EUROPEAN COMMISSION Brussels, 20.4.2016 COM(2016) 230 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE EUROPEAN COUNCIL AND THE COUNCIL delivering on the European Agenda on Security to fight against terrorism and pave the way towards an effective and genuine Security Union



1. Introduction The 22 March 2016 bomb attacks in Brussels have once again highlighted the security risk Europe faces from terrorism. It comes after the atrocities in Madrid, London, Copenhagen and Paris as a further reminder of the need for an ambitious EU security policy, which can measure up to the scale of the threats. Working to ensure a high level of security for Europeans is an objective set by the Treaties and, as President Jean-Claude Juncker stated in his Political Guidelines of 15 July 2015, "a common European responsibility". In an era where terrorism and other serious crime operate across borders, both the European Union and its Member States have a responsibility towards their citizens to deliver an area of internal security where individuals are protected, in full compliance with EU fundamental rights. Member States have the front line responsibility for security, but cannot address transnational threats effectively acting on their own. That is why at European level we need to build the tools, infrastructure and environment in which national authorities can and do work together effectively to tackle shared challenges: an effective and genuine Security Union in which the rights and freedoms of citizens are well protected. The European Agenda on Security has provided a clear framework for the EU to work better together on security and was the basis for the European Council's endorsement of a renewed internal security strategy. Terrorism is one of its three priorities, alongside organised crime and cybercrime. Following the attacks in Brussels, the European Parliament, the EU Ministers for Justice and Home Affairs and the Commission met together to underline their determination to press ahead with the measures foreseen and to deepen the fight against terrorism. For this reason, this Communication, one year on from the presentation of the Agenda, takes stock of the progress that has been made in its implementation as concerns the EU contribution to counter-terrorism. The European Union is designed to deliver an area of freedom, security and justice, without internal borders for its citizens. Europeans need to feel confident that wherever they move within Europe their freedom and their security are well protected, in full compliance with the Union's values, including the rule of law and fundamental rights. In this regard, the Treaties envisage the need to ensure a high level of security, including through preventive measures, and through coordination and cooperation between police, judicial and other competent authorities. For this, the EU and its Member States need to move beyond the concept of cooperating to protect national internal security to the idea of protecting the collective security of the Union as a whole. When it comes to the most serious forms of crime and terrorism, the internal security of one Member State is the internal security of all Member States. As President Juncker stated recently in the Parliament on 12 April 2016, now is the time for action. In the security field, as in many other areas in Europe, fragmentation makes us vulnerable. Europe needs a genuine Security Union. In a Security Union, a police officer in one Member State should have the same reflex to share relevant information with colleagues over the border, as he would do with fellow officers within his country. This requires a step change in two respects. At European level, we need to urgently address the remaining gaps, fragmentation and operational limitations of the information exchange tools in place, to make sure that structures for cooperation are as effective as possible, and to make sure that European legislation to tackle terrorist criminals and their activities is up to date and robust. This is necessary to create an environment of confidence among national authorities and the legal and practical tools that allow them to work together to address common challenges. The full added value of an effective Security Union depends crucially on the use that is made of these tools and structures to close any future operational loopholes and police intelligence gaps. That requires a culture change, at the level of Member States, for their law enforcement authorities to acquire the habit of systematic cooperation and information sharing, right down to the last policeman. A sense of common responsibility, and the will and capacity to turn that into action, are essential if we are to overcome the fragmentation which terrorists and criminals are so effective at exploiting. Delivery of the European Agenda on Security is already well under way. Member States and EU institutions now need to re-double their efforts to ensure its full implementation and achieve effective results without further delay. At the same time, the multiple and overlapping challenges that Europe currently faces, linked to instability in our neighbourhood and wider global forces, mean that it is time now to take stock of its delivery alongside wider policy developments, in particular: the action being taken in the context of the European Agenda on Migration, the Digital Single Market, the Energy Union and on countering Hybrid Threats. By making these linkages and being better coordinated the Union can be more resilient, more responsive and more prepared in line with the Council conclusions on the renewed European Union internal security strategy 2015-2020. The aim of the present Communication is therefore twofold. First, to assess the delivery of the European Agenda on Security in relation to specific operational issues and identify where there are implementation gaps in the fight against terrorism. Second, to identify what action is still needed to deal with these gaps and, building on existing tools, to develop new standing cooperation structures between operational services responsible for combating terrorism, in order to draw together the work of Europol, Eurojust, intelligence services, police forces and judicial authorities. It sets out the roadmap towards an operational and effective Security Union increasing our collective capacity to tackle the terrorist threat. 2. Addressing all dimensions of the terrorist threat

In the field of counter-terrorism and radicalisation, the European Agenda on Security was designed to implement targeted operational actions in specific risk areas to deliver immediate improvements to the EU's collective counter terrorism capabilities. Despite many actions already underway, recent attacks have shown recurrent patterns. In many cases they were perpetrated by radicalised, known individuals, often with a history in organised crime, presenting a security risk because of their capacity to move unhindered within and between Member States or to return from third countries. This is observed even when their movements had been notified in law enforcement databases or had been known to intelligence services. Some of the persons involved in the attacks were already wanted by law enforcement authorities, and were able to benefit from the logistical support of local networks, allowing them to remain hidden and plan the attacks. The attacks were also marked by the capacity of the perpetrators to manufacture large quantities of explosives, based on having access to substantial quantities of precursors and pyrotechnic devices. The terrorists also had illegal access to a large supply of military-grade weapons and ammunition. Lastly, the attacks demonstrated the capacity of the perpetrators to target and attack critical infrastructures and large public spaces across different Member States, despite protection measures already in place. These criminal activities fall within the scope of actions to fight terrorism and organised crime already identified under the European Agenda on Security. Under the fight against terrorism priority, the European Agenda on Security focussed on the threat posed by returning foreign terrorist fighters, the prevention of radicalisation and the sanctioning of terrorists and their backers. It underlined the importance of cutting the access of terrorists to funds, firearms and explosives, of improving the protection of citizens and critical infrastructures, and of addressing the external dimension of the fight against terrorism beyond EU borders. It also underscored the significance of better information exchange to effectively track persons engaged in terrorist activities. The full implementation of the European Agenda on Security is therefore essential to delivering concrete improvements in these areas. These key areas of attention have been reinforced by Action Plans adopted in December 2015 on firearms and explosives, in February 2016 on strengthening the fight against terrorist financing, as well as in the Communication of 6 April 2016 on Stronger and Smarter Information Systems for Borders and Security. 2.1 Addressing the threat posed by returning foreign terrorist fighters According to a recent study, of the 4,000 foreign fighters thought to come from EU Member States, around 30% have returned to their home countries. Returned foreign fighters have been linked to the terrorist attacks of 2015 and 2016. Some foreign fighters will have been instructed to return to Europe to commit terrorist attacks, spread Daesh propaganda and radicalise and recruit others. The first priority is for national authorities to be informed of movements of foreign terrorist fighters, both outgoing and incoming and to share such information with each other and with EU agencies. The Commission has proposed several measures, which need to be adopted and implemented quickly by Member States: Schengen Information System: this system is the largest security database in Europe. It contains over 64 million alerts entered by 29 European countries. National authorities carried out 3 billion searches in the database in 2015. This is a 300% increase from June 2013. The June 2016 Justice and Home Affairs Council will explore ways to tackle operational problems with the Schengen Information System in relation to foreign terrorist fighters. Later this year the Commission will propose a revision of the Schengen Information System on return of irregular migrants and entry bans, the use of facial images for biometric identification, and the creation of new alerts for wanted unknown persons, which will improve the added value of the system for law enforcement purposes. By mid-2017 it will also add an automated fingerprint search functionality to the system, as already foreseen by the existing legal framework. In the meantime, Member States should enter alerts into the system relating to all measures involving expulsion, refusal of entry or removal of persons from the territory of a Member State. Common Risk Indicators: In June 2015, the Commission finalised a first set of common risk indicators, concerning foreign terrorist fighters, to detect terrorist travel. Common risk indicators and guidance from FRONTEX now support the work of national border authorities when conducting checks on individuals. Stronger external borders: Once adopted by the co-legislators by June at the latest, the proposed European Border and Coast Guard will deliver a new phase in integrated border management and raise common standards at the external border. The Commission has also tabled proposals to modify the Schengen Borders Code to impose the obligation of carrying out systematic checks against relevant law enforcement databases at the external borders on all persons, including EU citizens and members of their families, to screen for individuals who pose a threat to public order and internal security. The Commission has also revised the Schengen handbook to clarify "non-systematic checks" and provided guidance to help border guards seize invalidated documents.



Hotspots: Some terrorists have tried to exploit the large irregular flows of persons occurring at the EU external borders over the past months. The hotspot approach helps to identify any individuals posing a threat to EU security and separate them from those who need protection. The hotspot workflow and the relocation process include integrated and systematic security checks, with support provided by Frontex and Europol in the registration and fingerprinting of arrivals. The Commission's proposal for a Directive on Combatting Terrorism (see section 2.3 below) includes new criminal offences of travelling abroad, to and within the EU for the purposes of terrorism . The level of ambition of the Commission's proposal must be maintained in the legislative process in order to adequately tackle the threat posed in particular by terrorists re-entering the EU. Further steps are also needed: It is essential that all returning foreign fighters are identified, interviewed and screened to assess the level of risk they pose. Those considered dangerous should not be able to abscond. Information on returnees should systematically be shared with the European Counter Terrorism Centre in Europol and other Member States via the Schengen Information System. In addition, the Directive on the use of Passenger Name Record (PNR) should be formally adopted by the Council and implemented as a matter of urgency. Next steps: Member States should: -Systematically introduce all terrorism information into the Schengen Information System; all relevant information relating to individuals and objects should be clearly indicated as "terrorism related activity". -Systematically inform Europol's European Counter Terrorism Centre on returnees. -Apply the Common Risk Indicators at border checks. -Ensure the systematic registration and security checks of all arrivals at hotspots, and second the necessary experts to Europol and Frontex. -Perform systematic interviews and screening of all returnees to assess the level of risk they pose. -Adopt in the Council and implement the Passenger Name Record Directive as a matter of urgency. The European Parliament and the Council should: -By June 2016 at the latest, adopt the Commission's proposals for a Directive on combatting terrorism, the European Border and Coast Guard and changes to the Schengen Border Code, maintaining a high level of ambition. The Commission will: -By June 2016, prepare in cooperation with the Presidency operational measures for better use of the Schengen Information System in relation to foreign terrorist fighters. -By end 2016, propose to revise the Schengen Information System to improve its added value for law enforcement purposes. -By October 2016, prepare an Implementing Decision on the interoperability of the Passenger Information Units for Passenger Name Record data exchanges. 2.2 Preventing and fighting radicalisation The majority of the terrorist suspects involved in the attacks of Paris and Brussels are EU nationals who had been radicalised towards violent ideologies that explicitly reject common European values. The absolute priority must be to prevent more people from being radicalised and ensure that those who already are enter de-radicalisation programmes and are prevented from spreading terrorist propaganda and hate speech. The Commission has taken action in the following areas which now need concrete implementation at operational level by Member States: Radicalisation Awareness Network Centre of Excellence: The Centre was created on 1 October 2015 to step up support to Member States and to priority third countries. It has been reinforced with a budget of €25 million for the next 5 years. On-line terrorist propaganda and hate speech: The EU Internet Referral Unit was set up on 1 July 2015 in Europol to target terrorist material online and has assessed over 4,700 pieces of material across 45 platforms and made over 3,200 referrals for internet companies to remove content, with an effective removal rate of 91%. Member States should second experts to the EU Internet Referral Unit. The EU Internet Forum launched in December 2015 as a partnership with the internet industry to restrict the accessibility of terrorist material online and increase the volume of effective counter-narratives, and the Commission is supporting actions to promote effective alternative counter-narratives. A Joint Referral Platform is being developed by the internet industry with full Europol involvement which will tackle the problem that material removed from one site being uploaded elsewhere. An EU-wide "Empowering Civil Society" Programme will provide support to maximise the effectiveness of alternative narrative campaigns. For these two initiatives, €10 million have been earmarked under the Internal Security Fund. Further, the Commission is intensifying work to tackle the problem of online hate speech in cooperation with internet companies, Member States and civil society and will report on progress on this issue, among others, in an upcoming Communication on preventing radicalisation.

Addressing Radicalisation in prisons: Young people, who might be first time offenders or end up in prison for minor crimes, are particularly vulnerable to radicalisation or terrorist recruitment. The Commission has provided €8 million in 2015 and 2016 to implement the Council conclusions, providing funding for the development of rehabilitation and de-radicalisation programmes inside and outside prisons, risk assessment tools and training of professionals. Member States need to spend these funds wisely, making sure that they target the most vulnerable groups in an efficient way. Preventing radicalisation through education and youth outreach: under Erasmus+, priority is now given to projects fostering inclusion and promoting fundamental values. Up to €400 million have been made available for this purpose, and a specific €13 million call was launched in March to identify and spread best practices. The Commission will also launch large-scale virtual exchange programmes with third countries to foster inter-cultural understanding among teachers, children and young people, notably through the eTwinning programme and Erasmus+. The main actors in the fight against radicalisation are necessarily at local level and it must be a priority for Member States to identify and engage interlocutors at local level who have sufficient influence and are appropriately trained to pass counter-radicalisation messages and present alternative models to those spread by radical preachers and by organised crime groups. In addition to these preventive and educative measures against radicalisation, a more security-oriented approach is needed to ensure exchange of information between Member States on released convicts suspected of radicalisation or known radical individuals, in order to ensure surveillance and appropriate measures in relation to those representing a high risk. Next steps: Member States should: -Actively support national and local initiatives to prevent radicalisation, train professionals and local actors, and make the best possible use of available EU funds. -Immediately second experts to the EU Internet Referral Unit. -Proactively exchange all relevant information with other Member States on released convicts suspected of radicalisation or known radical individuals, in order to ensure surveillance of those representing a high risk. The Commission will: -Adopt a Communication on preventing radicalisation: 2nd quarter 2016. -Implement rapidly, in partnership with industry, the concrete activities of the 2016 roadmap developed in the context of the EU Internet Forum. 2.3 Sanctioning terrorists and their backers Recent events have shown that terrorists rely on local support. In addition to counter narratives to fight terrorist propaganda and radicalisation, communication campaigns should contain clear information that aiding, abetting or inciting terrorist offences such as providing housing, transport or material support to terrorists or public provocation to commit a terrorist offence are also terrorism-related offences, which will be severely sanctioned. There is EU legislation in place to ensure that this conduct is criminal throughout the Union and the Commission's proposal for a Directive on Combatting Terrorism will strengthen this framework by adding offences linked to terrorist travel, passive training, financing, provision of material support of any kind and facilitation. The Directive ensures that these offences will be subject to common minimum penal sanctions. The proposal also includes specific provisions on the rights of victims of terrorism. The Commission calls on the European Parliament and the Council to reach a swift conclusion on this Directive. A key element in successfully preventing, investigating and prosecuting serious and organised crime and terrorism-related offences is rapidly securing and obtaining digital evidence, as highlighted in the joint statement of 24 March 2016 of the EU Ministers for Justice and Home Affairs and representatives of EU institutions on the terrorist attacks in Brussels. Relevant information is frequently held by private companies, on their servers, often located outside the territory of the investigating law enforcement agency and therefore outside its jurisdiction. Aside from mutual legal assistance procedures and a few limited rules in international agreements, no harmonised approach exists on how to access such information. As a result, a wide array of different national approaches has evolved, which poses problems for investigation. The Commission will engage with the private sector to facilitate cooperation based on a common understanding across the EU on access to electronic information and evidence, and propose solutions, including a legal instrument if required. Next steps: The European Parliament and the Council should: -By June 2016, conclude discussions on the Commission's proposal for a Directive on combatting terrorism as a matter of priority and maintaining a high level of ambition. The Commission will: -By summer 2017, propose solutions, including legislation if required, to address the problems of obtaining digital evidence in relation to criminal investigations.

2.4 Improving information exchange Known criminals and identified individuals who are considered potentially dangerous should not be able to escape detection. The European Agenda on Security has already proposed measures to address the main challenges for effective and sustainable action at EU level to fight terrorism and organised crime, specifically through better exchange of information between Member States' law enforcement authorities and with the EU Agencies, and by improving the interoperability of relevant databases and information systems. The Commission has made a number of proposals to address these challenges. Common rules on data protection will now enable law enforcement and judicial authorities to cooperate more effectively with each other, as well as building confidence and ensuring legal certainty. The Data Protection Directive for police and criminal justice authorities adopted on 14 April 2016 needs to be transposed swiftly. In addition, the European Union has negotiated with the United States an international framework agreement ("Data Protection Umbrella Agreement") in order to ensure a high level protection of personal data transferred between the EU and the US for the prevention, detection, investigation and prosecution of criminal offences, including terrorism. The Agreement should be concluded swiftly. Legislative proposals now need to be swiftly agreed by the European Parliament and by the Council and implementation by Member States of existing information exchange systems and structures accelerated: The final adoption of the revised Europol Regulation, which will apply from Spring 2017, will constitute a decisive step towards making Europol a hub for the information exchange between law enforcement authorities in the EU. The European Counter Terrorism Centre in Europol was launched in January 2016 to provide support in the fight against terrorism and radicalisation by stepping up coordination and cooperation between relevant authorities and providing a secure communications environment. Member States need urgently to make available sufficient expertise in line with the 24 March 2016 Joint Statement of the EU Ministers for Justice and Home Affairs and representatives of EU institutions. The European Counter Terrorism Centre should now be strengthened to act as the law enforcement intelligence hub for analysing terrorism and assessing threats, and to support the development of counter-terrorism operational plans. The Commission will bring forward initiatives on how to develop the Centre into a stronger structure, with the capacity for joint operational planning, threat assessments and law enforcement intelligence coordination, staffed with personnel from the responsible institutions of the Member States as well as the Commission and subject to appropriate democratic scrutiny mechanisms. Work then should be taken forward by Centre, the EU Intelligence and Situation Centre facilitated by the Commission and in close collaboration with the Counter-Terrorism Group of national security services. Joint threat assessments on terrorism and radicalisation should start being developed by the European Counter Terrorism Centre and Intelligence and Situation Centre as a matter of urgency. The recent Communication on Stronger and Smarter Information Systems for Borders and Security launches a debate and process on how to address shortcomings in current data systems, gaps in the architecture and limited interoperability, interconnection and access, in full compliance with data protection rules. This could lead to a European common repository of data and EU-integrated biometric identity management for travel, migration and security. This work needs to be accelerated. The Commission has also proposed an EU Entry Exit System for the EU external border using biometrics, providing for law enforcement access and interoperability with other systems (notably the Visa Information System). Cross-border information exchange is vital for law enforcement within the EU. The existing Prüm framework must be implemented and used fully. It offers automated comparison of DNA profiles, fingerprint data and vehicle registration data. More systematic and consistent use of Interpol's Stolen and Lost Travel Documents database should also be prioritised.

Extension of the European Criminal Records Information System to third country nationals: The European Parliament and Council should adopt the Commission proposal to amend the EU system for the exchange of information of criminal convictions to include the exchange of criminal records of third country nationals. Jurisdiction for accessing digital evidence: The Commission will work with the European Parliament and the Council and the European Parliament, based on a consultation with experts and other stakeholders, to develop a common EU approach to determining jurisdiction of law enforcement authorities when they directly access data stored or located abroad (i.e. consider other alternative connecting factors than the principle of territoriality).



Next steps: Member States should: -Increase the number of expert staff seconded to the European Counter-Terrorism Centre. -Ensure as a matter of urgency that the Prüm framework is fully implemented, and make a more systematic and consistent use of Interpol's Stolen and Lost Travel Documents database. The European Parliament and the Council should: -By June 2016, quickly finalise the adoption of the revised Europol Regulation. -By end 2016, agree on the Commission's proposals on an EU Entry Exit System and on the Extension of the European Criminal Records Information System to third country nationals as a matter of priority. The Commission will: -By autumn 2016, bring forward initiatives to upgrade the European Counter Terrorism Centre. -By May 2016, set up an Expert Group to make proposals to improve and/or develop existing information systems, to address information gaps and to move towards the interoperability of information systems, as set out in the Communication on Stronger and Smarter Information Systems for Borders and Security, following an ambitious timeline. -Use its powers under the Treaties to ensure the proper implementation of the EU acquis. 2.5 Cutting the access of terrorists to firearms and explosives It is crucial to limit terrorists' access to explosive precursors and detonators. The Commission has already identified significant gaps in the implementation by Member States of Regulation 98/2013 on explosives precursors and is taking steps to address this. The Commission will assess the need to revise this Regulation in 2016. Security of explosive stocks, both civilian and military is another key element. Terrorist access to automatic weapons remains a major problem. The loophole allowing for the reactivation of firearms has now been closed with the adoption by the Commission of the Implementing Regulation on common firearms deactivation standards on 18 November 2015. This entered into force on 8 April 2016 and will ensure that deactivated firearms are rendered irreversibly inoperable. In addition to this, the Commission presented on 18 November 2015 a proposal for the revision of the Directive 91/477/EEC on the control of the acquisition and possession of weapons. This proposal aims to restrict the availability of some of the most powerful type of semi-automatic weapons and those that could be easily converted into full automatic weapons, as well as to enhance the exchange of information between Member States, traceability and marking rules for firearms. Its adoption by the European Parliament and the Council should be a priority in order to complement actions taken against the reactivation and the contraband of military-grade weapons. However, the biggest challenge is illegal weapons. The sourcing of contraband weapons from neighbouring regions remains a major problem and the risk of new sources emerging also has to be minimised. Detailed measures on restricting access to illegal firearms and explosives, enhancing operational cooperation and improving the collection and sharing of operational information through an optimal use of existing tools are contained in the Action Plan of 2 December 2015 on firearms and explosives, which should be implemented as a matter of priority. Next steps: Member States should : -Ensure as a matter of urgency that all necessary measures are taken for the full implementation of Regulation 98/2013 on explosives precursors. -Fully apply the implementing regulation on common firearms deactivation standards, which entered into application on 8 April 2016. The European Parliament and the Council should : -Agree as a matter of urgency on the Commission's proposal for the revision of the Directive 91/477/EEC on control of the acquisition and possession of firearms. The Commission will: -Take the necessary steps to accelerate the implementation of the relevant actions of the Action Plan of 2 December 2015 on firearms and explosives with an ambitious timeline. -Use its powers under the Treaties to ensure the proper implementation of the EU acquis.

2.6 Cutting access of terrorists to funds One characteristic of the recent attacks is that the overall amount of funds involved appears disproportionately small in comparison with the devastating effects they have had. The newly adopted Action Plan on fighting terrorist financing already includes an ambitious timetable, which the Commission is fully committed to and will deliver on. It takes forward two key goals. First, how to further detect and prevent terrorist organisations and their backers from moving funds and other assets, and to ensure that financial movements can wherever possible help law enforcement to trace terrorists and stop them from committing crimes. Secondly, how to further disrupt the sources of revenue of terrorist organisations, by targeting their capacity to raise funds in the first place. The Commission will, amongst other actions, present legislative proposals in the coming months. Member States should play their part and implement already agreed legislation as rapidly as possible. Next steps: Member States should : -Bring forward the date for effective transposition and entry into application of the 4th Anti-Money Laundering Directive to the 4th quarter of 2016 at the latest.

The Commission will: -By June 2016, adopt a legislative proposal to revise the 4th Anti-Money Laundering Directive. -By June 2016, adopt a Delegated Act to identify high risk third countries with strategic deficiencies in their anti-money laundering/countering terrorism financing (EU blacklist). -By December 2016, adopt a legislative proposal harmonising money laundering criminal offences and sanctions. -By December 2016, adopt a legislative proposal against illicit cash movements. -By December 2016, adopt a legislative proposal on the mutual recognition of criminal assets' freezing and confiscation orders. -By December 2016, adopt a legislative proposal for a Directive on combatting fraud and counterfeiting on non-cash means of payment. -By 1st quarter 2017, adopt a legislative proposal reinforcing customs' powers and cooperation and addressing terrorism financing related to trade in goods. -By 2nd quarter 2017, present a report on a supranational assessment of money laundering and terrorism financing risks and recommendations to Member States on measures suitable to address those risks. -By 2nd quarter 2017, adopt a legislative proposal against illicit trade in cultural goods. 2.7 Protecting citizens and critical infrastructures The vulnerability of large public events and critical infrastructure has been highlighted by the pattern of the attacks in Paris and Brussels. In order to be as well prepared as possible for such risks, law enforcement authorities and other key authorities – such as those responsible for transport –,need to exchange relevant information in an efficient way and to design preventive measures in a coordinated manner across borders. This also implies supporting research and new technologies, for example to detect explosives. In addition to this, new technology may be abused by terrorists to conduct new forms of attacks. Cybercrime, which is another priority of the European Agenda on Security, is an acute threat which could grow into a new frontier for terrorism and needs to be dealt with accordingly. The Action Plan of 2 December 2015 on firearms and explosives also contains a number of measures to prevent terrorist attacks. These include (i) specific actions on the use of detection technology and towards standardising its use (soft targets, critical infrastructures, public areas), (ii) the development of innovative detection tools, (iii) the strengthening of existing measures and creating new ones with the purpose of increasing security of passengers on different modes of transport, (iv) the use of new technologies to reinforce security, (v) the dissemination of guidance material on soft target protection and (vi) detection and protection trials. It is also important to give priority to the question of vetting of staff working in critical infrastructure and other public areas, especially of returning foreign terrorist fighters and other radicalised staff to prevent use of insider knowledge for terrorist activities. The Commission has also undertaken the following initiatives: The European Programme for Critical Infrastructure Protection provides an overall framework for activities aimed at improving the protection of critical infrastructure in Europe. Through this Programme, the Commission works with Member States to reduce the vulnerabilities of critical infrastructure and increase their resilience.

Dissemination of guidance material on soft target protection: In May 2014 the Commission and EU Airport Police network completed the work on EU Airport Soft Target Protection manual containing guidance on soft target protection. This manual has been translated into all EU languages and will be distributed to all Police forces. In October 2015 the Commission also started developing guidance material on protection against other soft target areas such as rail and metro and other areas of high public concentration (sport stadiums, shopping malls, public garages, etc.). The finalisation of this material will be accelerated and accompanied by adequate training. Detection and protection trials: Detection and protection trials have been launched by the Commission together with several Member States in February 2015 in different operational environments such as airports, train stations, sport events and public buildings. New trials are scheduled for May 2016, including in the context of hotspots. Security risk assessments: The Commission has developed security risk assessments to ensure that policies developed at EU level in areas such as transport security, border security or terrorism financing is based on a proper analysis of the relevant security risks to define effective responses to those risks and underlying threats. This work is conducted jointly with Member States, the EEAS and relevant EU agencies. Hybrid threats: The Commission and the High Representative adopted a Joint Communication on a Joint Framework on countering hybrid threats presenting actionable proposals to help counter hybrid threats and foster the resilience of the EU and Member States, as well as partners. All parties are encouraged to implement these actions swiftly. Fighting crime and terrorism needs to continuously draw on new technologies and capabilities. Further measures are needed to address the challenges of detecting threats. The Commission will also direct research funds towards future technological and capability needs. Horizon 2020 Secure societies programme has a budget of €1.7 billion 2014-20. Work programmes for 2016-2017 have been agreed, with several actions relating specifically to the fight against terrorism. Future calls and the next annual programmes should have a heightened focus on counter-terrorism technology and capabilities, drawing on the work of the European Counter Terrorism Centre as well as national law enforcement and intelligence communities. The European Agenda on Security underlined that a competitive EU security industry can also contribute to the EU's autonomy in meeting security needs. The EU has encouraged the development of innovative security solutions, for example through standards and common certificates. The Commission will come forward in 2016 with proposals on airport screening equipment, to remove barriers to the Single Market and to enhance the competitiveness of the EU security industry in export markets. Information systems are a key element of our society. While strong cybersecurity measures should be the first line of defence, we also need to ensure effective investigation and prosecution of crime targeting or exploiting those systems. The Directive on Attacks against Information Systems (2013/40/EU) provides a common European criminal law framework in this area. The Commission is currently monitoring Member States' implementation of the Directive and will report to the Parliament and Council in 2017, taking into account the technical and legal developments in the field of cybercrime and any possible need to further strengthening the legal framework. To complement the proposed Network and Information Security (NIS) Directive to reinforce cooperation and information exchange on cyber-threats, the Commission will propose further measures in June to support cooperation in this field and develop industrial capacities. Treatment of security-related additional fiscal expenditure Protection comes with a cost, be it in terms of deployment of intelligence, law enforcement or armed forces or of reinforcement of infrastructures. However, these costs have to be put in perspective with the human and economic damages a handful of criminals can generate. In light of the severity of the threat currently faced by the EU, the Commission will propose to make use of the flexibility embedded in the Stability and Growth Pact to accommodate unusual events outside government control when considering additional fiscal expenditure directly related to this threat. The Commission will engage with the Member States to find the necessary agreement on the way forward.

Next steps: The Commission will: -As a matter of urgency, take the necessary steps to accelerate the implementation of the relevant actions of the Action Plan of 2 December 2015 on firearms and explosives. -By September 2016, propose EU-wide rules on certification of airport screening equipment. -By December 2016, update the EU Airport Soft Target Protection manual. -By May 2016, conduct new detection and protection trials, including in the context of hotspots. -Direct research funds towards future technological and capability needs. -Propose an approach on the treatment of exceptional fiscal expenditure directly related to counter-terrorism in the context of the Stability and Growth Pact. The Commission intends to make use of such an approach in the forthcoming European Semester package this Spring. . 2.8 The external dimension The European Agenda on Security is also designed to ensure greater coherence between internal and external actions in the field of security given the direct linkage between the two and to draw on the work of the EU Counter Terrorism Coordinator, the Commission and the EEAS. The neighbourhood is a particular focus. Targeted and upgraded security and counter-terrorism dialogues have been already established, in particular with Jordan, Lebanon, Morocco Tunisia and Turkey, and concrete action plans are being agreed with those countries. Security and counter-terrorism experts have been deployed in the EU delegations of Algeria, Iraq, Jordan, Morocco, Nigeria, Saudi Arabia, Tunisia and Turkey. On the basis of these experiences, the EU should initiate an anti-terrorism partnership with countries around the Mediterranean, as well as by enlarging the network of counter-terrorism and security experts to other priority countries and regions (e.g. Lebanon, Sahel, Western Balkans). Recent events have demonstrated significant failings in cooperation with partners around the Mediterranean, despite shared concerns. EU justice and home affairs diplomacy and counter-terrorism cooperation must be developed as a matter of priority with partners from Turkey to Morocco, with the support of the European Counter Terrorism Centre, with a view to ensuring effective information sharing and police cooperation within the appropriate data protection framework. The EU has to strengthen its presence in the relevant counter-terrorism and security multilateral international fora (such as the United Nations, Global Counter-Terrorism Forum, G7 and the Financial Action Task Force) in order to promote international cooperation on counter-terrorism and security matters. The Action Plan of 2 December 2015 on firearms and explosives and the Action Plan of 2 February 2016 on strengthening the fight against terrorist financing contain specific actions towards third countries, in particular those in the EU's immediate neighbourhood. It foresees notably that the EU will step up its cooperation with neighbouring countries on the security dimension, including on countering the illicit trafficking of Small Arms and Light Weapons and the fight against illicit trafficking in human beings, cultural goods and drugs. It is envisaged that the illicit trafficking and use of firearms and explosives should be systematically integrated into security dialogues with key partner countries and organisations. The revised European Neighbourhood Policy also provides a framework for action in the neighbourhood countries as it brings together coherently the security dimension and other elements of stabilisation such as fighting corruption and abuse of power, economic development, investment opportunities and employment for youth, as well as specific financial support to civil society with an anti-radicalisation dimension. Next steps: The Commission will: -Take the necessary steps to accelerate the implementation of the external dimension of the Action Plan of 2 December 2015 on firearms and explosives, according to an ambitious timeline, with a particular focus on curbing the trafficking of firearms and explosives from the Western Balkans and possible new sources of weapon contraband developing from other regions in the EU's immediate neighbourhood. -Take the necessary steps to accelerate the implementation of the relevant actions of the Action Plan of 2 February 2016 on strengthening the fight against terrorist financing. -Engage in a reflection completing and deepening the reinforced Counter terrorism dialogues with priority countries around the Mediterranean with a view to the development of an effective anti-terrorism partnership. -Support the implementation of the Joint Action Plan established in the context of the Western Balkans Counter Terrorism Initiative.