial authorities 349 suspects. Simultaneously, authorities seized massive amounts of misused, falsified or counterfeit medicines, doping products and substances and illegal food and sport supplements, as well as counterfeit COVID vaccines, sanitary products and medical devices. Doping substances and medicines for erectile dysfunction were amongst the most seized items. In order to increase prevention and awareness, some participating states launched anti-doping campaigns and performed both ‘in-competition’ and ‘out-of-competition’ controls. Operation Shield III in a nutshell:seizures worth over EUR 40 million more than 10.5 million units of medicines and doping substances seizedover 1 million counterfeit COVID tests seized195 investigations carried out349 suspects arrested or reported to judicial authorities59 organised crime groups investigated10 underground labs shut down588 websites monitored 89 websites shut downover 218 000 shipments checked over 74 000 shipments seized 3 526 anti-doping controls ‘in-competition’ carried out (39 positive)3 245 anti-doping controls ‘out-of-competition’ carried out (9 positive)Misuse of medicine a serious societal issueThe trade and consumption of medicines not prescribed by medical professionals or a medical framework continues to pose a social problem, fostering illegal activity. Misuse spans the desire for psychotropic, recreational or performance-enhancing effects and extends to unintended means of consumption. This can cause growth in demand that is unable to be legally met, which incentivises trafficking - mostly with product diverted from the legitimate supply chain.In addition, falsified medicines are introduced among those diverted from the legitimate supply chain. These are manufactured in underground laboratories where criminals work under questionable hygienic circumstances and safety measures, leading to health risks for end consumers. Furthermore, counterfeit medicines will often not produce the desired effect and leave the consumer untreated. Medicine trafficking lucrative for organised crimeIn the course of the operation, many cases of large-scale medicine trafficking were uncovered, confirming that it can be as lucrative as or even more lucrative than narcotics trafficking. While these crimes generate massive illicit gains for traffickers and counterfeiters, the public finances and the social care systems of some Member States are inflicted with massive financial costs. The public health cost is also significant, be it because of treatment of addictive behaviours or the consequences of overdoses or stock shortage.Organised crime group dismantled in GreeceThe Greek Financial Police Division disrupted an organised crime group with a hierarchical structure, distinct roles and a years-long history of smuggling anabolic steroids and other illegal pharmaceutical products such as erectile dysfunction remedies. Members of this particular group were active in Greece and held other minor hubs in Europe, the US and Asia. Two labs in Greece were used to turn raw material trafficked through Moldova and Bulgaria into various products. Sales were conducted through websites and encrypted e-mail addresses to an international clientele including dozens of professional athletes. A large-scale police operation led to the arrest of one leading member of the organised crime group and the seizure of more than 2.4 million units of anabolic steroids and other illicit substances, as well as packaging material. Significant reduction in COVID-19-related traffickingWhile criminal networks are still exploiting opportunities offered by the COVID-19 pandemic, trafficking with medicines and protective equipment has met a significant decrease due to the high attention to the topic and intense monitoring by law enforcement. Governments offering the vaccines at no cost contributed to creating a disadvantageous situation for criminals aiming to feed an illegal market. Several fraud attempts targeting national bodies responsible for the supply of medicines and protective devices could be detected and thwarted. EU Member States: Austria, Belgium, Bulgaria, Croatia, Cyprus, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Lithuania, Netherlands, Poland, Portugal, Romania, Slovakia, Spain.Third-party countries: Albania, Bosnia and Herzegovina, Colombia, Georgia, Iceland, North Macedonia, Serbia, Switzerland, United States.

The participating authorities were involved in detecting and flagging terrorist content to online service providers and evaluating their responses. The activities resulted in the referral of 831 items to 34 affected platforms. Referred materials include content produced by or favouring proscribed right-wing extremist organisations. It also includes content disseminated in relation to terrorist attacks motivated by violent extremism. Such materials include livestreams, manifestos, claims and celebrations of attacks.  Violent extremism still a growing concern since Bratislava and Buffalo Since the first Referral Action Day targeting this type of online content in 2021, the threat posed by violent extremism and terrorism is still on the rise. The terror attacks in Buffalo (USA) and Bratislava (Slovakia) illustrated a concerning proliferation of violent right-wing extremist and terrorist activities on a global scale. The perpetrators of these attacks were part of transnational online communities and took inspiration from other violent right-wing extremists and terrorists. In their manifestos, terrorist actors have highlighted the pivotal role of online propaganda in the radicalisation process. This shows how the abuse of the internet continues to be an important aspect of violent right-wing radicalisation and recruitment.  RADs consolidate law enforcement’s efforts to tackle the creation and dissemination of violent extremist and terrorist propaganda online. During the coordinated activities, the participants refer content linked to propaganda material to online service providers, inviting them to evaluate and remove the content breaching their terms of service. The platforms are invited to reinforce their moderation protocols to avoid this type of abuse in the future.  *Czechia, Denmark, France, Germany, Hungary, Ireland, Italy, Malta, The Netherlands, Portugal, Slovakia, Slovenia, Spain, United Kingdom.  --- Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Known as Operation Power Off, this operation saw law enforcement in the United States, the United Kingdom, the Netherlands, Poland and Germany take action against these types of attacks which can paralyse the internet.   The services seized were by far the most popular DDoS booter services on the market, receiving top billing on search engines. One such service taken down had been used to carry out over 30 million attacks.  As part of this action, seven administrators have been arrested so far in the United States and the United Kingdom, with further actions planned against the users of these illegal services.  International police cooperation was central to the success of this operation as the administrators, users, critical infrastructure and victims were scattered across the world. Europol’s European Cybercrime Centre coordinated the activities in Europe through its Joint Cybercrime Action Taskforce (J-CAT). This international sweep follows previous editions of Operation Power Off which targeted the administrators and users of the DDoS marketplace webstresser.org.  Participating authorities United States: US Department of Justice (US DOJ), Federal Bureau of Investigation (FBI) United Kingdom: National Crime Agency (NCA) The Netherlands: National High Tech Crime Unit Landelijke Eenheid, Cybercrime team Midden-Nederland, Cybercrime team Noord-Holland and Cybercrime team Den Haag Germany: Federal Criminal Police Office (Bundeskriminalamt), Hanover Police Department (Polizeidirektion Hannover), Public Prosecutor’s Office Verden (Staatsanwaltschaft Verden) Poland: National Police Cybercrime Bureau (Biuro do Walki z Cyber-przestępczością)   DDoS-ing is a crime  DDoS booter services have effectively lowered the entry barrier into cybercrime: for a fee as low as EUR 10, any low-skilled individual can launch DDoS attacks with the click of a button, knocking offline whole websites and networks by barraging them with traffic.  The damage they can do to victims can be considerable, crippling businesses financially and depriving people of essential services offered by banks, government institutions and police forces. Emboldened by a perceived anonymity, many young IT enthusiasts get involved in this seemingly low-level crime, unaware of the consequences that such online activities can carry. DDoS-ing is taken seriously by law enforcement. Size does not matter – all levels of users are on the radar of law enforcement, be it a gamer booting out the competition out of a video game, or a high-level hacker carrying out DDoS attacks against commercial targets for financial gain. The side effects that a criminal investigation could have on the lives of these DDoS users can be serious, going as far as a prison sentence in some countries.  

As the first joint publication of this kind, the report emphasises the hand-in-glove approach between the agencies in the common fight against global drug trafficking. Titled 'Complexities and conveniences in the international drug trade: the involvement of Mexican criminal actors in the EU drug market', the publication is a result of systematic and continuous exchange of operational and strategic information. The EU’s most recent Serious and Organised Crime Threat Assessment showed that criminal networks across the EU are increasingly international and specialised in scope, with 65 % of criminal groups active in the EU composed of members of multiple nationalities. The presence of Mexican criminal actors collaborating with EU-based actors in the EU drug market follows this trend. Cartel cooks in service of EU-based criminal networks The joint report delves into how the involved criminal networks cooperate with one another, particularly through the use of specialised actors at different points in their operations. The different actors include facilitators such as brokers, laboratory specialists, envoys, intermediaries and money laundering service providers. Law enforcement have arrested Mexican laboratory specialists – also known as 'cooks' – working in EU-based production sites. These actors are especially important due to their unique knowledge of how to produce higher yields of more potent end product, and obtain larger and more profitable crystals of methamphetamine.  The report also states that Mexican cartels are known to cooperate with EU-based criminal networks to traffic both methamphetamine and cocaine to EU ports for further distribution with the EU or transit to even more lucrative markets of Asia and Oceania. The use of concealed shipments – such as cocaine hidden in blocks of cellular thermal concrete – or the plans to establish cocaine smuggling routes from Colombia to airports in southern Italy using private jets show the ever-evolving nature of these criminal activities. Corrupt officials in the public and private sectors act as facilitators and help to increase the likelihood of successfully trafficking drug consignments to the EU. On US soil, Mexican cartels have a history of establishing drug trafficking hubs and strong criminal partnerships, and of using violence to gain control over the territory where they operate. An increased presence of Mexican cartels in the EU could also result in increased profits for them and their EU-based criminal collaborators, as well as an increase in violence in the EU. The DEA and Europol will continue to act in concert in monitoring and fighting these developments.  

This money laundering ring is believed to have funnelled millions of euros through bank accounts in Europe before sending the funds to Spain to purchase real estate. The individual at the centre of this money laundering scheme has been arrested in the Canary Islands. A total of 75 properties have been seized so far across Spain for a cumulative value of EUR 25 million. The EUR 219 million at the heart of the fraud is known as the Magnitsky case. Its name derives from the Russian tax lawyer Sergei Magnitsky who died in a Russian prison in 2009 after having uncovered massive tax fraud carried out by Russian tax officials.  The Spanish investigators were able to uncover how part of that dirty money ended up in Spanish real estate. A group of individuals were identified – all Russian nationals with little or no ties to Spain, alongside a number of shell companies with no real economic activity.  The dirty money was either sent to the bank accounts of these Russian citizens supposedly residing in Spain for them to purchase properties, or sent to Spanish real estate agencies with strong ties to the Russian community which would buy real estate on behalf of alleged clients.  Europol’s European Financial and Economic Crime Centre provided specialised support to the investigation. One of its specialists was deployed to Tenerife to provide on-the-spot support to the Spanish investigators during the action day.  Eurojust provided significant support by managing European investigation orders and information requests sent to 12 different jurisdictions.  The investigation in Spain was carried out by the Spanish National Police (Policía Nacional) under the coordination of the Special Prosecutor’s Office Against Corruption and Organised Crime, and the Central Court of Instruction No.2 of the National High Court.  

On 29 November, the EPPO, in cooperation with law enforcement agencies in 14 EU Member States and with the support of Europol, carried out simultaneous investigative measures in relation to a complex VAT fraud scheme based on the sale of popular electronic goods.  Over 200 searches were carried out in Belgium, Cyprus, France, Germany, Greece, Hungary, Italy, Lithuania, Luxembourg, the Netherlands, Portugal, Romania, Slovakia and Spain. Within the framework of the EPPO operation, searches had previously been conducted in Czechia, Hungary, Italy, the Netherlands, Slovakia and Sweden on 12 and 13 October 2022.  The case started in April 2021 after the Portuguese Tax Authority in Coimbra started looking into a company selling mobile phones, tablets, earphones and other electronic devices, on suspicion of VAT fraud.  The case was passed on to the EPPO in June 2021. Since then, the EPPO, Europol’s European Financial and Economic Crime Centre (EFECC) and national law enforcement authorities have established connections between the suspected company in Portugal and close to 9 000 other legal entities, and more than 600 natural persons located in over 30 countries. Results so far  312 house searches; 24 arrests in Portugal, Italy and France. Seizures 529 bank accounts; shares of 21 legal persons; 81 real estate properties; 31 luxury cars; over EUR 2.5 million in cash;  104 valuable watches; Connected earbuds of an estimated value of EUR 2 million; 42 luxury accessories;  1 Kalashnikov; Total value of seizures (so far): EUR 67 million.   Europol’s role  Upon the request of the European Delegated Prosecutor for Portugal, Europol has been supporting this case since December 2021.  Europol’s EFECC has been providing extensive analytical support by cross-checking the evidence against its databases and mapping out the key targets and their criminal activities. In addition, Europol’s EFECC has facilitated the obtainment of financial information from Financial Intelligence Units across Europe in the framework of the EU Directive 1153/2019.  During the action day on 29 November, six Europol experts were deployed on location to assist with the investigative measures at a national level. ***  All the data collected is being analysed, and the investigation into the organised crime groups behind this scheme is continuing. Measures to recover the damages have been undertaken.  

The goal for law enforcement at the World Cup Europol’s crime centres are monitoring for potential threats stemming from the World Cup, so as to support local authorities responsible for the safety of fans and the wider tournament. As a result of open source and intelligence monitoring, Europol has detected and advised on threats including the following: potential threat to safety of match attendees, cyber threats, phishing campaigns relating to tickets and counterfeit products, extremist propaganda. Europol’s Operational & Analysis Centre has been working closely with the FIFA World Cup Qatar 2022 Safety & Security Operations Committee for more than one year, in order to prepare a tailored support package, including: on the spot deployments,  back office support from Europol’s 24/7 Operational Centre,  a support network consisting of nominated Points of Contact from all the Centres of the Operations Department, support from Europol’s international network of Liaison Bureaus. Closing the net on organised crime Large sporting events can attract organised crime groups as they attract vast numbers of spectators and a lot of economic activity. Organised crime groups are highly adaptable, and can be quick to find and exploit opportunities for illicit profits. Speaking about Europol’s approach to supporting international sporting events, Julia Viedma, Head of Europol’s Operational & Analysis Centre, remarked: International sporting events are some of the largest public gatherings in the world. Law enforcement’s role should be protecting the fans, the organisers and the participants themselves, so they can get on with enjoying the tournament in safety. We are grateful to our partners in Qatar and the IPCC in Doha for providing an excellent platform for law enforcement cooperation. With hundreds of thousands of fans in Doha, Europol will participate in the IPCC for the entire duration of the tournament and remain vigilant for threats in the aftermath of the 2022 World Cup.  

The action day on 7 December led to: 8 arrests (5 in Germany, 2 in Lithuania and 1 in Poland)  17 locations searched (14 in Germany, 2 in Lithuania and 1 in Poland)   12 transfers detected with 13 facilitators and 30 migrants seizures include electronic equipment, various documents, and cash The smuggling network is linked to over 100 smuggling incidents  The criminal network, composed mainly of Syrian and Turkish nationals, arranged the entire trip of Iraqi migrants from Baghdad to the EU via diverse smuggling corridors. The migrants recruited in Iraq travelled to Russia via Turkey and then to Belarus before entering the EU through the borders of Latvia, Lithuania and Poland. The final destinations were predominantly Germany and, to a lesser extent, Finland. The members of the criminal network were based in and acting from the countries across the smuggling route.  This large criminal network, connected to over 100 smuggling incidents, was divided hierarchically. The majority of the individuals involved in the smuggling operations did not knowing each other personally. The money flows were arranged via the hawala underground financial system and through the use of cryptocurrency. Hawaladars based in Berlin (Germany) were also used to execute payments for the drivers against a proof of delivery such as pictures of migrants at their final destination.  The smugglers arranged the travel by plane as far as Belarus. Then they used local drivers, mainly Ukrainian nationals, to complete the last leg of the smuggling route leading to the EU via land. The suspects charged between EUR 3 000 and 15 000 per person, with an estimated money flow worth at least EUR 16 million. Once in Belarus and unable to return to their countries of origin, some migrants arranged the final trip into the EU on their own. A number of groups on social media messaging platforms were created to advertise illegal smuggling activities from the border area to Germany. Reportedly, the drivers asked between EUR 500 and 1 000 per person for this criminal service. Smuggling in life-threatening conditions, including transport in overcrowded vehicles in loading platforms, was also reported. In a single incident, a migrant was found dead in Germany, abandoned in critical health condition by the driver close to the German/Polish border. Europol’s Task Force Flow to increase the law enforcement response to the crisis In February 2022, Europol set up Operational Taskforce Flow (OTF) Flow, currently operating from Vilnius. The investigations supported by the OTF have so far led to over 40 arrests, and the detection of about 100 transfers of more than 1 000 migrants in total. During the action day on 7 December 2022, Europol deployed, in addition to the staff already sent to the OTF, three experts to Germany and Poland to cross-check operation information against Europol’s databases in real time, perform digital forensics, and support the investigators in the field with new leads. Operational Task Force Flow is composed of representatives from law enforcement authorities from Estonia, Finland, Germany, Latvia, Lithuania and Poland, as well as Europol experts. This special set-up was created specifically to support national authorities in combating the increased migrant smuggling activities across the EU-Belarus border. Through OTF Flow, Europol supports the coordination of joint investigative and operational activities and facilitates the information exchange between the involved law enforcement authorities. The OTF was created following the Joint Investigative Cell (JIC), set up by Lithuania in June 2021, to tackle the newly-emerged phenomenon of migrant smuggling from Belarus then affecting Latvia, Lithuania and Poland.  Law enforcement authorities involved:  Estonia – Estonian Police and Border Guard (Politsei- ja Piirivalveamte) Germany – German Federal Police (Bundespolizei)  Latvia - State Border Guard Lithuania – State Border Guard Service (Valstybės sienos apsaugos tarnyba) and National Police (Lietuvos policija)  Poland – Border Guard (Polska Straż Graniczna)   

Heading towards Europe, the 21 meter-long vessel was intercepted in international waters off the coast of Sierra Leone. Its illegal shipment is believed to be worth in excess of EUR 150 million. An investigation is underway to identify the criminal groups involved on either side of the Atlantic Ocean.  Participating authorities  Brazil: Federal Police (Polícia Federal) France: National Police (Police Nationale – OFAST), National Navy (Marine Nationale) United Kingdom: National Crime Agency (NCA)  United States: US Drug Enforcement Administration (US DEA)  Europol: European Serious Organised Crime Centre  Maritime Analysis and Operation Centre – Narcotics (MAOC – N) The cocaine infrastructure  Underpinning the drug trafficking activities is a transport infrastructure that connects Latin American source countries with areas of consumption. Europol’s unique capabilities has positioned the Agency as the place where such crucial intelligence emerges. Europol currently hosts at its headquarters over 250 liaison officers from over 50 countries and organisations, which sees law enforcement from countries across the world working side by side to fight the most dangerous criminal networks. Coupled with Europol’s work into the encrypted means of communication used by criminals, this coordinated intelligence-led approach is delivering tangible results in the fight against maritime drugs trafficking. 

In total, 34 countries across Europe, supported by EU agencies and international organisations*, took part in these large-scale coordinated actions. The EMPACT Joint Action Days were planned based on an intelligence-led approach in which police, customs, immigration agencies and border control agencies joined forces.  Checks at borders and locations vulnerable to exploitation  In the framework of the EMPACT Joint Action Days, national authorities targeted human trafficking for sexual exploitation, forced begging and forced criminality. Officers made special checks at borders, bus and train stations, and locations vulnerable to exploitation such as brothels, massage parlours, shelters for families, shelters for victims of domestic violence and hospitals. National authorities also performed preventive actions. For example, Romanian authorities conducted awareness-raising and preventive activities to identify potential victims of human trafficking on their way to destination countries. These activities focused on checks and controls of persons and vehicles, controls in street prostitution areas, and awareness-raising of the threat of human trafficking and exploitation.  National authorities developed a number of investigations linked to the action days. One example is the identification of an individual suspected of child sexual exploitation in Croatia. The suspect was luring victims, mainly minors, via social networks. The investigative activities led to the identification of 16 victims, 14 of which were minors.  UK authorities also conducted focused activities targeting child sexual exploitation. Police forces visited children vulnerable to exploitation and disseminated training materials to hotels and local authorities to help identify children in need of help. During the JAD, approximately 20 % of potential victims identified in the United Kingdom were minors. Results of the actions targeting human trafficking 254 arrests; 910 potential victims identified; 115 suspected traffickers identified; 18 430 officers involved; 205 new cases opened. Global results of the EMPACT Joint Action Days conducted in October 2022 636 arrests; 910 potential victims of human trafficking identified; 2 476 illegal entries detected; Seizures include 106 firearms, half a tonne of drugs (mainly heroin and cannabis), electronic equipment and about EUR 1.7 million in cash; 335 new investigations initiated.   Police, gendarmerie, border guards, customs authorities and national units involved in combating organised crime across Europe cooperated in these EMPACT Joint Action Days. The intelligence-led approach, operational coordination across borders and joint work of all authorities involved contributed to increased interceptions. The information exchange led to the opening of 335 new cases against criminal networks involved in firearms trafficking, drugs trafficking, migrant smuggling and trafficking in human beings. Europol coordinated the exchange of operational information during the EMPACT Joint Action Days and supported the operational coordination. Europol also deployed experts on the ground to provide real-time analytical support to field operatives.  Europol’s officers deployed to Moldova earlier this year, as part of Europol’s support to bordering countries in the context of the war of aggression against Ukraine, also contributed to the action days.  Overall participants in all Joint Action Days EU Member States: Austria, Bulgaria, Croatia, Cyprus, Denmark, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.  Non-EU countries: Albania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, Switzerland, Türkiye, Ukraine and United Kingdom.  EU Agencies: Europol, Eurojust, Frontex International and institutional partners: EUBAM, IPA/2019  (Instrument for Pre-Accession Assistance) countering serious and organised crime in the Western Balkans, INTERPOL, PCC SEE (Police Cooperation Convention For Southeast Europe Secretariat), SEESAC (South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons) and SELEC (Southeast European Law Enforcement Center). * This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.  

During an operational phase carried out between mid-September to the end of November 2022, 8 755 money mules were identified alongside 222 money mule recruiters, and 2 469 individuals were arrested worldwide.  Now in its eighth edition, the European Money Mule Action (EMMA8) has gone international, with actions carried out in countries as far apart as Colombia, Singapore and Australia.  EMMA is the largest international operation of its kind, built around the idea that public-private information sharing is key to fighting complex modern crimes. This year, and with the continuing coordination of the EBF, around 1 800 banks and financial institutions supported law enforcement in this action, alongside online money transfer services, cryptocurrency exchanges, Fintech and KYC companies, and multinational computer technology corporations.   Overview of the results  2 469 money mules arrested; 1 648 criminal investigations initiated; 4 089 fraudulent transactions identified; EUR 17.5 million intercepted. Participating countries  Australia, Austria, Bulgaria, Colombia, Cyprus, Czech Republic, Estonia, Greece, Hungary, Singapore and Hong Kong (China), Ireland, Italy, Moldova, Netherlands, Poland, Portugal, Romania, Slovak Republic, Slovenia, Sweden, Switzerland, Spain, United Kingdom, United States. A link in the money laundering chain Have you ever been asked to help transfer money by: •    An online friend or love interest? •    Someone offering a way to make easy money? •    Someone claiming to need help as they can’t use their own bank account? If yes, you may have been talking to a money mule recruiter - and if you did what they asked, you may have committed a crime. The issue may seem trivial, yet the amount of criminal money being laundered through this method is not. Money mules are a significant part of the money laundering landscape, enabling criminals to swiftly move funds across a network of accounts, often in different countries.  The use of money mules is especially widespread in cybercrime, with the mules transfer the proceeds from their jurisdiction to the criminal’s home country. #DontBeaMule This week Europol, together with international partners, the European Banking Federation and financial institutions, will be raising awareness about this crime and its criminal implications through the #DontBeaMule campaign.  The campaign is available for download in 26 languages and will inform the public about how these criminals operate, how they can recognise the signs and what to do if they become a target.  Do you think you might be used as a mule? Act now before it is too late: stop transferring money and notify your bank and your national police immediately. EMMA8 was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) Cybercrime OFS Operational Action Plan led by the Netherlands.   

The investigation uncovered a large criminal network, which was altering the traceability of horse meat by falsifying transfer and identification documents. During the operational activities, national authorities arrested 35 individuals, including the heads of the network, while targeting 6 companies linked to the criminal organisation. During the raids in Spain, authorities seized half a tonne of horse meat unfit for consumption. Active international cooperation, facilitated by Europol, enabled the dismantling of the criminal scheme with six other arrests made by the Belgian Federal Police. The suspects involved in the criminal network had different functions: from the ones who slaughtered the animals without the necessary controls to the individuals dealing with the transport, the veterinarians providing false documents and the butcher facilities, which sold the meat unfit for consumption. Animal abuse generating millions in illegal profits The suspects acquired horses from across Spain for free or by paying up to 100 euros per animal. Due to several factors, these animals were not destined for the food market and the potential illegal profit was substantial. Once the leader of the criminal network acquired enough livestock to activate the illegal scheme, they set up a complete cattle exploitation facility in 2019 and started exporting the meat to other European markets. Spanish officers raided the clandestine facilities and uncovered 80 horses, which had been abused and were suffering from various untreated diseases due to the lack of veterinary control. This lack of supervision posed a significant risk for the development of zoonotic diseases transmittable to humans. Moreover, the animals endured poor conditions in the cattle facilities, a lack of food and water, as well as permanent stress situations during transport. Even a single illegal shipment generated 35 000 euros for the transporters, with an estimated turnover of EUR 4.5 million in turnover on the logistical side. The criminal network turned dirt into diamonds: horses, that were written off and worth only EUR 100 each, generated illegal profits of about EUR 1.5 million.  Europol coordinated the operational activities, facilitated the information exchange and provided analytical support to national law enforcement authorities. During the action days, Europol deployed experts to Belgium and Spain to cross-check operational information against Europol’s databases in real time and provided leads to investigators in the field.  

Over half of all criminal investigations today involve a cross-border request for electronic evidence. Due to the ongoing development of new technologies, more criminal investigations than ever are dependent on prompt, secure and legal means of sharing electronic evidence across borders. This goal is what guided this year’s SIRIUS conference. The SIRIUS Conference Programme The first day saw a wide-ranging dialogue with policy experts, judicial practitioners and technology companies discussing the latest developments, challenges and the future of digital evidence. The SIRIUS team provided an overview of the progress made in the last year as well as a peek into the upcoming SIRIUS EU Digital Evidence Situation Report 2022.  The second day, restricted to representatives of law enforcement and judicial authorities, explored the process of obtaining electronic evidence in various jurisdictions and crime areas, and delved into the rapidly developing field of Open Source Intelligence (OSINT). This two-day event highlighted the progress that the SIRIUS project has made to date, reflected by its ever-expanding membership and the growing popularity of its key products and services.   The SIRIUS project is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by OSPs. These services are available to law enforcement and judicial authorities via a platform and an application. To this day, SIRIUS serves a community of competent authorities from over 50 countries, representing all EU Member States and a growing number of third countries. The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under contribution agreement No PI/2020/417-500.