This is the fourth monthly report on the progress made towards building an effective and genuine Security Union and covers developments under two main pillars: tackling terrorism and organised crime and the means that support them; and strengthening our defences and building resilience against those threats. This report focusses on four key areas, information systems and interoperability, soft target protection, cyber threat and data protection in the context of criminal investigations.

The December Berlin Christmas market attack has again highlighted serious weaknesses in our information systems that need urgently to be addressed, in particular at EU level, to help national border and law enforcement authorities on the ground to do their demanding jobs more effectively. The fact that the different information systems are not interconnected – allowing attackers to use multiple identities to move undetected, including when crossing borders - and that that information is not routinely uploaded by Member States into the relevant EU databases are practical implementation weaknesses that need urgently to be remedied. Furthermore, when it comes to law enforcement measures on the borders and returning persons whose asylum requests have been rejected, further work is also needed.

In terms of soft target protection, the Commission will accelerate the work it is doing to bring together experts from Member States to share best practice and agree standard guidelines.

The cyber threat facing the EU is receiving widespread media coverage and this report looks at the various different work strands in this area already underway. This covers both the prevention side – through work with industry to promote security by design and implementation of the Network Information Security Directive – and fostering cooperation between Member States and with international organisations and partners on dealing with cyber-attacks as they happen. In the coming months, the Commission and the High Representative of the Union for Foreign Affairs and Security Policy will identify the actions needed to provide an effective EU-wide response to these threats, building on the 2013 EU Cybersecurity Strategy.

The protection of individuals' privacy and personal data is a key fundamental right and thus a cornerstone in any action towards a genuine Security Union. The Data Protection Directive for the police and criminal justice field adopted in April 2016 ensures a common high standard of data protection and will therefore facilitate smooth exchange of relevant data between Member States' law enforcement authorities. The Commission has also launched a revision of the ePrivacy Directive as part of its Data Package to extend the Directive's coverage to include all electronic communication providers and to bring its provisions in line with the General Data Protection Regulation. The proposal is designed to ensure privacy of electronic communication while also setting out the grounds under which restrictions of the scope of the ePrivacy Regulation can be envisaged, including for reasons of national security or criminal investigations.

II. STRENGTHENING INFORMATION SYSTEMS AND INTEROPERABILITY

President Juncker's State of the Union address in September 2016 and the European Council conclusions of December 2016 refer to the importance of overcoming the current shortcomings in information management and of improving the interoperability and interconnection between existing information systems. Recent events have again highlighted the urgent need to link existing EU databases together, not least to give border and law enforcement on the ground the tools needed to detect identity fraud. For example, the perpetrator of the December 2016 Berlin terrorist attack used at least 14 different identities and was able to pass between Member States without detection. There is a clear need for existing and future EU information systems to be searchable simultaneously using a biometric identifiers to close off this avenue for terrorists and criminals.

In this regard, the Commission launched work in April 2016 with its proposals for "stronger and smarter information systems for borders and security". This identified shortcomings in the functionalities of existing systems, gaps in the EU's architecture of data management, problems with the complex landscape of differently governed information systems and an overarching fragmentation caused by the fact that existing systems were designed individually rather than to fit together. As part of this process, the Commission launched the High Level Expert Group on Information Systems and Interoperability with EU Agencies, Member States and relevant stakeholders. On 21 December 2016 a Chairman's report set out the interim findings of the group which includes the priority option of creating a Single Search Portal to allow national law enforcement and border authorities to search simultaneously existing EU databases and information systems. The interim report also highlights the importance of data quality – since the information systems are only as effective as the quality and format of the data entered into them - and makes recommendations to improve the quality of data in EU systems through automated data quality control.

The Commission will rapidly follow up on the option to create a Single Search Portal and, together with the EU agency for the operational management of large scale IT systems, eu-LISA, will start its work on a portal capable of searching in parallel all relevant existing EU systems. A related study should be ready by June, as a basis for designing and testing a prototype of the portal before the end of the year. The Commission considers that in parallel Europol should continue its work on a system interface that will enable Member States' frontline officers when they are consulting their own national systems to consult automatically Europol's databases simultaneously.

The work towards the interoperability of information systems aims to overcome the current fragmentation in the EU's architecture of data management for border control and security and the related blind spots. When databases use a common repository of identity data – as envisaged for the proposed EU Entry/Exit System and the proposed European Travel Information and Authorisation System (ETIAS) – a person can only be registered under one single identity in the different databases, which prevents the use of different fake identities. As a first step as suggested in the interim findings of the High Level Expert Group, the Commission has asked eu-LISA to analyse the technical and operational aspects of implementing a shared biometric matching service. Such a service would enable searches across different databases with biometric data, which could expose false identities used by the person in question in another system. Beyond that, the High Level Expert Group should now assess whether it is necessary, technically feasible and proportionate to extend the common identity repository envisaged for the Entry/Exit System and ETIAS to other systems. In addition to biometric data stored in the biometric matching service, such a common identity repository would also include alphanumerical identity data. The Group should present its findings on this in its final report by the end of April 2017.

Recent security events highlight the need to re-examine the question of mandatory information sharing between Member States. The Commission proposal of December 2016 to strengthen the Schengen Information System foresees – for the first time - an obligation for Member States to issue alerts on persons related to terrorist offences. It is important that the co-legislators now work towards a swift adoption of the proposed measures. The Commission stands ready to examine if a mandatory obligation for information sharing should be introduced for other EU databases.

III. PROTECTING OUR SOFT TARGETS AGAINST TERRORIST ATTACKS

The Berlin attack was the most recent in the EU directed against so-called soft targets, which typically are civilian sites where people gather in large numbers (e.g. public spaces, hospitals, schools, sporting arenas, cultural centers, cafés and restaurants, shopping centres and transportation hubs). By their nature, these locations are vulnerable and difficult to protect and are also characterised by the high likelihood of mass casualties in the event of an attack. For all of these reasons they are favoured by terrorists. The threat of future attacks against soft targets including transport remains high, as confirmed by available assessments, including Europol's report on changes in Daesh modus operandi.

The 2015 European Agenda on Security and the 2016 Communication on the Security Union highlighted the need for increased work to improve security and use of innovative detection tools and technology in protection of soft targets. The Commission has been working to support, and encourage the sharing of best practice between, Member States in developing better tools to prevent and respond to soft target attacks. This work has produced operational handbooks and guidance material. Currently, the Commission is developing, in close cooperation with Member States' experts, a comprehensive manual on security procedures and templates applicable to different soft targets (e.g. shopping malls, hospitals, sport and cultural events). The aim is to issue soft target protection guidance to Member States in early 2017 based on best practices in Member States.