Documente Academic
Documente Profesional
Documente Cultură
firearms trafficking
Cybercrime
fraud
E U R OP EAN UNION
drug trafficking
sports corruption
environmental crime
document fraud
Migrant smuggling
TABLE OF CONTENTS
FOREWORD OF THE DIRECTOR 6
INTRODUCTION 8
KEY JUDGMENTS 10
UNDERSTANDING ORGANISED CRIME 12
fining ri an rgani cri 13
rgani cri gr an t r cri ina act r 14
ngin f rgani cri 17
ri r f cri 24
ASSESSING ORGANISED CRIME 26
rr nc c nt rf iting 28
rcri 28
r g r cti n trafficking an i tri ti n 34
n ir n nta cri 41
ra 42
nt ct a r rt cri 46
rgani r rt cri 47
a ac it 49
rt c rr ti n 54
Trafficking f fir ar 54
ink t n ri an rgani cri an t rr ri 55
CONCLUSIONS 56
ANNEX – LIST OF ABBREVIATIONS 58
FOREWORD
OF THE DIRECTOR
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 7
I am pleased to present the European information hub for criminal intelligence exchange of information remains Europol’s
Union (EU) Serious and Organised Crime in the EU to analyse and identify the key core business.
Threat Assessment 2017 (SOCTA 2017). crime threats facing the EU today.
The SOCTA 2017 is a forward-looking
The SOCTA 2017 is Europol’s agship
Informed by its analysis of the prevailing document that both describes and
product providing information to Europe’s
threat, the SOCTA 2017 identifies a anticipates emerging threats from serious
law enforcement community and decision-
number of key priorities, which, in and organised crime. In this edition of the
makers. It serves as the cornerstone of the
Europol’s view, require the greatest SOCTA, we highlight the role of technology
EU Policy Cycle for Serious and Organised
concerted action by Member States and in particular. Criminals have always been
Crime.
other actors to ensure the most effective adept at exploiting technology. However,
The Policy Cycle ensures effective impact. These include cybercrime, the the rate of technological innovation and
cooperation between national law production, trafficking and distribution of the ability of organised criminals to adapt
enforcement agencies, EU Institutions, illicit drugs, migrant smuggling, organised these technologies have been increasing
EU Agencies and other relevant partners property crime, and trafficking in human steadily over recent years. Developments
in the fight against serious and organised beings (THB). In addition, Europol such as the emergence of the online trade
crime. This is the second edition of the recommends focussing on three cross- in illicit goods and services are set to result
SOCTA, following its inaugural edition cu ng crime threats with a significant in significant shifts in criminal markets and
released in 2013. The SOCTA 2017 delivers impact across the spectrum of serious and confront law enforcement authorities with
a set of recommendations based on an in- organised crime – document fraud, money new challenges.
depth analysis of the major crime threats laundering and the online trade in illicit
In identifying and specifying these
facing the EU. The Council of Justice and goods and services. The SOCTA 2017 also
challenges, Europol hopes to provide a
Home Affairs Ministers will use these explores potential links between serious
tangible contribution to the efforts of
recommendations to define priorities for and organised crime and terrorism.
Member States and the EU in fighting
the coming four years.
In 2013, Europol reported the presence serious and organised crime. I look
The SOCTA 2017 is the outcome of the of at least 3,600 internationally operating forward to Europol’s continued support
work of many contributors from law Organised Crime Groups (OCGs) in the for and cooperation with law enforcement
enforcement authorities in the Member EU. In the SOCTA 2017, we identify agencies and other partners in the EU and
States, in countries with strategic and approximately 5,000 international OCGs beyond.
operational agreements with Europol, currently under investigation in the EU.
our institutional partners in the EU, and This increase is primarily a re ection of
Europol. a much improved intelligence picture.
It is also an indication of shifts in
Europol is a key partner to the Member
States in meeting security challenges by
criminal markets and the emergence of ain rig t
smaller groups and individual criminal Director of Europol
providing a highly developed pla orm
entrepreneurs in specific criminal
for the exchange of criminal intelligence
activities, especially those taking place
as well as analytical and operational
online.
support for some of the most complex
international investigations in the EU to These developments highlight the complex
date. In drafting the SOCTA 2017, Europol dynamics that shape the serious and
harnessed this unique information organised crime landscape in the EU. They
position. also emphasise the need for the continued
and enhanced exchange of information
The SOCTA 2017 represents the outcome
between law enforcement authorities
of the largest data collection on serious
as part of their day-to-day business.
and organised crime ever undertaken
Connecting law enforcement authorities
in the EU. Europol has been able to use
and facilitating the real-time 24/7
its singular intelligence capability as the
8
INTRODUCTION
T r an ni n an r
The European Union (EU) is a unique who share the presidency on a rotating
economic and political partnership basis. The third institution is the European
between 28 European countries.i It Commission, which represents the interests
was created in 1958 as the European of the Union as a whole.
Economic Community with the aim to
foster economic cooperation among its Europol is the EU’s law enforcement
six founding partners. Since then, the agency and assists the Member States in
number of EU Member States enlarged their fight against serious international
and the economic union developed into crime and terrorism. Established as an
an organisation covering a wide range of EU agency in 20091 , Europol, or the
policy areas. The official name changed to European Police Office, is at the heart of
the European security architecture and
the European Union in 1993 to re ect the
offers a unique range of services. Europol T T
broader cooperation on which members’
partnership is based. EU law is built is a support centre for law enforcement
operations, a hub for information on The SOCTA 2017 is the most comprehensive
on a series of treaties, voluntarily and study of serious and organised crime in
democratically agreed by all Members. criminal activities as well as a centre for
law enforcement expertise. Analysis is at the EU ever undertaken. It is the outcome
These agreements set out the EU’s goals in of a detailed analysis of the threat of
its main areas of activity. There are three the core of Europol’s activities. To give its
partners deeper insights into the crimes serious and organised crime facing the EU
main institutions involved in EU legislation: providing information for practitioners,
the European Parliament, which represents they are tackling, Europol produces regular
assessments that offer comprehensive, decision-makers and the wider public. As a
the EU’s citizens and its members are threat assessment, the SOCTA is a forward-
directly elected by them; the Council of forward-looking analyses of crime and
terrorism in the EU. looking document that assesses shifts in
the European Union, which represents the serious and organised crime landscape.
the governments of the Member States The SOCTA 2017 sets out current and
anticipated developments across the
spectrum of serious and organised crime,
identifies the key criminal groups and
individuals active in criminal activities
across the EU and describes the factors in
the wider environment that shape serious
and organised crime in the EU. The SOCTA
2017 also describes the dynamics that drive
organised crime in the age of technology
and re ects on how OCGs and individual
criminal entrepreneurs seek to exploit the
latest technological innovations.
The SOCTA is the product of close
cooperation between Europol, the law
enforcement authorities of the Member
States and third parties such as EU
agencies, international organisations and
countries outside the EU with strategic or
operational agreements with Europol. The
involvement of these crucial stakeholders
is also re ected in the SOCTA’s role as the
cornerstone of the EU Policy Cycle for
i
The Member States of the EU are: Austria, Serious and Organised Crime in the EU.
Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, France, Germany,
Greece, Hungary, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, and
United Kingdom.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 9
T ic c f r ri T T t g ata an rc
an rgani ri in t
As part of an iterative process, the SOCTA The findings of the SOCTA 2017 are the
The Policy Cycle provides a robust Methodology has been further developed outcome of detailed analysis of intelligence
framework that brings together the law and refined by experts at Europol and from gathered as part of the largest data
enforcement authorities of the Member the law enforcement authorities of the collection on serious and organised crime
States, Europol and a wide range of multi- Member States. The SOCTA Methodology ever undertaken in the EU. Member States,
disciplinary partners in the fight against allows Europol to understand and assess cooperation partners outside the EU and
serious and organised crime. The Policy serious and organised crime holistically. institutional partners contributed more
Cycle translates strategic objectives at the The SOCTA analyses and describes criminal than 2,300 questionnaires on crime areas
European level into concrete operational markets and crime areas in the EU; the and OCGs. The amount of data provided
actions against serious and organised OCGs or individual criminals carrying out for the SOCTA 2017 has more than doubled
crime. these criminal activities; as well as the compared to the SOCTA 2013.
factors in the broader environment that
The Policy Cycle is a methodology adopted In addition, Europol relied heavily on the
shape the nature of serious and organised
by the European Union in 2010 to address operational intelligence held in its Analysis
crime in the EU. Using a mixed methods
the most significant criminal threats facing Work File on Serious and Organised Crime
approach of qualitative and quantitative
the EU. Each cycle lasts four years and (AWF SOC) to provide a thorough and
analysis techniques and a set of clearly
optimises coordination and cooperation on extensive analysis of the criminal threats
defined indicators, Europol is able to
the crime priorities agreed by all Member facing the EU. Where appropriate, the
identify and specify the most threatening
States. During the cycle, all concerned data collected through questionnaires
criminal phenomena in the EU. Europol
services and stakeholders, at national and and available in Europol’s databases were
arrives at the recommended priorities for
EU level, are invited to allocate resources complemented by information from open
the fight against serious and organised
and mutually reinforce efforts. Emerging sources.
crime for the Policy Cycle based on this
threats are also monitored so that they Methodology. The SOCTA Methodology
can be effectively addressed. Relying on ensures transparency and reliability
the analytical findings of the SOCTA 2017, providing decision-makers with a solid
the Council of Justice and Home Affairs basis for their deliberations. The SOCTA
Ministers of the EU will decide on the Methodology is a public document and can
priorities in the fight against serious and be accessed online.2
organised crime for the second full Policy
Cycle from 2018 to 2021. These priorities The SOCTA 2017 is the
will determine the operational work carried
out in the framework of the Policy Cycle most comprehensive
for the next four years. The crime priorities study of serious and
agreed at European level in the context of
the Policy Cycle are re ected in operational organised crime in the EU
activities at Member State level. ever undertaken.
10
KEY JUDGMENTS
ORGANISED
CRIME GROUPS
Serious and organised crime in More than 5,000 OCGs operating
the EU features a great variety on an international level are
of criminal activities, which are currently under investigation
increasing in complexity and scale. in the EU. The number of
The profits generated by some of OCGs operating internationally
the successful OCGs and individual highlights the substantial scope
criminals active in the EU are and potential impact of serious
enormous and rival those of multi- and organised crime on the EU.
national corporations.
Criminals quickly adopt and integrate new Document fraud, money laundering and the online trade in illicit goods and
technologies into their modi operandi or build services are the engines of organised crime in the EU. Although neither
brand-new business models around them. The document fraud nor money laundering have a direct impact on most citizens in
use of new technologies by OCGs has an impact the EU, they facilitate most, if not all, other serious and organised crime. The
on criminal activities across the spectrum of online trade in illicit goods and services is expanding rapidly. Almost all types of
serious and organised crime. This includes illicit goods are now bought and sold via online platforms that offer the same
developments online, such as the expansion ease of use and shopping experience as most legal online platforms. Depending
of online trade and widespread availability of on the type of commodity and service, this includes platforms both on the
encrypted communication channels, as well surface web and the Darknet. Data is also traded as a commodity. The online
as other aspects of technological innovation trade in illicit goods and services is foreseen to increasingly disrupt established
such as more accessible and cheaper high- criminal markets and their traditional distribution models over the next few
performance drone technology. Technology has years.
a fundamental and lasting impact on the nature
of crime.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 11
Many of the OCGs are highly The most threatening OCGs are An increasing number
flexible and display great those which are able to invest of individual criminal
adaptability in the speed with their significant profits in the entrepreneurs offer Crime-as-
which they adjust their modi legitimate economy as well as into a-Service (CaaS). The online
operandi or whole business models their own criminal enterprises, trade in illicit goods and services
to changes in the environment. ensuring business continuity enables individual criminals
Many criminal activities are and a further expansion of their to operate their own criminal
increasingly complex and require a criminal activities. The involvement business without the need for
variety of skills as well as technical in serious and organised crime the infrastructures maintained
expertise to carry them out. may allow some terrorist groups by ‘traditional’ OCGs.
to generate funds to finance
terrorism-related activities.
CRIMINAL ACTIVITIES
Cybercrime is a key challenge to digital The illicit drugs market remains the largest Migrant smuggling has emerged as one
economies and societies. Cyber-dependent criminal market in the EU. More OCGs of the most profitable and widespread
crime is underpinned by a mature CaaS are active in the production, trafficking criminal activities for organised crime in
model, providing easy access to the tools and distribution of illicit drugs than any the EU. The migrant smuggling business is
and services required to carry out cyber- other phenomenon. The industrial-scale now a large, profitable and sophisticated
attacks. Child Sexual Exploitation (CSE) production of synthetic drugs within the EU criminal market, comparable to the
perpetrated online is increasingly profit continues to expand and cements the EU European drug markets.
driven. The growth of card-not-present as a key source region for these substances
(CNP) fraud, coupled with successful distributed worldwide. OCGs maintain
industry measures to tackle card-present complex trafficking operations cooperating
(CP) fraud, has resulted in CNP fraud with OCGs on a global scale to orchestrate
accounting for 66% of total card fraud value. the wholesale importation of illicit drugs
into the EU. Within the EU, the majority of
OCGs involved in the distribution of illicit THB for labour exploitation is increasing and
drugs deal in multiple illicit drugs, also is expected to continue to expand. OCGs are
called poly-drug trafficking. expected to exploit the presence of a large
number of potentially vulnerable persons
in the EU following the migration crisis.
Organised property crime encompasses a Labour exploitation threatens to undermine
range of different criminal activities carried the legitimate labour market lowering
out predominantly by highly mobile OCGs wages and impeding economic growth.
operating across the EU. A steady increase
in the number of reported burglaries over
recent years is a particular concern in many
Member States.
UNDERSTANDING
ORGANISED CRIME
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 13
5,000
The OCGs and individual criminals The criminal markets involving illicit drugs,
operating in the EU are highly diverse. trafficking of human beings and migrant
They range from large ‘traditional’ OCGs smuggling attract the largest numbers
international OCGs
to smaller groups and loose networks of OCGs and continue to generate the
currently under
supported by individual criminals, who are greatest profits among the various criminal
investigation hired and collaborate ad hoc. More than markets in the EU. However, emerging
5,000 OCGs operating on an international crime phenomena such as the online trade
level are currently under investigation in in illicit goods and services may eclipse
>180
the EU. This figure does not necessarily these markets in size and profits in the
re ect an overall increase in organised future. The online trade in illicit goods
crime activity in the EU compared to 2013, and services is no longer merely a modus
nationalities
when Europol reported on the activities of operandi, but an expanding, highly dynamic
involved 3,600 internationally operating OCGs in the and substantial criminal market itself.
EU. This increase is primarily a re ection
Over the past few years, criminals of
of a much improved intelligence picture.
more than 180 nationalities were involved
The increase also points to the emergence
in serious and organised crime in the
of smaller criminal networks, especially in
EU. The majority of OCGs operating on
criminal markets that are highly dependent
an international level are composed of
on the internet as part of their modi
members of more than one nationality.
operandi or business model. Overall, the
Nonetheless, the majority of the suspects
number of OCGs operating internationally
(60%) involved in serious and organised
highlights the substantial scope and
crime in the EU are nationals of a Member
potential impact of serious and organised
State.
crime on the EU.
tr ct r
The diversity of the criminal landscape and the emergence
actors operating in the EU is of more groups and looser
also re ected in the structures networks detailed in the
30-40%
of the OCGs. 30% to 40% of SOCTA 2013 did not affect
LOOSE
the OCGs operating on an all criminal markets. The
international level feature fragmentation of criminal
NETWORKS
loose network structures. An markets was particularly
approximate 20% of these pronounced in relation to highly
networks only exist for a short cyber-dependent criminal
period of time and are set up activities. Around these types
Most OCGs are organised
to support specific criminal of activities, an increasing
HIERARCHICALLY
ventures. Hierarchically number of individual criminal
20%
structured OCGs continue to entrepreneurs come together
SHORT-TERM
dominate traditional criminal on an ad hoc basis for specific
VENTURES
markets. criminal ventures or to deliver
CaaS.
The fragmentation of the
serious and organised crime
24%
u to fi e
members
iti n
76%
six or more 60% oforganised
the suspects involved in serious and
crime in the EU are EU nationals.
members
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 15
cti iti
More than one third of the OCGs active in the
EU are involved in the production, trafficking Involvement of OCGs active in the EU in different crime areas
or distribution of drugs. Other key criminal
activities for OCGs in the EU include organised
property crime, migrant smuggling, THB and
excise fraud.
Organised
property
INTERNATIONAL crime
Excise fraud
Migrant
smuggling
7 out of 10
OCGs are typically active in more than three countries
45%
criminal activity. The share of these poly- crime. Criminals are increasingly adapting
criminal groups has increased sharply the supply chain models of global online
of the OCGs reported for the SOCTA compared to 2013. retailers.
2017 are involved in more than one OCGs also often engage in more than The concept of CaaS has been an emerging
criminal activity one criminal activity to mitigate risks, feature of various criminal markets for
Many OCGs have expanded their reduce operational costs and increase some years. However, increasingly OCGs
crime portfolio in response to the profit margins. The OCGs involved in the also openly advertise ad hoc opportunities
sustained high level of demand for trafficking of illicit goods are the most for individual criminals to provide them
smuggling services during the poly-criminal groups in the EU. These with support or expertise for specific
migration crisis.
groups typically traffic more than one illicit criminal ventures.
commodity such as counterfeit goods or
OCGs operating on an international
different types of illicit drugs.
level are typically active in more than
Sharing Economy Many OCGs are highly exible and able three countries (70%). A limited number
An increasing number of individual criminal to shift from one criminal activity to of groups is active in more than seven
entrepreneurs come together on an ad hoc another or to add new criminal activities countries (10%).
a i for ecific cri inal enture or to to their crime por olio. In many cases,
deliver CaaS OCGs operate on an on-demand basis
and only become active once new profit
opportunities emerge.
Since 2012, Europol has been supporting the German-led ISEC project
on “Strengthening cross-border operational cooperation in the fight
against mobile organised crime groups (MOCGs) from the Baltic Sea
Region, including Russian-speaking MOCGs”. The project has resulted
in the dismantling of more than 100 OCGs. A total number of 575
arrest warrants were issued. The damage caused by the MOCGs
targeted by this project exceeded EUR 65 million. These MOCGs mainly
carried out organised property crime, drug trafficking, document
counterfeiting and money laundering.
16 UNDERSTANDING ORGANISED CRIME
rr ti n
OCGs use corruption to infiltrate public OBJECTIVES OF CORRUPTION
and private sector organisations relying
on bribery, con icts of interest, trading in
in uence and collusion in order to facilitate
their criminal activities. Corruption distorts
legitimate competition and erodes public
trust in authorities and legal systems.
i nc an t rti n nt r a r again t a nf rc nt
OCGs tend to avoid the use of violence. Violence usually attracts Countermeasures are the actions and behaviours of individual
law enforcement attention, which is often incompatible with the criminals and criminal groups to disrupt or prevent law
profit-driven motivations of those involved in organised crime. enforcement activities against them. OCGs use various
countermeasures to recognise and mitigate law enforcement
OCGs mostly employ violence against members of their own or actions.
competing OCGs. Violent crimes targeting rival OCGs often take
place in the context of “turf wars” over territory or in uence. OCGs
extort property or money from individuals by intimidating their The application of countermeasures requires an awareness of the
victims, threatening to carry out serious harm and murder. Very methods and techniques used by law enforcement authorities in
few OCGs engage in extortion as their core activity. Some OCGs investigating criminal networks.
offer to carry out racketeering and extortion as a service for other OCGs use a number of countermeasures to secure their
criminal networks and lend “professional extorters” to affiliated communication against law enforcement surveillance. These
OCGs. include technical countermeasures such as the use of encryption,
Hostage takers kidnap, hold and release individuals in exchange foreign and pre-paid SIM cards or satellite telephones as well as
for ransom payments. In the EU, this criminal activity is not widely reliance on code. To evade physical surveillance during transport,
carried out by OCGs. However, OCGs involved in migrant smuggling OCGs frequently change vehicles, often hired or leased using
have been known to use the threat of kidnapping in order to extort fraudulent IDs.
debt payments.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 17
MS
cross-cu ng criminal threats enable and facilitate most, if not all,
TO
other types of serious and organised crime. The business models
US
NS C
of OCGs active across the spectrum of serious and organised crime
IO S,
AT ER
rely on document fraud, money laundering and online trade to
AR RD
CL T O
maintain their criminal enterprises.
DE R
D PO
AN N S
ES TRA
ING
ITY DRIV
IC NT
T
EN DS ,
IF LE
D ID AR
AT
RT DU
L AN , ID C
CE AU
E
RAV RTS
FR
E NT T SSPO .)
A
UL TS (P , ETC
UD S
FRA UMEN , VISA
C S
DO ENSE
LIC
CERTIFICATES,
MENTS (BIRTH
BREEDER DOCU NTRACTS OR
RDS, WORK CO
MARRIAGE RECO )
DOCUMENT INVITATIONS TO
STAY IN TH E EU
DRUGS
ILLICIT
ONLINE TRADE
FIREARMS
IN ILLICIT
COUNTER
GOODS AND
SERIOUS SERVICES FRAU
DULE
FEIT GOO
DS
AND COU
NTE
NT DO
C UMEN
TS
ORGANISED
R FEIT
CUR
REN
CY
CRIME
MONEY
LAUNDERING
CAS
H SM
UGG
MONEY L LING
AUNDER
IN G SYNDIC
ATES
OPERATION SNAKE
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 19
Tra a n a n ring a nt t
O P ER A T I O N K A N D I L 5 New payment methods such as
Trade-based money laundering is a highly
effective way of concealing criminal funds A 2016 investigation by French, Spanish, cryptocurrencies, prepaid cards, online
by manipulating or forging purchases or German and Dutch law enforcement payments and internet vouchers are
sales using double invoicing, false invoicing, authorities disrupted an OCG laundering the continuously emerging and are generally
over- and under-invoicing by companies proceeds generated by the trade of heroin. less well-regulated than traditional
that are owned by OCGs, their associates This OCG collected proceeds throughout the payment methods. In combination with
and relatives. EU and laundered the funds in Middle Eastern alternative banking pla orms, these new
countries relying on cash couriers and trade- payment methods allow the movement
based money laundering techniques. The of large amounts of criminal funds.
OCG purchased expensive second-hand cars, Underground banking systems are financial
heavy machinery and construction equipment networks operating outside of normal
in Germany in cash and exported them to banking channels to transfer money
Iraq where they were again sold for cash. The
internationally, avoiding the fees and
group then used Money Service Businesses
regulations of conventional banks.
and Hawala to introduce the funds into the
legitimate financial system, leaving virtually
no paper trail.
MONEY LAUNDERING
Most common methods
CASH SMUGGLING
by couriers or using post
and parcel services TRADE-BASED MONEY
LAUNDERING
False invoicing and forged ID
documents are used by shell
companies owned by OCGs to
conceal criminal funds
DOCUMENT FRAUD
The use of fraudulent Document fraud is a key High-quality counterfeit Fraudulent documents are
documents in the EU has enabler of all types of criminal documents are primarily increasingly traded online and
ignificantly increa ed t activity as well as terrorism. produced by highly specialised trafficked u ing o t and arcel
re re ent a ignificant threat Document fraud is also counterfeiters. services.
to the EU. expected to emerge as one of
the fastest growing criminal
markets over the coming years.
T r cti n f f rg T a an r nta f g n in ti r t
c nt c nt Fraudulent documents are multi-purpose
Increasingly sophisticated security features The sale or rental of travel and identity criminal tools and each document can
protecting documents against forgery documents such as passports is an be used repeatedly to support different
as well as improved technical control increasing concern. There has been a criminal activities. Documents forgers are
measures have compelled OCGs to improve significant increase in the number of service providers often cooperating with
the quality of fraudulent documents. lost and stolen documents in circulation. multiple OCGs involved in various criminal
Suppliers of raw materials now primarily Instability and armed con icts often allow activities.
rely on Darknet marketplaces to sell their criminal groups to obtain blank documents
products. from the affected regions. This is also
true for con ict zones on the periphery of
the EU and has been highlighted by the
widespread availability of thousands of
non-EU blank identity documents.
r r c nt
DO CU M ENT FORG E RY AN D MI G RAN T SMUG G LI N G 6
Breeder documents are documents that are used to obtain other
In May 2016, Greek and Czech law enforcement authorities arrested forms of legitimate identification for the purpose of establishing
several suspects involved in the forgery of documents and migrant a false identity. Fraudulent breeder documents are typically used
smuggling as part of an international investigation supported by to apply for genuine travel and identity documents and driving
Europol. The forged documents were subsequently provided to licences. Birth certificates, marriage records, work contracts or
irregular migrants to enter the EU or to legalise their stays there. The invitations to stay in the EU are forged in order to obtain visas,
investigation in Greece highlighted the structure and the hierarchy residency or work permits on false grounds.
of the Athens-based network. The fees for the forged documents
ranged from EUR 100 to EUR 3,000 per piece depending on the
quality, type and country of issue. The documents forged by the
criminal group included passports, national ID cards, visas, driving
licences, asylum seekers’ registration cards and residence permits.
FORGED VALID
BIRTH CERTIFICATE VISA
MARRIAGE RECORD RESIDENCY PERMIT
WORK CONTRACT WORK PERMIT
INVITATION TO STAY IN THE EU
22 UNDERSTANDING ORGANISED CRIME
The online trade in illicit goods cultural goods, excise tobacco, firearms, Tra nt rfac
heroin, hormonal substances, specimens
and services has been expanding of endangered species, stolen vehicle parts The distribution of illicit commodities via
steadily over recent years. It and accessories, synthetic drugs and new online pla orms has soared in recent years
and is expected to continue to increase
is expected that this trade will psychoactive substances (NPS), as well as
steadily over the coming years. Online
compromised payment card data are sold
continue to grow rapidly for and purchased online. trade offers the opportunity to reach a
the foreseeable future and that huge number of potential customers. Illicit
It is not only illicit commodities that are goods purchased online are predominantly
online platforms will emerge as traded online, but also criminal services. trafficked using postal and parcel services.
a key distribution platform for all The expanding CaaS business model
provides customers with access to a wide
types of illicit goods in the EU. range of criminal services. A prime example
of this is cybercrime, where customers T H E S A L E O F D R U G S VI A PH OTO-
can access such services as malware S H A R I N G PL A T F O R MS
coding, Distributed Denial of Service
The Darknet is a key facilitator (DDoS) services, bulletproof hosting and Photo-sharing applications and pla orms
for various criminal activities anonymisation services, botnet hire and are popular with a huge number of users.
These services allow users to create
including the trade in illicit money laundering.
communities around shared interests using
drug illegal firear and Vendors often attempt to hide illegal hashtags. Drugs dealers and users make use
malware. Darknet marketplaces goods among legal products on online of these pla orms to form communities to
pla orms on the surface web. In some discuss, exchange information and trade
are becoming increasingly de- cases, surface web vendors redirect their various types of illegal drugs. Potential
centralised. customers to mirror sites on the Darknet or customers scroll through pictures of
advertise their products using false product advertised products and then contact the
designations or descriptions. dealer privately using direct messaging
Online pla orms operating in the legal The online market caters to dealers who functionalities. The eventual transaction
economy have had a profound impact on buy in bulk for re-sale as well as individual takes place either face to face or via online
business models, shopping experiences and users. The diminishing reliance on access payment and delivery by mail.
customer expectations. The multiplication to street networks of consumers of illicit
of sales pla orms makes online trade commodities challenges the established
easier, more accessible and cheaper. This business models in many criminal markets.
development has been mirrored in the T arkn t
online trade in illicit goods as criminals, like
legitimate traders, look to opportunities The Darknet is a distributed anonymous
online to grow their businesses. network within the deep web that can only
be accessed using software such as The
Virtually all illicit commodities are now Onion Router (TOR), I2P and Freenet. While
traded online either on dedicated criminal As of January 2017, the TOR these tools were ostensibly developed
online marketplaces or by exploiting
network had over 1.7 million for the purpose of legitimately protecting
otherwise legal online pla orms. The freedom and privacy, confidential business
number of goods on offer and frequency
directly connecting users, and
hosted over 60,000 unique onion activities and relationships, they can
with which new products become available equally be used by criminals for the same
indicates that the online trade in illicit domains.7 In one study, almost purpose - to conceal their identity and/or
goods is thriving and highly dynamic. 57% of active sites could be the hosting location of websites, forums
Commodities such as cannabis, cocaine, cla ified a related to o e and markets, collectively referred to as
counterfeit currency, counterfeit medicine, form of illicit activity.8 “hidden services”.9
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 23
Firearms traffickers use Darknet marketplaces to sell illegal firearms to private individuals, It is estimated that the top 1% most
members of OCGs and terrorists based in the EU. In December 2016, Slovenian law successful vendors are responsible
enforcement authorities, with the support of Europol, arrested two suspects accused of
for 51.5% of all transactions on Dark
selling various live firing weapons including automatic ri es, hand and smoke grenades as
well as ammunition via a prominent Darknet marketplace. The firearms were paid for in markets.11 Goods and services offered
Bitcoin. on the Darknet are available to anyone,
be it an individual user, an OCG or
terrorist group.12
DRIVERS OF CRIME
Drivers of crime shape the nature and
impact of serious and organised crime
itica c nt t ga in tr ct r
activities.13 They include facilitating factors The serious and organised crime landscape OCGs exploit various legal business
and vulnerabilities in society which create in the EU is fundamentally affected by structures and professional experts to
opportunities for criminals. the geopolitical situation in and around maintain a facade of legitimacy, obscure
Europe. The impact of con icts on the criminal activities and profits, and to
T c n g periphery of the EU, such as in Libya and perpetrate lucrative and complex crimes.
Syria, on serious and organised crime Legal business structures allow OCGs to
in the EU has already materialised and operate in the legal economy and enable
will continue to in uence crime. Armed them to merge legal and illegal profits.
con icts and poverty are the most
significant push factors for migrants
travelling to the EU. The emergence of new
For almost all types of organised con icts or destabilisation of countries
crime, criminals are deploying and on the periphery of the EU would sustain
the migration ow to the EU. Armed
adapting technology with ever
con icts close to the EU also entail the
greater skill and to ever greater risk of returning foreign fighters as well
effect. This is now, perhaps, the as the large-scale trafficking of firearms
greatest challenge facing law originating from these regions.
enforcement authorities around the
world, including in the EU.
e
Technological innovation continues to
shape society and the economy, and cati n f r cri
by extension the serious and organised
crime landscape in Europe. Criminal Key locations for crime feature well-developed transport
actors in the EU display a high degree of
and communication infrastructure. These locations
adaptability and creativity in exploiting
and employing new technologies. While are used to organise the global distribution of illicit
not all criminal activities are driven by commodities.
technological developments, the internet
OCGs hide illicit goods among legal commodity ows, which are
and ever-increasing connectivity have an
increasing in speed and volume and almost impossible to check
impact on virtually all types of serious and
thoroughly.
organised crime. Innovation in technology
and logistics increasingly enable OCGs to Criminal groups will take advantage of weaknesses in new
commit crime anonymously, anywhere and technologies, such as automated transport systems, and exploit gaps
anytime without being physically present. in the legal frameworks regulating them.
The Internet of Things is constantly Key locations for crime are characterised by several different factors:
expanding. Connectivity of all types of the presence of efficient transport infrastructures, proximity to or
devices, including phones and appliances, connections with source countries and consumer markets, access to
is increasingly a reality in households and business and investment opportunities, as well as demand for illicit
businesses across the EU. However, these commodities or services.
devices remain vulnerable to intrusion and
criminals are already deploying techniques
to compromise these devices in order to
gain personal and financial information and
confidential data on business transactions.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 25
CURRENCY COUNTERFEITING
The production of counterfeit currency requires varying degrees of
sophistication depending on the currency and level of quality of the
resulting counterfeits. Counterfeit banknotes of various currencies
are traded online on surface web and Darknet marketplaces.
Consequently, counterfeit currency is increasingly trafficked using
parcel services.
While the production of counterfeit currency is currently not a
major threat to the stability of the euro, the common European
currency remains popular with counterfeiters. The most commonly
counterfeited euro banknote denominations are the EUR20 and
EUR50 notes.14 In 2016, the European Central Bank (ECB) decided
to halt the production of EUR500 banknotes by the end of 2018
in an effort to fight money laundering as well as the production of
counterfeit euro banknotes.
CYBERCRIME
T O PE R A T I O N A VA L A N CH E 15
A mature CaaS model underpins cybercrime, providing easy access to On 30 November 2016, after more than
four years of investigation, the Public
the tools and services required to carry out cyber-attacks. Prosecutor’s Office Verden and the L neburg
Police (Germany) in close cooperation with
ry to are ran o are u ing encry tion i a ignificant threat to the United States Attorney’s Office for
the Western District of Pennsylvania, the
the EU, targeting not only citizens but increasingly public and private Department of Justice and the FBI, Europol,
sector organisations alike. Eurojust and global partners, dismantled an
international criminal infrastructure pla orm
known as ‘Avalanche’. The Avalanche network
Network intrusions for the purpose of illegally acquiring data have was used as a delivery pla orm to launch
ignificant i act glo ally re ulting in the lo of intellectual and manage mass global malware attacks
and money mule recruiting campaigns. The
property and the compromise of mass amounts of data which can be monetary losses associated with malware
used for further criminality including fraud and extortion. attacks conducted over the Avalanche
network are estimated to be in the hundreds
Cyber-dependent crimes are offences that can only be committed using a computer, of millions of euros worldwide, although
exact calculations are difficult due to the
computer networks or other form of information communications technology. Cybercrime
high number of malware families managed
is a global phenomenon affecting all Member States and is as borderless as the internet
through the pla orm. The global effort to
itself. The attack surface continues to grow as society becomes increasingly digitised, with take down this network involved the crucial
more citizens, businesses, public services and devices connecting to the internet. support of prosecutors and investigators
from 30 countries. The operation marks the
largest-ever use of sinkholing to combat
botnet infrastructures and is unprecedented
in its scale, with over 800,000 domains seized,
sinkholed or blocked.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 29
85%
of internet users feel at
risk of becoming a victim
of cybercrime
a ar t rk attack
The development and distribution of Network attacks vary in modi operandi and Data has become a
malware continues to be the cornerstone purpose. Website defacement is a common
for the majority of cybercrime. Information- but low-impact attack, and often the
key commodity for
stealing malware, such as banking Trojans, trademark of hacktivist groups targeting criminals.
still represent a significant threat. This government or public websites.
type of malware typically steals user data
Network intrusions that result in unlawful
such as credit card numbers and login Increasing internet connectivity by
access to or disclosure of private data
credentials from infected machines for citizens, businesses and the public
(data breaches) or intellectual property
subsequent use by criminals in fraud.
are growing in frequency and scale, sector, along with the exponentially
Since late 2013, cryptoware (ransomware with hundreds of millions of records growing number of connected devices
using encryption) has become the compromised globally each year.16 and sensors as part of the Internet of
leading malware in terms of threat and Compromised data can be used for a
Things will create new opportunities
impact. Cryptoware encrypts victims’ variety of criminal purposes including fraud
user generated files, denying them access and extortion17 and is highly valued by for cybercriminals. Malware targeting
unless the victim pays a fee to have their financially motivated criminals.18 smart devices will lead to new
files decrypted. Following the trend of sources of data leakage and network
Some Member States highlight the
information stealers, cryptoware campaigns
particular threat posed by insiders to a compromise and create new botnets.
are increasingly targeting public and private Given the ease of entry into cybercrime,
company’s security. Any sector or network
sector entities.
which holds data which can be monetised the use of cyber tools and services by
is a target for such attacks. traditional OCGs to enhance or expand
their capabilities is likely to become
more commonplace.
CRYPTOWARE
How it works
he roceeding
can be used for
Means of infection any other criminal
activity
o ro i ed e ite
fake o ile a e ail
attachments
Devices at risk
Computers and
mobile devices
T T
While neither o ine nor online CSE meet the Darknet dedicated specifically to the
the criteria to be considered ‘organised production, sharing and distribution of
f n rat n c nt at ria
crime’ this is still a high priority crime due CSEM. Typically this refers to services on
to the degree of physical and psychological the TOR network. Peer-to-peer (P2P) file
There is a growing trend in the production
damage to one of society’s most vulnerable sharing applications are the preferred
of Self-Generated Indecent Material
groups – children. method of exchanging CSEM.
(SGIM) - typically teens or pre-teens taking
indecent images of themselves to be
Online and o ine child sexual exploitation rcia shared privately with a partner or someone
are often considered two different crime
areas. However, a number of offenders are Children are sexually exploited largely to they believe they can trust, for example
involved in both. There are indications that satisfy the sexual appetites of those with a in grooming scenarios. Subsequently,
this is the case for about 30% of offenders sexual interest in children. However, there these images can be distributed either
in possession of CSEM. is a growing trend in the production of accidentally or maliciously without the
CSEM for financial gain. A particular activity owner’s consent.
The increasing global availability of associated with commercial production of
broadband internet and internet-enabled CSEM is that of Live Distant Child Abuse a t rti n
devices continues to fuel the growing (LDCA). LDCA is a significant threat in
number of both offenders and victims in Often associated with the production of
this area of criminality. LDCA involves a
this area. While the same can be said of any SGIM is the growing practice of sexual
perpetrator paying to direct the live abuse
number of crime areas, this phenomenon is extortion, whereby an offender uses
of children on a pre-arranged specific time-
a major contributor to online CSE. an explicit image of a minor - obtained
frame through video sharing pla orms.
incidentally or through coercion or
The internet provides offenders and deception - to further coerce or extort the
potential offenders with an environment in child into either producing more material
which they can operate with an enhanced or engaging in further online or even o ine
level of safety and anonymity. In particular, abuse. In some cases the perpetrator
there is a growing number of forums on alternatively seeks financial gain.19
32 ASSESSING ORGANISED CRIME
ar r nt fra
CP fraud requires an offender to present
a physical card at an automated teller
machine (ATM), Point of Sale (POS) or
other terminal. This crime has two stages:
obtaining a card, and the use of the card.
The cards used are either lost or stolen
genuine cards, or counterfeit cards. Unlike
fraud using lost or stolen cards, fraud using
counterfeit cards is typically committed
outside the Single Euro Payments Area
(SEPA).
ID THEFT AND
PAYMENT CARD
FRAUD
STEP 2
Your login credentials,
bank account details,
credit card numbers and
STEP 1 other personal information
A fraudster uses malware and are stolen
social engineering to access
your computer
STEP 3
Your data is sold on
the Darknet
STEP 4
OCGs use your compromised
ID and financial data to
support their criminal
activities
T T
AND DISTRIBUTION
Drug markets remain the largest criminal production lines capable of producing
markets in the EU. More than one third
n in tra synthetic drugs on an industrial scale.
of the criminal groups active in the EU Criminals continuously seek out methods
Drone technology is expected to advance
are involved in the production, trafficking and technologies to make their business
allowing drones to travel greater distances
or distribution of various types of drugs. models more effective and increase profit
and carry heavier loads as well as making
The trade in drugs generates multi-billion margins. Online marketplaces on the
them more affordable. OCGs involved in
euro profits for the groups involved in this Darknet are now a key pla orm used to
drug trafficking will likely invest in drone
criminal activity. The EU retail drug market advertise and sell all types of drugs. The
technology for trafficking purposes in order
is estimated to be worth at least EUR anonymous nature of online transactions
to avoid checks at border crossing points,
24 billion a year.22 The immense profits on these marketplaces and the use of
ports and airports.
generated from the trade in drugs fund cryptocurrencies reduce the risks of
various other criminal activities allowing detection by law enforcement authorities
OCGs to thrive and develop their criminal for both vendors and buyers.
enterprises at the expense of the health, TRENDS
prosperity and security of EU citizens. T c n g
OCGs involved in drug trafficking heavily Technical innovation and the accessibility SYNTHETIC DRUGS
rely on corruption to facilitate their of sophisticated equipment have allowed he arket for ynthetic drug
continue to e the o t
trafficking activities. They also make use OCGs to maximise the production output
dyna ic of the drug arket in
of fraudulent documents such as fake of individual sites. Large-scale cannabis the
import or company registration certificates cultivation sites are often maintained
to import illicit drugs among legal goods, using professional growing equipment
to procure pre-precursors and purchase such as climate control systems, CO2 and
equipment used as part of production ozone generators. Similarly, laboratories ONLINE TRADE
processes. manufacturing synthetic drugs feature nline arket lace on the
advanced chemical equipment and arknet are no a key
latfor u ed to ad erti e
and ell all ty e of drug
rug arket generate
EUR
billion/year
in rofit
>75%
of the in ol ed in the trafficking of
CUTTING - EDGE
one drug al o traffic and di tri ute other
TECHNOLOGY
echnical inno ation and
types of drugs. o hi ticated e ui ent
allo to a i i e the
roduction out ut
of the cri inal grou
acti e in the are
in ol ed in the drug
arket
~65% TOXIC WASTE
of OCGs involved in the drug trade are he roduction of ynthetic drug
simultaneously involved in other criminal generate large uantitie of highly
activities such as the trade in counterfeit to ic and dangerou a te u
LIBYA
i ya i e erging a a ne
di tri ution hu for canna i
re in trafficked to the acro
the editerranean ea
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 35
CANNABIS
Cannabis remains, by far, the most widely EU is Morocco from where it is trafficked to
consumed illegal drug in the EU.23 Cannabis the EU primarily by sea and road transport.
is distributed on EU markets as cannabis Cannabis resin originating from Morocco is ‘ R O S E O F T H E WI N D S ’ –
I N T E R N A T I O N A L O PE R AT ION AGAIN ST
resin and herbal cannabis. In recent years, increasingly smuggled to the EU across the
D R U G T R A F F I CK I N G 24
herbal cannabis has been increasingly Mediterranean Sea departing from Libya.
popular with consumers, which has led Cannabis resin shipments are transported In December 2016, a multinational police
to an increase in the production and across the Mediterranean Sea to the team including Europol announced the
availability of herbal cannabis within the EU Spanish coast using high-powered vessels arrest of a major Moroccan drug kingpin.
and in countries close to EU markets. where they are dropped into the sea and The work that led to this arrest began in
retrieved by OCGs on local fishing vessels April 2016. The Moroccan national had
Growing equipment, seeds and other raw
or pleasure boats using GPS signalling orchestrated a multi-tonne drug delivery.
materials used for cannabis cultivation
devices. This is the latest successful result achieved
in the EU are readily available online and
by JOT ’Rose of the Winds’. Approximately
often originate from the Netherlands. The
one week prior to his apprehension,
indoor cultivation of herbal cannabis in the
the Spanish Guardia Civil, supported by
EU is expected to further expand over the
Europol, the French Direction Nationale
coming years with new growing techniques
and increasingly sophisticated growing The market for cannabis du Renseignement et des Enqu tes
Douanières and the Italian Guardia di
technologies being used by OCGs in order remains by far the Finanza, localised and intercepted a
to increase harvest yields and profits.
Outdoor cultivation of herbal cannabis largest drug market in merchant vessel ying the ag of Panama.
The ship was subsequently escorted to the
remains limited compared to the indoor the EU. port of Almeria, where a thorough search
cultivation of cannabis.
revealed the illegal cargo of 19.6 tonnes of
Albania remains the main source of herbal cannabis resin. The crew were arrested and
cannabis trafficked to the EU. The main the shipment was seized. The investigations
source of cannabis resin consumed in the also revealed a poly-crime involvement of
the transnational organised crime networks
active in large-scale drug trafficking in the
Mediterranean Sea. Namely, concrete and
recurrent links with migrant smuggling and
cocaine trafficking have been ascertained.
36 ASSESSING ORGANISED CRIME
CANNABIS HERB
roduction trafficking and
distribution NETHERLANDS
Main distribution hub
Libya i e erging a a ne
distribution hub for cannabis
re in trafficked to the acro AFGHANISTAN
the editerranean ea ALBANIA
Main source
Distribution hub
SPAIN
Distribution hub
MOROCCO
Main source
LIBYA
Distribution hub
CANNABIS
ean of tran ortation rafficking to
COURIER PLEASURE BOAT SPEED BOAT CONTAINER LORRY SMALL AIRCRAFT
rafficking ithin
COURIER PRIVATE CAR BUS LORRY SMALL AIRCRAFT
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 37
COCAINE
Cocaine is primarily produced in Colombia, Large shipments of cocaine are trafficked in
Peru and Bolivia and trafficked to the EU containers hidden among legal goods or as O PE R A T I O N F U L E CO
via other South American countries such as part of the rip-on/rip-off modus operandi. Brazil is among the main countries of
Brazil, Venezuela, Argentina, the Caribbean Brazil is a key point of departure for departure for couriers trafficking cocaine
Sea region and West Africa. Over the last cocaine couriers travelling directly to the to the EU. This has been confirmed by
two years, the production of cocaine in EU. The United Arab Emirates (UAE) and the results of Operation Fuleco, an effort
Colombia has intensified significantly. destinations in East Africa have emerged by Member States supported by Europol
An increase in the production output in as hubs for cocaine couriers travelling to targeting cocaine couriers arriving to the
Colombia will likely impact on the EU in the EU. Cruise ships departing from the EU’s major airports. During Operation
the form of intensified trafficking activity Caribbean Sea region are increasingly being Fuleco, nearly 200 cocaine couriers were
as well as greater availability of cocaine on used to traffic cocaine to the EU. arrested and almost 500 kilograms of
drug markets in the Member States. cocaine seized in the Netherlands, Spain,
The trafficking modi operandi associated More OCGs are involved Portugal, the United Kingdom, France,
Belgium, Germany and Ireland. Operation
with the trade in cocaine have largely
remained the same. Cocaine is typically
in cocaine trafficking Fuleco took place in June and July 2014
trafficked as part of large shipments in than any other criminal and involved 12 Member States including
Austria, Belgium, Bulgaria, the Czech
containers or in smaller quantities by
couriers.
activity in the EU. Republic, France, Germany, Ireland, the
Netherlands, Romania, Spain, Sweden and
the United Kingdom.
COCAINE
roduction trafficking and
distribution Main entry points in the EU
NETHERLANDS
BELGIUM
PROFITS SPAIN
5.7
BILLION EUR / YEAR
ignificant increa e in
production in Colombia may
re ult in inten ified trafficking Means of
acti ity to the transportation
rafficking to
COLOMBIA
rafficking ithin
PERU
Main producers
PARCEL CONTAINER LORRY SMALL AIRCRAFT
BOLIVIA
HEROIN
Afghanistan remains the leading producer potential disruptions to trafficking activities
of heroin trafficked to the EU. The from Afghanistan further laboratories may
The Balkan route
production output of opium and heroin in emerge in the EU in the future. Heroin remains the main entry
Afghanistan is very high and is projected to is also available on online marketplaces route for the trafficking
remain so for the foreseeable future. and is occasionally distributed across the
EU in small quantities via post and parcel of heroin into the EU.
Production of heroin remains rare in
services.
the EU. However, depending on the
development of the demand for heroin and
HEROIN
roduction trafficking and
distribution
NO
RT
HER
NR
OU
TE
PAKISTAN
Main producer
SOUTHERN ROUTE
SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016
Means of transportation
rafficking to
LORRY
rafficking ithin
LORRY
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 39
SYNTHETIC DRUGS AND he arket for ynthetic he roduction ca acity er the la t fi e year
NEW PSYCHOACTIVE drug continue to e the of ynthetic drug ne ere
SUBSTANCES o t dyna ic of the drug la oratorie ha increa ed detected in the for the
roduction trafficking and arket in the ignificantly in recent fir t ti e
di tri ution year
Methamphetamine
Amphetamine
MDMA
NETHERLANDS
POLAND
BELGIUM
SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016
CZECH
REP.
to UNITED STATES
SLOVAKIA to AUSTRALIA
Means of transportation
AIR LORRY
40 ASSESSING ORGANISED CRIME
NPS
NPS continue to be produced in China and,
to a lesser degree, India and trafficked to
the EU in large quantities. NPS production
in the EU is largely limited to packaging and
re-selling of imported substances. However,
some limited NPS production is thought to
take place in the EU.
CH I L D R E N BU R N T BY D U M P E D
WA S T E F R O M S Y N T H E T I C DRU GS
PR O D U CT I O N
O P E RATI ON ALI MAYA
In August 2015, four children and an
In March 2016, Spanish law enforcement
accompanying adult suffered severe burns
authorities in cooperation with other
to their legs after coming in contact with
Member States and supported by Europol C O N TAI N E R S E I Z U R E O F 2 . 8 TO N N E S chemical waste dumped by suspected
were able to dismantle a network O F MDMA A N D ME T H A MPH E TA M I N E
VALUED M O R E T H A N U S D 1 . 5
synthetic drug producers in Belgium.
importing and distributing large quantities
B I L LI O N 25
Some of the waste produced as part of the
of dangerous NPS in the EU. This network
manufacture of synthetic drugs is highly
used various companies to import and
In November 2014, Australian law dangerous. Drug producers frequently
sell these substances, especially synthetic
enforcement authorities seized a dump this type of waste away from their
cannabinoids from China, generating
maritime shipping container holding laboratories in order to disguise their
significant profits. Coordinated action in
approximately 2.8 tonnes of MDMA locations.
March 2016 involving house searches at
and methamphetamine. The load was
four locations resulted in the seizure of
estimated to have a street value of more
HORMONAL
550 litres of acetone, 75,000 envelopes
than EUR 1.4 billion (USD 1.5 billion).
used for packaging different NPS brands,
At the time, the value and size of the
NPS worth more than EUR 1.5 million. This
SUBSTANCES
seizure was unprecedented. The container
investigation highlights the profits involved
arrived in Australia from Europe and was
in the distribution of NPS.
seized following an intelligence operation.
The seizure led to the arrest of several There is a growing market for illegal
individuals in Australia and Australian hormonal substances in the EU. These
law enforcement authorities suspect substances are both trafficked to and
the involvement of several OCGs in the illegally produced in the EU.
production, trafficking and intended Hormonal substances trafficked to the EU
distribution of this shipment. This seizure typically originate from China, India and
highlights the scope of the trafficking of Thailand. However, over the last few years
synthetic drugs from the EU to destination production facilities for illicit hormonal
markets around the world. substances have also been discovered in
the EU.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 41
ENVIRONMENTAL CRIME
Environmental crime covers a diverse exportation, placing on the market or use
range of different offences including the of ozone-depleting substances.
improper collection, transport, recovery
Environmental crime is characterised by its
or disposal of waste, the illegal operation
impact on the natural environment. The
of a plant in which a dangerous activity
environmental impact manifests itself in
is carried out or in which dangerous
increasing levels of pollution, a degradation
substances or preparations are stored, the
of wildlife, a reduction in biodiversity and
killing, destruction, possession or trade of
the disturbance of ecological balance.
specimens of protected wild fauna or ora
Environmental crime puts public health at
species, and the production, importation,
risk.
ILLICIT WASTE
TRAFFICKING
The use of legal business structures for
illicit waste trafficking activities by criminal
TRAFFICKING OF
actors are an inherent feature of this crime
area. In many cases, criminal actors and ENDANGERED
legal businesses are indistinguishable from
one another. As part of this development,
criminals involved in illicit waste trafficking
SPECIES I VO RY T R A F F I CK I N G
have moved towards the more complex The trafficking of and trade in endangered In November 2016, Austrian law
business model of illicit waste management species involves the collection or enforcement authorities seized 560
rather than just illegally dumping waste. processing of animals and plants protected kilograms of trafficked ivory, the
Illicit waste traffickers now operate along by national and international regulations. equivalent of 590 elephant tusks. Ivory
the entire waste processing chain, heavily The Convention on International Trade in is worth more than EUR 1,000 (USD
relying on the use of legal business Endangered Species of Wild Fauna and 1,000) per kilogram on the Austrian
structures for their activities. Flora (CITES) provides the international black market. German law enforcement
framework for the protection of authorities seized 1,200 kilograms of
The trafficking of illicit waste typically endangered species and aims to ensure
involves the use of fraudulent documents. ivory at a Berlin airport, Germany, in
that international trade in specimens of May 2016. Raw and manufactured
wild animals and plants does not threaten ivory were falsely declared and
their survival. destined for Vietnam.
The EU is primarily a transit region
for endangered species trafficked to
destination markets in Asia and North
America. The most commonly trafficked
species and wildlife products trafficked
from, to and via the EU include glass
eels, reptiles, exotic birds, pangolin, fish,
narwhal meat, shells, corals, date mussels,
timber and ivory.
The number of OCGs involved in the
trafficking of and trade in endangered
species is low, but believed to be
increasing. The OCGs involved are highly
specialised and typically only focus on this
specific activity.
42 ASSESSING ORGANISED CRIME
FRAUD
EXCISE FRAUD
Alcohol, cigarettes and mineral oils are F U EL F RAU D
subject to excise duty upon production in,
or on import to, the EU. OCGs use various Fuel fraud is a growing phenomenon
modi operandi to avoid excise duties and and typically involves base-oil fraud,
generate significant profits selling both
genuine and counterfeit excise goods at
also called ‘designer fuel’ fraud and fuel
laundering. This type of fraud requires INVESTMENT FRAUD
lower prices than their licit equivalents. significant expertise, which is usually only
Excise tax fraud is driven by legislative available from trained chemists or similar Investment fraud schemes generate
professions.
differences and varying excise tax rates huge rofit ne in e tigation
applied by different jurisdictions.
re ealed e ti ated rofit of u to
EUR 3 billion generated by one OCG.
Excise goods are increasingly offered
and bought online. Successful investment fraud schemes
typically use various social engineering
techniques to operate. Fraud schemes
relying on social engineering are
UNDE RSTAND I NG EXC I S E FRAUD particularly hard to counter.
ABUSE OF DUT Y SUSPE NSIO N SC HE M E S
The abuse of duty suspension schemes rates as the intended destination of the What is social engineering?
are the main modi operandi used to trafficked goods. Accomplices in the
avoid the payment of excise duties on declared country of destination, such as Social engineering techniques are a key
alcohol products and are also increasingly corrupt warehouse employees, confirm element to many different types of fraud.
used to avoid excise duties on tobacco receipt of the goods. However, in reality Social engineering is the use of deception
products. These modi operandi involve the goods are exported to countries to manipulate individuals into divulging
the exploitation of the EU Excise applying high excise rates. The goods confidential or personal information that may
Movement Control System (EMCS), a appear legitimate as documents certify be used for fraudulent purposes.
computerised system registering the that any excise obligations due were paid.
movement of excise goods within the EU, If the product originates from a country
and the T1 procedure, which is applied applying high excise rates, the goods O PE R A T I O N BA T E O
for excise goods under suspension often do not leave the country at all and
schemes imported from outside the EU, the movement of the goods is purely In 2015, law enforcement authorities in
by falsely declaring the real destination virtual. the EU launched an investigation into an
and quantities of excise goods imported OCG with ties to Germany, Portugal and
In other cases, traffickers file an Spain. This OCG operated a sophisticated
into the EU.
application for the transfer of one load pyramid fraud scheme offering investments
How does it work? and use a duplicate of the transport into a music sharing pla orm and other
authorisation to import multiple loads online services. The OCG used various front
In relation to alcohol products, as part
without paying excise duties. companies. The investigation was able to
of the import process for the EMCS and
the T1 procedure, criminals declare a identify more than 50,000 victims in 34
Member State which applies low excise countries. Overall, the OCG was able to
generate an estimated profit of more than
EUR 3 billion.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 43
Criminals orchestrate various investment fraud schemes. The most common schemes
encountered in the EU include:
Fraudsters operating B oi ler room As part of Pon z i s c h em es , fraudsters Py ram i d s c h em es operate on the same
s c h em es use cold-calling to contact attract a group of initial investors with model as Ponzi schemes. However, the
their victims and pressure them into promises of very high returns in a very initial investors are actively involved and
investing in non-existent or very low- short time. The fraudster starts to repay are required to recruit new investors in
value stocks. Fraudsters often use false the initial investors to attract more victims order to get profits.
documents and certificates to present using funds accrued from additional
their company and the offered stock as investors. In reality, the money is not
legitimate. invested and the fraudsters ultimately
disappear with the funds. The money is
laundered through multiple bank accounts
held by various front companies in
different jurisdictions.
STEP 1
Fraudster calls posing as an IT
STEP 4 specialist from the employee’s
company (or as a bank employee)
The data/access obtained is
used to transfer funds from the
company’s account to the
fraudster’s account
SECURITY STEP 2
Informs of a security breach on
ALTERNATIVE
BREACH the company’s system (or on the
internet banking facility)
•Encourages transfer of
SCAMS
funds to a “safe-keeping
account”
•The employee transfers
STEP 3
funds to an account OPTION 1: Requires
controlled by the fraudster OPTION 2: Encourages the employee to contact the financial detail
The money is re-trans- bank. Uses technology to remain on the line after necessary for check-up
ferred to accounts in termination of the call and therefore obtain sensitive and/or downloading of a
multiple jurisdictions financial detail di clo ed to the ank e loyee remote access software
(account numbers; access codes)
44 ASSESSING ORGANISED CRIME
T T
VAT frauds are highly complex forms of
tax fraud relying on the abuse of the VAT UN DERS TA N D I N G VA T F R A U D
rules for cross-border transactions. VAT MT IC FR A U D
fraudsters generate multi-billion euro
Cross-border transactions within the EU are zero-rated, which
profits by avoiding the payment of VAT
means that the payment of the VAT is not due until the goods are
or by fraudulently claiming repayments
sold at their destination. This enables traders to import goods
of VAT by national authorities following a
without accounting right away for the VAT. In simple MTIC cases,
chain of transactions. The most common
fraudsters sell the goods, charge the VAT to buyers without
form of VAT fraud is Missing Trader Intra-
remi ng the value to the tax authorities.
Community (MTIC) fraud.
More complex cases of VAT fraud are typically known as carousel
Changes in commodity prices have an
frauds. As part of these fraud schemes goods are imported and
impact on the profitability of MTIC fraud
sold through a series of companies before being exported again.
schemes involving specific commodities or
The exporters of these goods claim and receive the reimbursement
services. This is particularly true for fraud
of VAT payments that never occurred.
schemes involving the energy sector and
related commodities, which are subject to
frequent price uctuations.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 45
INTELLECTUAL PROPERTY
CRIME
The infringement of intellectual property In 2015, more than 80,000 seizures were
rights is a widespread phenomenon registered by customs authorities in the
in the EU. Cheap counterfeit copies of EU. These shipments contained more than
popular goods remain highly popular with 40 million articles worth an estimated EUR Counterfeit goods not only cause
consumers. Criminals are able to produce 642 million. Cigarettes remain the most losses in unpaid duties and
counterfeit goods in large quantities at frequently seized counterfeit product
minimal costs and use online pla orms to accounting for 27% of all seizures, followed taxes, but also reduce the sales
easily and effectively market their products by other goods such as batteries or air olu e rofit and in e t ent
internationally. Counterfeiting and piracy fresheners at 10% as well as toys at 9%. of legitimate businesses. This
are terms used to describe a range of illicit Regular household items such as body care
removes incentives for investment
activities related to Intellectual Property articles, medicines, electrical household
Rights (IPR) infringement. Most counterfeit goods represent 25.8% of the total number in research, development and
goods infringe a trademark, which means of seized counterfeit products. innovation.
that a good is produced without the
authorisation of its rights holder. OCGs are
increasingly involved in the violation of IPR.
OCGs produce a wide range of counterfeit n in i tri ti n
goods and manufacture sub-standard
Online marketplaces are the key Thousands of online shops are
goods distributed on EU markets including
distribution channel for counterfeit goods. used to sell counterfeit goods.
food and beverages, pesticides and
The sales volume of counterfeit goods In 2016, Operation In Our Sites
pharmaceutical products. Counterfeit and
online has increased significantly over (IOS) resulted in the seizure
sub-standard goods pose significant risks to
recent years. Counterfeiters use social of 4,780 domain names and
the health and safety of consumers.
media pla orms to advertise their products associated online shops selling
China remains the source country of most and steer potential consumers to online counterfeit merchandise.
of the counterfeit goods trafficked to the sales pla orms. The sale of counterfeit
EU. The trade in goods between the EU and goods online is closely related to the
China has expanded significantly in recent increasing use of parcel and postal services The distribution of counterfeit
years. China is the biggest source of imports to distribute counterfeit products, which is pharmaceutical products online
to the EU by far. difficult to detect among an increasing ow is particularly dangerous. In
of licit goods sold online and sent via postal 2016, Operation Pangea I
freight. specifically targeted online
vendors of counterfeit
P O LY-C RI M I NAL OC G I N VO LV ED I N medicines. The operation
T HE TRAD E I N C OU N TERFEI T G O O DS resulted in the seizure
A ND DRU G TRAFFI C KI N G
nt rf it ar ac tica of potentially dangerous
While the counterfeiting of medicines worth more than
In 2015 and 2016, Europol supported an
pharmaceuticals previously primarily EUR 50 million.
operation targeting an Italian OCG selling
affected lifestyle medicines, counterfeiters
counterfeit champagne in various Member
increasingly target almost all types of
States. Investigations in Italy and Germany
medicinal products including cancer
revealed that some of the suspects
medication and various types of medical
were also involved in the trafficking
devices.
of cocaine. During house searches in
Germany, investigators seized more than
12,000 bottles of fake champagne. The
investigation also uncovered links to VAT
and excise fraud.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 47
rgani rg ari an t ft
Some Member States note a steady
increase in the number of reported
burglaries over recent years. This increase
particularly affects business premises, OCGs make use of various online
which are targeted much more frequently services to facilitate their burglaries. In September 2015, Europol supported
than before. Burglaries of business This includes checking on social media French, Belgian and Moldovan law
premises often involve intrusion into the platforms whether individuals are away enforcement authorities in disrupting the
property via the roof. from targeted residences, scouting activities of a Moldovan OCG carrying
Many incidents of pickpocketing are not targeted neighbourhoods using free out serial burglaries targeting bicycle
attributed to organised crime. However, online navigation tools and fencing shops. The offenders typically stole luxury
the scale and level of organisation of bikes worth more than EUR 10,000 each.
goods via online marketplaces.
pickpocketing raids across many Member The bikes were transported from Paris
States suggests that MOCGs are heavily to Moldova on long-distance passenger
involved. busses. The bikes were eventually sold in
Ukraine as well as via online marketplaces.
This OCG was highly mobile and operated
rgani r ri with a strict division of tasks between
MOCGs are increasingly targeting commercial premises for armed robberies, which group members.
typically have less sophisticated security measures in place. Attacks on banks and other
cash-intensive businesses have declined notably in recent years due to the security
measures put into place at their locations.
Jewellery stores and other businesses selling highly valuable and compact goods remain
popular targets for armed robbers using various methods of attack including smash and
grab.
LOGICAL AT TACKS ON ATMS
As part of a new modus operandi, attackers drill or burn small holes into the ATM case in
order to reach the ATM’s computer hardware components. The attackers use this access to
intrude into the ATM’s operating system and force it to dispense cash.
48 ASSESSING ORGANISED CRIME
t r ic cri
The theft and fraudulent acquisition of motor OPERATION PANDORA
vehicles remains a lucrative business for the
various OCGs involved in this criminal activity.
Some OCGs steal specific vehicles to order for
clients based in destination countries. While
the overall number of stolen vehicles appears
to have remained stable in many Member
States over recent years, the number of
recovered vehicles has dropped considerably
across several Member States. This trend
likely indicates a further shift from individual
offenders to the involvement of more
professional OCGs.
ELECTRONIC COMPROMISE
OCGs involved in the theft of motor vehicles
increasingly rely on high-tech tools to gain
access to vehicles and to overcome security
measures. Information on how to overcome
car security systems can be easily found on 3 ,5 6 1 A RT E FA CTS S E I Z E D IN
online messaging boards and websites. In O PE R A T I O N PA N D O R A 28
many cases, the tools used for electronic In January 2017, Europol joined forces
compromise are readily available to order with law enforcement authorities from
online and often originate from China. t ra g trafficking 18 countries, Interpol, the United Nations
Some OCGs steal cars as part of burglaries The con icts in Libya, Syria and Iraq are
Educational, Scientific and Cultural
and home jacking attempts. MOCGs target thought to have resulted in the intensified Organization (UNESCO), and the World
residential homes with high-value cars parked trafficking of cultural goods from this region Customs Organization (WCO) to tackle the
outside, breaking and entering these premises to the EU. This trend is expected to continue theft and illicit trafficking of cultural goods.
to retrieve the original car keys and steal due to persistent instability in the region and
the vehicle. Vehicle theft is intimately linked Operation Pandora was successfully led by
the lack of law enforcement resources to Cypriot and Spanish police:
to document fraud. OCGs use fraudulent prevent or intercept trafficking activities in
documents to give stolen cars new identities origin and transit countries. A small portion 3,561 works of art and cultural goods
for registration or exportation purposes. of the funds generated by cultural goods were seized, almost half of which
trafficking in the Middle East and North Africa were archaeological objects; 500
region could potentially be used to support archaeological objects were found in
terrorist organisations. However, the profits Murcia, Spain, of which 19 were stolen in
achieved from cultural goods trafficking for 2014 from the Archaeological Museum
these organisations are thought to be low in Murcia;
compared to other revenue streams.
over 400 coins from different periods
WAR CRIMES were seized following investigations into
In some cases, the destruction, removal and suspicious online advertisements.
OCGs increasingly rely on trafficking of cultural goods in the context of
Several of the retrieved artefacts are
technical tools and expertise to an armed con ict can amount to a war crime.
of great cultural importance in the
Significant cultural goods are protected by
overcome new vehicle security international law. International humanitarian archaeological world, such as a marble
measures. law and international criminal law have Ottoman tombstone and a post-Byzantine
established various forms of attack against icon depicting Saint George, along with two
cultural property as war crimes. Activities Byzantine artefacts. All of them were seized
related to the destruction or trafficking of in Greece during actions carried out by the
cultural goods amounting to war crimes Hellenic Police.
The trade in spare parts is potentially have an impact on the EU. The
increasingly taking place on deliberate destruction of archaeological and
online marketplaces. OCGs have cultural heritage in Palmyra as well as other
places in Syria and Iraq could potentially
adapted to this and now rely be considered a war crime according to the
on these platforms to sell the Rome Statute of the International Criminal The illegal online trade
Court.27 Subsequently, law enforcement
cannibalised spare parts from authorities seized cultural goods originating in cultural goods is
stolen vehicles. from Palmyra and trafficked to Europe. expanding.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 49
PEOPLE AS A COMMODITY
MIGRANT SMUGGLING
Migrant smuggling has emerged as a reported just over 295,000 positive decisions
highly profitable and widespread criminal on asylum applications by Member States.31
Armed conflicts, economic and
activity for organised crime in the EU. The This means that a large number of irregular population pressures in Africa and
migrant smuggling business is now a large, migrants who did not apply for asylum the Middle East will continue to
profitable and sophisticated criminal market, or whose applications were rejected may
comparable to the European drug markets. attempt to stay illegally in the EU.
act as the main push factors for
irregular migrants travelling to the
The demand for and supply of smuggling In addition to the transportation of migrants,
services has grown significantly since 2014. document fraud has emerged as a key EU. Migrant smuggling to and within
More than 510,000 illegal border crossings criminal activity linked to the migration crisis. the EU will remain a key criminal
between border-crossing points at the The provision of fraudulent documents will threat.
external border of the EU were registered continue to represent a substantial threat to
in 2016.29 This is a substantial decrease the security of the EU. Fraudulent documents
compared to 2015, when over one million are used and can be re-used for many
irregular migrants entered the EU on different criminal offences. The number of unaccompanied
the Eastern Mediterranean and Central minors present in the EU has
Mediterranean routes.30 Nearly all of the
irregular migrants arriving in the EU along increa ed ignificantly in recent
these routes use the services offered by years as a result of the migration
criminal networks at some point during their crisis. This group is very vulnerable
journeys.
to all types of exploitation.
During 2016, 1,234,558 applications for
asylum were recorded in the EU. In 2015,
the European Asylum Support Office (EASO)
MIGRANT SMUGGLING
ROUTES
SOURCE: EUROPOL INFORMATION (2017)
50 ASSESSING ORGANISED CRIME
Migrant smuggling is a highly profitable crim- well as to change from irregular to legalised
igrant gg ing a ai inal activity featuring sustained high levels of residence status under false pretences or
in demand and relatively low levels of risk. Some by using fake identities. Migrant smuggling
OCGs previously involved in other criminal networks are increasingly offering tailor-made
In 2015, migrant smuggling networks offering activities such as the illegal trade in excise facilitation services including high-quality
facilitation services to reach or move within goods, drug trafficking or organised property fraudulent documents.
the EU generated an estimated EUR 4.7 billion crime have added migrant smuggling to their
to EUR 5.7 billion in profit. These profits have The abuse of genuine passports by look-alikes
por olio of criminal activities. Migrant smug-
seen a sharp decline in 2016, dropping by continues to be the main modus operandi
gling does not require access to significant
nearly EUR 2 billion between 2015 and 2016. used by document fraudsters. ID cards are
resources and OCGs can rely on their existing
This development is in line with the overall the most commonly detected document used
knowledge of routes and infrastructure
decrease in the number of irregular migrants as part of document fraud. In 2015, they ac-
used to smuggle goods across borders. The
arriving in the EU and as a result of a fall in counted for 50% of all detections in the EU. In
distinction between legal and illegal activities
the prices for migrant smuggling services 2016, more than 7,000 people were detected
is increasingly blurred. Individual criminal
following the peak of the migration crisis in with fraudulent documents on entry at the
entrepreneurs can step in and out of criminal
2015. external borders of the EU.32
activities by providing ad hoc services, espe-
cially taxi and truck drivers.
OCGs involved in migrant smuggling display n rging ark t
an unprecedented level of organisation and
coordination. While established smuggling Both the quantity and the quality of fraud-
modi operandi remain unchanged, migrant O P ERATI O N DA I DA LO S ulent documents circulating in the EU have
smugglers have shown great versatility in the increased. The sustained increase in demand
In March 2015, Operation Daidalos for fraudulent documents has prompted
means of transport, concealment methods
and technologies they use. targeted a criminal group smuggling established counterfeiters to increase their
irregular migrants from Greece to other production output and establish new print
Migrant smuggling is a multi-national busi- Member States which was involved in the shops.
ness. Migrant smugglers originating from over production and distribution of forged travel
122 countries are involved in facilitating the documents. In addition to providing these f ga c ann
journeys of irregular migrants to the EU. Most documents to irregular migrants, the group
migrant smuggling networks are composed Migrant smugglers frequently abuse legal
also sold these to other OCGs. The criminal channels to facilitate the entry of irregular
of various nationalities involving both EU and
network operated primarily in Greece. migrants to the EU or to legalise their stay.
non-EU nationals.
The abuse of legal channels involves a variety
Migrant smuggling networks heavily rely on of modi operandi including sham marriages,
social media to advertise smuggling services.
Migrant smugglers make use of ride-sharing
ga t n t n c nt bogus paternity, false employment contracts,
fake invitation letters, false medical visas, and
applications and P2P accommodation plat- c nt an i ntit fra false claims of being victims of trafficking or
forms to provide a cover for their smuggling Service packages offered by migrant smug- refugees.
activities. This leaves regular users at the glers now frequently include the provision
risk of inadvertently becoming facilitators by of fraudulent travel and identity documents.
unknowingly transporting or hosting irregular Fraudulent documents allow irregular mi-
migrants. grants to enter and move within the EU as
BUSINESS MODEL
Supply of fraudulent documents
COMMUNICATION DOCUMENT
TRANSPORTATION
VIA SOCIAL MEDIA FRAUD
& ACCOMMODATION
Migrant smugglers pass irregular Migrant smugglers widely rely on Document fraud has emerged as a
migrants from one network to social media and use online key criminal activity linked to the
another along the route of the platforms such as ride-sharing migration crisis.
migrants’ journey. websites, or P2P accommodation
platforms, to arrange facilitation
EU suspects typically work as services.
drivers transporting irregular
migrants within the EU to
destination countries.
52 ASSESSING ORGANISED CRIME
T T
THB for sexual and labour exploitation
includes the recruitment, transportation, T f r a r itati n he trafficking of icti ithin
harbouring and exploitation of victims. The involvement of OCGs in THB for labour the EU remains a key threat.
OCGs involved in THB typically operate exploitation is increasing in the EU. OCGs
in independent cells that deal with the cater to the growing demand for cheap labour
various stages of recruitment, transport and across many Member States and have access
exploitation. to a large number of potential victims. THB The migration crisis has resulted
Traffickers rely heavily on document fraud to for labour exploitation threatens to infiltrate in an increase in the number
the legal economy, where it lowers wages and
enable their trafficking activities. This includes
hampers economic growth. of potential victims of THB. A
the use of fraudulent identity, travel and
breeder documents as well as the abuse of THE B U SINESS MODEL
growing number of vulnerable
legal channels such as the EU visa regime for
There has been little change in the types
adults and unaccompanied
tourism, study and work visas. OCGs involved
in THB also continue to exploit asylum of industries featuring labour exploitation. minors in the EU are likely to be
provisions in order to traffic non-EU nationals Traffickers continue to target less regulated targeted y trafficker
into the EU. On many occasions, victims industries as well as those featuring seasonal
are provided with fraudulent documents to demand for workers. Vulnerable sectors
conceal their real identity and age. include agriculture, catering, cleaning,
construction, entertainment, fishing,
CR I M I N A L G A N G A CCU S E D OF
T f r a itati n hospitality, retail and transportation.
T R A F F I CK I N G OVE R 1 5 0 W OME N
The sexual exploitation of EU nationals no Traffickers take advantage of discrepancies in I N TO PR O S T I T U T I O N D I S M AN T L E D BY
longer relies predominantly on the use labour legislation to organise the exploitation A U S T R I A 33
of violence and coercion towards victims. of victims in the grey zone between legal
employment and labour exploitation. Some In November 2016, Austrian law
Some OCGs are increasingly relying on enforcement authorities with the support
threats of violence towards victims and their victims receive wages equivalent to the
minimum standard in their countries of origin. of Europol dismantled a Chinese OCG
families rather than attacking the victim.
involved in the trafficking of up to 300
Victims originating from outside the EU are However, these are far below acceptable women. Victims were lured to Austria
still routinely subjected to violence, debt salaries in countries of exploitation where
bondage, passport confiscation and other on promises of work as nannies or
they do not have sufficient resources to cover masseuses. They were provided with
forms of coercion as an integral part of their living expenses. These wage dumping
trafficking modi operandi. forged documents and brought to Austria
practices seriously undermine the legal labour
illegally. Upon their arrival in Vienna, OCG
market in countries of destination and make
it difficult for victims of labour exploitation to
members took away the victims’ IDs. The
be recognised as such. women were placed in so-called “sex
studios” owned by the OCG and forced
to work as prostitutes. After a few weeks
they were transferred to other brothels in
Austria.
for la our e loitation i he traditional trafficking flo fro rafficker often ecifically
increa ing in the a tern uro e to e tern uro e target underage icti oth
ha een re laced y ulti le and ale and fe ale to e ually
rafficker continue to target le di er e flo of icti all o er the e loit the
regulated indu trie a ell a tho e
featuring ea onal de and for
orker
ha e further increa ed
the u e of legal u ine e
that can conceal e loitation
uch a hotel nightclu and
a age arlour
rafficker continue to rely on the u e of ocial edia oice-o er- o and in tant e aging
a lication at all tage of the trafficking cycle
ink t n igrant
gg ing an trafficking in
an ing MI G R A N T S M U G G L I N G AN D H U MAN
T R A F F I CK I N G R I N G O PERAT IN G V IA
OCGs involved in THB often exploit existing T H E M E D I T E R R A N E A N 35
migratory routes to traffic victims within the
MIGRANT SMUGGLING EU. While the migration crisis has not yet
In November 2015, a joint operation
between Spanish and Polish law enforcement
had a widespread impact on THB for labour
authorities, coordinated by Europol, revealed
exploitation in the EU, some investigations
the operation of a migrant smuggling network
show that traffickers are increasingly targeting
exploiting irregular migrants from Pakistan
irregular migrants and asylum seekers in the
in restaurants in Spain. Irregular migrants
EU for exploitation. Irregular migrants in the
were forced to work long hours in appalling
EU represent a large pool of potential victims
conditions without salary, holiday or social
susceptible to promises of work even if this
security to repay their debts to smugglers
entails exploitation.
for the travel and provision of fraudulent
SHAM MARRIAGES documents. The migrant smugglers used
TRAFFICKING IN the criminal proceeds to invest in new
There has been an increasing number of
restaurants, which were also used for the
HUMAN BEINGS reports of incidents of sham marriages in
exploitation of irregular migrants.
several Member States. This increase is likely
related to the migration crisis and an increase
in the number of irregular migrants seeking to
transition to legal residence status after failed
asylum applications.
54 ASSESSING ORGANISED CRIME
SPORTS TRAFFICKING
CORRUPTION OF FIREARMS
Criminal networks use match-fixing The proliferation and availability DIV ERSION F ROM LEGAL SU PPLY
to manipulate the outcomes of sports
matches, which skews be ng odds and
of illegal firear in the e er Firearms traffickers are highly adept at
exploiting legal loopholes and differences
allows them to generate significant profits. States increases the risk of their in regulatory regimes between Member
Match-fixing in the EU primarily affects use by terrorist groups to carry States to divert firearms from legal
football games. However, match-fixers are suppliers. The reactivation of deactivated
also targeting tennis, snooker and dart out attacks in the EU. weapons and conversion of blank-firing
competitions. firearms are among the main sources
of illegal firearms trafficked in the EU.
In some cases OCGs have infiltrated
sporting clubs in order to orchestrate llegal firear are increa ingly Firearms traffickers often convert blank-
firing firearms or reactivate deactivated
money laundering schemes. accessible due to their firearms purchased from legal dealers
availability online. based in countries applying less stringent
acquisition rules such as more permissive
licensing and registration requirements.
FO OT BALL AND MON EY L AUN DERI N G
Recent terrorist attacks in the EU carried out Various con ict zones in the periphery of
In May 2016, as part of Operation by jihadist terrorists using trafficked firearms the EU have the potential to emerge as
Matrioskas, law enforcement authorities have demonstrated the lethal consequences major sources of firearms trafficked to
dismantled a Russian-speaking OCG which of the trade in illicit firearms. Several the EU.
had infiltrated football clubs and laundered incidents of violent clashes between criminal
several million euros across the EU. The gangs have highlighted that the use of illegal
OCG used middlemen to purchase football firearms remains a significant threat to EU
clubs experiencing financial pressure. The citizens.
In June 2016, Italian law enforcement
group was able to conceal their money ONLINE TRADE authorities arrested two members of the
laundering activities among the large
Firearms are frequently traded on online mafia clan ‘Ceusi’ on charges of firearms
financial transactions and cross-border
pla orms including Darknet marketplaces. trafficking. The suspects had purchased
money ows, which are not unusual
Both individual criminals and OCGs obtain over 160 decommissioned firearms
for professional football clubs. Weak
illegal firearms via online marketplaces. This from Slovakia. Some of the firearms
governance allowed the OCG to use the development has resulted in a significant were reactivated and sent to Malta in
clubs to launder money by over- or under- increase in the use of parcel and postal parcels. The Italian OCG maintained links
valuating players on the transfer market services to traffic firearms and firearm with Egyptian OCGs involved in migrant
as well as by accepting bids for television components. smuggling activities.36
rights deals.
Online trade allows individuals with no or
limited connections to organised crime to
procure firearms. These individual criminal
actors increasingly engage in the trafficking of Using post and parcel services
firearms and firearm components as part of
a CaaS business model and have emerged as is now the most common way of
key distributors of illegal firearms in the EU. trafficking firear in the
The online trade in illegal firearms via various
pla orms is set to expand further over the
coming years.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 55
CONCLUSIONS
Tackling organised crime in the The role of the SOCTA
age of technology The vital role of technology for organised
Serious and organised crime is a key
crime is reflected in the data collected RECOMMENDED
threat to the security of the EU. Criminal
groups and individual criminals continue
and analysed for the SOCTA 2017. For the
SOCTA 2017, Europol has undertaken the PRIORITIES
largest-ever data collection on serious and
to generate multi-billion euro profits
organised crime in the EU. Based on the outcome of a
from their activities in the EU each year.
Some parts of the serious and organised Europol relied on more than 2,300 comprehensive analysis of the
crime landscape in the EU have changed questionnaires contributed by Member indicators and factors detailed in
drastically in recent years - in large part States, Europol’s operational and
due to advancements in technology that strategic partners outside the EU and our
the SOCTA Methodology, Europol
have had a profound impact on the wider institutional partners as well as operational recommends key priorities to
society and economy. intelligence held in Europol’s databases to
produce the most detailed assessment of
tackle the most threatening
Technology is a key component of most,
if not all, criminal activities carried out
the nature and scale of criminal threats forms of serious and organised
by organised crime groups in the EU and
facing the EU and its Member States yet. crime. In addition to five specific
has afforded organised crime with an Based on an in-depth analysis of this criminal activities carried out
unprecedented degree of flexibility. This data and a methodology endorsed by the
flexibility is particularly apparent in the Member States, Europol identifies the key by organised crime in the EU,
ease with which criminals adapt to changes threats from serious and organised crime Europol is also recommending
in society. facing the EU today and over the coming
years.
to focus on three cross-cutting
The internet, the multitude of online
platforms and communication channels it
threats that enable or enhance
hosts have had a huge impact on society, all types of serious and
strengthening and transforming the
economy, driving innovation and shaping
organised crime.
social interaction. However, it is also a key
enabler of criminal activity and plays a role
in all types of criminality.
The impact of technology on crime,
however, extends beyond the internet and
involves all kinds of technical innovation
such as advances in drone technology,
automated logistics, and advanced printing
technologies.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 57
Synthetic drugs
Online child production in
sexual Online trade in External
the EU Excise fraud counterfeit Burglaries and borders of the Labour
exploitation theft Online trade exploitation
Trafficking of goods EU
Production Illicit waste (including
precursors and trafficking
Cyber- de/reactiva-
THREATS
pre-precursors
dependent tion)
Import of
crime MTIC fraud
cocaine to the Production of
(malware,
EU via major counterfeit Motorvehicle Secondary Sexual
cryptoware, etc.)
ports and goods in the crime movements exploitation
couriers EU
Poly-drug Investment
Distribution trafficking in fraud
including the EU Trafficking of Traditional
online Payment card Trafficking of
endangered trafficking
fraud (card-not- Large-scale counterfeit Organised Risk for labour Child
present fraud) cannabis species goods (not
Sports robberies exploitation trafficking
production and online) in the
corruption
trafficking in EU
the EU
Corruption
CROSS-CUTTING
CRIME THREATS
Extortion
ANNEX
LIST OF ABBREVIATIONS
28
Europol 2016, 3561 artefacts seized in Operation Pandora (23/01/2017),
D. Moore and T. Rid 2015, Cryptopolitik and the Darknet, p. 21
8
accessible at https://www.europol.europa.eu/newsroom/news/3561-
9
Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016, artefacts-seized-in-operation-pandora
p.47
Frontex 2017, Risk Analysis for 2017
29
p.36-37
18
Verizon 2016, 2016 Data Breach Investigation Report, p.4
Europol 2016, Internet Organised Crime Threat Assessment (IOCTA) 2016,
19
p.24
ISBN 978-92-95200-77-7
DOI 10.2813/114730
SERIOUS AND ORGANISED CRIME QL-04-17-236-EN-N
THREAT ASSESSMENT
E UROP E AN UN ION
www.europol.europa.eu
Follow us