EUROPEAN COMMISSION Brussels, 20.3.2019 COM(2019) 145 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE EUROPEAN COUNCIL AND THE COUNCIL Eighteenth Progress Report towards an effective and genuine Security Union {SWD(2019) 140 final}



I. INTRODUCTION This is the eighteenth report on the further progress made towards building an effective and genuine Security Union. It covers developments under two main pillars: tackling terrorism and organised crime and the means that support them; and strengthening our defences and building resilience against those threats. Ahead of the European Parliament elections in May 2019, this report underlines the important work undertaken at various levels to address and prevent cyber threats and disinformation in the electoral context. In response to the European Council’s call for measures to protect the Union’s democratic systems and to combat disinformation in the run-up to the upcoming elections, the Union has made considerable progress towards more coordinated action on electoral resilience. However, given the time pressure to ensure the Union’s preparedness before European voters go the polls in May 2019, the Commission calls on all actors involved – government authorities, political parties and notably online platforms – to redouble their efforts to step up electoral resilience to counter disinformation. Ahead of the upcoming European Council on 21 and 22 March 2019 that will discuss progress in this area, the Commission also calls on Member States to strengthen their coordination to address disinformation and ensure the protection of the European Parliament elections. The EU has made considerable progress in the work towards an effective and genuine Security Union, with agreement reached on a number of priority legislative initiatives that will enhance security for all citizens. Over recent months, the European Parliament and the Council reached agreement on the interoperability of EU information systems for security, border and migration management, and on new EU rules to close down the space in which terrorists and criminals operate, making it harder for them to access explosives precursors, finance their activities and travel without detection. With agreement reached on 15 out of 22 legislative initiatives presented by the Commission in the Security Union (see list of all Security Union initiatives in Annex I), the EU is delivering in what is a joint priority area for the European Parliament, the Council and the Commission. However, there is a need for further efforts. In particular, within the current legislative mandate, the co-legislators need to address the urgent threat posed by terrorist content online, by reaching agreement on the Commission’s proposal. The European Parliament and the Council also need to reach agreement on the Commission’s proposal for a reinforced European Border and Coast Guard to strengthen security through enhanced protection of the external borders of the Union. The tragic events in Christchurch, New Zealand on 15 March 2019 show that the threat of terrorism remains a clear and present danger, whether fuelled by far right extremism or other extremist ideologies. The difficulties encountered in trying to remove live-streamed content from Internet platforms and prevent its reappearance further underlines the vital importance of the Commission’s proposal on terrorist content online. It is crucial that the proposed rules for the removal of terrorist content online are agreed by the co-legislators as a matter of urgency. It is equally important to the fight against terrorism in all its forms that all Member States fully implement legislation the EU has adopted notably in response to terrorist attacks in Europe to close down the space in which terrorists operate, in particular the Directives on combating terrorism and on the control of acquisition and possession of firearms. In the context of fighting extremism, the Commission has also been actively working, and taking relevant measures, against illegal hate speech online, anti-Muslim hatred and Antisemitism. This report also sets out the progress made in the implementation of other priority files on security, notably on measures to support the protection of public spaces. The complete and correct implementation of agreed measures is of the utmost priority to ensure the full benefits of an effective and genuine Security Union. The Commission is actively supporting Member States, including through funding and by facilitating the exchange of best practices. Where necessary, the Commission also makes full use of its powers under the Treaties for the enforcement of EU law, including infringement action when appropriate. The commemoration of the 15th European Remembrance Day for Victims of Terrorism on 11 March 2019, fifteen years after the Madrid Bombings of 11 March 2004 and three years after the deadly attacks in Brussels and Zaventem of 22 March 2016, is the backdrop of this report. Providing support to victims of terrorist attacks is an important part of the work towards an effective and genuine Security Union. To further step up this support, the Commission adopted on 31 January 2019 a Decision on the financing of the pilot project “Setting up a EU Centre of Expertise for Victims of Terrorism”. The EU Centre of Expertise will act as a hub of expertise and platform for practitioners dealing with victims of terrorism. The Commission welcomes the contribution of the European Parliament’s Report on findings and recommendations of the Special Committee on Terrorism as a valuable input to the joint work towards an effective and genuine Security Union. II. DELIVERING ON LEGISLATIVE PRIORITIES 1.Stronger and smarter information systems for security, border and migration management Information exchange is a central aspect of the support the EU provides to national authorities in the fight against terrorism and serious crime. In that respect, the interoperability of EU-wide information systems marks a step change in the way data is provided to national authorities, ensuring that data is accurate and complete. The co-legislators have reached political agreement on the related priority legislative proposals to achieve the interoperability of EU information systems for security, border and migration management. The proposed measures will make EU information systems work together in a more intelligent and targeted way whilst fully respecting fundamental rights. Making best use of existing data, interoperability will close information gaps and blind spots by helping to detect multiple identities and countering identity fraud. Once the co-legislators formally adopt the new rules, the Commission will stand ready to support Member States in their implementation. There is a need for close cooperation with EU agencies and all Member States and Schengen associated countries to reach the ambitious objective of achieving full interoperability of EU information systems for security, border and migration management by 2020. In preparation of that, a first workshop took place with Member States’ experts on 5 March 2019 to launch a process of effective coordination. At this stage, the future architecture of interoperable EU information systems will include the reinforced Schengen Information System, the existing Visa Information System, the recently agreed extension of the European Criminal Records Information System to third-country nationals, and the newly established EU Entry/Exit System and European Travel Information and Authorisation System (ETIAS). As part of the technical implementation of the European Travel Information and Authorisation System, the Commission put forward a proposal on 7 January 2019 setting out technical amendments to the related Regulation. The proposed changes concern the legal acts of those EU information systems that the European Travel Information and Authorisation System will query as part of the assessment of security or irregular migration risks of visa-exempt third-country nationals prior to their travel to the Schengen Area. The proposed amendments are necessary to fully set up the European Travel Information and Authorisation System. The Commission calls on the co-legislators to advance their work on the technical amendments in order to reach agreement as soon as possible, thus enabling swift and timely implementation of the European Travel Information and Authorisation System to make it operational in early 2021. In May 2018, the Commission presented a proposal to strengthen the existing Visa Information System providing for more thorough background checks on visa applicants and closing information gaps through better information exchange between Member States. The Council adopted its negotiating mandate on 19 December 2018, and on 13 March 2019, the European Parliament’s Plenary voted its report on the proposal thus concluding its first reading. The Commission calls for a swift start of negotiations between the co-legislators under the next European Parliament. In May 2016, the Commission proposed to extend the scope of Eurodac by including not only the identification of asylum applicants but also that of illegally-staying third-country nationals and those who enter the EU irregularly. In line with the December 2018 European Council conclusions and the Commission Communication of 6 March 2019 on progress in the implementation of the European Agenda on Migration, the Commission calls on the co-legislators to proceed to the adoption of the proposal without delay. Adopting this legislative proposal will enable Eurodac to become part of the future architecture of interoperable EU information systems, thus integrating the crucial data of illegally staying third-country nationals and those who have entered the EU irregularly. In order to strengthen the EU information systems for security, border and migration management, the Commission calls on the European Parliament and the Council: ·to adopt the legislative proposal on Eurodac, on which agreement is within close reach, before the European Parliamentary elections. (Joint Declaration priority) ·to advance the work in view of reaching a swift agreement on the proposed technical amendments that are necessary to establish the European Travel Information and Authorisation System. 2.Strengthening security through enhanced external border management

Strong protection of the external borders is a precondition for security in the area of free movement without internal border controls. This is a task for the Member States, who have to ensure the management of their external borders both in their own interests and in the common interest of all, with the help of the European Border and Coast Guard. In response to the European Council conclusions of June 2018, the Commission proposed in September 2018 to enhance the capacities of the European Border and Coast Guard. It would take the Agency to a new operational level with a standing corps of 10 000 border guards exercising executive powers and with its own equipment, while fully respecting both fundamental rights and the sovereignty of the Member States. The legislative work on the proposal is advancing well and negotiations between the co-legislators have entered into the crucial phase. The European Parliament adopted its negotiating mandate on 11 February 2019, while the Council received its mandate on 20 February 2019. Two trilogue meetings took place on 27 February 2019 and 12 March 2019. The Commission welcomes and supports the progress made on this priority file, showing that all institutions are committed towards adopting this proposal before the 2019 European Parliament elections. In order to strengthen security through enhanced external border management, the Commission calls on the European Parliament and the Council: ·to adopt the legislative proposal to strengthen the European Border and Coast Guard during the current term of the European Parliament. (2018 State of the Union initiative) 3.Preventing radicalisation Addressing terrorist content online remains a key challenge in fighting terrorism and preventing radicalisation. Such content has had a role to play in most attacks on European soil in the last two years, whether through incitement to commit an attack, instructions on how to carry it out or glorification of the deadly results. In order to tackle the clear and present danger posed by such content, President Juncker’s 2018 State of the Union address was accompanied by a proposal for a Regulation on terrorist content online, setting out a legal framework to prevent the misuse of hosting service providers for the dissemination of terrorist content online. While fully guaranteeing freedom of speech and other fundamental rights, it is critical for the future rules to provide for effective measures to remove terrorist content online as rapidly as possible, given that the potential damage caused by such content rises with every hour it remains online. While the Council adopted its negotiating mandate in December 2018, work in the European Parliament is still ongoing and will hopefully allow the Parliament to adopt its negotiating mandate in the course of March 2019. The Commission calls on both co-legislators to reach agreement on the proposed legislation during the current term of the European Parliament, given the vital importance of an EU regulatory framework for the removal of terrorist content online with clear rules and safeguards. In parallel, the Commission continues to provide support to Member States in their efforts to prevent radicalisation. A dedicated EU Cooperation Mechanism, bringing together national representatives, helps ensure that EU-level support responds to Member States’ needs. Recent examples include a conference on “EU cities against radicalisation” jointly organised with the Committee of the Regions on 26 February 2019. On 13 March 2019, the Commission organised an expert meeting with national policymakers to identify practical steps to further support prison and probation services. The outcome of this work will become part of a manual which the Radicalisation Awareness Network is preparing on the rehabilitation and reintegration of terrorist offenders, returning foreign terrorist fighters and those radicalised in prison (see also section IV.4 on external). In order to prevent radicalisation, the Commission calls on the European Parliament: ·to adopt, as a matter of priority, its negotiating mandate on the legislative proposal to prevent the dissemination of terrorist content online, in order for the co-legislators to reach agreement on the legislation during the current term of the European Parliament. (2018 State of the Union initiative) 4.Enhancing cybersecurity Classic cyber threats to systems and data remain on the rise, with an increase in activity from malicious actors across a diverse range of targets and victims in 2018. Countering cybercrime and enhancing cybersecurity therefore remains a priority for EU action. The EU has made tangible progress in enhancing its cybersecurity, implementing the actions set out in the September 2017 Joint Communication on "Resilience, Deterrence and Defence: Building strong cybersecurity for the EU". On 12 March 2019, the European Parliament’s Plenary confirmed the political agreement reached by the co-legislators on the Cybersecurity Act. With entry into force expected in May 2019, the Act will increase cybersecurity capabilities and the preparedness of Member States and businesses. The Cybersecurity Act will establish an EU cybersecurity certification framework for information and communications technology products, systems and services. It will also improve cooperation and coordination across Member States and EU institutions, agencies and bodies, notably the renamed EU Agency for Cybersecurity. Further progress is needed, however, on the September 2018 Commission proposal on a European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres. The proposal aims to support cybersecurity technological and industrial capacities and to increase the competitiveness of the Union's cybersecurity industry. The European Parliament and the Council adopted their negotiating mandates on 13 March 2019. The first trilogue meeting also took place on 13 March 2019. The Commission calls on the co-legislators to reach swift agreement on the proposed legislation. The EU has made significant progress towards further operationalisation of the Joint EU Diplomatic Response to Malicious Cyber Activities (the "cyber diplomacy toolbox"), responding to the call by the European Council to take forward the work on the capacity to respond to and deter cyber-attacks through EU restrictive measures. On 8 March 2019, the High Representative of the Union for Foreign Affairs and Security Policy and the Commission presented a joint proposal for a Council Regulation concerning restrictive measures to counter cyber-attacks threatening the Union or its Member States. The Commission and the High Representative call for the swift adoption of this proposal to strengthen the Union’s resilience against cyber-attacks. In order to enhance cybersecurity, the Commission and the High Representative call on the Council: ·to adopt the Council Regulation concerning restrictive measures to counter cyber-attacks threatening the Union or its Member States. 5.Closing down the space in which terrorists operate The EU has taken further action to deny terrorists and criminals the means to act, making it harder for them to access explosives precursors, finance their activities and travel without detection. The European Parliament and the Council reached political agreement on 14 February 2019 on the proposed Regulation on restrictions on the marketing and use of explosives precursors. Once applicable, the Regulation will make significant improvements to the current legislative framework, restricting access to dangerous explosives precursors that might be misused to build homemade bombs. It will close security gaps with measures such as banning additional chemicals, mandatory checks of the criminal records of those who apply for a licence for the purchase of restricted substances, and clarifying that rules applicable to economic operators also apply to companies that operate online.

Moreover, as part of the efforts to fight terrorist financing, the co-legislators reached agreement on the proposed Directive to facilitate the use of financial and other information for the prevention, detection, investigation or prosecution of serious criminal offences. Once formally adopted and implemented, the Directive will provide designated law enforcement authorities and Asset Recovery Offices with direct access to bank account information held in national centralised bank account registries. The Directive will also enhance the cooperation between national Financial Intelligence Units and law enforcement authorities and facilitate Europol’s access to financial information. Building on that, the Commission will further reflect on cooperation between Financial Intelligence Units of different Member States, including in the upcoming report on the cooperation between Financial Intelligence Units as foreseen by the 5th Anti-Money Laundering Directive. In addition, as also required by the 5th Anti-Money Laundering Directive, the Commission is assessing aspects related to the potential interconnection of national centralised bank account registries and data retrieval systems in the EU. The Commission is also analysing non-conviction based confiscation measures in the Union. Finally, and also in response to a call by the European Parliament, the Commission will continue to assess the necessity, technical feasibility and proportionality of additional measures to track terrorist financing in the EU. As part of the work to curb document fraud, the co-legislators reached provisional agreement on 19 February 2019 on the proposed Regulation to strengthen the security of identity cards of Union citizens and of residence documents so that they cannot be used fraudulently by criminals and terrorists. The European Parliament’s Civil Liberties, Justice and Home Affairs Committee confirmed the agreement on 11 March 2019. Once adopted, the Regulation will introduce minimum security features for identity cards including biometric identifiers (a facial image and two fingerprints) on a contactless chip. This will significantly improve the security of national identity cards and residence documents, making it more difficult for terrorists and other criminals to misuse or falsify such documents to enter or move within the EU. More secure identity documents will contribute to strengthening EU external border management. At the same time, more secure and reliable documents will make it easier for EU citizens to exercise their free movement rights. Further progress is needed, however, on the Commission’s April 2018 proposals on access to electronic evidence, given that more than half of all criminal investigations today involve a cross-border request to access electronic evidence. The Council adopted its negotiating mandate on proposals for a Regulation to improve the cross-border access to electronic evidence in criminal investigations and for a Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings. In the European Parliament, however, there has only been very limited progress on the proposals since their adoption by the Commission in April 2018. Given the crucial importance of efficient access to electronic evidence for the prosecution of cross-border crimes such as terrorism or cybercrime, the Commission urges the European Parliament to advance on this proposal. In parallel, the Commission is working on its international initiatives on access to electronic evidence in the context of ongoing negotiations of a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime and with the United States. Therefore, the Commission adopted recommendations for negotiation mandates for both of these international initiatives on 5 February 2019. The Council is currently discussing the draft mandates, including at the 7-8 March 2019 Justice and Home Affairs Council meeting. The Commission calls on the Council to adopt the Decision authorising the participation in negotiations on a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime, as well as the Decision authorising the opening of negotiations with the United States on cross-border access to electronic evidence. It is important to proceed fast with the negotiations in order to advance international cooperation on sharing electronic evidence, while ensuring compatibility with EU law and Member States’ obligations under it, taking also account of future developments in EU law. In order to close down the space in which terrorists operate, the Commission calls on: ·the European Parliament to adopt as a matter of urgency its negotiating mandate on the legislative proposals on electronic evidence in order to enter into trilogue discussions with the Council without delay. (Joint Declaration priority) ·the Council to adopt the Decisions authorising the participation in negotiations on a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime as well as the opening of negotiations with the United States on cross-border access to electronic evidence. III. COUNTERING DISINFORMATION AND PROTECTING ELECTIONS AGAINST OTHER CYBER-ENABLED THREATS The ability of outside and inside parties to interfere in public debates and manipulate elections is more real than ever and could increase further with the upcoming European Parliament elections. The possible consequences – the undermining or delegitimising of democratic institutions – are a serious, strategic and growing threat. They are a key part of the security challenges the EU faces today across national borders, and require a joint, cross-border response. The electoral campaigns ahead of the European Parliament elections will start in earnest in March. Ahead of the European Council on 21 and 22 March 2019, the Commission calls on Member States to step up their coordination and information exchange to counter disinformation and protect elections against cyber-enabled threats. Member States should make full use of the tools and information channels provided by the EU, notably the newly established Rapid Alert System. Moreover, due to concern for the situation as it stands, the Commission urges online platforms to accelerate their efforts across all Member States to help ensure the integrity of the European Parliament elections in May 2019. To support and encourage these efforts, the Commission and the High Representative continue to take action along two complementary strands to address cyber-enabled threats: countering disinformation and enhancing electoral resilience. 1.Taking Action against Disinformation The exposure of citizens to large-scale disinformation, including misleading or outright false information, may be a serious type of cyber-enabled threat and is a major challenge for the upcoming European elections. The Commission is closely monitoring the implementation of the actions set out in its April 2018 Communication on Tackling online disinformation. Moreover, progress made under the Code of Practice on Disinformation, signed by representatives of online platforms, leading social networks, advertisers and the advertising industry in October 2018, is under close monitoring by the Commission (see below). The Commission will carry out a comprehensive assessment at the conclusion of the Code’s initial 12-month period of application. Should the implementation and the impact of the Code of Practice prove to be unsatisfactory, the Commission may propose further measures, including of a legislative nature. Building on this work, and responding to the call made by Leaders at the June 2018 European Council to protect the Union's democratic systems, the Commission and the High Representative presented a Joint Action Plan against disinformation in December 2018. The Action Plan highlights that, according to the EU Hybrid Fusion Cell, disinformation by the Russian Federation poses the greatest threat to the EU. It is systematic, well-resourced and on a different scale compared to other countries. To address the threat posed by disinformation, the Action Plan foresees an increase of resources devoted to the fight against disinformation, more specifically for the Strategic Communication Task Forces of the European External Action Service (EEAS), including the East Strategic Communication Task Force. The Action Plan also foresees an increase of resources devoted to the issue, and calls for a reinforcement over the next two years. The Action Plan set out concrete measures to tackle disinformation, including the creation of a Rapid Alert System. With a view to the European Parliament elections, the Rapid Alert System was set up in March 2019 among the EU institutions and Member States to facilitate the sharing of data and assessments of disinformation campaigns and to provide alerts on disinformation threats. The Action Plan also foresees close monitoring of the implementation of the above-mentioned Code of Practice signed by the online platforms. On 29 January 2019, the Commission published the reports submitted by signatories of the Code of Practice – Google, Facebook, Twitter, Mozilla and the trade associations representing the advertising sector. While the Commission welcomed progress made, it also called on signatories to intensify their efforts in the run up to the 2019 European Parliament elections. On 28 February 2019, the Commission published reports by Facebook, Google and Twitter covering the progress made in January 2019 on their commitments to fight disinformation. In these reports, platforms did not provide enough details showing that new policies and tools are being deployed in a timely manner and with sufficient resources across all Member States. There is clearly room for improvement for all signatories. More specifically, the Commission calls for platforms to ensure transparency of political ads by the start of the campaign for the European elections in all EU Member States, to allow appropriate access to platforms' data for research and fact-checking purposes, and to ensure proper cooperation between the platforms and individual Member States through contact points in the Rapid Alert System. The Commission will report again on 20 March 2019 on the implementation of the above-mentioned Code of Practice. 2.Enhancing Electoral Resilience

On 12 September 2018 the Commission adopted a package of measures to enhance the resilience of our electoral systems addressed to Member States and European and national political parties and foundations, including a Recommendation on election cooperation networks, online transparency, protection against cybersecurity incidents and fighting disinformation campaigns, guidance on the application of EU data protection law, and a legislative amendment to tighten the rules on European political party funding. The European Parliament welcomed the package in its Resolution adopted on 28 October 2018. The Council welcomed the package in its Conclusions of 19 February 2019 on securing free and fair European elections, which express a shared commitment by all Member States to a coordinated European approach to protecting the integrity of the upcoming European elections. The Justice and Home Affairs Council discussed the state of play on 7 March 2019. The amendment to the Regulation on the statute and funding of the European political parties and foundations introduces the possibility to impose sanctions on the illegal use of personal data in case of deliberate impact on the outcome of the European Parliament elections. Following political agreement in January 2019, the European Parliament’s Plenary approved the text of the amendment on 12 March 2019. The amendment is scheduled to become law ahead of 2019 European Parliament elections. The Recommendation on election cooperation networks, online transparency, protection against cybersecurity incidents and fighting disinformation campaigns in the context of elections to the European Parliament is addressed to the Member States and national and European political parties and foundations and presents concrete steps for relevant actors in these areas. In an effort to implement the Recommendation, national election networks appointed contact points to take part in a European cooperation network on elections that serves to raise alerts about threats, exchange on best practices among national networks, discuss common solutions to identified challenges and encourage common projects and exercises among national networks. At the first meeting of the network on 21 January 2019, participants agreed that a comprehensive approach is essential to ensure the integrity of elections while preserving an open democratic debate and a level political playing field. The second meeting of the European cooperation network on elections took place on 27 February 2019, focussing on monitoring and enforcement related topics relevant to the electoral context, including data protection, media regulation, law enforcement, transparency and social media, and engagement of different stakeholders in monitoring activities. It laid the groundwork for its membership to participate in a cyber-resilience exercise immediately after the network’s next anticipated meeting on 5 April 2019. A Workshop on "Enhancing cyber resilience of elections", jointly organised by the European Parliament and the Commission, was held on 19 February 2019 to improve the security and resilience of electoral systems and infrastructures against constantly evolving cyber-enabled threats. National cybersecurity authorities from Member States, the European Union Agency for Network and Information Security and online platforms discussed measures focusing on actions that are urgent and relevant for ensuring the integrity of the 2019 European Parliament elections. The EU institutions and the Member States are also closely cooperating on other awareness-raising activities aimed at protecting the integrity of the electoral process and on involving actors from the private and public sector, including media, online platforms and civil society. In order to address disinformation and ensure electoral resilience, the Commission and the High Representative call on the Member States: ·to implement swiftly and decisively the actions of the December 2018 Joint Action Plan against Disinformation. IV. IMPLEMENTATION OF OTHER PRIORITY FILES ON SECURITY 1.Implementation of legislative measures in the Security Union The complete and correct implementation of agreed measures is of utmost priority to ensure the full benefits of an effective and genuine Security Union. The Commission is actively supporting Member States, including through funding and by facilitating the exchange of best practices. Where necessary, the Commission also makes full use of its powers under the Treaties for the enforcement of EU law, including infringement action when appropriate. As regard the implementation of the EU Passenger Name Record Directive, the Commission launched infringement procedures on 19 July 2018 against 14 Member States for failing to communicate the adoption of national legislation which fully transposes the Directive – a critical tool in the fight against terrorism and serious crime. Nine of those Member States have since notified full transposition. Member States where full transposition is still absent have received reasoned opinions (Spain on 24 January 2019, the Netherlands and Finland on 7 March 2019). In parallel, the Commission continues to support all Member States in their efforts to complete the development of their passenger name record systems, including by facilitating the exchange of information and best practices. The deadline for transposition of the Directive on combating terrorism expired on 8 September 2018. The Commission launched infringement procedures on 22 November 2018 against 16 Member States for failing to communicate the adoption of national legislation which fully transposes the Directive. 9 of these Member States have since notified full transposition. The Commission urges the remaining 7 Member States to take the necessary measures as soon as possible. The deadline for transposition of the Directive on the control of the acquisition and possession of weapons expired on 14 September 2018. So far, 6 Member States have notified full transposition and 5 Member States have notified partial transposition. 22 Member States, including those that have notified partial transposition, received the Commission’s letters of formal notice on 22 November 2018. As regards the transposition into national law of the Data Protection Law Enforcement Directive, the Commission launched infringement procedures on 19 July 2018 against 19 Member States, owing to their failure to communicate the adoption of national legislation ensuring the full transposition of the Directive. Currently, 17 Member States have notified full transposition and 5 Member States have notified partial transposition. So far, procedures against 6 Member States have been closed, while 9 Member States received a reasoned opinion on 25 January 2019. The Commission is expected to report on consistency of identification of operators of essential services by 9 May 2019. Based on the Member States’ notifications, it was established that the Directive on the security of network and information systems has been fully transposed in 25 Member States and partially transposed in one Member State. In January 2019, the Commission closed infringement procedures for non-communication against 6 Member States. 9 Member States are subject to an infringement procedure for non-communication of full transposition of the Directive. As part of the transposition of the Directive on the security of network and information systems, Member States had to submit to the Commission by 9 November 2018 information about the operators of Essential Services identified within their territory. The Commission is now assessing the information submitted by the Member States. Moreover, the Commission is assessing the transposition of the 4th Anti-Money Laundering Directive, while also working so as to verify that the rules are implemented by Member States. The Commission has launched infringement procedures against all 28 Member States as it assessed that the communications received from the Member States do not represent a complete transposition of this Directive. It will continue to use its powers when appropriate to ensure full implementation of this Directive. The Commission calls on Member States, as a matter of urgency, to take the necessary measures to fully transpose the following Directives into national law and communicate them to the Commission: ·the EU Passenger Name Record Directive, where 3 Member States still need to notify transposition into national law and 2 Member States need to complete the notification of transposition; ·the Directive on security of network information systems, where 2 Member States still need to notify transposition into national law and 1 Member State needs to complete the notification of transposition; ·the Directive on combating terrorism, where 3 Member States still need to notify transposition into national law and 4 Member States need to complete the notification of transposition; ·the Directive on the control of the acquisition and possession of weapons, where 17 Member States still need to notify transposition into national law and 5 need to complete the notification of transposition; ·the Data Protection Law Enforcement Directive, where 5 Member States still need to notify transposition into national law and 5 Member States need to complete the notification of transposition; and ·the 4th Anti-Money Laundering Directive, where 1 Member State still needs to complete the notification of transposition.

2.Protecting public spaces: Recommended good practices As part of the practical work to improve protection and resilience against terrorism, the Commission continues to support Member States and their local authorities in the protection of public spaces. Implementing the October 2017 Action Plan to support the protection of public spaces, the work focuses on developing and gathering guidance and good practices. Working together with public authorities and private operators of public spaces in the so-called Operators’ Forum, the Commission has identified good practices for several measures that all operators and public authorities involved in the protection of public spaces can implement to strengthen security. They provide the basic steps to guide future work within all relevant sectors for the protection of public spaces (see box below). Good practices for public authorities and private operators to strengthen the security of public spaces Assessment and planning ·Establish and undertake vulnerability assessments to identify potential vulnerabilities against attacks by outsiders or insiders; ·Develop and implement a facility or event security plan, including preparatory, emergency and recovery measures, identifying the appropriate security measures for the facility’s or event’s environment. Security measures need to be effective, discreet, proportionate and tailor made for different environments, taking into account their specific functioning; ·Appoint and train a person responsible for the coordination and implementation of security measures contained in the security plan; and ·Develop and implement a crisis management plan. Awareness and training ·Initiate public awareness campaigns on reporting of suspicious behaviour and how to react in the case of an attack compromising the security of a facility or event; ·Develop and implement an internal security awareness programme for all employees; ·Develop and implement an internal insider threats awareness programme that will help protect facilities or events against different types of insider threats, such as sabotage, commercial theft, or terrorist attacks; ·Develop basic security training programmes for all staff and undertake specific security trainings, contributing to the development of a corporate security culture. Develop activities that motivate employees to implement sound security practices and keep a high level of security vigilance; and ·Undertake regular security exercises that will help to identify the level of preparedness to deter and respond to an attack. Physical protection ·Assess security and physical protection issues from the beginning of the design process of a new facility or event; ·Assess the necessary access controls and barriers, whilst avoiding to create new vulnerabilities. Access controls and barriers should not shift risks and create new targets; ·Assess the most appropriate detection technology for explosives, firearms, bladed arms, as well as chemical, biological, radiological and nuclear agents. Cooperation