Responding to the need of Member States' customs authorities to co-operate with each other in order to successfully tackle customs fraud and transnational trafficking, and to prosecute and punish the offenders, the Naples II Convention is used by Member States in order to exchange information: (a) with a view to prosecuting and punishing infringements of EU and national customs laws, and (b) for mutual administrative assistance purposes with regard to national customs law. To this end, it is fully complementary to Regulation 515/97 which covers mutual administrative assistance with regard to EU customs law. However, according to stakeholders, the Naples II Convention may need to be updated in order to take account of the development of fraud methods and adapt to Member States needs for the exchange of information.

Regulation 515/1997 was updated in 2015 and amended by Regulation 2015/1525. Despite the progress brought by this reform, there are still a number of points which could be improved. In particular, some stakeholders considered the legal basis to exchange information with a third country insufficient in the absence of a mutual administrative assistance agreement between the EU and this country.

Member States' customs co-operation and mutual administrative assistance in customs matters are governed by three main instruments on administrative assistance, notably mutual exchange of information (Regulation 515/1997 ), mutual assistance and cooperation between customs administrations in order to investigate and prosecute customs infringements ("Naples II" Convention ) and the Customs Information System ("CIS Decision" ). CIS and the Customs Files Identification Database (FIDE) assist in preventing, investigating and prosecuting serious contraventions of national laws, for example in the areas of weapons and drug trafficking, by making information available more rapidly.

The assessment also shows that further synergies and multi-agency cooperation are needed between customs and other law enforcement authorities in the area of organised crime, security and fight against terrorism both at the national and EU level.

The 2016 progress report on the implementation of the strategy confirmed that the reform of customs risk management is adapted to today's reality of increased volume and speed of international trade. However, stakeholders underlined that this is a resource-intensive exercise. According to stakeholders, the financing to develop the required IT systems to ensure the availability and sharing of supply chain-data and risk relevant information is a challenge.

An EU Strategy and Action Plan for customs risk management and supply chain security adopted in 2014 seeks to ensure that customs has the capacities to fulfil its security mission in cooperation with law enforcement and security agencies and is part and parcel of the EU security agenda. Key priorities include improving co-operation between customs and other agencies at national and EU level in order to enhance the effectiveness of supply chain risk management. Another objective is to adapt the cargo information systems used by customs to tackle security risks including the exploitation of cargo and parcel traffic by organised criminal or terrorist groups for trafficking in dangerous goods and supplies or for directly delivering an attack (e.g. explosives) on transport operations.

The CRMF includes EU common risk criteria for real-time analysis of security risks at all EU border posts and a common IT platform, the Customs Risk Management System (CRMS) for customs collaboration on implementing controls, sharing of risk information and control results and customs crisis response.

Customs carry out controls on the supply chain based on a risk-based approach that is part of a common risk management framework (CRMF). Security based controls aim at tackling a wide spectrum of risks, including financing, related to terrorist and criminal activity embodied in commercial supply chains. These include firearms and ammunition, explosives, drugs and their precursors, CBRN, illicit trafficking in cultural goods and protected species, counterfeit goods, waste, financial fraud and other trafficking.

Customs is the lead authority for control of goods at the external border and has the co-ordinating role in that regard. Under the Union Customs Code (UCC), Member States' customs authorities are responsible for the supervision and control of all goods entering, passing through or leaving the EU. Customs supervision applies to all goods whether carried by persons or in commercial supply chains.

The Commission is currently conducting a study on the feasibility of storing long stay visas and residence document in a EU repository, with the purpose of facilitating the checks at external borders to prevent fraud.

Various measures have also been adopted concerning visas. A uniform format for visas was adopted. It requires the use of biometric identifiers, which are not stored in the visa sticker itself, but in the Visa Information System.

As for residence permits delivered to third-country nationals, they are required to conform to the uniform format established by the EU and to include the same biometric features as passports since May 2012.

The strengthening of the security of identity and travel documents was already identified as an important measure for combating terrorism as early as September 2001. In response, the EU has adopted various measures aiming to improve the security of identity documents for both EU citizens and third country nationals in order to prevent identity fraud. With regard to the security of the passports of EU citizens, the Council adopted Regulation (EC) No 2252/2004. It aims to establish higher harmonised security standards for greater protection against falsification and to integrate biometric identifiers in passports and travel documents by laying down minimum security standards of passports and travel documents. On 8 December 2016, the Commission also adopted an Action Plan to strengthen the European response to travel document fraud. The Action Plan aims at improving the overall security of travel documents issued in the EU for identification and border crossing purposes.

While the initial Frontex founding Regulation did not contain any specific references to fundamental rights, the agency drew up a dedicated strategy and action plan in 2011. At the same time, a consultative forum and a Fundamental Rights Officer were established to give advice on these matters and strengthen mechanisms to ensure fundamental rights compliance. With the new EBCG Regulation, Article 1 now recognises the nexus between an integrated border management and ensuring a high level of internal security within the Union in full respect for fundamental rights, while safeguarding the free movement of persons within it. The European Border and Coast Guard Agency shall guarantee the protection of fundamental rights in the performance of its tasks, and there is a single comprehensive provision spelling out related obligations (Article 34). The new Regulation also introduces a fundamental rights complaints mechanism (Article 72) as demanded by European Parliament, EU Ombudsman and Council of Europe. Any person directly affected by actions of staff during EBCG operations can file a complaint about fundamental rights violations with the fundamental rights officer, further directed on the merits and for appropriate follow-up by the Executive Director or the competent national authority.

There are important fundamental-rights implications related to the tasks performed by the European Border and Coast Guard Agency, including the use of identification and verification technology in the context of border control. There is a significant body of European Court of Human Rights and Court of Justice case law clarifying the scope and guarantees related to the protection of fundamental rights during border checks, including on the guarantees derived from the right to liberty when a person is held in transit zones (Amuur v. France), the respect of human dignity when performing border checks (Mohamed Zakaria CJEU case 23/12), the access to an effective remedy to challenge the enforcement of removal measures on board the ships (Hirsi Jamaa et al. v. Italy) and application of detailed rules and minimum safeguards on measures that impact privacy (S. And Marper v. UK).

Activities of the EBCG are complemented by the European Border Surveillance System (EUROSUR), established by Regulation (EU) 1052/2013. The main aim of this system is to establish a common framework for information exchange and cooperation amongst Member States, the European Border and Coast Guard Agency and neighbouring countries in order to strengthen external border controls, in particular at the southern maritime and eastern land borders.

A number of other legal instruments complete the EBCG's operational framework. Regulation (EU) No 656/2014 establishing rules for the surveillance of the external sea borders set out rules on maritime surveillance and rescue operations coordinated by the agency. These new rules are a response to the current migratory situation and to the need of placing human rights protection at their centre.

The need for stepping up the management of external borders and in particular the Schengen acquis regarding control on persons crossing the external borders led to the establishment of a new European Border and Coast Guard (EBCG) with Regulation (EU) 2016/1624 replacing the former framework. The new Regulation entered into force on 6 October 2016. The European Border and Coast Guard consists of the EBCG Agency and the national border and coast guards of the Member States. Although Member States retain primary responsibility for border management, there is a clear shift towards responsibility shared with the agency. To this end, the agency’s staff will grow from 309 in 2015 to 1,000 in 2020. At the same time, a rapid reaction pool of 1,500 European border guards as a standing corps was inscribed in the Regulation. It could be deployed for a rapid border intervention within five days from the adoption of an operational plan. The agency continues to maintain a technical equipment pool composed of equipment owned by either the Member States or by the agency itself. With an increase in budget to more than twice the amount of 2015 (EUR 143.3 million compared to EUR 322 million in 2020), the agency may start acquiring equipment on its own in the future.

The European Border and Coast Guard Agency (formerly Frontex) is the main instrument created by the EU to reinforce border management. It started its operations in 2005. Under the previous Frontex Regulation, border control fell into the sole competence of the Member States. The agency’s main task at the time was to render border control more effective by coordinating Member States’ joint activities and providing surveillance data, technical support and expertise. The agencies' success was confirmed by the successive external evaluations. The Council and the European Parliament have supported its rapid growth in staffing and budget since its launch.

These tools coexist with EU instruments already developed in the past at EU level, such as the European Border and Coast Guard Agency, the European Surveillance System (Eurosur), the Schengen evaluation and monitoring mechanism and the Directive on advance passenger information (API).

As regards the Schengen Information System, its potential to tackle document fraud will grow with the implementation of a ‘fingerprint search’ functionality. This will enable the successful identification (via their fingerprints) of persons sought by the authorities. The automated fingerprint identification system (AFIS) will perform identity checks and contribute significantly to the detection of document and identity fraud. Member States will be phasing it in from the start of 2018.

The Schengen Borders Code imposes an obligation to check visa holders against the Visa Information System (VIS) in order to verify the identity of the visa holder and the authenticity of the visa. The evaluation of the VIS carried out in 2016 indicated however that on average only one in two visas is checked at borders. The Schengen Borders Code also imposes an obligation to check all travellers and their documents against the Schengen Information System (SIS). The evaluation of SIS, carried out in 2016, however indicated that in some Member States border checks against databases are not consistently carried out, due to deficiencies in procedures, lack of staff or technical failures. This demonstrates that further investments and awareness-raising at national level will be needed, especially taking into account the introduction of systematic checks on all persons against databases since April 2017. Due account was taken of fundamental rights requirements when designing the amendment to the Schengen Borders Code. To minimise the impact on the fundamental rights related to the respect of private and family life (Article 7) and the protection of personal data (Article 8), the databases are consulted on the basis of a hit/no-hit system and the consultation is neither registered nor further processed.

As part of the development of an integrated border management system, developments occurred both internally, through the inclusion of biometric data in passports, establishment of the Visa Information System and the second generation of the Schengen Information System (SIS), and externally, particularly in the field of transatlantic cooperation with initiatives such as the Passenger Name Records (PNR) Agreements or the Visa Waiver programme.

The absence of internal borders in the Schengen area and the freedom of movement enjoyed by Union citizens require strong and reliable management of the movement of persons and goods across the external borders. In order to preserve security, law enforcement authorities in the Member States have been granted access to relevant databases on persons. There are information systems and databases in place at EU level that provide border guards, police officers and other authorities with relevant information on persons and documents, in accordance with their respective purposes.

The assessment suggests that the potential of border checks as means to combat terrorism, fight criminality and manage migration can be further exploited. Better implementation of the rules in place must be a priority. Insufficient implementation can hamper the EU's ability to strengthen its internal security. According to stakeholders, strengthening security through border management also requires a better coordination of the tasks of different players such as customs, border guards and police forces at national level and enhancing coordination at Union level. Further synergies can be achieved through cooperation between Europol and the European Border and Coast Guard Agency, especially when it comes to on-the-spot cooperation. Cooperation has improved considerably over the last months, and according to stakeholders it is expected to be further consolidated.

In the related area of customs, the creation of databases and IT systems centralised at EU level (including those managed by OLAF, such as notably the Anti-Fraud Information System AFIS) allows Member States' authorities to have direct access to relevant information and to exchange information between each other and the Commission for anti-fraud purposes. This has contributed to supporting and facilitating European co-operation, improving national capabilities and complementing Member States action. OLAF takes an active approach in the realisation of Policy Cycle priorities, notably Missing Trader Intra Community (MTIC) and Excise fraud, and supports the organisation and implementation of Joint Custom Operations (JCO) by Member States. These are organised within the framework of the Excise priority and include supporting the exchange of information between various services.

An important set of measures was adopted to manage the EU’s external borders and protect the Schengen area without internal borders. These include information systems and frameworks such as the Schengen Information System and Eurosur, and the common rules set by the Schengen Border Code. A major coordinating role is also played at EU level by the European Border and Coast Guard Agency. Given their recent adoption, it is too early to assess the exact extent to which these new measures help to manage migration more effectively, improve the internal security in the EU and safeguard the principle of free movement of persons, while ensuring respect of fundamental rights.

Eurojust plays an essential role in the external dimension of EU internal security. Eurojust has developed extensive expertise regarding the application of Mutual Legal Assistance agreements with third countries and, in cooperation with the JITs Network secretariat, promote the involvement of third States in JITS. Many operational cases extend beyond the EU, and Eurojust has a specific mandate to facilitate judicial cooperation with third countries. It has so far concluded nine cooperation agreements with third countries (seven of which have entered into force), providing a solid legal basis for the exchange of operational information, including personal data. On the basis of such agreements, Norway, Switzerland and the USA have seconded liaison prosecutors to Eurojust. Eurojust has also established a network of judicial contact points in third countries that facilitates judicial cooperation with 41 countries.

Eurojust and Europol maintain close relations. For example, a Eurojust expert on cybercrime was placed at the European Cybercrime Center (EC3), and Eurojust will second a prosecutor/judge to the European Counter Terrorism Centre (ECTC) and the European Migrant Smuggling Centre (EMCS) at Europol to ensure early judicial follow up.

Judicial cooperation work also requires analysing recurrent legal issues and developing best practices. Eurojust has become a centre of legal and judicial expertise on an array of issues such as ne bis in idem, controlled deliveries and interception of telecommunications. Eurojust identifies best practice to improve the effectiveness of and speedy responses in the fight against serious cross-border crime. Eurojust operates as a permanent network and works closely with other specialised judicial networks.

Combating organised crime is also a priority for Eurojust, and since 2012, more than 145 Eurojust cases dealt with Italian mafia-type organised criminal groups.

In the field of cybercrime, Eurojust also offers operational support to cases and organises coordination meetings and JITs. In addition, it facilitates the sharing of experience and expertise among national practitioners in critical areas such as cooperation with ISPs located in the USA and encryption of data. Since 2016, Eurojust support the European judicial Cybercrime Network (EJCN) created by the Council in June 2016.

In respect of terrorism, the exchange of information with Eurojust on terrorist offences based on Council Decision 2005/671/JHA has brought benefits to all Member States. It allows Member States’ competent authorities to be notified immediately by Eurojust if links between cases or criminal networks are detected as a result of Eurojust's cross-checking of the information it receives. It also allows providing Member States’ competent authorities regularly with analyses of the judicial responses to terrorism and best practice from Member States through the Terrorism Convictions Monitor. The network of national correspondents for Eurojust for terrorism matters served as a primary point of contact for the response to the 2016 Brussels terrorist attacks. It was activated within an hour of the attacks and facilitated the provision of quick and comprehensive assistance to the Belgian investigation.

In 2003 Eurojust published guidelines for deciding which jurisdiction should prosecute. The guidelines suggest factors to be taken into consideration in multi-jurisdictional cases. Since their publication, they have been of assistance to the competent national authorities for determining which jurisdiction is best placed to prosecute in cross-border cases. The guidelines also assist Eurojust, which may advise the competent national authorities on this matter. In addition, since their publication, the Guidelines have been used by some Member States as a reference point when developing their own legislation or guidelines.

Eurojust has also assisted Member States in addressing the question of which jurisdiction is best placed to prosecute in cross-border cases in which a prosecution might be or has been launched in two or more jurisdictions. To prevent and support the settling of conflicts of jurisdiction that could result in an infringement of the principle of ne bis in idem, and to ensure that the most effective practices with regard to criminal proceedings are in place in the

Eurojust has also provided useful support to Member States to coordinate cross-border investigations and prosecutions, and assist them for complex mutual legal assistance requests with countries outside the EU, especially with a number of Cooperation Agreements and the network of Eurojust contact points.

The role of Eurojust in providing support for speeding up and facilitating the execution of European Arrest Warrants (EAW) is seen as very valuable by stakeholders. This mutual recognition instrument has proven to be a vital EU measure that helps all Member States to bring criminals to justice by improving and simplifying judicial procedures designed to surrender persons for the purpose of conducting a criminal prosecution or executing a custodial sentence or detention order, replacing lengthy extradition procedures within the EU. The traditional extradition procedures used to take on average one year to surrender a person from one state to another. The EAW has had a marked effect in speeding up the procedures, with 15 days on average to have a person surrendered from another Member State in case of the requested person's consent and 54 days if the requested person did not consent. While the EAW covers a broad range of crimes, it operates most efficiently with serious crimes, including terrorism and organised crime, by abolishing the so called double criminality check.

As a centralised, permanent body, Eurojust has been instrumental in fostering a climate of mutual trust, overcoming inherent barriers in cross-border cooperation in criminal matters relating to lack of knowledge of substantive and procedural rules, institutions, formalised and informal practice or reluctance to cooperate by law enforcement authorities.

Eurojust is increasingly asked to support the setting up and functioning of Joint Investigation Teams (JITs). The Eurojust support to JITs included, since 2009, also their funding in the framework of two grants awarded to Eurojust within the ISEC programme and since July 2013 from Eurojust’s own budget. As underlined by stakeholders in the assessment, the availability of EU funding has proven highly valuable in allowing Member States to share information directly without the need for formal requests and enabled them to request investigative measures amongst themselves directly. A constant increase in the applications for JIT funding is noted at Eurojust. Since 2009, Eurojust has provided financial support to 251 JITs. Stakeholders stressed that is important that sufficient funds are secured in the future for the setting up of JITs.

In most of the cases referred to Eurojust, the solution is found through the interaction of the prosecutors working at the Eurojust National desks, which are in contact with their national authorities. Coordination meetings and coordination centres were set up as specific operational tools to speed up and improve judicial cooperation across borders within the EU and beyond. They bring together judicial and law enforcement authorities from the involved Member States – and third States in some cases – to enable real-time transmission of information in cases of serious cross-border crimes among national authorities and coordinated responses during common action days.

Eurojust's specific structure and character have enabled it to play an active role in facilitating prosecutions and building mutual trust in the field of criminal justice cooperation. Its role in judicial cooperation and coordination has over the years proven vital in dismantling organised crime groups (OCGs) and terrorist networks and in confiscating the proceeds of crime. The constant increase of casework since 2002, with 2306 cases in 2016 up from only a few hundred cases in 2002, demonstrated the recognition by the Member States of the added value of Eurojust.

Eurojust was established in 2002 to stimulate and improve the coordination of investigations and prosecutions and the cooperation between the competent authorities in the Member States in relation to serious cross-border crime. It also ensures early consideration of judicial issues such as conflicts of jurisdiction, admissibility of evidence and proper follow-up to freezing and confiscation orders.

While the role of Eurojust has already been reinforced by the 2008 Eurojust Decision, Art. 85 TFEU provides potential for a significant further strengthening of the organisation. This is one of the main aims pursued by the Commission's proposal for a new Regulation laying down the functions of Eurojust presented in 2013 which should increase Eurojust's efficiency and effectiveness with a new governance structure and homogeneous status and powers of National Members, and would ensure that Eurojust can cooperate closely with the European Public Prosecutor's Office once this is established, and provide the European Parliament and national Parliaments a role in the evaluation of Eurojust's activities in line with the Lisbon Treaty.

Eurojust is regularly called upon to undertake more activities, for example in the field of e-evidence, encryption, data retention, and the implementation of the European Arrest Warrant and the European Investigation Order.

Eurojust was set up to facilitate coordination and cooperation between national investigative and prosecutorial authorities in dealing with cases affecting various Member States. It has helped to build mutual trust and to bridge the EU's wide variety of legal systems and traditions. By rapidly solving legal problems, and identifying competent authorities in other countries, Eurojust has facilitated the execution of requests for cooperation and mutual recognition instruments. These years have witnessed the continued growth of the organisation into what is now a central player in judicial cooperation in criminal matters.

In 2006, Council Decision 2006/560/JHA amended Decision 2003/170/JHA on the common use of liaison officers posted abroad by the law enforcement agencies of the Member States. The objective of the 2003 Council Decision was to provide the legal basis under which Member States law enforcement authorities may pool the capacities of their liaison officers in a third country or an international organisation. The 2006 amendments aimed to facilitate Member States use of the Europol liaison officers abroad. The main added value of the legislation is to provide for the possibility that Member States may agree that liaison officers posted abroad by one Member State shall also look after the interests of one or more other Member States. With the growing nexus of internal and external security and the growing financial constraints this is still very important.

The 2004 Council Decision on tackling vehicle crime with cross-border implications facilitates procedures for a quick repatriation of vehicles seized, designating a contact point in Member States for tackling cross-border vehicle crime and, whenever a vehicle is reported stolen, entering it in the Schengen Information system (SIS) and, where possible, in INTERPOL's stolen motor vehicle database. The EU network of the Member States contact points, CARPOL, was positively evaluated.

There are other examples of instruments aimed at facilitating operational law enforcement cooperation, in particular Council Decision 2004/919/EC on tackling vehicle crime with cross-border implications and Council Decision 2006/560/JHA on the common use of liaison officers posted abroad by the law enforcement agencies of the Member States.

The Commission has continuously supported a more extensive use of the Decision, including by using its infringement powers as necessary. However, more needs to be known on the practical implementation of the Decision by Member States and on how to ensure it delivers its full potential. More information is needed on practical difficulties which may be faced by practitioners, for example when preparing information requests. The Commission has decided therefore to launch a study which will examine further in details how the Decision is applied.

Studies on the transposition and implementation of the Decision and feedback from stakeholders in the framework of the assessment have confirmed the practical added value of this instrument, outlining the short delays in the responses received to requests and the few refusals faced. The possibility to create organisational sub-entity (like counter terrorism units) in line with the principles of the Decision allowing for a point to point communication in some operational cases was seen as crucial.

Following the Council Declaration on combating Terrorism of 25 March 2004 that called for 'exploration of possibilities of greater intelligence sharing on terrorist matters', Sweden presented a legislative initiative to set out common rules for Member States' law enforcement authorities to exchange information and criminal intelligence. The adoption in 2006 of Framework Decision 2006/960/JHA, known as the "Swedish Initiative", was a major step forward in cross-border law information exchange as the essence of the Decision is to provide an "equivalent access" to information detained by a Member State to national and other Member States law enforcement authorities.

The Commission is committed to enhance the implementation of the Prüm framework by all Member States, looking at an increase of the number of connections between Member States with a view to maximise its effectiveness and added value. Based on the high-level expert group's report, the Commission decided to conduct a feasibility study on possible improvements to the Prüm framework, notably in the area of fingerprints.

The Prüm Decisions have not yet been fully implemented by all Member States. In 2016 the Commission launched infringements procedures against five Member States for failing to comply with the Prüm Decisions. Delays in the implementation of the Decisions and a lack of consistency in their application have a detrimental effect on the use of the framework, preventing the instrument to deliver its full potential. The need to fully implement and apply the Prüm Decisions without further delay has also been recently underlined by the EU experts in the context of the high-level expert group on interoperability.

The Commission has promoted the use of the Prüm framework by supporting its practical implementation and by funding of over EUR 20 million for related projects.

Depending on the type of information concerned, 23 Member States are connected to the automated exchange of DNA profiles, 22 Member States to the fingerprint data and 21 Member States – to the vehicle registration data pursuant to the Prüm Decisions. The assessment shows that the framework is highly valued by stakeholders as an investigative tool allowing accelerating the exchange of information and is complementary to other systems. Its importance for operational cooperation was emphasised by a number of stakeholders during the assessment. The establishment of a European network of automated data exchanges has brought concrete benefits, supporting forensic activities and allowing solving criminal, search and identification cases. It has also facilitated the organisation of joint patrols and cross border operations and the provision of assistance during major events.

In 2005, seven Member States signed the Treaty of Prüm to step up cross-border cooperation in relation to countering terrorism, cross-border crime and illegal migration. In 2008, Member States adopted Council Decisions 2008/615/JHA and 2008/616/JHA to incorporate the Treaty provisions into the EU acquis. The Prüm Decisions aim at speeding up the procedures enabling Member States to find out whether any other Member State, and if so which one, has the information sought regarding DNA files, fingerprints and vehicle registration data in the context of an investigation to combat terrorism or cross border crime. Based on a hit/no hit system, the Prüm framework allows comparing anonymous profiles which can lead to requests for further information through mutual assistance procedures, including those adopted pursuant to the Swedish Framework Decision.

The Prüm Decisions on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and the Framework Decision 2006/960/JHA, known as the "Swedish initiative", which lays down common rules for Member States law enforcement authorities to exchange information and criminal intelligence, are the most relevant legal frameworks to facilitate and foster information exchange. The principles of availability and equivalent access are key notions underlying this legal framework. According to the former, a law enforcement officer in one Member State who needs information in order to perform his duties can obtain this from another Member State; the law enforcement agency in the other Member State holding this information will make it available for the stated purpose, taking into account the requirement of ongoing investigations in the requesting State. The principle of equivalent access means that common rules ensure that the conditions applied to requests made by other Member States are not stricter than those applicable at national level. At the same time they foresee that data exchange would take place according to national data protection rules.

OLAF, as an independent EU body, investigates or coordinates Member States' investigations into fraud, corruption and other illegal activity affecting negatively the financial interests of the Union as well as serious misconduct within the European Institutions, and, as a service of the Commission, develops anti-fraud policy for the European Commission.

As regards the Prüm Decisions, the report of the high-level expert group emphasised the need for full implementation and application. The Commission pursues its efforts to ensure that all Member States comply with the conditions set up by the Decisions, including by pursuing its structured dialogue with those Member States meeting delays and using its enforcement powers. As for the Swedish Initiative, the Commission services are conducting a study examining in further detail how the instrument is applied.

In its report presented of May 2017, the high-level expert group on information systems and interoperability noted a number of transversal issues to be addressed in relation with existing EU information systems and exchange of information. This includes the need to raise the standard of data quality and data use across all systems, the need for criteria to prioritise in order to deal with the huge amount of data, the importance to move away from a silo approach, and the need to keep procedures simple for comparing and transmitting data for law enforcement purposes to ensure that available instruments will be used and their potential fully delivered.

A number of legal frameworks aim at stepping up cooperation and the exchange of information and criminal intelligence. The most relevant are the Prüm Decisions and the so-called Swedish initiative. The increased awareness and understanding of the added value of enhanced information exchange among Member States and with EU agencies have contributed to significant progress in the volume and quality of information exchanged. It emerges from the assessment that Member States should make use of these instruments to their full potential.

Through capacity building CEPOL also contributes indirectly to operational cooperation between third country authorities and their counterparts in the EU. The agency has concluded working arrangements with third countries and international organisations specifying, in particular, the nature, extent and manner in which the authorities and training institutes of third countries, international organisations and private parties concerned may participate in CEPOL's work. CEPOL has also supported Union external missions with training activities focused on law enforcement and judicial cooperation.

The new CEPOL Regulation has widened the training target audience and allowed the agency to offer more targeted and relevant training with an EU dimension, in line with the European Law Enforcement Training Scheme. By conducting multi-annual strategic training needs analysis, CEPOL engages further in external relations cooperation, capacity building in third countries and preparations for Union missions.

After the Commission highlighted that the EU was lacking a systematic process for identifying and addressing strategic training needs, which are constantly evolving, a Law Enforcement Training Scheme (LETS) was established in March 2013. The objective of the LETS was to present a coordinated policy approach ensuring high quality training of law enforcement officials in all ranks, in order to increase their general and specific knowledge on cross-border policing issues.

Trainings have covered a wide range of topics, ranging from key cross-border cooperation tools and mechanisms to law enforcement techniques and from serious criminal phenomena to leadership. They are carried out by the agency or by a network of national training institutes for law enforcement officials in the Member States, and in close cooperation with other European agencies (mainly Europol, European Coast and Border Guard, EMCDDA, FRA, EASO) and other EU partners (EEAS, European Security and Defence College and others).

Since its creation in 2001, CEPOL training courses have aimed at raising awareness of law enforcement officials on existing EU instruments on tackling security challenges and provided knowledge of their use, thus facilitating cross-border cooperation between the Member States and promoting a common law enforcement culture. CEPOL has also developed, implemented and coordinated training in specific criminal or policing thematic areas and training of law enforcement officials in relation to Union missions and law enforcement capacity-building activities in third countries.

The European Union Agency for Law Enforcement Training (CEPOL) is operational since 1st January 2001 and became an agency in 2005. On 1st July 2016 the CEPOL Regulation (Regulation (EU) 2015/2219) entered into application, replacing and repealing Council Decision 2005/681/JHA.

Following the EU SOCTA 2017 on 9 March 2017, the Commission' views on the priorities set out in its sixth progress report towards an effective and genuine Security Union, and a discussion between the relevant stakeholders, the Council adopted the new EU crime priorities for the EU Policy Cycle 2018-2021 on 18 May 2017. They include eight specific crime priorities: (1) cybercrime, (2) drug production, trafficking and distribution, (3) illegal immigration, (4) organised burglaries and theft (organised property crime), (5) trafficking in human beings, (6) firearms trafficking, (7) Missing Trade Intra Community (MTIC)/Excise fraud and (8) environmental crime, and two cross-cutting crime priorities: (9) document fraud and (10) criminal finance, money laundering and asset recovery.

·need to better address cross-priority cooperation considering that, as underlined by the EU SOCTA 2017, poly-criminality is on the rise (45% of organised crime groups are involved in more than one criminal activity).

·need to bring together the internal and external dimensions of security since many of the criminal threats to the EU emanate from or through countries outside the EU. The new SOCTA concludes that around 40% of the suspects involved in serious and organised crime in the EU are non-EU nationals. Therefore, further strengthening of involvement and cooperation with relevant third countries is essential.

·need for strengthening the multi-disciplinary and multi-agency approach by involving non-law enforcement partners, including other public authorities and the private sector, whenever relevant. This could contribute to a better inclusion of preventive measures. At the same time, the EU Policy Cycle should remain a tool that, first and foremost, delivers operational results.

·need for a strengthened commitment and engagement of Member States to ensure an active and balanced contribution of all participants to the implementation of agreed actions. At national level, Member States should better integrate the EU Policy Cycle actions into their national planning. There is also a need to improve the awareness of the EU Policy Cycle among law enforcement practitioners at national level.

·need for a lighter and more streamlined EU Policy Cycle, with simplified and more targeted monitoring and reporting procedures which will reduce the administrative burden of those involved in the operational aspects of the Policy Cycle. Improved reporting should also facilitate the political level in its steering of the Policy Cycle process.

An evaluation study contracted by the Commission and completed in early 2017 concluded that the EU Policy Cycle 2013-2017 had led to an improvement in the exchange of information, sharing of good practices and the launch of a significant number of joint investigations and operations by Member States. It also contributed to building relations and trust, including with third countries.

The Policy Cycle is based on Europol EU Serious and Organised Crime Threat Assessment (SOCTA), which recommends key crime threats on which the EU should focus. Following discussions with all relevant stakeholders (Member States, the Commission, EU JHA agencies), the Council adopts the EU crime priorities for the duration of the Policy Cycle. Subsequently the Commission, together with experts of relevant EU agencies, institutions and Member States, develops a four-year Multi-Annual Strategic Plan which contains a list of strategic goals to be achieved, implemented by annual Operational Action Plans. The monitoring and assessment of the effectiveness of the Policy Cycle is done by the Council's Standing Committee on operational cooperation on internal security (COSI), based on reports provided by Member States which have taken the lead on one or several crime areas and Europol. It allows to adapt or modify the process during the Cycle. After two years, an interim review allowing for a revision of the MASPs and priorities is foreseen. At the end of an EU Policy Cycle, a thorough evaluation is conducted and lessons learned serve as input for the next EU Policy Cycle.

The EU Policy Cycle for serious international and organised crime was adopted in 2010 to ensure an effective cooperation between Member States’ law enforcement agencies, EU institutions and EU agencies with the aim to achieve coherent operational actions by national authorities targeting the key criminal threats facing the EU.

The assessment shows that one challenge will be to make the Europol databases interoperable with other EU databases, where necessary.

The new Europol Regulation makes Europol more effective and efficient. It also ensures the scrutiny by the European Parliament and national Parliaments over Europol's activities. It provides for a flexible data management architecture where information could be more easily cross-matched and criminal analyses be made in a more effective way. It also changes the rules on cooperation with external partners by simplifying strategic and technical cooperation, providing for flexible rules on the exchanges of data with the Union bodies, including e.g. CSDP missions, as well as making the Commission responsible for negotiating agreements allowing for operational cooperation with third countries (instead of Europol).

Europol's activities are essential for the achievement of all three priorities of the European Agenda on Security and contribute to the successful implementation of the European Agenda on Migration.

Europol plays a key role in the implementation of the operational phases of the EU Policy Cycle where it assists Member States in coordinating their joint actions (concrete projects and operations).

Europol also plays a significant role in strategic analysis. Its "Serious Organized Crime Threat Assessment" (SOCTA), produced every four years, gives a picture of the emerging threats to Europe in serious and organised crime. The SOCTA is the basis for the Council to establish the EU priorities in the fight against the most serious phenomena of organized crime affecting Europe, becoming a key component of intelligence-led policing in Europe (under the EU Policy Cycle on serious and organised crime). Europol produces also the EU Terrorism Situation and Trend Report (TE-SAT), with a detailed account of the state of terrorism in the EU, and other more specific threat assessments and analytical products.

The assessment shows that stakeholders value Europol's support to national law enforcement authorities through the collection, exchange and analysis of criminal information as well as operational assistance. The latter includes, for instance, providing the expertise of analysts in support of cross-border investigations, or by taking part in a Joint Investigation Team.

Connecting over 650 law enforcement agencies in Europe and beyond, Europol allows for pooling together information on serious cross-border crime and terrorism, providing analytical and operational support for Member States' investigations and operations.

The agency supports and strengthens action by the law enforcement authorities of the Member States and their mutual cooperation in preventing and combatting serious crime affecting two or more Member States (including cybercrime), terrorism and forms of crime which affect a common interest covered by a Union policy. Europol has no autonomous investigative or coercive powers. In its activities, it must abide to the data protection rules. Besides further strengthening the agency, the Europol Regulation has introduced mechanisms for the scrutiny of Europol's activities by the European Parliament together with national Parliaments.

Europol is the EU agency for law enforcement cooperation. Created in 1995 by a Convention between Member States, it became an EU agency in 2010 on the basis of Council Decision 2009/371/JHA. As from 1 May 2017 its activities are regulated by Regulation 2016/794.

EU security policies and instruments can only be successful if the law enforcement authorities and officers on the ground have full knowledge of these and acquire the competencies and skills to apply them. In this context CEPOL assists Member States in developing bilateral and regional cooperation via law enforcement training. The agency develops and coordinates the organisation of thematic training. The main challenge for the agency remains the need to focus on priority areas and deliver high quality training in the areas that influence most the security of the EU. As the agency's governing Regulation entered into force only recently, it is too early to assess the impact of this new legal basis.

The EU Policy Cycle on serious and organised crime is a tool to foster effective cooperation between Member States’ law enforcement agencies, EU institutions and EU agencies, aiming at coherent operational actions in Member States to target the key criminal threats facing the EU. The assessment indicates its importance to support intelligence led policing, and a recent study showed that it was successfully implemented during the period 2013-2017. Still, challenges were identifies as regards the need to streamline the Cycle, ensure the commitment and engagement of Member States, strengthen the multi-disciplinary and multi-agency approach, bring together the internal and external dimensions of security and better address cross-priority cooperation. Member States agreed to launch a new Policy Cycle for the period 2018-2021 which takes into account a number of the challenges identified.

Europol offers a unique set of tools and serves as an EU hub for criminal information exchange, support centre for Members States' law enforcement operations and a platform for law enforcement experts' exchanges. It has quickly adapted its internal organisation by creating the European Counter-Terrorism Centre, the European Migrants Smuggling Centre, by establishing 24/7 services and by providing for new tools and services to best serve Member States' law enforcement services.

By 6 May 2019, the Commission needs to review the Prüm Decisions and the Swedish Framework Decision, in order to make, if necessary, proposals to align those instruments with Data Protection Directive (EU) 2016/680 for Police and Criminal Justice Authorities.

The proposed approach would overcome the current weakness in the EU's data management architecture eliminating blind spots. The EU agency responsible for information system management, eu-LISA, would play a crucial role in providing technical expertise and bringing the work towards the interoperability of information systems forward.

·Common identity repository – based on alphanumeric identity data (e.g. dates of birth, passport numbers) and detecting whether a person is registered under multiple identities in different databases.

·European search portal – allowing the systems to be searched simultaneously, in full compliance with data protection safeguards and possibly with more streamlined rules for access to the systems by law enforcement authorities;

The report sets out a new approach to the management of data, where all centralised EU information systems for security, border and migration management are interoperable in full respect of data protection and other fundamental rights.

In June 2016, the Commission set up a high-level expert group on information systems and interoperability to address the legal, technical and operational challenges to achieve interoperability. The high-level expert group presented its final report on 11 May 2017. Following this, the seventh report on progress made towards an effective and genuine Security Union welcomed the group's report and recommendations, and proposed the way forward to address structural shortcomings under the three main areas:

In November 2016, the Commission presented its proposal to set up a European Travel Information and Authorisation System (ETIAS). ETIAS will allow assessing information declared by visa exempt third country nationals in advance of their arrival at the EU external borders (land, air, and sea). The aim of this assessment is to determine whether the presence of visa exempt travellers would pose a security, illegal immigration, or public health risk. The travel authorisation would only constitute an authorisation to travel to the Member States, but not a right of entry, as the decision to let a traveller enter the EU territory would still be taken by a border guard at the border-crossing point.

In April 2016, the Commission presented a proposal on the establishment of an Entry/Exit System (EES). The proposed system will modernise external border management by improving the quality and efficiency of border controls and will use new technologies to cope with the increasing flow of third-country travellers arriving at the external Schengen borders. The system will register entry and exit data of non-EU nationals crossing the EU's external borders and therefore contribute to contribute to enhancing external border management and internal security.

In April 2016, the Commission presented a Communication on Stronger and smarter information systems for borders and security, initiating a discussion on how information systems in the European Union can better enhance border management and internal security. The Communication takes stock on the situation of the various information systems for borders and security, highlighting the added-value, but also the challenges raised by the web of systems developed over time in the EU.

Data held by private actors is an increasingly important source of information for law enforcement authorities. Considering that processing passenger data against law enforcement databases and risk-based predetermined criteria can provide valuable and necessary information on persons that might be involved in criminal activities, Directive 2016/681 (the PNR Directive), adopted in April 2016, provides for the transfer by air carriers of passenger name record (PNR) data to the Member States' competent authorities. PNR is also a key part of the cooperation with EU strategic allies against terrorism and serious crime. Agreements were signed with Canada, Australia and the United States for the processing and transfer of passenger name record data.

The European Criminal Records Information System (ECRIS) contributes to reduce crime by fostering crime prevention and by giving the adequate responses to crimes already committed as regards recidivism. It was established in 2012 on the basis of Council Framework Decision 2009/315/JHA on the exchange between the Member States of information extracted from criminal records and Council Decision 2009/316/JHA on ECRIS. It allows for an electronic, de-centralised information exchange between Member States regarding criminal convictions in the EU for the purpose of criminal proceedings and other purposes. The Commission has adopted on 29 June 2017 a legislative proposal for a Regulation to establish a centralised system supplementing ECRIS with regard to the exchange of information on convicted third country nationals.

With the entry into force of the latest revisions of the Schengen Border Code (SBC) in April 2017, the objective of the Common Position as regards the consultation of INTERPOL's SLTD database is mirrored by the revised SBC as a legally binding instrument.

The assessment shows that the calls on Member States to step up the use of the SLTD database of INTERPOL are still relevant, and that progress can and should still be made in that respect.

The Commission submitted in 2006 a report to the Council on the operation of the Common Position. INTERPOL also presented to the EU in May 2009 and December 2013 two reports describing the state of contributions and use of INTERPOL’s SLTD database by EU Member States. In its 2013 report, Interpol outlined that the overall contribution of EU Member States to the SLTD database was excellent, but called on them to use it more for travel documents' checks. The Council recalled in its October 2014 conclusions the obligations for EU Member States as outlined in its Common Position (2005/69/JHA), and called on them, the Commission and Interpol to take a number of actions as regards INTERPOL's SLTD database.

In preamble 7, the Common Position "obliges Member States to ensure that their competent authorities will exchange [… their stolen and lost passports] with the Interpol database on Stolen and Lost Travel Documents, [...]". Article 3(3) states that "Each Member State shall ensure immediately after data have been entered in its relevant national database or the SIS […] these data are also exchanged with Interpol.", and article 3(4) that "Member States shall ensure that their competent law enforcement authorities will query the Interpol database […] each time when appropriate for the performance of their task". Article 6 states that "Each Member State shall ensure that if a positive identification occurs against the Interpol database its competent authorities shall take action […]".

The 2005 Council Common Position on exchanging certain data with INTERPOL obliges Member States to ensure that their competent authorities will exchange data with the INTERPOL database on Stolen Travel Documents (SLTD), in parallel to entering them in the relevant national database and, where applicable, the SIS.

Council Decision 2008/633/JHA of 23 June 2008 provides a legal basis for the consultation of the Visa Information System by so-called "designated authorities" of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences. Regulation 603/2013 of 26 June 2013 provides a legal base for designated authorities of Member States and by Europol for a comparison of fingerprints with the fingerprints of persons registered in the Eurodac database for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences. The 2016 evaluation of the VIS carried out in 2016 found that, in practice, access to the VIS for law enforcement purposes has been limited and fragmented across Member States.

These changes involve technical and operational improvements to the SIS to address issues identified in the Commission’s 2016 comprehensive evaluation of the system. They develop and improve the existing system, building on the effective safeguards already in place. As the system continues to process personal data (and it will process further categories of sensitive biometric data), there are potential impacts on individuals’ fundamental right to the protection of such data. Hence, additional safeguards have been put in place to limit the collection and further processing of data to what is strictly necessary and operationally required, and granting access to data only to those who have an operational need to process them. Clear data retention timeframes have been set out in the proposals and there is explicit recognition of and provision for individuals’ rights to access and rectify data relating to them and to request erasure in line with their fundamental rights. In addition, the proposals set out requirements for an alert to be deleted and introduce a proportionality assessment if an alert is being extended. They also establish extensive and robust safeguards for the use of biometric identifiers to avoid innocent persons being inconvenienced. Lastly, they require the end-to-end security of the system, ensuring greater protection of the data stored in it.

·a new action which is the inquiry check allowing a more-in-depth questioning of the person. This measure does not involve temporary detention and physical search of the person or his belongings.

On 21 December 2016, the Commission adopted three legislative proposals, which aim to strengthen the operational effectiveness and efficiency of SIS and extend its functionalities and use. Among other changes, the proposals introduce new provisions regarding the use of biometric data and new types of alerts, such as preventive alerts on children at risk of abduction, alerts on unknown wanted persons, alerts for inquiry checks and alerts on return decisions.

The evidence collected during the evaluation showed that SIS is a tool with which the EU brings significant added value in combating crime and security threats – the scale of the system is such that similar results could not be achieved by action at national level or through bilateral cooperation. It supports European cooperation in the area by facilitating, and thereby increasing, information exchange between law enforcement officials across 30 Member States that use the system.

The Commission presented on 21 December 2016 a report and a staff working document on the outcome of an evaluation of the Schengen Information System. The operational effectiveness of SIS in supporting law enforcement authorities in combating crime and security threats is illustrated by the statistics collected during the Commission’s evaluation. Since its entry into operation, queries in SIS have led to:

Since 2013 the Commission has undertaken intensive awareness-raising with Member States. In addition to awareness-raising, the Commission has also made legal and technical improvements and as of 1 February 2015 SIS provides for real-time communication in cases requiring special urgency and attention. As of the same date, SIS clearly displays if an identity document was invalidated by the issuing Member State for travel purposes. SIS alerts also display the “terrorism-related activity” of a person, vehicles and other means of transport.

The first generation of the system was set up in 1995 as the major compensatory measure following the abolition of internal border controls, in line with the 1985 Schengen Agreement and the 1990 Schengen Implementing Convention. In the absence of internal border controls, Member States had to address the issues of cross-border crime and irregular migration. SIS allows for the effective and efficient implementation of the mutual recognition measures set out in the Schengen Implementing Convention. However, after the enlargement of the Schengen area, the system’s capacity and functionalities needed updating. As a result, the second generation (SIS II) entered into operation on 9 April 2013 and provided Member States with enhanced functionalities and new object categories. In April 2017 the Commission launched an infringement procedure against Ireland for the failure to implement a connection with SIS II.

The Schengen Information System (SIS) is a centralised, large-scale information system supporting checks at the external Schengen borders and reinforcing law enforcement and judicial cooperation within 29 countries throughout Europe. It provides law enforcement with alerts on serious criminals and other people posing a threat to national security, people that should be arrested to face justice in another Member State, and missing persons who crossed a border into another Member State. The system also contains information about stolen motor vehicles, misuse of identity or travel documents, stolen firearms, stolen number plates and other lost or stolen property.

According to stakeholders, the proposals for a new Entry/Exit System and a new European travel information and authorisation system constitute a stepping stone towards the interoperability of EU information systems.

To address these shortcomings, the Commission initiated a work process towards the interoperability of information systems. As part of that, the Commission set out an approach on how to achieve the interoperability of information systems for security, border and migration management by 2020 to ensure that border guards, law enforcement officers including customs officials, immigration officials and judicial authorities have the necessary information at their disposal. Work on implementing this approach is on-going.

However, there are also shortcomings related to information systems that impede the work of national authorities. The main shortcomings are: (a) sub-optimal functionalities of existing information systems, (b) gaps in the EU's architecture of data management, (c) a complex landscape of differently governed information systems, and (d) a fragmented architecture of data management for border control and security. These shortcomings have been confirmed in the evaluation.

There are a number of information systems and databases at EU level that provide border guards, police officers and other authorities with relevant information on persons, in accordance with their respective purposes.

Significant financial resources have been dedicated to research in the area of information exchange, under FP7 and H2020 Security Research Programmes, for a total of approximately EUR 182 million (covering information management; secure communications; information gathering; preparedness, prevention, mitigation and planning; organisational structure and cultures of public users; end users; other coordination; training).

EU agencies (Europol and Eurojust) and bodies (OLAF) play a key role in assisting national law enforcement and judicial authorities in their efforts to prevent and fight crime and fostering cross-border cooperation.

Information exchange tools and information systems need to comply with fundamental rights. An important development in relation to access to data held by private actors was the annulment, by the Court of Justice, of the Data Retention Directive in 2014. The main objective of the Directive was to harmonise Member States’ provisions concerning the retention of certain data which are generated or processed by providers of publicly available electronic communications services or of public communications networks. It sought to ensure that the data were available for the purposes of the prevention, investigation, detection and prosecution of serious crime, such as, in particular, organised crime and terrorism. The Court considered that the retention of data for the purpose of allowing the competent national authorities to possibly access those data, as required by the Directive, genuinely satisfied an objective of general interest. However, since the Directive did not lay down clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, the Court concluded that, by adopting the Directive, the EU legislature had exceeded the limits imposed by the requirement of proportionality.

Another set of information tools concerns data held by private actors. Such data have become an important source of information for law enforcement authorities, notably for the purpose of investigating crime, as they provide for criminal intelligence about the composition of criminal groups, the means used to commit certain crimes (like air travel to facilitate human trafficking and drugs trafficking, or their communications), the types of crime being committed and other elements of criminal modus operandi. Examples of such data are passenger name record (PNR) data used for the booking of air travel, as well as communications data and financial transaction data.

Both proposed systems aim at contributing to the security of the European Union and strengthening its external border management. The proposed systems will provide for law enforcement access. Provided the agreement by the co-legislators, both proposed systems are envisaged to be operational by 2020.

Second, the Commission proposed European travel information and authorisation system (ETIAS) to allow for advance assessment of security, irregular migration and public health risks on visa exempt travellers planning to travel to the EU.

The Commission has also made legislative proposals on two new IT systems. First, an Entry-Exit System (EES) which will modernise and strengthen the Schengen area’s external border management and help Member States deal with ever-increasing numbers of travellers coming to the EU. The system will contribute to fighting identity fraud and promote mobility between the Schengen zone and third countries in a secure environment, while also contributing to the fight against terrorism and serious crimes. The EES will register the identities of third-country nationals (alphanumeric data, four fingerprints and facial image) together with details of their travel documents, and will link these to electronic entry and exit records.

As regards centralised information systems, the second generation of the Schengen Information System (SIS II) is at the very heart of Schengen cooperation. Moreover, law enforcement authorities have access, under strict conditions and with the necessary safeguards, to EU databases containing data on visa and asylum purposes (Visa Information System and Eurodac).

Together with Article 39 CISA on mutual assistance, the Prüm Decisions and the Swedish Framework Decision constitute the backbone of the EU framework of information exchange between law enforcement authorities. It outlines conditions for the exchange of information in the context of conducting a criminal investigation or criminal intelligence operation. They are complemented by more specific instruments.

The Convention Implementing the Schengen Agreement (CISA), often referred to as the Schengen Convention, offers essential instruments for cross-border operational police cooperation. Title III on police cooperation and judicial cooperation contains provisions on cross-border surveillance (Art. 40) and hot pursuit (Art. 41). The Prüm Decisions on the stepping up of cross-border cooperation to combat terrorism and cross-border crime further complements this by adding other forms of cooperation, such as joint patrols and other joint operations in which officers from a Member State participate in operations within another Member State's' territory (Art. 17).

Cooperation against crime and terrorism at EU level focuses primarily on the cross-border exchange of information and on different forms of operational cross-border cooperation. This has been a policy priority in the justice and home affairs area for the last 15 years. In order to enhance European cooperation, a number of tools have been set up for law enforcement, criminal investigation and judicial cooperation purposes, as well as EU centralised and decentralised information systems.

In specific regions, the Commission has also used other instruments, including the European Neighbourhood Instrument (ENI), to help countries of the Eastern Partnership (Armenia, Azerbaijan, Belarus, Georgia, Moldova, Ukraine) to define strategic priorities related to the fight against cybercrime. The Instrument of Pre-accession (IPA) finances a new action of EUR 5 million to help countries in South-Eastern Europe and Turkey to cooperate on cybercrime. The roll-out of more actions in these areas is foreseen in the next years, also through other financing instruments.

At a global and trans-regional level these initiatives are financed by the Instrument contributing to Stability and Peace (IcSP) where cybersecurity and combatting cybercrime have been identified as areas of priority since 2013 with an allocation of EUR 4.5 million for 2013, and an indicative allocation of EUR 21.5 million over the period 2014-2017.

The Commission also supports capacity building in third countries, recognising the strong link between increased cyber resilience and sustainable development. The objectives are to increase third countries’ technical capabilities, preparedness, and establish effective legal frameworks to address cybercrime and cybersecurity problems; and at the same time enhance their capacity for effective international cooperation in these areas. The Commission has partnered with the Council of Europe and EU Member States for the implementation of these actions.

The EEAS and Commission services, in close cooperation with the Member States, also establish links and dialogues on international cyber policy and security of information and communication technologies with key strategic partners such as Brazil, China, India, Japan, the Republic of Korea and the United States.

A coordinated EU action at international level in the field of cybersecurity is ensured by the European External Action Service (EEAS) and Commission services, together with the Member States. In doing so, they seek to uphold EU core values and promote a peaceful, open and transparent use of cyber technologies. The HR, the Commission and the Member States engage in policy dialogue with international partners and with international organisations such as the Council of Europe, the Organisation for Economic Co-operation and Development (OECD), the Organization for Security and Co-operation in Europe (OSCE), the North Atlantic Treaty Organization (NATO) and the United Nations (UN).

The Communication on strengthening Europe's Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry announced the development of a Cybersecurity Smart Specialisation Platform to help Member States and regions interested in investing in innovation in the cyber-security sector (RIS3) with the European Regional Development Fund.

In 2014-2016, the EU invested about €20 million in such projects; an additional investment of EUR 12 million is earmarked for a call for proposals to open in May 2017.

Cybersecurity is one of the areas supported under the Digital Service Infrastructures (DSIs) stream within the Connecting Europe Facility (CEF). The funded projects deploy trans-European digital services based on solutions such as e-identification and interoperable health services. One of the aims is to achieve cross-border cooperation in cybersecurity, enhancing the security and thus the trust in cross-border electronic communication, contributing to the creation of the Digital Single Market.

EU funding is also available for infrastructure projects. For the 2014-2020 period, the European Structural and Investment (ESI) Funds foresee a contribution of up to €400 million for investments in trust and cybersecurity. The ESI funds can finance security and data protection investments to enhance interoperability and interconnection of digital infrastructures, electronic identification, privacy and trust services.

Under "Leadership in enabling and industrial technologies", projects on dedicated technology- driven digital security building blocks are funded (such as the 2014 calls on Cryptography and Security- by-Design). Security is also integrated as a functional requirement in specific technologies, such as the Internet of Things, 5G, Cloud, etc.

The Fighting Crime and Terrorism strand focuses on increasing the knowledge of the cybercrime phenomenon - its specificities, its economy (including its unlawful markets and its use of virtual currencies) and the means for law enforcement authorities to fight it more efficiently and to prosecute offenders with more solid evidence from specialised forensic activities.

The Digital Security strand focuses on increasing the security of current applications, services and infrastructures by integrating state-of-the-art security solutions or processes, supporting the creation of lead markets and market incentives in Europe. Security is also a so-called “digital focus area” under other challenges (privacy and security in ehealth; energy; transport; innovative security solutions for public administrations). The aim is to ensure digital security integration in the application domains.

Cybersecurity and privacy are part of two streams of the Horizon 2020 programme. Under the Societal Challenge “Secure societies – Protecting freedom and security of Europe and its citizens”, there are two relevant strands - the Digital Security strand and fighting Crime and Terrorism strand.

For research and innovation, during the 2007-2013 period, the EU invested EUR 334 million in cybersecurity and online privacy projects. Topics such as trustworthy network and service infrastructures, cryptology and advanced biometrics were addressed under the 7th Framework Programme (FP7) and the Competitiveness and Innovation Programme (CIP). During the same period, the Security Research theme of FP7 invested EUR 50 million in cybercrime projects addressing topics like the economy of cybercrime, risk analysis for infrastructure protection, money laundering and dedicated road mapping actions. For the period 2014-2016, the EU has so far invested EUR 160 million under the H2020 Research and Innovation Framework Programme in cybersecurity research and innovation projects.

The EU financial support in the field of cybersecurity focusses on three main strands: research and innovation, infrastructure and capacity building in third countries.

In this context the creation of the cPPP stimulated cybersecurity players to organise themselves at the European level. The European Cyber Security Organisation (ECSO) was launched on 13 June 2016 in Brussels.

Given that it is a recently created Partnership, with active involvement of industry partners and other stakeholders from the cybersecurity community, it can be assumed that the objectives are still consistent with the current needs. At the same time it is worth noting that the EU investment in the field of cybersecurity is substantially lower if compared to other key global players such as e.g. the US or China.

The EU will invest EUR 450 million in calls for proposal related to this partnership, under its research and innovation programme Horizon 2020. Cybersecurity market players, represented by ECSO, are expected to invest three times more bringing the total investment to EUR 1.8 billion. The Commission launched the first H2020 calls for proposals under the cybersecurity PPP at the end of 2016 and in the first quarter of 2017

The goal of this partnership is to stimulate European competitiveness and help overcome cybersecurity market fragmentation through innovation, building trust between Member States and industrial actors as well as helping align the demand and supply sectors for cybersecurity products and solutions. It aims at gathering industrial and public resources to deliver excellence in research and innovation and maximise the use of available funds through greater coordination with Member States and regions.

The contractual Public Private Partnership on cybersecurity (cPPP) is one of the 16 initiatives put forward in the Commission's Digital Single Market Strategy. Its establishment was announced in the European Commission's Communication on Strengthening Europe's Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry and constitutes an important element of the implementation of the 2013 EU Cybersecurity Strategy. The contract between the European Commission and the industry represented by the European Cybersecurity Organisation (ECSO) was signed on 05 July 2016.

The Commission is currently performing a full evaluation of ENISA, as requested by Article 32 of its Regulation, with a view to revise its mandate that is currently set to expire in 2020. The final results of the evaluation are expected in the third quarter of 2017. The evaluation aims to assess the relevance, impact, effectiveness, efficiency, coherence and EU added value of the agency having regard to its performance, governance, internal organisational structure and working practices. A public consultation on ENISA’s evaluation and review has recently been concluded and its results are being analysed.

The 2013 Regulation gave ENISA a very broad mandate in the cybersecurity area that allowed the agency to be flexible in terms of responding to new challenges not specifically mentioned in the legal text. However, since 2013, the cybersecurity context has evolved significantly, in terms of threat landscape, technology, market and policy developments. The ever increasing digital connectivity makes cyberspace more vulnerable and exposes the economy and society to cyber threats. On the regulatory front, delivering on the EU Cybersecurity Strategy, the adoption of the first EU wide legislation on cybersecurity – the Directive on security of network and information systems (the "NIS Directive") – constitutes a major development with impact also on ENISA, which is entrusted some important new tasks by the Directive.

ENISA carries out its activities according to an annual and multiannual work programme. It is granted an autonomous budget financed primarily through a contribution from the Union as well as contributions from third countries participating in the agency’s work. Member States are also allowed to make voluntary contributions to the revenue of the agency.

ENISA helps the Commission, the Member States and the business community to address, respond and especially to prevent NIS problems. The main activities run by ENISA include:

The 2013 ENISA's Regulation mandated the agency to contribute to a high level of network and information security within the Union and to raise awareness on these matters for the benefit of citizens, consumers, enterprises and public sector organisations with the ultimate goal of supporting the single market.

The European Union Agency for Network and Information Security (ENISA) was set up in 2004 with a regulation based on Article 114 TFEU. Its legal basis was revised in 2013 and this is the regulation currently applicable. The overall objective was to contribute to a high level of network and information security within the EU.

As the Directive was recently negotiated and adopted, its objectives are still consistent with the current needs. At the same time, the Directive clearly brings EU added value. For the time being, the Member States have very different levels of capabilities and preparedness leading to fragmented approaches across the EU. Therefore, cooperation and information sharing is happening mainly among a minority of Member States with a high-level of capabilities. The establishment of the strategic and operational cooperation mechanisms which are entrusted with concrete tasks under the Directive should be a major improvement in this regard. However, since the cooperation is voluntary, the success of those mechanisms will depend on the level of Member States' involvement in the process. Once transposed and implemented, the new Directive will ensure that all Member States have in place a minimum level of national capabilities.

·Security and notification requirements for digital service providers - Important digital businesses, referred to in the Directive as "digital service providers" (DSPs), will also be required to take appropriate security measures and to notify serious incidents to the competent authority. The Directive will cover the providers of the following services: online marketplaces; cloud computing services and search engines.

·Security and notification requirements for operators of essential services - Businesses with an important role for society and economy, referred in the Directive as "operators of essential services", will have to take appropriate security measures and to notify serious incidents to the relevant national authority.

·Improving cooperation - The Directive creates ‘Cooperation Group’ between Member States, in order to support and facilitate strategic cooperation and the exchange of information among Member States and to develop trust and confidence amongst them. The Commission provides the secretariat for the Cooperation Group. The Directive also creates a network of Computer Security Incident Response Teams, known as the CSIRTs Network, in order to promote swift and effective operational cooperation on specific cybersecurity incidents and sharing information about risks. The EU Agency for Network and Information Security (ENISA) provides the secretariat for the CSIRTs Network.

·Improving national cybersecurity capabilities - Member States will be required to adopt a national NIS strategy defining the strategic objectives and appropriate policy and regulatory measures in relation to cybersecurity. Member States will also be required to designate a national competent authority for the implementation and enforcement of the Directive, as well as Computer Security Incident Response Teams (CSIRTs) responsible for handling incidents and risks.

The adoption of the NIS Directive was a key step towards building European level cybersecurity resilience. The Directive was adopted in July 2016 and Member States have until May 2018 to transpose the Directive into their national laws and 6 months more to identify operators of essential services. Its objective is to achieve a high common level of security of network and information systems within the EU. The four cornerstones of the NIS Directive are:

Over the past few years, the European Commission has adopted a series of measures to raise Europe's preparedness to ward off cyber incidents. The approach adopted previously in the area of NIS, starting in 2001, mainly consisted in the adoption of a series of action plans and strategies urging the Member States to increase their NIS capabilities and to cooperate to counter cross border NIS problems.

In July 2016, the Commission presented additional measures to boost the cybersecurity industry and to tackle cyber-threats. The Digital Single Market Strategy presented in May 2015 called for the creation of a public-private partnership on cybersecurity. The partnership was signed on 5 July 2016 by the Commission and the European Cyber Security Organization (ECSO) – an industry-led association, which includes a wide variety of stakeholders such as large companies, SMEs and start-ups, research centers, universities, end-users, operators, clusters and association as well as public authorities.

Since 2013, the Commission has adopted a set of legislative proposals; in particular the Directive on Security of Network and Information Systems (NIS Directive), earmarked more than EUR 600 million of EU investment for research and innovation in cybersecurity projects during the 2014-2020 period, and fostered cooperation within the EU and with partners on the global stage.

·Mainstreaming cybersecurity in EU policies by embedding cybersecurity in the future EU policy initiatives from the start, in particular with regard to new technologies and emerging sectors such as connected cars, smart grids and the Internet of Things (loT).

·Making the EU a strong player in cybersecurity. Europe needs to be more ambitious in nurturing its competitive advantage in the field of cybersecurity to ensure that European citizens, enterprises (including SMEs), public administrations have access to the latest digital security technology, which is interoperable, competitive, trustworthy and respects fundamental rights including the right to privacy and data protection. This should also help take advantage of the booming global cybersecurity market. To achieve this Europe needs to overcome the current cybersecurity market fragmentation and foster European cybersecurity industry; and

·Increasing cybersecurity capabilities and cooperation. The aim is to bring cybersecurity capabilities at the same level of development in all the EU Member States and ensure that exchanges of information and cooperation are efficient, including at cross-border level;

Since the adoption of the first EU Cybersecurity Strategy in 2013, the European Commission has stepped up its efforts to better protect Europeans online.

Overall, the assessment points to continued relevance of all instruments currently in place but highlights the need for more measures at all levels – strategic, legislative and operational.

As regards industrial policy, the objectives of the recently created contractual Public-Private Partnership in this area are still consistent with the current needs. However, stakeholders pointed to the need of expanding the EU investment in the field of cybersecurity which still remains substantially lower if compared to other key global players such as e.g. the US or China. As a positive development resulting from the establishment of the contractual Public-Private Partnership (cPPP) was considered the fact that it stimulated private cybersecurity actors to organise themselves at European level and overcome the fragmentation which existed earlier.

With regard to the European Union Agency for Network and Information Security (ENISA), the 2013 Regulation gave ENISA a very broad mandate in the cybersecurity area that allowed the agency to be flexible in terms of responding to new challenges not specifically mentioned in the legal text. The Commission is currently performing a full evaluation of ENISA, with a view to review its mandate. The evaluation aims to assess the relevance, impact, effectiveness, efficiency, coherence and EU added value of the agency. In light of the significant changes that occurred in the cybersecurity landscape since 2013, in the dialogue process of the assessment, stakeholders noted the need for focussing on the support to Member States cooperation to strengthen Europe's cyber resilience and on the cooperation with other agencies, such as Europol and Eurojust.

In terms of legislation, considering that the main act – the Directive on security of network and information systems (NIS Directive) was adopted in 2016, it appears from the assessment that its objectives are still consistent with the current needs and the Directive clearly brings EU added value. For the time being, the Member States have very different levels of capabilities and preparedness leading to fragmented approaches across the EU. Once transposed and implemented, the new directive will ensure that all Member States have in place a minimum level of national capabilities.

Since 2013, the cybersecurity context has evolved significantly, in terms of threats landscape technology, market and policy developments. Given the constantly evolving nature of cybersecurity threats, and the dynamic policy development in this field, this part of the assessment presents the main elements of EU action on achieving cyber resilience.

The protection of network and information security is the first line of defence against cybercrime. Every day, cyber security incidents cause major economic damage to the European economy and businesses. Cyber-attacks are a key component of hybrid threats; timed precisely in conjunction with physical threats, such as terrorism, they can have a devastating impact, destabilising a country or challenging its political institutions. As they increasingly rely on online technologies, critical infrastructure such as energy grids, satellite communications and healthcare systems become ever-more vulnerable. This is a key challenge facing the Union and one where action at EU level can make a real difference to our collective resilience. Ensuring the security of the Union requires the mainstreaming of cybersecurity across both our internal and external security work and a broad range of EU policies.

othe Instrument for Pre-Accession Assistance (IPA), including 5 million for the CyberProceeds@IPA project run by the Council of Europe between 15 December 2015 and 14 June 2019, which aims to strengthen the capacity of authorities in Western Balkans and Turkey to search, seize and confiscate cybercrime proceeds and prevent money laundering on the Internet.

othe Instrument contributing to stability and peace, including 9 million for the GLACY+ project run by the Council of Europe (in partnership with INTERPOL) between 1 March 2016 and 27 February 2020, which aims to strengthen the capacities of States worldwide to apply legislation on cybercrime and electronic evidence and enhance their abilities for effective international cooperation in this area;

·In the first two years of Horizon 2020 (2014-2015), six cybercrime-related projects were selected within the Fight against Crime and Terrorism (FCT) call, with the total of 33 million euros;

·Under the 7th Framework Programme for Research and Technological Development (FP7, 2007-2013), the EU invested 80 million euros in cybercrime-related projects, addressing topics like legal, criminological and sociological aspects of cyber-crime as a new European-scale emergency, the economy of cybercrime, risk analysis for infrastructure protection, money laundering, identity theft, European informatics data exchange framework for court and evidence, or dedicated road mapping actions;

·the Internal Security Fund (ISF) as the successor to ISEC for the period 2014-2020, with a total budget slightly over EUR 1 billion available for funding actions under the ISF Police instrument, including the fight against cybercrime. Concrete actions to be funded through this instrument can include a wide range of initiatives, such as setting up and running IT systems, acquisition of operational equipment, promoting and developing training schemes and ensuring administrative and operational coordination and cooperation;

·the Prevention and Fight against Crime Programme (ISEC 2007-2013) which has contributed around EUR 15 million to the fight against cybercrime since 2007;

As far as EU funding is concerned, in addition to financing Europol's EC3 (staff and operational costs), the Commission supports the fight against cybercrime by funding cybercrime projects through tools such as:

The Commission engages in policy development processes under the Internet Corporation for Assigned Names and Numbers (ICANN) with a focus on public safety consequences of the organisation of the Internet. In view of ICANN's responsibility for the coordinating of the maintenance and procedures of the Internet's Domain Name System (DNS) , the Commission continuously assesses at policy level potential risks of abuse by cybercriminals, and ways to ensure accountability online by law enforcement authorities on the basis of the functioning of the DNS. The Commission co-chairs the Public Safety Working Group (PSWG) of ICANN's Governmental Advisory Committee (GAC), which meets several times a year.

In view of the cross-border nature of the internet, the Commission is also engaged in policy development activities at international level. With the United States as a key partner in the fight against cybercrime, the Commission engages in regular dialogues at working level in the context of the EU-US working group on cybercrime. The EU-US working group on cybercrime provides for an opportunity for collaboration on relevant issues, including on cross-border access to electronic evidence, the role of encryption in criminal investigations and the fight against child sexual abuse and exploitation online. The EU-US working group reports back periodically at senior official and ministerial level.

To further improve judicial cooperation within the EU, in 2016 the Council has established the European Judicial Cybercrime Network. The task of this network of specialised prosecutors and judges is to facilitate and enhance cooperation between the competent judicial authorities dealing with cybercrime, cyber-enabled crime and investigations in cyberspace, by facilitating exchange of information and best practices, as well as fostering dialogue among the different actors and stakeholders that have a role in ensuring the rule of law in cyberspace. In line with Council expectations, Eurojust provides support to the network in accomplishing its tasks.

Eurojust has also intensified its focus on the support it provides to Member States in cases of cybercrime, leading to a steep rise in the number of cases supported by Eurojust.

In providing support to Member States’ law enforcement and judicial authorities, Europol and Eurojust have increased their operational cooperation. Many cases now involve operational and judicial coordination from an early stage, leading to more effective and more efficient investigations and prosecutions. A Eurojust representative is seconded to the EC3 to build the bridge between Eurojust and Europol, facilitating the exchange of information, and supporting and coordinating cooperation with the EC3.

In the area of awareness-raising, prevention and mitigation, Europol participates in the recently launched project "No More Ransom!". Founded by the Dutch National Police, Europol, Intel Security/McAfee and Kaspersky Lab, this projects aims to combat ransomware, by helping victims and raising awareness, in particular by making available to the public a wide range of decryption tools.

The EC3 also created advisory groups in order to develop strategic cooperation with the private sector. Four dedicated advisory groups have been created in the areas of internet security, financial services, communication services and e-commerce in order to foster closer cooperation with its leading non-law enforcement partners.

The EC3 focuses on providing operational support of the Member States at the EU level for cross-border cybercrime, as well as specialised strategic and threat assessments. EC3 supports Member States and links investigations in different Member States, either via direct contacts or the Joint Cybercrime Action Task Force (J-CAT) set up by Europol. J-CAT hosts of police officers temporarily seconded by national authorities on a temporary basis to EC3 (for a period of up to 6 months). The main added value of this group lies in its ability to pool national intelligence related to a single cybercrime case - which is typically scattered across several Member States - in order to build an accurate picture of its scale and relevance for EU coordinated action.

·reaches out to cybercrime related law enforcement services, private sector, academia and other non-law enforcement partners (such as internet security companies, the financial sector, computer emergency response teams) to enhance cooperation;

To support operational cooperation among Member States, Europol’s Cybercrime Centre (EC3) was set up in 2013 as an integral part of Europol and has become a focal point in combatting and preventing cross-border cybercrime. The Centre serves as the central hub for criminal information and intelligence and:

As announced, the Commission intends to report on its conclusions on encryption to the Council in the fourth quarter of 2017.

The Commission has also begun a review of the role of encryption in criminal investigations. This stems from the Commission's commitment in the April 2015 European Agenda on Security to explore with service providers concerns law enforcement authorities have on encryption technologies followed by the discussion launched by the Slovak Presidency of the Council on the role of encryption in criminal investigations, which was concluded at the 8-9 December 2016 JHA Council meeting. Moreover, in its Internet Organised Crime Threat Assessment 2016, Europol highlights that “The growing misuse of legitimate anonymity and encryption services and tools for illegal purposes poses a serious impediment to detection, investigation and prosecution, thereby creating a high level of threat cutting across all crime areas.”

Also in the area of electronic evidence, Europol has indicated that technologies used by Internet Service Providers to allocate one IP address to multiple users are an increasing problem for investigators, because it greatly complicates the identification of criminals to the point that some investigations must be abandoned.

In particular, the Commission is currently reviewing mechanisms available for obtaining cross-border access to electronic evidence. The Commission reported to the 8 June 2017 Council on the results of a comprehensive expert consultation process that identified possible options to improve cross-border access to electronic evidence for criminal investigations.

In parallel, the Commission is reviewing how to remove obstacles to the investigation of cyber-enabled crime and terrorism. In 2016, Eurojust and Europol presented a joint paper, listing the most prominent common challenges faced in criminal investigations and prosecutions of cybercrime. This document was updated in 2017.

To support implementation, the Commission addressed reasoned opinions to Bulgaria, Belgium and Ireland in December 2016 for non-communication of complete transposition of Directive 2013/40/EU on attack