REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

Retsudvalget 2017-18
REU Alm.del Bilag 78
Offentligt

currency counterfeiting

SERIOUS

AND

ORGANISED CRIME

THREAT ASSESSMENT

EUROP EAN UN ION

Crime in the age of technology

firearms trafficking

Intellectual property crime

Cybercrime

fraud

money laundering

Trafficking in human beings

drug trafficking

sports corruption

illicit online trade

environmental crime

Organised property crime

document fraud

Migrant smuggling

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

SOCTA 2017

Reproducion is authorised provided the source is acknowledged. For any use or reproducion of individual

photos, permission must be sought directly from the copyright holders.

This publicaion and more informaion on Europol are available on the Internet:

Website: www.europol.europa.eu

Facebook: www.facebook.com/Europol

Twiter: @Europol

YouTube: www.youtube.com/EUROPOLtube

ACKNOWLEDGEMENTS

The EU Serious and Organised Crime Threat Assessment (SOCTA) is the product of systemaic analysis of law

enforcement informaion on criminal aciviies and groups afecing the EU. The SOCTA is designed to assist

decision-makers in the prioriisaion of serious and organised crime threats.

It has been produced by Europol, drawing on extensive contribuions from the organisaion’s Analysis Work

File on Serious and Organised Crime (AWF SOC) and external partners. Europol would like to express its grat-

itude to Member States, third countries and organisaions, the European Border and Coast Guard Agency

(Frontex), the European Union’s Judicial Cooperaion Unit (Eurojust), the European Monitoring Centre for

Drugs and Drug Addicion (EMCDDA), INTERPOL, and the SOCTA Academic Advisory Group for their valuable

contribuions and input.

PHOTO CREDITS

Europol: pages 6 and 8

Shuterstock: pages 24, 28, 31, 32, 35, 40,

41, 42, 45, 47, 54, 55

Spanish Naional Police: page 18

Spanish Guardia Civil: page 48

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EUROP EAN UN ION

SERIOUS AND ORGANISED CRIME

THREAT ASSESSMENT

Crime in the age of technology

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

TABLE OF CONTENTS

FOREWORD OF THE DIRECTOR

INTRODUCTION

KEY JUDGMENTS

UNDERSTANDING ORGANISED CRIME

Deﬁning serious and organised crime

Organised crime groups (OCGs) and other criminal actors

Engines of organised crime

Drivers of crime

ASSESSING ORGANISED CRIME

Currency counterfeiting

Cybercrime

Drug production, trafﬁcking and distribution

Environmental crime

raud

Intellectual property crime

Organised property crime

People as a commodity

Sports corruption

Trafﬁcking of ﬁrearms

inks bet een serious and organised crime and terrorism

CONCLUSIONS

ANNEX – LIST OF ABBREVIATIONS

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

FOREWORD

OF THE DIRECTOR

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

I am pleased to present the European

Union (EU) Serious and Organised Crime

Threat Assessment 2017 (SOCTA 2017).

The SOCTA 2017 is Europol’s lagship

product providing informaion to Europe’s

law enforcement community and decision-

makers. It serves as the cornerstone of the

EU Policy Cycle for Serious and Organised

Crime.

The Policy Cycle ensures efecive

cooperaion between naional law

enforcement agencies, EU Insituions,

EU Agencies and other relevant partners

in the ight against serious and organised

crime. This is the second ediion of the

SOCTA, following its inaugural ediion

released in 2013. The SOCTA 2017 delivers

a set of recommendaions based on an in-

depth analysis of the major crime threats

facing the EU. The Council of Jusice and

Home Afairs Ministers will use these

recommendaions to deine prioriies for

the coming four years.

The SOCTA 2017 is the outcome of the

work of many contributors from law

enforcement authoriies in the Member

States, in countries with strategic and

operaional agreements with Europol,

our insituional partners in the EU, and

Europol.

Europol is a key partner to the Member

States in meeing security challenges by

providing a highly developed plaform

for the exchange of criminal intelligence

as well as analyical and operaional

support for some of the most complex

internaional invesigaions in the EU to

date. In drating the SOCTA 2017, Europol

harnessed this unique informaion

posiion.

The SOCTA 2017 represents the outcome

of the largest data collecion on serious

and organised crime ever undertaken

in the EU. Europol has been able to use

its singular intelligence capability as the

informaion hub for criminal intelligence

in the EU to analyse and idenify the key

crime threats facing the EU today.

Informed by its analysis of the prevailing

threat, the SOCTA 2017 ideniies a

number of key prioriies, which, in

Europol’s view, require the greatest

concerted acion by Member States and

other actors to ensure the most efecive

impact. These include cybercrime, the

producion, traicking and distribuion of

illicit drugs, migrant smuggling, organised

property crime, and traicking in human

beings (THB). In addiion, Europol

recommends focussing on three cross-

cu ng crime threats with a signiicant

impact across the spectrum of serious and

organised crime – document fraud, money

laundering and the online trade in illicit

goods and services. The SOCTA 2017 also

explores potenial links between serious

and organised crime and terrorism.

In 2013, Europol reported the presence

of at least 3,600 internaionally operaing

Organised Crime Groups (OCGs) in the

EU. In the SOCTA 2017, we idenify

approximately 5,000 internaional OCGs

currently under invesigaion in the EU.

This increase is primarily a relecion of

a much improved intelligence picture.

It is also an indicaion of shits in

criminal markets and the emergence of

smaller groups and individual criminal

entrepreneurs in speciic criminal

aciviies, especially those taking place

online.

These developments highlight the complex

dynamics that shape the serious and

organised crime landscape in the EU. They

also emphasise the need for the coninued

and enhanced exchange of informaion

between law enforcement authoriies

as part of their day-to-day business.

Connecing law enforcement authoriies

and facilitaing the real-ime 24/7

exchange of informaion remains Europol’s

core business.

The SOCTA 2017 is a forward-looking

document that both describes and

anicipates emerging threats from serious

and organised crime. In this ediion of the

SOCTA, we highlight the role of technology

in paricular. Criminals have always been

adept at exploiing technology. However,

the rate of technological innovaion and

the ability of organised criminals to adapt

these technologies have been increasing

steadily over recent years. Developments

such as the emergence of the online trade

in illicit goods and services are set to result

in signiicant shits in criminal markets and

confront law enforcement authoriies with

new challenges.

In idenifying and specifying these

challenges, Europol hopes to provide a

tangible contribuion to the eforts of

Member States and the EU in ighing

serious and organised crime. I look

forward to Europol’s coninued support

for and cooperaion with law enforcement

agencies and other partners in the EU and

beyond.

Rob ain right

Director of Europol

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

INTRODUCTION

The European Union and Europol

The European Union (EU) is a unique

economic and poliical partnership

between 28 European countries.

was created in 1958 as the European

Economic Community with the aim to

foster economic cooperaion among its

six founding partners. Since then, the

number of EU Member States enlarged

and the economic union developed into

an organisaion covering a wide range of

policy areas. The oicial name changed to

the European Union in 1993 to relect the

broader cooperaion on which members’

partnership is based. EU law is built

on a series of treaies, voluntarily and

democraically agreed by all Members.

These agreements set out the EU’s goals in

its main areas of acivity. There are three

main insituions involved in EU legislaion:

the European Parliament, which represents

the EU’s ciizens and its members are

directly elected by them; the Council of

the European Union, which represents

the governments of the Member States

who share the presidency on a rotaing

basis. The third insituion is the European

Commission, which represents the interests

of the Union as a whole.

Europol is the EU’s law enforcement

agency and assists the Member States in

their ight against serious internaional

crime and terrorism. Established as an

EU agency in 2009

, Europol, or the

European Police Oice, is at the heart of

the European security architecture and

ofers a unique range of services. Europol

is a support centre for law enforcement

operaions, a hub for informaion on

criminal aciviies as well as a centre for

law enforcement experise. Analysis is at

the core of Europol’s aciviies. To give its

partners deeper insights into the crimes

they are tackling, Europol produces regular

assessments that ofer comprehensive,

forward-looking analyses of crime and

terrorism in the EU.

The SOCTA

The SOCTA 2017 is the most comprehensive

study of serious and organised crime in

the EU ever undertaken. It is the outcome

of a detailed analysis of the threat of

serious and organised crime facing the EU

providing informaion for praciioners,

decision-makers and the wider public. As a

threat assessment, the SOCTA is a forward-

looking document that assesses shits in

the serious and organised crime landscape.

The SOCTA 2017 sets out current and

anicipated developments across the

spectrum of serious and organised crime,

ideniies the key criminal groups and

individuals acive in criminal aciviies

across the EU and describes the factors in

the wider environment that shape serious

and organised crime in the EU. The SOCTA

2017 also describes the dynamics that drive

organised crime in the age of technology

and relects on how OCGs and individual

criminal entrepreneurs seek to exploit the

latest technological innovaions.

The SOCTA is the product of close

cooperaion between Europol, the law

enforcement authoriies of the Member

States and third paries such as EU

agencies, internaional organisaions and

countries outside the EU with strategic or

operaional agreements with Europol. The

involvement of these crucial stakeholders

is also relected in the SOCTA’s role as the

cornerstone of the EU Policy Cycle for

Serious and Organised Crime in the EU.

The Member States of the EU are: Austria,

Belgium, Bulgaria, Croaia, Cyprus, Czech Republic,

Denmark, Estonia, Finland, France, Germany,

Greece, Hungary, Ireland, Italy, Latvia, Lithuania,

Luxembourg, Malta, Netherlands, Poland, Portugal,

Romania, Slovakia, Slovenia, Spain, Sweden, and

United Kingdom.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

The EU Policy Cycle for Serious

and Organised Crime in the EU

The Policy Cycle provides a robust

framework that brings together the law

enforcement authoriies of the Member

States, Europol and a wide range of muli-

disciplinary partners in the ight against

serious and organised crime. The Policy

Cycle translates strategic objecives at the

European level into concrete operaional

acions against serious and organised

crime.

The Policy Cycle is a methodology adopted

by the European Union in 2010 to address

the most signiicant criminal threats facing

the EU. Each cycle lasts four years and

opimises coordinaion and cooperaion on

the crime prioriies agreed by all Member

States. During the cycle, all concerned

services and stakeholders, at naional and

EU level, are invited to allocate resources

and mutually reinforce eforts. Emerging

threats are also monitored so that they

can be efecively addressed. Relying on

the analyical indings of the SOCTA 2017,

the Council of Jusice and Home Afairs

Ministers of the EU will decide on the

prioriies in the ight against serious and

organised crime for the second full Policy

Cycle from 2018 to 2021. These prioriies

will determine the operaional work carried

out in the framework of the Policy Cycle

for the next four years. The crime prioriies

agreed at European level in the context of

the Policy Cycle are relected in operaional

aciviies at Member State level.

The SOCTA Methodology

As part of an iteraive process, the SOCTA

Methodology has been further developed

and reined by experts at Europol and from

the law enforcement authoriies of the

Member States. The SOCTA Methodology

allows Europol to understand and assess

serious and organised crime holisically.

The SOCTA analyses and describes criminal

markets and crime areas in the EU; the

OCGs or individual criminals carrying out

these criminal aciviies; as well as the

factors in the broader environment that

shape the nature of serious and organised

crime in the EU. Using a mixed methods

approach of qualitaive and quanitaive

analysis techniques and a set of clearly

deined indicators, Europol is able to

idenify and specify the most threatening

criminal phenomena in the EU. Europol

arrives at the recommended prioriies for

the ight against serious and organised

crime for the Policy Cycle based on this

Methodology. The SOCTA Methodology

ensures transparency and reliability

providing decision-makers with a solid

basis for their deliberaions. The SOCTA

Methodology is a public document and can

be accessed online.

Data and sources

The indings of the SOCTA 2017 are the

outcome of detailed analysis of intelligence

gathered as part of the largest data

collecion on serious and organised crime

ever undertaken in the EU. Member States,

cooperaion partners outside the EU and

insituional partners contributed more

than 2,300 quesionnaires on crime areas

and OCGs. The amount of data provided

for the SOCTA 2017 has more than doubled

compared to the SOCTA 2013.

In addiion, Europol relied heavily on the

operaional intelligence held in its Analysis

Work File on Serious and Organised Crime

(AWF SOC) to provide a thorough and

extensive analysis of the criminal threats

facing the EU. Where appropriate, the

data collected through quesionnaires

and available in Europol’s databases were

complemented by informaion from open

sources.

The SOCTA 2017 is the

most comprehensive

study of serious and

organised crime in the EU

ever undertaken.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

KEY JUDGMENTS

ORGANISED

CRIME GROUPS

Serious and organised crime in

the EU features a great variety

of criminal aciviies, which are

increasing in complexity and scale.

The proits generated by some of

the successful OCGs and individual

criminals acive in the EU are

enormous and rival those of muli-

naional corporaions.

More than 5,000 OCGs operaing

on an internaional level are

currently under invesigaion

in the EU. The number of

OCGs operaing internaionally

highlights the substanial scope

and potenial impact of serious

and organised crime on the EU.

TECHNOLOGY AND ENGINES OF ORGANISED CRIME

Criminals quickly adopt and integrate new

technologies into their

modi operandi

or build

brand-new business models around them. The

use of new technologies by OCGs has an impact

on criminal aciviies across the spectrum of

serious and organised crime. This includes

developments online, such as the expansion

of online trade and widespread availability of

encrypted communicaion channels, as well

as other aspects of technological innovaion

such as more accessible and cheaper high-

performance drone technology. Technology has

a fundamental and lasing impact on the nature

of crime.

Document fraud, money laundering and the online trade in illicit goods and

services are the engines of organised crime in the EU. Although neither

document fraud nor money laundering have a direct impact on most ciizens in

the EU, they facilitate most, if not all, other serious and organised crime. The

online trade in illicit goods and services is expanding rapidly. Almost all types of

illicit goods are now bought and sold via online plaforms that ofer the same

ease of use and shopping experience as most legal online plaforms. Depending

on the type of commodity and service, this includes plaforms both on the

surface web and the Darknet. Data is also traded as a commodity. The online

trade in illicit goods and services is foreseen to increasingly disrupt established

criminal markets and their tradiional distribuion models over the next few

years.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

Many of the OCGs are highly

lexible and display great

adaptability in the speed with

which they adjust their

modi

operandi

or whole business models

to changes in the environment.

Many criminal aciviies are

increasingly complex and require a

variety of skills as well as technical

experise to carry them out.

The most threatening OCGs are

those which are able to invest

their signiicant proits in the

legiimate economy as well as into

their own criminal enterprises,

ensuring business coninuity

and a further expansion of their

criminal aciviies. The involvement

in serious and organised crime

may allow some terrorist groups

to generate funds to inance

terrorism-related aciviies.

An increasing number

of individual criminal

entrepreneurs ofer Crime-as-

a-Service (CaaS). The online

trade in illicit goods and services

enables individual criminals

to operate their own criminal

business without the need for

the infrastructures maintained

by ‘tradiional’ OCGs.

CRIMINAL ACTIVITIES

Cybercrime is a key challenge to digital

economies and socieies. Cyber-dependent

crime is underpinned by a mature CaaS

model, providing easy access to the tools

and services required to carry out cyber-

atacks. Child Sexual Exploitaion (CSE)

perpetrated online is increasingly proit

driven. The growth of card-not-present

(CNP) fraud, coupled with successful

industry measures to tackle card-present

(CP) fraud, has resulted in CNP fraud

accouning for 66% of total card fraud value.

The illicit drugs market remains the largest

criminal market in the EU. More OCGs

are acive in the producion, traicking

and distribuion of illicit drugs than any

other phenomenon. The industrial-scale

producion of syntheic drugs within the EU

coninues to expand and cements the EU

as a key source region for these substances

distributed worldwide. OCGs maintain

complex traicking operaions cooperaing

with OCGs on a global scale to orchestrate

the wholesale importaion of illicit drugs

into the EU. Within the EU, the majority of

OCGs involved in the distribuion of illicit

drugs deal in muliple illicit drugs, also

called poly-drug traicking.

Migrant smuggling has emerged as one

of the most proitable and widespread

criminal aciviies for organised crime in

the EU. The migrant smuggling business is

now a large, proitable and sophisicated

criminal market, comparable to the

European drug markets.

Organised property crime encompasses a

range of diferent criminal aciviies carried

out predominantly by highly mobile OCGs

operaing across the EU. A steady increase

in the number of reported burglaries over

recent years is a paricular concern in many

Member States.

THB for labour exploitaion is increasing and

is expected to coninue to expand. OCGs are

expected to exploit the presence of a large

number of potenially vulnerable persons

in the EU following the migraion crisis.

Labour exploitaion threatens to undermine

the legiimate labour market lowering

wages and impeding economic growth.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING

ORGANISED CRIME

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

DEFINING

SERIOUS AND

ORGANISED CRIME

OCGs are as varied as the markets they

service and the aciviies they engage in.

In many cases, OCGs relect the socieies,

cultures and value systems they originate

from. As socieies across Europe become

more interconnected and internaional in

outlook, organised crime is now also more

connected and internaionally acive than

ever before.

Since the year 2000, the United Naions

Convenion against Transnaional

Organized Crime has provided an

internaionally shared deiniion of an

organised criminal group as

“a group of

three or more persons exising over a

period of ime acing in concert with the

aim of commiing crimes for inancial or

material beneit.”

This deiniion was also

adopted in the EU’s Council Framework

Decision 2008/841/JHA of 24 October

2008 on the ight against organised crime

and coninues to relect law enforcement

authoriies’ conceptualisaion of organised

crime across the world. However, this

deiniion does not adequately describe

the complex and lexible nature of modern

organised crime networks.

OCGs operate in a criminal economy

dictated by the laws of supply and demand

and are favoured by social tolerance

for certain types of crime such as the

trade in counterfeit goods and speciic

frauds against public authoriies or large

companies. These factors will coninue

to shape the organised crime landscape.

Individual criminals and criminal groups

are lexible and quickly adapt to exploit

new vicims, to evade countermeasures or

idenify new criminal opportuniies.

Who

CaaS

CRIME AS A SERVICE

ORGANISED CRIME

GROUPS

CRIMINAL NETWORKS

CRIMINAL EXPERTS

How

CORRUPTION

COUNTERMEASURES

AGAINST LAW

ENFORCEMENT

CRIMINAL FINANCES

(MONEY LAUNDERING)

DOCUMENT FRAUD

ONLINE TRADE

TECHNOLOGY

VIOLENCE AND

EXTORTION

What

FRAUD

Excise fraud

Investment fraud

Mass marketing fraud

Payment order fraud

Value Added Tax fraud

CURRENCY

COUNTERFEITING

CYBERCRIME

Child sexual exploitation

Cyber-dependent crimes

Payment card fraud

DRUG PRODUCTION

TRAFFICKING AND

DISTRIBUTION

ILLICIT WASTE

TRAFFICKING

INTELLECTUAL

PROPERTY CRIME

MIGRANT SMUGGLING

ORGANISED

PROPERTY CRIME

SPORTS

CORRUPTION

TRAFFICKING OF

ENDANGERED SPECIES

TRAFFICKING

OF FIREARMS

TRAFFICKING IN

HUMAN BEINGS

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING ORGANISED CRIME

ORGANISED CRIME GROUPS

(OCGs)

AND OTHER CRIMINAL ACTORS

5,000

>180

nationalities

involved

international OCGs

currently under

investigation

The OCGs and individual criminals

operaing in the EU are highly diverse.

They range from large ‘tradiional’ OCGs

to smaller groups and loose networks

supported by individual criminals, who are

hired and collaborate

ad hoc.

More than

5,000 OCGs operaing on an internaional

level are currently under invesigaion in

the EU. This igure does not necessarily

relect an overall increase in organised

crime acivity in the EU compared to 2013,

when Europol reported on the aciviies of

3,600 internaionally operaing OCGs in the

EU. This increase is primarily a relecion

of a much improved intelligence picture.

The increase also points to the emergence

of smaller criminal networks, especially in

criminal markets that are highly dependent

on the internet as part of their

modi

operandi

or business model. Overall, the

number of OCGs operaing internaionally

highlights the substanial scope and

potenial impact of serious and organised

crime on the EU.

The criminal markets involving illicit drugs,

traicking of human beings and migrant

smuggling atract the largest numbers

of OCGs and coninue to generate the

greatest proits among the various criminal

markets in the EU. However, emerging

crime phenomena such as the online trade

in illicit goods and services may eclipse

these markets in size and proits in the

future. The online trade in illicit goods

and services is no longer merely a

modus

operandi,

but an expanding, highly dynamic

and substanial criminal market itself.

Over the past few years, criminals of

more than 180 naionaliies were involved

in serious and organised crime in the

EU. The majority of OCGs operaing on

an internaional level are composed of

members of more than one naionality.

Nonetheless, the majority of the suspects

(60%) involved in serious and organised

crime in the EU are naionals of a Member

State.

Structure

The diversity of the criminal

actors operaing in the EU is

also relected in the structures

of the OCGs. 30% to 40% of

the OCGs operaing on an

internaional level feature

loose network structures. An

approximate 20% of these

networks only exist for a short

period of ime and are set up

to support speciic criminal

ventures. Hierarchically

structured OCGs coninue to

dominate tradiional criminal

markets.

The fragmentaion of the

serious and organised crime

landscape and the emergence

of more groups and looser

networks detailed in the

SOCTA 2013 did not afect

all criminal markets. The

fragmentaion of criminal

markets was paricularly

pronounced in relaion to highly

cyber-dependent criminal

aciviies. Around these types

of aciviies, an increasing

number of individual criminal

entrepreneurs come together

on an

ad hoc

basis for speciic

criminal ventures or to deliver

CaaS.

30-40%

LOOSE

NETWORKS

Most OCGs are organised

HIERARCHICALLY

20%

SHORT-TERM

VENTURES

24%

Composition

up to ﬁve

members

76%

six or more

members

serious and

60%

of the suspects involved inare EU nationals.

organised crime in the EU

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

Activities

More than one third of the OCGs acive in the

EU are involved in the producion, traicking

or distribuion of drugs. Other key criminal

aciviies for OCGs in the EU include organised

property crime, migrant smuggling, THB and

excise fraud.

Involvement of OCGs active in the EU in different crime areas

INTERNATIONAL

DIMENSION AND MOBILITY

Organised

property

crime

Drug trafﬁcking

Trafﬁcking in

human beings

Excise fraud

Migrant

smuggling

7 out of 10

OCGs are typically active in

more than three countries

TRENDS

Poly-criminality

45% of the OCGs reported for the SOCTA

2017 are involved in more than one

criminal acivity. The share of these poly-

criminal groups has increased sharply

compared to 2013.

OCGs also oten engage in more than

one criminal acivity to miigate risks,

reduce operaional costs and increase

proit margins. The OCGs involved in the

traicking of illicit goods are the most

poly-criminal groups in the EU. These

groups typically traic more than one illicit

commodity such as counterfeit goods or

diferent types of illicit drugs.

Many OCGs are highly lexible and able

to shit from one criminal acivity to

another or to add new criminal aciviies

to their crime porfolio. In many cases,

OCGs operate on an on-demand basis

and only become acive once new proit

opportuniies emerge.

Poly-criminality

45%

reported for the SOCTA

of the OCGs

2017 are involved in more than one

criminal activity

Many OCGs have expanded their

crime portfolio in response to the

sustained high level of demand for

smuggling services during the

migration crisis.

The integraion of digital systems in many

criminal aciviies and the expansion of the

online trade in illicit goods and services

is transforming serious and organised

crime. Criminals are increasingly adaping

the supply chain models of global online

retailers.

The concept of CaaS has been an emerging

feature of various criminal markets for

some years. However, increasingly OCGs

also openly adverise

ad hoc

opportuniies

for individual criminals to provide them

with support or experise for speciic

criminal ventures.

OCGs operaing on an internaional

level are typically acive in more than

three countries (70%). A limited number

of groups is acive in more than seven

countries (10%).

Sharing Economy

An increasing number of individual criminal

entrepreneurs come together on an ad hoc

basis for speciﬁc criminal ventures or to

deliver CaaS

Since 2012, Europol has been supporing the German-led ISEC project

on “Strengthening cross-border operaional cooperaion in the ight

against mobile organised crime groups (MOCGs) from the Balic Sea

Region, including Russian-speaking MOCGs”. The project has resulted

in the dismantling of more than 100 OCGs. A total number of 575

arrest warrants were issued. The damage caused by the MOCGs

targeted by this project exceeded EUR 65 million. These MOCGs mainly

carried out organised property crime, drug traicking, document

counterfeiing and money laundering.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING ORGANISED CRIME

Corruption

OCGs use corrupion to iniltrate public

and private sector organisaions relying

on bribery, conlicts of interest, trading in

inluence and collusion in order to facilitate

their criminal aciviies. Corrupion distorts

legiimate compeiion and erodes public

trust in authoriies and legal systems.

Corrupion is used to enable all types of

criminal acivity. However, the prevalence

and scale of corrupion associated with dif-

ferent crimes vary. Some criminal aciviies

use corrupion as an integral part of their

modus operandi.

Corrupion is increasingly facilitated by on-

line services. Some criminals use cryptocur-

rencies and alternaive banking plaforms

to transfer funds to their accomplices in the

public and private sector. The use of these

techniques makes it more diicult to detect

inancial lows and to uncover corrupion.

OBJECTIVES OF CORRUPTION

OBTAIN

INFORMATION

STAY OFF

THE RADAR

SUPPORT

ACTIVITIES

Upcoming controls

Ongoing investigations

Conﬁdential data

Obstruction of justice

Witness intimidation

Avoid controls

Ease transport

Obtain permits

Bid rigging

iolence and e tortion

OCGs tend to avoid the use of violence. Violence usually atracts

law enforcement atenion, which is oten incompaible with the

proit-driven moivaions of those involved in organised crime.

OCGs mostly employ violence against members of their own or

compeing OCGs. Violent crimes targeing rival OCGs oten take

place in the context of “turf wars” over territory or inluence. OCGs

extort property or money from individuals by inimidaing their

vicims, threatening to carry out serious harm and murder. Very

few OCGs engage in extorion as their core acivity. Some OCGs

ofer to carry out racketeering and extorion as a service for other

criminal networks and lend “professional extorters” to ailiated

OCGs.

Hostage takers kidnap, hold and release individuals in exchange

for ransom payments. In the EU, this criminal acivity is not widely

carried out by OCGs. However, OCGs involved in migrant smuggling

have been known to use the threat of kidnapping in order to extort

debt payments.

Countermeasures against la enforcement

Countermeasures are the acions and behaviours of individual

criminals and criminal groups to disrupt or prevent law

enforcement aciviies against them. OCGs use various

countermeasures to recognise and miigate law enforcement

acions.

The applicaion of countermeasures requires an awareness of the

methods and techniques used by law enforcement authoriies in

invesigaing criminal networks.

OCGs use a number of countermeasures to secure their

communicaion against law enforcement surveillance. These

include technical countermeasures such as the use of encrypion,

foreign and pre-paid SIM cards or satellite telephones as well as

reliance on code. To evade physical surveillance during transport,

OCGs frequently change vehicles, oten hired or leased using

fraudulent IDs.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

ENGINES OF ORGANISED CRIME

CE AU

RT DU

IF LE

IC NT

ES TRA

AN NS

D PO

DE R

CL T O

AR RD

AT ER

IO S ,

NS C

Document fraud, money laundering and the online trade in illicit

goods and services are the engines of organised crime. These

cross-cu ng criminal threats enable and facilitate most, if not all,

other types of serious and organised crime. The business models

of OCGs acive across the spectrum of serious and organised crime

rely on document fraud, money laundering and online trade to

maintain their criminal enterprises.

DOCUMENT

FRAUD

IVIN

TIT S, DR

EN D

D ID CAR

L A , ID

AVE ORTS

ENT (PASS TC.)

UL TS

RA MEN VISAS

DO ENSES

LIC

ES,

TH CERTIFICAT

CUMENTS (BIR

BREEDER DO

ORK CONTRACTS

GE RECORDS, W

MARRIA

TAY IN THE EU)

VITATIONS TO S

SALE AND

STO

LEN

RENTAL OF

GEN

UINE DOCU

MENTS

L AN

OCU

MEN

SERIOUS

AND

ORGANISED

CRIME

ONLINE TRADE

IN ILLICIT

GOODS AND

SERVICES

ILLICIT

DRUGS

FIREARMS

COUNTER

FEIT GOO

FRAU

DULE

NT DO

COU

CUME

NTE

NTS

RFE

IT C

URR

ENC

MONEY

LAUNDERING

CAS

SMU

GGL

I NG

MONEY L

AUND

ERING S

DICATES

TRADE-BASED MONEY LAUNDERING

SUCH ND

THOD

T ME AYMENT HERS

OUC

INE P

PAYM

NEW IES, ONL ERNET V

INT

RENC

OCUR

CRYP

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING ORGANISED CRIME

CRIMINAL FINANCES AND MONEY LAUNDERING

Money laundering sustains

and contributes to the

growth of criminal markets

across the EU.

Money laundering is linked

to virtually all criminal

activities generating criminal

proceeds.

Money laundering allows OCGs to

introduce the proceeds of crime into the

legiimate economy. Almost all criminal

groups need to launder proits generated

from criminal aciviies. However, the

way in which money laundering is carried

out varies greatly depending on an

OCG’s level of experise as well as the

frequency and scale of money laundering

aciviies. Criminal networks coninuously

seek to exploit the latest technological

developments such as cryptocurrencies

and anonymous payment methods. Rapid

transacion processing and the proliferaion

of efecive anonymisaion tools are

signiicant obstacles in the ideniicaion of

the beneicial owners of criminal proceeds.

A growing number of online plaforms and

applicaions ofer new ways of transferring

money and are not always regulated to the

same degree as tradiional inancial service

providers. Money launderers heavily

rely on document fraud to facilitate their

aciviies. Fraudulent documents such as

false invoices and forged ID documents

are used to conceal the origin of criminal

cash, to open bank accounts or to establish

shell companies. Money launderers provide

services to both organised crime and

terrorist organisaions.

Money laundering syndicates

OCGs increasingly use money laundering

syndicates acing as illegal service

providers to launder money. In exchange

for a commission of between 5% and 8%,

these syndicates ofer complex laundering

techniques and carry out the laundering

operaions on behalf of other OCGs.

Cash

Cash remains at the core of the money

laundering business. Cash coninues to be

smuggled by couriers and, increasingly, by

post and parcel services.

OPERAT ION KOURI

OPERAT ION SNAK E

In 2015, Europol supported Spanish

authoriies in dismantling a Chinese network

involved in the laundering of criminal

proceeds from THB for labour exploitaion,

the producion of counterfeit goods as well

as excise tax fraud. Relying on middlemen

and third paries, the OCGs had established

complex corporate structures and various

accounts to transfer money to China. In

addiion to their main criminal aciviies,

the group also ofered money laundering

and internaional remitance services to

other OCGs based in the EU in exchange for

a negoiated percentage of the laundered

funds. Between 2009 and 2015, the European

branch of this OCG had laundered more than

EUR 340 million.

In 2016, a Joint Invesigaion Team (JIT)

composed of French, Belgian and Dutch

invesigators, Eurojust and Europol

dismantled a complex network involved in

the laundering of drug traicking proceeds

based in Morocco. Cash couriers travelling by

car collected up to EUR 1 million per month in

cash across Western Europe and transported

it to Belgium and the Netherlands to be

transferred to Morocco via the Middle East

using the Hawala system. The operaion

resulted in the seizure of more than EUR 7.1

million in cash.

OPERATION SNAKE

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

Trade-based money laundering

Trade-based money laundering is a highly

efecive way of concealing criminal funds

by manipulaing or forging purchases or

sales using double invoicing, false invoicing,

over- and under-invoicing by companies

that are owned by OCGs, their associates

and relaives.

OPERAT ION K ANDIL

Ne payment methods

A 2016 invesigaion by French, Spanish,

German and Dutch law enforcement

authoriies disrupted an OCG laundering the

proceeds generated by the trade of heroin.

This OCG collected proceeds throughout the

EU and laundered the funds in Middle Eastern

countries relying on cash couriers and trade-

based money laundering techniques. The

OCG purchased expensive second-hand cars,

heavy machinery and construcion equipment

in Germany in cash and exported them to

Iraq where they were again sold for cash. The

group then used Money Service Businesses

and Hawala to introduce the funds into the

legiimate inancial system, leaving virtually

no paper trail.

New payment methods such as

cryptocurrencies, prepaid cards, online

payments and internet vouchers are

coninuously emerging and are generally

less well-regulated than tradiional

payment methods. In combinaion with

alternaive banking plaforms, these new

payment methods allow the movement

of large amounts of criminal funds.

Underground banking systems are inancial

networks operaing outside of normal

banking channels to transfer money

internaionally, avoiding the fees and

regulaions of convenional banks.

MONEY LAUNDERING

Most common methods

CASH SMUGGLING

by couriers or using post

and parcel services

TRADE-BASED MONEY

LAUNDERING

False invoicing and forged ID

documents are used by shell

companies owned by OCGs to

conceal criminal funds

MONEY LAUNDERING

SYNDICATES

relying on a network of

middlemen and complex

laundering techniques

ORGANISED

CRIME GROUPS

TERRORIST

ORGANISATIONS

NEW PAYMENT METHODS

such as cryptocurrencies and

anonymous payment methods are

signiﬁcant obstacles in the

identiﬁcation of the beneﬁcial

owners of criminal proceeds

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING ORGANISED CRIME

DOCUMENT FRAUD

The use of fraudulent

documents in the EU has

signiﬁcantly increased. It

represents a signiﬁcant threat

to the EU.

Document fraud is a key

enabler of all types of criminal

activity as well as terrorism.

Document fraud is also

expected to emerge as one of

the fastest growing criminal

markets over the coming years.

High-quality counterfeit

documents are primarily

produced by highly specialised

counterfeiters.

Fraudulent documents are

increasingly traded online and

trafﬁcked using post and parcel

services.

Document fraud is a key facilitator for

organised crime. Document fraud entails

the producion and use of counterfeit

documents as well as the use of

genuine documents obtained by means

of decepion or misrepresentaion.

The producion and use of fraudulent

documents has also been linked to terrorist

actors. Document fraudsters and forgers

manipulate or produce all types of idenity,

travel and administraive documents.

Fraudulent documents are used and traded

extensively among OCGs and represent

a signiicant obstacle in the ight against

serious and organised crime. Fraudulent

IDs are in high demand and are the most

commonly traded type of fraudulent

document. Increasingly, fraudulent

documents are traded online. Online

marketplaces are used by criminals to

display the range of genuine documents on

ofer and allow document forgers to receive

orders directly from clients.

Understanding the different types of document fraud

GENUINE

DOCUMENT

OCGs dealing with

genuine documents

exploit weaknesses in

the issuance chain of

documents and

beneﬁt from the ease

with which citizens

can claim new ones

FALSE

DOCUMENT

LOOKALIKE

Used by someone other

than the legitimate owner,

based on physical

resemblance

FORGED

A genuine document with

some alterations

B ERL IN CHRIST M AS MARKE T AT TACK

On 19 December 2016, a Tunisian suspect

drove a truck into a Christmas market in the

centre of Berlin, Germany. The terrorist atack

let 12 people dead and 56 others injured.

The perpetrator was a rejected asylum

seeker from Tunisia and had previously been

suspected of involvement with the Islamic

State. Ater his asylum claim was rejected, the

suspect travelled throughout Europe using

muliple idenity documents under diferent

aliases.

EXPIRED

Used by its legitimate

owner after its expiry date

COUNTERFEITED

An entirely fabricated

document

FRAUDULENTLY

OBTAINED

through false supporting

documents or corruption

STOLEN BLANK

from an administration

and ﬁlled with the client s

biographical data

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

The production of forged

documents

Increasingly sophisicated security features

protecing documents against forgery

as well as improved technical control

measures have compelled OCGs to improve

the quality of fraudulent documents.

Suppliers of raw materials now primarily

rely on Darknet marketplaces to sell their

products.

The sale and rental of genuine

documents

The sale or rental of travel and idenity

documents such as passports is an

increasing concern. There has been a

signiicant increase in the number of

lost and stolen documents in circulaion.

Instability and armed conlicts oten allow

criminal groups to obtain blank documents

from the afected regions. This is also

true for conlict zones on the periphery of

the EU and has been highlighted by the

widespread availability of thousands of

non-EU blank idenity documents.

A multi-purpose tool

Fraudulent documents are muli-purpose

criminal tools and each document can

be used repeatedly to support diferent

criminal aciviies. Documents forgers are

service providers oten cooperaing with

muliple OCGs involved in various criminal

aciviies.

THE MAIN CRIME AREAS LINKED TO OR SUPPORTED BY DOCUMENT FRAUD

Drug

trafﬁcking

Fraud

Migrant

smuggling

Money laundering

Property crime

Terrorism

Trafﬁcking in

Human Beings

reeder documents

DOCU M ENT FORGERY AN D M IGRANT SM UGGLING

In May 2016, Greek and Czech law enforcement authoriies arrested

several suspects involved in the forgery of documents and migrant

smuggling as part of an internaional invesigaion supported by

Europol. The forged documents were subsequently provided to

irregular migrants to enter the EU or to legalise their stays there. The

invesigaion in Greece highlighted the structure and the hierarchy

of the Athens-based network. The fees for the forged documents

ranged from EUR 100 to EUR 3,000 per piece depending on the

quality, type and country of issue. The documents forged by the

criminal group included passports, naional ID cards, visas, driving

licences, asylum seekers’ registraion cards and residence permits.

Breeder documents are documents that are used to obtain other

forms of legiimate ideniicaion for the purpose of establishing

a false idenity. Fraudulent breeder documents are typically used

to apply for genuine travel and idenity documents and driving

licences. Birth ceriicates, marriage records, work contracts or

invitaions to stay in the EU are forged in order to obtain visas,

residency or work permits on false grounds.

FORGED

BIRTH CERTIFICATE

MARRIAGE RECORD

WORK CONTRACT

INVITATION TO STAY IN THE EU

VALID

VISA

RESIDENCY PERMIT

WORK PERMIT

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING ORGANISED CRIME

ONLINE TRADE IN ILLICIT GOODS AND SERVICES

The online trade in illicit goods

and services has been expanding

steadily over recent years. It

is expected that this trade will

continue to grow rapidly for

the foreseeable future and that

online platforms will emerge as

a key distribution platform for all

types of illicit goods in the EU.

The Darknet is a key facilitator

for various criminal activities

including the trade in illicit

drugs, illegal ﬁrearms and

malware. Darknet marketplaces

are becoming increasingly de-

centralised.

Online plaforms operaing in the legal

economy have had a profound impact on

business models, shopping experiences and

customer expectaions. The muliplicaion

of sales plaforms makes online trade

easier, more accessible and cheaper. This

development has been mirrored in the

online trade in illicit goods as criminals, like

legiimate traders, look to opportuniies

online to grow their businesses.

Virtually all illicit commodiies are now

traded online either on dedicated criminal

online marketplaces or by exploiing

otherwise legal online plaforms. The

number of goods on ofer and frequency

with which new products become available

indicates that the online trade in illicit

goods is thriving and highly dynamic.

Commodiies such as cannabis, cocaine,

counterfeit currency, counterfeit medicine,

cultural goods, excise tobacco, irearms,

heroin, hormonal substances, specimens

of endangered species, stolen vehicle parts

and accessories, syntheic drugs and new

psychoacive substances (NPS), as well as

compromised payment card data are sold

and purchased online.

It is not only illicit commodiies that are

traded online, but also criminal services.

The expanding CaaS business model

provides customers with access to a wide

range of criminal services. A prime example

of this is cybercrime, where customers

can access such services as malware

coding, Distributed Denial of Service

(DDoS) services, bulletproof hosing and

anonymisaion services, botnet hire and

money laundering.

Vendors oten atempt to hide illegal

goods among legal products on online

plaforms on the surface web. In some

cases, surface web vendors redirect their

customers to mirror sites on the Darknet or

adverise their products using false product

designaions or descripions.

The online market caters to dealers who

buy in bulk for re-sale as well as individual

users. The diminishing reliance on access

to street networks of consumers of illicit

commodiies challenges the established

business models in many criminal markets.

Trade on the surface eb

The distribuion of illicit commodiies via

online plaforms has soared in recent years

and is expected to coninue to increase

steadily over the coming years. Online

trade ofers the opportunity to reach a

huge number of potenial customers. Illicit

goods purchased online are predominantly

traicked using postal and parcel services.

T H E SALE OF DRU GS VIA PH OTO-

SH ARIN G PL AT FORMS

Photo-sharing applicaions and plaforms

are popular with a huge number of users.

These services allow users to create

communiies around shared interests using

hashtags. Drugs dealers and users make use

of these plaforms to form communiies to

discuss, exchange informaion and trade

various types of illegal drugs. Potenial

customers scroll through pictures of

adverised products and then contact the

dealer privately using direct messaging

funcionaliies. The eventual transacion

takes place either face to face or via online

payment and delivery by mail.

The Darknet

The Darknet is a distributed anonymous

network within the deep web that can only

be accessed using sotware such as The

Onion Router (TOR), I2P and Freenet. While

these tools were ostensibly developed

for the purpose of legiimately protecing

freedom and privacy, conidenial business

aciviies and relaionships, they can

equally be used by criminals for the same

purpose - to conceal their idenity and/or

the hosing locaion of websites, forums

and markets, collecively referred to as

“hidden services”.

As of January 2017, the

TOR

network had over 1.7 million

directly connecting users, and

hosted over 60,000 unique onion

domains.

In one study,

almost

57% of active sites could be

classiﬁed as related to some

form of illicit activity.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

DARK NE T ARMS VEN DORS ARREST ED IN SLOVENIA

1 0

Firearms traickers use Darknet marketplaces to sell illegal irearms to private individuals,

members of OCGs and terrorists based in the EU. In December 2016, Slovenian law

enforcement authoriies, with the support of Europol, arrested two suspects accused of

selling various live iring weapons including automaic riles, hand and smoke grenades as

well as ammuniion via a prominent Darknet marketplace. The irearms were paid for in

Bitcoin.

It is estimated that

the top 1% most

successful vendors are responsible

for 51.5% of all transactions on Dark

markets.

Goods and services offered

on the Darknet are available to anyone,

be it an individual user, an OCG or

terrorist group.

SURFACE WEB

STANDARD BROWSING

SOCIAL MEDIA

Illicit commodities,

especially drugs and

counterfeit goods, are

increasingly advertised

and sold on social media

platforms.

Surface web platforms

selling illicit commodities

are often easy to ﬁnd

using simple internet

searches, using a

standard browser.

Shift to Dark markets

There is a shit from sales on the

surface web to sales on the Darknet,

typically when the status of a product

or substance changes from being legal

to illegal. For example, the sales of gun

parts or de-acivated irearms is legal

in certain jurisdicions and therefore

available on the surface web, but when

the gun is assembled or re-acivated it

is illegal and will be sold on the Darknet.

Likewise, a previously undiscovered

New Psychoacive Substance (NPS) is

iniially unregulated and can be sold

on the surface web, but as soon as it is

regulated or restricted, sales will move

to the Darknet. Dark markets are highly

unstable. New decentralised markets

are likely to overcome the weakness and

vulnerability of being hosted in a speciic

locaion. These localised Dark markets cut

out intermediaries, cater to sellers and

buyers in their own language allowing

them to interact directly. Transacions on

local plaforms enable sellers and buyers

to avoid internaional mail systems by

arranging the local collecion of illegal

goods.

MARKETPLACES

Vendors often attempts to hide

illegal goods among legal

products.

Counterfeit

medicines

Stolen

goods

Illicit drugs

Child Sexual

Exploitation

Material

P2P

Peer-to-peer (P2P)

platforms use clients

running on users devices to

allow customers and

vendors to connect directly

with each other.

Malware and

cybercriminal

services

Trafﬁcking

of ﬁrearms

TOR BROWSING

The Darknet is a distributed

anonymous network within

the deep web that can only be

accessed using software such

as TOR, I2P and Freenet.

DARKNET

Although the exact scale of the

criminality on the Darknet cannot be

fully determined as of yet, the Darknet

is clearly an established criminal

environment hosting an increasing

number of platforms including Dark

markets and other hidden services.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

UNDERSTANDING ORGANISED CRIME

DRIVERS OF CRIME

Drivers of crime shape the nature and

impact of serious and organised crime

aciviies.

They include facilitaing factors

and vulnerabiliies in society which create

opportuniies for criminals.

Geopolitical conte t

The serious and organised crime landscape

in the EU is fundamentally afected by

the geopoliical situaion in and around

Europe. The impact of conlicts on the

periphery of the EU, such as in Libya and

Syria, on serious and organised crime

in the EU has already materialised and

will coninue to inluence crime. Armed

conlicts and poverty are the most

signiicant push factors for migrants

travelling to the EU. The emergence of new

conlicts or destabilisaion of countries

on the periphery of the EU would sustain

the migraion low to the EU. Armed

conlicts close to the EU also entail the

risk of returning foreign ighters as well

as the large-scale traicking of irearms

originaing from these regions.

egal business structures

OCGs exploit various legal business

structures and professional experts to

maintain a facade of legiimacy, obscure

criminal aciviies and proits, and to

perpetrate lucraive and complex crimes.

Legal business structures allow OCGs to

operate in the legal economy and enable

them to merge legal and illegal proits.

Technology

For almost all types of organised

crime, criminals are deploying and

adapting technology with ever

greater skill and to ever greater

effect. This is now, perhaps, the

greatest challenge facing law

enforcement authorities around the

world, including in the EU.

Technological innovaion coninues to

shape society and the economy, and

by extension the serious and organised

crime landscape in Europe. Criminal

actors in the EU display a high degree of

adaptability and creaivity in exploiing

and employing new technologies. While

not all criminal aciviies are driven by

technological developments, the internet

and ever-increasing connecivity have an

impact on virtually all types of serious and

organised crime. Innovaion in technology

and logisics increasingly enable OCGs to

commit crime anonymously, anywhere and

anyime without being physically present.

The Internet of Things is constantly

expanding. Connecivity of all types of

devices, including phones and appliances,

is increasingly a reality in households and

businesses across the EU. However, these

devices remain vulnerable to intrusion and

criminals are already deploying techniques

to compromise these devices in order to

gain personal and inancial informaion and

conidenial data on business transacions.

ey locations for crime

Key locations for crime feature well-developed transport

and communication infrastructure. These locations

are used to organise the global distribution of illicit

commodities.

OCGs hide illicit goods among legal commodity lows, which are

increasing in speed and volume and almost impossible to check

thoroughly.

Criminal groups will take advantage of weaknesses in new

technologies, such as automated transport systems, and exploit gaps

in the legal frameworks regulaing them.

Key locaions for crime are characterised by several diferent factors:

the presence of eicient transport infrastructures, proximity to or

connecions with source countries and consumer markets, access to

business and investment opportuniies, as well as demand for illicit

commodiies or services.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

USING TECHNOLOGY TO FIGHT

SERIOUS AND ORGANISED CRIME

Technology is also a signiﬁcant aid

to law enforcement authorities in the

ﬁght against serious and organised

crime. This includes the use of

advanced digital forensics tools, the

deployment of predictive policing

software driven by Big Data as well as

drones for the monitoring of areas and

large events.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING

ORGANISED CRIME

CRIMINAL MARKETS

AND SERVICES

The criminal markets and criminal aciviies detailed in

this chapter are presented in alphabeical order.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

CURRENCY COUNTERFEITING

The producion of counterfeit currency requires varying degrees of

sophisicaion depending on the currency and level of quality of the

resuling counterfeits. Counterfeit banknotes of various currencies

are traded online on surface web and Darknet marketplaces.

Consequently, counterfeit currency is increasingly traicked using

parcel services.

While the producion of counterfeit currency is currently not a

major threat to the stability of the euro, the common European

currency remains popular with counterfeiters. The most commonly

counterfeited euro banknote denominaions are the EUR20 and

EUR50 notes.

In 2016, the European Central Bank (ECB) decided

to halt the producion of EUR500 banknotes by the end of 2018

in an efort to ight money laundering as well as the producion of

counterfeit euro banknotes.

CYBERCRIME

CY ER-DEPENDENT CRIMES

A mature CaaS model underpins cybercrime, providing easy access to

the tools and services required to carry out cyber-attacks.

Cryptoware (ransomware using encryption) is a signiﬁcant threat to

the EU, targeting not only citizens but increasingly public and private

sector organisations alike.

Network intrusions for the purpose of illegally acquiring data have

signiﬁcant impact globally, resulting in the loss of intellectual

property and the compromise of mass amounts of data which can be

used for further criminality including fraud and extortion.

Cyber-dependent crimes are ofences that can only be commited using a computer,

computer networks or other form of informaion communicaions technology. Cybercrime

is a global phenomenon afecing all Member States and is as borderless as the internet

itself. The atack surface coninues to grow as society becomes increasingly digiised, with

more ciizens, businesses, public services and devices connecing to the internet.

OPERAT ION AVAL AN CH E

1 5

On 30 November 2016, ater more than

four years of invesigaion, the Public

Prosecutor’s Oice Verden and the L neburg

Police (Germany) in close cooperaion with

the United States Atorney’s Oice for

the Western District of Pennsylvania, the

Department of Jusice and the FBI, Europol,

Eurojust and global partners, dismantled an

internaional criminal infrastructure plaform

known as ‘Avalanche’. The Avalanche network

was used as a delivery plaform to launch

and manage mass global malware atacks

and money mule recruiing campaigns. The

monetary losses associated with malware

atacks conducted over the Avalanche

network are esimated to be in the hundreds

of millions of euros worldwide, although

exact calculaions are diicult due to the

high number of malware families managed

through the plaform. The global efort to

take down this network involved the crucial

support of prosecutors and invesigators

from 30 countries. The operaion marks the

largest-ever use of sinkholing to combat

botnet infrastructures and is unprecedented

in its scale, with over 800,000 domains seized,

sinkholed or blocked.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

Cybercrime continues to grow as society

becomes increasingly digitised

85%

of internet users feel at

risk of becoming a victim

of cybercrime

The digital underground

The CaaS model provides easy access to tools and services

across the entire spectrum of cyber-criminality, from

entry-level to top-tier players, including those with other

motivations such as hacktivists or even terrorists. This

allows even entry-level cybercriminals to carry out attacks

of a scale disproportionate to their technical capability.

Criminal forums and marketplaces within the deep web or

Darknet remain a crucial environment for cybercriminals to

communicate and are a key component for CaaS.

CRIME-AS-A-SERVICE

Malware and ID theft

Malware typically steals user data

such as credit card numbers, login

credentials and personal

information from infected

machines for subsequent use by

criminals in fraud.

Cryptoware

Cryptoware (ransomware using

encryption) has become the

leading malware in terms of

threat and impact. It encrypts

victims user generated ﬁles,

denying them access unless the

victim pays a fee to have their

ﬁles decrypted.

Network attacks

Network intrusions that result in

unlawful access to or disclosure

of private data (data breaches)

or intellectual property are

growing in frequency and scale,

with hundreds of millions of

records compromised globally

each year.

Payment order fraud

Criminals use fraudulent transfer

orders to defraud private and public

sector organisations. Fraudsters

heavily rely on social engineering

techniques and malware to carry out

this type of fraud.

Payment card fraud

Compromised card data is readily

available and easy to obtain on

forums, marketplaces and

automated card shops in the

deep web and Darknet.

Online sexual exploitation

Child Sexual Exploitation

Material is increasingly

produced for ﬁnancial gain and

distributed through the Darknet.

Coercion and sexual extortion

are increasingly being used to

victimise children.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

Mal are

The development and distribuion of

malware coninues to be the cornerstone

for the majority of cybercrime. Informaion-

stealing malware, such as banking Trojans,

sill represent a signiicant threat. This

type of malware typically steals user data

such as credit card numbers and login

credenials from infected machines for

subsequent use by criminals in fraud.

Since late 2013, cryptoware (ransomware

using encrypion) has become the

leading malware in terms of threat and

impact. Cryptoware encrypts vicims’

user generated iles, denying them access

unless the vicim pays a fee to have their

iles decrypted. Following the trend of

informaion stealers, cryptoware campaigns

are increasingly targeing public and private

sector eniies.

Net ork attacks

Network atacks vary in

modi operandi

and

purpose. Website defacement is a common

but low-impact atack, and oten the

trademark of hackivist groups targeing

government or public websites.

Network intrusions that result in unlawful

access to or disclosure of private data

(data breaches) or intellectual property

are growing in frequency and scale,

with hundreds of millions of records

compromised globally each year.

Compromised data can be used for a

variety of criminal purposes including fraud

and extorion

and is highly valued by

inancially moivated criminals.

Some Member States highlight the

paricular threat posed by insiders to a

company’s security. Any sector or network

which holds data which can be moneised

is a target for such atacks.

Data has become a

key commodity for

criminals.

Increasing internet connectivity by

citizens, businesses and the public

sector, along with the exponentially

growing number of connected devices

and sensors as part of the Internet of

Things will create new opportunities

for cybercriminals. Malware targeting

smart devices will lead to new

sources of data leakage and network

compromise and create new botnets.

Given the ease of entry into cybercrime,

the use of cyber tools and services by

traditional OCGs to enhance or expand

their capabilities is likely to become

more commonplace.

CRYPTOWARE

How it works

Ransomware can be

obtained on the

Darknet by OCGs

Organised Crime

Groups

The proceedings

can be used for

any other criminal

activity

Means of infection

Compromised websites,

fake mobile apps, email

attachments

Devices at risk

Computers and

mobile devices

Ransomware locks your computer

and mobile devices or encrypts

your electronic ﬁles, demanding a

ransom payment in order to regain

control of your data.

Ransom

Payment is almost

exclusively in

Bitcoins

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

ON INE C I D SE UA E P OITATION (CSE)

Child Sexual Exploitation

Material (CSEM) is increasingly

produced for ﬁnancial gain.

A growing number of Darknet

forums facilitating the exchange

of CSEM, coupled with the ease

of access to these networks,

is leading to an increase in the

volume of material exchanged

through the Darknet.

Coercion and sexual extortion

are increasingly being used to

victimise children. Offenders

use these methods to obtain

further child abuse material, for

ﬁnancial gain or to get physical

access to the victim.

While neither o ine nor online CSE meet

the criteria to be considered ‘organised

crime’ this is sill a high priority crime due

to the degree of physical and psychological

damage to one of society’s most vulnerable

groups – children.

Online and o ine child sexual exploitaion

are oten considered two diferent crime

areas. However, a number of ofenders are

involved in both. There are indicaions that

this is the case for about 30% of ofenders

in possession of CSEM.

The increasing global availability of

broadband internet and internet-enabled

devices coninues to fuel the growing

number of both ofenders and vicims in

this area. While the same can be said of any

number of crime areas, this phenomenon is

a major contributor to online CSE.

The internet provides ofenders and

potenial ofenders with an environment in

which they can operate with an enhanced

level of safety and anonymity. In paricular,

there is a growing number of forums on

the Darknet dedicated speciically to the

producion, sharing and distribuion of

CSEM. Typically this refers to services on

the TOR network. Peer-to-peer (P2P) ile

sharing applicaions are the preferred

method of exchanging CSEM.

Self-Generated Indecent Material

(SGIM)

There is a growing trend in the producion

of Self-Generated Indecent Material

(SGIM) - typically teens or pre-teens taking

indecent images of themselves to be

shared privately with a partner or someone

they believe they can trust, for example

in grooming scenarios. Subsequently,

these images can be distributed either

accidentally or maliciously without the

owner’s consent.

Commercial CSEM

Children are sexually exploited largely to

saisfy the sexual appeites of those with a

sexual interest in children. However, there

is a growing trend in the producion of

CSEM for inancial gain. A paricular acivity

associated with commercial producion of

CSEM is that of Live Distant Child Abuse

(LDCA). LDCA is a signiicant threat in

this area of criminality. LDCA involves a

perpetrator paying to direct the live abuse

of children on a pre-arranged speciic ime-

frame through video sharing plaforms.

Se ual e tortion

Oten associated with the producion of

SGIM is the growing pracice of sexual

extorion, whereby an ofender uses

an explicit image of a minor - obtained

incidentally or through coercion or

decepion - to further coerce or extort the

child into either producing more material

or engaging in further online or even o ine

abuse. In some cases the perpetrator

alternaively seeks inancial gain.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

PAYMENT CARD FRAUD

Payment card fraud is a low-risk, high-proit

acivity. Compromised card data is readily

available and easy to obtain on forums,

marketplaces and automated card shops in

the deep web and Darknet. Payment card

fraud can be split into two disinct crime

areas:

Card-present fraud

and

card-not-

present fraud.

Some OCGs run ‘laboratories’

to study ATMs in order to

conduct targeted attacks.

Card-present fraud (CP)

CP fraud requires an ofender to present

a physical card at an automated teller

machine (ATM), Point of Sale (POS) or

other terminal. This crime has two stages:

obtaining a card, and the use of the card.

The cards used are either lost or stolen

genuine cards, or counterfeit cards. Unlike

fraud using lost or stolen cards, fraud using

counterfeit cards is typically commited

outside the Single Euro Payments Area

(SEPA).

Some OCGs have

partly industrialised

their processes, using

workshops to produce

counterfeit cards.

Card-not-present fraud (CNP)

CNP fraud involves the use of card data

to make fraudulent purchases online or

by telephone. Unlike CP fraud, the data

required is only that needed to make an

online credit card purchase – the name

of the card holder, billing address, card

number, expiry date and security code. The

fraud, commonly referred to as ‘carding’,

is commited across all sectors but the

purchase of physical goods, airline ickets,

car rentals and accommodaion with

compromised cards have generally seen an

increase throughout the EU. Where CNP is

used to fraudulently purchase goods, like

CP fraud, ofenders will typically purchase

high-value goods with the intenion of

reselling them. Ofenders will oten use

packet mules or reshipping services to

safely receive their fraudulently obtained

goods.

CNP is fuelled by the availability of

compromised card data resuling from

data breaches, informaion stealing

malware and phishing. As many data

breaches oten involve the compromise of

millions of card details at once, there is a

considerable excess of card data compared

to the demand. Among the places where

compromised card data can be found are

an increasing number of illegal carding sites

on both the deep web and Darknet where

not only card data can be purchased but

ofenders can learn about how and where

to ‘card’. New payments methods provide

ofenders with new opportuniies to use

compromised card data. By uploading

the card data to smartphone services,

ofenders can make “in app” or “on site”

payments to apps which they control.

The growing e-commerce industry

will result in a parallel growth of CNP

fraud, especially as industry measures

at prevening CP fraud become more

efecive. Criminal

modus operandi

will be

shaped by industry measures to counter

payment card fraud.

Emerging and alternate payment opions

such as contactless payment using Near

Field Communicaion (NFC) will drive

innovaion within OCGs to enable them to

abuse new technologies. New electronic/

card-less payment methods may however

ulimately result in a downwards trend in

card fraud.

IN T ERN AT ION AL CRIMIN AL N E T WORK

B EH IN D L ARGE-SCAL E PAY M EN T

FRAU D DISMAN T L ED

In September 2016, Italian and Romanian

law enforcement authoriies supported

by Europol disrupted an internaional

criminal group responsible for large-scale

misuse of compromised payment card data,

prosituion and money laundering. The

criminal network used sophisicated ATM

skimming devices which allowed them to

compromise ATMs and decepive phishing

techniques to perform a high volume of

fraudulent transacions. Esimated losses

incurred by the criminals’ aciviies amount

to several hundred thousands of euros.

Micro-camera bars, card readers, magneic

strip readers and writers, computers,

phones and lash drives, several vehicles,

as well as thousands of plasic cards ready

to be encoded were seized in several

locaions.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

ID THEFT AND

PAYMENT CARD

FRAUD

STEP 2

STEP 1

A fraudster uses malware and

social engineering to access

your computer

Your login credentials,

bank account details,

credit card numbers and

other personal information

are stolen

STEP 3

Your data is sold on

the Darknet

STEP 4

OCGs use your compromised

ID and ﬁnancial data to

support their criminal

activities

GLOB AL ACT ION AGAINST AIRL INE

FRAU DST ERS

Global Airport Acion Days combine the

eforts of law enforcement and private

sector partners to combat the fraudulent

online purchases of light ickets, which

is esimated to cost the industry over

EUR 1 billion per year. Fraudulent online

transacions are highly lucraive for

organised crime and are oten purchased

to facilitate more serious criminal aciviies

including migrant smuggling, THB, drug

traicking and terrorism. In October 2016,

the ith Global Airport Acion Day was

organised through coordinaion centres

at Europol, INTERPOL Global Complex for

Innovaion in Singapore and Ameripol

in Bogota. The acivity was supported

by Canadian and US law enforcement

agencies. Representaives from airlines,

online travel agencies, payment card

companies, Perseuss and the Internaional

Air Transport Associaion (IATA) worked

together with law enforcement oicers

deployed in the airports. Eurojust assisted

throughout the acion week, together with

the European Border and Coast Guard

Agency (Frontex) which deployed oicers

to 20 airports, assising in the detecion of

idenity fraud, fake documents and migrant

smuggling. 193 individuals suspected of

traveling with airline ickets bought using

stolen, compromised or fake credit card

details were detained. 43 countries, 75

airlines and 8 online travel agencies were

involved in this global operaion which took

place at 189 airports across the world.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

DRUG PRODUCTION, TRA IC ING

AND DISTRIBUTION

Drug markets remain the largest criminal

markets in the EU. More than one third

of the criminal groups acive in the EU

are involved in the producion, traicking

or distribuion of various types of drugs.

The trade in drugs generates muli-billion

euro proits for the groups involved in this

criminal acivity. The EU retail drug market

is esimated to be worth at least EUR

24 billion a year.

The immense proits

generated from the trade in drugs fund

various other criminal aciviies allowing

OCGs to thrive and develop their criminal

enterprises at the expense of the health,

prosperity and security of EU ciizens.

OCGs involved in drug traicking heavily

rely on corrupion to facilitate their

traicking aciviies. They also make use

of fraudulent documents such as fake

import or company registraion ceriicates

to import illicit drugs among legal goods,

to procure pre-precursors and purchase

equipment used as part of producion

processes.

Online trade

Criminals coninuously seek out methods

and technologies to make their business

models more efecive and increase proit

margins. Online marketplaces on the

Darknet are now a key plaform used to

adverise and sell all types of drugs. The

anonymous nature of online transacions

on these marketplaces and the use of

cryptocurrencies reduce the risks of

detecion by law enforcement authoriies

for both vendors and buyers.

producion lines capable of producing

syntheic drugs on an industrial scale.

Drone technology is expected to advance

allowing drones to travel greater distances

and carry heavier loads as well as making

them more afordable. OCGs involved in

drug traicking will likely invest in drone

technology for traicking purposes in order

to avoid checks at border crossing points,

ports and airports.

Technology

Technical innovaion and the accessibility

of sophisicated equipment have allowed

OCGs to maximise the producion output

of individual sites. Large-scale cannabis

culivaion sites are oten maintained

using professional growing equipment

such as climate control systems, CO2 and

ozone generators. Similarly, laboratories

manufacturing syntheic drugs feature

advanced chemical equipment and

TRENDS

SYNTHETIC DRUGS

The market for synthetic drugs

continues to be the most

dynamic of the drug markets in

the EU.

ONLINE TRADE

Online marketplaces on the

Darknet are now a key

platform used to advertise

and sell all types of drugs.

Drug market generates

EUR

billion/year

in proﬁts

>75%

of the OC s involved in the trafﬁcking of

one drug also trafﬁc and distribute other

types of drugs.

CUTTING - EDGE

TECHNOLOGY

of the criminal groups

active in the EU are

involved in the drug

market

Technical innovation and

sophisticated equipment

allow OC s to maximise the

production output.

~65%

of OCGs involved in the drug trade are

simultaneously involved in other criminal

activities such as the trade in counterfeit

goods, THB and migrant smuggling. Drugs

are also used as a means of payment

among criminal groups.

TOXIC WASTE

419

previously undetected S

reported in the EU for the ﬁrst

time over the past ﬁve years

The production of synthetic drugs

generates large quantities of highly

toxic and dangerous waste. Dump

sites often remain contaminated

for a signiﬁcant period of time and

their recovery is costly.

LIBYA

Libya is emerging as a new

distribution hub for cannabis

resin trafﬁcked to the EU across

the editerranean Sea.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

CANNABIS

Cannabis remains, by far, the most widely

consumed illegal drug in the EU.

Cannabis

is distributed on EU markets as cannabis

resin and herbal cannabis. In recent years,

herbal cannabis has been increasingly

popular with consumers, which has led

to an increase in the producion and

availability of herbal cannabis within the EU

and in countries close to EU markets.

Growing equipment, seeds and other raw

materials used for cannabis culivaion

in the EU are readily available online and

oten originate from the Netherlands. The

indoor culivaion of herbal cannabis in the

EU is expected to further expand over the

coming years with new growing techniques

and increasingly sophisicated growing

technologies being used by OCGs in order

to increase harvest yields and proits.

Outdoor culivaion of herbal cannabis

remains limited compared to the indoor

culivaion of cannabis.

Albania remains the main source of herbal

cannabis traicked to the EU. The main

source of cannabis resin consumed in the

EU is Morocco from where it is traicked to

the EU primarily by sea and road transport.

Cannabis resin originaing from Morocco is

increasingly smuggled to the EU across the

Mediterranean Sea deparing from Libya.

Cannabis resin shipments are transported

across the Mediterranean Sea to the

Spanish coast using high-powered vessels

where they are dropped into the sea and

retrieved by OCGs on local ishing vessels

or pleasure boats using GPS signalling

devices.

‘ ROSE OF T H E WINDS’ –

IN T ERN AT ION AL OPERAT ION AGAIN ST

DRUG T RAFFICK IN G

The market for cannabis

remains by far the

emains

largest

drug market in

gest

the EU.

In December 2016, a mulinaional police

team including Europol announced the

arrest of a major Moroccan drug kingpin.

The work that led to this arrest began in

April 2016. The Moroccan naional had

orchestrated a muli-tonne drug delivery.

This is the latest successful result achieved

by JOT ’Rose of the Winds’. Approximately

one week prior to his apprehension,

the Spanish Guardia Civil, supported by

Europol, the French Direcion Naionale

du Renseignement et des Enqu tes

Douanières and the Italian Guardia di

Finanza, localised and intercepted a

merchant vessel lying the lag of Panama.

The ship was subsequently escorted to the

port of Almeria, where a thorough search

revealed the illegal cargo of 19.6 tonnes of

cannabis resin. The crew were arrested and

the shipment was seized. The invesigaions

also revealed a poly-crime involvement of

the transnaional organised crime networks

acive in large-scale drug traicking in the

Mediterranean Sea. Namely, concrete and

recurrent links with migrant smuggling and

cocaine traicking have been ascertained.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

CANNABIS HERB

roduction, trafﬁcking and

distribution

The

indoor cultivation

herbal cannabis in the EU is

expected to further expand

over the coming years with

new growing techniques and

increasingly sophisticated

growing technologies being

used by OC s.

NETHERLANDS

Main distribution hub

CZECH REP.

Distribution hub

ALBANIA

Main source

CANNABIS RESIN

Cannabis resin continues to be

trafﬁcked in large quantities

from

Morocco

to the EU.

Libya

is emerging as a new

distribution hub for cannabis

resin trafﬁcked to the EU across

the editerranean Sea.

SPAIN

Distribution hub

NETHERLANDS

Distribution hub

AFGHANISTAN

ALBANIA

Distribution hub

Main source

MOROCCO

Main source

LIBYA

Distribution hub

CANNABIS

eans of transportation

Trafﬁcking to EU

COURIER

PLEASURE BOAT

SPEED BOAT

CONTAINER

LORRY

SMALL AIRCRAFT

Trafﬁcking within EU

COURIER

PRIVATE CAR

BUS

LORRY

SMALL AIRCRAFT

SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

COCAINE

Cocaine is primarily produced in Colombia,

Peru and Bolivia and traicked to the EU

via other South American countries such as

Brazil, Venezuela, Argenina, the Caribbean

Sea region and West Africa. Over the last

two years, the producion of cocaine in

Colombia has intensiied signiicantly.

An increase in the producion output in

Colombia will likely impact on the EU in

the form of intensiied traicking acivity

as well as greater availability of cocaine on

drug markets in the Member States.

The traicking

modi operandi

associated

with the trade in cocaine have largely

remained the same. Cocaine is typically

traicked as part of large shipments in

containers or in smaller quaniies by

couriers.

Large shipments of cocaine are traicked in

containers hidden among legal goods or as

part of the rip-on/rip-of

modus operandi.

Brazil is a key point of departure for

cocaine couriers travelling directly to the

EU. The United Arab Emirates (UAE) and

desinaions in East Africa have emerged

as hubs for cocaine couriers travelling to

the EU. Cruise ships deparing from the

Caribbean Sea region are increasingly being

used to traic cocaine to the EU.

OPERAT ION FUL ECO

More OCGs are involved

in cocaine trafﬁcking

than any other criminal

activity in the EU.

Brazil is among the main countries of

departure for couriers traicking cocaine

to the EU. This has been conirmed by

the results of Operaion Fuleco, an efort

by Member States supported by Europol

targeing cocaine couriers arriving to the

EU’s major airports. During Operaion

Fuleco, nearly 200 cocaine couriers were

arrested and almost 500 kilograms of

cocaine seized in the Netherlands, Spain,

Portugal, the United Kingdom, France,

Belgium, Germany and Ireland. Operaion

Fuleco took place in June and July 2014

and involved 12 Member States including

Austria, Belgium, Bulgaria, the Czech

Republic, France, Germany, Ireland, the

Netherlands, Romania, Spain, Sweden and

the United Kingdom.

COCAINE

roduction, trafﬁcking and

distribution

Main entry points in the EU

NETHERLANDS

BELGIUM

PROFITS

SPAIN

5.7

EUR / YEAR

BILLION

Signiﬁcant increase in

production in

Colombia

may

result in intensiﬁed trafﬁcking

activity to the EU.

COLOMBIA

Means of

transportation

Trafﬁcking to EU

COURIER

PLEASURE BOAT

CONTAINER

PERU

Trafﬁcking within EU

Main producers

BOLIVIA

PARCEL

CONTAINER

LORRY

SMALL AIRCRAFT

SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

HEROIN

Afghanistan remains the leading producer

of heroin traicked to the EU. The

producion output of opium and heroin in

Afghanistan is very high and is projected to

remain so for the foreseeable future.

Producion of heroin remains rare in

the EU. However, depending on the

development of the demand for heroin and

potenial disrupions to traicking aciviies

from Afghanistan further laboratories may

emerge in the EU in the future. Heroin

is also available on online marketplaces

and is occasionally distributed across the

EU in small quaniies via post and parcel

services.

The Balkan route

remains the main entry

route for the trafﬁcking

of heroin into the EU.

HEROIN

roduction, trafﬁcking and

distribution

Partial shift for the

trafﬁcking of heroin

from the Balkan route

to the

Caucasus route

CAU

CAS

OUT

AFGHANISTAN

BALKA

N ROU

Main producer

PAKISTAN

Main producer

SOUTHERN ROUTE

Means of transportation

Trafﬁcking to EU

RCEL

COURIER

TE C R

BUS

LORRY

CO T I ER

LL BO T

ERRY

Trafﬁcking within EU

RCEL

COURIER

TE C R

BUS

LORRY

SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

SYNTHETIC DRUGS AND NEW PSYCHOACTIVE

SU STANCES (NPS)

The producion of diferent types of

syntheic drugs takes place in various

Member States. The intended desinaion

markets for syntheic drugs produced in

the EU vary according to the substance and

producion locaion. A share of the large-

scale producion of 3,4-methylenedioxy-

methamphetamine (MDMA), amphetamine

and, to a lesser extent, methamphetamine

in the Netherlands and Belgium is intended

for traicking to markets outside the EU,

while the producion of syntheic drugs

in other parts of the EU predominantly

supplies domesic and neighbouring EU

markets.

The Netherlands and Belgium remain

a globally signiicant producion

and distribuion hub for MDMA and

amphetamine. The OCGs involved in the

producion of syntheic drugs are highly

lexible and have signiicant inancial

resources to constantly explore new

market opportuniies such as engaging in

the producion of other syntheic drugs

including mephedrone.

Producion sites for methamphetamine are

expected to also appear in other Member

States in greater numbers in the future,

especially those with exising producion

capabiliies for amphetamine.

SYNTHETIC DRUGS AND

NEW PSYCHOACTIVE

SUBSTANCES

roduction, trafﬁcking and

distribution

The market for synthetic

drugs continues to be the

most dynamic of the drug

markets in the EU.

The production capacity

of synthetic drug

laboratories has increased

signiﬁcantly in recent

years.

Over the last ﬁve years,

new S were

detected in the EU for the

ﬁrst time.

Main producers

Export / Main destinations

Methamphetamine

Amphetamine

MDMA

NETHERLANDS

BELGIUM

POLAND

CZECH

REP.

SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016

to UNITED STATES

SLOVAKIA

to AUSTRALIA

AUSTRALI

Means of transportation

Trafﬁcking to EU

Trafﬁcking within EU

RCEL

COURIER

CO T I ER

AIR

REI T

RCEL

TE C R

LORRY

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

Precursors and pre-precursors

OCGs producing syntheic drugs in the

EU coninue to be highly lexible and

will remain so in the future. They are

quick to adopt alternaive precursor and

pre-precursor substances in reacion to

any shortages in established precursor

substances. China remains a major

supplier of pre-precursor substances and

essenial chemicals as well as hardware and

glassware for syntheic drug laboratories in

the EU.

Some OCGs have specialised in the

procurement and producion of pre-

precursor and precursor substances

supplying OCGs producing and distribuing

syntheic drugs in the EU.

The great quaniies of MDMA and

amphetamine produced by Dutch OCGs are

not solely intended for distribuion in the

EU. The MDMA and amphetamine output

from producion in the Netherlands and

Belgium is traicked to desinaion markets

around the world. Australia remains

among the most signiicant desinaion

markets outside the EU for syntheic drugs

produced in the Netherlands and Belgium.

In some cases, large shipments of syntheic

drugs are traicked to desinaions outside

the EU in mariime shipping containers.

There has been a signiicant increase in

the amount of MDMA traicked from the

Netherlands to the United States over the

last two years.

The producion of syntheic drugs

generates large quaniies of highly toxic

waste. OCGs dump this waste away

from producion laboratories to conceal

their locaion. Dump sites oten remain

contaminated for a signiicant period

of ime and their recovery is costly. The

dumping of toxic waste in public places

also entails signiicant risks for the health

and safety of ciizens. In recent years, the

number of dump sites discovered in the EU

has been increasing. Dump sites are most

frequently discovered in the Netherlands

and Belgium.

NPS

NPS coninue to be produced in China and,

to a lesser degree, India and traicked to

the EU in large quaniies. NPS producion

in the EU is largely limited to packaging and

re-selling of imported substances. However,

some limited NPS producion is thought to

take place in the EU.

CHILDREN B U RN T BY DU M PED

WAST E FROM SY N T H E T IC DRU GS

PRODUCT ION

OPERAT ION ALIMAYA

In March 2016, Spanish law enforcement

authoriies in cooperaion with other

Member States and supported by Europol

were able to dismantle a network

imporing and distribuing large quaniies

of dangerous NPS in the EU. This network

used various companies to import and

sell these substances, especially syntheic

cannabinoids from China, generaing

signiicant proits. Coordinated acion in

March 2016 involving house searches at

four locaions resulted in the seizure of

550 litres of acetone, 75,000 envelopes

used for packaging diferent NPS brands,

NPS worth more than EUR 1.5 million. This

invesigaion highlights the proits involved

in the distribuion of NPS.

CONTAIN ER SEIZ URE OF 2 .8 TONN ES

OF MDMA AND ME T HAMPHE TAM INE

VALU ED M ORE T HAN USD 1 .5

B ILLION

In November 2014, Australian law

enforcement authoriies seized a

mariime shipping container holding

approximately 2.8 tonnes of MDMA

and methamphetamine. The load was

esimated to have a street value of more

than EUR 1.4 billion (USD 1.5 billion).

At the ime, the value and size of the

seizure was unprecedented. The container

arrived in Australia from Europe and was

seized following an intelligence operaion.

The seizure led to the arrest of several

individuals in Australia and Australian

law enforcement authoriies suspect

the involvement of several OCGs in the

producion, traicking and intended

distribuion of this shipment. This seizure

highlights the scope of the traicking of

syntheic drugs from the EU to desinaion

markets around the world.

In August 2015, four children and an

accompanying adult sufered severe burns

to their legs ater coming in contact with

chemical waste dumped by suspected

syntheic drug producers in Belgium.

Some of the waste produced as part of the

manufacture of syntheic drugs is highly

dangerous. Drug producers frequently

dump this type of waste away from their

laboratories in order to disguise their

locaions.

HORMONAL

SUBSTANCES

There is a growing market for illegal

hormonal substances in the EU. These

substances are both traicked to and

illegally produced in the EU.

Hormonal substances traicked to the EU

typically originate from China, India and

Thailand. However, over the last few years

producion faciliies for illicit hormonal

substances have also been discovered in

the EU.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

ENVIRONMENTAL CRIME

Environmental crime covers a diverse

range of diferent ofences including the

improper collecion, transport, recovery

or disposal of waste, the illegal operaion

of a plant in which a dangerous acivity

is carried out or in which dangerous

substances or preparaions are stored, the

killing, destrucion, possession or trade of

specimens of protected wild fauna or lora

species, and the producion, importaion,

exportaion, placing on the market or use

of ozone-depleing substances.

Environmental crime is characterised by its

impact on the natural environment. The

environmental impact manifests itself in

increasing levels of polluion, a degradaion

of wildlife, a reducion in biodiversity and

the disturbance of ecological balance.

Environmental crime puts public health at

risk.

ILLICIT WASTE

TRAFFICKING

The use of legal business structures for

illicit waste traicking aciviies by criminal

actors are an inherent feature of this crime

area. In many cases, criminal actors and

legal businesses are indisinguishable from

one another. As part of this development,

criminals involved in illicit waste traicking

have moved towards the more complex

business model of illicit waste management

rather than just illegally dumping waste.

Illicit waste traickers now operate along

the enire waste processing chain, heavily

relying on the use of legal business

structures for their aciviies.

The traicking of illicit waste typically

involves the use of fraudulent documents.

TRAFFICKING OF

ENDANGERED

SPECIES

The traicking of and trade in endangered

species involves the collecion or

processing of animals and plants protected

by naional and internaional regulaions.

The Convenion on Internaional Trade in

Endangered Species of Wild Fauna and

Flora (CITES) provides the internaional

framework for the protecion of

endangered species and aims to ensure

that internaional trade in specimens of

wild animals and plants does not threaten

their survival.

The EU is primarily a transit region

for endangered species traicked to

desinaion markets in Asia and North

America. The most commonly traicked

species and wildlife products traicked

from, to and via the EU include glass

eels, repiles, exoic birds, pangolin, ish,

narwhal meat, shells, corals, date mussels,

imber and ivory.

The number of OCGs involved in the

traicking of and trade in endangered

species is low, but believed to be

increasing. The OCGs involved are highly

specialised and typically only focus on this

speciic acivity.

IVORY T RAFFICK ING

In November 2016, Austrian law

enforcement authoriies seized 560

kilograms of traicked ivory, the

equivalent of 590 elephant tusks. Ivory

is worth more than EUR 1,000 (USD

1,000) per kilogram on the Austrian

black market. German law enforcement

authoriies seized 1,200 kilograms of

ivory at a Berlin airport, Germany, in

May 2016. Raw and manufactured

ivory were falsely declared and

desined for Vietnam.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

FRAUD

EXCISE FRAUD

Alcohol, cigaretes and mineral oils are

subject to excise duty upon producion in,

or on import to, the EU. OCGs use various

modi operandi

to avoid excise duies and

generate signiicant proits selling both

genuine and counterfeit excise goods at

lower prices than their licit equivalents.

Excise tax fraud is driven by legislaive

diferences and varying excise tax rates

applied by diferent jurisdicions.

FUEL FRAUD

Fuel fraud is a growing phenomenon

and typically involves base-oil fraud,

also called ‘designer fuel’ fraud and fuel

laundering. This type of fraud requires

signiicant experise, which is usually only

available from trained chemists or similar

professions.

INVESTMENT FRAUD

Investment fraud schemes generate

huge proﬁts. One investigation

revealed estimated proﬁts of up to

EUR 3 billion generated by one OCG.

Successful investment fraud schemes

typically use various social engineering

techniques to operate. Fraud schemes

relying on social engineering are

paricularly hard to counter.

What is social engineering?

Social engineering techniques are a key

element to many diferent types of fraud.

Social engineering is the use of decepion

to manipulate individuals into divulging

conidenial or personal informaion that may

be used for fraudulent purposes.

Excise goods are increasingly offered

and bought online.

UN DERSTAN DING EXCISE FRAUD

ABU SE O F D U T Y SU SP ENSI O N SCHEMES

The abuse of duty suspension schemes

are the main

modi operandi

used to

avoid the payment of excise duies on

alcohol products and are also increasingly

used to avoid excise duies on tobacco

products. These

modi operandi

involve

the exploitaion of the EU Excise

Movement Control System (EMCS), a

computerised system registering the

movement of excise goods within the EU,

and the T1 procedure, which is applied

for excise goods under suspension

schemes imported from outside the EU,

by falsely declaring the real desinaion

and quaniies of excise goods imported

into the EU.

How does it work?

In relaion to alcohol products, as part

of the import process for the EMCS and

the T1 procedure, criminals declare a

Member State which applies low excise

rates as the intended desinaion of the

traicked goods. Accomplices in the

declared country of desinaion, such as

corrupt warehouse employees, conirm

receipt of the goods. However, in reality

the goods are exported to countries

applying high excise rates. The goods

appear legiimate as documents cerify

that any excise obligaions due were paid.

If the product originates from a country

applying high excise rates, the goods

oten do not leave the country at all and

the movement of the goods is purely

virtual.

In other cases, traickers ile an

applicaion for the transfer of one load

and use a duplicate of the transport

authorisaion to import muliple loads

without paying excise duies.

OPERAT ION B AT EO

In 2015, law enforcement authoriies in

the EU launched an invesigaion into an

OCG with ies to Germany, Portugal and

Spain. This OCG operated a sophisicated

pyramid fraud scheme ofering investments

into a music sharing plaform and other

online services. The OCG used various front

companies. The invesigaion was able to

idenify more than 50,000 vicims in 34

countries. Overall, the OCG was able to

generate an esimated proit of more than

EUR 3 billion.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

UN DERSTAN DIN G IN VEST M ENT FRAUD

Criminals orchestrate various investment fraud schemes. The most common schemes

encountered in the EU include:

Fraudsters operaing

Boiler room

schemes

use cold-calling to contact

their vicims and pressure them into

invesing in non-existent or very low-

value stocks. Fraudsters oten use false

documents and ceriicates to present

their company and the ofered stock as

legiimate.

As part of

Ponzi schemes,

fraudsters

atract a group of iniial investors with

promises of very high returns in a very

short ime. The fraudster starts to repay

the iniial investors to atract more vicims

using funds accrued from addiional

investors. In reality, the money is not

invested and the fraudsters ulimately

disappear with the funds. The money is

laundered through muliple bank accounts

held by various front companies in

diferent jurisdicions.

Pyramid schemes

operate on the same

model as Ponzi schemes. However, the

iniial investors are acively involved and

are required to recruit new investors in

order to get proits.

MASS MARKETING FRAUD

Mass markeing fraud schemes rely on

mass-communicaion media, including

telephones, the internet, mass mailing,

television and radio, to contact vicims and

solicit money or other items of value in one

or more jurisdicions.

Between May 2014 and May 2015, a UK-

based OCG defrauded over EUR 690,000

(GBP 600,000) from pensioners across

the country. Posing as police oicers, OCG

members contacted vicims by phone to

warn them of the risk of fraud involving

their bank. The vicims were encouraged

to transfer their savings to safekeeping

accounts controlled by the fraudsters.

Fraudsters already rely on social media

and instant messaging applications to

obtain sensitive information or elicit

payments from their victims.

Scams relying on phishing or cold-

calling can target thousands of victims

at once. In one cold-calling case, one

telecommunications provider was

confronted with 3.6 million attempts

against 90,000 victims.

STEP 1

STEP 4

The data/access obtained is

used to transfer funds from the

company’s account to the

fraudster’s account

Fraudster calls posing as an IT

specialist from the employee’s

company (or as a bank employee)

ALTERNATIVE

•

Encourages transfer of

SECURITY

BREACH

SCAMS

STEP 2

Informs of a security breach on

the company’s system (or on the

internet banking facility)

funds to a “safe-keeping

account”

•

The employee transfers

funds to an account

controlled by the fraudster

The money is re-trans-

ferred to accounts in

multiple jurisdictions

STEP 3

OPTION 2:

Encourages the employee to contact the

bank. Uses technology to remain on the line after

termination of the call and therefore obtain sensitive

ﬁnancial details disclosed to the bank employee

(account numbers; access codes)

OPTION 1:

Requires

ﬁnancial details

necessary for check-up

and/or downloading of a

remote access software

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

PAYMENT ORDER FRAUD

Criminals use fraudulent

transfer orders to defraud

private and public sector

organisaions. Typically, the

afected organisaions are acive

internaionally. This increasingly

common type of fraud is also

referred to as CEO fraud, wire

transfer fraud or business e-mail

compromise. Fraudsters heavily

rely on social engineering

techniques and malware to carry

out this type of fraud. OCGs

organising CEO fraud schemes

targeing organisaions based

in the EU typically operate

remotely from outside the EU.

Typically, stolen funds are

transferred through series of

accounts in various Member

States before reaching

desinaion accounts outside

the EU.

UN DERSTANDING FRAU DULENT

T RANSFER ORDERS

STEP 1

STEP 6

The employee transfers funds

to an account controlled by

the fraudster. The money is

re-transferred to accounts in

multiple jurisdictions

A fraudster calls posing as a

high-ranking ﬁgure of the

company

CEO

IMPERSONATION

STEP 2

Requires an urgent transfer

of funds and absolute

conﬁdentiality

STEP 5

Instructions on how to

proceed are given later by a

third-person or via e-mail

STEP 3

Invokes a sensitive

situation (e.g. tax control;

merger; acquisition)

ALTERNATIVE

•Requests to receive information on clients

(e.g. all unsettled invoices)

•Uses the information obtained to defraud

clients

STEP 4

Pressures the employee not to follow

the regular authorisation procedures

A UE ADDED TA ( AT) RAUD

VAT frauds are highly complex forms of

tax fraud relying on the abuse of the VAT

rules for cross-border transacions. VAT

fraudsters generate muli-billion euro

proits by avoiding the payment of VAT

or by fraudulently claiming repayments

of VAT by naional authoriies following a

chain of transacions. The most common

form of VAT fraud is Missing Trader Intra-

Community (MTIC) fraud.

Changes in commodity prices have an

impact on the proitability of MTIC fraud

schemes involving speciic commodiies or

services. This is paricularly true for fraud

schemes involving the energy sector and

related commodiies, which are subject to

frequent price luctuaions.

UNDERSTANDING VAT FRAUD

MT I C FR AU D

Cross-border transacions within the EU are zero-rated, which

means that the payment of the VAT is not due unil the goods are

sold at their desinaion. This enables traders to import goods

without accouning right away for the VAT. In simple MTIC cases,

fraudsters sell the goods, charge the VAT to buyers without

remi ng the value to the tax authoriies.

More complex cases of VAT fraud are typically known as carousel

frauds. As part of these fraud schemes goods are imported and

sold through a series of companies before being exported again.

The exporters of these goods claim and receive the reimbursement

of VAT payments that never occurred.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

OTHER TYPES OF FRAUD

Insurance fraud

Fraudsters defraud hundreds of millions

of euros from private and public

insurance providers each year. OCGs are

increasingly involved in fraud schemes

targeing health care systems.

eneﬁt fraud

Beneit fraud schemes cause signiicant

inancial losses for all Member States.

OCGs and individual fraudsters target

social and labour beneit schemes to

defraud the state of regular beneit

payments. Beneit fraud is strongly

linked to THB and migrant smuggling.

EU subsidy fraud

OCGs have repeatedly atempted

to defraud EU funds by submi ng

applicaions for EU grants or tenders.

Typically, these applicaions are based

on false declaraions such as fraudulent

progress reports as well as fraudulent

documents such as fake invoices.

In 2015, German law enforcement

authoriies dismantled a Russian-

speaking OCG providing nursing services

in order to defraud health care insurance

providers.

Procurement rigging

Procurement procedures are frequently

the target of corrupion. Criminal groups

use bribes to elicit informaion or

directly inluence the evaluaion of bids

in order to win public service tenders

in compeiion with legal businesses.

This type of manipulaion is paricularly

notable in the energy, construcion,

informaion technology and waste

management sectors.

oan and mortgage fraud

Fraudsters organising loan or credit

fraud schemes typically rely on

fraudulent documents to obtain bank

loans, which are never paid back.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

INTELLECTUAL PROPERTY

CRIME

The infringement of intellectual property

rights is a widespread phenomenon

in the EU. Cheap counterfeit copies of

popular goods remain highly popular with

consumers. Criminals are able to produce

counterfeit goods in large quaniies at

minimal costs and use online plaforms to

easily and efecively market their products

internaionally. Counterfeiing and piracy

are terms used to describe a range of illicit

aciviies related to Intellectual Property

Rights (IPR) infringement. Most counterfeit

goods infringe a trademark, which means

that a good is produced without the

authorisaion of its rights holder. OCGs are

increasingly involved in the violaion of IPR.

OCGs produce a wide range of counterfeit

goods and manufacture sub-standard

goods distributed on EU markets including

food and beverages, pesicides and

pharmaceuical products. Counterfeit and

sub-standard goods pose signiicant risks to

the health and safety of consumers.

China remains the source country of most

of the counterfeit goods traicked to the

EU. The trade in goods between the EU and

China has expanded signiicantly in recent

years. China is the biggest source of imports

to the EU by far.

In 2015, more than 80,000 seizures were

registered by customs authoriies in the

EU. These shipments contained more than

40 million aricles worth an esimated EUR

642 million. Cigaretes remain the most

frequently seized counterfeit product

accouning for 27% of all seizures, followed

by other goods such as bateries or air

fresheners at 10% as well as toys at 9%.

Regular household items such as body care

aricles, medicines, electrical household

goods represent 25.8% of the total number

of seized counterfeit products.

Counterfeit goods not only cause

losses in unpaid duties and

taxes, but also reduce the sales

volume, proﬁts and investments

of legitimate businesses. This

removes incentives for investment

in research, development and

innovation.

Online distribution

Online marketplaces are the key

distribuion channel for counterfeit goods.

The sales volume of counterfeit goods

online has increased signiicantly over

recent years. Counterfeiters use social

media plaforms to adverise their products

and steer potenial consumers to online

sales plaforms. The sale of counterfeit

goods online is closely related to the

increasing use of parcel and postal services

to distribute counterfeit products, which is

diicult to detect among an increasing low

of licit goods sold online and sent via postal

freight.

Thousands of online shops are

used to sell counterfeit goods.

In 2016, Operaion In Our Sites

(IOS) resulted in the seizure

of 4,780 domain names and

associated online shops selling

counterfeit merchandise.

The distribuion of counterfeit

pharmaceuical products online

is paricularly dangerous. In

2016, Operaion Pangea I

speciically targeted online

vendors of counterfeit

medicines. The operaion

resulted in the seizure

of potenially dangerous

medicines worth more than

EUR 50 million.

POLY-CRIM INAL OCG INVOLVED IN

T HE T RADE IN COUN T ERFEIT GOODS

AN D DRU G T RAFFICKIN G

Counterfeit pharmaceuticals

While the counterfeiing of

pharmaceuicals previously primarily

afected lifestyle medicines, counterfeiters

increasingly target almost all types of

medicinal products including cancer

medicaion and various types of medical

devices.

In 2015 and 2016, Europol supported an

operaion targeing an Italian OCG selling

counterfeit champagne in various Member

States. Invesigaions in Italy and Germany

revealed that some of the suspects

were also involved in the traicking

of cocaine. During house searches in

Germany, invesigators seized more than

12,000 botles of fake champagne. The

invesigaion also uncovered links to VAT

and excise fraud.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

ORGANISED PROPERTY CRIME

Organised property crime encompasses

a range of diferent criminal aciviies

carried out predominantly by mobile

OCGs operaing across the EU. Organised

burglaries, thets and robberies as well as

motor vehicle crime and the traicking

of cultural goods all fall into this broad

category of criminal acivity. However,

the OCGs carrying out diferent types of

property crime are also highly diverse.

Some OCGs are highly specialised in

speciic types of crime or

modi operandi,

while others are acive in several types

of property crime and other forms of

serious and organised crime. MOCGs

typically operate in and predominantly

target the most prosperous Member

States in Western and Northern Europe.

Despite the highly organised nature

of MOCG operaions, the organised

crime involvement in property crimes

remains under-invesigated. In many

cases, incidents of property crime are

sill classiied as pety criminality without

recognising the organised crime aspect.

Online marketplaces have made it easier

to adverise and sell stolen goods. These

marketplaces are now used extensively

to sell stolen goods, paricularly low-bulk

high-value goods such as phones, tablets

and other electronic equipment. Legal

business structures are used extensively to

fence stolen goods, oten in the country of

origin of the MOCGs involved in organised

burglaries and thets.

Organised burglaries and thefts

Some Member States note a steady

increase in the number of reported

burglaries over recent years. This increase

paricularly afects business premises,

which are targeted much more frequently

than before. Burglaries of business

premises oten involve intrusion into the

property via the roof.

Many incidents of pickpockeing are not

atributed to organised crime. However,

the scale and level of organisaion of

pickpockeing raids across many Member

States suggests that MOCGs are heavily

involved.

OCGs make use of various online

services to facilitate their burglaries.

This includes checking on social media

platforms whether individuals are away

from targeted residences, scouting

targeted neighbourhoods using free

online navigation tools and fencing

goods via online marketplaces.

Organised robberies

MOCGs are increasingly targeing commercial premises for armed robberies, which

typically have less sophisicated security measures in place. Atacks on banks and other

cash-intensive businesses have declined notably in recent years due to the security

measures put into place at their locaions.

Jewellery stores and other businesses selling highly valuable and compact goods remain

popular targets for armed robbers using various methods of atack including smash and

grab.

LOGICAL AT TACKS ON ATMS

In September 2015, Europol supported

French, Belgian and Moldovan law

enforcement authoriies in disruping the

aciviies of a Moldovan OCG carrying

out serial burglaries targeing bicycle

shops. The ofenders typically stole luxury

bikes worth more than EUR 10,000 each.

The bikes were transported from Paris

to Moldova on long-distance passenger

busses. The bikes were eventually sold in

Ukraine as well as via online marketplaces.

This OCG was highly mobile and operated

with a strict division of tasks between

group members.

As part of a new modus operandi, atackers drill or burn small holes into the ATM case in

order to reach the ATM’s computer hardware components. The atackers use this access to

intrude into the ATM’s operaing system and force it to dispense cash.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

Motor vehicle crime

The thet and fraudulent acquisiion of motor

vehicles remains a lucraive business for the

various OCGs involved in this criminal acivity.

Some OCGs steal speciic vehicles to order for

clients based in desinaion countries. While

the overall number of stolen vehicles appears

to have remained stable in many Member

States over recent years, the number of

recovered vehicles has dropped considerably

across several Member States. This trend

likely indicates a further shit from individual

ofenders to the involvement of more

professional OCGs.

ELECTRONIC COMPROMISE

OCGs involved in the thet of motor vehicles

increasingly rely on high-tech tools to gain

access to vehicles and to overcome security

measures. Informaion on how to overcome

car security systems can be easily found on

online messaging boards and websites. In

many cases, the tools used for electronic

compromise are readily available to order

online and oten originate from China.

Some OCGs steal cars as part of burglaries

and home jacking atempts. MOCGs target

residenial homes with high-value cars parked

outside, breaking and entering these premises

to retrieve the original car keys and steal

the vehicle. Vehicle thet is inimately linked

to document fraud. OCGs use fraudulent

documents to give stolen cars new ideniies

for registraion or exportaion purposes.

OPERATION PANDORA

3 , 5 6 1 ART EFACTS SEIZ ED IN

OPERAT ION PAN DORA

Cultural goods trafﬁcking

The conlicts in Libya, Syria and Iraq are

thought to have resulted in the intensiied

traicking of cultural goods from this region

to the EU. This trend is expected to coninue

due to persistent instability in the region and

the lack of law enforcement resources to

prevent or intercept traicking aciviies in

origin and transit countries. A small porion

of the funds generated by cultural goods

traicking in the Middle East and North Africa

region could potenially be used to support

terrorist organisaions. However, the proits

achieved from cultural goods traicking for

these organisaions are thought to be low

compared to other revenue streams.

WAR CRIMES

In January 2017, Europol joined forces

with law enforcement authoriies from

18 countries, Interpol, the United Naions

Educaional, Scieniic and Cultural

Organizaion (UNESCO), and the World

Customs Organizaion (WCO) to tackle the

thet and illicit traicking of cultural goods.

Operaion Pandora was successfully led by

Cypriot and Spanish police:

3,561 works of art and cultural goods

were seized, almost half of which

were archaeological objects; 500

archaeological objects were found in

Murcia, Spain, of which 19 were stolen in

2014 from the Archaeological Museum

in Murcia;

over 400 coins from diferent periods

were seized following invesigaions into

suspicious online adverisements.

Several of the retrieved artefacts are

of great cultural importance in the

archaeological world, such as a marble

Otoman tombstone and a post-Byzanine

icon depicing Saint George, along with two

Byzanine artefacts. All of them were seized

in Greece during acions carried out by the

Hellenic Police.

OCGs increasingly rely on

technical tools and expertise to

overcome new vehicle security

measures.

The trade in spare parts is

increasingly taking place on

online marketplaces. OCGs have

adapted to this and now rely

on these platforms to sell the

cannibalised spare parts from

stolen vehicles.

In some cases, the destrucion, removal and

traicking of cultural goods in the context of

an armed conlict can amount to a war crime.

Signiicant cultural goods are protected by

internaional law. Internaional humanitarian

law and internaional criminal law have

established various forms of atack against

cultural property as war crimes. Aciviies

related to the destrucion or traicking of

cultural goods amouning to war crimes

potenially have an impact on the EU. The

deliberate destrucion of archaeological and

cultural heritage in Palmyra as well as other

places in Syria and Iraq could potenially

be considered a war crime according to the

Rome Statute of the Internaional Criminal

Court.

Subsequently, law enforcement

authoriies seized cultural goods originaing

from Palmyra and traicked to Europe.

The illegal online trade

in cultural goods is

expanding.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

PEOPLE AS A COMMODITY

MIGRANT SMUGGLING

Migrant smuggling has emerged as a

highly proitable and widespread criminal

acivity for organised crime in the EU. The

migrant smuggling business is now a large,

proitable and sophisicated criminal market,

comparable to the European drug markets.

The demand for and supply of smuggling

services has grown signiicantly since 2014.

More than 510,000 illegal border crossings

between border-crossing points at the

external border of the EU were registered

in 2016.

This is a substanial decrease

compared to 2015, when over one million

irregular migrants entered the EU on

the Eastern Mediterranean and Central

Mediterranean routes.

Nearly all of the

irregular migrants arriving in the EU along

these routes use the services ofered by

criminal networks at some point during their

journeys.

During 2016, 1,234,558 applicaions for

asylum were recorded in the EU. In 2015,

the European Asylum Support Oice (EASO)

reported just over 295,000 posiive decisions

on asylum applicaions by Member States.

This means that a large number of irregular

migrants who did not apply for asylum

or whose applicaions were rejected may

atempt to stay illegally in the EU.

In addiion to the transportaion of migrants,

document fraud has emerged as a key

criminal acivity linked to the migraion crisis.

The provision of fraudulent documents will

coninue to represent a substanial threat to

the security of the EU. Fraudulent documents

are used and can be re-used for many

diferent criminal ofences.

Armed conflicts, economic and

population pressures in Africa and

the Middle East will continue to

act as the main push factors for

irregular migrants travelling to the

EU. Migrant smuggling to and within

the EU will remain a key criminal

threat.

The number of unaccompanied

minors present in the EU has

increased signiﬁcantly in recent

years as a result of the migration

crisis. This group is very vulnerable

to all types of exploitation.

MIGRANT SMUGGLING

ROUTES

SOURCE: EUROPOL INFORMATION (2017)

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

Migrant smuggling

business

a daily

In 2015, migrant smuggling networks ofering

facilitaion services to reach or move within

the EU generated an esimated EUR 4.7 billion

to EUR 5.7 billion in proit. These proits have

seen a sharp decline in 2016, dropping by

nearly EUR 2 billion between 2015 and 2016.

This development is in line with the overall

decrease in the number of irregular migrants

arriving in the EU and as a result of a fall in

the prices for migrant smuggling services

following the peak of the migraion crisis in

2015.

OCGs involved in migrant smuggling display

an unprecedented level of organisaion and

coordinaion. While established smuggling

modi operandi

remain unchanged, migrant

smugglers have shown great versaility in the

means of transport, concealment methods

and technologies they use.

Migrant smuggling is a muli-naional busi-

ness. Migrant smugglers originaing from over

122 countries are involved in facilitaing the

journeys of irregular migrants to the EU. Most

migrant smuggling networks are composed

of various naionaliies involving both EU and

non-EU naionals.

Migrant smuggling networks heavily rely on

social media to adverise smuggling services.

Migrant smugglers make use of ride-sharing

applicaions and P2P accommodaion plat-

forms to provide a cover for their smuggling

aciviies. This leaves regular users at the

risk of inadvertently becoming facilitators by

unknowingly transporing or hosing irregular

migrants.

Migrant smuggling is a highly proitable crim-

inal acivity featuring sustained high levels of

demand and relaively low levels of risk. Some

OCGs previously involved in other criminal

aciviies such as the illegal trade in excise

goods, drug traicking or organised property

crime have added migrant smuggling to their

porfolio of criminal aciviies. Migrant smug-

gling does not require access to signiicant

resources and OCGs can rely on their exising

knowledge of routes and infrastructure

used to smuggle goods across borders. The

disincion between legal and illegal aciviies

is increasingly blurred. Individual criminal

entrepreneurs can step in and out of criminal

aciviies by providing ad hoc services, espe-

cially taxi and truck drivers.

well as to change from irregular to legalised

residence status under false pretences or

by using fake ideniies. Migrant smuggling

networks are increasingly ofering tailor-made

facilitaion services including high-quality

fraudulent documents.

The abuse of genuine passports by look-alikes

coninues to be the main modus operandi

used by document fraudsters. ID cards are

the most commonly detected document used

as part of document fraud. In 2015, they ac-

counted for 50% of all detecions in the EU. In

2016, more than 7,000 people were detected

with fraudulent documents on entry at the

external borders of the EU.

An emerging market

Both the quanity and the quality of fraud-

ulent documents circulaing in the EU have

increased. The sustained increase in demand

for fraudulent documents has prompted

established counterfeiters to increase their

producion output and establish new print

shops.

OPERAT ION DAIDALOS

In March 2015, Operaion Daidalos

targeted a criminal group smuggling

irregular migrants from Greece to other

Member States which was involved in the

producion and distribuion of forged travel

documents. In addiion to providing these

documents to irregular migrants, the group

also sold these to other OCGs. The criminal

network operated primarily in Greece.

Abuse of legal channels

Migrant smugglers frequently abuse legal

channels to facilitate the entry of irregular

migrants to the EU or to legalise their stay.

The abuse of legal channels involves a variety

modi operandi

including sham marriages,

bogus paternity, false employment contracts,

fake invitaion leters, false medical visas, and

false claims of being vicims of traicking or

refugees.

Illegal but not undocumented

document and identity fraud

Service packages ofered by migrant smug-

glers now frequently include the provision

of fraudulent travel and idenity documents.

Fraudulent documents allow irregular mi-

grants to enter and move within the EU as

BUSINESS MODEL

Supply of fraudulent documents

Migrant hands over his

bio data and a photograph

eletronically

Facilitator sends

details to the

forger

Facilitator hands the

passport to the migrant

in exchange for fee

Forger procures passport and

applies a fake visa, stamp and

bio data on the document

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

The demand for smuggling

services has grown

signiﬁcantly

since 2014.

Migrant smuggling to and

ithin the EU ill remain a

key criminal threat

FACILITATION

SERVICES

Migrant smuggling networks offer their services including

transportation, accommodation,

the

provision of fraudulent

documents

and

information

on contact points in other countries.

TRANSPORTATION

& ACCOMMODATION

Migrant smugglers pass irregular

migrants from one network to

another along the route of the

migrants’ journey.

EU suspects typically work as

drivers transporting irregular

migrants within the EU to

destination countries.

COMMUNICATION

VIA SOCIAL MEDIA

Migrant smugglers widely rely on

social media

and use online

platforms such as

ride-sharing

websites,

P2P

accommodation

platforms, to arrange facilitation

services.

DOCUMENT

FRAUD

Document fraud has emerged as a

key criminal activity linked to the

migration crisis.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

TRA IC ING IN UMAN EINGS (T

THB for sexual and labour exploitaion

includes the recruitment, transportaion,

harbouring and exploitaion of vicims.

OCGs involved in THB typically operate

in independent cells that deal with the

various stages of recruitment, transport and

exploitaion.

Traickers rely heavily on document fraud to

enable their traicking aciviies. This includes

the use of fraudulent idenity, travel and

breeder documents as well as the abuse of

legal channels such as the EU visa regime for

tourism, study and work visas. OCGs involved

in THB also coninue to exploit asylum

provisions in order to traic non-EU naionals

into the EU. On many occasions, vicims

are provided with fraudulent documents to

conceal their real idenity and age.

)

The trafﬁcking of victims within

the EU remains a key threat.

The migration crisis has resulted

in an increase in the number

of potential victims of THB. A

growing number of vulnerable

adults and unaccompanied

minors in the EU are likely to be

targeted by trafﬁckers.

for labour e ploitation

The involvement of OCGs in THB for labour

exploitaion is increasing in the EU. OCGs

cater to the growing demand for cheap labour

across many Member States and have access

to a large number of potenial vicims. THB

for labour exploitaion threatens to iniltrate

the legal economy, where it lowers wages and

hampers economic growth.

THE BUSINESS MODEL

There has been litle change in the types

of industries featuring labour exploitaion.

Traickers coninue to target less regulated

industries as well as those featuring seasonal

demand for workers. Vulnerable sectors

include agriculture, catering, cleaning,

construcion, entertainment, ishing,

hospitality, retail and transportaion.

Traickers take advantage of discrepancies in

labour legislaion to organise the exploitaion

of vicims in the grey zone between legal

employment and labour exploitaion. Some

vicims receive wages equivalent to the

minimum standard in their countries of origin.

However, these are far below acceptable

salaries in countries of exploitaion where

they do not have suicient resources to cover

their living expenses. These wage dumping

pracices seriously undermine the legal labour

market in countries of desinaion and make

it diicult for vicims of labour exploitaion to

be recognised as such.

for se ual e ploitation

The sexual exploitaion of EU naionals no

longer relies predominantly on the use

of violence and coercion towards vicims.

Some OCGs are increasingly relying on

threats of violence towards vicims and their

families rather than atacking the vicim.

Vicims originaing from outside the EU are

sill rouinely subjected to violence, debt

bondage, passport coniscaion and other

forms of coercion as an integral part of

traicking

modi operandi.

CRIM IN AL GAN G ACCU SED OF

T RAFFICKIN G OVER 1 5 0 WOM EN

IN TO PROST IT UT ION DISM AN T L ED BY

AU ST RIA

In November 2016, Austrian law

enforcement authoriies with the support

of Europol dismantled a Chinese OCG

involved in the traicking of up to 300

women. Vicims were lured to Austria

on promises of work as nannies or

masseuses. They were provided with

forged documents and brought to Austria

illegally. Upon their arrival in Vienna, OCG

members took away the vicims’ IDs. The

women were placed in so-called “sex

studios” owned by the OCG and forced

to work as prositutes. Ater a few weeks

they were transferred to other brothels in

Austria.

Trafﬁcking of underage victims

Traickers oten speciically target underage

vicims, both male and female, to sexually

exploit them. The exploitaion of underage

vicims is not always moivated by inancial

proit. In some cases, underage vicims are

traicked for the purpose of producing CSEM,

which is traded on online plaforms.

T RAFFICK ING VICT IM S FORCED INTO CRIMIN AL IT Y

In November 2016, a Spanish invesigaion supported by Europol resulted in the arrest of 16

suspected traickers and the rescue of nine minors. The OCG traicked young women and

forced them into pickpockeing in various Member States. The vicims were iniially lured to

Spain and travelled there using counterfeit documents. In Spain, the traickers trained the

vicims in pickpockeing techniques and forced them to commit thets in crowded areas and

on public transport. The OCG shared family ies and was hierarchically structured operaing

in smaller groups in diferent European ciies. The larger criminal network was mainly

composed of naionals from Bosnia and Herzegovina and traded the vicims from one group

to another for an esimated EUR 5,000 each.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

LABOUR EXPLOITATION

SEXUAL EXPLOITATION

CHILD TRAFFICKING

T B for labour exploitation

increasing in the EU.

Trafﬁckers continue to target less

regulated industries as well as those

featuring seasonal demand for

workers.

The traditional trafﬁcking flow from

Eastern Europe to estern Europe

has been replaced by multiple and

diverse flows of victims all over the

EU.

OC s have further increased

the

use of legal businesses

that can conceal exploitations

such as hotels, nightclubs and

massage parlours.

Trafﬁckers often speciﬁcally

target underage victims, both

male and female, to sexually

exploit them.

Trafﬁckers continue to rely on the use of social media, oice-over-I ( oI ) and instant messaging

applications at all stages of the trafﬁcking cycle.

inks bet een migrant

smuggling and trafﬁcking in

human beings

MIGRANT SMUGGLING

OCGs involved in THB oten exploit exising

migratory routes to traic vicims within the

EU. While the migraion crisis has not yet

had a widespread impact on THB for labour

exploitaion in the EU, some invesigaions

show that traickers are increasingly targeing

irregular migrants and asylum seekers in the

EU for exploitaion. Irregular migrants in the

EU represent a large pool of potenial vicims

suscepible to promises of work even if this

entails exploitaion.

SHAM MARRIAGES

There has been an increasing number of

reports of incidents of sham marriages in

several Member States. This increase is likely

related to the migraion crisis and an increase

in the number of irregular migrants seeking to

transiion to legal residence status ater failed

asylum applicaions.

MIGRAN T SM U GGL IN G AN D H U M AN

T RAFFICK IN G RIN G OPERAT IN G VIA

T HE M EDIT ERRAN EAN

TRAFFICKING IN

HUMAN BEINGS

In November 2015, a joint operaion

between Spanish and Polish law enforcement

authoriies, coordinated by Europol, revealed

the operaion of a migrant smuggling network

exploiing irregular migrants from Pakistan

in restaurants in Spain. Irregular migrants

were forced to work long hours in appalling

condiions without salary, holiday or social

security to repay their debts to smugglers

for the travel and provision of fraudulent

documents. The migrant smugglers used

the criminal proceeds to invest in new

restaurants, which were also used for the

exploitaion of irregular migrants.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ASSESSING ORGANISED CRIME

SPORTS

CORRUPTION

Criminal networks use match-ixing

to manipulate the outcomes of sports

matches, which skews be ng odds and

allows them to generate signiicant proits.

Match-ixing in the EU primarily afects

football games. However, match-ixers are

also targeing tennis, snooker and dart

compeiions.

In some cases OCGs have iniltrated

sporing clubs in order to orchestrate

money laundering schemes.

TRAFFICKING

OF FIREARMS

The proliferation and availability

of illegal ﬁrearms in the ember

States increases the risk of their

use by terrorist groups to carry

out attacks in the EU.

Illegal ﬁrearms are increasingly

accessible due to their

availability online.

Recent terrorist atacks in the EU carried out

by jihadist terrorists using traicked irearms

have demonstrated the lethal consequences

of the trade in illicit irearms. Several

incidents of violent clashes between criminal

gangs have highlighted that the use of illegal

irearms remains a signiicant threat to EU

ciizens.

ONLINE TRADE

Firearms are frequently traded on online

plaforms including Darknet marketplaces.

Both individual criminals and OCGs obtain

illegal irearms via online marketplaces. This

development has resulted in a signiicant

increase in the use of parcel and postal

services to traic irearms and irearm

components.

Online trade allows individuals with no or

limited connecions to organised crime to

procure irearms. These individual criminal

actors increasingly engage in the traicking of

irearms and irearm components as part of

a CaaS business model and have emerged as

key distributors of illegal irearms in the EU.

The online trade in illegal irearms via various

plaforms is set to expand further over the

coming years.

DIVERSION FROM LEGAL SUPPLY

Firearms traickers are highly adept at

exploiing legal loopholes and diferences

in regulatory regimes between Member

States to divert irearms from legal

suppliers. The reacivaion of deacivated

weapons and conversion of blank-iring

irearms are among the main sources

of illegal irearms traicked in the EU.

Firearms traickers oten convert blank-

iring irearms or reacivate deacivated

irearms purchased from legal dealers

based in countries applying less stringent

acquisiion rules such as more permissive

licensing and registraion requirements.

Various conlict zones in the periphery of

the EU have the potenial to emerge as

major sources of irearms traicked to

the EU.

FOOT B AL L AND MONEY L AUN DERING

In May 2016, as part of Operaion

Matrioskas, law enforcement authoriies

dismantled a Russian-speaking OCG which

had iniltrated football clubs and laundered

several million euros across the EU. The

OCG used middlemen to purchase football

clubs experiencing inancial pressure. The

group was able to conceal their money

laundering aciviies among the large

inancial transacions and cross-border

money lows, which are not unusual

for professional football clubs. Weak

governance allowed the OCG to use the

clubs to launder money by over- or under-

valuaing players on the transfer market

as well as by acceping bids for television

rights deals.

In June 2016, Italian law enforcement

authoriies arrested two members of the

maia clan ‘Ceusi’ on charges of irearms

traicking. The suspects had purchased

over 160 decommissioned irearms

from Slovakia. Some of the irearms

were reacivated and sent to Malta in

parcels. The Italian OCG maintained links

with Egypian OCGs involved in migrant

smuggling aciviies.

Using post and parcel services

is now the most common way of

trafﬁcking ﬁrearms in the EU.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

LINKS BETWEEN SERIOUS AND

ORGANISED CRIME AND

TERRORISM

Terrorism and the groups carrying out

terrorist ofences have evolved signiicantly

over the last decade. The EU has been the

target of repeated terror atacks and plots

in recent years. The invesigaions into the

terrorist atacks in Brussels and Paris, carried

out in March 2016 and November 2015

respecively, uncovered the involvement of

some of the perpetrators in diferent types

of serious and organised crime including the

traicking of illicit drugs, as well as personal

contacts with criminal groups involved in

the traicking of irearms and producion of

fraudulent documents.

Recent invesigaions have revealed that

terrorist groups have made use of migrant

smuggling networks to allow their operaives

to enter the EU. However, these cases do

not suggest that terrorist groups maintain

sustained engagement with OCGs involved in

migrant smuggling.

The proit-driven nature of organised crime

aciviies is in many cases incompaible with

terrorist acts, which atract a great degree of

media and law enforcement atenion to the

perpetrators.

The pursuit of criminal aciviies in support of

terrorist aciviies is not a new phenomenon.

However, the involvement of suspects with

extensive criminal backgrounds and access

to the resources and tools of organised

crime networks in terrorism is paricularly

threatening in light of the fast pace of

radicalisaion and willingness to very quickly

engage in terrorist atacks following the

beginning of the radicalisaion process.

The threat emanaing from links between

serious and organised crime and terrorism

is two-fold. Firstly, the potenial exploitaion

of OCG infrastructures to procure tools, such

as irearms or fraudulent documents, and

move goods and people may deliver lethal

weapons used in atacks in the EU to terrorist

groups. Secondly, involvement in serious and

organised crime may allow terrorist actors to

generate funds to inance terrorism-related

aciviies.

The suspects are involved in various crime

areas including money laundering, migrant

smuggling, heroin and irearms traicking,

organised property crime and THB. These

suspects are typically involved at a low level

in organised crime and do not ill major roles

within organised crime networks.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

CONCLUSIONS

Tackling organised crime in the The role of the SOCTA

age of technology

The vital role of technology for organised

Serious and organised crime is a key

threat to the security of the EU. Criminal

groups and individual criminals coninue

to generate muli-billion euro proits

from their aciviies in the EU each year.

Some parts of the serious and organised

crime landscape in the EU have changed

drasically in recent years - in large part

due to advancements in technology that

have had a profound impact on the wider

society and economy.

Technology is a key component of most,

if not all, criminal aciviies carried out

by organised crime groups in the EU and

has aforded organised crime with an

unprecedented degree of lexibility. This

lexibility is paricularly apparent in the

ease with which criminals adapt to changes

in society.

The internet, the mulitude of online

plaforms and communicaion channels it

hosts have had a huge impact on society,

strengthening and transforming the

economy, driving innovaion and shaping

social interacion. However, it is also a key

enabler of criminal acivity and plays a role

in all types of criminality.

The impact of technology on crime,

however, extends beyond the internet and

involves all kinds of technical innovaion

such as advances in drone technology,

automated logisics, and advanced prining

technologies.

crime is relected in the data collected

and analysed for the SOCTA 2017. For the

SOCTA 2017, Europol has undertaken the

largest-ever data collecion on serious and

organised crime in the EU.

Europol relied on more than 2,300

quesionnaires contributed by Member

States, Europol’s operaional and

strategic partners outside the EU and our

insituional partners as well as operaional

intelligence held in Europol’s databases to

produce the most detailed assessment of

the nature and scale of criminal threats

facing the EU and its Member States yet.

Based on an in-depth analysis of this

data and a methodology endorsed by the

Member States, Europol ideniies the key

threats from serious and organised crime

facing the EU today and over the coming

years.

RECOMMENDED

PRIORITIES

Based on the outcome of a

comprehensive analysis of the

indicators and factors detailed in

the SOCTA Methodology, Europol

recommends key priorities to

tackle the most threatening

forms of serious and organised

crime. In addition to ﬁve speciﬁc

criminal activities carried out

by organised crime in the EU,

Europol is also recommending

to focus on three cross-cutting

threats that enable or enhance

all types of serious and

organised crime.

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017

SPECIFIC PRIORITY CRIME

THREATS:

Cybercrime

Drug production, trafﬁcking and distribution

Migrant smuggling

Organised property crime

Trafﬁcking in human beings

CROSS-CUTTING PRIORITY CRIME

THREATS:

Criminal ﬁnances and money laundering

Document fraud

Online trade in illicit goods and services

CRIME AREAS

Currency

counterfeiting

CYBERCRIME

DRUG

Environmental

crime

TRAFFICKING

Synthetic drugs

production in

the EU

Trafﬁcking of

precursors and

pre-precursors

Illicit waste

trafﬁcking

Fraud

Intellectual

MIGRANT

ORGANISED

property crime

PROPERTY CRIME

SMUGGLING

Trafﬁcking of

ﬁrearms

TRAFFICKING IN

HUMAN BEINGS

Online child

sexual

exploitation

Production

Excise fraud

Online trade in

Burglaries and

counterfeit

theft

goods

External

borders of the

THREATS

Cyber-

dependent

Import of

crime

cocaine to the

(malware,

EU via major

cryptoware, etc.)

ports and

couriers

Distribution

including

online

Online trade

(including

de/reactiva-

tion)

Labour

exploitation

MTIC fraud

Poly-drug

trafﬁcking in

the EU

Payment card

fraud (card-not- Large-scale

cannabis

present fraud)

production and

trafﬁcking in

the EU

Investment

fraud

Trafﬁcking of

endangered

species

Production of

counterfeit

goods in the

Motorvehicle

crime

Secondary

movements

Sexual

exploitation

Sports

corruption

Trafﬁcking of

counterfeit

goods (not

online) in the

Organised

robberies

Risk for labour

exploitation

Traditional

trafﬁcking

Child

trafﬁcking

CROSS-CUTTING

CRIME THREATS

Corruption

Countermeasures against law enforcement

Criminal ﬁnances and money laundering

Document fraud, including identity fraud

Extortion

Online trade in illicit goods (ﬁrearms, counterfeit goods, drugs)

HIGH THREAT

THREAT

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ANNEX

LIST OF ABBREVIATIONS

ATM

AWF SOC

CaaS

CNP

COSI

CSE

CSEM

DDoS

EASO

ECB

EMCDDA

EMCS

IPR

LDCA

MDMA

MOCG

MTIC

NFC

NPS

OCG

P2P

POS

SEPA

SOCTA

THB

TOR

VAT

Automated teller machine

Analysis Work File on Serious and Organised Crime

Crime-as-a-Service

Card-not-present

Standing Committee on Operational Cooperation on Internal Security

Card-present

Child Sexual Exploitation

Child Sexual Exploitation Material

Distributed denial of service

European sylum Support Ofﬁce

European Central Bank

European Monitoring Centre for Drugs and Drug Addiction

Excise Movement and Control System

European Union

Intellectual Property Rights

Long-distance child abuse

3,4-methylenedioxy-methamphetamine

Mobile organised crime group

Missing Trader Intra Community

Near Field Communication

New Psychoactive Substances

Organised crime group

Peer-to-peer

Point of Sale

Single Euro Payments Area

Serious and Organised Crime Threat Assessment

Trafﬁcking in uman Beings

The Onion Router

Value Added Tax

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

REFERENCES

Council Decision of 6 April 2009 establishing the European Police Oice

(Europol) (2009/371/JHA), accessible at htps://www.europol.europa.eu/

publicaions-documents/council-decision-of-6-april-2009-establishing-

european-police-oice-europol

Council Document 12159/12, Serious and Organised Crime Threat

Assessment (SOCTA). Methodology (04/07/2012), accessible at htp://data.

consilium.europa.eu/doc/document/ST-12159-2012-INIT/en/pdf

Europol 2016, Internaional criminal network behind large-scale payment

fraud dismantled (07/09/2016), accessible at htps://www.europol.europa.

eu/newsroom/news/internaional-criminal-network-behind-large-scale-

payment-fraud-dismantled

Europol 2016, Global acion against airline fraudsters (19/10/2016),

accessible at htps://www.europol.europa.eu/newsroom/news/global-

acion-against-airline-fraudsters-193-detained

Europol 2015, Large Chinese money laundering network dismantled

(12/05/2015), accessible at htps://www.europol.europa.eu/newsroom/

news/large-chinese-money-laundering-network-dismantled

Europol and Eurojust 2016, Hawala money laundering ring dismantled by

Joint Invesigaion Team (29/11/ 2016), accessible at htps://www.europol.

europa.eu/newsroom/news/hawala-money-laundering-ring-dismantled-

joint-invesigaion-team

Europol 2016, Iraqi money laundering syndicate based in Germany

dismantled with support of Europol and Eurojust (31/03/2016), accessible

at htps://www.europol.europa.eu/newsroom/news/iraqi-money-

laundering-syndicate-based-in-germany-dismantled-support-europol-and-

eurojust

Europol 2016, Dozens arrested for massive document forgery and migrants

smuggling (31/05/2016), accessible at htps://www.europol.europa.eu/

newsroom/news/dozens-arrested-for-massive-document-forgery-and-

migrant-smuggling

htps://metrics.torproject.org

D. Moore and T. Rid 2015, Cryptopoliik and the Darknet, p. 21

EMCDDA & Europol 2016, EU Drug Markets Report 2016, p. 23

EMCDDA & Europol 2016, EU Drug Markets Report 2016, p. 60

Europol 2016, ‘Rose of the Winds’ – Internaional operaion against drug

traicking (01/12/20160, accessible at htps://www.europol.europa.eu/

newsroom/news/%E2%80%98rose-of-winds%E2%80%99-%E2%80%93-

internaional-operaion-against-drug-traicking

ABC News 2014, Six charged ater drug bust which seized 2.8 tonnes of

MDMA and methamphetamine worth $1.5 billion (29/11/2014), accessible

at htp://www.abc.net.au/news/2014-11-29/six-charged-over-enormous-

$1.5b-drug-bust/5927904

BBC 2015, Gang guilty over £600,000 phone scam against pensioners

(10/12/2015), accessible at htp://www.bbc.com/news/uk-35064360

European Parliament 2015, Parliamentary quesions: Answer given by

Vice-President Mogherini on behalf of the Commission (22/09/2015),

accessible at htp://www.europarl.europa.eu/sides/getAllAnswers.

do?reference=E-2015-008402&language=EN

Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,

p.47

Europol 2016, 3561 artefacts seized in Operaion Pandora (23/01/2017),

accessible at htps://www.europol.europa.eu/newsroom/news/3561-

artefacts-seized-in-operaion-pandora

Europol 2016, Darknet arms vendors arrested in Slovenia with support

of Europol (20/12/2016), available at htps://www.europol.europa.eu/

newsroom/news/darknet-arms-vendor-arrested-in-slovenia-support-of-

europol

Frontex 2017, Risk Analysis for 2017

UNHCR 2015, Over one million sea arrivals reach Europe in 2015,

accessible at htp://www.unhcr.org/news/latest/2015/12/5683d0b56/

million-sea-arrivals-reach-europe-2015.html

Carnegie Mellon University 2015, Measuring the Longitudinal Evoluion of

the Online Anonymous Marketplace Ecosystem, available at htps://www.

usenix.org/system/iles/conference/usenixsecurity15/sec15-paper-soska-

updated.pdf

EASO 2015, Latest Asylum Trends – 2015 Overview, accessible at htps://

www.easo.europa.eu/sites/default/iles/public/LatestAsylumTrends20151.

pdf

Frontex 2017, Risk Analysis for 2017

Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,

p.49

In 2014, Europol published a report on the future of serious and

organised crime “Exploring tomorrow’s organised crime”, which

highlighted key drivers for change which have an impact on serious and

organised crime in the EU. The report is available on Europol’s website

at htps://www.europol.europa.eu/publicaions-documents/exploring-

tomorrow%E2%80%99s-organised-crime

Europol 2016, Crime gang accused of traicking over 150 women into

prosituion dismantled by Austria (17/11/2016), available at: htps://www.

europol.europa.eu/newsroom/news/crime-gang-accused-of-traicking-

over-150-women-prosituion-dismantled-austria

Europol 2016, Europol teams up with Spanish authoriies to bring down

human traicking network (29/11/2016), available at htps://www.europol.

europa.eu/newsroom/news/europol-teams-spanish-authoriies-to-bring-

down-human-traicking-network

European Central Bank 2016, Annual Report 2015, p. 76

Europol 2016, ‘Avalanche’ network dismantled in internaional cyber

operaion (01/12/2016), accessible at htps://www.europol.europa.eu/

newsroom/news/%E2%80%98avalanche%E2%80%99-network-dismantled-

in-internaional-cyber-operaion

Europol 2015, Hit on migrant smuggling and human traicking ring

operaing via the Mediterranean (03/11/2015), available at: htps://www.

europol.europa.eu/newsroom/news/hit-migrant-smuggling-and-human-

traicking-ring-operaing-mediterranean;

Symantec 2016, Internet Security Threat Report, p.54

Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,

p.36-37

Europol 2016, Weapons smugglers arrested in Italy with the support

of Europol (09/06/2016), accessible at htps://www.europol.europa.eu/

newsroom/news/weapon-smugglers-arrested-in-italy-support-of-europol

Verizon 2016, 2016 Data Breach Invesigaion Report, p.4

Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,

p.24

REU, Alm.del - 2017-18 - Bilag 78: Rapporter fra EUIPO, EUROPOL og SOCTA om IPR-kriminalitet og organiseret kriminalitet i EU (2017)

ISBN 978-92-95200-77-7

DOI 10.2813/114730

QL-04-17-236-EN-N

Eisenhowerlaan 73, 2517 KK

The Hague, the Netherlands

www.europol.europa.eu

SERIOUS AND ORGANISED CRIME

THREAT ASSESSMENT

EUROP EAN UN ION