EUROPEAN COMMISSION Strasbourg,12.12.2017 COM(2017) 779 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE EUROPEAN COUNCIL AND THE COUNCIL Twelfth progress report towards an effective and genuine Security Union



I. INTRODUCTION This is the twelfth monthly report on the progress made towards building an effective and genuine Security Union and covers developments under two main pillars: tackling terrorism and organised crime and the means that support them; and strengthening our defences and building resilience against those threats. It is almost a year since the 19 December 2016 Berlin Christmas market attack which left twelve dead and fifty six injured and was perpetrated by an individual who used multiple identities to evade border and law enforcement authorities. This incident and other terrorist attacks committed by perpetrators who used multiple identities, such as the stabbing in Marseille in October 2017, not only highlighted the importance of effective information sharing between Member State authorities, but also the vital importance of the work begun by the Commission in spring 2016 to overcome the current shortcomings in EU information management which make it possible for an individual to appear in different EU databases using different identities. The legislative proposals for Regulations on the interoperability of information systems, tabled as part of a package with this report, are designed to close down the space for terrorists and criminals to exploit the current gaps to perpetrate identity fraud, thereby better protecting the EU's external border, strengthening internal security and improving the management of migration. The proposals represent a step-change not only in the way the EU manages information for security, border and migration management but also in making that data available to national authorities, to ensure that they have the information they need, when and where they need it. Given the central importance of these proposals to enhancing the effectiveness of border and law enforcement, the Commission now calls on the co-legislators to work on the legislative proposals on interoperability as a matter of the highest priority, and also to reach rapid agreement on the remaining legislative proposals on the table that relate to individual information systems to provide those in the front line with the information they need to do their jobs in keeping our citizens safe. This report therefore focuses on the next steps towards stronger and smarter information systems for security, borders and migration management, to make the data architecture of EU information systems more effective and efficient, while at the same time ensuring full respect of data protection requirements. This report also takes stock of a number of actions designed to maximise the benefits of existing information systems, covering legislative work as well as ongoing work to ensure their full implementation and better application of EU information systems. The October 2017 European Council took stock of the implementation of the Bratislava roadmap and noted the significant progress made by the EU, in particular in the area of internal security, in four areas: intensified cooperation and information exchange, increased checks and interconnection of databases, development of a European Travel Information and Authorisation System (ETIAS) and systematic efforts against radicalisation. This report shows that further progress has been made in all these areas over the last two months. II. STRONGER AND SMARTER INFORMATION SYSTEMS FOR SECURITY, BORDER AND MIGRATION MANAGEMENT Recent surveys show that EU citizens strongly support increased cross EU sharing of information in the fight against terrorism and organised crime. The information provided by EU systems plays a vital role in helping national authorities to manage the external border, to fight crime and terrorism, and to curb irregular migration. To maximise this EU added value, the information provided by EU systems needs to be complete, accurate and reliable. The current picture is fragmented, complex and difficult to use. To address these shortcomings, in line with the April 2016 Commission Communication, work has focused on three areas: maximising the benefits of existing information systems, developing new and complementary systems to plug gaps, and improving the interoperability of information systems. 1.Towards the interoperability of information systems First, the proposed measures will help officers on the ground to make best use of existing data. A European search portal will provide a "one stop shop" – enabling the simultaneous search of multiple EU information systems as well as the relevant Europol data and Interpol systems, in line with the users' access rights. This will give officers on the ground efficient, fast and seamless access to the data they need to do their job and remove the current complexity of deciding which database should be checked in any given situation. Second, by using biometric data, the proposed measures will allow national authorities to detect multiple identities and counter identity fraud. A shared biometric matching service will enable the search and comparison of biometric data from several central systems, while a common identity repository will contain the shared biographical and biometric identity data of third-country nationals present in EU information systems. Building on these two interoperability components, a multiple-identity detector will check whether data on a queried identity exists in more than one of the systems connected to it. Whenever immigration and asylum officers record a person in EU information systems, or when police officers and border guards check a person against these systems, they will be informed if the person is already known under a different identity, or if the person uses multiple identities. This will close the current gaps and blind spots that terrorists and other criminals seek to exploit by hiding behind false or multiple identities. Third, the proposed measures will enable police officers to carry out rapid and effective identity checks within their territory. During such checks, police officers will have access to the identity data of third-country nationals whose data is recorded in EU information systems, allow for the correct identification and detection of multiple identities. This will increase substantially the effectiveness of checks within Member States' territory, also in line with the Commission's recommendation on proportionate police checks and police cooperation in the Schengen area. To complement these interoperability components, the Commission also proposes to facilitate and streamline law enforcement access to non-law enforcement systems by introducing a new two-step data consultation approach. Already under current rules, law enforcement authorities can consult non-law enforcement information systems for the purpose of prevention, investigation, detection or prosecution of terrorism and other serious criminal offences. However, the respective systems are governed by different access conditions and safeguards, and some of the current rules hinder the efficiency of the legitimate use of the systems by these authorities. Under the new two-step data consultation approach, a law enforcement officer would first check in parallel all the systems storing their data in the common identity repository in order to know whether information on the searched person existed in any of the systems. To ensure data protection, only a "hit/no-hit" reply would be given. The officer would not have access to any data in any system but crucially would know if and where such data existed. In a second step, the officer would then be able to request full access to the information system(s) that generated hits, with an individual access request for each system concerned and in line with the respective rules established by each system concerned. Like today, the officer would need to justify the need to access the system, in line with that information system's access rights and purpose limitation principles, with subsequent full access remaining subject to prior authorisation by a designated authority and continuing to require a specific user ID and login. Once such a two-step data consultation approach applies, there will no longer be any need for a prior search in national databases and the launch of a prior search in the automated fingerprint identification system of other Member States under Decision 2008/615/JHA ('Prüm check'). The interoperability proposals respect and promote fundamental rights and in particular the right to data protection. With the new comprehensive framework for the protection of personal data in the EU in place and significant developments in technology and IT security, the principle of purpose limitation can be more easily implemented at the level of access and use to data stored, in full compliance with the Charter of Fundamental Rights and with recent European Court of Justice’s jurisprudence. The proposed measures will not lead to the interconnectivity of the individual systems. Each system will keep its specific purpose limitation, access rules and data retention rules. The proposed measures will also not lead to an increase in the collection of new data. They provide a targeted and intelligent way of using existing information held in EU systems to best effect. The legislative proposals are the result of an inclusive and transparent process that started with the Commission Communication on Stronger and Smart Information Systems for Borders and Security of April 2016 which was followed up by a High-Level Expert Group to address the legal, technical and operational challenges of different options to achieve interoperability. The legislative proposals include detailed provisions for the necessary changes to the legal instruments that are currently stable texts as adopted by the co-legislators, namely the Schengen Borders Code, the Entry/Exit System Regulation, the legal instruments governing the Visa Information System. The other instruments covered are currently under negotiation in the European Parliament and Council. For these instruments it is therefore not possible to set out the necessary amendments at this stage. The Commission will present such amendments for each for these instruments within two weeks after a political agreement on the respective draft Regulation will be reached. It calls on the co-legislators to reach swift agreement in the ongoing negotiations on these instruments. 2.Developing new and complementary actions to address gaps In addition to the new proposals on interoperability set out above, it is vital that progress continues to be made on closing the current information gaps that the Commission identified in its April 2016 Communication in respect of third-country nationals visiting the Schengen area. The final texts of the Regulation on the EU Entry/Exit System (EES) and the Regulation amending the Schengen Borders Code to align it to the EES were adopted by the co-legislators at the end of November with entry into force by the end of 2017. Following this development of the system will start in 2018 to ensure that it is fully operational by 2020. A further information gap – that of third country nationals who do not require a visa – was addressed in the Commission's November 2016 legislative proposal to establish a new large-scale IT system, the European Travel Information and Authorisation System (ETIAS). The Council agreed its General Approach in June 2017 and the European Parliament's negotiating mandate was confirmed on 25 October 2017. Trilogue negotiations began the same day and continued on 16 November 2017 and 29 November 2017. The next political trilogue is scheduled to take place on 12 December 2017. The Commission calls on both co-legislators to reach a political agreement on the file by the end of 2017, in line with the European Council conclusions of December 2016 and the Joint Declaration.

3.Maximising the benefits of existing information systems (a) Ongoing legislative work to strengthen existing information systems As part of the Commission's efforts to maximise the potential of existing EU information systems, the Commission adopted three legislative proposals, in December 2016, to strengthen the Schengen Information System (SIS). These include key measures to step up the fight against terrorism, such as introducing an obligation on Member States to create an alert in SIS if a person is sought in relation to a terrorist offence. Discussions in the European Parliament and the Council have also included the need to share information on terrorist offences in SIS with Europol, with amendments being proposed to make it possible for Europol and Member States to exchange supplementary information on SIS hits related to terrorism, and for Europol to cross-check information on newly created alerts and hits on such alerts against its databases and analytical work files. Negotiations between the European Parliament and the Council on these proposals began on 16 November 2017. Given the importance of these proposals, the Commission urges the co-legislators to reach an agreement on the proposals by early 2018. In parallel, as planned since 2016, work continues to strengthen the SIS by introducing an automated fingerprint identification system (AFIS). This will allow end users of SIS (such as police officers and border guards) to search the SIS on the basis of fingerprint data, allowing for reliable identification of people, including those travelling under false identities. Nine Member States have volunteered to take part in the first phase of the roll-out of the AFIS, expected to begin in March 2018. The full roll-out to all Member States using SIS is expected to be completed later that year. As regards the legislative proposal to reinforce the Eurodac system, trilogues are ongoing. Eurodac is one of the information systems that will be covered by the interoperability components, which is why it is important that the co-legislators reach swift agreement on this file. In the Communication setting out the Commission's contribution to the Leaders' meeting on a way forward on the external and the internal dimension of migration policy, the Commission calls for the proposal to be adopted by March 2018. To further close down the space for terrorists and criminals, on 29 June 2017, the Commission presented a supplementary proposal to facilitate the exchange of criminal records of third-country nationals in the EU through the European Criminal Records Information System (ECRIS). The Justice and Home Affairs Council adopted, on 8 December 2017, a general approach on both the proposed Directive and Regulation. The trilogue discussions between the co-legislators could start as soon as the European Parliament adopts its negotiating mandate on both ECRIS proposals. The Commission calls on both co-legislators to reach swift agreement on the proposals. On 29 June 2017, the Commission adopted a proposal to revise the mandate of the Agency for the operational management of large-scale IT systems in the area of freedom, security and justice. The Agency should be tasked with contributing to the development of interoperability between large-scale IT systems and with this in mind, the proposal is designed to review the Agency's establishing Regulation to take account of the recommendations stemming from the evaluation of the Agency, and to improve its functioning and enhance and strengthen its role to ensure that it can meet current challenges at EU level. It also aims at inserting changes deriving from policy, legal or factual developments and in particular to reflect that new systems will be entrusted to the Agency. The European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) adopted its negotiating mandate on 7 December 2017, and the Council reached a general approach on the same day. (b) Ensuring the full implementation of existing information systems A key tool in the fight against terrorism and organised crime is the Passenger Name Records (PNR) Directive. Although work continues across all Member States to ensure the full implementation of the Directive by the deadline of 25 May 2018, one year after the November 2016 PNR Implementation Plan significant disparities remain between Member States' progress in setting up their national PNR systems. The transposition deadline is fast approaching. It is therefore crucial that these efforts intensify to deliver a successful conclusion by 25 May 2018. Of particular importance is the putting in place of the procedures and communication channels to allow national Passenger Information Units to share all relevant PNR data with the Passenger Information Units of other Member States and with Europol. This vital EU security tool will only be able to reach its full potential when all Member States have operational PNR systems in place and are able effectively to exchange data among themselves and with Europol. As of 15 November 2017, the picture is the following: ·Seven Member States already have both the legal and the technical capability to collect and process PNR data. However, most of these Member States still need to adjust their respective legal bases in order to be fully aligned with the requirements of the PNR Directive. ·Thirteen Member States are at an intermediary stage of implementation. Out of these, four have their Passenger Information Units (PIUs) established and equipped, but do not collect and process real PNR data because of the lack of a legal basis allowing the collection of personal data. The remaining nine Member States are in various stages of finalisation of the development or installation of the PIU and its technical solution to be used to process PNR data according to the requirements of the PNR Directive, while the engagement with air carriers is still ongoing. However, some of these nine Member States have already adopted legislation on PNR. ·Seven Member States are at a insufficiently advanced stage of the implementation process and still need to define the administrative architecture of their PIU, and/or submit the relevant legislation to their Parliaments, and/or start installing the technical solution to be used by the PIU, and/or launch the process to establish connectivity with air carriers. he Commission continues to support Member States in their efforts to implement the Directive in a timely manner. The sixth meeting on the implementation of the PNR Directive was held on 3 October 2017 and allowed Member States' experts to update each other and the Commission on their progress in the implementation process and to share lessons learned, best practice and practical experience. Financial assistance has been made available through the national programmes and EU actions under the Internal Security Fund – Police to support the setting up of functional PIUs at national level and enable the exchange of PNR data between them in line with the PNR Directive. Work also continues to ensure the full implementation of the Prüm Decisions for the exchange of fingerprint data, DNA data and vehicle registration data. While most Member States have made progress in this regard, the Commission has had to use its infringement powers. The Commission sent Reasoned Opinions to Croatia, Ireland and Italy on 18 May 2017, and to Greece on 5 October 2017. In parallel, the Commission continues to support Member States by providing funding for implementation under the national programmes within ISF – Police. The Commission has provided an additional EUR 22 million to these national programmes for 2017 and this funding can be used for the implementation of Prüm. (c) Support for better application of existing information systems In addition to strengthening existing systems and ensuring their full implementation, the Commission is also working hard to support better application of existing information systems. Under the Schengen evaluation mechanism, on-site evaluations of the implementation of SIS take place in Member States every five years, carried out by Member State and European Commission experts in the field. In 2017, evaluation visits were carried out in Denmark, Iceland, Sweden, Portugal, Spain, Croatia, Norway and the UK. Any implementation issues identified during the evaluations are addressed through formal recommendations by the Council to the Member State concerned. Progress on past recommendations also forms part of the checks carried out by the evaluation teams during their on-site visits. Building on the findings of the Schengen evaluations carried out so far on the use of the Schengen Information System, the Commission will elaborate a set of best practices and lessons learned that provide added value across Member States to improve the application of existing information systems, for subsequent discussion with Member States. To further improve information flows, Member States should make full use of technical solutions to improve the sharing of information with Europol. Automating the process of uploading data to the Europol information system for cross-checking purposes can significantly improve the sharing of relevant and up to date information with Europol and with other Member States. So-called 'data loaders' provide a technical tool for such automated uploading of data. Europol has developed such data loaders to allow Member States to improve their performance in uploading, updating and deleting data in Europol information system. These data loaders are already in use in several Member States. In order to make Europol data available to a much wider group of police officers, an ongoing pilot project including five Member States (Spain, Estonia, Finland, Greece, Poland) focuses on the use of QUEST, a system interface that allows integrating automatic queries to Europol data from national police information systems. This interface is expected to become operational in the beginning of 2018, after the validation by European Data Protection Service and operational tests by the Member States. The Commission has contracted a study assessing the completeness and conformity of the measures of Member States to transpose the Swedish framework decision that provides a common legal framework for the exchange of information between Member States' law enforcement authorities. The results are expected in the first quarter of 2018 and will be examined to see if new action is necessary. On 3 October 2017, the Commission issued a reasoned opinion to Luxembourg for non-communication of national measures taken to implement this decision. III. IMPLEMENTATION OF OTHER PRIORITY FILES ON SECURITY

In addition to the work on closing information gaps and strengthening information systems, work has continued in a number of other areas of the Security Union. 1.Measures to improve protection and resilience against terrorism and crime As a follow-up to the adoption of the Commission Action Plan on the protection of public spaces, the first meeting of the High Risk Security Network took place on 14-15 November 2017. The Spanish Guardia Civil Unit tasked with protection of high-risk places hosted this first conference at its headquarters in Logroño, Spain. This new network aims to support the development of new tactics to better protect high-risk public spaces. Moreover, the first meeting of the Operators' Forum will take place in Brussels on 20 December 2017, back-to-back with a dedicated thematic meeting on car rentals on 21 December 2017. Preparations have also started in regard to a meeting with mayors of European cities that will be held together with the Committee of the Regions in spring next year. Responding to a heightened level of threat to transport, and specifically rail networks, some Member States have reinforced their security measures to protect rail transport. These measures have been carried out in a fragmented way, highlighting the need for improved coordination in the area of rail security. The Commission has therefore announced, in its Work Programme 2018, its intention to work towards further measures to improve passenger railway security. In the area of research, the Security Research Event 2017 was co-organised by the European Commission and the Estonian Presidency in Tallinn on 14-15 November 2017. There was a wide acknowledgement that additional efforts are required to bridge the gap between research outputs, and effective products and services that can be used to tackle different security threats such as terrorism, cybercrime and natural disasters. Involving industry, academia, public authorities and practitioners in a co-creation process would help bring together supply-side (industry) and demand-side (end-users) to consolidate future requirements and agree on possible solutions that can have a practical impact and facilitate the work of security practitioners in the near future. The Commission will consider how to take these ideas forward. 2.Tackling the means that support terrorism Discussions with co-legislators continued on the Commission proposal for amendments to the 4th Anti-money Laundering Directive, which will help in the fight against terrorism financing. The Commission again calls on the co-legislators to finalise swiftly the legislative negotiations on this priority file and agree on a compromise that enhances the current set of Union rules on the prevention of money laundering and terrorist financing, including by enhancing transparency of beneficial ownership information. In addition, the proposal for a Directive to harmonise the definition and criminal sanctions of money laundering will help to overcome obstacles to cross-border cooperation in the fight against money laundering. A general approach was reached in Council on 8 June 2017. With the European Parliament adopting its position on 11 December 2017, the interinstitutional discussions will soon commence with a view to reaching agreement in the first half of 2018. Work continues on possible measures to improve cross-border access by law enforcement authorities to relevant financial data that might provide necessary leads on terrorist activities, as announced in the Commission's Work Programme 2017. On 20 November 2017, the Commission organised a high-level stakeholder meeting with Member States and EU bodies to assess the need for additional measures to facilitate cross border access to financial information for counter-terrorism purposes. In this meeting, Member States noted that the various measures, whether existing, ongoing or planned, might provide the necessary tools and solutions, notably the European Investigation Order, the Anti-Money Laundering Directive (including the proposal for amendments currently under negotiation) and a forthcoming call for proposals to support Counter-Terrorism Financing projects. The proposal for a revised 4th Anti-Money Laundering Directive envisages the mandatory establishment of national centralised bank account registries and retrieval systems, to which Financial Intelligence Units and anti-money laundering authorities would have access. The Commission is currently assessing the impact of relevant policy options with a view to proposing, in spring 2018, a Directive to grant law enforcement authorities and asset recovery offices access to the registries and data retrieval systems in their own Member State. The Commission is also working on initiatives to improve the cooperation between Financial Intelligence Units as well as their cooperation with law enforcement authorities. This work should also be finalised in spring 2018. In parallel, and in view of preparing the necessary initiatives to facilitate cross-border access to financial data by law enforcement authorities, the Commission will continue to assess the necessity, technical feasibility and proportionality of any additional measures. The Commission adopted today a report on the evaluation of Regulation 258/2012 on export authorisation, and import and transit measures for firearms. It concludes that the Regulation remains necessary but that its efficiency is limited by the lack of precision of some of its provisions, as well as by a complex interplay with other instruments of EU law. In order to exchange views on these conclusions, the Commission will meet with national experts at the end of January 2018. It will also convene several meetings to move ahead on a number of challenges (seizure statistics, ballistics, cooperation with the Western Balkans countries). On 18 October 2017, the Commission issued a Recommendation on immediate steps to prevent misuse of explosives precursors, urging Member States to urgently take a number of actions aiming to strengthen protection against the use of home-made explosives for terrorist purposes and supporting the objectives of Regulation 98/2013 on explosives precursors. A meeting of the Standing Committee on Precursors, on 12-13 December 2017, will take stock of the progress achieved by Member States in the implementation of the Recommendation. On 6 December 2017, the Commission decided to close the infringement procedure against France on the non-compliance with Regulation 98/2013, given that France informed the Commission of full implementation of the Regulation. In parallel, the Commission is revising Regulation 98/2013 with a view to tightening the restrictions and controls on the sale, possession, introduction and use of explosives precursors, improving the capacity of economic operators and Member State competent and law enforcement authorities to detect and prevent instances of misuse, and increasing the degree of uniformity in the application of the Regulation across Member States. The impact assessment on the various options in revising the Regulation will be concluded in spring 2018. 3.Cybersecurity and criminal justice in the cyberspace The European Council Conclusions of 19 October 2017 acknowledged the initiatives of the Cybersecurity Package. On 20 November 2017, the Council adopted Conclusions on the Joint Communication to the European Parliament and the Council "Resilience, Deterrence and Defence: Building strong cybersecurity for the EU". An action plan to implement those Council Conclusions will be adopted by the General Affairs Council on 12 December 2017. The discussions with the Council on the proposed 'Cybersecurity Act' (covering the new ENISA mandate and the certification framework) have started. The legislative proposal on non-cash means of payments has been presented to the European Parliament and Council and its examination is under way. The Commission urges that work in the European Parliament starts now that the Rapporteur was appointed on 13 November 2017. Regarding the implementation of the NIS Directive, a meeting of the Cooperation Group took place on 28 November. The Group adopted two of its deliverables concerning key aspects of the Directive: guidelines on the identification of operators of essential services concerning good practices related to the criteria defining the criticality of an operator, and guidelines on security measures providing an overview of benchmarks for measures to be applied when securing network and information systems. A third deliverable on notification requirements, setting out the circumstances in which Operators of Essential Services will be required to notify an incident, is expected to be adopted soon in written procedure. The Group has started engaging in talks concerning its first Work Programme (2018-2020), which should be adopted by February 2018. The Commission committed in the 11th Security Union Progress Report to assess the need for additional resources for Europol (in particular the European Cybercrime Centre, EC3) to enable EC3's support to Member States to address challenges related to encryption in criminal investigations. Considering the economies of scale achieved by providing an EU-level capability (compared to individual solutions at Member-State level), the Commission also took note of the need for further support in this area as called for by the Justice and Home Affairs Council on 7-8 December 2017. The assessment of the specific needs for additional resources is ongoing, and the Commission will report in the next Security Union Progress Report on the funds made available to this end. Enabling law-enforcement agencies from Member States to use tools provided by EC3 in a fast-changing field will allow the best return on investment and ensure that the European capabilities will remain up-to-date with the challenges, without prohibiting, limiting, or weakening encryption. At the JHA Council meeting on 7-8 December 2017, Member States decided to continue discussions at expert level with a view to finding a common understanding of possible solutions on data retention in line with the Tele2 ruling of 21 December 2016. The Commission will continue to support Member States in this process. The Commission considers this process to be part of its own assessment on the ruling’s implications and its ongoing work to finalise its guidance on the way forward on data retention as announced in the Commission Work Programme for 2018. As previously announced, the Commission envisages bringing forward a legislative initiative on electronic evidence in early 2018 to facilitate law enforcement access to electronic evidence located in another country.