Europol Review 2015

Terrorism:

 

Islamic State going global

On the evening of 13 November 2015 three teams of terrorists, operating separately, committed a series of coordinated attacks with automatic rifles and explosives in a stadium, concert hall and at a number of restaurants and bars in Paris. The attacks were deliberately meant to kill and injure as many civilians as possible, and caused the death of 130 people, wounding 368. The so-called Islamic State (IS) claimed responsibility for the attacks, saying that they were committed in retaliation for the French airstrikes on IS targets in Syria and Iraq.

The attacks raised the question of whether IS is changing its prime focus from seizing territory and local resources to more global goals. Its involvement in international terrorism against the West was, until November, limited to attacks on tourists in Muslim-majority countries, and inspiring individuals in Europe to perpetrate lone-actor terrorist attacks. This apparent shift of focus of IS, and also the activities of other terrorist groups threatening the safety of the EU, is closely monitored by counter terrorism experts from EU Member States, supported by Europol specialists and analysts. The overall purpose of these efforts is to make timely interventions possible, and to react effectively to any terrorist activities.

One issue closely linked to IS and religiously inspired terrorism in general, and deserving special attention, is that of returning foreign fighters. The November Paris attacks have once again demonstrated that young Europeans, having returned from Syria and other conflict areas where they had joined rebel groups, are of serious concern for the EU. Several of the Paris attackers, and people around them, had been to Syria before.

Chasing the terrorists and identifying missing links Chasing the terrorists and identifying missing links

Chasing the terrorists and identifying missing links

Chasing the terrorists and identifying missing links

Europol activated the Emergency Response Team (EMRT) immediately after the 13 November 2015 Paris attacks, to support the investigations on a 24/7 basis. Europol counter terrorism (CT) experts, analysts and French and Belgian colleagues worked round the clock to assist from Europol offices in The Hague and on the spot where investigations were taking place. They analysed an enormous amount of data generated by the criminal investigations being carried out in both countries. Altogether five mobile offices with staff members were deployed in Belgium, Paris and Lyon (Interpol) to assist French and Belgian investigators. This included expert Arabic language support from Europol’s Internet Referral Unit.

Europol was able to demonstrate its ability to respond quickly and effectively to support counter-terrorism and criminal investigations whenever a major terrorist incident may require the investigations to have a transnational or international scope.

New characteristics and modus operandi of recent IS attacks New characteristics and modus operandi of recent IS attacks

New characteristics and modus operandi of recent IS attacks

  • Mumbai-style tactics
  • Development from series of lone-actor to major terrorist attacks by an international network
  • Capacity to strike at will, at any time and at almost any chosen targer, with a shift towards a broader strategy of IS going global
  • External action command trained for special forces-style attacks, in the international environment
  • Foreign terrorist fighters (FTFs) motivated less by religeous zeal and more by social elements (role models, peer pressure, seeing themselves as military heroes not religeous martyrs)
  • Significant proportion diagnosed with mental problems and with a criminal record
  • The terrorist threat, like never before, is linked to other security phenomena such as mass migration, weapons trafficking, document counterfeiting and conflicts close to EU borders
Adjusting our response to the new threat Adjusting our response to the new threat

Adjusting our response to the new threat

Fighting terrorism, along with combating serious and organised crime, is Europol’s core business. Europol’s existing CT services have recently been brought together in the European Counter Terrorism Centre (ECTC), staffed by Europol experts and analysts, and operational from 1 January 2016. The ECTC maximises Europol’s operational, technical and intelligence exchange capabilities.

These include monitoring Arab language terrorist websites and social media, and tracking terrorist support networks through information on financial transactions. The EU IRU - Internet Referral Unit – one of the core CT services composing the ECTC, identifies and analyses terrorist content on the internet and social media, and works with private sector companies to remove it.

The ECTC also houses the EU Bomb Data System (EBDS) a platform for the timely sharing of relevant information and intelligence on incidents involving explosives, incendiary and explosive devices, as well as chemical, biological, radiological and nuclear (CBRN) materials.

Fighting terrorist and extremist propaganda on the internet Fighting terrorist and extremist propaganda on the internet

Fighting terrorist and extremist propaganda on the internet

Terrorists' use of the internet and social media has increased significantly in recent years. Via the internet, terrorists can now reach millions of people through a single click. This gives them a powerful tool to reach their audiences. The number of internet users worldwide is estimated at more than 3 billion people, according to the International Telecommunication Union (ITU)4.

Jihadist groups in particular have demonstrated a sophisticated understanding of how social networks operate. They have launched well-organised concerted social media campaigns to recruit followers and to promote or glorify acts of terrorism or violent extremism. In doing this, they have been empowered by the use of Internet in unprecedented ways.

To tackle this phenomenon, on 12 March 2015, the Justice and Home Affairs Council of the European Union mandated Europol to establish a dedicated unit aimed at reducing the level and impact of terrorist and violent extremist propaganda on the internet.

Results from the Internet Referral Unit, July-December 2015

Referrals of terrorist and extremist propaganda:

  • 1 813 decisions for referral
  • 1 605 removals
  • 89% total referral success rate

On 1 July 2015 Europol launched the European Union Internet Referral Unit (EU IRU) to combat terrorist propaganda and related violent extremist activities on the internet. It would do this by:

  • coordinating and sharing the identification (flagging) of terrorist and violent extremist online content with relevant partners;
  • carrying out and supporting referrals quickly, efficiently and effectively, in close cooperation with industry;
  • supporting competent authorities by providing strategic and operational analysis;
  • being a European Centre for Excellence for the abovementioned tasks.

In 2015, the EU IRU was still in its pilot phase and focused on targeting the main terrorist propaganda players. Europol experts followed the development of the jihadist propaganda, by highlighting major shifts in the jihadist narrative and interpreting the core messages broadcast by jihadist organisations. They produced early warning notifications on jihadist threats to EU Member States. From the EU IRU’s inception in July, to December 2015, over 1700 decisions for referral were made. In more than 90% of cases, the content was deleted by the relevant online media platform.

Terrorist finance tracking Terrorist finance tracking

Terrorist finance tracking

The size, structure and scope of terrorist organisations have evolved, and the methodologies to raise, transfer and use funds have subsequently adapted. Funds are required to carry out specific terrorist attacks: expenses may relate to travel to and from the target, the purchase of a range of arms and explosives or false identity documents, use of vehicles, mobile phones, covering of basic expenses, such as food, accommodation and medical treatment.

Europol’s Terrorist Finance Tracking Programme (TFTP) has proven to be a valuable tool in terrorism related investigations. It enhances the ability to map out terrorist networks, often filling in missing links in an investigative chain. It is used to track terrorist money flows, allowing authorities to identify and locate operatives and their financiers, and assists in broader efforts to uncover terrorist cells. While the TFTP is based on queries linked to terrorism and terrorist financing, the generated leads enrich the overall intelligence picture, including the opportunity to identify new lines of inquiry (initially not related to counter terrorism).

Since January 2015 up to the end of January 2016, 50 contributions were submitted by the US authorities and 160 requests were sent by Member States and Europol, generating a total of over 9 400 intelligence leads, of relevance to 28 Member States. This includes close to 100 exchanges within TFTP concerning travelling fighters, leading to over 2 900 leads specific to this phenomenon. The TFTP also supported the investigations into the November 2015 terror attacks in Paris, generating more than 1000 leads so far.

Key trends and information on terrorism Key trends and information on terrorism

Key trends and information on terrorism

Since 2007, Europol has provided law enforcement and intelligence officials, the European Parliament, Council of the EU, policymakers and the general public with facts and figures on terrorism in the European Union. Through its EU Terrorism Situation and Trend Report (TE-SAT), Europol also identifies developing trends in terrorism.

TE-SAT: reporting on the trends in terrorism and extremism in 20155

  • 205 terrorist attacks in the EU, of which the vast majority were attacks by ethno-nationalists and separatist groups
  • 1 053 counter terrorism-related arrests, of which the majority on suspicion of involvement in religiously inspired terrorism
  1. As reported by national competent authorities for the EU Terrorism Situation and Trend Report 2016.footnote 5