ANNEX 7 EUROPOL ACTIVITIES IN COUNTERTERRORISM

Recent developments that include the terrorist attacks in Brussels and Berlin, a number of failed, foiled and also completed other attacks, the propaganda videos that have been produced in European languages by IS to call for attacks, and a high number of arrests on suspicion of terrorist activities, show that the terrorist threat towards the EU is high. Even though a further military defeat of IS in Syria and Iraq is expected, the severity of the threat in the EU may even increase. The videos indeed give the impression that IS is increasingly under strain in Syria and Iraq, but at the same time they show a strategy of mobilising lone actors to commit attacks against citizens in countries of the anti-IS coalition .

To ensure an effective response to the constant changing developments in terrorism, the European Counter Terrorism Centre (ECTC) has been established at Europol, under the authority and direction of the European Council. It builds further on the already established tools and counter terrorism (CT) networks of Europol, but includes a number of new features. These aim at enhancing the CT capabilities and at better facilitating information exchange among CT authorities, to bring cross-border cooperation in this field to a new level.

The ECTC is designed as a central hub in the EU in the fight against terrorism. In fact, it is the single point in the EU where CT operational information from law enforcement from all EU MS, but also from third parties, is brought together for analytical purposes. Specialised teams of CT analysts and experts work on this information to establish the wider EU perspective on CT phenomena for both operational and strategic goals. To ensure efficient information exchange, the ECTC benefits from an excellent network of CT officers throughout the EU and beyond.

The principal task of the ECTC is to provide operational support upon MS’s request for ongoing investigations, such as those following the Paris attacks. The ECTC can assist by cross-checking live operational data with the already available data at Europol, quickly bringing financial leads to light, and by analysing all available investigative details to assist in compiling a structured picture of the terrorist network. In case of a major terrorist event, the ECTC can contribute to the coordinated response. For this purpose different teams are available, often combined with CT experts temporarily seconded from MS, depending on the nature of the event.

One of Europol’s core databases is the Europol Information System (EIS). Through this system, Member States directly share and retrieve information on suspects, convicted persons, events and devices connected with serious and organised crime and terrorism. The EIS offers first-line investigative support as this reference system allows MS to quickly identify whether or not information they are looking for is available in one of the EU MS, with cooperation partners or Europol. In case of a positive hit, more information may then be requested through the user’s Europol National Unit. In December 2016 the EIS held information on over 7800 foreign terrorist fighters, contributed by 24 countries.

For a more in-depth analysis, the ECTC works with the counter terrorism analysis work file (AWF). This file provides the framework for operational analytical support with the MS and third partners. As a result, the number of data categories that are permitted to be stored and processed is broader than in the EIS (within the CT AWF, there is focused analysis on certain CT phenomena). Existing and emerging terrorist phenomena are handled within separate focal points. In these highly secure environments the information is collected, cross-matched and analysed. This is done by dedicated teams of CT analysts and CT experts. Within CT, a major focal point is ‘Travellers’, which deals with foreign terrorist fighters. In response to the concerted efforts of Member States with the assistance of Europol the amount of data on foreign terrorist fighters within Focal Point Travellers increased substantially in 2016, reflecting the increase of entries on foreign terrorist fighters in the EIS.

The ECTC uses an integrated approach, meaning that data inserted in one system is automatically cross-checked against all other databases at Europol, to close intelligence gaps. In addition regular manual checks are carried out.

In an organisation like Europol, with its main focus on information exchange, secure and swift transmission of data is essential, especially when it comes to CT data. Information from a Member State must reach Europol, and vice versa, without the risk of interception. To facilitate this information exchange, the Secure Information Exchange Network Application (SIENA) was designed and has been in use for a number of years by MS, Europol and third parties that have operational cooperation agreements with Europol.

A dedicated area has been created within SIENA especially for CT authorities. This means that CT authorities now have the possibility to send information directly to Europol or other CT authorities. Until very recently, countries could only use SIENA for sending their contributions on terrorism to Europol indirectly, through the Europol National Units and Liaison Bureaux. The extended infrastructure now also allows CT authorities from different countries to directly exchange information amongst themselves, and the involvement of Europol is optional. However, it is recommended that Europol is involved, otherwise possible links to other MS and third partners may remain undiscovered as well as potential links between organised crime and terrorism.

In practice, this means that every CT officer in the Member States can check the EIS from their own computers, or can directly send information to, or receive information, from the focal points. The options described for sharing information are at the discretion of the Member State. The dedicated SIENA CT environment is already operational with 90% of all MS, and in total 46 CT authorities, now connected to the system.

Terrorists’ use of the internet and social media has increased enormously over the course of recent years. Jihadist groups, in particular, have demonstrated a sophisticated understanding of how social networks operate and have launched well-organised, concerted social media campaigns to recruit followers and to promote or glorify acts of terrorism and violent extremism.

As this is a problem that spans multiple linguistic audiences and jurisdictions, a common EU response was necessary, hence the establishment of an Internet Referral Unit (IRU) at the ECTC. The IRU has the following core tasks:

• To coordinate and share the identification tasks (flagging) of terrorist and violent extremist online content with relevant partners;
• To carry out and support referrals quickly, efficiently and effectively, in close cooperation with industry;
• To support competent authorities, by providing strategic analysis and operational analysis.

The ECTC uses a number of tools to help detect financing of terrorism, of which one of the most known is TFTP - the Terrorism Finance Tracking Programme. In 2010, the European Parliament adopted the EU-US Terrorist Finance Tracking Programme (TFTP) Agreement.

Relevant information obtained through the TFTP is provided by the US Treasury Department to Europol, competent authorities of EU Member States and Eurojust (either spontaneously by the US, pursuant to Article 9, or upon request, Article 10), with the aim of combating terrorism and terrorist financing.

The TFTP has proven to be a valuable tool in terrorismrelated investigations - it enhances the ability to map out terrorist networks, often filling in missing links in an investigative chain. It is used to track terrorist money flows, allowing authorities to identify and locate operatives and their financiers, and assists in broader efforts to uncover terrorist cells.

The bomb-making process, potential recipes for the harmful use of explosives precursors as well as potential new threats using chemical, biological, radiological and nuclear (CBRN) materials are monitored daily and crosschecked by Europol specialists at the ECTC. Europol also facilitates cooperation between CBRN and explosives specialists through the European Explosive Ordnance Disposal Network (EEODN). The agency provides seminars and training where responses to potential and realistic scenarios of terrorist attacks can be rehearsed.

Launched in January 2013, the European Cybercrime Centre (EC3) can deliver high-level technical, analytical and digital forensic expertise to support investigations of EU Member States and third parties in cases of convergence of cyber and terrorism.

European Union Member States have recently established the Counter Terrorism Joint Liaison Team (CT JLT) for closer cooperation on cross-border investigations. The team consists of CT experts/analysts from the Member States and Europol.

The ECTC’s core business is to support MS in ongoing investigations, for which it has several teams and analysts available to produce analytical products, ranging from cross-check reports to intelligence notifications, and risk and threat assessments. To provide direct operational support, and to also contribute to a coordinated response in cases of major terrorist attacks or threats, the ECTC applies a scalable approach where other teams can be activated depending on the need. For example, the Europol Emergency Response Team (EMRT). This team exists of Europol experts and analysts with relevant backgrounds and experience, to support emerging investigations on a 24/7 basis.

Between January and December 2016, approximately 363 400 migrants entered Europe by sea, mainly in Greece and Italy. And still, every day, many people attempt to cross those borders to escape the atrocities in Syria and Iraq. There is no concrete evidence that terrorist travellers systematically use those flows of refugees to enter Europe unnoticed, but it is indisputable that some terrorists have entered the EU posing as a refugees, as was seen in the Paris attacks of 13 November 2015.

To counter this threat, Europol has recently approved the recruitment of up to 200 counter-terrorist and other investigators for deployment to migration hotspots in Greece and soon also to Italy. Up to 50 of these “guest officers” will be deployed on rotation at key points on the external borders of the EU to strengthen security checks on the inward flows of migrants, in order to identify suspected terrorists and criminals, establishing a second line of defence.