EUROPEAN COMMISSION Brussels, 30.10.2019 COM(2019) 552 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE EUROPEAN COUNCIL AND THE COUNCIL Twentieth Progress Report towards an effective and genuine Security Union



I. INTRODUCTION This is the twentieth report on the further progress made towards building an effective and genuine Security Union and covers developments under two main pillars: tackling terrorism and organised crime and the means that support them; and strengthening our defences and building resilience against those threats. The Juncker Commission made security a top priority from day one. Building on the April 2015 European Agenda on Security and the April 2016 Communication paving a way towards an effective and genuine Security Union, the EU responded with a coordinated approach to a series of terrorist attacks and other growing security challenges, making significant progress in enhancing our collective security. It has become increasingly clear that today’s security challenges – whether it is terrorism, organised crime, cyberattacks, disinformation or other evolving cyber-enabled threats – are shared threats. Only by working together can we achieve the level of collective security that citizens rightly demand and expect. This shared understanding has been the basis for the progress made towards an effective and genuine Security Union. Driven by the needs of national authorities working on keeping citizens safe, the EU-level support has focused on legislative and operational measures where joint action can have an impact on the security of Member States. This work has been carried out in close conjunction with the European Parliament and the Council, and with full transparency towards the wider public. Full respect of fundamental rights has been at the heart of this work, as the security of the Union can only be ensured when citizens are confident that their fundamental rights are fully respected. The EU has worked to counter terrorism by closing down the space in which terrorists operate, with new rules making it harder for them to access explosives, firearms and financing, and to restrict their movements. The EU has stepped up information exchange to provide those on the frontline, police officers and border guards, with efficient access to accurate and complete data, making best use of existing information and closing gaps and blind spots. Strong protection of the external borders is a precondition for security in the area of free movement without internal border controls. In March 2019, the European Parliament and the Council reached agreement on a further strengthened and fully equipped European Border and Coast Guard and the new Regulation is expected to enter into force in early December 2019. The EU has provided a platform and funding for those working in local communities to exchange best practices on countering radicalisation and preventing violent extremism, as well as proposing new rules to effectively remove terrorist content online. EU support has helped make cities more resilient against attacks, with action plans to support the protection of public spaces and to enhance preparedness against chemical, biological, radiological and nuclear security risks. The EU has addressed cybersecurity and cyber-enabled threats, by putting in place a new EU cybersecurity strategy and adopting relevant legislation, and tackling disinformation to better protect our elections. Work continues to strengthen the security of our digital critical infrastructure, including reinforced cooperation on the cybersecurity of 5G networks across Europe. More still remains to be done. The live-streamed attack against a synagogue and the killing of two citizens in Halle, Germany on 9 October 2019 was a shocking reminder of the threat posed by right-wing violent extremism and anti-Semitism. It also highlighted once again the misuse of the internet for terrorist propaganda and hence the need for EU-wide rules for the deletion of terrorist content online. The 7-8 October 2019 Justice and Home Affairs Council debated right-wing violent extremism and terrorism, stressing the need for further work including on countering the spread of unlawful right-wing extremist content online and offline. At the same time, the killing of three police officers and another staff member in the Paris police headquarters on 3 October 2019 shows that the threat from jihadi inspired terrorism remains real, and that on-going efforts to support Member States in addressing this threat need to continue. The escape of imprisoned members of ISIS/Da’esh in the context of recent events in Northern Syria could have a serious impact on security in Europe. It is important that Member States make full use of existing information systems to detect and identify foreign terrorist fighters when crossing the external borders. Work is also on-going on the use of battlefield information to prosecute foreign terrorist fighters. This report sets out the recent progress made in the work towards an effective and genuine Security Union, highlighting areas where further action is needed. It provides an update on the implementation of agreed measures on cybersecurity of 5G networks, in particular on the EU Risk Assessment Report published on 9 October 2019, and on countering disinformation. This report focuses in particular on the external dimension of the cooperation in the Security Union, with the signing of two bilateral counter-terrorism arrangements with Albania and the Republic of North Macedonia and progress made in the cooperation with third country partners on the exchange of passenger name record data. In addition, together with this report, the Commission adopted a request for authorisation for the launch of negotiations for an agreement between the EU and New Zealand on the exchange of personal data to fight serious crime and terrorism. II. DELIVERING ON LEGISLATIVE PRIORITIES 1.Preventing radicalisation online and in communities The prevention of radicalisation is a cornerstone of the Union’s response to the threats posed by terrorism. In that respect, the internet has been the most significant battleground for terrorists’ action in the 21st century. Spaces in which radicalised individuals can communicate and share content enable the development of worldwide, expanding networks of both jihadi and right-wing violent extremists. This is why the Commission continues its two-track approach against online radicalisation where proposed rules on removing illegal terrorist content online should reinforce the voluntary partnership with online platforms. Essential to this is the legislative proposal to prevent the dissemination of terrorist content online, with clear rules and safeguards that would make it mandatory for internet platforms to take down terrorist content within one hour upon receipt of a reasoned request by competent authorities, and to take proactive measures proportionate to the level of exposure to terrorist content. Interinstitutional negotiations are ongoing between the European Parliament and the Council, with a first trilogue meeting held on 17 October 2019. Given the threat posed by terrorist content online, the Commission calls on the co-legislators to reach agreement on the proposed legislation by the end of 2019. The proposed legislation complements the voluntary partnership with the internet industry and other stakeholders taking place in the EU Internet Forum. Since its creation in 2015, it has been a catalyst for internet companies to act proactively to identify and remove terrorist content online, paving the way for the industry-led initiative of a ‘shared database of hashes’ and the creation of the Global Internet Forum to Counter Terrorism. The EU Internet Referral Unit, part of the EU law enforcement agency Europol, has been instrumental in strengthening cooperation with internet companies and contributing to the overall objectives of the EU Internet Forum. At the latest Ministerial meeting of the EU Internet Forum on 7 October 2019, EU Member States and senior representatives of internet companies committed to collaborating under the so-called EU Crisis Protocol. The EU Crisis Protocol identifies thresholds for enhanced cooperation and establishes new ways to enhance crisis response. This is part of the efforts at international level to implement the ‘Christchurch Call for Action’, seeking to ensure coordinated and rapid reaction to contain the spread of viral terrorist or violent extremist content online. Beyond those measures against online radicalisation, the Commission continues to support efforts at national and local level to prevent and counter radicalisation on the ground. Building on the wealth of experience and expertise gathered within the Radicalisation Awareness Network, the EU offers targeted support to local actors including cities, and provides opportunities for exchange between practitioners, researchers and policy makers. For example, the network has issued specific guidance and organised workshops to support competent authorities in dealing with children who came from conflict zones. To ensure the continuity of activities carried out within the Radicalisation Awareness Network, the Commission has launched the procedure for a new framework contract for an estimated value of EUR 61 million over a period of four years, starting in 2020. In order to counter the threat posed by terrorist content online, the Commission calls on the European Parliament and the Council: ·to conclude the negotiations on the legislative proposal to prevent the dissemination of terrorist content online before the end of the year. 2. Stronger and smarter information systems for security, border and migration management The EU has stepped up information exchange, making it easier to tackle identity fraud, strengthening border checks, modernising Europe-wide law enforcement databases, closing information gaps and reinforcing the EU law enforcement agency Europol. Central to this is the interoperability of EU information systems, which means making best use of existing information and closing blind spots. Responding to the needs of those working on the frontline, interoperability will lead to faster, more systematic access to information for law enforcement officers, border guards and migration officials, thus contributing to improving internal security and border management. However, interoperability and all the innovation it entails will only make a difference for security, border and migration management on the ground if each Member State fully implements the related legislation. This is why the implementation of interoperability is a top priority in the Security Union, both at political and technical levels. The Commission and the EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) support Member States with expertise and the exchange of best practices, using a network of national coordinators and developing a scorecard to enable effective monitoring and coordination arrangements. Close cooperation between EU agencies, all Member States and Schengen associated countries will be paramount in order to attain the ambitious objective of achieving full interoperability of EU information systems for security, border and migration management by 2020.

Meanwhile, the European Parliament and the Council are still to complete the legislative work in this respect. Swift agreement on all pending legislative proposals is essential to secure complete and timely roll-out of interoperability. First, as part of the technical implementation of the European Travel Information and Authorisation System, there is a need for technical amendments to the related Regulations to fully set up the system. The Commission invites the European Parliament to speed up its work on these technical amendments in order to start interinstitutional negotiations as soon as possible. Second, interinstitutional negotiations are still on-going on the May 2018 proposal to strengthen and upgrade the existing Visa Information System. Building on the first trilogue meeting that took place on 22 October 2019, the Commission calls on both co-legislators to swiftly conclude the negotiations. Third, agreement is still pending on the May 2016 Commission proposal to extend the scope of Eurodac by storing not only the fingerprints and relevant data of asylum applicants and of persons apprehended in connection to an irregular crossing of the external border, but also those of illegally-staying third-country nationals. The proposed changes would also extend the storage period of fingerprints and relevant data of those who enter the EU irregularly. The Commission calls on the co-legislators to proceed to the adoption of the proposal. In order to strengthen the EU information systems for security, border and migration management, the Commission calls on the European Parliament and the Council: ·to advance the work in view of reaching a swift agreement on the proposed technical amendments that are necessary to establish the European Travel Information and Authorisation System. ·to swiftly conduct and conclude negotiations on the proposal to strengthen the existing Visa Information System. ·to adopt the legislative proposal on Eurodac (Joint Declaration priority). 3. Closing down the space in which terrorists operate The EU has taken firm action to close down the space in which terrorists operate, with new rules making it harder for terrorists and other criminals to access explosives, firearms and financing, and to restrict their movement. To strengthen the judicial response to terrorism, the EU Agency for Criminal Justice Cooperation (Eurojust) set up on 1 September 2019 a European Judicial Counter Terrorism Register. The register will gather judicial information to establish links in proceedings against suspects of terrorist offences, thus reinforcing coordination among prosecutors in counter-terrorism investigations with potential cross-border implications. Further efforts are needed, however, to support and facilitate investigations in cross-border cases, notably when it comes to law enforcement access to electronic evidence. As regards the April 2018 legislative proposals to improve cross-border access to electronic evidence in criminal investigations , the European Parliament has yet to adopt its negotiating position before the co-legislators can enter into negotiations. The Commission urges the European Parliament to advance on this legislative proposal so that the co-legislators can work towards swift adoption. On the basis of its proposal for EU-internal rules, the Commission is also engaging in international negotiations to improve cross-border access to electronic evidence. On 25 September 2019, the Commission and United States authorities held the first formal negotiation round on an EU-US Agreement on cross-border access to electronic evidence. A further round is scheduled for 6 November 2019. In the context of the ongoing negotiations of a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime, the Commission participated on behalf of the Union in three negotiating sessions in July, September and October 2019. While good progress has been made in these negotiations, a number of major topics of significant interest to the Union are still to be addressed, such as data protection safeguards. The negotiation of a Second Additional Protocol will continue in November 2019 and throughout 2020. It is important to proceed fast with both negotiations in order to advance international cooperation on sharing electronic evidence, while ensuring compatibility with EU law and Member States’ obligations under it, taking also account of future developments in EU law. Reflecting on-going concerns about money laundering, the European Parliament adopted on 19 September 2019 a Resolution on the state of implementation of the Union’s anti-money laundering legislation , responding to the package of four reports on anti-money laundering that the Commission adopted on 24 July 2019 . The European Parliament called on Member States to ensure the proper and speedy implementation of anti-money laundering directives. The European Parliament also called on the Commission to assess whether an anti-money laundering regulation would be more appropriate than a Directive and to assess the need for a coordination and support mechanism for financial intelligence units. In order to improve law enforcement access to electronic evidence, the Commission calls on the European Parliament and Council: ·to reach swift agreement on the legislative proposals on electronic evidence (Joint Declaration priority). 4. Enhancing cybersecurity Enhancing cybersecurity remains a key aspect of the work towards a genuine and effective Security Union. Implementing the 2017 EU Cybersecurity Strategy, the Union has strengthened its resilience by making itself harder to attack and quicker to recover, as well as its deterrence by increasing the chances of attackers getting caught and punished, including through a framework for a joint EU diplomatic response to malicious cyber activities. The Union also supports Member States in cyber defence, implementing the EU Cyber Defence Policy Framework. With the entry into force of the Cybersecurity Act in June 2019, the EU cybersecurity certification framework is taking shape. Certification plays a critical role in increasing trust and security in products and services that are crucial for the Digital Single Market. The certification framework will provide EU-wide certification schemes as a comprehensive set of rules, technical requirements, standards and procedures. It involves two expert groups, namely the European Cybersecurity Certification Group representing Member State authorities and the Stakeholder Cybersecurity Certification Group representing industry. The latter brings together both the demand and supply side of information and communication technology products and services, including small and medium-sized enterprises, digital service providers, European and international standardisation bodies, national accreditation bodies, data protection supervisory authorities and conformity assessment bodies. Meanwhile, the European Parliament and the Council still have to reach agreement on the legislative initiative for a European Cybersecurity Industrial, Technology and Research Competence Centre and Network of National Coordination Centres. The proposal aims to strengthen the Union's cybersecurity capacity by stimulating the European technological and industrial cybersecurity ecosystem as well as coordinating and pooling related resources. The Commission calls on both co-legislators to resume and swiftly conclude interinstitutional negotiations on this priority initiative to enhance cybersecurity. The work to enhance cybersecurity includes support for both the national and regional levels. Beyond cyber threats targeting systems and data, the EU continues to address the complex and multifaceted challenges posed by hybrid threats. In the Council, a horizontal working party on countering hybrid threats has been established to improve the resilience of the EU and its Member States against hybrid threats and to support action to strengthen the crisis resilience of societies. The Commission and the European External Action Service support these efforts under the 2016 Joint Framework on Countering Hybrid Threats and the 2018 Joint Communication on increasing resilience and bolstering capabilities to address hybrid threats. Moreover, the Joint Research Centre is elaborating a ‘conceptual model’ framework to characterise hybrid threats, with the aim to help Member States and their competent authorities to identify the type of hybrid attack they might face. The model looks at the way in which an actor (state or non-state) employs a series of tools (from disinformation to espionage or physical operations) in various domains (economic, military, social, political) to affect a target in order to achieve a series of objectives. In order to enhance cybersecurity, the Commission calls on the European Parliament and the Council: ·to reach swift agreement on the legislative proposal for a European Cybersecurity Industrial, Technology and Research Competence Centre and Network of National Coordination Centres. III. ENHANCING THE SECURITY OF DIGITAL INFRASTRUCTURES Fifth Generation (5G) networks will be the future backbone of increasingly digitised economies and societies. Billions of connected objects and systems are concerned, including in critical sectors such as energy, transport, banking, and health, as well as industrial control systems carrying sensitive information and supporting safety systems. Ensuring the cybersecurity and resilience of 5G networks is therefore essential.

As part of a coordinated approach, Member States published on 9 October 2019 a report on the EU coordinated risk assessment on cybersecurity in 5G networks with the support of the Commission and the European Agency for Cybersecurity. This major step is part of the implementation of the March 2019 Commission Recommendation to ensure a high level of cybersecurity of 5G networks across the EU. The report is based on the results of the national cybersecurity risk assessments by all Member States. It identifies the main threats and threat actors, the most sensitive assets, the main vulnerabilities (including technical ones and other types of vulnerabilities) and a number of strategic risks. This assessment provides the basis to identify mitigation measures that can be applied at national and European level. The report identifies a number of important cybersecurity challenges which are likely to appear or become more prominent in 5G networks. These security challenges are mainly linked to key innovations in 5G technology, in particular the importance of software and the wide range of services and applications enabled by 5G, as well as the role of suppliers in building and operating 5G networks and the degree of dependency on individual suppliers. This means that suppliers’ products, services and operations increasingly become part of the ‘attack surface’ of 5G networks. Moreover, the risk profile of individual suppliers will become particularly important, including the likelihood of the supplier being subject to interference from a non-EU country. In line with the process set out in the March 2019 Commission Recommendation, Member States should agree by 31 December 2019 on a toolbox of mitigating measures to address the identified cybersecurity risks at national and Union level. The Commission and the European External Action Service will also continue to exchange with like-minded partners about cybersecurity and resilience of 5G networks. In that respect, the Commission is in contact with NATO on the EU coordinated risk assessment of the cybersecurity of 5G networks.



IV. COUNTERING DISINFORMATION AND PROTECTING ELECTIONS AGAINST OTHER CYBER-ENABLED THREATS The EU has established a framework for coordinated action against disinformation, with full respect for European values and fundamental rights. Under the Action Plan against Disinformation, work continues to close down the space for disinformation, including with a view to protect the integrity of elections. Central to this is the work with industry through the self-regulatory Code of Practice on Disinformation for online platforms and the advertising sector that became applicable in October 2018. The Commission has assessed the effectiveness of the Code following its first year of operations, based on annual self-assessment reports submitted by the online platforms and the other Code signatories and published on 29 October 2019 together with a Commission Statement. Broadly, the reports demonstrate serious efforts by the signatories to implement their commitments. Actions taken by the platforms signatories vary in terms of speed and scope across the Code’s five pillars of commitments. In general, progress is more advanced with respect to commitments relating to the 2019 European election, namely on disrupting advertising and monetisation incentives for disinformation (pillar 1), ensuring the transparency of political and issue-based advertising (pillar 2), and ensuring the integrity of services against inauthentic accounts and behaviours (pillar 3). By contrast, progress is less advanced or lacking with respect to commitments to empower consumers (pillar 4) and commitments to empower the research community, including via the provision by platforms of relevant and privacy-compliant access to datasets for research purposes (pillar 5). There are also differences in the scope of actions undertaken by each platform to ensure the implementation of their commitments as well as differences across Member States as regards the deployment of the individual policies. The Commission continues to work with Code signatories and other stakeholders to step up the action taken against disinformation. Under the Action Plan against Disinformation, the Commission and the High Representative, in cooperation with the Member States, set up a Rapid Alert System for addressing disinformation campaigns. The Rapid Alert System enabled EU Institutions and Member States to share information and analyses ahead of the 2019 elections to the European Parliament, and to coordinate responses. This work has intensified further after the elections, with working-level exchanges ongoing on a daily basis and three meetings of the Rapid Alert Systems Points of Contact organised by different Member States. Another practical step to identify disinformation has come with the work of the Strategic Communications Team (‘StratComms’), and in particular its East Stratcom Taskforce, which has been running the ‘EUvsDisinfo’ project to monitor, analyse and respond to pro-Kremlin disinformation. Since the beginning of 2019, the first dedicated budget of EUR 3 million has made it possible to step up and expand this work to include the monitoring and analysis of pro-Kremlin disinformation in web, broadcast and social media in 19 languages ranging from English to Serbian and Arabic. The amount of exposed disinformation activities more than doubled due to improved monitoring capacity, with around 2000 disinformation cases so far in 2019 compared to 765 cases during the same period in 2018. The East Stratcom Taskforce played a vital role in monitoring and exposing pro-Kremlin disinformation targeting the 2019 elections to the European Parliament. The research was paired with a campaign to raise awareness about attempted interference in electoral processes around the world. Its outreach, carried out in close cooperation with the European Parliament and the Commission, resulted in more than 20 media interviews, while the campaign engaged more than 300 journalists. The Commission has also taken action to reduce the spread of disinformation and myths about EU institutions and policies. It has established a network of communication experts with an online portal providing interactive information material on EU policies and the challenge of disinformation and its impact on society. It has also launched a series of social media campaigns focusing on tackling disinformation, in collaboration with the European Parliament and the European External Action Service. V. IMPLEMENTATION OF OTHER PRIORITY FILES ON SECURITY 1. Implementation of legislative measures in the Security Union Agreed measures in the Security Union will only bring full benefits to security if all Member States ensure their swift and complete implementation. To this end, the Commission is actively supporting Member States in the implementation of EU legislation, including through funding and by facilitating the exchange of best practices. The Commission makes full use of its powers under the Treaties for the enforcement of EU law, including infringement action as appropriate. The deadline for the transposition of the EU Passenger Name Record Directive expired on 25 May 2018. To date, 25 Member States have notified full transposition, which represents significant progress since July 2018 when the Commission launched infringement procedures against 14 Member States. Two Member States have yet to notify full transposition, despite on-going infringement procedures launched on 19 July 2018. In parallel, the Commission continues to support all Member States in their efforts to complete the development of their passenger name record systems, including by facilitating the exchange of information and best practices. The deadline for the transposition of the Directive on combating terrorism expired on 8 September 2018. To date, 22 Member States have notified full transposition, which represents significant progress since November 2018 when the Commission launched infringement procedures against 16 Member States. Three Member States have yet to notify full transposition, despite the on-going infringement procedures. On 25 July 2019, the Commission sent reasoned opinions to two Member States for failing to notify full transposition of the Directive. In response, both Member States announced that legislative work will be completed before the end of this year. The deadline for the transposition of the Directive on the control of the acquisition and possession of weapons expired on 14 September 2018. To date, 13 Member States have notified full transposition. 15 Member States have yet to notify full transposition, despite on-going infringement procedures launched on 22 November 2018. On 25 July 2019, the Commission sent reasoned opinions to 20 Member States for failing to notify full transposition of the Directive. In response, five Member States notified full transposition of the Directive. The deadline for the transposition of the Data Protection Law Enforcement Directive expired on 6 May 2018. To date, 25 Member States have notified full transposition, which represents significant progress since July 2018 when the Commission launched infringement procedures against 19 Member States. Three Member States have yet to notify full transposition, despite the on-going infringement procedures. On 25 July 2019, the Commission decided to refer two Member States to the Court of Justice of the European Union for non-transposition of the Directive and sent a letter of formal notice to one Member State for failing to fully transpose the Directive. The Commission is assessing the transposition of the 4th Anti-Money Laundering Directive, while also working to verify that the rules are implemented by Member States. They had to transpose the Directive into national law by 26 June 2018. The Commission maintains infringement procedures against 21 Member States as it assessed that the communication received from the Member States does not represent a complete transposition of this Directive. The Commission has assessed the conformity of the transposition of cybercrime-related directives. It has launched in July and October 2019 infringement procedures against 23 Member States as it assessed that the national implementing legislation notified by those Member States did not represent a correct transposition of the Directive on combatting child sexual abuse . The Commission has likewise initiated in July and October 2019 infringement procedures against four Member States as it assessed that the national implementing legislation notified by those Member States did not represent a correct transposition of the Directive on attacks against information systems .