currency counterfeiting

firearms trafficking

Intellectual property crime

Cybercrime

fraud
E U R OP EAN UNION

money laundering Crime in the age of technology
THREAT ASSESSMENT

Trafficking in human beings

drug trafficking

sports corruption

illicit online trade
SERIOUS AND ORGANISED CRIME

environmental crime

Organised property crime

document fraud

Migrant smuggling
SOCTA 2017

© European Police Office 2017

Reproduction is authorised provided the source is acknowledged. For any use or reproduction of individual
photos, permission must be sought directly from the copyright holders.

This publication and more information on Europol are available on the Internet:
Website: www.europol.europa.eu
Facebook: www.facebook.com/Europol
Twitter: @Europol
YouTube: www.youtube.com/EUROPOLtube

ACKNOWLEDGEMENTS PHOTO CREDITS

The EU Serious and Organised Crime Threat Assessment (SOCTA) is the product of systematic analysis of law Europol: pages 6 and 8
enforcement information on criminal activities and groups affecting the EU. The SOCTA is designed to assist Shutterstock: pages 24, 28, 31, 32, 35, 40,
decision-makers in the prioritisation of serious and organised crime threats. 41, 42, 45, 47, 54, 55
Spanish National Police: page 18
It has been produced by Europol, drawing on extensive contributions from the organisation’s Analysis Work Spanish Guardia Civil: page 48
File on Serious and Organised Crime (AWF SOC) and external partners. Europol would like to express its grat-
itude to Member States, third countries and organisations, the European Border and Coast Guard Agency
(Frontex), the European Union’s Judicial Cooperation Unit (Eurojust), the European Monitoring Centre for
Drugs and Drug Addiction (EMCDDA), INTERPOL, and the SOCTA Academic Advisory Group for their valuable
contributions and input.
EUR O P EAN UN I O N
SERIOUS AND ORGANISED CRIME
THREAT ASSESSMENT
Crime in the age of technology
TABLE OF CONTENTS
FOREWORD OF THE DIRECTOR 6
INTRODUCTION 8
KEY JUDGMENTS 10
UNDERSTANDING ORGANISED CRIME 12
fining ri an rgani cri 13
rgani cri gr an t r cri ina act r 14
ngin f rgani cri 17
ri r f cri 24
ASSESSING ORGANISED CRIME 26
rr nc c nt rf iting 28
rcri 28
r g r cti n trafficking an i tri ti n 34
n ir n nta cri 41
ra 42
nt ct a r rt cri 46
rgani r rt cri 47
a ac it 49
rt c rr ti n 54
Trafficking f fir ar 54
ink t n ri an rgani cri an t rr ri 55
CONCLUSIONS 56
ANNEX – LIST OF ABBREVIATIONS 58
FOREWORD
OF THE DIRECTOR
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 7

I am pleased to present the European information hub for criminal intelligence exchange of information remains Europol’s
Union (EU) Serious and Organised Crime in the EU to analyse and identify the key core business.
Threat Assessment 2017 (SOCTA 2017). crime threats facing the EU today.
The SOCTA 2017 is a forward-looking
The SOCTA 2017 is Europol’s agship
Informed by its analysis of the prevailing document that both describes and
product providing information to Europe’s
threat, the SOCTA 2017 identifies a anticipates emerging threats from serious
law enforcement community and decision-
number of key priorities, which, in and organised crime. In this edition of the
makers. It serves as the cornerstone of the
Europol’s view, require the greatest SOCTA, we highlight the role of technology
EU Policy Cycle for Serious and Organised
concerted action by Member States and in particular. Criminals have always been
Crime.
other actors to ensure the most effective adept at exploiting technology. However,
The Policy Cycle ensures effective impact. These include cybercrime, the the rate of technological innovation and
cooperation between national law production, trafficking and distribution of the ability of organised criminals to adapt
enforcement agencies, EU Institutions, illicit drugs, migrant smuggling, organised these technologies have been increasing
EU Agencies and other relevant partners property crime, and trafficking in human steadily over recent years. Developments
in the fight against serious and organised beings (THB). In addition, Europol such as the emergence of the online trade
crime. This is the second edition of the recommends focussing on three cross- in illicit goods and services are set to result
SOCTA, following its inaugural edition cu ng crime threats with a significant in significant shifts in criminal markets and
released in 2013. The SOCTA 2017 delivers impact across the spectrum of serious and confront law enforcement authorities with
a set of recommendations based on an in- organised crime – document fraud, money new challenges.
depth analysis of the major crime threats laundering and the online trade in illicit
In identifying and specifying these
facing the EU. The Council of Justice and goods and services. The SOCTA 2017 also
challenges, Europol hopes to provide a
Home Affairs Ministers will use these explores potential links between serious
tangible contribution to the efforts of
recommendations to define priorities for and organised crime and terrorism.
Member States and the EU in fighting
the coming four years.
In 2013, Europol reported the presence serious and organised crime. I look
The SOCTA 2017 is the outcome of the of at least 3,600 internationally operating forward to Europol’s continued support
work of many contributors from law Organised Crime Groups (OCGs) in the for and cooperation with law enforcement
enforcement authorities in the Member EU. In the SOCTA 2017, we identify agencies and other partners in the EU and
States, in countries with strategic and approximately 5,000 international OCGs beyond.
operational agreements with Europol, currently under investigation in the EU.
our institutional partners in the EU, and This increase is primarily a re ection of
Europol. a much improved intelligence picture.
It is also an indication of shifts in
Europol is a key partner to the Member
States in meeting security challenges by
criminal markets and the emergence of ain rig t
smaller groups and individual criminal Director of Europol
providing a highly developed pla orm
entrepreneurs in specific criminal
for the exchange of criminal intelligence
activities, especially those taking place
as well as analytical and operational
online.
support for some of the most complex
international investigations in the EU to These developments highlight the complex
date. In drafting the SOCTA 2017, Europol dynamics that shape the serious and
harnessed this unique information organised crime landscape in the EU. They
position. also emphasise the need for the continued
and enhanced exchange of information
The SOCTA 2017 represents the outcome
between law enforcement authorities
of the largest data collection on serious
as part of their day-to-day business.
and organised crime ever undertaken
Connecting law enforcement authorities
in the EU. Europol has been able to use
and facilitating the real-time 24/7
its singular intelligence capability as the
8

INTRODUCTION
T r an ni n an r
The European Union (EU) is a unique who share the presidency on a rotating
economic and political partnership basis. The third institution is the European
between 28 European countries.i It Commission, which represents the interests
was created in 1958 as the European of the Union as a whole.
Economic Community with the aim to
foster economic cooperation among its Europol is the EU’s law enforcement
six founding partners. Since then, the agency and assists the Member States in
number of EU Member States enlarged their fight against serious international
and the economic union developed into crime and terrorism. Established as an
an organisation covering a wide range of EU agency in 20091 , Europol, or the
policy areas. The official name changed to European Police Office, is at the heart of
the European security architecture and
the European Union in 1993 to re ect the
offers a unique range of services. Europol T T
broader cooperation on which members’
partnership is based. EU law is built is a support centre for law enforcement
operations, a hub for information on The SOCTA 2017 is the most comprehensive
on a series of treaties, voluntarily and study of serious and organised crime in
democratically agreed by all Members. criminal activities as well as a centre for
law enforcement expertise. Analysis is at the EU ever undertaken. It is the outcome
These agreements set out the EU’s goals in of a detailed analysis of the threat of
its main areas of activity. There are three the core of Europol’s activities. To give its
partners deeper insights into the crimes serious and organised crime facing the EU
main institutions involved in EU legislation: providing information for practitioners,
the European Parliament, which represents they are tackling, Europol produces regular
assessments that offer comprehensive, decision-makers and the wider public. As a
the EU’s citizens and its members are threat assessment, the SOCTA is a forward-
directly elected by them; the Council of forward-looking analyses of crime and
terrorism in the EU. looking document that assesses shifts in
the European Union, which represents the serious and organised crime landscape.
the governments of the Member States The SOCTA 2017 sets out current and
anticipated developments across the
spectrum of serious and organised crime,
identifies the key criminal groups and
individuals active in criminal activities
across the EU and describes the factors in
the wider environment that shape serious
and organised crime in the EU. The SOCTA
2017 also describes the dynamics that drive
organised crime in the age of technology
and re ects on how OCGs and individual
criminal entrepreneurs seek to exploit the
latest technological innovations.
The SOCTA is the product of close
cooperation between Europol, the law
enforcement authorities of the Member
States and third parties such as EU
agencies, international organisations and
countries outside the EU with strategic or
operational agreements with Europol. The
involvement of these crucial stakeholders
is also re ected in the SOCTA’s role as the
cornerstone of the EU Policy Cycle for
i
The Member States of the EU are: Austria, Serious and Organised Crime in the EU.
Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, France, Germany,
Greece, Hungary, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, and
United Kingdom.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 9

T ic c f r ri T T t g ata an rc
an rgani ri in t
As part of an iterative process, the SOCTA The findings of the SOCTA 2017 are the
The Policy Cycle provides a robust Methodology has been further developed outcome of detailed analysis of intelligence
framework that brings together the law and refined by experts at Europol and from gathered as part of the largest data
enforcement authorities of the Member the law enforcement authorities of the collection on serious and organised crime
States, Europol and a wide range of multi- Member States. The SOCTA Methodology ever undertaken in the EU. Member States,
disciplinary partners in the fight against allows Europol to understand and assess cooperation partners outside the EU and
serious and organised crime. The Policy serious and organised crime holistically. institutional partners contributed more
Cycle translates strategic objectives at the The SOCTA analyses and describes criminal than 2,300 questionnaires on crime areas
European level into concrete operational markets and crime areas in the EU; the and OCGs. The amount of data provided
actions against serious and organised OCGs or individual criminals carrying out for the SOCTA 2017 has more than doubled
crime. these criminal activities; as well as the compared to the SOCTA 2013.
factors in the broader environment that
The Policy Cycle is a methodology adopted In addition, Europol relied heavily on the
shape the nature of serious and organised
by the European Union in 2010 to address operational intelligence held in its Analysis
crime in the EU. Using a mixed methods
the most significant criminal threats facing Work File on Serious and Organised Crime
approach of qualitative and quantitative
the EU. Each cycle lasts four years and (AWF SOC) to provide a thorough and
analysis techniques and a set of clearly
optimises coordination and cooperation on extensive analysis of the criminal threats
defined indicators, Europol is able to
the crime priorities agreed by all Member facing the EU. Where appropriate, the
identify and specify the most threatening
States. During the cycle, all concerned data collected through questionnaires
criminal phenomena in the EU. Europol
services and stakeholders, at national and and available in Europol’s databases were
arrives at the recommended priorities for
EU level, are invited to allocate resources complemented by information from open
the fight against serious and organised
and mutually reinforce efforts. Emerging sources.
crime for the Policy Cycle based on this
threats are also monitored so that they Methodology. The SOCTA Methodology
can be effectively addressed. Relying on ensures transparency and reliability
the analytical findings of the SOCTA 2017, providing decision-makers with a solid
the Council of Justice and Home Affairs basis for their deliberations. The SOCTA
Ministers of the EU will decide on the Methodology is a public document and can
priorities in the fight against serious and be accessed online.2
organised crime for the second full Policy
Cycle from 2018 to 2021. These priorities The SOCTA 2017 is the
will determine the operational work carried
out in the framework of the Policy Cycle most comprehensive
for the next four years. The crime priorities study of serious and
agreed at European level in the context of
the Policy Cycle are re ected in operational organised crime in the EU
activities at Member State level. ever undertaken.
10

KEY JUDGMENTS
ORGANISED
CRIME GROUPS
Serious and organised crime in More than 5,000 OCGs operating
the EU features a great variety on an international level are
of criminal activities, which are currently under investigation
increasing in complexity and scale. in the EU. The number of
The profits generated by some of OCGs operating internationally
the successful OCGs and individual highlights the substantial scope
criminals active in the EU are and potential impact of serious
enormous and rival those of multi- and organised crime on the EU.
national corporations.

TECHNOLOGY AND ENGINES OF ORGANISED CRIME

Criminals quickly adopt and integrate new Document fraud, money laundering and the online trade in illicit goods and
technologies into their modi operandi or build services are the engines of organised crime in the EU. Although neither
brand-new business models around them. The document fraud nor money laundering have a direct impact on most citizens in
use of new technologies by OCGs has an impact the EU, they facilitate most, if not all, other serious and organised crime. The
on criminal activities across the spectrum of online trade in illicit goods and services is expanding rapidly. Almost all types of
serious and organised crime. This includes illicit goods are now bought and sold via online platforms that offer the same
developments online, such as the expansion ease of use and shopping experience as most legal online platforms. Depending
of online trade and widespread availability of on the type of commodity and service, this includes platforms both on the
encrypted communication channels, as well surface web and the Darknet. Data is also traded as a commodity. The online
as other aspects of technological innovation trade in illicit goods and services is foreseen to increasingly disrupt established
such as more accessible and cheaper high- criminal markets and their traditional distribution models over the next few
performance drone technology. Technology has years.
a fundamental and lasting impact on the nature
of crime.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 11

Many of the OCGs are highly The most threatening OCGs are An increasing number
flexible and display great those which are able to invest of individual criminal
adaptability in the speed with their significant profits in the entrepreneurs offer Crime-as-
which they adjust their modi legitimate economy as well as into a-Service (CaaS). The online
operandi or whole business models their own criminal enterprises, trade in illicit goods and services
to changes in the environment. ensuring business continuity enables individual criminals
Many criminal activities are and a further expansion of their to operate their own criminal
increasingly complex and require a criminal activities. The involvement business without the need for
variety of skills as well as technical in serious and organised crime the infrastructures maintained
expertise to carry them out. may allow some terrorist groups by ‘traditional’ OCGs.
to generate funds to finance
terrorism-related activities.

CRIMINAL ACTIVITIES

Cybercrime is a key challenge to digital The illicit drugs market remains the largest Migrant smuggling has emerged as one
economies and societies. Cyber-dependent criminal market in the EU. More OCGs of the most profitable and widespread
crime is underpinned by a mature CaaS are active in the production, trafficking criminal activities for organised crime in
model, providing easy access to the tools and distribution of illicit drugs than any the EU. The migrant smuggling business is
and services required to carry out cyber- other phenomenon. The industrial-scale now a large, profitable and sophisticated
attacks. Child Sexual Exploitation (CSE) production of synthetic drugs within the EU criminal market, comparable to the
perpetrated online is increasingly profit continues to expand and cements the EU European drug markets.
driven. The growth of card-not-present as a key source region for these substances
(CNP) fraud, coupled with successful distributed worldwide. OCGs maintain
industry measures to tackle card-present complex trafficking operations cooperating
(CP) fraud, has resulted in CNP fraud with OCGs on a global scale to orchestrate
accounting for 66% of total card fraud value. the wholesale importation of illicit drugs
into the EU. Within the EU, the majority of
OCGs involved in the distribution of illicit THB for labour exploitation is increasing and
drugs deal in multiple illicit drugs, also is expected to continue to expand. OCGs are
called poly-drug trafficking. expected to exploit the presence of a large
number of potentially vulnerable persons
in the EU following the migration crisis.
Organised property crime encompasses a Labour exploitation threatens to undermine
range of different criminal activities carried the legitimate labour market lowering
out predominantly by highly mobile OCGs wages and impeding economic growth.
operating across the EU. A steady increase
in the number of reported burglaries over
recent years is a particular concern in many
Member States.
UNDERSTANDING
ORGANISED CRIME
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 13

DEFINING SERIOUS AND
ORGANISED CRIME
OCGs are as varied as the markets they
service and the activities they engage in. Who
In many cases, OCGs reflect the societies,
cultures and value systems they originate
from. As societies across Europe become
more interconnected and international in CaaS
CRIME AS A SERVICE
outlook, organised crime is now also more
connected and internationally active than ORGANISED CRIME CRIMINAL NETWORKS CRIMINAL EXPERTS
ever before. GROUPS
Since the year 2000, the United Nations
Convention against Transnational
Organized Crime has provided an
internationally shared definition of an
organised criminal group as “a group of
How
three or more persons existing over a
period of time acting in concert with the
aim of committing crimes for financial or
material benefit.” This definition was also
adopted in the EU’s Council Framework CORRUPTION COUNTERMEASURES CRIMINAL FINANCES DOCUMENT FRAUD
AGAINST LAW (MONEY LAUNDERING)
Decision 2008/841/JHA of 24 October
ENFORCEMENT
2008 on the fight against organised crime
and continues to reflect law enforcement
authorities’ conceptualisation of organised
crime across the world. However, this
definition does not adequately describe TECHNOLOGY VIOLENCE AND
ONLINE TRADE
the complex and flexible nature of modern EXTORTION
organised crime networks.
OCGs operate in a criminal economy
dictated by the laws of supply and demand
and are favoured by social tolerance
What
for certain types of crime such as the
trade in counterfeit goods and specific
frauds against public authorities or large
companies. These factors will continue
to shape the organised crime landscape. CURRENCY CYBERCRIME DRUG PRODUCTION FRAUD
Individual criminals and criminal groups COUNTERFEITING Child sexual exploitation TRAFFICKING AND Excise fraud
are flexible and quickly adapt to exploit Cyber-dependent crimes DISTRIBUTION Investment fraud
new victims, to evade countermeasures or Payment card fraud Mass marketing fraud
identify new criminal opportunities. Payment order fraud
Value Added Tax fraud

ILLICIT WASTE INTELLECTUAL MIGRANT SMUGGLING ORGANISED
TRAFFICKING PROPERTY CRIME PROPERTY CRIME

SPORTS TRAFFICKING OF TRAFFICKING TRAFFICKING IN
CORRUPTION ENDANGERED SPECIES OF FIREARMS HUMAN BEINGS
14 UNDERSTANDING ORGANISED CRIME

ORGANISED CRIME GROUPS (OCGs)
AND OTHER CRIMINAL ACTORS

5,000
The OCGs and individual criminals The criminal markets involving illicit drugs,
operating in the EU are highly diverse. trafficking of human beings and migrant
They range from large ‘traditional’ OCGs smuggling attract the largest numbers
international OCGs
to smaller groups and loose networks of OCGs and continue to generate the
currently under
supported by individual criminals, who are greatest profits among the various criminal
investigation hired and collaborate ad hoc. More than markets in the EU. However, emerging
5,000 OCGs operating on an international crime phenomena such as the online trade
level are currently under investigation in in illicit goods and services may eclipse

>180
the EU. This figure does not necessarily these markets in size and profits in the
re ect an overall increase in organised future. The online trade in illicit goods
crime activity in the EU compared to 2013, and services is no longer merely a modus
nationalities
when Europol reported on the activities of operandi, but an expanding, highly dynamic
involved 3,600 internationally operating OCGs in the and substantial criminal market itself.
EU. This increase is primarily a re ection
Over the past few years, criminals of
of a much improved intelligence picture.
more than 180 nationalities were involved
The increase also points to the emergence
in serious and organised crime in the
of smaller criminal networks, especially in
EU. The majority of OCGs operating on
criminal markets that are highly dependent
an international level are composed of
on the internet as part of their modi
members of more than one nationality.
operandi or business model. Overall, the
Nonetheless, the majority of the suspects
number of OCGs operating internationally
(60%) involved in serious and organised
highlights the substantial scope and
crime in the EU are nationals of a Member
potential impact of serious and organised
State.
crime on the EU.

tr ct r
The diversity of the criminal landscape and the emergence
actors operating in the EU is of more groups and looser
also re ected in the structures networks detailed in the
30-40%
of the OCGs. 30% to 40% of SOCTA 2013 did not affect
LOOSE
the OCGs operating on an all criminal markets. The
international level feature fragmentation of criminal
NETWORKS
loose network structures. An markets was particularly
approximate 20% of these pronounced in relation to highly
networks only exist for a short cyber-dependent criminal
period of time and are set up activities. Around these types
Most OCGs are organised
to support specific criminal of activities, an increasing
HIERARCHICALLY
ventures. Hierarchically number of individual criminal
20%
structured OCGs continue to entrepreneurs come together
SHORT-TERM
dominate traditional criminal on an ad hoc basis for specific
VENTURES
markets. criminal ventures or to deliver
CaaS.
The fragmentation of the
serious and organised crime

24%
u to fi e
members
iti n
76%
six or more 60% oforganised
the suspects involved in serious and
crime in the EU are EU nationals.
members
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 15

cti iti
More than one third of the OCGs active in the
EU are involved in the production, trafficking Involvement of OCGs active in the EU in different crime areas
or distribution of drugs. Other key criminal
activities for OCGs in the EU include organised
property crime, migrant smuggling, THB and
excise fraud.
Organised
property
INTERNATIONAL crime

DIMENSION AND MOBILITY rug trafficking
rafficking in
human beings

Excise fraud
Migrant
smuggling
7 out of 10
OCGs are typically active in more than three countries

The integration of digital systems in many
TRENDS cri ina it criminal activities and the expansion of the
45% of the OCGs reported for the SOCTA online trade in illicit goods and services
Poly-criminality 2017 are involved in more than one is transforming serious and organised

45%
criminal activity. The share of these poly- crime. Criminals are increasingly adapting
criminal groups has increased sharply the supply chain models of global online
of the OCGs reported for the SOCTA compared to 2013. retailers.
2017 are involved in more than one OCGs also often engage in more than The concept of CaaS has been an emerging
criminal activity one criminal activity to mitigate risks, feature of various criminal markets for
Many OCGs have expanded their reduce operational costs and increase some years. However, increasingly OCGs
crime portfolio in response to the profit margins. The OCGs involved in the also openly advertise ad hoc opportunities
sustained high level of demand for trafficking of illicit goods are the most for individual criminals to provide them
smuggling services during the poly-criminal groups in the EU. These with support or expertise for specific
migration crisis.
groups typically traffic more than one illicit criminal ventures.
commodity such as counterfeit goods or
OCGs operating on an international
different types of illicit drugs.
level are typically active in more than
Sharing Economy Many OCGs are highly exible and able three countries (70%). A limited number
An increasing number of individual criminal to shift from one criminal activity to of groups is active in more than seven
entrepreneurs come together on an ad hoc another or to add new criminal activities countries (10%).
a i for ecific cri inal enture or to to their crime por olio. In many cases,
deliver CaaS OCGs operate on an on-demand basis
and only become active once new profit
opportunities emerge.

Since 2012, Europol has been supporting the German-led ISEC project
on “Strengthening cross-border operational cooperation in the fight
against mobile organised crime groups (MOCGs) from the Baltic Sea
Region, including Russian-speaking MOCGs”. The project has resulted
in the dismantling of more than 100 OCGs. A total number of 575
arrest warrants were issued. The damage caused by the MOCGs
targeted by this project exceeded EUR 65 million. These MOCGs mainly
carried out organised property crime, drug trafficking, document
counterfeiting and money laundering.
16 UNDERSTANDING ORGANISED CRIME

rr ti n
OCGs use corruption to infiltrate public OBJECTIVES OF CORRUPTION
and private sector organisations relying
on bribery, con icts of interest, trading in
in uence and collusion in order to facilitate
their criminal activities. Corruption distorts
legitimate competition and erodes public
trust in authorities and legal systems.

Corruption is used to enable all types of
criminal activity. However, the prevalence
and scale of corruption associated with dif-
ferent crimes vary. Some criminal activities OBTAIN STAY OFF SUPPORT
use corruption as an integral part of their INFORMATION THE RADAR ACTIVITIES
modus operandi.

Corruption is increasingly facilitated by on-
line services. Some criminals use cryptocur-
rencies and alternative banking pla orms Upcoming controls Obstruction of justice Ease transport
to transfer funds to their accomplices in the
public and private sector. The use of these Ongoing investigations Witness intimidation Obtain permits
techniques makes it more difficult to detect
financial ows and to uncover corruption. nfi ntia ata Avoid controls Bid rigging

i nc an t rti n nt r a r again t a nf rc nt
OCGs tend to avoid the use of violence. Violence usually attracts Countermeasures are the actions and behaviours of individual
law enforcement attention, which is often incompatible with the criminals and criminal groups to disrupt or prevent law
profit-driven motivations of those involved in organised crime. enforcement activities against them. OCGs use various
countermeasures to recognise and mitigate law enforcement
OCGs mostly employ violence against members of their own or actions.
competing OCGs. Violent crimes targeting rival OCGs often take
place in the context of “turf wars” over territory or in uence. OCGs
extort property or money from individuals by intimidating their The application of countermeasures requires an awareness of the
victims, threatening to carry out serious harm and murder. Very methods and techniques used by law enforcement authorities in
few OCGs engage in extortion as their core activity. Some OCGs investigating criminal networks.
offer to carry out racketeering and extortion as a service for other OCGs use a number of countermeasures to secure their
criminal networks and lend “professional extorters” to affiliated communication against law enforcement surveillance. These
OCGs. include technical countermeasures such as the use of encryption,
Hostage takers kidnap, hold and release individuals in exchange foreign and pre-paid SIM cards or satellite telephones as well as
for ransom payments. In the EU, this criminal activity is not widely reliance on code. To evade physical surveillance during transport,
carried out by OCGs. However, OCGs involved in migrant smuggling OCGs frequently change vehicles, often hired or leased using
have been known to use the threat of kidnapping in order to extort fraudulent IDs.
debt payments.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 17

ENGINES OF ORGANISED CRIME
Document fraud, money laundering and the online trade in illicit
goods and services are the engines of organised crime. These

MS
cross-cu ng criminal threats enable and facilitate most, if not all,

TO
other types of serious and organised crime. The business models

US
NS C
of OCGs active across the spectrum of serious and organised crime

IO S,
AT ER
rely on document fraud, money laundering and online trade to

AR RD
CL T O
maintain their criminal enterprises.

DE R
D PO
AN N S
ES TRA
ING
ITY DRIV

IC NT
T
EN DS ,

IF LE
D ID AR

AT
RT DU
L AN , ID C

CE AU
E
RAV RTS

FR
E NT T SSPO .)
A
UL TS (P , ETC
UD S
FRA UMEN , VISA
C S
DO ENSE
LIC
CERTIFICATES,
MENTS (BIRTH
BREEDER DOCU NTRACTS OR
RDS, WORK CO
MARRIAGE RECO )
DOCUMENT INVITATIONS TO
STAY IN TH E EU

FRAUD SALE AND
R ENTAL OF G
EN UINE DOCU
STO MENTS
LE NB
LAN
KD
OCU
MEN
TS

DRUGS
ILLICIT
ONLINE TRADE
FIREARMS
IN ILLICIT
COUNTER
GOODS AND
SERIOUS SERVICES FRAU
DULE
FEIT GOO
DS

AND COU
NTE
NT DO
C UMEN
TS
ORGANISED
R FEIT
CUR
REN
CY
CRIME

MONEY
LAUNDERING

CAS
H SM
UGG
MONEY L LING
AUNDER
IN G SYNDIC
ATES

TRADE-BASED MONEY LAUNDERING
S
CH A
O D S SU AND
H
MET YMENT ERS S
ENT
W PAYM NLINE PA T VOUCH
NE ,O RNE
CIES INTE
O C U RREN
CRYPT
18 UNDERSTANDING ORGANISED CRIME

CRIMINAL FINANCES AND MONEY LAUNDERING

Money laundering sustains Money laundering is linked
and contributes to the to virtually all criminal
growth of criminal markets activities generating criminal
across the EU. proceeds.

Money laundering allows OCGs to n a n ring n icat a
introduce the proceeds of crime into the
legitimate economy. Almost all criminal OCGs increasingly use money laundering Cash remains at the core of the money
groups need to launder profits generated syndicates acting as illegal service laundering business. Cash continues to be
from criminal activities. However, the providers to launder money. In exchange smuggled by couriers and, increasingly, by
way in which money laundering is carried for a commission of between 5% and 8%, post and parcel services.
out varies greatly depending on an these syndicates offer complex laundering
OCG’s level of expertise as well as the techniques and carry out the laundering
frequency and scale of money laundering operations on behalf of other OCGs.
activities. Criminal networks continuously O PE R A T I O N KO U R I 4
seek to exploit the latest technological In 2016, a Joint Investigation Team (JIT)
developments such as cryptocurrencies O P ERATI O N S N A K E 3
composed of French, Belgian and Dutch
and anonymous payment methods. Rapid investigators, Eurojust and Europol
transaction processing and the proliferation In 2015, Europol supported Spanish dismantled a complex network involved in
of effective anonymisation tools are authorities in dismantling a Chinese network the laundering of drug trafficking proceeds
significant obstacles in the identification of involved in the laundering of criminal based in Morocco. Cash couriers travelling by
the beneficial owners of criminal proceeds. proceeds from THB for labour exploitation, car collected up to EUR 1 million per month in
A growing number of online pla orms and the production of counterfeit goods as well cash across Western Europe and transported
as excise tax fraud. Relying on middlemen it to Belgium and the Netherlands to be
applications offer new ways of transferring
and third parties, the OCGs had established transferred to Morocco via the Middle East
money and are not always regulated to the
complex corporate structures and various using the Hawala system. The operation
same degree as traditional financial service
accounts to transfer money to China. In resulted in the seizure of more than EUR 7.1
providers. Money launderers heavily addition to their main criminal activities, million in cash.
rely on document fraud to facilitate their the group also offered money laundering
activities. Fraudulent documents such as and international remittance services to
false invoices and forged ID documents other OCGs based in the EU in exchange for
are used to conceal the origin of criminal a negotiated percentage of the laundered
cash, to open bank accounts or to establish funds. Between 2009 and 2015, the European
shell companies. Money launderers provide branch of this OCG had laundered more than
services to both organised crime and EUR 340 million.
terrorist organisations.

OPERATION SNAKE
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 19

Tra a n a n ring a nt t
O P ER A T I O N K A N D I L 5 New payment methods such as
Trade-based money laundering is a highly
effective way of concealing criminal funds A 2016 investigation by French, Spanish, cryptocurrencies, prepaid cards, online
by manipulating or forging purchases or German and Dutch law enforcement payments and internet vouchers are
sales using double invoicing, false invoicing, authorities disrupted an OCG laundering the continuously emerging and are generally
over- and under-invoicing by companies proceeds generated by the trade of heroin. less well-regulated than traditional
that are owned by OCGs, their associates This OCG collected proceeds throughout the payment methods. In combination with
and relatives. EU and laundered the funds in Middle Eastern alternative banking pla orms, these new
countries relying on cash couriers and trade- payment methods allow the movement
based money laundering techniques. The of large amounts of criminal funds.
OCG purchased expensive second-hand cars, Underground banking systems are financial
heavy machinery and construction equipment networks operating outside of normal
in Germany in cash and exported them to banking channels to transfer money
Iraq where they were again sold for cash. The
internationally, avoiding the fees and
group then used Money Service Businesses
regulations of conventional banks.
and Hawala to introduce the funds into the
legitimate financial system, leaving virtually
no paper trail.

MONEY LAUNDERING
Most common methods

CASH SMUGGLING
by couriers or using post
and parcel services TRADE-BASED MONEY
LAUNDERING
False invoicing and forged ID
documents are used by shell
companies owned by OCGs to
conceal criminal funds

MONEY LAUNDERING NEW PAYMENT METHODS
SYNDICATES such as cryptocurrencies and
relying on a network of anonymous payment methods are
ORGANISED TERRORIST ignificant o tacle in the
middlemen and complex
CRIME GROUPS ORGANISATIONS identification of the eneficial
laundering techniques
owners of criminal proceeds
20 UNDERSTANDING ORGANISED CRIME

DOCUMENT FRAUD

The use of fraudulent Document fraud is a key High-quality counterfeit Fraudulent documents are
documents in the EU has enabler of all types of criminal documents are primarily increasingly traded online and
ignificantly increa ed t activity as well as terrorism. produced by highly specialised trafficked u ing o t and arcel
re re ent a ignificant threat Document fraud is also counterfeiters. services.
to the EU. expected to emerge as one of
the fastest growing criminal
markets over the coming years.

Document fraud is a key facilitator for
organised crime. Document fraud entails n r tan ing t iff r nt t f c nt fra
the production and use of counterfeit
documents as well as the use of
genuine documents obtained by means
of deception or misrepresentation.
The production and use of fraudulent
documents has also been linked to terrorist
actors. Document fraudsters and forgers
manipulate or produce all types of identity, GENUINE
travel and administrative documents. DOCUMENT
Fraudulent documents are used and traded OCGs dealing with FALSE
extensively among OCGs and represent genuine documents
a significant obstacle in the fight against exploit weaknesses in DOCUMENT
serious and organised crime. Fraudulent the issuance chain of
IDs are in high demand and are the most documents and
commonly traded type of fraudulent enefit fro the ea e
with which citizens
document. Increasingly, fraudulent
can claim new ones
documents are traded online. Online
marketplaces are used by criminals to
display the range of genuine documents on
offer and allow document forgers to receive
orders directly from clients. LOOKALIKE FORGED
Used by someone other A genuine document with
than the legitimate owner, some alterations
based on physical
resemblance
BE RLI N C HRI STM AS MARKE T AT TAC K

On 19 December 2016, a Tunisian suspect EXPIRED COUNTERFEITED
An entirely fabricated
drove a truck into a Christmas market in the Used by its legitimate
document
centre of Berlin, Germany. The terrorist attack owner after its expiry date
left 12 people dead and 56 others injured.
The perpetrator was a rejected asylum
seeker from Tunisia and had previously been FRAUDULENTLY STOLEN BLANK
from an administration
suspected of involvement with the Islamic OBTAINED and filled ith the client
State. After his asylum claim was rejected, the through false supporting
biographical data
suspect travelled throughout Europe using documents or corruption
multiple identity documents under different
aliases.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 21

T r cti n f f rg T a an r nta f g n in ti r t
c nt c nt Fraudulent documents are multi-purpose
Increasingly sophisticated security features The sale or rental of travel and identity criminal tools and each document can
protecting documents against forgery documents such as passports is an be used repeatedly to support different
as well as improved technical control increasing concern. There has been a criminal activities. Documents forgers are
measures have compelled OCGs to improve significant increase in the number of service providers often cooperating with
the quality of fraudulent documents. lost and stolen documents in circulation. multiple OCGs involved in various criminal
Suppliers of raw materials now primarily Instability and armed con icts often allow activities.
rely on Darknet marketplaces to sell their criminal groups to obtain blank documents
products. from the affected regions. This is also
true for con ict zones on the periphery of
the EU and has been highlighted by the
widespread availability of thousands of
non-EU blank identity documents.

THE MAIN CRIME AREAS LINKED TO OR SUPPORTED BY DOCUMENT FRAUD

Drug Fraud Migrant Money laundering Property crime Terrorism Trafficking in
trafficking smuggling Human Beings

r r c nt
DO CU M ENT FORG E RY AN D MI G RAN T SMUG G LI N G 6
Breeder documents are documents that are used to obtain other
In May 2016, Greek and Czech law enforcement authorities arrested forms of legitimate identification for the purpose of establishing
several suspects involved in the forgery of documents and migrant a false identity. Fraudulent breeder documents are typically used
smuggling as part of an international investigation supported by to apply for genuine travel and identity documents and driving
Europol. The forged documents were subsequently provided to licences. Birth certificates, marriage records, work contracts or
irregular migrants to enter the EU or to legalise their stays there. The invitations to stay in the EU are forged in order to obtain visas,
investigation in Greece highlighted the structure and the hierarchy residency or work permits on false grounds.
of the Athens-based network. The fees for the forged documents
ranged from EUR 100 to EUR 3,000 per piece depending on the
quality, type and country of issue. The documents forged by the
criminal group included passports, national ID cards, visas, driving
licences, asylum seekers’ registration cards and residence permits.

FORGED VALID
BIRTH CERTIFICATE VISA
MARRIAGE RECORD RESIDENCY PERMIT
WORK CONTRACT WORK PERMIT
INVITATION TO STAY IN THE EU
22 UNDERSTANDING ORGANISED CRIME

ONLINE TRADE IN ILLICIT GOODS AND SERVICES

The online trade in illicit goods cultural goods, excise tobacco, firearms, Tra nt rfac
heroin, hormonal substances, specimens
and services has been expanding of endangered species, stolen vehicle parts The distribution of illicit commodities via
steadily over recent years. It and accessories, synthetic drugs and new online pla orms has soared in recent years
and is expected to continue to increase
is expected that this trade will psychoactive substances (NPS), as well as
steadily over the coming years. Online
compromised payment card data are sold
continue to grow rapidly for and purchased online. trade offers the opportunity to reach a
the foreseeable future and that huge number of potential customers. Illicit
It is not only illicit commodities that are goods purchased online are predominantly
online platforms will emerge as traded online, but also criminal services. trafficked using postal and parcel services.
a key distribution platform for all The expanding CaaS business model
provides customers with access to a wide
types of illicit goods in the EU. range of criminal services. A prime example
of this is cybercrime, where customers T H E S A L E O F D R U G S VI A PH OTO-
can access such services as malware S H A R I N G PL A T F O R MS
coding, Distributed Denial of Service
The Darknet is a key facilitator (DDoS) services, bulletproof hosting and Photo-sharing applications and pla orms
for various criminal activities anonymisation services, botnet hire and are popular with a huge number of users.
These services allow users to create
including the trade in illicit money laundering.
communities around shared interests using
drug illegal firear and Vendors often attempt to hide illegal hashtags. Drugs dealers and users make use
malware. Darknet marketplaces goods among legal products on online of these pla orms to form communities to
pla orms on the surface web. In some discuss, exchange information and trade
are becoming increasingly de- cases, surface web vendors redirect their various types of illegal drugs. Potential
centralised. customers to mirror sites on the Darknet or customers scroll through pictures of
advertise their products using false product advertised products and then contact the
designations or descriptions. dealer privately using direct messaging
Online pla orms operating in the legal The online market caters to dealers who functionalities. The eventual transaction
economy have had a profound impact on buy in bulk for re-sale as well as individual takes place either face to face or via online
business models, shopping experiences and users. The diminishing reliance on access payment and delivery by mail.
customer expectations. The multiplication to street networks of consumers of illicit
of sales pla orms makes online trade commodities challenges the established
easier, more accessible and cheaper. This business models in many criminal markets.
development has been mirrored in the T arkn t
online trade in illicit goods as criminals, like
legitimate traders, look to opportunities The Darknet is a distributed anonymous
online to grow their businesses. network within the deep web that can only
be accessed using software such as The
Virtually all illicit commodities are now Onion Router (TOR), I2P and Freenet. While
traded online either on dedicated criminal As of January 2017, the TOR these tools were ostensibly developed
online marketplaces or by exploiting
network had over 1.7 million for the purpose of legitimately protecting
otherwise legal online pla orms. The freedom and privacy, confidential business
number of goods on offer and frequency
directly connecting users, and
hosted over 60,000 unique onion activities and relationships, they can
with which new products become available equally be used by criminals for the same
indicates that the online trade in illicit domains.7 In one study, almost purpose - to conceal their identity and/or
goods is thriving and highly dynamic. 57% of active sites could be the hosting location of websites, forums
Commodities such as cannabis, cocaine, cla ified a related to o e and markets, collectively referred to as
counterfeit currency, counterfeit medicine, form of illicit activity.8 “hidden services”.9
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 23

DA RKNE T ARMS V E N DO RS ARRES TED I N SLOV EN I A 10

Firearms traffickers use Darknet marketplaces to sell illegal firearms to private individuals, It is estimated that the top 1% most
members of OCGs and terrorists based in the EU. In December 2016, Slovenian law successful vendors are responsible
enforcement authorities, with the support of Europol, arrested two suspects accused of
for 51.5% of all transactions on Dark
selling various live firing weapons including automatic ri es, hand and smoke grenades as
well as ammunition via a prominent Darknet marketplace. The firearms were paid for in markets.11 Goods and services offered
Bitcoin. on the Darknet are available to anyone,
be it an individual user, an OCG or
terrorist group.12

ift t ark ark t
SURFACE WEB There is a shift from sales on the
surface web to sales on the Darknet,
STANDARD BROWSING typically when the status of a product
Surface web platforms or substance changes from being legal
SOCIAL MEDIA elling illicit co oditie
Illicit commodities,
to illegal. For example, the sales of gun
are often ea y to find
e ecially drug and parts or de-activated firearms is legal
u ing i le internet
counterfeit good are earche u ing a in certain jurisdictions and therefore
increa ingly ad erti ed standard browser. available on the surface web, but when
and sold on social media MARKETPLACES
platforms.
the gun is assembled or re-activated it
Vendors often attempts to hide
illegal good a ong legal
is illegal and will be sold on the Darknet.
products. Likewise, a previously undiscovered
New Psychoactive Substance (NPS) is
Counterfeit Stolen
good
initially unregulated and can be sold
medicines
llicit drug on the surface web, but as soon as it is
regulated or restricted, sales will move
to the Darknet. Dark markets are highly
unstable. New decentralised markets
are likely to overcome the weakness and
vulnerability of being hosted in a specific
Child Sexual location. These localised Dark markets cut
Exploitation out intermediaries, cater to sellers and
Material buyers in their own language allowing
them to interact directly. Transactions on
Malware and local pla orms enable sellers and buyers
cybercriminal to avoid international mail systems by
P2P services
arranging the local collection of illegal
Peer-to-peer (P2P) goods.
platforms use clients TOR BROWSING
running on u er de ice to rafficking
allow customers and he arknet i a di tri uted
of firear anony ou net ork ithin
vendors to connect directly
with each other. the deep web that can only be
acce ed u ing oft are uch
as TOR, I2P and Freenet. Although the exact scale of the
criminality on the Darknet cannot be
fully determined as of yet, the Darknet
is clearly an established criminal
environment hosting an increasing
DARKNET number of platforms including Dark
markets and other hidden services.
24 UNDERSTANDING ORGANISED CRIME

DRIVERS OF CRIME
Drivers of crime shape the nature and
impact of serious and organised crime
itica c nt t ga in tr ct r
activities.13 They include facilitating factors The serious and organised crime landscape OCGs exploit various legal business
and vulnerabilities in society which create in the EU is fundamentally affected by structures and professional experts to
opportunities for criminals. the geopolitical situation in and around maintain a facade of legitimacy, obscure
Europe. The impact of con icts on the criminal activities and profits, and to
T c n g periphery of the EU, such as in Libya and perpetrate lucrative and complex crimes.
Syria, on serious and organised crime Legal business structures allow OCGs to
in the EU has already materialised and operate in the legal economy and enable
will continue to in uence crime. Armed them to merge legal and illegal profits.
con icts and poverty are the most
significant push factors for migrants
travelling to the EU. The emergence of new
For almost all types of organised con icts or destabilisation of countries
crime, criminals are deploying and on the periphery of the EU would sustain
the migration ow to the EU. Armed
adapting technology with ever
con icts close to the EU also entail the
greater skill and to ever greater risk of returning foreign fighters as well
effect. This is now, perhaps, the as the large-scale trafficking of firearms
greatest challenge facing law originating from these regions.
enforcement authorities around the
world, including in the EU.
e
Technological innovation continues to
shape society and the economy, and cati n f r cri
by extension the serious and organised
crime landscape in Europe. Criminal Key locations for crime feature well-developed transport
actors in the EU display a high degree of
and communication infrastructure. These locations
adaptability and creativity in exploiting
and employing new technologies. While are used to organise the global distribution of illicit
not all criminal activities are driven by commodities.
technological developments, the internet
OCGs hide illicit goods among legal commodity ows, which are
and ever-increasing connectivity have an
increasing in speed and volume and almost impossible to check
impact on virtually all types of serious and
thoroughly.
organised crime. Innovation in technology
and logistics increasingly enable OCGs to Criminal groups will take advantage of weaknesses in new
commit crime anonymously, anywhere and technologies, such as automated transport systems, and exploit gaps
anytime without being physically present. in the legal frameworks regulating them.
The Internet of Things is constantly Key locations for crime are characterised by several different factors:
expanding. Connectivity of all types of the presence of efficient transport infrastructures, proximity to or
devices, including phones and appliances, connections with source countries and consumer markets, access to
is increasingly a reality in households and business and investment opportunities, as well as demand for illicit
businesses across the EU. However, these commodities or services.
devices remain vulnerable to intrusion and
criminals are already deploying techniques
to compromise these devices in order to
gain personal and financial information and
confidential data on business transactions.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 25

USING TECHNOLOGY TO FIGHT
SERIOUS AND ORGANISED CRIME

echnology i al o a ignificant aid
to law enforcement authorities in the
fight again t eriou and organi ed
crime. This includes the use of
advanced digital forensics tools, the
deployment of predictive policing
software driven by Big Data as well as
drones for the monitoring of areas and
large events.
ASSESSING
ORGANISED CRIME
CRIMINAL MARKETS
AND SERVICES
The criminal markets and criminal activities detailed in
this chapter are presented in alphabetical order.
28 ASSESSING ORGANISED CRIME

CURRENCY COUNTERFEITING
The production of counterfeit currency requires varying degrees of
sophistication depending on the currency and level of quality of the
resulting counterfeits. Counterfeit banknotes of various currencies
are traded online on surface web and Darknet marketplaces.
Consequently, counterfeit currency is increasingly trafficked using
parcel services.
While the production of counterfeit currency is currently not a
major threat to the stability of the euro, the common European
currency remains popular with counterfeiters. The most commonly
counterfeited euro banknote denominations are the EUR20 and
EUR50 notes.14 In 2016, the European Central Bank (ECB) decided
to halt the production of EUR500 banknotes by the end of 2018
in an effort to fight money laundering as well as the production of
counterfeit euro banknotes.

CYBERCRIME
T O PE R A T I O N A VA L A N CH E 15

A mature CaaS model underpins cybercrime, providing easy access to On 30 November 2016, after more than
four years of investigation, the Public
the tools and services required to carry out cyber-attacks. Prosecutor’s Office Verden and the L neburg
Police (Germany) in close cooperation with
ry to are ran o are u ing encry tion i a ignificant threat to the United States Attorney’s Office for
the Western District of Pennsylvania, the
the EU, targeting not only citizens but increasingly public and private Department of Justice and the FBI, Europol,
sector organisations alike. Eurojust and global partners, dismantled an
international criminal infrastructure pla orm
known as ‘Avalanche’. The Avalanche network
Network intrusions for the purpose of illegally acquiring data have was used as a delivery pla orm to launch
ignificant i act glo ally re ulting in the lo of intellectual and manage mass global malware attacks
and money mule recruiting campaigns. The
property and the compromise of mass amounts of data which can be monetary losses associated with malware
used for further criminality including fraud and extortion. attacks conducted over the Avalanche
network are estimated to be in the hundreds
Cyber-dependent crimes are offences that can only be committed using a computer, of millions of euros worldwide, although
exact calculations are difficult due to the
computer networks or other form of information communications technology. Cybercrime
high number of malware families managed
is a global phenomenon affecting all Member States and is as borderless as the internet
through the pla orm. The global effort to
itself. The attack surface continues to grow as society becomes increasingly digitised, with take down this network involved the crucial
more citizens, businesses, public services and devices connecting to the internet. support of prosecutors and investigators
from 30 countries. The operation marks the
largest-ever use of sinkholing to combat
botnet infrastructures and is unprecedented
in its scale, with over 800,000 domains seized,
sinkholed or blocked.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 29

Cybercrime continues to grow as society
becomes increasingly digitised

85%
of internet users feel at
risk of becoming a victim
of cybercrime

The digital underground

The CaaS model provides easy access to tools and services
acro the entire ectru of cy er-cri inality fro
entry-le el to to -tier layer including tho e ith other
motivations such as hacktivists or even terrorists. This
allows even entry-level cybercriminals to carry out attacks
CRIME-AS-A-SERVICE of a scale disproportionate to their technical capability.
Criminal forums and marketplaces within the deep web or
Darknet remain a crucial environment for cybercriminals to
communicate and are a key component for CaaS.

Malware and ID theft Cryptoware Network attacks
Malware typically steals user data Cryptoware (ransomware using Network intrusions that result in
uch a credit card nu er login encryption) has become the unlawful access to or disclosure
credentials and personal leading malware in terms of of private data (data breaches)
information from infected threat and impact. It encrypts or intellectual property are
machines for subsequent use by icti u er generated file gro ing in fre uency and cale
criminals in fraud. denying them access unless the with hundreds of millions of
victim pays a fee to have their records compromised globally
file decry ted each year.

Payment order fraud Payment card fraud Online sexual exploitation
Criminals use fraudulent transfer Compromised card data is readily Child Sexual Exploitation
orders to defraud private and public available and easy to obtain on Material is increasingly
sector organisations. Fraudsters foru arket lace and roduced for financial gain and
heavily rely on social engineering automated card shops in the distributed through the Darknet.
techniques and malware to carry out deep web and Darknet. Coercion and sexual extortion
this type of fraud. are increasingly being used to
victimise children.
30 ASSESSING ORGANISED CRIME

a ar t rk attack
The development and distribution of Network attacks vary in modi operandi and Data has become a
malware continues to be the cornerstone purpose. Website defacement is a common
for the majority of cybercrime. Information- but low-impact attack, and often the
key commodity for
stealing malware, such as banking Trojans, trademark of hacktivist groups targeting criminals.
still represent a significant threat. This government or public websites.
type of malware typically steals user data
Network intrusions that result in unlawful
such as credit card numbers and login Increasing internet connectivity by
access to or disclosure of private data
credentials from infected machines for citizens, businesses and the public
(data breaches) or intellectual property
subsequent use by criminals in fraud.
are growing in frequency and scale, sector, along with the exponentially
Since late 2013, cryptoware (ransomware with hundreds of millions of records growing number of connected devices
using encryption) has become the compromised globally each year.16 and sensors as part of the Internet of
leading malware in terms of threat and Compromised data can be used for a
Things will create new opportunities
impact. Cryptoware encrypts victims’ variety of criminal purposes including fraud
user generated files, denying them access and extortion17 and is highly valued by for cybercriminals. Malware targeting
unless the victim pays a fee to have their financially motivated criminals.18 smart devices will lead to new
files decrypted. Following the trend of sources of data leakage and network
Some Member States highlight the
information stealers, cryptoware campaigns
particular threat posed by insiders to a compromise and create new botnets.
are increasingly targeting public and private Given the ease of entry into cybercrime,
company’s security. Any sector or network
sector entities.
which holds data which can be monetised the use of cyber tools and services by
is a target for such attacks. traditional OCGs to enhance or expand
their capabilities is likely to become
more commonplace.

CRYPTOWARE
How it works

Ransomware can be Organised Crime
obtained on the Groups
Darknet by OCGs

he roceeding
can be used for
Means of infection any other criminal
activity

o ro i ed e ite
fake o ile a e ail
attachments

Devices at risk
Computers and
mobile devices

Ransomware locks your computer
Ransom
Payment is almost
and mobile devices or encrypts exclusively in
your electronic file de anding a Bitcoins
ran o ay ent in order to regain
control of your data.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 31

T T

Child Sexual Exploitation
Material (CSEM) is increasingly
roduced for financial gain

A growing number of Darknet
forums facilitating the exchange
of CSEM, coupled with the ease
of access to these networks,
is leading to an increase in the
volume of material exchanged
through the Darknet.

Coercion and sexual extortion
are increasingly being used to
victimise children. Offenders
use these methods to obtain
further child abuse material, for
financial gain or to get hy ical
access to the victim.

While neither o ine nor online CSE meet the Darknet dedicated specifically to the
the criteria to be considered ‘organised production, sharing and distribution of
f n rat n c nt at ria
crime’ this is still a high priority crime due CSEM. Typically this refers to services on
to the degree of physical and psychological the TOR network. Peer-to-peer (P2P) file
There is a growing trend in the production
damage to one of society’s most vulnerable sharing applications are the preferred
of Self-Generated Indecent Material
groups – children. method of exchanging CSEM.
(SGIM) - typically teens or pre-teens taking
indecent images of themselves to be
Online and o ine child sexual exploitation rcia shared privately with a partner or someone
are often considered two different crime
areas. However, a number of offenders are Children are sexually exploited largely to they believe they can trust, for example
involved in both. There are indications that satisfy the sexual appetites of those with a in grooming scenarios. Subsequently,
this is the case for about 30% of offenders sexual interest in children. However, there these images can be distributed either
in possession of CSEM. is a growing trend in the production of accidentally or maliciously without the
CSEM for financial gain. A particular activity owner’s consent.
The increasing global availability of associated with commercial production of
broadband internet and internet-enabled CSEM is that of Live Distant Child Abuse a t rti n
devices continues to fuel the growing (LDCA). LDCA is a significant threat in
number of both offenders and victims in Often associated with the production of
this area of criminality. LDCA involves a
this area. While the same can be said of any SGIM is the growing practice of sexual
perpetrator paying to direct the live abuse
number of crime areas, this phenomenon is extortion, whereby an offender uses
of children on a pre-arranged specific time-
a major contributor to online CSE. an explicit image of a minor - obtained
frame through video sharing pla orms.
incidentally or through coercion or
The internet provides offenders and deception - to further coerce or extort the
potential offenders with an environment in child into either producing more material
which they can operate with an enhanced or engaging in further online or even o ine
level of safety and anonymity. In particular, abuse. In some cases the perpetrator
there is a growing number of forums on alternatively seeks financial gain.19
32 ASSESSING ORGANISED CRIME

PAYMENT CARD FRAUD
Payment card fraud is a low-risk, high-profit
activity. Compromised card data is readily
available and easy to obtain on forums, Some OCGs run ‘laboratories’
marketplaces and automated card shops in
to study ATMs in order to
the deep web and Darknet. Payment card
fraud can be split into two distinct crime conduct targeted attacks.
areas: Card-present fraud and card-not-
present fraud.

ar r nt fra
CP fraud requires an offender to present
a physical card at an automated teller
machine (ATM), Point of Sale (POS) or
other terminal. This crime has two stages:
obtaining a card, and the use of the card.
The cards used are either lost or stolen
genuine cards, or counterfeit cards. Unlike
fraud using lost or stolen cards, fraud using
counterfeit cards is typically committed
outside the Single Euro Payments Area
(SEPA).

Some OCGs have data breaches, information stealing
I N T E R N A T I O N A L CR I MI N AL N E T W ORK
partly industrialised malware and phishing. As many data BE H I N D L A R G E - S CA L E PAYME N T
breaches often involve the compromise of F R A U D D I S MA N T L E D 20
their processes, using millions of card details at once, there is a
workshops to produce considerable excess of card data compared In September 2016, Italian and Romanian
counterfeit cards. to the demand. Among the places where law enforcement authorities supported
compromised card data can be found are by Europol disrupted an international
an increasing number of illegal carding sites criminal group responsible for large-scale
on both the deep web and Darknet where
ar n t r nt fra not only card data can be purchased but
misuse of compromised payment card data,
prostitution and money laundering. The
CNP fraud involves the use of card data offenders can learn about how and where criminal network used sophisticated ATM
to make fraudulent purchases online or to ‘card’. New payments methods provide skimming devices which allowed them to
by telephone. Unlike CP fraud, the data offenders with new opportunities to use compromise ATMs and deceptive phishing
required is only that needed to make an compromised card data. By uploading techniques to perform a high volume of
online credit card purchase – the name the card data to smartphone services, fraudulent transactions. Estimated losses
of the card holder, billing address, card offenders can make “in app” or “on site” incurred by the criminals’ activities amount
number, expiry date and security code. The payments to apps which they control. to several hundred thousands of euros.
fraud, commonly referred to as ‘carding’, Micro-camera bars, card readers, magnetic
The growing e-commerce industry
is committed across all sectors but the strip readers and writers, computers,
will result in a parallel growth of CNP
purchase of physical goods, airline tickets, phones and ash drives, several vehicles,
fraud, especially as industry measures
car rentals and accommodation with as well as thousands of plastic cards ready
at preventing CP fraud become more
compromised cards have generally seen an to be encoded were seized in several
effective. Criminal modus operandi will be
increase throughout the EU. Where CNP is locations.
shaped by industry measures to counter
used to fraudulently purchase goods, like
payment card fraud.
CP fraud, offenders will typically purchase
high-value goods with the intention of Emerging and alternate payment options
reselling them. Offenders will often use such as contactless payment using Near
packet mules or reshipping services to Field Communication (NFC) will drive
safely receive their fraudulently obtained innovation within OCGs to enable them to
goods. abuse new technologies. New electronic/
card-less payment methods may however
CNP is fuelled by the availability of
ultimately result in a downwards trend in
compromised card data resulting from
card fraud.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 33

ID THEFT AND
PAYMENT CARD
FRAUD

STEP 2
Your login credentials,
bank account details,
credit card numbers and
STEP 1 other personal information
A fraudster uses malware and are stolen
social engineering to access
your computer

STEP 3
Your data is sold on
the Darknet

STEP 4
OCGs use your compromised
ID and financial data to
support their criminal
activities

G LOB AL ACTI ON AG AI N ST AI RL I N E by Canadian and US law enforcement
FRAU D STERS 21 agencies. Representatives from airlines,
online travel agencies, payment card
Global Airport Action Days combine the companies, Perseuss and the International
efforts of law enforcement and private Air Transport Association (IATA) worked
sector partners to combat the fraudulent together with law enforcement officers
online purchases of flight tickets, which deployed in the airports. Eurojust assisted
is estimated to cost the industry over throughout the action week, together with
EUR 1 billion per year. Fraudulent online the European Border and Coast Guard
transactions are highly lucrative for Agency (Frontex) which deployed officers
organised crime and are often purchased to 20 airports, assisting in the detection of
to facilitate more serious criminal activities identity fraud, fake documents and migrant
including migrant smuggling, THB, drug smuggling. 193 individuals suspected of
trafficking and terrorism. In October 2016, traveling with airline tickets bought using
the fifth Global Airport Action Day was stolen, compromised or fake credit card
organised through coordination centres details were detained. 43 countries, 75
at Europol, INTERPOL Global Complex for airlines and 8 online travel agencies were
Innovation in Singapore and Ameripol involved in this global operation which took
in Bogota. The activity was supported place at 189 airports across the world.
34 ASSESSING ORGANISED CRIME

T T
AND DISTRIBUTION
Drug markets remain the largest criminal production lines capable of producing
markets in the EU. More than one third
n in tra synthetic drugs on an industrial scale.
of the criminal groups active in the EU Criminals continuously seek out methods
Drone technology is expected to advance
are involved in the production, trafficking and technologies to make their business
allowing drones to travel greater distances
or distribution of various types of drugs. models more effective and increase profit
and carry heavier loads as well as making
The trade in drugs generates multi-billion margins. Online marketplaces on the
them more affordable. OCGs involved in
euro profits for the groups involved in this Darknet are now a key pla orm used to
drug trafficking will likely invest in drone
criminal activity. The EU retail drug market advertise and sell all types of drugs. The
technology for trafficking purposes in order
is estimated to be worth at least EUR anonymous nature of online transactions
to avoid checks at border crossing points,
24 billion a year.22 The immense profits on these marketplaces and the use of
ports and airports.
generated from the trade in drugs fund cryptocurrencies reduce the risks of
various other criminal activities allowing detection by law enforcement authorities
OCGs to thrive and develop their criminal for both vendors and buyers.
enterprises at the expense of the health, TRENDS
prosperity and security of EU citizens. T c n g
OCGs involved in drug trafficking heavily Technical innovation and the accessibility SYNTHETIC DRUGS
rely on corruption to facilitate their of sophisticated equipment have allowed he arket for ynthetic drug
continue to e the o t
trafficking activities. They also make use OCGs to maximise the production output
dyna ic of the drug arket in
of fraudulent documents such as fake of individual sites. Large-scale cannabis the
import or company registration certificates cultivation sites are often maintained
to import illicit drugs among legal goods, using professional growing equipment
to procure pre-precursors and purchase such as climate control systems, CO2 and
equipment used as part of production ozone generators. Similarly, laboratories ONLINE TRADE
processes. manufacturing synthetic drugs feature nline arket lace on the
advanced chemical equipment and arknet are no a key
latfor u ed to ad erti e
and ell all ty e of drug
rug arket generate
EUR
billion/year
in rofit
>75%
of the in ol ed in the trafficking of
CUTTING - EDGE
one drug al o traffic and di tri ute other
TECHNOLOGY
echnical inno ation and
types of drugs. o hi ticated e ui ent
allo to a i i e the
roduction out ut
of the cri inal grou
acti e in the are
in ol ed in the drug
arket
~65% TOXIC WASTE
of OCGs involved in the drug trade are he roduction of ynthetic drug
simultaneously involved in other criminal generate large uantitie of highly
activities such as the trade in counterfeit to ic and dangerou a te u

419 re iou ly undetected
re orted in the for the fir t
goods, THB and migrant smuggling. Drugs
are also used as a means of payment
ite often re ain conta inated
for a ignificant eriod of ti e and
their reco ery i co tly
ti e o er the a t fi e year among criminal groups.

LIBYA
i ya i e erging a a ne
di tri ution hu for canna i
re in trafficked to the acro
the editerranean ea
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 35

CANNABIS
Cannabis remains, by far, the most widely EU is Morocco from where it is trafficked to
consumed illegal drug in the EU.23 Cannabis the EU primarily by sea and road transport.
is distributed on EU markets as cannabis Cannabis resin originating from Morocco is ‘ R O S E O F T H E WI N D S ’ –
I N T E R N A T I O N A L O PE R AT ION AGAIN ST
resin and herbal cannabis. In recent years, increasingly smuggled to the EU across the
D R U G T R A F F I CK I N G 24
herbal cannabis has been increasingly Mediterranean Sea departing from Libya.
popular with consumers, which has led Cannabis resin shipments are transported In December 2016, a multinational police
to an increase in the production and across the Mediterranean Sea to the team including Europol announced the
availability of herbal cannabis within the EU Spanish coast using high-powered vessels arrest of a major Moroccan drug kingpin.
and in countries close to EU markets. where they are dropped into the sea and The work that led to this arrest began in
retrieved by OCGs on local fishing vessels April 2016. The Moroccan national had
Growing equipment, seeds and other raw
or pleasure boats using GPS signalling orchestrated a multi-tonne drug delivery.
materials used for cannabis cultivation
devices. This is the latest successful result achieved
in the EU are readily available online and
by JOT ’Rose of the Winds’. Approximately
often originate from the Netherlands. The
one week prior to his apprehension,
indoor cultivation of herbal cannabis in the
the Spanish Guardia Civil, supported by
EU is expected to further expand over the
Europol, the French Direction Nationale
coming years with new growing techniques
and increasingly sophisticated growing The market for cannabis du Renseignement et des Enqu tes
Douanières and the Italian Guardia di
technologies being used by OCGs in order remains by far the Finanza, localised and intercepted a
to increase harvest yields and profits.
Outdoor cultivation of herbal cannabis largest drug market in merchant vessel ying the ag of Panama.
The ship was subsequently escorted to the
remains limited compared to the indoor the EU. port of Almeria, where a thorough search
cultivation of cannabis.
revealed the illegal cargo of 19.6 tonnes of
Albania remains the main source of herbal cannabis resin. The crew were arrested and
cannabis trafficked to the EU. The main the shipment was seized. The investigations
source of cannabis resin consumed in the also revealed a poly-crime involvement of
the transnational organised crime networks
active in large-scale drug trafficking in the
Mediterranean Sea. Namely, concrete and
recurrent links with migrant smuggling and
cocaine trafficking have been ascertained.
36 ASSESSING ORGANISED CRIME

CANNABIS HERB
roduction trafficking and
distribution NETHERLANDS
Main distribution hub

he indoor cultivation of CZECH REP.
Distribution hub
her al canna i in the i
e ected to further e and
o er the co ing year ith
ne gro ing techni ue and
increa ingly o hi ticated
ALBANIA
gro ing technologie eing Main source
u ed y

SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016
CANNABIS RESIN
anna i re in continue to e NETHERLANDS
Distribution hub
trafficked in large uantitie
from Morocco to the

Libya i e erging a a ne
distribution hub for cannabis
re in trafficked to the acro AFGHANISTAN
the editerranean ea ALBANIA
Main source
Distribution hub

SPAIN
Distribution hub

MOROCCO
Main source
LIBYA
Distribution hub

CANNABIS
ean of tran ortation rafficking to
COURIER PLEASURE BOAT SPEED BOAT CONTAINER LORRY SMALL AIRCRAFT

rafficking ithin
COURIER PRIVATE CAR BUS LORRY SMALL AIRCRAFT
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 37

COCAINE
Cocaine is primarily produced in Colombia, Large shipments of cocaine are trafficked in
Peru and Bolivia and trafficked to the EU containers hidden among legal goods or as O PE R A T I O N F U L E CO
via other South American countries such as part of the rip-on/rip-off modus operandi. Brazil is among the main countries of
Brazil, Venezuela, Argentina, the Caribbean Brazil is a key point of departure for departure for couriers trafficking cocaine
Sea region and West Africa. Over the last cocaine couriers travelling directly to the to the EU. This has been confirmed by
two years, the production of cocaine in EU. The United Arab Emirates (UAE) and the results of Operation Fuleco, an effort
Colombia has intensified significantly. destinations in East Africa have emerged by Member States supported by Europol
An increase in the production output in as hubs for cocaine couriers travelling to targeting cocaine couriers arriving to the
Colombia will likely impact on the EU in the EU. Cruise ships departing from the EU’s major airports. During Operation
the form of intensified trafficking activity Caribbean Sea region are increasingly being Fuleco, nearly 200 cocaine couriers were
as well as greater availability of cocaine on used to traffic cocaine to the EU. arrested and almost 500 kilograms of
drug markets in the Member States. cocaine seized in the Netherlands, Spain,
The trafficking modi operandi associated More OCGs are involved Portugal, the United Kingdom, France,
Belgium, Germany and Ireland. Operation
with the trade in cocaine have largely
remained the same. Cocaine is typically
in cocaine trafficking Fuleco took place in June and July 2014
trafficked as part of large shipments in than any other criminal and involved 12 Member States including
Austria, Belgium, Bulgaria, the Czech
containers or in smaller quantities by
couriers.
activity in the EU. Republic, France, Germany, Ireland, the
Netherlands, Romania, Spain, Sweden and
the United Kingdom.

COCAINE
roduction trafficking and
distribution Main entry points in the EU

NETHERLANDS
BELGIUM

PROFITS SPAIN

5.7
BILLION EUR / YEAR

ignificant increa e in
production in Colombia may
re ult in inten ified trafficking Means of
acti ity to the transportation

rafficking to
COLOMBIA

COURIER PLEASURE BOAT CONTAINER

rafficking ithin
PERU

Main producers
PARCEL CONTAINER LORRY SMALL AIRCRAFT
BOLIVIA

SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016
38 ASSESSING ORGANISED CRIME

HEROIN
Afghanistan remains the leading producer potential disruptions to trafficking activities
of heroin trafficked to the EU. The from Afghanistan further laboratories may
The Balkan route
production output of opium and heroin in emerge in the EU in the future. Heroin remains the main entry
Afghanistan is very high and is projected to is also available on online marketplaces route for the trafficking
remain so for the foreseeable future. and is occasionally distributed across the
EU in small quantities via post and parcel of heroin into the EU.
Production of heroin remains rare in
services.
the EU. However, depending on the
development of the demand for heroin and

HEROIN
roduction trafficking and
distribution
NO
RT
HER
NR
OU
TE

Partial shift for the
CAU
trafficking of heroin CAS
US
ROU
fro the alkan route TE
to the Caucasus route
AFGHANISTAN
BALKA Main producer
N ROU
TE

PAKISTAN
Main producer

SOUTHERN ROUTE
SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016

Means of transportation

rafficking to

LORRY

rafficking ithin

LORRY
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 39

SYNTHETIC DRUGS AND NEW PSYCHOACTIVE
T
The production of different types of for trafficking to markets outside the EU, exible and have significant financial
synthetic drugs takes place in various while the production of synthetic drugs resources to constantly explore new
Member States. The intended destination in other parts of the EU predominantly market opportunities such as engaging in
markets for synthetic drugs produced in supplies domestic and neighbouring EU the production of other synthetic drugs
the EU vary according to the substance and markets. including mephedrone.
production location. A share of the large-
The Netherlands and Belgium remain Production sites for methamphetamine are
scale production of 3,4-methylenedioxy-
a globally significant production expected to also appear in other Member
methamphetamine (MDMA), amphetamine
and distribution hub for MDMA and States in greater numbers in the future,
and, to a lesser extent, methamphetamine
amphetamine. The OCGs involved in the especially those with existing production
in the Netherlands and Belgium is intended
production of synthetic drugs are highly capabilities for amphetamine.

SYNTHETIC DRUGS AND he arket for ynthetic he roduction ca acity er the la t fi e year
NEW PSYCHOACTIVE drug continue to e the of ynthetic drug ne ere
SUBSTANCES o t dyna ic of the drug la oratorie ha increa ed detected in the for the
roduction trafficking and arket in the ignificantly in recent fir t ti e
di tri ution year

Main producers Export / Main destinations

Methamphetamine

Amphetamine

MDMA

NETHERLANDS
POLAND
BELGIUM
SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016

CZECH
REP.
to UNITED STATES
SLOVAKIA to AUSTRALIA

Means of transportation

rafficking to rafficking ithin

AIR LORRY
40 ASSESSING ORGANISED CRIME

r c r r an r r c r r The great quantities of MDMA and The production of synthetic drugs
amphetamine produced by Dutch OCGs are generates large quantities of highly toxic
OCGs producing synthetic drugs in the
not solely intended for distribution in the waste. OCGs dump this waste away
EU continue to be highly exible and
EU. The MDMA and amphetamine output from production laboratories to conceal
will remain so in the future. They are
from production in the Netherlands and their location. Dump sites often remain
quick to adopt alternative precursor and
Belgium is trafficked to destination markets contaminated for a significant period
pre-precursor substances in reaction to
around the world. Australia remains of time and their recovery is costly. The
any shortages in established precursor
among the most significant destination dumping of toxic waste in public places
substances. China remains a major
markets outside the EU for synthetic drugs also entails significant risks for the health
supplier of pre-precursor substances and
produced in the Netherlands and Belgium. and safety of citizens. In recent years, the
essential chemicals as well as hardware and
In some cases, large shipments of synthetic number of dump sites discovered in the EU
glassware for synthetic drug laboratories in
drugs are trafficked to destinations outside has been increasing. Dump sites are most
the EU.
the EU in maritime shipping containers. frequently discovered in the Netherlands
Some OCGs have specialised in the There has been a significant increase in and Belgium.
procurement and production of pre- the amount of MDMA trafficked from the
precursor and precursor substances Netherlands to the United States over the
supplying OCGs producing and distributing last two years.
synthetic drugs in the EU.

NPS
NPS continue to be produced in China and,
to a lesser degree, India and trafficked to
the EU in large quantities. NPS production
in the EU is largely limited to packaging and
re-selling of imported substances. However,
some limited NPS production is thought to
take place in the EU.

CH I L D R E N BU R N T BY D U M P E D
WA S T E F R O M S Y N T H E T I C DRU GS
PR O D U CT I O N
O P E RATI ON ALI MAYA
In August 2015, four children and an
In March 2016, Spanish law enforcement
accompanying adult suffered severe burns
authorities in cooperation with other
to their legs after coming in contact with
Member States and supported by Europol C O N TAI N E R S E I Z U R E O F 2 . 8 TO N N E S chemical waste dumped by suspected
were able to dismantle a network O F MDMA A N D ME T H A MPH E TA M I N E
VALUED M O R E T H A N U S D 1 . 5
synthetic drug producers in Belgium.
importing and distributing large quantities
B I L LI O N 25
Some of the waste produced as part of the
of dangerous NPS in the EU. This network
manufacture of synthetic drugs is highly
used various companies to import and
In November 2014, Australian law dangerous. Drug producers frequently
sell these substances, especially synthetic
enforcement authorities seized a dump this type of waste away from their
cannabinoids from China, generating
maritime shipping container holding laboratories in order to disguise their
significant profits. Coordinated action in
approximately 2.8 tonnes of MDMA locations.
March 2016 involving house searches at
and methamphetamine. The load was
four locations resulted in the seizure of
estimated to have a street value of more

HORMONAL
550 litres of acetone, 75,000 envelopes
than EUR 1.4 billion (USD 1.5 billion).
used for packaging different NPS brands,
At the time, the value and size of the
NPS worth more than EUR 1.5 million. This

SUBSTANCES
seizure was unprecedented. The container
investigation highlights the profits involved
arrived in Australia from Europe and was
in the distribution of NPS.
seized following an intelligence operation.
The seizure led to the arrest of several There is a growing market for illegal
individuals in Australia and Australian hormonal substances in the EU. These
law enforcement authorities suspect substances are both trafficked to and
the involvement of several OCGs in the illegally produced in the EU.
production, trafficking and intended Hormonal substances trafficked to the EU
distribution of this shipment. This seizure typically originate from China, India and
highlights the scope of the trafficking of Thailand. However, over the last few years
synthetic drugs from the EU to destination production facilities for illicit hormonal
markets around the world. substances have also been discovered in
the EU.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 41

ENVIRONMENTAL CRIME
Environmental crime covers a diverse exportation, placing on the market or use
range of different offences including the of ozone-depleting substances.
improper collection, transport, recovery
Environmental crime is characterised by its
or disposal of waste, the illegal operation
impact on the natural environment. The
of a plant in which a dangerous activity
environmental impact manifests itself in
is carried out or in which dangerous
increasing levels of pollution, a degradation
substances or preparations are stored, the
of wildlife, a reduction in biodiversity and
killing, destruction, possession or trade of
the disturbance of ecological balance.
specimens of protected wild fauna or ora
Environmental crime puts public health at
species, and the production, importation,
risk.

ILLICIT WASTE
TRAFFICKING
The use of legal business structures for
illicit waste trafficking activities by criminal
TRAFFICKING OF
actors are an inherent feature of this crime
area. In many cases, criminal actors and ENDANGERED
legal businesses are indistinguishable from
one another. As part of this development,
criminals involved in illicit waste trafficking
SPECIES I VO RY T R A F F I CK I N G
have moved towards the more complex The trafficking of and trade in endangered In November 2016, Austrian law
business model of illicit waste management species involves the collection or enforcement authorities seized 560
rather than just illegally dumping waste. processing of animals and plants protected kilograms of trafficked ivory, the
Illicit waste traffickers now operate along by national and international regulations. equivalent of 590 elephant tusks. Ivory
the entire waste processing chain, heavily The Convention on International Trade in is worth more than EUR 1,000 (USD
relying on the use of legal business Endangered Species of Wild Fauna and 1,000) per kilogram on the Austrian
structures for their activities. Flora (CITES) provides the international black market. German law enforcement
framework for the protection of authorities seized 1,200 kilograms of
The trafficking of illicit waste typically endangered species and aims to ensure
involves the use of fraudulent documents. ivory at a Berlin airport, Germany, in
that international trade in specimens of May 2016. Raw and manufactured
wild animals and plants does not threaten ivory were falsely declared and
their survival. destined for Vietnam.
The EU is primarily a transit region
for endangered species trafficked to
destination markets in Asia and North
America. The most commonly trafficked
species and wildlife products trafficked
from, to and via the EU include glass
eels, reptiles, exotic birds, pangolin, fish,
narwhal meat, shells, corals, date mussels,
timber and ivory.
The number of OCGs involved in the
trafficking of and trade in endangered
species is low, but believed to be
increasing. The OCGs involved are highly
specialised and typically only focus on this
specific activity.
42 ASSESSING ORGANISED CRIME

FRAUD
EXCISE FRAUD
Alcohol, cigarettes and mineral oils are F U EL F RAU D
subject to excise duty upon production in,
or on import to, the EU. OCGs use various Fuel fraud is a growing phenomenon
modi operandi to avoid excise duties and and typically involves base-oil fraud,
generate significant profits selling both
genuine and counterfeit excise goods at
also called ‘designer fuel’ fraud and fuel
laundering. This type of fraud requires INVESTMENT FRAUD
lower prices than their licit equivalents. significant expertise, which is usually only
Excise tax fraud is driven by legislative available from trained chemists or similar Investment fraud schemes generate
professions.
differences and varying excise tax rates huge rofit ne in e tigation
applied by different jurisdictions.
re ealed e ti ated rofit of u to
EUR 3 billion generated by one OCG.
Excise goods are increasingly offered
and bought online. Successful investment fraud schemes
typically use various social engineering
techniques to operate. Fraud schemes
relying on social engineering are
UNDE RSTAND I NG EXC I S E FRAUD particularly hard to counter.
ABUSE OF DUT Y SUSPE NSIO N SC HE M E S
The abuse of duty suspension schemes rates as the intended destination of the What is social engineering?
are the main modi operandi used to trafficked goods. Accomplices in the
avoid the payment of excise duties on declared country of destination, such as Social engineering techniques are a key
alcohol products and are also increasingly corrupt warehouse employees, confirm element to many different types of fraud.
used to avoid excise duties on tobacco receipt of the goods. However, in reality Social engineering is the use of deception
products. These modi operandi involve the goods are exported to countries to manipulate individuals into divulging
the exploitation of the EU Excise applying high excise rates. The goods confidential or personal information that may
Movement Control System (EMCS), a appear legitimate as documents certify be used for fraudulent purposes.
computerised system registering the that any excise obligations due were paid.
movement of excise goods within the EU, If the product originates from a country
and the T1 procedure, which is applied applying high excise rates, the goods O PE R A T I O N BA T E O
for excise goods under suspension often do not leave the country at all and
schemes imported from outside the EU, the movement of the goods is purely In 2015, law enforcement authorities in
by falsely declaring the real destination virtual. the EU launched an investigation into an
and quantities of excise goods imported OCG with ties to Germany, Portugal and
In other cases, traffickers file an Spain. This OCG operated a sophisticated
into the EU.
application for the transfer of one load pyramid fraud scheme offering investments
How does it work? and use a duplicate of the transport into a music sharing pla orm and other
authorisation to import multiple loads online services. The OCG used various front
In relation to alcohol products, as part
without paying excise duties. companies. The investigation was able to
of the import process for the EMCS and
the T1 procedure, criminals declare a identify more than 50,000 victims in 34
Member State which applies low excise countries. Overall, the OCG was able to
generate an estimated profit of more than
EUR 3 billion.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 43

U ND ERSTAND I N G I N V ESTMEN T FRAUD

Criminals orchestrate various investment fraud schemes. The most common schemes
encountered in the EU include:

Fraudsters operating B oi ler room As part of Pon z i s c h em es , fraudsters Py ram i d s c h em es operate on the same
s c h em es use cold-calling to contact attract a group of initial investors with model as Ponzi schemes. However, the
their victims and pressure them into promises of very high returns in a very initial investors are actively involved and
investing in non-existent or very low- short time. The fraudster starts to repay are required to recruit new investors in
value stocks. Fraudsters often use false the initial investors to attract more victims order to get profits.
documents and certificates to present using funds accrued from additional
their company and the offered stock as investors. In reality, the money is not
legitimate. invested and the fraudsters ultimately
disappear with the funds. The money is
laundered through multiple bank accounts
held by various front companies in
different jurisdictions.

MASS MARKETING FRAUD
Mass marketing fraud schemes rely on Scams relying on phishing or cold-
mass-communication media, including Between May 2014 and May 2015, a UK- calling can target thousands of victims
telephones, the internet, mass mailing, based OCG defrauded over EUR 690,000 at once. In one cold-calling case, one
television and radio, to contact victims and (GBP 600,000) from pensioners across
solicit money or other items of value in one telecommunications provider was
the country. Posing as police officers, OCG
or more jurisdictions. members contacted victims by phone to confronted with 3.6 million attempts
warn them of the risk of fraud involving against 90,000 victims.
Fraudsters already rely on social media their bank. The victims were encouraged
and instant messaging applications to to transfer their savings to safekeeping
obtain sensitive information or elicit accounts controlled by the fraudsters.26
payments from their victims.

STEP 1
Fraudster calls posing as an IT
STEP 4 specialist from the employee’s
company (or as a bank employee)
The data/access obtained is
used to transfer funds from the
company’s account to the
fraudster’s account
SECURITY STEP 2
Informs of a security breach on
ALTERNATIVE
BREACH the company’s system (or on the
internet banking facility)
•Encourages transfer of
SCAMS
funds to a “safe-keeping
account”
•The employee transfers
STEP 3
funds to an account OPTION 1: Requires
controlled by the fraudster OPTION 2: Encourages the employee to contact the financial detail
The money is re-trans- bank. Uses technology to remain on the line after necessary for check-up
ferred to accounts in termination of the call and therefore obtain sensitive and/or downloading of a
multiple jurisdictions financial detail di clo ed to the ank e loyee remote access software
(account numbers; access codes)
44 ASSESSING ORGANISED CRIME

PAYMENT ORDER FRAUD
Criminals use fraudulent UN DERS TAN DI N G F R A U D U L E N T
transfer orders to defraud TRAN S F ER O RDER S
private and public sector
organisations. Typically, the STEP 1
affected organisations are active A fraudster calls posing as a
internationally. This increasingly high-ranking figure of the
common type of fraud is also STEP 6 company
referred to as CEO fraud, wire The employee transfers funds
transfer fraud or business e-mail to an account controlled by
compromise. Fraudsters heavily the fraudster. The money is
re-transferred to accounts in
rely on social engineering
multiple jurisdictions CEO STEP 2
techniques and malware to carry Requires an urgent transfer
out this type of fraud. OCGs IMPERSONATION of funds and absolute
organising CEO fraud schemes confidentiality
targeting organisations based
in the EU typically operate STEP 5
remotely from outside the EU. Instructions on how to STEP 3
proceed are given later by a
Typically, stolen funds are third-person or via e-mail Invokes a sensitive
transferred through series of situation (e.g. tax control;
accounts in various Member merger; acquisition)
States before reaching ALTERNATIVE
destination accounts outside •Requests to receive information on clients
STEP 4
(e.g. all unsettled invoices) Pressures the employee not to follow
the EU.
•Uses the information obtained to defraud the regular authorisation procedures
clients

T T
VAT frauds are highly complex forms of
tax fraud relying on the abuse of the VAT UN DERS TA N D I N G VA T F R A U D
rules for cross-border transactions. VAT MT IC FR A U D
fraudsters generate multi-billion euro
Cross-border transactions within the EU are zero-rated, which
profits by avoiding the payment of VAT
means that the payment of the VAT is not due until the goods are
or by fraudulently claiming repayments
sold at their destination. This enables traders to import goods
of VAT by national authorities following a
without accounting right away for the VAT. In simple MTIC cases,
chain of transactions. The most common
fraudsters sell the goods, charge the VAT to buyers without
form of VAT fraud is Missing Trader Intra-
remi ng the value to the tax authorities.
Community (MTIC) fraud.
More complex cases of VAT fraud are typically known as carousel
Changes in commodity prices have an
frauds. As part of these fraud schemes goods are imported and
impact on the profitability of MTIC fraud
sold through a series of companies before being exported again.
schemes involving specific commodities or
The exporters of these goods claim and receive the reimbursement
services. This is particularly true for fraud
of VAT payments that never occurred.
schemes involving the energy sector and
related commodities, which are subject to
frequent price uctuations.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 45

OTHER TYPES OF FRAUD
n ranc fra n fit fra i fra
Fraudsters defraud hundreds of millions Benefit fraud schemes cause significant OCGs have repeatedly attempted
of euros from private and public financial losses for all Member States. to defraud EU funds by submi ng
insurance providers each year. OCGs are OCGs and individual fraudsters target applications for EU grants or tenders.
increasingly involved in fraud schemes social and labour benefit schemes to Typically, these applications are based
targeting health care systems. defraud the state of regular benefit on false declarations such as fraudulent
payments. Benefit fraud is strongly progress reports as well as fraudulent
linked to THB and migrant smuggling. documents such as fake invoices.

In 2015, German law enforcement
r c r nt rigging an an rtgag fra
authorities dismantled a Russian- Procurement procedures are frequently Fraudsters organising loan or credit
speaking OCG providing nursing services the target of corruption. Criminal groups fraud schemes typically rely on
in order to defraud health care insurance use bribes to elicit information or fraudulent documents to obtain bank
providers. directly in uence the evaluation of bids loans, which are never paid back.
in order to win public service tenders
in competition with legal businesses.
This type of manipulation is particularly
notable in the energy, construction,
information technology and waste
management sectors.
46 ASSESSING ORGANISED CRIME

INTELLECTUAL PROPERTY
CRIME
The infringement of intellectual property In 2015, more than 80,000 seizures were
rights is a widespread phenomenon registered by customs authorities in the
in the EU. Cheap counterfeit copies of EU. These shipments contained more than
popular goods remain highly popular with 40 million articles worth an estimated EUR Counterfeit goods not only cause
consumers. Criminals are able to produce 642 million. Cigarettes remain the most losses in unpaid duties and
counterfeit goods in large quantities at frequently seized counterfeit product
minimal costs and use online pla orms to accounting for 27% of all seizures, followed taxes, but also reduce the sales
easily and effectively market their products by other goods such as batteries or air olu e rofit and in e t ent
internationally. Counterfeiting and piracy fresheners at 10% as well as toys at 9%. of legitimate businesses. This
are terms used to describe a range of illicit Regular household items such as body care
removes incentives for investment
activities related to Intellectual Property articles, medicines, electrical household
Rights (IPR) infringement. Most counterfeit goods represent 25.8% of the total number in research, development and
goods infringe a trademark, which means of seized counterfeit products. innovation.
that a good is produced without the
authorisation of its rights holder. OCGs are
increasingly involved in the violation of IPR.
OCGs produce a wide range of counterfeit n in i tri ti n
goods and manufacture sub-standard
Online marketplaces are the key Thousands of online shops are
goods distributed on EU markets including
distribution channel for counterfeit goods. used to sell counterfeit goods.
food and beverages, pesticides and
The sales volume of counterfeit goods In 2016, Operation In Our Sites
pharmaceutical products. Counterfeit and
online has increased significantly over (IOS) resulted in the seizure
sub-standard goods pose significant risks to
recent years. Counterfeiters use social of 4,780 domain names and
the health and safety of consumers.
media pla orms to advertise their products associated online shops selling
China remains the source country of most and steer potential consumers to online counterfeit merchandise.
of the counterfeit goods trafficked to the sales pla orms. The sale of counterfeit
EU. The trade in goods between the EU and goods online is closely related to the
China has expanded significantly in recent increasing use of parcel and postal services The distribution of counterfeit
years. China is the biggest source of imports to distribute counterfeit products, which is pharmaceutical products online
to the EU by far. difficult to detect among an increasing ow is particularly dangerous. In
of licit goods sold online and sent via postal 2016, Operation Pangea I
freight. specifically targeted online
vendors of counterfeit
P O LY-C RI M I NAL OC G I N VO LV ED I N medicines. The operation
T HE TRAD E I N C OU N TERFEI T G O O DS resulted in the seizure
A ND DRU G TRAFFI C KI N G
nt rf it ar ac tica of potentially dangerous
While the counterfeiting of medicines worth more than
In 2015 and 2016, Europol supported an
pharmaceuticals previously primarily EUR 50 million.
operation targeting an Italian OCG selling
affected lifestyle medicines, counterfeiters
counterfeit champagne in various Member
increasingly target almost all types of
States. Investigations in Italy and Germany
medicinal products including cancer
revealed that some of the suspects
medication and various types of medical
were also involved in the trafficking
devices.
of cocaine. During house searches in
Germany, investigators seized more than
12,000 bottles of fake champagne. The
investigation also uncovered links to VAT
and excise fraud.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 47

ORGANISED PROPERTY CRIME
Organised property crime encompasses of MOCG operations, the organised
a range of different criminal activities crime involvement in property crimes
carried out predominantly by mobile remains under-investigated. In many
OCGs operating across the EU. Organised cases, incidents of property crime are
burglaries, thefts and robberies as well as still classified as petty criminality without
motor vehicle crime and the trafficking recognising the organised crime aspect.
of cultural goods all fall into this broad
Online marketplaces have made it easier
category of criminal activity. However,
to advertise and sell stolen goods. These
the OCGs carrying out different types of
marketplaces are now used extensively
property crime are also highly diverse.
to sell stolen goods, particularly low-bulk
Some OCGs are highly specialised in
high-value goods such as phones, tablets
specific types of crime or modi operandi,
and other electronic equipment. Legal
while others are active in several types
business structures are used extensively to
of property crime and other forms of
fence stolen goods, often in the country of
serious and organised crime. MOCGs
origin of the MOCGs involved in organised
typically operate in and predominantly
burglaries and thefts.
target the most prosperous Member
States in Western and Northern Europe.
Despite the highly organised nature

rgani rg ari an t ft
Some Member States note a steady
increase in the number of reported
burglaries over recent years. This increase
particularly affects business premises, OCGs make use of various online
which are targeted much more frequently services to facilitate their burglaries. In September 2015, Europol supported
than before. Burglaries of business This includes checking on social media French, Belgian and Moldovan law
premises often involve intrusion into the platforms whether individuals are away enforcement authorities in disrupting the
property via the roof. from targeted residences, scouting activities of a Moldovan OCG carrying
Many incidents of pickpocketing are not targeted neighbourhoods using free out serial burglaries targeting bicycle
attributed to organised crime. However, online navigation tools and fencing shops. The offenders typically stole luxury
the scale and level of organisation of bikes worth more than EUR 10,000 each.
goods via online marketplaces.
pickpocketing raids across many Member The bikes were transported from Paris
States suggests that MOCGs are heavily to Moldova on long-distance passenger
involved. busses. The bikes were eventually sold in
Ukraine as well as via online marketplaces.
This OCG was highly mobile and operated
rgani r ri with a strict division of tasks between
MOCGs are increasingly targeting commercial premises for armed robberies, which group members.
typically have less sophisticated security measures in place. Attacks on banks and other
cash-intensive businesses have declined notably in recent years due to the security
measures put into place at their locations.
Jewellery stores and other businesses selling highly valuable and compact goods remain
popular targets for armed robbers using various methods of attack including smash and
grab.
LOGICAL AT TACKS ON ATMS
As part of a new modus operandi, attackers drill or burn small holes into the ATM case in
order to reach the ATM’s computer hardware components. The attackers use this access to
intrude into the ATM’s operating system and force it to dispense cash.
48 ASSESSING ORGANISED CRIME

t r ic cri
The theft and fraudulent acquisition of motor OPERATION PANDORA
vehicles remains a lucrative business for the
various OCGs involved in this criminal activity.
Some OCGs steal specific vehicles to order for
clients based in destination countries. While
the overall number of stolen vehicles appears
to have remained stable in many Member
States over recent years, the number of
recovered vehicles has dropped considerably
across several Member States. This trend
likely indicates a further shift from individual
offenders to the involvement of more
professional OCGs.
ELECTRONIC COMPROMISE
OCGs involved in the theft of motor vehicles
increasingly rely on high-tech tools to gain
access to vehicles and to overcome security
measures. Information on how to overcome
car security systems can be easily found on 3 ,5 6 1 A RT E FA CTS S E I Z E D IN
online messaging boards and websites. In O PE R A T I O N PA N D O R A 28
many cases, the tools used for electronic In January 2017, Europol joined forces
compromise are readily available to order with law enforcement authorities from
online and often originate from China. t ra g trafficking 18 countries, Interpol, the United Nations
Some OCGs steal cars as part of burglaries The con icts in Libya, Syria and Iraq are
Educational, Scientific and Cultural
and home jacking attempts. MOCGs target thought to have resulted in the intensified Organization (UNESCO), and the World
residential homes with high-value cars parked trafficking of cultural goods from this region Customs Organization (WCO) to tackle the
outside, breaking and entering these premises to the EU. This trend is expected to continue theft and illicit trafficking of cultural goods.
to retrieve the original car keys and steal due to persistent instability in the region and
the vehicle. Vehicle theft is intimately linked Operation Pandora was successfully led by
the lack of law enforcement resources to Cypriot and Spanish police:
to document fraud. OCGs use fraudulent prevent or intercept trafficking activities in
documents to give stolen cars new identities origin and transit countries. A small portion 3,561 works of art and cultural goods
for registration or exportation purposes. of the funds generated by cultural goods were seized, almost half of which
trafficking in the Middle East and North Africa were archaeological objects; 500
region could potentially be used to support archaeological objects were found in
terrorist organisations. However, the profits Murcia, Spain, of which 19 were stolen in
achieved from cultural goods trafficking for 2014 from the Archaeological Museum
these organisations are thought to be low in Murcia;
compared to other revenue streams.
over 400 coins from different periods
WAR CRIMES were seized following investigations into
In some cases, the destruction, removal and suspicious online advertisements.
OCGs increasingly rely on trafficking of cultural goods in the context of
Several of the retrieved artefacts are
technical tools and expertise to an armed con ict can amount to a war crime.
of great cultural importance in the
Significant cultural goods are protected by
overcome new vehicle security international law. International humanitarian archaeological world, such as a marble
measures. law and international criminal law have Ottoman tombstone and a post-Byzantine
established various forms of attack against icon depicting Saint George, along with two
cultural property as war crimes. Activities Byzantine artefacts. All of them were seized
related to the destruction or trafficking of in Greece during actions carried out by the
cultural goods amounting to war crimes Hellenic Police.
The trade in spare parts is potentially have an impact on the EU. The
increasingly taking place on deliberate destruction of archaeological and
online marketplaces. OCGs have cultural heritage in Palmyra as well as other
places in Syria and Iraq could potentially
adapted to this and now rely be considered a war crime according to the
on these platforms to sell the Rome Statute of the International Criminal The illegal online trade
Court.27 Subsequently, law enforcement
cannibalised spare parts from authorities seized cultural goods originating in cultural goods is
stolen vehicles. from Palmyra and trafficked to Europe. expanding.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 49

PEOPLE AS A COMMODITY
MIGRANT SMUGGLING
Migrant smuggling has emerged as a reported just over 295,000 positive decisions
highly profitable and widespread criminal on asylum applications by Member States.31
Armed conflicts, economic and
activity for organised crime in the EU. The This means that a large number of irregular population pressures in Africa and
migrant smuggling business is now a large, migrants who did not apply for asylum the Middle East will continue to
profitable and sophisticated criminal market, or whose applications were rejected may
comparable to the European drug markets. attempt to stay illegally in the EU.
act as the main push factors for
irregular migrants travelling to the
The demand for and supply of smuggling In addition to the transportation of migrants,
services has grown significantly since 2014. document fraud has emerged as a key EU. Migrant smuggling to and within
More than 510,000 illegal border crossings criminal activity linked to the migration crisis. the EU will remain a key criminal
between border-crossing points at the The provision of fraudulent documents will threat.
external border of the EU were registered continue to represent a substantial threat to
in 2016.29 This is a substantial decrease the security of the EU. Fraudulent documents
compared to 2015, when over one million are used and can be re-used for many
irregular migrants entered the EU on different criminal offences. The number of unaccompanied
the Eastern Mediterranean and Central minors present in the EU has
Mediterranean routes.30 Nearly all of the
irregular migrants arriving in the EU along increa ed ignificantly in recent
these routes use the services offered by years as a result of the migration
criminal networks at some point during their crisis. This group is very vulnerable
journeys.
to all types of exploitation.
During 2016, 1,234,558 applications for
asylum were recorded in the EU. In 2015,
the European Asylum Support Office (EASO)

MIGRANT SMUGGLING
ROUTES
SOURCE: EUROPOL INFORMATION (2017)
50 ASSESSING ORGANISED CRIME

Migrant smuggling is a highly profitable crim- well as to change from irregular to legalised
igrant gg ing a ai inal activity featuring sustained high levels of residence status under false pretences or
in demand and relatively low levels of risk. Some by using fake identities. Migrant smuggling
OCGs previously involved in other criminal networks are increasingly offering tailor-made
In 2015, migrant smuggling networks offering activities such as the illegal trade in excise facilitation services including high-quality
facilitation services to reach or move within goods, drug trafficking or organised property fraudulent documents.
the EU generated an estimated EUR 4.7 billion crime have added migrant smuggling to their
to EUR 5.7 billion in profit. These profits have The abuse of genuine passports by look-alikes
por olio of criminal activities. Migrant smug-
seen a sharp decline in 2016, dropping by continues to be the main modus operandi
gling does not require access to significant
nearly EUR 2 billion between 2015 and 2016. used by document fraudsters. ID cards are
resources and OCGs can rely on their existing
This development is in line with the overall the most commonly detected document used
knowledge of routes and infrastructure
decrease in the number of irregular migrants as part of document fraud. In 2015, they ac-
used to smuggle goods across borders. The
arriving in the EU and as a result of a fall in counted for 50% of all detections in the EU. In
distinction between legal and illegal activities
the prices for migrant smuggling services 2016, more than 7,000 people were detected
is increasingly blurred. Individual criminal
following the peak of the migration crisis in with fraudulent documents on entry at the
entrepreneurs can step in and out of criminal
2015. external borders of the EU.32
activities by providing ad hoc services, espe-
cially taxi and truck drivers.
OCGs involved in migrant smuggling display n rging ark t
an unprecedented level of organisation and
coordination. While established smuggling Both the quantity and the quality of fraud-
modi operandi remain unchanged, migrant O P ERATI O N DA I DA LO S ulent documents circulating in the EU have
smugglers have shown great versatility in the increased. The sustained increase in demand
In March 2015, Operation Daidalos for fraudulent documents has prompted
means of transport, concealment methods
and technologies they use. targeted a criminal group smuggling established counterfeiters to increase their
irregular migrants from Greece to other production output and establish new print
Migrant smuggling is a multi-national busi- Member States which was involved in the shops.
ness. Migrant smugglers originating from over production and distribution of forged travel
122 countries are involved in facilitating the documents. In addition to providing these f ga c ann
journeys of irregular migrants to the EU. Most documents to irregular migrants, the group
migrant smuggling networks are composed Migrant smugglers frequently abuse legal
also sold these to other OCGs. The criminal channels to facilitate the entry of irregular
of various nationalities involving both EU and
network operated primarily in Greece. migrants to the EU or to legalise their stay.
non-EU nationals.
The abuse of legal channels involves a variety
Migrant smuggling networks heavily rely on of modi operandi including sham marriages,
social media to advertise smuggling services.
Migrant smugglers make use of ride-sharing
ga t n t n c nt bogus paternity, false employment contracts,
fake invitation letters, false medical visas, and
applications and P2P accommodation plat- c nt an i ntit fra false claims of being victims of trafficking or
forms to provide a cover for their smuggling Service packages offered by migrant smug- refugees.
activities. This leaves regular users at the glers now frequently include the provision
risk of inadvertently becoming facilitators by of fraudulent travel and identity documents.
unknowingly transporting or hosting irregular Fraudulent documents allow irregular mi-
migrants. grants to enter and move within the EU as

BUSINESS MODEL
Supply of fraudulent documents

Migrant hands over his Facilitator sends
bio data and a photograph details to the
eletronically forger

Facilitator hands the Forger procures passport and
passport to the migrant applies a fake visa, stamp and
in exchange for fee bio data on the document
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 51

The demand for smuggling igrant gg ing t an
services has grown it in t i r ain a
ignificant since 2014. k cri ina t r at

FACILITATION Migrant smuggling networks offer their services including
transportation, accommodation, the provision of fraudulent
SERVICES documents and information on contact points in other countries.

COMMUNICATION DOCUMENT
TRANSPORTATION
VIA SOCIAL MEDIA FRAUD
& ACCOMMODATION
Migrant smugglers pass irregular Migrant smugglers widely rely on Document fraud has emerged as a
migrants from one network to social media and use online key criminal activity linked to the
another along the route of the platforms such as ride-sharing migration crisis.
migrants’ journey. websites, or P2P accommodation
platforms, to arrange facilitation
EU suspects typically work as services.
drivers transporting irregular
migrants within the EU to
destination countries.
52 ASSESSING ORGANISED CRIME

T T
THB for sexual and labour exploitation
includes the recruitment, transportation, T f r a r itati n he trafficking of icti ithin
harbouring and exploitation of victims. The involvement of OCGs in THB for labour the EU remains a key threat.
OCGs involved in THB typically operate exploitation is increasing in the EU. OCGs
in independent cells that deal with the cater to the growing demand for cheap labour
various stages of recruitment, transport and across many Member States and have access
exploitation. to a large number of potential victims. THB The migration crisis has resulted
Traffickers rely heavily on document fraud to for labour exploitation threatens to infiltrate in an increase in the number
the legal economy, where it lowers wages and
enable their trafficking activities. This includes
hampers economic growth. of potential victims of THB. A
the use of fraudulent identity, travel and
breeder documents as well as the abuse of THE B U SINESS MODEL
growing number of vulnerable
legal channels such as the EU visa regime for
There has been little change in the types
adults and unaccompanied
tourism, study and work visas. OCGs involved
in THB also continue to exploit asylum of industries featuring labour exploitation. minors in the EU are likely to be
provisions in order to traffic non-EU nationals Traffickers continue to target less regulated targeted y trafficker
into the EU. On many occasions, victims industries as well as those featuring seasonal
are provided with fraudulent documents to demand for workers. Vulnerable sectors
conceal their real identity and age. include agriculture, catering, cleaning,
construction, entertainment, fishing,
CR I M I N A L G A N G A CCU S E D OF
T f r a itati n hospitality, retail and transportation.
T R A F F I CK I N G OVE R 1 5 0 W OME N
The sexual exploitation of EU nationals no Traffickers take advantage of discrepancies in I N TO PR O S T I T U T I O N D I S M AN T L E D BY
longer relies predominantly on the use labour legislation to organise the exploitation A U S T R I A 33
of violence and coercion towards victims. of victims in the grey zone between legal
employment and labour exploitation. Some In November 2016, Austrian law
Some OCGs are increasingly relying on enforcement authorities with the support
threats of violence towards victims and their victims receive wages equivalent to the
minimum standard in their countries of origin. of Europol dismantled a Chinese OCG
families rather than attacking the victim.
involved in the trafficking of up to 300
Victims originating from outside the EU are However, these are far below acceptable women. Victims were lured to Austria
still routinely subjected to violence, debt salaries in countries of exploitation where
bondage, passport confiscation and other on promises of work as nannies or
they do not have sufficient resources to cover masseuses. They were provided with
forms of coercion as an integral part of their living expenses. These wage dumping
trafficking modi operandi. forged documents and brought to Austria
practices seriously undermine the legal labour
illegally. Upon their arrival in Vienna, OCG
market in countries of destination and make
it difficult for victims of labour exploitation to
members took away the victims’ IDs. The
be recognised as such. women were placed in so-called “sex
studios” owned by the OCG and forced
to work as prostitutes. After a few weeks
they were transferred to other brothels in
Austria.

Trafficking f n rag icti
Traffickers often specifically target underage TRAFFI C K I N G VI CT I M S F O R CE D I N TO CR I MI N A L I T Y 34
victims, both male and female, to sexually
exploit them. The exploitation of underage In November 2016, a Spanish investigation supported by Europol resulted in the arrest of 16
victims is not always motivated by financial suspected traffickers and the rescue of nine minors. The OCG trafficked young women and
profit. In some cases, underage victims are forced them into pickpocketing in various Member States. The victims were initially lured to
trafficked for the purpose of producing CSEM, Spain and travelled there using counterfeit documents. In Spain, the traffickers trained the
which is traded on online pla orms. victims in pickpocketing techniques and forced them to commit thefts in crowded areas and
on public transport. The OCG shared family ties and was hierarchically structured operating
in smaller groups in different European cities. The larger criminal network was mainly
composed of nationals from Bosnia and Herzegovina and traded the victims from one group
to another for an estimated EUR 5,000 each.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 53

LABOUR EXPLOITATION SEXUAL EXPLOITATION CHILD TRAFFICKING

for la our e loitation i he traditional trafficking flo fro rafficker often ecifically
increa ing in the a tern uro e to e tern uro e target underage icti oth
ha een re laced y ulti le and ale and fe ale to e ually
rafficker continue to target le di er e flo of icti all o er the e loit the
regulated indu trie a ell a tho e
featuring ea onal de and for
orker
ha e further increa ed
the u e of legal u ine e
that can conceal e loitation
uch a hotel nightclu and
a age arlour

rafficker continue to rely on the u e of ocial edia oice-o er- o and in tant e aging
a lication at all tage of the trafficking cycle

ink t n igrant
gg ing an trafficking in
an ing MI G R A N T S M U G G L I N G AN D H U MAN
T R A F F I CK I N G R I N G O PERAT IN G V IA
OCGs involved in THB often exploit existing T H E M E D I T E R R A N E A N 35
migratory routes to traffic victims within the
MIGRANT SMUGGLING EU. While the migration crisis has not yet
In November 2015, a joint operation
between Spanish and Polish law enforcement
had a widespread impact on THB for labour
authorities, coordinated by Europol, revealed
exploitation in the EU, some investigations
the operation of a migrant smuggling network
show that traffickers are increasingly targeting
exploiting irregular migrants from Pakistan
irregular migrants and asylum seekers in the
in restaurants in Spain. Irregular migrants
EU for exploitation. Irregular migrants in the
were forced to work long hours in appalling
EU represent a large pool of potential victims
conditions without salary, holiday or social
susceptible to promises of work even if this
security to repay their debts to smugglers
entails exploitation.
for the travel and provision of fraudulent
SHAM MARRIAGES documents. The migrant smugglers used
TRAFFICKING IN the criminal proceeds to invest in new
There has been an increasing number of
restaurants, which were also used for the
HUMAN BEINGS reports of incidents of sham marriages in
exploitation of irregular migrants.
several Member States. This increase is likely
related to the migration crisis and an increase
in the number of irregular migrants seeking to
transition to legal residence status after failed
asylum applications.
54 ASSESSING ORGANISED CRIME

SPORTS TRAFFICKING
CORRUPTION OF FIREARMS
Criminal networks use match-fixing The proliferation and availability DIV ERSION F ROM LEGAL SU PPLY
to manipulate the outcomes of sports
matches, which skews be ng odds and
of illegal firear in the e er Firearms traffickers are highly adept at
exploiting legal loopholes and differences
allows them to generate significant profits. States increases the risk of their in regulatory regimes between Member
Match-fixing in the EU primarily affects use by terrorist groups to carry States to divert firearms from legal
football games. However, match-fixers are suppliers. The reactivation of deactivated
also targeting tennis, snooker and dart out attacks in the EU. weapons and conversion of blank-firing
competitions. firearms are among the main sources
of illegal firearms trafficked in the EU.
In some cases OCGs have infiltrated
sporting clubs in order to orchestrate llegal firear are increa ingly Firearms traffickers often convert blank-
firing firearms or reactivate deactivated
money laundering schemes. accessible due to their firearms purchased from legal dealers
availability online. based in countries applying less stringent
acquisition rules such as more permissive
licensing and registration requirements.
FO OT BALL AND MON EY L AUN DERI N G
Recent terrorist attacks in the EU carried out Various con ict zones in the periphery of
In May 2016, as part of Operation by jihadist terrorists using trafficked firearms the EU have the potential to emerge as
Matrioskas, law enforcement authorities have demonstrated the lethal consequences major sources of firearms trafficked to
dismantled a Russian-speaking OCG which of the trade in illicit firearms. Several the EU.
had infiltrated football clubs and laundered incidents of violent clashes between criminal
several million euros across the EU. The gangs have highlighted that the use of illegal
OCG used middlemen to purchase football firearms remains a significant threat to EU
clubs experiencing financial pressure. The citizens.
In June 2016, Italian law enforcement
group was able to conceal their money ONLINE TRADE authorities arrested two members of the
laundering activities among the large
Firearms are frequently traded on online mafia clan ‘Ceusi’ on charges of firearms
financial transactions and cross-border
pla orms including Darknet marketplaces. trafficking. The suspects had purchased
money ows, which are not unusual
Both individual criminals and OCGs obtain over 160 decommissioned firearms
for professional football clubs. Weak
illegal firearms via online marketplaces. This from Slovakia. Some of the firearms
governance allowed the OCG to use the development has resulted in a significant were reactivated and sent to Malta in
clubs to launder money by over- or under- increase in the use of parcel and postal parcels. The Italian OCG maintained links
valuating players on the transfer market services to traffic firearms and firearm with Egyptian OCGs involved in migrant
as well as by accepting bids for television components. smuggling activities.36
rights deals.
Online trade allows individuals with no or
limited connections to organised crime to
procure firearms. These individual criminal
actors increasingly engage in the trafficking of Using post and parcel services
firearms and firearm components as part of
a CaaS business model and have emerged as is now the most common way of
key distributors of illegal firearms in the EU. trafficking firear in the
The online trade in illegal firearms via various
pla orms is set to expand further over the
coming years.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 55

LINKS BETWEEN SERIOUS AND
ORGANISED CRIME AND
TERRORISM
Terrorism and the groups carrying out not suggest that terrorist groups maintain The threat emanating from links between
terrorist offences have evolved significantly sustained engagement with OCGs involved in serious and organised crime and terrorism
over the last decade. The EU has been the migrant smuggling. is two-fold. Firstly, the potential exploitation
target of repeated terror attacks and plots of OCG infrastructures to procure tools, such
The profit-driven nature of organised crime
in recent years. The investigations into the as firearms or fraudulent documents, and
activities is in many cases incompatible with
terrorist attacks in Brussels and Paris, carried move goods and people may deliver lethal
terrorist acts, which attract a great degree of
out in March 2016 and November 2015 weapons used in attacks in the EU to terrorist
media and law enforcement attention to the
respectively, uncovered the involvement of groups. Secondly, involvement in serious and
perpetrators.
some of the perpetrators in different types organised crime may allow terrorist actors to
of serious and organised crime including the The pursuit of criminal activities in support of generate funds to finance terrorism-related
trafficking of illicit drugs, as well as personal terrorist activities is not a new phenomenon. activities.
contacts with criminal groups involved in However, the involvement of suspects with
The suspects are involved in various crime
the trafficking of firearms and production of extensive criminal backgrounds and access
areas including money laundering, migrant
fraudulent documents. to the resources and tools of organised
smuggling, heroin and firearms trafficking,
crime networks in terrorism is particularly
Recent investigations have revealed that organised property crime and THB. These
threatening in light of the fast pace of
terrorist groups have made use of migrant suspects are typically involved at a low level
radicalisation and willingness to very quickly
smuggling networks to allow their operatives in organised crime and do not fill major roles
engage in terrorist attacks following the
to enter the EU. However, these cases do within organised crime networks.
beginning of the radicalisation process.
56

CONCLUSIONS
Tackling organised crime in the The role of the SOCTA
age of technology The vital role of technology for organised
Serious and organised crime is a key
crime is reflected in the data collected RECOMMENDED
threat to the security of the EU. Criminal
groups and individual criminals continue
and analysed for the SOCTA 2017. For the
SOCTA 2017, Europol has undertaken the PRIORITIES
largest-ever data collection on serious and
to generate multi-billion euro profits
organised crime in the EU. Based on the outcome of a
from their activities in the EU each year.
Some parts of the serious and organised Europol relied on more than 2,300 comprehensive analysis of the
crime landscape in the EU have changed questionnaires contributed by Member indicators and factors detailed in
drastically in recent years - in large part States, Europol’s operational and
due to advancements in technology that strategic partners outside the EU and our
the SOCTA Methodology, Europol
have had a profound impact on the wider institutional partners as well as operational recommends key priorities to
society and economy. intelligence held in Europol’s databases to
produce the most detailed assessment of
tackle the most threatening
Technology is a key component of most,
if not all, criminal activities carried out
the nature and scale of criminal threats forms of serious and organised
by organised crime groups in the EU and
facing the EU and its Member States yet. crime. In addition to five specific
has afforded organised crime with an Based on an in-depth analysis of this criminal activities carried out
unprecedented degree of flexibility. This data and a methodology endorsed by the
flexibility is particularly apparent in the Member States, Europol identifies the key by organised crime in the EU,
ease with which criminals adapt to changes threats from serious and organised crime Europol is also recommending
in society. facing the EU today and over the coming
years.
to focus on three cross-cutting
The internet, the multitude of online
platforms and communication channels it
threats that enable or enhance
hosts have had a huge impact on society, all types of serious and
strengthening and transforming the
economy, driving innovation and shaping
organised crime.
social interaction. However, it is also a key
enabler of criminal activity and plays a role
in all types of criminality.
The impact of technology on crime,
however, extends beyond the internet and
involves all kinds of technical innovation
such as advances in drone technology,
automated logistics, and advanced printing
technologies.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 57

SPECIFIC PRIORITY CRIME CROSS-CUTTING PRIORITY CRIME
THREATS: THREATS:
Cybercrime Criminal finances and money laundering
Drug production, trafficking and distribution Document fraud
Migrant smuggling Online trade in illicit goods and services
Organised property crime
Trafficking in human beings

Currency DRUG Environmental Intellectual ORGANISED MIGRANT Trafficking of TRAFFICKING IN
CRIME AREAS CYBERCRIME Fraud
counterfeiting TRAFFICKING crime property crime PROPERTY CRIME SMUGGLING firearms HUMAN BEINGS

Synthetic drugs
Online child production in
sexual Online trade in External
the EU Excise fraud counterfeit Burglaries and borders of the Labour
exploitation theft Online trade exploitation
Trafficking of goods EU
Production Illicit waste (including
precursors and trafficking
Cyber- de/reactiva-
THREATS

pre-precursors
dependent tion)
Import of
crime MTIC fraud
cocaine to the Production of
(malware,
EU via major counterfeit Motorvehicle Secondary Sexual
cryptoware, etc.)
ports and goods in the crime movements exploitation
couriers EU
Poly-drug Investment
Distribution trafficking in fraud
including the EU Trafficking of Traditional
online Payment card Trafficking of
endangered trafficking
fraud (card-not- Large-scale counterfeit Organised Risk for labour Child
present fraud) cannabis species goods (not
Sports robberies exploitation trafficking
production and online) in the
corruption
trafficking in EU
the EU
Corruption
CROSS-CUTTING
CRIME THREATS

Countermeasures against law enforcement

Criminal finances and money laundering

Document fraud, including identity fraud

Extortion

Online trade in illicit goods (firearms, counterfeit goods, drugs)

HIGH THREAT THREAT
58

ANNEX
LIST OF ABBREVIATIONS

ATM Automated teller machine
AWF SOC Analysis Work File on Serious and Organised Crime
CaaS Crime-as-a-Service
CNP Card-not-present
COSI Standing Committee on Operational Cooperation on Internal Security
CP Card-present
CSE Child Sexual Exploitation
CSEM Child Sexual Exploitation Material
DDoS Distributed denial of service
EASO uro ean ylu u ort ffice
ECB European Central Bank
EMCDDA European Monitoring Centre for Drugs and Drug Addiction
EMCS Excise Movement and Control System
EU European Union
IPR Intellectual Property Rights
LDCA Long-distance child abuse
MDMA 3,4-methylenedioxy-methamphetamine
MOCG Mobile organised crime group
MTIC Missing Trader Intra Community
NFC Near Field Communication
NPS New Psychoactive Substances
OCG Organised crime group
P2P Peer-to-peer
POS Point of Sale
SEPA Single Euro Payments Area
SOCTA Serious and Organised Crime Threat Assessment
THB rafficking in u an eing
TOR The Onion Router
VAT Value Added Tax
REFERENCES
1
Council Decision of 6 April 2009 establishing the European Police Office 20
Europol 2016, International criminal network behind large-scale payment
(Europol) (2009/371/JHA), accessible at https://www.europol.europa.eu/ fraud dismantled (07/09/2016), accessible at https://www.europol.europa.
publications-documents/council-decision-of-6-april-2009-establishing- eu/newsroom/news/international-criminal-network-behind-large-scale-
european-police-office-europol payment-fraud-dismantled
2
Council Document 12159/12, Serious and Organised Crime Threat 21
Europol 2016, Global action against airline fraudsters (19/10/2016),
Assessment (SOCTA). Methodology (04/07/2012), accessible at http://data. accessible at https://www.europol.europa.eu/newsroom/news/global-
consilium.europa.eu/doc/document/ST-12159-2012-INIT/en/pdf action-against-airline-fraudsters-193-detained
3
Europol 2015, Large Chinese money laundering network dismantled EMCDDA & Europol 2016, EU Drug Markets Report 2016, p. 23
22

(12/05/2015), accessible at https://www.europol.europa.eu/newsroom/
EMCDDA & Europol 2016, EU Drug Markets Report 2016, p. 60
23
news/large-chinese-money-laundering-network-dismantled
24
Europol 2016, ‘Rose of the Winds’ – International operation against drug
4
Europol and Eurojust 2016, Hawala money laundering ring dismantled by
trafficking (01/12/20160, accessible at https://www.europol.europa.eu/
Joint Investigation Team (29/11/ 2016), accessible at https://www.europol.
newsroom/news/%E2%80%98rose-of-winds%E2%80%99-%E2%80%93-
europa.eu/newsroom/news/hawala-money-laundering-ring-dismantled-
international-operation-against-drug-trafficking
joint-investigation-team
25
ABC News 2014, Six charged after drug bust which seized 2.8 tonnes of
5
Europol 2016, Iraqi money laundering syndicate based in Germany
MDMA and methamphetamine worth $1.5 billion (29/11/2014), accessible
dismantled with support of Europol and Eurojust (31/03/2016), accessible
at http://www.abc.net.au/news/2014-11-29/six-charged-over-enormous-
at https://www.europol.europa.eu/newsroom/news/iraqi-money-
$1.5b-drug-bust/5927904
laundering-syndicate-based-in-germany-dismantled-support-europol-and-
eurojust 26
BBC 2015, Gang guilty over £600,000 phone scam against pensioners
(10/12/2015), accessible at http://www.bbc.com/news/uk-35064360
6
Europol 2016, Dozens arrested for massive document forgery and migrants
smuggling (31/05/2016), accessible at https://www.europol.europa.eu/ 27
European Parliament 2015, Parliamentary questions: Answer given by
newsroom/news/dozens-arrested-for-massive-document-forgery-and- Vice-President Mogherini on behalf of the Commission (22/09/2015),
migrant-smuggling accessible at http://www.europarl.europa.eu/sides/getAllAnswers.
do?reference=E-2015-008402&language=EN
https://metrics.torproject.org
7

28
Europol 2016, 3561 artefacts seized in Operation Pandora (23/01/2017),
D. Moore and T. Rid 2015, Cryptopolitik and the Darknet, p. 21
8
accessible at https://www.europol.europa.eu/newsroom/news/3561-
9
Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016, artefacts-seized-in-operation-pandora
p.47
Frontex 2017, Risk Analysis for 2017
29

Europol 2016, Darknet arms vendors arrested in Slovenia with support
10
UNHCR 2015, Over one million sea arrivals reach Europe in 2015,
30
of Europol (20/12/2016), available at https://www.europol.europa.eu/
accessible at http://www.unhcr.org/news/latest/2015/12/5683d0b56/
newsroom/news/darknet-arms-vendor-arrested-in-slovenia-support-of-
million-sea-arrivals-reach-europe-2015.html
europol
EASO 2015, Latest Asylum Trends – 2015 Overview, accessible at https://
31
Carnegie Mellon University 2015, Measuring the Longitudinal Evolution of
11
www.easo.europa.eu/sites/default/files/public/LatestAsylumTrends20151.
the Online Anonymous Marketplace Ecosystem, available at https://www.
pdf
usenix.org/system/files/conference/usenixsecurity15/sec15-paper-soska-
updated.pdf Frontex 2017, Risk Analysis for 2017
32

Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,
12
Europol 2016, Crime gang accused of trafficking over 150 women into
33

p.49 prostitution dismantled by Austria (17/11/2016), available at: https://www.
europol.europa.eu/newsroom/news/crime-gang-accused-of-trafficking-
13
In 2014, Europol published a report on the future of serious and
over-150-women-prostitution-dismantled-austria
organised crime “Exploring tomorrow’s organised crime”, which
highlighted key drivers for change which have an impact on serious and 34
Europol 2016, Europol teams up with Spanish authorities to bring down
organised crime in the EU. The report is available on Europol’s website human trafficking network (29/11/2016), available at https://www.europol.
at https://www.europol.europa.eu/publications-documents/exploring- europa.eu/newsroom/news/europol-teams-spanish-authorities-to-bring-
tomorrow%E2%80%99s-organised-crime down-human-trafficking-network
14
European Central Bank 2016, Annual Report 2015, p. 76 35
Europol 2015, Hit on migrant smuggling and human trafficking ring
operating via the Mediterranean (03/11/2015), available at: https://www.
15
Europol 2016, ‘Avalanche’ network dismantled in international cyber
europol.europa.eu/newsroom/news/hit-migrant-smuggling-and-human-
operation (01/12/2016), accessible at https://www.europol.europa.eu/
trafficking-ring-operating-mediterranean;
newsroom/news/%E2%80%98avalanche%E2%80%99-network-dismantled-
in-international-cyber-operation 36
Europol 2016, Weapons smugglers arrested in Italy with the support
of Europol (09/06/2016), accessible at https://www.europol.europa.eu/
16
Symantec 2016, Internet Security Threat Report, p.54
newsroom/news/weapon-smugglers-arrested-in-italy-support-of-europol
Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,
17

p.36-37
18
Verizon 2016, 2016 Data Breach Investigation Report, p.4
Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,
19

p.24
ISBN 978-92-95200-77-7
DOI 10.2813/114730
SERIOUS AND ORGANISED CRIME QL-04-17-236-EN-N

THREAT ASSESSMENT
E UROP E AN UN ION

Eisenhowerlaan 73, 2517 KK
The Hague, the Netherlands

www.europol.europa.eu
Follow us