Beruflich Dokumente
Kultur Dokumente
firearms trafficking
Cybercrime
fraud
E U R OP EAN UNION
drug trafficking
sports corruption
environmental crime
document fraud
Migrant smuggling
E UR O P EAN UN I O N
SERIOUS AND ORGANISED CRIME
THREAT ASSESSMENT
Crime in the age of technology
TABLE OF CONTENTS
FOREWORD OF THE DIRECTOR 6
INTRODUCTION 8
KEY JUDGMENTS 10
UNDERSTANDING ORGANISED CRIME 12
Dening serious and organised crime 13
Organised crime grou s (OC s) and ot er criminal actors 14
ngines of organised crime 17
Dri ers of crime 24
ASSESSING ORGANISED CRIME 26
Currency counterfeiting 28
Cy ercrime 28
Drug roduction, trafcking and distri ution 34
n ironmental crime 41
raud 42
ntellectual ro erty crime 46
Organised ro erty crime 47
eo le as a commodity 49
orts corru tion 54
rafcking of rearms 54
inks et een serious and organised crime and terrorism 55
CONCLUSIONS 56
ANNEX LIST OF ABBREVIATIONS 58
FOREWORD
OF THE DIRECTOR
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 7
I am pleased to present the European analyse and identify the key crime threats The SOCTA 2017 is a forward-looking
Union (EU) Serious and Organised Crime facing the EU today. document that both describes and
Threat Assessment 2017 (SOCTA 2017). The anticipates emerging threats from serious
Informed by its analysis of the prevailing
SOCTA 2017 is Europols flagship product and organised crime. In this edition of the
threat, the SOCTA 2017 identifies a number
providing information to Europes law SOCTA, we highlight the role of technology
of key priorities, which, in Europols view,
enforcement community and decision- in particular. Criminals have always been
require the greatest concerted action by
makers. It serves as the cornerstone of the adept at exploiting technology. However,
Member States and other actors to ensure
EU Policy Cycle for Serious and Organised the rate of technological innovation and
the most effective impact. These include
Crime. the ability of organised criminals to adapt
cybercrime, the production, trafficking
these technologies have been increasing
The Policy Cycle ensures effective and distribution of illicit drugs, migrant
steadily over recent years. Developments
cooperation between national law smuggling, organised property crime, and
such as the emergence of the online trade
enforcement agencies, EU Institutions, the trafficking in human beings (THB). In
in illicit goods and services are set to result
EU Agencies and other relevant partners addition, Europol recommends focussing
in significant shifts in criminal markets and
in the fight against serious and organised on three cross-cutting crime threats with a
confront law enforcement authorities with
crime. This is the second edition of the significant impact across the spectrum of
new challenges.
SOCTA, following its inaugural edition serious and organised crime document
released in 2013. The SOCTA 2017 delivers fraud, money laundering and the online In identifying and specifying these
a set of recommendations based on an in- trade in illicit goods and services. The challenges, Europol hopes to provide a
depth analysis of the major crime threats SOCTA 2017 also explores potential links tangible contribution to the efforts of
facing the EU. The Council of Justice and between serious and organised crime and Member States and the EU in fighting
Home Affairs Ministers will use these terrorism. serious and organised crime. I look
recommendations to define priorities for forward to Europols continued support
In 2013, Europol reported the presence
the coming four years. for and cooperation with law enforcement
of at least 3,600 internationally operating
agencies and other partners in the EU and
The SOCTA 2017 is the outcome of the Organised Crime Groups (OCGs) in the
beyond.
work of many contributors from law EU. In the SOCTA 2017, we identify
enforcement authorities in the Member approximately 5,000 international OCGs
States, in countries with strategic and currently under investigation in the EU. This
operational agreements with Europol, increase is primarily a reflection of a much
our institutional partners in the EU and improved intelligence picture. It is also
Europol. an indication of shifts in criminal markets
and the emergence of smaller groups
Europol is a key partner to the Member
and individual criminal entrepreneurs in
o ain rig t
States in meeting security challenges by Director of Europol
specific criminal activities, especially those
providing a highly developed platform for
taking place online.
the exchange of criminal intelligence as
well as analytical and operational support These developments highlight the complex
for some of the most complex international dynamics that shape the serious and
investigations in the EU to date. In drafting organised crime landscape in the EU. They
the SOCTA 2017, Europol harnessed this also emphasise the need for the continued
unique information position. and enhanced exchange of information
between law enforcement authorities
The SOCTA 2017 represents the outcome of
as part of their day-to-day business.
the largest data collection on serious and
Connecting law enforcement authorities
organised crime ever undertaken in the EU.
and facilitating the real-time 24/7 exchange
Europol has been able to use its singular
of information remains Europols core
intelligence capability as the information
business.
hub for criminal intelligence in the EU to
8
INTRODUCTION
e uro ean nion and uro ol
The European Union (EU) is a unique who share the presidency on a rotating
economic and political partnership basis. The third institution is the European
between 28 European countries.i It Commission, which represents the interests
was created in 1958 as the European of the Union as a whole.
Economic Community with the aim to
foster economic cooperation among its Europol is the EUs law enforcement
six founding partners. Since then, the agency and assists the Member States in
number of EU Member States enlarged their fight against serious international
and the economic union developed into crime and terrorism. Established as an
an organisation covering a wide range of EU agency in 20091 , Europol, or the
policy areas. The official name changed to European Police Office, is at the heart of
the European security architecture and
the European Union in 1993 to reflect the
offers a unique range of services. Europol e OC
broader cooperation on which members
partnership is based. EU law is built is a support centre for law enforcement
operations, a hub for information on The SOCTA 2017 is the most comprehensive
on a series of treaties, voluntarily and study of serious and organised crime in
democratically agreed by all Members. criminal activities as well as a centre for
law enforcement expertise. Analysis is at the EU ever undertaken. It is the outcome
These agreements set out the EUs goals in of a detailed analysis of the threat of
its main areas of activity. There are three the core of Europols activities. To give its
partners deeper insights into the crimes serious and organised crime facing the EU
main institutions involved in EU legislation: providing information for practitioners,
the European Parliament, which represents they are tackling, Europol produces regular
assessments that offer comprehensive, decision-makers and the wider public. As a
the EUs citizens and its members are threat assessment, the SOCTA is a forward-
directly elected by them; the Council of forward-looking analyses of crime and
terrorism in the EU. looking document that assesses shifts in
the European Union, which represents the serious and organised crime landscape.
the governments of the Member States The SOCTA 2017 sets out current and
anticipated developments across the
spectrum of serious and organised crime,
identifies the key criminal groups and
individuals active in criminal activities
across the EU and describes the factors in
the wider environment that shape serious
and organised crime in the EU. The SOCTA
2017 also describes the dynamics that drive
organised crime in the age of technology
and reflects on how OCGs and individual
criminal entrepreneurs seek to exploit the
latest technological innovations.
The SOCTA is the product of close
cooperation between Europol, the law
enforcement authorities of the Member
States and third parties such as EU
agencies, international organisations and
countries outside the EU with strategic or
operational agreements with Europol. The
involvement of these crucial stakeholders
is also reflected in the SOCTAs role as the
cornerstone of the EU Policy Cycle for
i
The Member States of the EU are: Austria, Serious and Organised Crime in the EU.
Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, France, Germany,
Greece, Hungary, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, and
United Kingdom.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 9
KEY JUDGMENTS
ORGANISED
CRIME GROUPS
Serious and organised crime in More than 5,000 OCGs operating
the EU features a great variety on an international level are
of criminal activities, which are currently under investigation
increasing in complexity and scale. in the EU. The number of
The profits generated by some of OCGs operating internationally
the successful OCGs and individual highlights the substantial scope
criminals active in the EU are and potential impact of serious
enormous and rival those of multi- and organised crime on the EU.
national corporations.
Criminals quickly adopt and integrate new Document fraud, money laundering and the online trade in illicit goods and
technologies into their modi operandi or build services are the engines of organised crime in the EU. Although neither
brand-new business models around them. The document fraud nor money laundering have a direct impact on most citizens in
use of new technologies by OCGs has an impact the EU, they facilitate most, if not all, other serious and organised crime. The
on criminal activities across the spectrum of online trade in illicit goods and services is expanding rapidly. Almost all types of
serious and organised crime. This includes illicit goods are now bought and sold via online platforms that offer the same
developments online, such as the expansion ease of use and shopping-experience as most legal online platforms. Depending
of online trade and widespread availability of on the type of commodity and service, this includes platforms both on the
encrypted communication channels, as well surface web and the Darknet. Data is also traded as a commodity. The online
as other aspects of technological innovation trade in illicit goods and services is foreseen to increasingly disrupt established
such as more accessible and cheaper high- criminal markets and their traditional distribution model over the next few
performance drone technology. Technology has years.
a fundamental and lasting impact on the nature
of crime.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 11
Many of the OCGs are highly The most threatening OCGs are An increasing number
flexible and display great those which are able to invest of individual criminal
adaptability in the speed with their significant profits in the entrepreneurs offer Crime-as-
which they adjust their modi legitimate economy as well as into a-Service (CaaS). The online
operandi or whole business models their own criminal enterprises, trade in illicit goods and services
to changes in the environment. ensuring business continuity enables individual criminals
Many criminal activities are and a further expansion of their to operate their own criminal
increasingly complex and require a criminal activities. The involvement business without the need for
variety of skills as well as technical in serious and organised crime the infrastructures maintained
expertise to carry out. may allow some terrorist groups by traditional OCGs.
to generate funds to finance
terrorism-related activities.
CRIMINAL ACTIVITIES
Cybercrime is a key challenge to digital The illicit drugs market remains the largest Migrant smuggling has emerged as one
economies and societies. Cyber-dependent criminal market in the EU. More OCGs of the most profitable and widespread
crime is underpinned by a mature CaaS are active in the production, trafficking criminal activities for organised crime in
model, providing easy access to the and distribution of illicit drugs than any the EU. The migrant smuggling business is
tools and services required to carry out other phenomenon. The industrial-scale now a large, profitable and sophisticated
cyber-attacks. Child Sexual Abuse (CSE) production of synthetic drugs within the EU criminal market, comparable to the
perpetrated online is increasingly profit continues to expand and cements the EU European drug markets.
driven. The growth of card-not-present as a key source region for these substances
(CNP) fraud, coupled with successful distributed worldwide. OCGs maintain
industry measures to tackle card-present complex trafficking operations cooperating
(CP) fraud, has resulted in CNP fraud with OCGs on a global scale to orchestrate
accounting for 66% of total card fraud value. the wholesale importation of illicit drugs
into the EU. Within the EU, the majority of
OCGs involved in the distribution of illicit THB for labour exploitation is increasing and
drugs deal in multiple illicit drugs, also is expected to continue to expand. OCGs are
called poly-drug trafficking. expected to exploit the presence of a large
number of potentially vulnerable persons
in the EU following the migration crisis.
Organised property crime encompasses a Labour exploitation threatens to undermine
range of different criminal activities carried the legitimate labour market lowering
out predominantly by highly mobile OCGs wages and impeding economic growth.
operating across the EU. A steady increase
in the number of reported burglaries over
recent years is a particular concern in many
Member States.
UNDERSTANDING
ORGANISED CRIME
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 13
5,000
The OCGs and individual criminals The criminal markets involving illicit drugs,
operating in the EU are highly diverse. trafficking of human beings and migrant
They range from large traditional OCGs smuggling attract the largest numbers
international OCGs
to smaller groups and loose networks of OCGs and continue to generate the
currently under
supported by individual criminals, who are greatest profits among the various criminal
investigation hired and collaborate ad hoc. More than markets in the EU. However, emerging
5,000 OCGs operating on an international crime phenomena such as the online trade
level are currently under investigation in in illicit goods and services may eclipse
>180
the EU. This figure does not necessarily these markets in size and profits in the
reflect an overall increase in organised future. The online trade in illicit goods
crime activity in the EU compared to 2013, and services is no longer merely a modus
nationalities
when Europol reported on the activities of operandi, but an expanding, highly dynamic
involved 3,600 internationally operating OCGs in the and substantial criminal market itself.
EU. This increase is primarily a reflection
Over the past few years, criminals of
of a much improved intelligence picture.
more than 180 nationalities were involved
The increase also points to the emergence
in serious and organised crime in the
of smaller criminal networks, especially in
EU. The majority of OCGs operating on
criminal markets that are highly dependent
an international level are composed of
on the internet as part of their modi
members of more than one nationality.
operandi or business model. Overall, the
Nonetheless, the majority of the suspects
number of OCGs operating internationally
(60%) involved in serious and organised
highlights the substantial scope and
crime in the EU are nationals of a Member
potential impact of serious and organised
State.
crime on the EU.
tructure
The diversity of the criminal landscape and the emergence
actors operating in the EU is of more groups and looser
also reflected in the structures networks detailed in the
of the OCGs. 30% to 40% of SOCTA 2013 did not affect 30-40%
the OCGs operating on an all criminal markets. The LOOSE
international level feature fragmentation of criminal
loose network structures. An markets was particularly
approximate 20% of these pronounced in relation to highly
networks only exist for a short cyber-dependent criminal
period of time and are set up activities. Around these types
Most OCGs are organised
to support specific criminal of activities, an increasing
HIERARCHICALLY
ventures. Hierarchically number of individual criminal
20%
structured OCGs continue to entrepreneurs come together
SHORT TIME
dominate traditional criminal on an ad hoc basis for specific
VENTURES
markets. criminal ventures or to deliver
CaaS.
The fragmentation of the
serious and organised crime
24%
up to ve
members
Com osition
76%
six or more 60% oforganised
the suspects involved in serious and
crime in the EU are EU nationals.
members
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 15
cti ities
More than one third of the OCGs active in the
EU are involved in the production, trafficking Involvement of OCGs active in the EU in different crime areas
or distribution of drugs. Other key criminal
activities for OCGs in the EU include organised
property crime, migrant smuggling, THB and
excise fraud.
Organised
property
INTERNATIONAL crime
Excise fraud
Migrant
smuggling
7 out of 10
OCGs are typically active in more than three countries
45%
criminal activity. The share of these poly- crime. Criminals are increasingly adapting
criminal groups has increased sharply the supply chain models of global online
of the OCGs reported for the SOCTA compared to 2013. retailers.
2017 are involved in more than one OCGs also often engage in more than The concept of CaaS has been an emerging
criminal activity one criminal activity to mitigate risks, feature of various criminal markets for
Many OCGs have expanded their reduce operational costs and increase some years. However, increasingly OCGs
crime portfolio in response to the profit margins. The OCGs involved in the also openly advertise ad hoc opportunities
sustained high level of demand for trafficking of illicit goods are the most for individual criminals to provide them
smuggling services during the poly-criminal groups in the EU. These with support or expertise for specific
migration crisis.
groups typically traffic more than one illicit criminal ventures.
commodity such as counterfeit goods or
OCGs operating on an international
different types of illicit drugs.
level are typically active in more than
Sharing Economy Many OCGs are highly flexible and able three countries (70%). A limited number
An increasing number of individual criminal to shift from one criminal activity to of groups is active in more than seven
entrepreneurs come together on an ad hoc another or to add new criminal activities countries (10%).
basis for specic criminal ventures or to to their crime portfolio. In many cases,
deliver CaaS OCGs operate on an on-demand basis
and only become active once new profit-
opportunities emerge.
Since 2012, Europol has been supporting the German-led ISEC project
on Strengthening cross-border operational cooperation in the fight
against mobile organised crime groups (MOCGs) from the Baltic Sea
Region, including Russian-speaking MOCGs. The project has resulted
in the dismantling of more than 100 OCGs. A total number of 575
arrest warrants were issued. The damage caused by the MOCGs
targeted by this project exceeded EUR 65 million. These MOCGs mainly
carried out organised property crime, drug trafficking, document
counterfeiting and money laundering.
16 UNDERSTANDING ORGANISED CRIME
Corru tion
OCGs use corruption to infiltrate public
and private sector organisations relying OBJECTIVES OF CORRUPTION
on bribery, conflicts of interest, trading in
influence and collusion in order to facilitate
their criminal activities. Corruption distorts
legitimate competition and erodes public
trust in authorities and legal systems.
MS
cross-cutting criminal threats enable and facilitate most, if not all,
TO
other types of serious and organised crime. The business models
US
NS C
of OCGs active across the spectrum of serious and organised crime
IO S,
AT ER
rely on document fraud, money laundering and online trade to
AR RD
CL T O
maintain their criminal enterprises.
DE R
D PO
AN N S
ES TRA
ING
ITY DRIV
IC NT
T
EN DS ,
IF LE
D ID AR
AT
RT DU
L AN , ID C
CE AU
E
RAV RTS
FR
E NT T SSPO .)
A
UL TS (P , ETC
UD S
FRA UMEN , VISA
C S
DO ENSE
LIC
CERTIFICATES,
MENTS (BIRTH
BREEDER DOCU NTRACTS OR
RDS, WORK CO
MARRIAGE RECO )
DOCUMENT INVITATIONS TO
STAY IN TH E EU
DRUGS
ILLICIT
ONLINE TRADE
FIREARMS
IN ILLICIT
COUNTER
GOODS AND
SERIOUS SERVICES FRAU
DULE
FEIT GOO
DS
AND COU
NTE
NT DO
C UMEN
TS
ORGANISED
R FEIT
CUR
REN
CY
CRIME
MONEY
LAUNDERING
CAS
H SM
UGG
MONEY L LING
AUNDER
IN G SYNDIC
ATES
OPERATION SNAKE
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 19
MONEY LAUNDERING
Most common methods
CASH SMUGGLING
by couriers or using post
and parcel services TRADE-BASED MONEY
LAUNDERING
False invoicing and forged ID
documents are used by shell
companies owned by OCGs to
conceal criminal funds
DOCUMENT FRAUD
The use of fraudulent Document fraud is a key High-quality counterfeit Fraudulent documents are
documents in the EU has enabler of all types of criminal documents are primarily increasingly traded online and
signicantly increased. It activity as well as terrorism. produced by highly specialised trafcked using post and parcel
represents a signicant threat Document fraud is also counterfeiters. services.
to the EU. expected to emerge as one of
the fastest growing criminal
markets over the coming years.
reeder documents
DO CU M ENT FORG E RY AN D MI G RAN T SMUG G LI N G 6
Breeder documents are documents that are used to obtain other
In May 2016, Greek and Czech law enforcement authorities arrested forms of legitimate identification for the purpose of establishing
several suspects involved in the forgery of documents and migrant a false identity. Fraudulent breeder documents are typically used
smuggling as part of an international investigation supported by to apply for genuine travel and identity documents and driving
Europol. The forged documents were subsequently provided to licences. Birth certificates, marriage records, work contracts or
irregular migrants to enter the EU or to legalise their stays there. The invitations to stay in the EU are forged in order to obtain visas,
investigation in Greece highlighted the structure and the hierarchy residency or work permits on false grounds.
of the Athens-based network. The fees for the forged documents
ranged from EUR 100 to EUR 3,000 per piece depending on the
quality, type and country of issue. The documents forged by the
criminal group included passports, national ID cards, visas, driving
licences, asylum seekers registration cards and residence permits.
FORGED VALID
BIRTH CERTIFICATE VISA
MARRIAGE RECORD RESIDENCY PERMIT
WORK CONTRACT WORK PERMIT
INVITATION TO STAY IN THE EU
22 UNDERSTANDING ORGANISED CRIME
The online trade in illicit goods cultural goods, excise tobacco, firearms, rade on t e surface e
heroin, hormonal substances, specimens
and services has been expanding of endangered species, stolen vehicle parts The distribution of illicit commodities via
steadily over recent years. It and accessories, synthetic drugs and new online platforms has soared in recent years
and is expected to continue to increase
is expected that this trade will psychoactive substances (NPS), as well as
steadily over the coming years. Online
compromised payment card data are sold
continue to grow rapidly for and purchased online. trade offers the opportunity to reach a
the foreseeable future and that huge number of potential customers. Illicit
It is not only illicit commodities that are goods purchased online are predominantly
online platforms will emerge as traded online, but also criminal services. trafficked using postal and parcel services.
a key distribution platform for all The expanding CaaS business model
provides customers with access to a wide
types of illicit goods in the EU. range of criminal services. A prime example
of this is cybercrime, where customers T H E S A L E O F D R U G S VI A PH OTO-
can access such services as malware S H A R I N G PL A T F O R MS
coding, Distributed Denial of Service
The Darknet is a key facilitator (DDoS) services, bulletproof hosting and Photo-sharing applications and platforms
for various criminal activities anonymisation services, botnet hire and are popular with a huge number of users.
These services allow users to create
including the trade in illicit money laundering.
communities around shared interests using
drugs, illegal rearms and Vendors often attempt to hide illegal hashtags. Drugs dealers and users make use
malware. Darknet marketplaces goods among legal products on online of these platforms to form communities to
platforms on the surface web. In some discuss, exchange information and trade
are becoming increasingly de- cases, surface web vendors redirect their various types of illegal drugs. Potential
centralised. customers to mirror sites on the Darknet or customers scroll through pictures of
advertise their products using false product advertised products and then contact the
designations or descriptions. dealer privately using direct messaging
Online platforms operating in the legal The online market caters to dealers who functionalities. The eventual transaction
economy have had a profound impact on buy in bulk for re-sale as well as individual takes place either face to face or via online
business models, shopping experiences and users. The diminishing reliance on access payment and delivery by mail.
customer expectations. The multiplication to street networks of consumers of illicit
of sales platforms makes online trade commodities challenges the established
easier, more accessible and cheaper. This business models in many criminal markets.
development has been mirrored in the e Darknet
online trade in illicit goods as criminals, like
legitimate traders, look to opportunities The Darknet is a distributed anonymous
online to grow their businesses. network within the deep web that can only
be accessed using software such as The
Virtually all illicit commodities are now Onion Router (TOR), I2P and Freenet. While
traded online either on dedicated criminal As of January 2017, the TOR these tools were ostensibly developed
online marketplaces or by exploiting
network had over 1.7 million for the purpose of legitimately protecting
otherwise legal online platforms. The freedom and privacy, confidential business
number of goods on offer and frequency
directly connecting users, and
hosted over 60,000 unique onion activities and relationships, they can
with which new products become available equally be used by criminals for the same
indicates that the online trade in illicit domains.7 In one study, almost purpose - to conceal their identity and/or
goods is thriving and highly dynamic. 57% of active sites could be the hosting location of websites, forums
Commodities such as cannabis, cocaine, classied as related to some and markets, collectively referred to as
counterfeit currency, counterfeit medicine, form of illicit activity.8 hidden services.9
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 23
Firearms traffickers use Darknet marketplaces to sell illegal firearms to private individuals, It is estimated that the top 1% most
members of OCGs and terrorists based in the EU. In December 2016, Slovenian law successful vendors are responsible
enforcement authorities, with the support of Europol, arrested two suspects accused of
for 51.5% of all transactions on Dark
selling various live firing weapons including automatic rifles, hand and smoke grenades as
well as ammunition via a prominent Darknet marketplace. The firearms were paid for in markets.11 Goods and services offered
Bitcoin. on the Darknet are available to anyone,
be it an individual user, an OCG or
terrorist group.12
DRIVERS OF CRIME
Drivers of crime shape the nature and
impact of serious and organised crime
eo olitical conte t egal usiness structures
activities.13 They include facilitating factors The serious and organised crime landscape OCGs exploit various legal business
and vulnerabilities in society which create in the EU is fundamentally affected by structures and professional experts to
opportunities for criminals. the geopolitical situation in and around maintain a facade of legitimacy, obscure
Europe. The impact of conflicts on the criminal activities and profits, and to
ec nology periphery of the EU, such as in Libya and perpetrate lucrative and complex crimes.
Syria, on serious and organised crime Legal business structures allow OCGs to
in the EU has already materialised and operate in the legal economy and enable
will continue to influence crime. Armed them to merge legal and illegal profits.
conflicts and poverty are the most
significant push factors for migrants
travelling to the EU. The emergence of new
For almost all types of organised conflicts or destabilisation of countries
crime, criminals are deploying and on the periphery of the EU would sustain
the migration flow to the EU. Armed
adapting technology with ever
conflicts close to the EU also entail the
greater skill and to ever greater risk of returning foreign fighters as well
effect. This is now, perhaps, the as the large-scale trafficking of firearms
greatest challenge facing law originating from these regions.
enforcement authorities around the
world, including in the EU.
e
Technological innovation continues to
shape society and the economy, and ey locations for crime
by extension the serious and organised
crime landscape in Europe. Criminal Key locations for crime feature well-developed transport
actors in the EU display a high degree of
and communication infrastructure. These locations
adaptability and creativity in exploiting
and employing new technologies. While are used to organise the global distribution of illicit
not all criminal activities are driven by commodities.
technological developments, the internet
OCGs hide illicit goods among legal commodity flows, which are
and ever-increasing connectivity have an
increasing in speed and volume and almost impossible to check
impact on virtually all types of serious and
thoroughly.
organised crime. Innovation in technology
and logistics increasingly enable OCGs to Criminal groups will take advantage of weaknesses in new
commit crime anonymously, anywhere and technologies, such as automated transport systems, and exploit gaps
anytime without being physically present. in the legal frameworks regulating them.
The Internet of Things is constantly Key locations for crime are characterised by several different factors:
expanding. Connectivity of all types of the presence of efficient transport infrastructures, proximity to or
devices, including phones and appliances, connections with source countries and consumer markets, access to
is increasingly a reality in households and business and investment opportunities, as well as demand for illicit
businesses across the EU. However, these commodities or services.
devices remain vulnerable to intrusion and
criminals are already deploying techniques
to compromise these devices in order to
gain personal and financial information and
confidential data on business transactions.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 25
CURRENCY COUNTERFEITING
The production of counterfeit currency requires varying degrees of
sophistication depending on the currency and level of quality of the
resulting counterfeits. Counterfeit banknotes of various currencies
are traded online on surface web and Darknet marketplaces.
Consequently, counterfeit currency is increasingly trafficked using
parcel services.
While the production of counterfeit currency is currently not a
major threat to the stability of the euro, the common European
currency remains popular with counterfeiters. The most commonly
counterfeited euro banknote denominations are the EUR20 and
EUR50 notes.14 In 2016, the European Central Bank (ECB) decided
to halt the production of EUR500 banknotes by the end of 2018
in an effort to fight money laundering as well as the production of
counterfeit euro banknotes.
CYBERCRIME
C D D C O PE R A T I O N A VA L A N CH E 15
A mature CaaS model underpins cybercrime, providing easy access to On 30 November 2016, after more than
four years of investigation, the Public
the tools and services required to carry out cyber-attacks. Prosecutors Office Verden and the Lneburg
Police (Germany) in close cooperation with
Cryptoware (ransomware using encryption) is a signicant threat to the United States Attorneys Office for
the Western District of Pennsylvania, the
the EU, targeting not only citizens but increasingly public and private Department of Justice and the FBI, Europol,
sector organisations alike. Eurojust and global partners, dismantled an
international criminal infrastructure platform
known as Avalanche. The Avalanche network
Networks intrusions for the purpose of illegally acquiring data was used as a delivery platform to launch
have signicant impact globally, resulting in the loss of intellectual and manage mass global malware attacks
and money mule recruiting campaigns. The
property and the compromise of mass amounts of data which can be monetary losses associated with malware
used for further criminality including fraud and extortion. attacks conducted over the Avalanche
network are estimated to be in the hundreds
Cyber-dependent crimes are offences that can only be committed using a computer, of millions of euros worldwide, although
exact calculations are difficult due to the
computer networks or other form of information communications technology. Cybercrime
high number of malware families managed
is a global phenomenon affecting all Member States and is as borderless as the internet
through the platform. The global effort to
itself. The attack surface continues to grow as society becomes increasingly digitised, with take down this network involved the crucial
more citizens, businesses, public services and devices connecting to the internet. support of prosecutors and investigators
from 30 countries. The operation marks the
largest-ever use of sinkholing to combat
botnet infrastructures and is unprecedented
in its scale, with over 800,000 domains seized,
sinkholed or blocked.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 29
85%
of internet users feel the
risk to become a victim of
cybercrime
CRYPTOWARE
How it works
The proceedings
can be used for
Means of infection any other criminal
activity
Compromised websites,
fake mobile apps, email
attachments
Devices at risk
Computers and
mobile devices
O C D O O (C )
While neither offline nor online CSE meet the Darknet dedicated specifically to the
the criteria to be considered organised production, sharing and distribution of
elf enerated ndecent aterial
crime this is still a high priority crime due CSEM. Typically this refers to services on ( )
to the degree of physical and psychological the TOR network. Peer-to-peer (P2P) file
There is a growing trend in the production
damage to one of societys most vulnerable sharing applications are the preferred
of Self-Generated Indecent Material
groups children. method of exchanging CSEM.
(SGIM) - typically teens or pre-teens taking
indecent images of themselves to be
Online and offline child sexual exploitation Commercial C shared privately with a partner or someone
are often considered two different crime
areas. However, a number of offenders are Children are sexually exploited largely to they believe they can trust, for example
involved in both. There are indications that satisfy the sexual appetites of those with a in grooming scenarios. Subsequently,
this is the case for about 30% of offenders sexual interest in children. However, there these images can be distributed either
in possession of CSEM. is a growing trend in the production of accidentally or maliciously without the
CSEM for financial gain. A particular activity owners consent.
The increasing global availability of associated with commercial production of
broadband internet and internet-enabled CSEM is that of Live Distant Child Abuse e ual e tortion
devices continues to fuel the growing (LDCA). LDCA is a significant threat in
number of both offenders and victims in Often associated with the production of
this area of criminality. LDCA involves a
this area. While the same can be said of any SGIM is the growing practice of sexual
perpetrator paying to direct the live abuse
number of crime areas, this phenomenon is extortion, whereby an offender uses
of children on a pre-arranged specific time-
a major contributor to online CSE. an explicit image of a minor - obtained
frame through video sharing platforms.
incidentally or through coercion or
The internet provides offenders and deception - to further coerce or extort the
potential offenders with an environment in child into either producing more material
which they can operate with an enhanced or engaging in further online or even offline
level of safety and anonymity. In particular, abuse. In some cases the perpetrator
there is a growing number of forums on alternatively seeks financial gain.19
32 ASSESSING ORGANISED CRIME
ID THEFT AND
PAYMENT CARD
FRAUD
STEP 2
Your login credentials,
bank account details,
credit card numbers and
STEP 1 other personal information
A fraudster uses malware and are stolen
social engineering to access
your computer
STEP 3
Your data is sold on
the Darknet
STEP 4
OGCs use your compromised
ID and nancial data to
support their criminal
activities
LIBYA
ibya is emerging as a ne
distribution hub for cannabis
resin trafficked to the E across
the Mediterranean Sea.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 35
CANNABIS
Cannabis remains, by far, the most widely EU is Morocco from where it is trafficked to
consumed illegal drug in the EU.23 Cannabis the EU primarily by sea and road transport.
is distributed on EU markets as cannabis Cannabis resin originating from Morocco is R O S E O F T H E WI N D S
I N T E R N A T I O N A L O PE R AT ION AGAIN ST
resin and herbal cannabis. In recent years, increasingly smuggled to the EU across the
D R U G T R A F F I CK I N G 24
herbal cannabis has been increasingly Mediterranean Sea departing from Libya.
popular with consumers, which has led Cannabis resin shipments are transported In December 2016, a multinational police
to an increase in the production and across the Mediterranean Sea to the team including Europol announced the
availability of herbal cannabis within the EU Spanish coast using high-powered vessels arrest of a major Moroccan drug kingpin.
and in countries close to EU markets. where they are dropped into the sea and The work that led to this arrest began in
retrieved by OCGs on local fishing vessels April 2016. The Moroccan national had
Growing equipment, seeds and other raw
or pleasure boats using GPS signalling orchestrated a multi-tonne drug delivery.
materials used for cannabis cultivation
devices. This is the latest successful result achieved
in the EU are readily available online and
by JOT Rose of the Winds. Approximately
often originate from the Netherlands. The
one week prior to his apprehension,
indoor cultivation of herbal cannabis in the
the Spanish Guardia Civil, supported by
EU is expected to further expand over the
Europol, the French Direction Nationale
coming years with new growing techniques
and increasingly sophisticated growing The market for cannabis du Renseignement et des Enqutes
Douanires and the Italian Guardia di
technologies being used by OCGs in order remains by far the Finanza, localised and intercepted a
to increase harvest yields and profits.
Outdoor cultivation of herbal cannabis largest drug market in merchant vessel flying the flag of Panama.
The ship was subsequently escorted to the
remains limited compared to the indoor the EU. port of Almeria, where a thorough search
cultivation of cannabis.
revealed the illegal cargo of 19.6 tonnes of
Albania remains the main source of herbal cannabis resin. The crew were arrested and
cannabis trafficked to the EU. The main the shipment was seized. The investigations
source of cannabis resin consumed in the also revealed a poly-crime involvement of
the transnational organised crime networks
active in large-scale drug trafficking in the
Mediterranean Sea. Namely, concrete and
recurrent links with migrant smuggling and
cocaine trafficking have been ascertained.
36 ASSESSING ORGANISED CRIME
CANNABIS HERB
roduction, trafcking and
distribution NETHERLANDS
Main distribution hub
SPAIN
Distribution hub
MOROCCO
Main source
LIBYA
Distribution hub
CANNABIS
eans of transportation Trafcking to E
COURIER PLEASURE BOAT SPEED BOAT CONTAINER LORRY SMALL AIRCRAFT
Trafcking within E
COURIER PRIVATE CAR BUS LORRY SMALL AIRCRAFT
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 37
COCAINE
Cocaine is primarily produced in Colombia, Large shipments of cocaine are trafficked in
Peru and Bolivia and trafficked to the EU containers hidden among legal goods or as O PE R A T I O N F U L E CO
via other South American countries such as part of the rip-on/rip-off modus operandi. Brazil is among the main countries of
Brazil, Venezuela, Argentina, the Caribbean Brazil is a key point of departure for departure for couriers trafficking cocaine
Sea region and West Africa. Over the last cocaine couriers travelling directly to the to the EU. This has been confirmed by
two years, the production of cocaine in EU. The United Arab Emirates (UAE) and the results of Operation Fuleco, an effort
Colombia has intensified significantly. destinations in East Africa have emerged by Member States supported by Europol
An increase in the production output in as hubs for cocaine couriers travelling to targeting cocaine couriers arriving to the
Colombia will likely impact on the EU in the EU. Cruise ships departing from the EUs major airports. During Operation
the form of intensified trafficking activity Caribbean Sea region are increasingly being Fuleco, nearly 200 cocaine couriers were
as well as greater availability of cocaine on used to traffic cocaine to the EU. arrested and almost 500 kilograms of
drug markets in the Member States. cocaine seized in the Netherlands, Spain,
The trafficking modi operandi associated More OCGs are involved Portugal, the United Kingdom, France,
Belgium, Germany and Ireland. Operation
with the trade in cocaine have largely
remained the same. Cocaine is typically
in cocaine trafcking Fuleco took place in June and July 2014
trafficked as part of large shipments in than any other criminal and involved 12 Member States including
Austria, Belgium, Bulgaria, the Czech
containers or in smaller quantities by
couriers.
activity in the EU. Republic, France, Germany, Ireland, the
Netherlands, Romania, Spain, Sweden and
the United Kingdom.
COCAINE
roduction, trafcking and
distribution Main entry points in the EU
NETHERLANDS
BELGIUM
PROFITS SPAIN
5.7
BILLION EUR / YEAR
Signicant increase in
production in Colombia may
result in intensied trafcking Means of
activity to the E . transportation
Trafcking to E
COLOMBIA
Trafcking within E
PERU
Main producers
PARCEL CONTAINER LORRY SMALL AIRCRAFT
BOLIVIA
HEROIN
Afghanistan remains the leading producer potential disruptions to trafficking activities
of heroin trafficked to the EU. The from Afghanistan further laboratories may
The Balkan route
production output of opium and heroin in emerge in the EU in the future. Heroin remains the main entry
Afghanistan is very high and is projected to is also available on online marketplaces route for the trafficking
remain so for the foreseeable future. and is occasionally distributed across the
EU in small quantities via post and parcel of heroin into the EU.
Production of heroin remains rare in
services.
the EU. However, depending on the
development of the demand for heroin and
HEROIN
ro uction trafficking an
distribution
NO
RT
HER
NR
OU
TE
PAKISTAN
Main producer
SOUTHERN ROUTE
SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016
Means of transportation
rafficking to
LORRY
rafficking ithin
LORRY
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 39
SYNTHETIC DRUGS AND The market for synthetic The production capacity Over the last ve years,
NEW PSYCHOACTIVE drugs continues to be the of synthetic drug 419 new NPS were
SUBSTANCES most dynamic of the drug laboratories has increased detected in the EU for the
Production, trafcking and markets in the EU. signicantly in recent rst time.
distribution years.
Methamphetamine
Amphetamine
MDMA
NETHERLANDS
POLAND
BELGIUM
SOURCE: EMCDDA & EUROPOL EU DRUG MARKETS REPORT 2016
CZECH
REP.
to UNITED STATES
SLOVAKIA to AUSTRALIA
Means of transportation
recursors and re recursors The great quantities of MDMA and The production of synthetic drugs
amphetamine produced by Dutch OCGs are generates large quantities of highly toxic
OCGs producing synthetic drugs in the
not solely intended for distribution in the waste. OCGs dump this waste away
EU continue to be highly flexible and
EU. The MDMA and amphetamine output from production laboratories to conceal
will remain so in the future. They are
from production in the Netherlands and their location. Dump sites often remain
quick to adopt alternative precursor and
Belgium is trafficked to destination markets contaminated for a significant period
pre-precursor substances in reaction to
around the world. Australia remains of time and their recovery is costly. The
any shortages in established precursor
among the most significant destination dumping of toxic waste in public places
substances. China remains a major
markets outside the EU for synthetic drugs also entails significant risks for the health
supplier of pre-precursor substances and
produced in the Netherlands and Belgium. and safety of citizens. In recent years, the
essential chemicals as well as hardware and
In some cases, large shipments of synthetic number of dump sites discovered in the EU
glassware for synthetic drug laboratories in
drugs are trafficked to destinations outside has been increasing. Dump sites are most
the EU.
the EU in maritime shipping containers. frequently discovered in the Netherlands
Some OCGs have specialised in the There has been a significant increase in and Belgium.
procurement and production of pre- the amount of MDMA trafficked from the
precursor and precursor substances Netherlands to the United States over the
supplying OCGs producing and distributing last two years.
synthetic drugs in the EU.
NPS
NPS continue to be produced in China and,
to a lesser degree, India and trafficked to
the EU in large quantities. NPS production
in the EU is largely limited to packaging and
re-selling of imported substances. However,
some limited NPS production is thought to
take place in the EU.
CH I L D R E N BU R N T BY D U M P E D
WA S T E F R O M S Y N T H E T I C DRU GS
PR O D U CT I O N
O P E RATI ON ALI MAYA
In August 2015, four children and
In March 2016, Spanish law enforcement
accompanying adult suffered severe burns
authorities in cooperation with other
to their legs after coming in contact with
Member States and supported by Europol C O N TAI N E R S E I Z U R E O F 2 . 8 TO N N E S chemical waste dumped by suspected
were able to dismantle a network O F MDMA A N D ME T H A MPH E TA M I N E
VALUED M O R E T H A N U S D 1 . 5
synthetic drug producers in Belgium.
importing and distributing large quantities
B I L LI O N 25
Some of the waste produced as part of the
of dangerous NPS in the EU. This network
manufacture of synthetic drugs is highly
used various companies to import and
In November 2014, Australian law dangerous. Drug producers frequently
sell these substances, especially synthetic
enforcement authorities seized a dump this type of waste away from their
cannabinoids from China, generating
maritime shipping container holding laboratories in order to disguise their
significant profits. Coordinated action in
approximately 2.8 tonnes of MDMA locations.
March 2016 involving house searches at
and methamphetamine. The load was
four locations resulted in the seizure of
estimated to have a street value of more
HORMONAL
550 litres of acetone, 75,000 envelopes
than EUR 1.4 billion (USD 1.5 billion).
used for packaging different NPS brands,
At the time, the value and size of the
NPS worth more than EUR 1.5 million. This
SUBSTANCES
seizure was unprecedented. The container
investigation highlights the profits involved
arrived in Australia from Europe and was
in the distribution of NPS.
seized following an intelligence operation.
The seizure led to the arrest of several There is a growing market for illegal
individuals in Australia and Australian hormonal substances in the EU. These
law enforcement authorities suspect substances are both trafficked to and
the involvement of several OCGs in the illegally produced in the EU.
production, trafficking and intended Hormonal substances trafficked to the EU
distribution of this shipment. This seizure typically originate from China, India and
highlights the scope of the trafficking of Thailand. However, over the last few years
synthetic drugs from the EU to destination production facilities for illicit hormonal
markets around the world. substances have also been discovered in
the EU.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 41
ENVIRONMENTAL CRIME
Environmental crime covers a diverse exportation, placing on the market or use
range of different offences including the of ozone-depleting substances.
improper collection, transport, recovery
Environmental crime is characterised by its
or disposal of waste, the illegal operation
impact on the natural environment. The
of a plant in which a dangerous activity
environmental impact manifests itself in
is carried out or in which dangerous
increasing levels of pollution, a degradation
substances or preparations are stored, the
of wildlife, a reduction in biodiversity and
killing, destruction, possession or trade of
the disturbance of ecological balance.
specimens of protected wild fauna or flora
Environmental crime puts public health at
species, and the production, importation,
risk.
ILLICIT WASTE
TRAFFICKING
The use of legal business structures for
illicit waste trafficking activities by criminal
TRAFFICKING OF
actors are an inherent feature of this crime
area. In many cases, criminal actors and ENDANGERED
legal businesses are indistinguishable from
one another. As part of this development,
criminals involved in illicit waste trafficking
SPECIES I VO RY T R A F F I CK I N G
have moved towards the more complex The trafficking of and trade in endangered In November 2016, Austrian law
business model of illicit waste management species involves the collection or enforcement authorities seized 560
rather than just illegally dumping waste. processing of animals and plants protected kilograms of trafficked ivory, the
Illicit waste traffickers now operate along by national and international regulations. equivalent of 590 elephant tusks. Ivory
the entire waste processing chain, heavily The Convention on International Trade in is worth more than EUR 1,000 (USD
relying on the use of legal business Endangered Species of Wild Fauna and 1,000) per kilogram on the Austrian
structures for their activities. Flora (CITES) provides the international black market. German law enforcement
framework for the protection of authorities seized 1,200 kilograms of
The trafficking of illicit waste typically endangered species and aims to ensure
involves the use of fraudulent documents. ivory at a Berlin airport, Germany, in
that international trade in specimens of May 2016. Raw and manufactured
wild animals and plants does not threaten ivory were falsely declared and
their survival. destined for Vietnam.
The EU is primarily a transit region
for endangered species trafficked to
destination markets in Asia and North
America. The most commonly trafficked
species and wildlife products trafficked
from, to and via the EU include glass
eels, reptiles, exotic birds, pangolin, fish,
narwhal meat, shells, corals, date mussels,
timber and ivory.
The number of OCGs involved in the
trafficking of and trade in endangered
species is low, but believed to be
increasing. The OCGs involved are highly
specialised and typically only focus on this
specific activity.
42 ASSESSING ORGANISED CRIME
FRAUD
EXCISE FRAUD
Alcohol, cigarettes and mineral oils are FUEL FRAUD
subject to excise duty upon production in,
or on import to, the EU. OCGs use various Fuel fraud is a growing phenomenon
modi operandi to avoid excise duties and and typically involves base-oil fraud,
generate significant profits selling both
genuine and counterfeit excise goods at
also called designer fuel fraud and fuel
laundering. This type of fraud requires INVESTMENT FRAUD
lower prices than their licit equivalents. significant expertise, which is usually only
Excise tax fraud is driven by legislative available from trained chemists or similar Investment fraud schemes generate
professions.
differences and varying excise tax rates huge prots. One investigation
applied by different jurisdictions.
revealed estimated prots of up to
EUR 3 billion generated by one OCG.
Excise goods are increasingly offered
and bought online. Successful investment fraud schemes
typically use various social engineering
techniques to operate. Fraud schemes
relying on social engineering are
UNDE RSTAND I NG EXC I S E FRAUD particularly hard to counter.
ABUSE OF DUT Y SUSPE NSIO N SC HE M E S
The abuse of duty suspension schemes rates as the intended destination of the What is social engineering?
are the main modi operandi used to trafficked goods. Accomplices in the
avoid the payment of excise duties on declared country of destination, such as Social engineering techniques are a key
alcohol products and are also increasingly corrupt warehouse employees, confirm element to many different types of fraud.
used to avoid excise duties on tobacco receipt of the goods. However, in reality Social engineering is the use of deception
products. These modi operandi involve the goods are exported to countries to manipulate individuals into divulging
the exploitation of the EU Excise applying high excise rates. The goods confidential or personal information that may
Movement Control System (EMCS), a appear legitimate as documents certify be used for fraudulent purposes.
computerised system registering the that any excise obligations due were paid.
movement of excise goods within the EU, If the product originates from a country
and the T1 procedure, which is applied applying high excise rates, the goods O PE R A T I O N BA T E O
for excise goods under suspension often do not leave the country at all and
schemes imported from outside the EU, the movement of the goods is purely In 2015, law enforcement authorities in
by falsely declaring the real destination virtual. the EU launched an investigation into an
and quantities of excise goods imported OCG with ties to Germany, Portugal and
In other cases, traffickers file an Spain. This OCG operated a sophisticated
into the EU.
application for the transfer of one load pyramid fraud scheme offering investments
How does it work? and use a duplicate of the transport into a music sharing platform and other
authorisation to import multiple loads online services. The OCG used various front
In relation to alcohol products, as part
without paying excise duties. companies. The investigation was able to
of the import process for the EMCS and
the T1 procedure, criminals declare a identify more than 50,000 victims in 34
Member State which applies low excise countries. Overall, the OCG was able to
generate an estimated profit of more than
EUR 3 billion.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 43
Criminals orchestrate various investment fraud schemes. The most common schemes
encountered in the EU include:
Fraudsters operating Boiler room As part of Ponzi schemes, fraudsters Pyramid schemes operate on the same
schemes use cold-calling to contact attract a group of initial investors with model as Ponzi schemes. However, the
their victims and pressure them into promises of very high returns in a very initial investors are actively involved and
investing in non-existent or very low- short time. The fraudster starts to repay are required to recruit new investors in
value stocks. Fraudsters often use false the initial investors to attract more victims order to get profits.
documents and certificates to present using funds accrued from additional
their company and the offered stock as investors. In reality, the money is not
legitimate. invested and the fraudsters ultimately
disappear with the funds. The money is
laundered through multiple bank accounts
held by various front companies in
different jurisdictions.
STEP 1
Fraudster calls posing as an IT
STEP 4 specialist from the employees
company (or as a bank employee)
The data/access obtained is
used to transfer funds from the
companys account to the
fraudsters account
SECURITY STEP 2
Informs of a security breach on
ALTERNATIVE
BREACH the companys system (or on the
internet banking facility)
Encourages transfer of
SCAMS
funds to a safe-keeping
account
The employee transfers
STEP 3
funds to an account OPTION 1: Requires
controlled by the fraudster OPTION 2: Encourages the employee to contact the nancial details
The money is re-trans- bank. Uses technology to remain on the line after necessary for check-up
ferred to accounts in termination of the call and therefore obtain sensitive and/or downloading of a
multiple jurisdictions nancial details disclosed to the bank employee remote access software
(account numbers; access codes)
44 ASSESSING ORGANISED CRIME
DD D ( ) D
VAT frauds are highly complex forms of
tax fraud relying on the abuse of the VAT UN DERS TA N D I N G VA T F R A U D
rules for cross-border transactions. VAT MT IC FR A U D
fraudsters generate multi-billion euro
Cross-border transactions within the EU are zero-rated, which
profits by avoiding the payment of VAT
means that the payment of the VAT is not due until the goods are
or by fraudulently claiming repayments
sold at their destination. This enables traders to import goods
of VAT by national authorities following a
without accounting right away for the VAT. In simple MTIC cases,
chain of transactions. The most common
fraudsters sell the goods, charge the VAT to buyers without
form of VAT fraud is Missing Trader Intra-
remitting the value to the tax authorities.
Community (MTIC) fraud.
More complex cases of VAT fraud are typically known as carousel
Changes in commodity prices have an
frauds. As part of these fraud schemes goods are imported and
impact on the profitability of MTIC fraud
sold through a series of companies before being exported again.
schemes involving specific commodities or
The exporters of these goods claim and receive the reimbursement
services. This is particularly true for fraud
of VAT payments that never occurred.
schemes involving the energy sector and
related commodities, which are subject to
frequent price fluctuations.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 45
INTELLECTUAL PROPERTY
CRIME
The infringement of intellectual property In 2015, more than 80,000 seizures were
rights is a widespread phenomenon registered by customs authorities in the
in the EU. Cheap counterfeit copies of EU. These shipments contained more than
popular goods remain highly popular with 40 million articles worth an estimated EUR Counterfeit goods not only cause
consumers. Criminals are able to produce 642 million. Cigarettes remain the most losses in unpaid duties and
counterfeit goods in large quantities at frequently seized counterfeit product
minimal costs and use online platforms to accounting for 27% of all seizures, followed taxes, but also reduce the sales
easily and effectively market their products by other goods such as batteries or air volume, prots and investments
internationally. Counterfeiting and piracy fresheners at 10% as well as toys at 9%. of legitimate businesses. This
are terms used to describe a range of illicit Regular household items such as body
removes incentives for investment
activities related to Intellectual Property care articles, medicines, toys, electrical
Rights (IPR) infringement. Most counterfeit household goods represent 25.8% of in research, development and
goods infringe a trademark, which means the total number of seized counterfeit innovation.
that a good is produced without the products.
authorisation of its rights holder. OCGs are
increasingly involved in the violation of IPR.
OCGs produce a wide range of counterfeit Online distri ution
goods and manufacture sub-standards
Online marketplaces are the key Thousands of online shops are
goods distributed on EU markets including
distribution channel for counterfeit goods. used to sell counterfeit goods.
food and beverages, pesticides and
The sales volume of counterfeit goods In 2016, Operation In Our Sites
pharmaceutical products. Counterfeit and
online has increased significantly over (IOS) resulted in the seizure
sub-standard goods pose significant risks to
recent years. Counterfeiters use social of 4,780 domain names and
the health and safety of consumers.
media platforms to advertise their products associated online shops selling
China remains the source country of most and steer potential consumers to online counterfeit merchandise.
of the counterfeit goods trafficked to the sales platforms. The sale of counterfeit
EU. The trade in goods between the EU and goods online is closely related to the
China has expanded significantly in recent increasing use of parcel and postal services The distribution of counterfeit
years. China is the biggest source of imports to distribute counterfeit products, which is pharmaceutical products online
to the EU by far. difficult to detect among an increasing flow is particularly dangerous. In
of licit goods sold online and sent via postal 2016, Operation Pangea IX
freight. specifically targeted online
vendors of counterfeit
P O LY-C RI M I NAL OC G I N VO LV ED I N medicines. The operation
T HE TRAD E I N C OU N TERFEI T G O O DS resulted in the seizure
A ND DRU G TRAFFI C KI N G
Counterfeit armaceuticals of potentially dangerous
While the counterfeiting of medicines worth more than
In 2015 and 2016, Europol supported an
pharmaceuticals previously primarily EUR 50 million.
operation targeting an Italian OCG selling
affected lifestyle medicines, counterfeiters
counterfeit champagne in various Member
increasingly target almost all types of
States. Investigations in Italy and Germany
medicinal products including cancer
revealed that some of the suspects
medication and various types of medical
were also involved in the trafficking
devices.
of cocaine. During house searches in
Germany, investigators seized more than
12,000 bottles of fake champagne. The
investigation also uncovered links to VAT
and excise fraud.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 47
PEOPLE AS COMMODITY
MIGRANT SMUGGLING
Migrant smuggling has emerged as a reported just over 295,000 positive decisions
highly profitable and widespread criminal on asylum applications by Member States.31
Armed conflicts, economic and
activity for organised crime in the EU. The This means that a large number of irregular population pressures in Africa and
migrant smuggling business is now a large, migrants who did not apply for asylum the Middle East will continue to
profitable and sophisticated criminal market, or whose applications were rejected may
comparable to the European drug markets. attempt to stay illegally in the EU.
act as the main push factors for
irregular migrants travelling to the
The demand for and supply of smuggling In addition to the transportation of migrants,
services has grown significantly since 2014. document fraud has emerged as a key EU. Migrant smuggling to and within
More than 510,000 illegal border crossings criminal activity linked to the migration crisis. the EU will remain a key criminal
between border-crossing points at the The provision of fraudulent documents will threat.
external border of the EU were registered continue to represent a substantial threat to
in 2016.29 This is a substantial decrease the security of the EU. Fraudulent documents
compared to 2015, when over one million are used and can be re-used for many
irregular migrants entered the EU on different criminal offences. The number of unaccompanied
the Eastern Mediterranean and Central minors present in the EU has
Mediterranean routes.30 Nearly all of the
irregular migrants arriving in the EU along increased signicantly in recent
these routes use the services offered by years as a result of the migration
criminal networks at some point during their crisis. This group is very vulnerable
journeys.
to all types of exploitation.
During 2016, 1,234,558 applications for
asylum were recorded in the EU. In 2015,
the European Asylum Support Office (EASO)
MIGRANT SMUGGLING
ROUTES
SOURCE: EUROPOL INFORMATION (2017)
50 ASSESSING ORGANISED CRIME
Migrant smuggling is a highly profitable crim- well as to change from irregular to legalised
igrant smuggling a daily inal activity featuring sustained high levels of residence status under false pretences or
usiness demand and relatively low levels of risk. Some by using fake identities. Migrant smuggling
OCGs previously involved in other criminal networks are increasingly offering tailor-made
In 2015, migrant smuggling networks offering activities such as the illegal trade in excise facilitation services including high-quality
facilitation services to reach or move within goods, drug trafficking or organised property fraudulent documents.
the EU generated an estimated EUR 4.7 billion crime have added migrant smuggling to their
to EUR 5.7 billion in profit. These profits have The abuse of genuine passports by look-alikes
portfolio of criminal activities. Migrant smug-
seen a sharp decline in 2016, dropping by continues to be the main modus operandi
gling does not require access to significant
nearly EUR 2 billion between 2015 and 2016. used by document fraudsters. ID cards are
resources and OCGs can rely on their existing
This development is in line with the overall the most commonly detected document used
knowledge of routes and infrastructure
decrease in the number of irregular migrants as part of document fraud. In 2015, they ac-
used to smuggle goods across borders. The
arriving in the EU and as a result of a fall in counted for 50% of all detections in the EU. In
distinction between legal and illegal activities
the prices for migrant smuggling services 2016, more than 7,000 people were detected
is increasingly blurred. Individual criminal
following the peak of the migration crisis in with fraudulent documents on entry at the
entrepreneurs can step in and out of criminal
2015. external borders of the EU.32
activities by providing ad hoc services, espe-
cially taxi and truck drivers.
OCGs involved in migrant smuggling display n emerging market
an unprecedented level of organisation and
coordination. While established smuggling Both the quantity and the quality of fraud-
modi operandi remain unchanged, migrant O P ERATI O N DA I DA LO S ulent documents circulating in the EU have
smugglers have shown great versatility in the increased. The sustained increase in demand
In March 2015, Operation Daidalos for fraudulent documents has prompted
means of transport, concealment methods
and technologies they use. targeted a criminal group smuggling established counterfeiters to increase their
irregular migrants from Greece to other production output and establish new print
Migrant smuggling is a multi-national busi- Member States which was involved in the shops.
ness. Migrant smugglers originating from over production and distribution of forged travel
122 countries are involved in facilitating the documents. In addition to providing these use of legal c annels
journeys of irregular migrants to the EU. Most documents to irregular migrants, the group
migrant smuggling networks are composed Migrant smugglers frequently abuse legal
also sold these to other OCGs. The criminal channels to facilitate the entry of irregular
of various nationalities involving both EU and
network operated primarily in Greece. migrants to the EU or to legalise their stay.
non-EU nationals.
The abuse of legal channels involves a variety
Migrant smuggling networks heavily rely on of modi operandi including sham marriages,
social media to advertise smuggling services.
Migrant smugglers make use of ride-sharing
llegal ut not undocumented bogus paternity, false employment contracts,
fake invitations letters, false medical visa,
applications and P2P accommodation plat- document and identity fraud and false claims to be victims of trafficking or
forms to provide a cover for their smuggling Service packages offered by migrant smug- refugees.
activities. This leaves regular users at the glers now frequently include the provision
risk of inadvertently becoming facilitators by of fraudulent travel and identity documents.
unknowingly transporting or hosting irregular Fraudulent documents allow irregular mi-
migrants. grants to enter and move within the EU as
BUSINESS MODEL
Supply of fraudulent documents
COMMUNICATION DOCUMENT
TRANSPORTATION
VIA SOCIAL MEDIA FRAUD
& ACCOMMODATION
Migrants smugglers pass Migrant smugglers widely rely on Document fraud has emerged as a
irregular migrants from one social media and use online key criminal activity linked to the
network to another along the platforms such as ride-sharing migration crisis.
route of the migrants journey. websites, or P2P accommodation
platforms, to arrange facilitation
EU suspects typically work as services.
drivers transporting irregular
migrants within the EU to
destination countries.
52 ASSESSING ORGANISED CRIME
C ( )
THB for sexual and labour exploitation
includes the recruitment, transportation, for la our e loitation The trafcking of victims within
harbouring and exploitation of victims. The involvement of OCGs in THB for labour the EU remains a key threat.
OCGs involved in THB typically operate exploitation is increasing in the EU. OCGs
in independent cells that deal with the cater to the growing demand for cheap labour
various stages of recruitment, transport and across many Member States and have access
exploitation. to a large number of potential victims. THB The migration crisis has resulted
Traffickers rely heavily on document fraud to for labour exploitation threatens to infiltrate in an increase in the number
the legal economy, where it lowers wages and
enable their trafficking activities. This includes
hampers economic growth. of potential victims of THB. A
the use of fraudulent identity, travel and
breeder documents as well as the abuse of THE BUSINESS MODEL
growing number of vulnerable
legal channels such as the EU visa regime for
There has been little change in the types
adults and unaccompanied
tourism, study and work visas. OCGs involved
in THB also continue to exploit asylum of industries featuring labour exploitation. minors in the EU are likely to be
provisions in order to traffic non-EU nationals Traffickers continue to target less regulated targeted by trafckers.
into the EU. On many occasions, victims industries as well as those featuring seasonal
are provided with fraudulent documents to demand for workers. Vulnerable sectors
conceal their real identity and age. include agriculture, catering, cleaning,
construction, entertainment, fishing,
CR I M I N A L G A N G A CCU S E D OF
for se ual e loitation hospitality, retail and transportation.
T R A F F I CK I N G OVE R 1 5 0 W OME N
The sexual exploitation of EU nationals no Traffickers take advantage of discrepancies in I N TO PR O S T I T U T I O N D I S M AN T L E D BY
longer relies predominantly on the use labour legislation to organise the exploitation A U S T R I A 33
of violence and coercion towards victims. of victims in the grey zone between legal
employment and labour exploitation. Some In November 2016, Austrian law
Some OCGs are increasingly relying on enforcement authorities with the support
threats of violence towards victims and their victims receive wages equivalent to the
minimum standard in their countries of origin. of Europol dismantled a Chinese OCG
families rather than attacking the victim.
involved in the trafficking of up to 300
Victims originating from outside the EU are However, these are far below acceptable women. Victims were lured to Austria
still routinely subjected to violence, debt salaries in countries of exploitation where
bondage, passport confiscation and other on promises of work as nannies or
they do not have sufficient resources to cover masseuses. They were provided with
forms of coercion as an integral part of their living expenses. These wage dumping
trafficking modi operandi. forged documents and brought to Austria
practices seriously undermine the legal labour
illegally. Upon their arrival in Vienna, OCG
market in countries of destination and make
it difficult for victims of labour exploitation to
members took away the victims IDs. The
be recognised as such. women were placed in so-called sex
studios owned by the OCG and forced
to work as prostitutes. After a few weeks
they were transferred to other brothels in
Austria.
THB for labour exploitation is The traditional trafcking flow from Trafckers often specically
increasing in the EU. Eastern Europe to Western Europe target underage victims, both
has been replaced by multiple and male and female, to sexually
Trafckers continue to target less diverse flows of victims all over the exploit them.
regulated industries as well as those EU.
featuring seasonal demand for
workers.
OCGs have further increased
the use of legal businesses
that can conceal exploitations
such as hotels, nightclubs and
massage parlours.
Trafckers continue to rely on the use of social media, Voice-over-IP (VoIP) and instant messaging
applications at all stages of the trafcking cycle.
SPORTS TRAFFICKING
CORRUPTION OF FIREARMS
Criminal networks use match-fixing The proliferation and availability DIVERSION FROM LEGAL SUPPLY
to manipulate the outcomes of sports
matches, which skews betting odds and
of illegal rearms in the ember Firearms traffickers are highly adept at
exploiting legal loopholes and differences
allows them to generate significant profits. States increases the risk of their in regulatory regimes between Member
Match-fixing in the EU primarily affects use by terrorist groups to carry States to divert firearms from legal
football games. However, match-fixers are suppliers. The reactivation of deactivated
also targeting tennis, snooker and dart out attacks in the EU. weapons and conversion of blank-firing
competitions. firearms are among the main sources
of illegal firearms trafficked in the EU.
In some cases OCGs have infiltrated
sporting clubs in order to orchestrate Illegal rearms are increasingly Firearms traffickers often convert blank-
firing firearms or reactivate deactivated
money laundering schemes. accessible due to their firearms purchased from legal dealers
availability online. based in countries applying less stringent
acquisition rules such as more permissive
licensing and registration requirements.
FO OT BALL AND MON EY L AUN DERI N G
Recent terrorist attacks in the EU carried out Various conflict zones in the periphery of
In May 2016, as part of Operation by jihadist terrorists using trafficked firearms the EU have the potential to emerge as
Matrioskas, law enforcement authorities have demonstrated the lethal consequences major sources of firearms trafficked to
dismantled a Russian-speaking OCG which of the trade in illicit firearms. Several the EU.
had infiltrated football clubs and laundered incidents of violent clashes between criminal
several million euros across the EU. The gangs have highlighted that the use of illegal
OCG used middlemen to purchase football firearms remains a significant threat to EU
clubs experiencing financial pressure. The citizens.
In June 2016, Italian law enforcement
group was able to conceal their money ONLINE TRADE authorities arrested two members of the
laundering activities among the large
Firearms are frequently traded on online mafia clan Ceusi on charges of firearms
financial transactions and cross-border
platforms including Darknet marketplaces. trafficking. The suspects had purchased
money flows, which are not unusual
Both individual criminals and OCGs obtain over 160 decommissioned firearms
for professional football clubs. Weak
illegal firearms via online marketplaces. This from Slovakia. Some of the firearms
governance allowed the OCG to use the development has resulted in a significant were reactivated and sent to Malta in
clubs to launder money by over- or under- increase in the use of parcel and postal parcels. The Italian OCG maintained links
valuating players on the transfer market services to traffic firearms and firearm with Egyptian OCGs involved in migrant
as well as by accepting bids for television components. smuggling activities.36
rights deals.
Online trade allows individuals with no or
limited connections to organised crime to
procure firearms. These individual criminal
actors increasingly engage in the trafficking of Using post and parcel services
firearms and firearm components as part of
a CaaS business model and have emerged as is now the most common way of
key distributors of illegal firearms in the EU. trafcking rearms in the E .
The online trade in illegal firearms via various
platforms is set to expand further over the
coming years.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 55
CONCLUSIONS
Tackling organised crime in the The role of the SOCTA
age of technology The vital role of technology for organised
Serious and organised crime is a key
crime is reflected in the data collected RECOMMENDED
threat to the security of the EU. Criminal
groups and individual criminals continue
and analysed for the SOCTA 2017. For the
SOCTA 2017, Europol has undertaken the PRIORITIES
largest-ever data collection on serious and
to generate multi-billion euro profits
organised crime in the EU. Based on the outcome of a
from their activities in the EU each year.
Some parts of the serious and organised Europol relied on more than 2,300 comprehensive analysis of the
crime landscape in the EU have changed questionnaires contributed by Member indicators and factors detailed in
drastically in the past years - in large part States, Europols operational and
due to advancements in technology that strategic partners outside the EU and our
the SOCTA Methodology, Europol
have had a profound impact on the wider institutional partners as well as operational recommends key priorities to
society and economy. intelligence held in Europols databases to
produce the most detailed assessment of
tackle the most threatening
Technology is a key component of most,
if not all, criminal activities carried out
the nature and scale of criminal threats forms of serious and organised
by organised crime groups in the EU and
facing the EU and its Member States yet. crime. In addition to five specific
has afforded organised crime with an Based on an in-depth analysis of this criminal activities carried out
unprecedented degree of flexibility. This data and a methodology endorsed by the
flexibility is particularly apparent in the Member States, Europol identifies the key by organised crime in the EU,
ease with which criminals adapt to changes threats from serious and organised crime Europol is also recommending
in society. facing the EU today and over the coming
years.
to focus on three cross-cutting
The internet, the multitude of online
platforms and communication channels it
threats that enable or enhance
hosts have had a huge impact on society, all types of serious and
strengthening and transforming the
economy, driving innovation and shaping
organised crime.
social interaction. However, it is also a key
enabler of criminal activity and plays a role
in all types of criminality.
The impact of technology on crime,
however, extends beyond the internet and
involves all kinds of technical innovation
such as advances in drone technology,
automated logistics, and advanced printing
technologies.
EU SERIOUS AND ORGANISED CRIME THREAT ASSESSMENT 2017 57
Synthetic drugs
Online child production in
sexual Online trade in External
the EU Excise fraud counterfeit Burglaries and borders of the Labour
exploitation theft Online trade exploitation
Trafcking of goods EU
Production Illicit waste (including
precursors and trafcking
Cyber- de/reactiva-
THREATS
pre-precursors
dependent tion)
Import of
crime
cocaine to the Production of
(malware,
EU via major counterfeit Motorvehicle Secondary Sexual
cryptoware, etc.)
ports and MTIC fraud goods in the crime movements exploitation
couriers EU
Poly-drug
Distribution trafcking in
including the EU Trafcking of Traditional
online Payment card Trafcking of
endangered trafcking
fraud (card-not- Large-scale counterfeit Organised Risk for labour Child
present fraud) cannabis species Investment goods (not robberies exploitation trafcking
production and fraud online) in the
trafcking in EU
the EU
Corruption
CROSS-CUTTING
CRIME THREATS
Extortion
ANNEX
LIST OF ABBREVIATIONS
news/large-chinese-money-laundering-network-dismantled
EMCDDA & Europol 2016, EU Drug Markets Report 2016, p. 60
23
4
Europol and Eurojust 2016, Hawala money laundering ring dismantled by 24
Europol 2016, Rose of the Winds International operation against drug
Joint Investigation Team (29/11/ 2016), accessible at https://www.europol.
trafficking (01/12/20160, accessible at https://www.europol.europa.eu/
europa.eu/newsroom/news/hawala-money-laundering-ring-dismantled-
newsroom/news/%E2%80%98rose-of-winds%E2%80%99-%E2%80%93-
joint-investigation-team
international-operation-against-drug-trafficking
5
Europol 2016, Iraqi money laundering syndicate based in Germany 25
ABC News 2014, Six charged after drug bust which seized 2.8 tonnes of
dismantled with support of Europol and Eurojust (31/03/2016), accessible
MDMA and methamphetamine worth $1.5 billion (29/11/2014), accessible
at https://www.europol.europa.eu/newsroom/news/iraqi-money-
at http://www.abc.net.au/news/2014-11-29/six-charged-over-enormous-
laundering-syndicate-based-in-germany-dismantled-support-europol-and-
$1.5b-drug-bust/5927904
eurojust
26
BBC 2015, Gang guilty over 600,000 phone scam against pensioners
6
Europol 2016, Dozens arrested for massive document forgery and migrants
(10/12/2015), accessible at http://www.bbc.com/news/uk-35064360
smuggling (31/05/2016), accessible at https://www.europol.europa.eu/
newsroom/news/dozens-arrested-for-massive-document-forgery-and- 27
Europol 2016, 3561 artefacts seized in Operation Pandora (23/01/2017),
migrant-smuggling accessible at https://www.europol.europa.eu/newsroom/news/3561-
artefacts-seized-in-operation-pandora
https://metrics.torproject.org
7
p.49 Europol 2016, Crime gang accused of trafficking over 150 women into
33
QL-04-17-236-EN-N
SERIOUS AND ORGANISED CRIME
THREAT ASSESSMENT
E UROP E AN UN ION
www.europol.europa.eu
Follow us