EUROPOL COUNTER TERRORISM ACTIVITIES

First-line investigative support: the European Counter Terrorism Centre

Recent developments that include the completed terrorist attacks and a substantial number of failed and foiled attacks, combined with the existence of large numbers of potentially violent jihadist extremists in the EU, indicate that the terrorist threat towards the EU is high. Despite the setback of IS in Iraq and Syria the severity of the threat in the EU may even increase, in relation to returning foreign terrorist fighters and their children and wives who may all pose a danger to the security of EU Member States, but also as this setback could mean that IS will focus even more on the West. Addressing the challenges and making full use of the available Counter Terrorism opportunities is key to countering terrorism effectively. To ensure an effective response to the constantly changing developments in terrorism, the European Counter Terrorism Centre (ECTC) was established at Europol, under the authority and direction of the European Council. It builds further on the already existing tools and counter terrorism networks of Europol, but includes a number of new features. These aim at enhancing the counter terrorism capabilities and at better facilitating information exchange among counter terrorism authorities, to bring cross-border cooperation in this field to a new level. The ECTC is designed as a central hub in the EU in the fight against terrorism. In fact, it is the single point in the EU where counter terrorism operational information from law enforcement from all EU Member States, but also from third parties, is brought together for analytical purposes. Specialized teams of counter terrorism analysts and experts work on this information to construct the wider EU perspective on counter terrorism phenomena for both operational and strategic goals. To ensure efficient information exchange, the ECTC benefits from an excellent network of counter terrorism officers throughout the EU and beyond. The principal task of the ECTC is to provide operational support upon EU Member States’ request for ongoing investigations. The ECTC can assist by cross-checking live operational data with the already available data at Europol, quickly bringing financial leads to light and by analyzing all available investigative details to assist in compiling a structured picture of the terrorist network. If a major terrorist event were to occur, the ECTC can contribute to a coordinated response. Different teams are available for this purpose, often combined with counter terrorism experts temporarily seconded from EU Member States, depending on the nature of the event. To provide direct operational support and to also contribute to a coordinated response if major terrorist attacks or threats were to occur, the ECTC applies a scalable approach where other teams can be activated depending on the need. The Europol Emergency Response Team (EMRT) is an example of this. This team comprises Europol experts and analysts with relevant backgrounds and experience to support emerging investigations on a 24/7 basis.

Europol Information System

One of Europol’s core databases is the Europol Information System (EIS). Through this system, EU Member States directly share and retrieve information, including on suspects, means of communication, financial accounts and firearms, etc. connected with serious and organized crime and terrorism. The EIS offers first-line investigative support, as this reference system allows EU Member States to quickly identify whether or not information relevant to them is available in one of the EU Member States or with non-EU countries or organizations. In case of a positive hit, more information may then be requested through the contributor’s Europol National Unit. At the end of 2018, the EIS held information on 63 353 individuals linked to terrorism (the vast majority linked to the foreign terrorist fighter (FTFs) phenomenon), provided by 34 different contributors.

Further in-depth analysis: Counter Terrorism Analysis Work File and Analytical Projects

For a more in-depth analysis, the ECTC works with the counter terrorism analysis work file (AWF). This file provides the framework for operational analytical support with the EU Member States and non-EU partners. As a result, the number of data categories that are permitted to be stored and processed is broader than in the EIS (within the counter terrorism AWF, there is focused analysis on certain counter terrorism phenomena). Existing and emerging terrorist phenomena are handled within separate files, known as Analysis Projects (APs). In these highly secure environments the information is collected, crossmatched and analyzed. This is done by dedicated teams of counter terrorism analysts and counter terrorism experts. Within counter terrorism, a major AP is the topic of ‘travelers’, which deals with foreign terrorist fighters. The amount of data on foreign terrorist fighters within the AP Travelers increased substantially in 2018 as a result of the concerted efforts of EU Member States with the assistance of Europol. In December 2017, the ECTC opened a new AP on Core International Crimes which is related to war crimes, crimes against humanity and genocide. The ECTC uses an integrated approach meaning that data inserted in one system is automatically crosschecked against all other databases at Europol to close intelligence gaps. In addition, regular manual checks are carried out.

Information exchange: SIENA

In an organization like Europol, with its main focus on information exchange, the secure and swift transmission of data is essential, especially when it comes to counter terrorism data. Information from a Member State must reach Europol and vice versa, without the risk of interception. To facilitate this information exchange, the Secure Information Exchange Network Application (SIENA) was designed and has been in use for a number of years by EU Member States, Europol and third parties that have operational cooperation agreements with Europol. A dedicated area has been created within SIENA especially for counter terrorism authorities. This means that counter terrorism authorities now have the possibility to send information directly to Europol or other counter terrorism authorities. Until recently, countries could only use SIENA to send their contributions on terrorism to Europol indirectly, through the Europol National Unit and Liaison Bureau. The extended infrastructure now also allows counter terrorism authorities from different countries to directly exchange information among themselves, with optional involvement of Europol. Involvement of Europol is recommended to avoid that possible links to other EU Member States and third partners remain undiscovered, as well as to identify potential links between organized crime and terrorism. In practice, this means that every counter terrorism officer in the EU Member States can check the EIS from their own computers and directly send information to, or receive information from, the Analysis Projects. The options described for sharing information are at the discretion of the Member State.

European Union Internet Referral Unit

The EU Internet Referral Unit (EU IRU) coordinates EU efforts to tackle access to online terrorist propaganda and delivering operational support to high profile CT cases. The unit is developing an agile operational support model, in order to further enhance ECTC rapid response to terrorist attacks and expand the EU law enforcement toolbox, especially in niche technical capabilities. The EU IRU keeps abreast with the innovation employed by terrorist groups to exploit the online environment, for the purpose of disseminating terrorist propaganda, recruitment to terrorist organizations and the planning and execution of terrorist attacks. By the end of 2018, the EU IRU supported 222 operations and delivered 339 operational products. It also assessed in total 87 819 pieces of content, which triggered 85 477 decisions for referral, with a success rate of removal of 84.85 % since it was setup in July 2015.

Terrorism Finance Tracking Programme

The ECTC uses a number of tools to help detect the financing of terrorism, one of the best known is the Terrorist Finance Tracking Programme (TFTP). The TFTP was established following an EU-US agreement adopted by the European Parliament in 2010. Relevant information obtained through the TFTP is provided by the US Department of the Treasury to Europol, competent authorities of EU Member States and Eurojust either spontaneously by the US, or upon request, pursuant to Article 9 or Article 10 of the Agreement respectively, with the aim of combating terrorism and terrorist financing. TFTP has proven to be a valuable tool in terrorism-related investigations, it enhances the ability to map out terrorist networks, often by filling in missing links in an investigative chain. It is used to track terrorist money flows, allowing authorities to identify and locate operatives and their financiers and assists in broader efforts to uncover terrorist cells.

Chemical, biological, radiological and nuclear and explosives

Europol is a key partner in the Chemical, Biological, Radiological and Nuclear (CBRN) and Explosives field, working together with the national competent authorities (from EU Member States and non-EU countries) and liaising, assisting and jointly promoting activities and training with the European Commission and other relevant international organizations in these areas of expertise. The European Explosive Ordnance Disposal (EOD) Units Network, with its EOD and CBRN expert working groups continues to be facilitated and actively supported by Europol. This network is one of the main achievements stemming from the EU Action Plan on Enhancing the Security of Explosives. A new platform for the European Explosives Ordnance Units Network on the Europol Platform of Experts (EPE) has become the main communication channel enabling already more than 300 European bomb technicians and CBRN experts to swiftly, efficiently and directly share knowledge, best practices and technical information on recent cases and incidents. The bomb-making process, potential recipes for the harmful use of explosives precursors, as well as potential new threats using CBRN materials, are monitored daily and cross-checked by Europol’s ECTC experts. Information is shared with experts and relevant units within the EU Member States and non-EU countries. Europol assessments, strategic reports and expertise are also timely in detecting security gaps and feeding the EU Policy Cycle through effective cooperation with the European Commission. In October 2017, the European Commission issued a new Action Plan to enhance preparedness against CBRN security risks, enhancing Europol’s role as a key player in CBRN security. The ECTC – Strategy CBRN and Explosives Team also assists EU Member States operationally, both with counter terrorism and serious and organized crime investigations. This includes having Europol staff appointed as court experts.

The Counter Terrorism Joint Liaison Team

The Counter Terrorism Joint Liaison Team (CT JLT) was established by the EU Member States to improve the speed and quality of CT cooperation. It functions as a platform for the swift exchange of operational information and actionable intelligence among dedicated counter terrorism experts and analysts from the EU Member States, associated non-EU countries and Europol. The CT JLT facilitates generating added value to all shared CT cases, acting as a force multiplier to individual counter-terrorism efforts by EU Member States and Third Parties.

Team of rotating Guest Officers at immigration hotspots

Europol provided support to Italy and Greece by deploying short-term Seconded National Experts (Guest Officers) at hotspots on the eastern Aegean islands and in southern Italy. Up to 50 of these Guest Officers are deployed on rotation in order to strengthen the security checks on the inward migration flow, in order to identify suspected terrorists and criminals, thus providing additional security checks. There is no concrete evidence that terrorist travelers systematically use those flows of refugees to enter Europe unnoticed, but it is indisputable that some terrorists have entered the EU posing as a refugee, as was seen in the Paris attacks of 13 November 2015. To counter this threat, Europol has recently approved the recruitment of up to 200 counter terrorist and other investigators for deployment to migration hotspots in Greece and Italy.

European Cybercrime Centre

Launched in January 2013 the European Cybercrime Centre (EC3) delivers high-level technical, analytical and digital forensic expertise to support investigations by EU Member States and non-EU countries in cases of convergence of cyber and terrorism.