EUROPEAN COMMISSION Brussels, 24.7.2019 COM(2019) 353 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE EUROPEAN COUNCIL AND THE COUNCIL Nineteenth Progress Report towards an effective and genuine Security Union



I. INTRODUCTION This is the nineteenth report on the further progress made towards building an effective and genuine Security Union and covers developments under two main pillars: tackling terrorism and organised crime and the means that support them; and strengthening our defences and building resilience against those threats. Europeans rightly expect their Union to keep them safe. The Juncker Commission made security a top priority from day one. In the European Council’s ‘A new strategic agenda 2019-2024’, the objective of ‘protecting citizens and freedoms’ ranks top of four main priorities for the Union. The European Council further announced that it will build on and strengthen the Union’s efforts in the fight against terrorism and cross-border crime, including through improving cooperation and information sharing and further developing common instruments. Thanks to close cooperation between the European Parliament, the Council and the Commission, the EU has taken significant strides in the joint work towards an effective and genuine Security Union, putting in place a number of priority legislative initiatives and implementing a wide range of non-legislative measures to support its Member States and enhance security for all citizens. The Union has taken decisive action to close down the space in which terrorists and criminals operate, denying terrorists the means to carry out attacks by prohibiting the acquisition and use of certain firearms and explosives and limiting the access to financing. The EU has also reinforced information sharing between Member States and closed information gaps and blind spots, while countering radicalisation, protecting Europeans online, tackling cyber and cyber-enabled threats, reinforcing the management of the Union’s external borders, and strengthening international cooperation in the area of security. At the same time, there are still a number of priority initiatives in the Security Union pending adoption by the co-legislators. Following the constitution of the 9th legislature of the European Parliament on 2 July 2019, this report: ·sets out where action is required by the co-legislators to address immediate threats. There is a particularly urgent need for action to counter terrorist propaganda and radicalisation online; ·sets out pending priority initiatives in the Security Union that require further action by the co-legislators to enhance cybersecurity and to facilitate the access to electronic evidence and to complete the work on stronger and smarter information systems for security, border and migration management; ·updates on the joint and urgent work launched in March 2019 to assess and strengthen the security of 5G networks, building on the national risk assessments that Member States submitted by 15 July 2019; ·addresses a package of four reports related to anti-money laundering, adopted by the Commission on 24 July 2019, that analyse the current risks and vulnerabilities in money laundering and assess how the relevant EU regulatory framework is being applied in the private and public sector; ·provides an update on the progress made since March 2019 in implementing legislative measures in the Security Union, with the interoperability of information systems being one of the top priorities for swift and complete implementation by Member States; ·takes stock of on-going work to counter disinformation and protect elections against cyber-enabled threats, efforts to enhance preparedness and protection against security threats, and the cooperation with international partners on security issues. II. DELIVERING ON LEGISLATIVE PRIORITIES 1. Preventing radicalisation online and in communities Preventing radicalisation is at the heart of the EU response to terrorism, both online and in our communities. The horrific attack in Christchurch, New Zealand on 15 March 2019 served as an appalling reminder of how the internet can be harnessed for terrorist purposes, whether fuelled by jihadism, far right extremism or any other extremist ideology. The speed and scale at which the livestreamed Christchurch attack video spread across internet platforms highlighted the vital importance of internet platforms having adequate measures in place to stem the rapid propagation of such content. In response, Heads of State or Government of some Member States and third countries, President Juncker and online platforms supported on 15 May 2019 the ‘Christchurch Call to action’ that sets out collective actions that aim to eliminate terrorist and violent extremist content online. Further commitments in that respect have been taken by the G7 and G20. The Commission has already addressed the clear and present danger posed by terrorist content online with the legislative proposal that President Juncker announced in his 2018 State of the Union address, proposing a clear and harmonised legal framework to prevent the misuse of hosting service providers for the dissemination of terrorist content online. The proposed measures would make it mandatory for internet platforms to take down terrorist content within one hour when they receive a removal order from competent authorities in any Member State. Additionally, if a platform is being abused to spread terrorist content, it would have an obligation to make use of proactive measures to detect this content and prevent it from reappearing – with clear rules and safeguards. Member State authorities would have to ensure dedicated law enforcement capacity with the resources to effectively detect terrorist content and issue removal orders. This will allow for a fast and effective Union-wide system, and will put robust safeguards in place, including effective complaint mechanisms and provision for judicial redress.

The proposed measures will help guarantee the smooth functioning of the Digital Single Market, whilst increasing security and enhancing trust online and strengthening safeguards for freedom of expression and information. In the Council, the Justice and Home Affairs Ministers agreed a general approach on the proposal in December 2018. The European Parliament adopted its position in first reading in April 2019. The Commission calls on both co-legislators to enter into inter-institutional negotiations as quickly as possible on this priority initiative to remove terrorist content online, with a view to reaching swift agreement on an EU regulatory framework with clear rules and safeguards.

In parallel, the Commission is continuing the cooperation with online platforms in the framework of the EU Internet Forum. As announced by President Juncker at the Paris meeting on 15 May 2019 on the ‘Christchurch Call to action’, the Commission has, together with Europol, initiated work on the development of an EU crisis protocol to allow governments and internet platforms to respond rapidly and in a coordinated manner to the dissemination of terrorist content online, for instance in the immediate aftermath of a terrorist attack. This work is part of the efforts at international level to implement the ‘Christchurch Call for Action’. In addition to further discussions with Member States and industry and a table top exercise planned for September 2019 to simulate an emergency situation, the Commission will convene an EU Internet Forum Ministerial meeting on 7 October 2019 with a view to endorsing the EU crisis protocol. Moreover, the Commission is continuing its efforts to support Member States and local actors in preventing and countering radicalisation on the ground in local communities across Europe. This requires long-term, sustainable efforts involving all relevant actors at local, national and EU level. The Steering Board for Union actions on preventing and countering radicalisation, set up in August 2018 to advise the Commission on how to strengthen the EU policy response in this area, held its second meeting on 17 June 2019 to explore further actions in priority areas such as radicalisation in prisons and countering extremist ideologies. As frontline and grassroots practitioners are often best placed to identify early warning signs of radicalisation and ways to address them, the EU-funded Radicalisation Awareness Network continues to support front-line responders, connecting around 5,000 practitioners from civil society, schools and police, as well as national coordinators and policy-makers. Recent collaboration of front-line practitioners within the Network led to a deeper understanding of the challenges of far right extremism. This year the Radicalisation Awareness Network will publish fact sheets to help policy makers and practitioners to identify the main forms and manifestations of far right and Islamist extremism, such as key narratives, language, forms, symbols, typologies and strategies. Finally, as local actors and cities are at the forefront in preventing and countering radicalisation, the Commission supports city-led initiatives on anti-radicalisation. Following up on a Conference on ‘EU Cities against Radicalisation’ on 26 February 2019, the first meeting of a pilot group of about 20 cities hosted by the Mayor of Strasbourg took place on 8 July 2019 to step up the exchange of best practices and enhance cities’ efforts in this area. In parallel, work is ongoing in supporting partner countries in addressing radicalisation that can lead to terrorism, including in prisons. In order to counter the threat posed by terrorist content online, the Commission calls on the European Parliament and the Council: ·to enter into negotiations on the legislative proposal to prevent the dissemination of terrorist content online, with a view to reaching swift agreement on an EU regulatory framework with clear rules and safeguards. 2. Enhancing cybersecurity Cybersecurity remains a key security challenge. The EU has made important progress on tackling ‘classic’ cyber threats targeting systems and data, implementing the actions set out in the September 2017 Joint Communication on ‘Resilience, Deterrence and Defence: Building strong cybersecurity for the EU’. This inlcudes the EU Cybersecurity Act that gives a permanent mandate to the European Union Agency for Cybersecurity, strengthening its role, and establishes an EU framework for cybersecurity certification. The Commission has also addressed sector-specific requirements, for example through its Recommendation on cybersecurity in the energy sector adopted on 3 April 2019. But the continued increase in activity from malicious actors across a diverse range of targets and victims, means that efforts to counter cybercrime and enhance cybersecurity remain a priority for EU action. The European Parliament and the Council still need to reach agreement on the Commission’s priority initiative for a European Cybersecurity Industrial, Technology and Research Competence Centre and Network of National Coordination Centres. The proposal aims to support cybersecurity technological and industrial capacities and to increase the competitiveness of the Union’s cybersecurity industry. Both co-legislators adopted their negotiating mandates in March 2019. As it was not possible to conclude the inter-institutional negotiations before the end of the previous term of the European Parliament, the latter formally adopted its position in first reading. In the meantime, the discussions between Member States in the Council are continuing, with a particular focus on the interaction between the proposed Regulation establishing the Cybersecurity Competence Centre and Network on the one side and the Horizon Europe and Digital Europe programmes on the other. The Commission calls on both co-legislators to resume and swiftly conclude inter-institutional negotiations on this priority initiative to enhance cybersecurity. Meanwhile, the Commission continues to support research and innovation related to cybersecurity, making available EUR 135 million in the current multiannual financial framework for projects in areas such as cybersecurity in critical infrastructures, intelligent security and privacy management, and tools specifically for citizens and small and medium-sized enterprises. In July 2019, the Commission issued a new call for proposals under the Connecting Europe Facility programme, making available EUR 10 million for EU funding to key actors identified by the Directive on the security of network and information systems (NIS Directive) such as European Computer Security Incident Response Teams, operators of essential services (e.g. banks, hospitals, utility providers, railways, airlines, domain name providers) and various public authorities. For the first time, European cybersecurity certification authorities are also eligible to apply for this programme in order to allow them to implement the EU Cybersecurity Act. On 17 May 2019, the Council adopted a sanctions regime which allows the EU to impose targeted restrictive measures to deter and respond to cyber-attacks constituting an external threat to the EU and its Member States. The new sanctions regime is part of the EU’s cyber diplomacy toolbox, a framework for a joint EU diplomatic response to malicious cyber activities that allows the EU to make full use of measures within the Common Foreign and Security Policy to deter and respond to malicious cyber activities. Beyond cyber threats targeting systems and data, the EU is also taking action to address the complex and multifaceted challenges posed by hybrid threats. The European Council, in its conclusions of 21 June 2019, underlined that ‘the EU must ensure a coordinated response to hybrid and cyber threats and strengthen its cooperation with relevant international actors’. The Commission welcomes that countering hybrid threats is also a priority of the Finnish Council Presidency and that a scenario-based policy discussion on hybrid threats was held at the 18-19 July 2019 informal meeting of Justice and Home Affairs Ministers in Helsinki. Similar scenario-based discussions on hybrid threats took place between EU defence policy directors on 7–8 July 2019 and between EU political directors on 9-10 July 2019, the outcome of which will be reported to foreign and defence ministers at a joint informal session on 29-30 August 2019. In order to enhance cybersecurity, the Commission calls on the European Parliament and the Council: ·to reach swift agreement on the legislative proposal for a European Cybersecurity Industrial, Technology and Research Competence Centre and Network of National Coordination Centres. 3. Improving law enforcement access to electronic evidence The EU has taken further action to deny terrorists and criminals the means to act, making it harder for them to access explosives precursors, finance their activities and travel without detection. Negotiations on the Commission’s April 2018 proposals to improve law enforcement access to electronic evidence should be finalised as quickly as possible – more than half of all criminal investigations today involve a cross-border request to access electronic evidence. The Council adopted its negotiating position on proposals for a Regulation to improve the cross-border access to electronic evidence in criminal investigations and for a Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings. Given the crucial importance of efficient access to electronic evidence for the investigation and prosecution of cross-border crimes such as terrorism or cybercrime, the Commission urges the European Parliament to advance on this proposal so that the co-legislators can work to swift adoption. In parallel, the Commission is working on improving and ensuring necessary safeguards in international exchange of electronic evidence in the context of the ongoing negotiations of a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime, as well as with the United States in line with the negotiating mandates given by the Council at the Justice and Home Affairs Council meeting on 6-7 June 2019. The Commission participated in the latest round of negotiations on a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime on 9-11 July 2019. The Commission and the United States authorities are currently preparing at technical level for the formal launch of the negotiations for an EU-U.S. Agreement on cross-border access to electronic evidence. In order to improve law enforcement access to electronic evidence, the Commission calls on the European Parliament: ·to adopt its negotiating mandate on the legislative proposals on electronic evidence to enter swiftly into trilogue discussions with the Council. (Joint Declaration priority)

4. Stronger and smarter information systems for security, border and migration management Following the adoption of rules on the interoperability of information systems, which will close information gaps and blind spots by helping to detect multiple identities and countering identity fraud, the Commission swiftly launched a series of initiatives to support Member States in the implementation process, including with funding where needed, as well as with workshops to facilitate the exchange of expertise and best practice. Close cooperation between EU Agencies, all Member States and Schengen associated countries will be paramount in order to achieve the ambitious objective of achieving full interoperability of EU information systems for security, border and migration management by 2020. This objective also requires swift and complete implementation of recently agreed legislation to establish new information systems – the EU Entry/Exit System and European Travel Information and Authorisation System – as well as to reinforce the Schengen Information System and to extend the European Criminal Records Information System to third-country nationals. The new architecture for stronger and smarter information systems for security, border and migration management will only make a difference on the ground if all components are fully implemented at Union level and by each Member State, in accordance with the agreed timetable. At the same time, there is need for further action by the co-legislators to complete the work on stronger and smarter information systems for security, border and migration management.

As part of the technical implementation of the European Travel Information and Authorisation System, the Commission presented two proposals on 7 January 2019 setting out technical amendments to the related Regulation that are necessary to fully set up the system. The Commission calls on the co-legislators to advance their work on these technical amendments in order to reach agreement as soon as possible, thus enabling swift and timely implementation of the European Travel Information and Authorisation System to make it operational in early 2021. In May 2018, the Commission presented a proposal to strengthen the existing Visa Information System providing for more thorough background checks on visa applicants and closing information gaps through better information exchange between Member States.

The Council adopted its negotiating mandate on 19 December 2018, and on 13 March 2019 the European Parliament’s Plenary voted its report on the proposal thus concluding its first reading. The Commission calls for a swift start of negotiations between the co-legislators under the newly constituted European Parliament. In May 2016, the Commission proposed to extend the scope of Eurodac by including not only the identification of asylum applicants but also that of illegally-staying third-country nationals and those who enter the EU irregularly. In line with the December 2018 European Council conclusions and the Commission Communication of 6 March 2019 on progress in the implementation of the European Agenda on Migration, the Commission calls on the co-legislators to proceed to the adoption of the proposal. It is necessary to adopt this legislative proposal in order to enable Eurodac to become part of the future architecture of interoperable EU information systems, thus integrating the crucial data of illegally staying third-country nationals and those who have entered the EU irregularly. In order to strengthen the EU information systems for security, border and migration management, the Commission calls on the European Parliament and the Council: ·to adopt the legislative proposal on Eurodac (Joint Declaration priority); ·to advance the work in view of reaching a swift agreement on the proposed technical amendments that are necessary to establish the European Travel Information and Authorisation System. III. ENHANCING THE SECURITY OF DIGITAL INFRASTRUCTURES The resilience of our digital infrastructure is critical to government, business, the security of our personal data and the functioning of our democratic institutions. The fifth generation (5G) networks which will be deployed in the coming years will form the digital backbone of our societies and economies, connecting billions of citizens, objects and systems, including in critical sectors such as energy, transport, banking, and health, as well as industrial control systems carrying sensitive information and supporting safety systems. With worldwide revenues estimated to reach €225 billion in 2025, 5G is a key asset for Europe to compete in the global market and the security of 5G networks is crucial for ensuring the strategic autonomy of the Union. Ensuring a high level of cybersecurity requires concerted measures at both national and European level, as any vulnerability in 5G networks in one Member State would affect the Union as a whole. Following the support from the Heads of State or Government expressed at the March 2019 European Council, the Commission presented on 26 March 2019 a Recommendation on cybersecurity of 5G networks, setting out actions to assess cybersecurity risks of 5G networks and to strengthen preventive measures. The recommendations build on coordinated EU risk assessment and risk management measures, an effective framework for cooperation and information exchange, and joint EU situational awareness covering critical communication networks. As the first stage of the process initiated by the Recommendation, by 15 July 2019, all Member States had completed their national risk assessment and submitted their findings to the Commission and EU Agency for Cybersecurity, or have announced that they would do so shortly. The national risk assessments followed a set of guidelines and a common template for reporting on findings agreed upon by Member States and the Commission in order to promote consistency and facilitate the exchange of information about national results at EU level. The parameters assessed in all Member States included: ·the main threats and threat actors affecting 5G networks; ·the degree of sensitivity of 5G network components and functions as well as other assets; and ·various types of vulnerabilities, including both technical otherwise, such as those potentially arising from the 5G supply chain. In addition, the work on national risk assessments involved a range of responsible actors in the Member States such as, depending on the national responsibilities, authorities on cybersecurity, telecommunication, security and intelligence services, strengthening their cooperation and coordination. In parallel and in view of their national timetables for 5G deployment, a number of Member States have already taken steps to reinforce applicable security requirements in this area, while several others have indicated their intention to consider new measures in the near future. Based on the results of the national risk assessment, Member States’ cybersecurity authorities in the Network and Information Systems Cooperation Group will prepare a joint review of risks at EU level by 1 October 2019, which will form the second stage of the process initiated under the Recommendation. Building on that, and as the third stage, the Cooperation Group will prepare a common Union toolbox of mitigating measures by 31 December 2019 to address the identified risks. The Commission and the EU Agency for Cybersecurity will continue to support the implementation of the Recommendation. The work in the Network and Information Systems Cooperation Group is supported by several other fora. The Body of European Regulators for Electronic Communications is preparing a survey of all existing security measures that are potentially relevant for 5G. A new dedicated expert group in the EU Agency for Cybersecurity has launched work on the 5G Threat Landscape review. In addition, following the entry into force of the Cybersecurity Act on 27 June 2019, the Commission and the EU Agency for Cybersecurity will take all necessary steps to set up the EU-wide certification framework. Member States also met in the Standards Committee in June 2019 to discuss cybersecurity and standardisation in response to the Recommendation to explore future challenges for cybersecurity standardisation, including 5G networks, and suitable policy initiatives at the EU level.

Finally, the security of 5G networks is of strategic importance for the Union. Foreign investment in strategic sectors, acquisition of critical assets, technologies and infrastructure in the Union and supply of critical equipment may also pose risks to the Union’s security. The new EU framework for the screening of foreign direct investments entered into force on 10 April 2019. Over the next 18 months, the Commission and Member States will take the necessary steps to make sure that the EU can fully apply the Investment Screening Regulation as of 11 October 2020. IV. ANTI-MONEY LAUNDERING The ability of criminals and terrorists to transfer funds between bank accounts in a matter of hours enables them to more easily prepare their acts of terror or to illegally launder the proceeds of crime, across different Member States. To address this challenge, the Union has developed a solid regulatory framework for countering money laundering and terrorist financing, in line with international standards adopted by the Financial Action Task Force. Given the need to keep pace with evolving trends, technological developments and the adapting ingenuity of criminals to exploit any gaps or loopholes in the system, on 24 July 2019, the Commission adopted a package of four reports that analyse the current risks and vulnerabilities related to money laundering, and assess the way the framework is applied by the relevant actors both in the private and public sector. The package includes an assessment of the potential interconnection of national centralised bank account registries and data retrieval systems in the EU. Such national centralised systems allow the identification of any natural or legal person holding or controlling payments accounts, bank accounts and safe deposit boxes – information that is often crucial for competent authorities in the fight against money laundering and terrorist financing. The 5th Anti-Money Laundering Directive requires Member States to put in place such national centralised systems and provide their national Financial Intelligence Units with direct access. The recently adopted rules to facilitate the use of financial information to counter serious crime provide designated law enforcement authorities and Asset Recovery Offices with direct access to their respective national centralised bank account registries. Building on that, and as required under the Anti-Money Laundering Directive, the report assesses various IT solutions at EU level, already operational or under development, which may serve as a model for a possible interconnection of the national centralised systems. Given that a future EU-wide interconnection of the centralised mechanisms would speed up access to financial information and facilitate the cross-border cooperation of the competent authorities, the Commission intends to further consult with the relevant stakeholders, governments, as well as the Financial Intelligence Units, law enforcement authorities and Asset Recovery Offices, as potential ‘end-users’ of a possible interconnection system. As part of the Commission’s reflection on the work of Financial Intelligence Units, a report assessing the cooperation between Financial Intelligence Units looks both at cooperation within the Union and with third countries. It identifies certain shortcomings which are likely to continue to exist until the tasks and cross-border cooperation obligations of Financial Intelligence Units are more clearly spelled out in the EU legal framework for anti-money laundering and countering terrorist financing. The assessment also shows a need for a stronger mechanism to coordinate and support cross-border cooperation and analysis. Looking beyond the existing work to tackle money laundering and terrorist financing, and also in response to a call by the European Parliament, the Commission will continue to assess the necessity, technical feasibility and proportionality of additional measures to track terrorist financing in the EU. V. IMPLEMENTATION OF OTHER PRIORITY FILES ON SECURITY 1. Implementation of legislative measures in the Security Union Reaching agreement on measures under the Security Union is not the end of the process – it is vital to subsequently ensure their swift and complete implementation by Member States so that the full benefits can be enjoyed. To this end, the Commission is actively supporting Member States, including through funding and by facilitating the exchange of best practices.

Where necessary, however, the Commission stands ready to make full use of its powers under the Treaties for the enforcement of EU law, including infringement action when appropriate. The deadline for the implementation of the EU Passenger Name Record Directive passed on 25 May 2018. To date, 25 Member States have notified full transposition to the Commission. Full transposition is still absent in two Member States, despite the infringement procedures launched on 19 July 2018. In parallel, the Commission continues to support all Member States in their efforts to complete the development of their passenger name record systems, including by facilitating the exchange of information and best practices. The deadline for transposition of the Directive on combating terrorism passed on 8 September 2018. To date, 22 Member States have notified full transposition to the Commission. Three Member States still fail to communicate the adoption of national legislation which fully transposes the Directive, despite the infringement procedures launched on 22 November 2018. The deadline for transposition of the Directive on the control of the acquisition and possession of weapons passed on 14 September 2018. To date, 8 Member States have notified full transposition to the Commission. 20 Member States still fail to communicate the adoption of national measures which fully transpose the Directive, despite the infringement procedures launched on 22 November 2018. With respect to the transposition into national law of the Data Protection Law Enforcement Directive, the deadline for transposition passed on 6 May 2018. To date, 20 Member States have notified full transposition to the Commission. 7 Member States still fail to communicate the adoption of national measures which fully transpose the Directive, despite the infringement procedures the Commission launched on 19 July 2018. Member States had until 9 May 2018 to transpose the Directive on the security of network and information systems into national law. To date, 26 Member States have notified full transposition to the Commission and 2 Member States have partially transposed the Directive. Moreover, by 9 November 2018, Member States were required to identify operators of essential services in line with the Directive. By 9 May 2019, the Commission was supposed to submit a report to the European Parliament and the Council assessing the consistency of the approach in the identification of operators of essential services identified within their territory. However, as a number of Member States had yet to submit complete information on the identification process, the Commission has had to delay its report. The Commission is assessing the transposition of the 4th Anti-Money Laundering Directive , while also working to verify that the rules are implemented by Member States. The Commission is engaged in infringement procedures against 24 Member States as it assessed that the communications received from the Member States do not represent a complete transposition of this Directive. The Commission calls on Member States, as a matter of urgency, to take the necessary measures to fully transpose the following Directives into national law and communicate them to the Commission: ·the EU Passenger Name Record Directive, where 1 Member State still needs to notify transposition into national law and 1 Member State needs to complete the notification of transposition; ·the Directive on combating terrorism, where 2 Member States still need to notify transposition into national law and 1 Member State needs to complete the notification of transposition; ·the Directive on the control of the acquisition and possession of weapons, where 12 Member States still need to notify transposition into national law and 8 Member States need to complete the notification of transposition; ·the Data Protection Law Enforcement Directive, where 2 Member States still need to notify transposition into national law and 5 Member States need to complete the notification of transposition; ·the Directive on security of network information systems, where 2 Member States still need to complete the notification of transposition; and ·the 4th Anti-Money Laundering Directive, where 24 Member States still need to complete the notification of transposition. 2. Countering disinformation and protecting elections against other cyber-enabled threats

Protecting democratic processes and institutions from disinformation and related interference is a major challenge for societies across the globe. To tackle this, the EU has put in place a robust framework for coordinated action against disinformation, with full respect for European values and fundamental rights. As set out in the Joint Communication of 14 June 2019 on the implementation of the Action Plan against Disinformation, the work on several complementary strands has helped close down the space for disinformation and preserve the integrity of the European Parliament elections. The European Council, in its conclusions of 21 June 2019, welcomed the Commission’s intention to conduct an in-depth evaluation of the implementation of commitments undertaken by online platforms and other signatories under the Code of Practice against Disinformation and invited the Commission and the High Representative of the Union for Foreign Affairs and Security Policy to continuously assess and appropriately respond to the “evolving nature of the threats and the growing risk of malicious interference and online manipulation associated with the development of Artificial Intelligence and data-gathering techniques”. The Commission and the High Representative will advance its work in this area in line with the European Council’s conclusions. In March 2019, the Commission and the High Representative set up a Rapid Alert System among the EU institutions and Member States to facilitate the sharing of insights related to disinformation campaigns and coordinate responses. The first meeting of Member States’ contact points following the European Parliament elections took place in Tallinn on 3-4 June 2019. To further strengthen the Rapid Alert System, the High Representative and the Commission, in close cooperation with Member States, will review the functioning of the Rapid Alert System in autumn 2019. They will also develop a common methodology for the analysis and exposure of disinformation campaigns as well as stronger partnerships with international partners such as the G7 and NATO. Work also continues in the European Cooperation Network on Elections which held a first meeting on 7 June 2019 to take stock of the elections to the European Parliament. These reflections and further input from relevant national authorities, political parties and online platforms will contribute to the Commission’s comprehensive report on the European Parliament elections to be adopted in October 2019. Member States have used the network with regards to elections other than those to the European Parliament, which highlights its broader usefulness for securing the integrity of democracy in the EU. The Commission will also continue to monitor and promote the implementation of the commitments undertaken by platforms in the Code of Practice against Disinformation.

The reports provided by Google, Twitter and Facebook under the Code of Practice show that all the platforms took action in advance of the European Parliament elections by labelling political ads and making them publicly available via searchable ad libraries. At the same time, there is room for improvement as identified by the European Regulators Group for Audiovisual Media Services. Notably, there is still a lack of access to the detailed raw data necessary for comprehensive monitoring. Finally, platforms should give the research community meaningful access to data, in line with personal data protection rules. Later this year, the Commission will conduct a comprehensive assessment of the implementation of all commitments under the Code of Practice during its initial 12-month period. On this basis, the Commission may consider further actions, including of a regulatory nature, to improve the long-term EU’s response to disinformation. 3. Preparedness and protection Strengthening defences and building resilience against security threats is an important aspect of the work towards an effective and genuine Security Union. This includes the support the Commission provides to Member States and their local authorities to reinforce the protection of public spaces, as well as the support to Member States in enhancing preparedness against chemical, biological, radiological and nuclear security risks, implementing the two action plans in this area, as well as analysing the needs for related response capacities to be developed under rescEU. As regards evolving chemical threats, in cooperation with Member States and in consultation with international partners, the Commission has developed a list of chemicals that are of most concern in terms of misuse for terrorist purposes. The EU list serves as the basis for further work to reduce accessibility to these chemicals, and to work with manufacturers on improving detection capabilities. Technologies for unmanned aircraft allow a wide range of possible operations. With a rapid expansion over recent years in the market in unmanned aircraft systems for military, civilian commercial and hobby purposes, drones represent an opportunity but also an increasing security threat to critical infrastructure (including aviation), public spaces and events, sensitive sites and individuals. In Europe, drones have been used to disrupt aviation and law enforcement operations, to survey critical infrastructure and to smuggle contraband into prisons and over borders. The Commission supports Member States in countering the growing threat posed by drones to citizens and critical societal functions without discarding their beneficial use e.g. in emergency response operations. The Commission recently adopted common EU-wide rules on the safe operation of drones to mitigate the risk of their malicious use, which include provisions requiring operator registration and enabling remote identification. Moreover, the Commission supports Member States by monitoring trends in the evolution of the threat posed by drones, funding relevant research projects and capacity-building measures, and facilitating exchange between Member States and other stakeholders. To step up this support, the Commission will organise a high-level international conference on 17 October 2019 to counter the risks posed by drones. In response to a need to take a broad view on EU policy on critical infrastructure protection, the Commission presented on 23 July 2019 an evaluation of the European Critical Infrastructure Directive as the legal framework for the identification and designation of European critical infrastructures and the assessment of the need to improve their protection. The evaluation found that the context in which critical infrastructures in Europe operate has changed considerably since the Directive entered into force, including with legislative developments in sectors particularly targeted by the Directive such as energy, and that the provisions of the Directive are only partially relevant as a result of the evolved landscape. At the same time, there is continued support from Member States for EU policy on critical infrastructure protection that respects subsidiarity and provides added value. 4. External dimension Given the cross-border and global nature of most security threats facing our Union, cooperation with international organisations and partner countries outside the EU is an integral part of the work towards an effective and genuine Security Union. Leveraging the benefits of multilateral cooperation is an integral part of this effort, and includes the cooperation between the EU and the UN, as recently reinforced with the signing of the framework on counter-terrorism between the UN and the EU in New York on 24 April 2019, on the occasion of the second UN-EU high-level political dialogue on counter-terrorism. The framework promotes cooperation on capacity building to counter terrorism and prevent and counter violent extremism in Africa, the Middle East and Asia. The framework identifies areas for UN-EU cooperation and priorities until 2020. The security cooperation with the Western Balkans represents a particular regional priority, implementing a number of security-related priority actions identified in the 2018 Western Balkans Strategy. To that end, on 4 April 2019 the Commission organised the first meeting of the Inter-Agency Task Force for the Western Balkans, where representatives of seven EU agencies shared their experience and enhanced operational cooperation with partners in the region, including in the fight against organised crime, terrorism, firearms, drugs, migrant smuggling and trafficking in human beings. Hybrid risk surveys have been launched with all six Western Balkan countries. Another tangible example of the cooperation with the region is the European Border and Coast Guard Status Agreement between the EU and Albania that entered into force on 1 May 2019, which was swiftly followed by a deployment of the European Border and Coast Guard Agency teams to the border with Greece. This is the first such agreement with and deployment to a third country. Similar agreements should soon be signed with other countries in the region. In addition, a Europol liaison officer was deployed in Albania in July 2019 to further assist the Albanian authorities in their efforts to prevent and combat organised crime. To step up the fight against firearms trafficking, the Commission presented on 27 June 2019 an evaluation of the 2015-2019 Action Plan countering firearms trafficking between the EU and the South-eastern region of Europe. The evaluation demonstrates the added-value of cooperation but highlights that further effort is still required, e.g. by putting in place efficient national coordination centres on firearms or by harmonising the collection of information and reporting on firearm seizures. Equal priority is given by the EU to developing cooperation with Middle Eastern and North African countries in the area of security. The EU has launched a Security dialogue with Tunisia and Algeria. The EU and Tunisia held the 3rd dialogue on Security and Counter-Terrorism on 12 June in Tunis, whereas the 2nd dialogue EU-Algeria on Security and Counter-Terrorism took place on 12 November 2018 in Algiers. Talks are ongoing to launch a structured Security dialogue with Morocco, following the recent Association Council of 27 June, where the EU and Morocco recognised the importance of deepening cooperation on security to face common challenges. In parallel, discussions are ongoing to develop a structured security dialogue with Egypt, as also further confirmed by the last Senior Official meeting EU-Egypt held on 10 July in Cairo. Based on the mandate from the Council, the Commission has started informal talks with most Middle Eastern and North African countries in view of launching formal negotiations for an international agreement for the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the relevant competent authorities in Middle Eastern and North African countries for fighting serious crime and terrorism. Within this context, the Commission is also promoting the conclusion of working arrangements directly between Europol and partner authorities in the Middle Eastern and North African countries, to provide a formal framework for regular strategic-level cooperation. The EU and the United States are close and strategic partners in addressing common threats and enhancing security. At their Justice and Home Affairs Ministerial Meeting on 19 June 2019, the EU and the United States reaffirmed that fighting terrorism is among their top priorities. As regards the EU-US Passenger Name Record Agreement, both parties reiterated the importance of the agreement and committed to begin a joint evaluation in September 2019 to assess its implementation, in line with the provisions of the agreement. Both parties also committed to enhance their joint efforts in fighting terrorism, including by expanding the sharing of information gathered in zones of combat for use in investigations and prosecutions.