EUROPEAN COMMISSION Brussels, 24.7.2020 COM(2020) 605 final COMMUNICATION FROM THE COMMISSION on the EU Security Union Strategy



I.Introduction The Commission’s Political Guidelines made clear that we can leave no stone unturned when it comes to protecting our citizens. Security is not only the basis for personal safety, it also protects fundamental rights and provides the foundation for confidence and dynamism in our economy, our society and our democracy. Europeans today face a security landscape in flux, impacted by evolving threats as well as other factors including climate change, demographic trends and political instability beyond our borders. Globalisation, free movement and the digital transformation continue to bring prosperity, make our lives easier, and spur innovation and growth. But alongside these benefits come inherent risks and costs. They can be manipulated by terrorism, organised crime, the drugs trade and human trafficking, all direct threats to citizens and our European way of life. Cyber-attacks and cybercrime continue to rise. Security threats are also becoming more complex: they feed on the ability to work cross-border and on inter-connectivity; they exploit the blurring of the boundaries between the physical and digital world; they exploit vulnerable groups, social and economic divergences. Attacks can come at a moment’s notice and may leave little or no trace; both state and non-state actors can deploy a variety of hybrid threats; and what happens outside the EU can have a critical impact on security inside the EU. The COVID-19 crisis has also reshaped our notion of safety and security threats and corresponding policies. It has highlighted the need to guarantee security both in the physical and digital environments. It has underlined the importance of open strategic autonomy for our supply chains in terms of critical products, services, infrastructures and technologies. It has reinforced the need to engage every sector and every individual in a common effort to ensure that the EU is more prepared and resilient in the first place and has better tools to respond when needed. Citizens cannot be protected only through Member States acting on their own. Building on our strengths to work together has never been more essential, and the EU has never had more potential to make a difference. It can lead by example, by enhancing its overall crisis management system and working within and outside its borders to contribute to global stability. While primary responsibility for security lies with Member States, recent years have brought an increasing understanding that the security of one Member State is the security of all. The EU can bring a multidisciplinary and integrated response, helping security actors in Member States with the tools and the information they need. The EU can also ensure that security policy remains grounded in our common European values – respecting and upholding the rule of law, equality and fundamental rights and guaranteeing transparency, accountability and democratic control – to give policies the right foundation of trust. It can build an effective and genuine Security Union in which the rights and freedoms of individuals are well protected. Security and respect for fundamental rights are not conflicting aims, but consistent and complementary. Our values and fundamental rights must be the basis of security policies, ensuring the principles of necessity, proportionality and legality, and with the right safeguards for accountability and judicial redress, while enabling an effective response to protect individuals, particularly the most vulnerable. Significant legal, practical and support tools are already in place, but need to be both strengthened and better implemented. Much progress has been made to improve the exchange of information and intelligence cooperation with Member States and to close down the space in which terrorists and criminals operate. But fragmentation remains. The work must also go beyond the EU’s boundaries. Protecting the Union and its citizens is no longer only about ensuring security within the EU borders, but also about addressing the external dimension of security. The EU’s approach to external security within the framework of the Common Foreign and Security Policy (CFSP) and the Common Security and Defence Policy (CSDP) will remain an essential component of EU efforts to enhance security within the EU. Cooperation with third countries and at global level to address common challenges is central to an effective and comprehensive response, with stability and security in the EU’s neighbourhood critical to the EU’s own security. Building on the previous work of the European Parliament , Council and the Commission, this new strategy shows that a genuine and effective Security Union needs to combine a strong core of instruments and policies to deliver security in practice with a recognition that security has implications for all parts of society and all public policies. The EU needs to ensure a secure environment for everyone, whatever their racial or ethnic origin, religion, belief, gender, age or sexual orientation. This Strategy covers the period 2020-2025 and focuses on building capabilities and capacities to secure a future-proof security environment. It sets out a whole-of-society approach to security that can effectively respond to a rapidly-changing threat landscape in a coordinated manner. It defines strategic priorities and the corresponding actions to address digital and physical risks in an integrated manner across the whole Security Union ecosystem, concentrating on where the EU can bring further value. Its goal is to offer a security dividend to protect everyone in the EU. II.A rapidly changing European security threat landscape The safety, prosperity and well-being of citizens depend on being secure. The threats to that security depend on the extent to which their lives and livelihoods are vulnerable. The greater the vulnerability, the greater the risk that it can be exploited. Both vulnerabilities and threats are in a state of constant evolution, and the EU needs to adapt. Our daily lives depend on a wide variety of services – such as energy, transport, and finance, as well as health. These rely on both physical and digital infrastructure, adding to the vulnerability and the potential for disruption. During the COVID-19 pandemic, new technologies have kept many businesses and public services running, whether keeping us connected through remote working or maintaining the logistics of supply chains. But this has also opened the door to an extraordinary increase in malicious attacks, attempting to capitalise on the disruption of the pandemic and the shift to digital home working for criminal purposes. Shortages of goods have created new openings for organised crime. The consequences could have been fatal, disrupting essential health services at a time of the most intense pressure. The ever-increasing ways in which digital technologies benefit our lives has also made the cybersecurity of technologies an issue of strategic importance. Homes, banks, financial services and enterprises (notably small and medium enterprises) are heavily affected by cyber-attacks. The potential damage is multiplied still further by the interdependence of physical and digital systems: any physical impact is bound to affect digital systems, while cyber-attacks on information systems and digital infrastructures can bring essential services to a halt. The rise of the Internet of things and the increased use of artificial intelligence will bring new benefits as well as a new set of risks. Our world relies on digital infrastructures, technologies and online systems, which allow us to create business, consume products and enjoy services. All rely on communicating and interaction. Online dependency has opened the door to a wave of cybercrime. ‘Cybercrime-as-a-service’ and the underground cybercriminal economy give easy access to cybercrime products and services online. Criminals quickly adapt to use new technologies to their own ends. For example, counterfeit and falsified medicines have infiltrated the legitimate supply chain of pharmaceuticals. The exponential growth of child sexual abuse material online has shown the social consequences of changing patterns of crime. A recent survey showed that most people in the EU (55 %) are concerned about their data being accessed by criminals and fraudsters. The global environment also accentuates these threats. Assertive industrial policies by third countries, combined with the continued cyber-enabled theft of intellectual property, are changing the strategic paradigm for protecting and advancing European interests. This is accentuated by the rise of dual-use applications – making a strong civilian technology sector a strong asset for defence and security capability. Industrial espionage has a significant impact on the EU’s economy, jobs and growth: cyber theft of trade secrets is estimated to cost the EU €60 billion . This calls for a thorough reflection of how dependencies and the increased exposure to cyber threats affect the EU’s capacity to protect individuals and businesses alike. The COVID-19 crisis has also underlined how social divisions and uncertainties create a security vulnerability. This increases the potential for more sophisticated and hybrid attacks by state and non-state actors, with vulnerabilities exploited through a mix of cyber-attacks, damage to critical infrastructure , disinformation campaigns, and radicalisation of the political narrative. At the same time, more long-established threats continue to evolve. There was a downward trend in terrorist attacks in the EU in 2019. However, the threat to EU citizens of jihadist attacks from or inspired by Da’esh and al-Qaeda and their affiliates remains high. In parallel, the threat of violent right wing extremism is also growing. Attacks inspired by racism must be a cause for serious concern: the deadly anti-Semitic terror attacks in Halle were a reminder of the need to step up the response in line with the 2018 Council Declaration. One in five people in the EU are very worried about a terrorist attack in the next 12 months. The vast majority of recent terrorist attacks were “low tech” attacks, lone actors targeting individuals in public spaces, while terrorist propaganda online took on a new significance with the live streaming of the Christchurch attacks. The threat posed by radicalised individuals remains high – potentially bolstered by returning foreign terrorist fighters and by extremists released from prison. The crisis has also shown how existing threats can evolve in new circumstances. Organised crime groups have exploited shortages of goods providing an opening to create new illicit markets. The trade in illicit drugs remains the largest criminal market in the EU, estimated at a minimum retail value of €30 billion per year in the EU. Trafficking in human beings persists: estimates show an annual global profit for all forms of exploitation of almost €30 billion. International trade in counterfeit pharmaceuticals reached €38.9 billion. At the same time, low rates of confiscation allow criminals to continue expanding their criminal activities and infiltrating the legal economy. Criminals and terrorists find it easier to access firearms, from the online market and through new technologies such as 3-D printing. Use of Artificial Intelligence, new technologies and robotics will further increase the risk that criminals exploit the benefits of innovation for malicious ends.

These threats cut across categories and strike different parts of society in different ways. They all represent a major threat to individuals and businesses and require a comprehensive and coherent response at EU level. When security vulnerabilities can come even from small inter-connected household items such as an internet connected fridge or coffee machine, we can no longer rely on traditional state actors alone to ensure our security. Economic operators must take greater responsibility for the cybersecurity of products and services they place on the market; while individuals too need to have at least a basic understanding of cybersecurity to be able to protect themselves. III.An EU coordinated response for the whole of society The EU has already shown how it can bring real added value. Since 2015, the Security Union brought new linkages in the way security policies are addressed at EU level. But more needs to be done to engage the whole of society, including governments at all levels, business in all sectors and individuals in all Member States. The increasing awareness of the risks of dependency and the need for a strong European industrial strategy point to an EU with a critical mass of industry, technology production and supply chain resilience. Strength also means full respect of fundamental rights and EU values: they are a prerequisite of legitimate, effective and sustainable security policies. This Security Union strategy sets out concrete work streams to take forward. It is built around the following common objectives: ·Building capabilities and capacities for early detection, prevention and rapid response to crises: Europe needs to be more resilient to prevent, protect and withstand future shocks. We need to build capabilities and capacities for early detection and rapid response to security crises through an integrated and coordinated approach, both globally and through sector-specific initiatives (such as for the financial, energy, judiciary, law enforcement, healthcare, maritime, transport sectors) and building on existing tools and initiatives. The Commission will also come forward with proposals for a wide-ranging crisis management system within the EU, which could also be relevant for security. ·Focusing on results: A performance-driven strategy needs to be based around careful threat and risk assessment to target our efforts to best effect. It needs to define and apply the right rules and the right tools. It needs reliable strategic intelligence as a basis for EU security policies. Where EU legislation is required, it needs to be followed up so that it is implemented in full, to avoid fragmentation and gaps left to be exploited. The effective implementation of this Strategy will also depend on securing appropriate funding in the next programming period 2021-2027, including for related EU agencies. ·Linking all players in the public and private sectors in a common effort: Key players in both the public and private sectors have been reluctant to share security-relevant information, whether for fear of compromising national security or competitiveness. But we are most effective when all are harnessed to support each other. In the first place, this means a more intense cooperation between Member States, involving law enforcement, judicial and other public authorities, and with EU institutions and agencies, to build the understanding and exchange needed for common solutions. Cooperation with the private sector is also key, all the more so given that industry owns an important part of the digital and non-digital infrastructure central to fighting crime and terrorism effectively. Individuals themselves can also contribute, for example through building the skills and awareness to combat cybercrime or disinformation. Finally, this common effort must extend beyond our borders, building closer ties with like-minded partners. IV.Protecting Everyone in the EU: Strategic priorities for the Security Union The EU is uniquely well-placed to respond to these new global threats and challenges. The threat analysis above points to four inter-dependent strategic priorities to be taken forward at the EU level, in full respect of fundamental rights: (i) a future proof security environment, (ii) tackling evolving threats, (iii) protecting Europeans from terrorism and organised crime, (iv) a strong European security ecosystem. 1.A future-proof security environment Critical infrastructure protection and resilience Individuals rely on key infrastructures in their daily lives, to travel, to work, to benefit from essential public services such as hospitals, transport, energy supplies, or to exercise their democratic rights. If these infrastructures are not sufficiently protected and resilient, attacks can cause huge disruption – whether physical or digital – both in individual Member States and potentially across the entire EU. The EU’s existing framework for protection and resilience of critical infrastructures has not kept pace with evolving risks. Increasing interdependencies mean that disruptions in one sector can have an immediate impact on operations in others: an attack on electricity production could knock out telecommunications, hospitals, banks or airports, while an attack on digital infrastructure could lead to disruptions in networks for power or finance. As our economy and society increasingly move ever more online, risks such as these grow all the more acute. The legislative framework needs to address this increased interconnectedness and interdependency, with robust critical infrastructure protection and resilience measures, both cyber and physical. Essential services, including those based on space infrastructures must be adequately protected against current and anticipated threats, but also be resilient. This implies the ability of a system to prepare and plan for, absorb, recover from, and more successfully adapt to adverse events. At the same time, Member States have exercised their margin of discretion by implementing existing legislation in different ways. The resulting fragmentation can undermine the internal market and make cross-border coordination more difficult – most obviously in border regions. Operators providing essential services in different Member States have to comply with different reporting regimes. The Commission is looking into whether new frameworks for both physical and digital infrastructures could bring more consistency and a more coherent approach to ensuring the reliable provision of essential services. This framework needs to be accompanied by sector-specific initiatives to tackle the specific risks faced by critical infrastructures such as in transport, space, energy, finance and health. Given the high dependence of the financial sector on IT services and its high vulnerability to cyber-attacks, a first step will be an initiative on the digital operational resilience for financial sectors. Due to the particular sensitivities and impact of the energy system, a dedicated initiative will support a stronger resilience of critical energy infrastructure against physical, cyber and hybrid threats, ensuring a level playing field for energy operators across borders. Security-relevant effects of foreign direct investments likely to affect critical infrastructures or critical technologies will also be subject to the assessments carried out by EU Member States and the Commission under the new European framework for foreign direct investments screening. The EU can also build new tools to support the resilience of critical infrastructures. The global internet has so far shown a high level of resilience, in particular as regards the ability to support increased traffic volumes. However, we need to be prepared for possible future crises threatening the security, stability and resilience of the internet. Making sure that the internet remains up and running means being robust against cyber incidents and malicious online activities, and limiting dependency on infrastructures and services located outside Europe. This will require a combination of legislation, with the review of existing rules to ensure a high common level of security of network and information systems in the EU; increased investment in research and innovation; and looking at the deployment or hardening of core internet infrastructures and resources, notably the Domain Name System. A key element to protect key EU and national digital assets is to offer critical infrastructures a channel for secure communications. The Commission is working with Member States to put in place a certified secure end-to-end quantum infrastructure, terrestrial and space-based, in combination with the secure governmental satellite communications system laid out in the Space Programme regulation. Cybersecurity The number of cyber-attacks continues to rise . These attacks are more sophisticated than ever, come from a wide range of sources inside and outside the EU, and target areas of maximum vulnerability. State or state-backed actors are frequently involved, targeting key digital infrastructures like major Cloud providers. Cyber risks have emerged as a significant threat to the financial system as well. The International Monetary Fund has estimated the annual loss due to cyber-attacks at 9% of banks’ net income globally, or around $100 billion. The move to connected devices will bring great benefits for users: but with less data stored and processed in data centres, and more processed closer to the user ‘at the edge’ , cybersecurity will no longer be able to focus on protecting central points.

In 2017, the EU put forward an approach to cybersecurity with resilience-building, rapid response and effective deterrence at its core. The EU now needs to make sure that its cybersecurity capabilities keep pace with reality, to deliver both resilience and response. This calls for a real whole-of-society approach, with EU institutions, agencies and bodies, Member States, industry, academia and individuals giving cybersecurity the priority it needs. This horizontal approach again needs to be complemented by sector-specific cybersecurity approaches for areas such as energy, financial services, transport or health. The next phase of the EU’s work should be drawn together in a revised European Cybersecurity Strategy. Exploring new and enhanced forms of cooperation between intelligence services, EU INTCEN, and other organisations involved in security should be part of efforts to enhance cybersecurity, as well as combatting terrorism, extremism, radicalism and hybrid threats. Given the ongoing roll-out of the 5G infrastructure across the EU and the potential dependence of many critical services on 5G networks, the consequences of systemic and widespread disruption would be particularly serious. The process put in place by the Commission’s 2019 Recommendation on the Cybersecurity of 5G networks has now led to specific Member State action on the key measures set out in a 5G toolbox. One of the most important long-term needs is to develop a culture of cybersecurity by design, with security built into products and services from the start. An important contribution to this will be the new cybersecurity certification framework under the Cybersecurity Act. The framework is already under way, with two certification schemes already in preparation, and priorities for further schemes to be defined later this year. Cooperation between the EU Agency for Cybersecurity (ENISA), the data protection authorities and the European Data Protection Board is of key importance in this area. The Commission has already identified the need for a Joint Cyber Unit to provide structured and coordinated operational cooperation. This could include a mutual assistance mechanism in times of crisis at EU level. Building on the implementation of the Blueprint recommendation, the Joint Cyber Unit could build trust between the different actors in the European cybersecurity ecosystem and offer a key service to Member States. The Commission will launch discussions with relevant stakeholders (starting with Member States) and set out a clear process, milestones and timeline by the end of 2020. Also important are common rules on information security and on cybersecurity for all EU institutions, bodies and agencies. The aim should be to create mandatory and high common standards for the secure exchange of information and the security of digital infrastructures and systems across all EU institutions, bodies and agencies. This new framework should underpin a strong and efficient operational cooperation on cybersecurity across the EU institutions, bodies and agencies, centred on the role of the Computer Emergency Response Team (CERT-EU) for the EU institutions, bodies and agencies. Given its global nature, building and maintaining robust international partnerships is fundamental to further prevent, deter and respond to cyber-attacks. The framework for a joint EU diplomatic response to malicious cyber activities (“cyber diplomacy toolbox”) sets out measures under the Common Foreign and Security Policy, including restrictive measures (sanctions), which can be used against activities that harm its political, security and economic interests. The EU should also deepen its work through development and cooperation funds to provide capacity building to support partner states in strengthening their digital ecosystems, adopting national legislative reforms and adhering to international standards. This increases the resilience of the overall community and its ability to counter and respond effectively to cyber threats. This includes specific work to promote the EU standards and relevant legislation to increase the cybersecurity of partner countries in the neighbourhood. Protecting public spaces Recent terrorist attacks have focused on public spaces, including places of worship and transport hubs, exploiting their open and accessible nature. The rise of terrorism triggered by political or ideologically motivated extremism has made this threat even more acute. This calls for both stronger physical protection of such places and adequate detection systems, without undermining citizens’ freedoms. The Commission will enhance public-private cooperation for the protection of public spaces, with funding, the exchange of experience and good practices, specific guidance and recommendations. Awareness raising, performance requirements and testing of detection equipment and enhancing background checks to address insider threats will also be part of the approach. An important aspect to reflect is the fact that minorities and vulnerable individuals can be disproportionately affected including persons targeted because of their religion or gender, and therefore require particular attention. Regional and local public authorities have an important role to improve security of public spaces. The Commission is also helping foster cities’ innovation in security in public spaces. The launch of a new Urban Agenda partnership on “security in public spaces” in November 2018 reflects the strong commitment of Member States, Commission and cities to better address threats to security in the urban space. The market for drones continues to expand, with many valuable and legitimate uses. However, they also have the potential to be misused by criminals and terrorists, with public spaces under particular threat. Targets can include individuals, gatherings of people, critical infrastructure, law enforcement authorities, borders or public spaces. Knowledge about the use of drones in conflict could find its way back to Europe either directly (via returning Foreign Terrorist Fighters) or online. Rules already developed by the European Aviation Safety Agency are an important first step in areas including the registration of drone operators and the mandatory remote identification of drones. With drones becoming ever more widely available, more affordable and more capable, there is a need for additional action. This could include information sharing, guidance and good practice for use by all, including law enforcement, as well as more testing of drone countermeasures. In addition, the privacy and data protection implications of the use of drones in public spaces should be further analysed and addressed. Key actions ·Legislation on the protection and resilience of critical infrastructure ·Revision of the Network Information Systems Directive ·An initiative on the operational resilience of the financial sector ·Protection and cybersecurity of critical energy infrastructure and network code on cybersecurity for cross-border electricity flows ·A European Cybersecurity Strategy ·Next steps towards the creation of a Joint Cyber Unit ·Common rules on information security and cybersecurity for EU institutions, bodies and Agencies ·Stepped up cooperation for the protection of public spaces, including places of worship ·Sharing of best practices on addressing misuse of drone 2.Tackling evolving threats Cybercrime Technology brings new opportunities for society. It also offers new tools for the judiciary and for law enforcement. But at the same time, it opens doors for criminals. Malware, the theft of personal or business data by hacking, and the shutting off of digital activity causing financial or reputational damage, are all on the rise. The resilient environment created by strong cybersecurity is the first defence. Law enforcement authorities need to be able to work in the sphere of digital investigations with clear rules to investigate and prosecute crimes and affording victims the necessary protection. This work should build on the Joint Cybercrime Action Task Force in Europol and the Law Enforcement Emergency response Protocol created to coordinate response to large-scale cyber-attacks. Effective mechanisms enabling public-private partnerships and cooperation are also key. In parallel, the fight against cybercrime should become a strategic communication priority across the EU, to alert Europeans to the risks and to the preventive measures they could take. This should be part of a proactive approach. An essential step is also the full implementation of the current legal framework: the Commission will be ready to use infringement procedures as appropriate, as well as keeping this framework under review to ensure it remains fit for purpose. The Commission will also explore, together with Europol and the EU Agency for Cybersecurity ENISA, the feasibility of an EU cybercrime-related rapid alert system that could ensure the flow of information and swift reactions when cybercrimes surge. Cybercrime is a global challenge where effective international cooperation is necessary. The EU supports the Council of Europe’s Budapest Convention on cybercrime, which is an effective, well-established framework that allows all countries to identify what systems and communication channels they need to put in place to be able to work effectively with each other. Nearly half of EU citizens worry about data misuse and identity theft is a major concern. The fraudulent use of identity for financial gain is one aspect, but there can also be a major personal and psychological impact, with illegal postings made by the identity thief able to stay online for years. The Commission will explore possible practical measures to protect victims against all forms of identity theft, taking account of the upcoming European Digital Identity initiative. Tackling cybercrime means looking ahead. As society uses new technological developments to strengthen the economy and society, criminals can also look to exploit these tools to negative ends. For example, criminals can use artificial intelligence to detect and identify passwords or to simplify the creation of malware, to exploit images and audio that can be then used for identity theft or fraud. Modern law enforcement

Law enforcement and justice practitioners need to adapt to new technology. Technological developments and emerging threats require law enforcement authorities to have access to new tools, acquire new skills and develop alternative investigative techniques. To complement legislative actions aiming at improving cross-border access to electronic evidence for criminal investigations, the EU can help law enforcement authorities to develop the necessary capacity to identify, secure and read the data needed to investigate crimes and to use that data as evidence in court. The Commission will explore measures to enhance law enforcement capacity in digital investigations, defining how to make the best use of research and development to create new tools for law enforcement; and how training can offer the right skill set to law enforcement and the judiciary. This will also include providing stringent scientific evaluations and testing methods through the Commission’s Joint Research Centre. Common approaches can also ensure that artificial intelligence, space capabilities, Big Data and High Performance Computing are integrated into security policy in a way which is effective both in fighting crimes and in ensuring fundamental rights. Artificial intelligence could act as a powerful tool to fight crime, creating enormous investigative capabilities by analysing large amounts of information and identifying patterns and anomalies. It can also provide concrete tools, such as to help identify online terrorist content, discover suspicious transactions in the sales of dangerous products or offer assistance to citizens in emergencies. Realising this potential means bringing together research, innovation and users of artificial intelligence with the right governance and technical infrastructure, actively involving the private sector and academia. It also means ensuring the highest standards of compliance with fundamental rights while ensuring an effective protection of citizens. In particular, decisions impacting individuals must be subject to human review and comply with the relevant applicable EU law. Electronic information and evidence is needed in about 85% of investigations into serious crimes, while 65% of the total requests go to providers based in another jurisdiction. The fact that traditional physical traces have moved online further expands the gap between the law enforcement and criminals’ capabilities. Putting in place clear rules for cross-border access to electronic evidence for criminal investigations is essential. This is why swift adoption by the European Parliament and Council of the e-evidence proposals is key to provide practitioners with an efficient tool. Cross-border access to e-evidence through multilateral and bilateral international negotiations is also key, to establish compatible rules at international level . Access to digital evidence also depends on the availability of information. If the data is erased too quickly, important evidence may disappear, so that the possibility to identify and locate suspects and criminal networks (as well as victims) no longer exists. On the other hand, data retention schemes raise questions of protection of privacy. Depending on the outcome of the cases pending before the European Court of Justice, the Commission will assess the way forward on data retention. Access to Internet domain name registration information (‘WHOIS data’) is important for criminal investigations, cybersecurity and consumer protection. However, access to this information is becoming more difficult, pending the adoption of a new WHOIS policy by the Internet Corporation for Assigned Names and Numbers (ICANN). The Commission will continue to work with the ICANN and the multi-stakeholder community to ensure that legitimate access seekers, including law enforcement, can obtain efficient access to WHOIS data in line with EU and international data protection regulations. This will include assessing possible solutions, including whether legislation may be necessary to clarify rules for accessing such information. Law enforcement and judicial authorities also need to be equipped to obtain the necessary data and evidence once the 5G architecture for mobile telecommunications is fully deployed in the EU, in a way which respects the confidentiality of communications. The Commission will support an enhanced and coordinated approach when building international standards, defining best practices, process, and technical interoperability in key technological areas such as AI, internet of things or blockchain technologies. Today, a substantial part of investigations against all forms of crime and terrorism involve encrypted information. Encryption is essential to the digital world, securing digital systems and transactions and also protecting a series of fundamental rights, including freedom of expression, privacy and data protection. However, if used for criminal purposes, it may also mask the identity of criminals and hide the content of their communications. The Commission will explore and support balanced technical, operational and legal solutions to the challenges and promote an approach which both maintains the effectiveness of encryption in protecting privacy and security of communications, while providing an effective response to crime and terrorism. Countering illegal content online Bringing the security of the online and physical environments in line means continued steps in countering illegal content online. More and more, core threats to citizens such as terrorism, extremism or child sexual abuse rely on the digital environment: this calls for concrete action and a framework to ensure respect for fundamental rights. An essential first step is swiftly concluding the negotiations on the proposed legislation on terrorist content online and ensuring its implementation. Strengthening voluntary cooperation between law enforcement and the private sector in the EU Internet Forum is also key to fight the misuse of the internet by terrorists, violent extremists and criminals. The EU Internet Referral Unit in Europol will continue to play a crucial role in monitoring the activity of terrorist groups online and the action taken by platforms, as well as in further developing the EU Crisis Protocol . In addition, the Commission will continue to engage with international partners including by participating in the Global Internet Forum to Counter Terrorism to tackle these challenges at global level. Work will continue to support the development of alternative and counter narratives through the Civil Society Empowerment Programme. To prevent and counter the spread of illegal hate speech online, the Commission launched in 2016 the Code of Conduct on countering illegal hate speech online, with a voluntary commitment by online platforms to remove hate speech content. The latest evaluation shows that companies assess 90% of flagged content within 24 hours and remove 71% of the content deemed to be illegal hate speech. However, the platforms need to improve further transparency and feedback to users and to ensure consistent evaluation of flagged content. The EU Internet Forum will also facilitate exchanges on existing and developing technology to address the challenges related to child sexual abuse online. Tackling child sexual abuse online is at the heart of a new Strategy to step up the fight against child sexual abuse , which will seek to maximise the use of tools available at EU level to fight against these crimes. Companies must be able to continue their work to detect and remove child sexual abuse material online, and the damage caused by this material calls for a framework setting out clear and permanent obligations to tackle the problem. The Strategy will also announce that the Commission will also start preparing sector-specific legislation to tackle child sexual abuse online more effectively, in full respect of fundamental rights. More generally, the forthcoming Digital Services Act will also clarify and upgrade the liability and safety rules for digital services and remove disincentives holding back actions to address illegal content, goods or services. In addition, the Commission will continue to engage with international partners and with the Global Internet Forum to Counter Terrorism, including through the independent advisory committee, to discuss how to tackle these challenges at global level while preserving EU values and fundamental rights. New topics should also be addressed such as algorithms or online gaming. Hybrid threats The scale and diversity of hybrid threats today is unprecedented. The COVID-19 crisis saw more proof of this, with several state and non-state actors seeking to instrumentalise the pandemic – in particular through manipulation of the information environment and challenging core infrastructures. This risks weakening social cohesion and undermining trust in EU institutions and Member States’ governments. The EU approach to hybrid threats is set out in the 2016 Joint Framework and the 2018 Joint Communication on bolstering hybrid resilience. Action at EU level is underpinned by a sizeable toolbox covering the internal-external nexus, based on a whole-of-society approach and on close cooperation with strategic partners, notably NATO and G7. A report on the implementation of the EU approach on hybrid threats is published together with this Strategy. Based on the mapping presented in parallel to this Strategy, the Commission services and the European External Action Service will create a restricted online platform for Member States’ reference on counter-hybrid tools and measures at EU level. Whereas responsibility for countering hybrid threats lies primarily with Member States – due to the intrinsic links with national security and defence policies – some vulnerabilities are common to all Member States and some threats extend across borders, such as targeting cross-border networks or infrastructure. The Commission and the High Representative will set out an EU approach to hybrid threats that integrates the external and internal dimension in a seamless flow and brings the national and EU-wide considerations together. This must cover the full spectrum of action – from early detection, analysis, awareness, building resilience and prevention through to crisis response and consequence management. In addition to reinforced implementation, with hybrid threats in constant evolution, a particular focus will be to mainstream hybrid considerations into policy making, to keep up to speed with dynamic developments and to ensure that no potentially relevant initiative is overlooked. The effects of new initiatives will also be assessed through hybrid lenses, including initiatives in areas that have so far been outside the remit of the counter hybrid framework such as education, technology and research. This approach would benefit from the work done on the conceptualisation of hybrid threats, which provides a comprehensive view of the various tools that adversaries may use. The aim should be to ensure that the decision-making process is underpinned by regular, comprehensive intelligence-based reporting on the evolution of hybrid threats. This will rely heavily on Member States’ intelligence and on further enhancing intelligence cooperation with Member States’ competent services through EU INTCEN. To develop situational awareness, the Commission services and the European External Action Service will explore options to streamline information flows from different sources, including Member States, as well as EU agencies such as ENISA, Europol and Frontex. The EU Hybrid Fusion Cell will remain the EU focal point for hybrid threat assessments. Building resilience is central to preventing and protecting against hybrid threats. It is therefore crucial to systematically track and objectively measure progress in this area. A first step will be to identify sectoral hybrid resilience baselines for both Member States and EU institutions and bodies. Finally, to step up hybrid crisis response preparedness, the existing protocol should be reviewed, as defined in the 2016 EU Playbook , reflecting a broader review and strengthening of the EU crisis response system currently under consideration. The aim is to maximise the effect of EU action by swiftly bringing together sectoral responses and ensuring seamless cooperation with our partners, NATO in the first place. Key actions ·Ensuring that the cybercrime legislation is implemented and fit for purpose ·A Strategy for a more effective fight against child sexual abuse ·Proposals on the detection and removal of child sexual abuse material ·An EU approach on Countering Hybrid Threats ·Review of the EU operational protocol for countering hybrid threats (EU Playbook) ·Assessment of how to enhance law enforcement capacity in digital investigations

3.Protecting Europeans from terrorism and organised crime Terrorism and radicalisation The terrorist threat in the EU remains high. Despite the decrease in the number of attacks overall, these can still have a devastating effect. Radicalisation can also more broadly polarise and destabilise social cohesion. Member States retain the primary responsibility in the fight against terrorism and radicalisation. However, the ever-increasing cross-border/cross sectorial dimension of the threat calls for further steps in EU cooperation and coordination. Effective implementation of EU counter-terrorism legislation, including restrictive measures, is a priority. It remains an objective to extend the mandate of the European Public Prosecutor’s Office to cross-border terrorist crimes. Fighting terrorism starts with addressing the root causes. The polarisation of society, real or perceived discrimination and other psychological and sociological factors can reinforce people’s vulnerability to radical discourse. In this context, tackling radicalisation goes hand in hand with fostering social cohesion at local, national and European level. Several impactful initiatives and policies have been developed in the last decade, in particular through the Radicalisation Awareness Network and the EU Cities against Radicalisation Initiative. It is time now to consider actions to streamline EU policies, initiatives and funds to tackle radicalisation. Such actions can support the development of capabilities and skills, enhance cooperation, strengthen the evidence base and help evaluate progress, involving all relevant stakeholders, including first line practitioners, policy makers and academia. Soft policies such as education, culture, youth and sports could contribute to the prevention of radicalisation, providing opportunities for at-risk youth and cohesion inside of the EU. Priority areas include work on early detection and risk management, resilience building and disengagement, as well as rehabilitation and reintegration in society. Terrorists have sought to acquire and to “weaponise” chemical, biological, radiological and nuclear (CBRN) materials, as well as to develop the knowledge and capacity to use them. The potential of CBRN attacks features prominently in terrorist propaganda. With the potential damage so high, particular attention is needed. Building on the approach used to regulate access to explosive precursors, the Commission will look into restricting access to certain dangerous chemicals that could be used to carry out attacks. The development of EU civil protection response (rescEU) capacities in the field in CBRN will also be key. Cooperation with third countries is also important to enhance a common culture of CBRN safety and security, making full use of the EU global CBRN Centres of Excellence. This cooperation will include national gap and risk assessments, support to national and regional CBRN action plans, exchanges of good practices and CBRN capacity building activities. The EU has developed the most advanced legislation in the world to restrict access to explosives precursors and detect suspicious transactions aiming to build improvised explosive devices. But the threat from home-made explosives remains high, used in multiple attacks throughout the EU. The first step must be implementation of the rules, as well as ensuring that the online environment does not allow the by-passing of controls. The effective prosecution of those who have committed terrorist crimes, including Foreign Terrorist Fighters currently in Syria and Iraq, is also an important element of counterterrorism policy. While these issues are primarily dealt with by Member States, EU coordination and support can help Member States to address common challenges. The steps under way to fully implement border security legislation and make full use of all relevant EU databases to share information on known suspects will be an important step. As well as identifying high-risk individuals, a reintegration and rehabilitation policy is needed. Cross-professional cooperation, including with prison and probation staff, will reinforce the judicial understanding of the processes of radicalisation to violent extremism and the judicial sector’s approach to sentencing and alternatives to detention. The challenge of foreign terrorist fighters is emblematic of the link between internal and external security. Cooperation on counterterrorism and preventing and countering radicalisation and violent extremism is central to security inside the EU. Further steps to develop counterterrorism partnerships and cooperation with countries in the neighbourhood and beyond is needed, drawing on the expertise of the Network of EU Counter-Terrorism/Security Experts. The Joint Action Plan on Counter-terrorism for the Western Balkans is a good reference for such targeted cooperation. In particular, efforts should be made to support partner countries’ capacity to identify and locate foreign terrorist fighters. The EU will also continue to promote multilateral cooperation, working with the leading global actors in this field, such as the United Nations, NATO, the Council of Europe, Interpol and the OSCE. It will also engage with the Global Counterterrorism Forum and the Global Coalition against Da’esh, as well as relevant civil society actors. The Union’s external policy instruments, including development and cooperation, play also an important role when working with third countries to prevent terrorism and piracy. International cooperation is also essential to cut off all sources of terrorism financing, for example through the Financial Action Task Force. Organised crime Organised crime comes at a huge economic and personal cost. The economic loss due to organised crime and corruption has been estimated to represent between €218 and €282 billion annually. More than 5,000 organised crime groups were under investigation in Europe in 2017 – a 50% rise compared to 2013. Organised crime is increasingly operating cross-border including from the immediate neighbourhood of the EU, calling for intensified operational cooperation and information exchange with partners in the neighbourhood. New challenges are emerging and taking crime online: the COVID-19 pandemic saw a huge rise in online scams on vulnerable groups, as well as health and sanitary products being targeted in thefts and burglaries. The EU needs to step up its work against organised crime, including at international level, with more tools to dismantle organised crime’s business model. Fighting organised crime also requires close cooperation with local and regional administrations as well as civil society, who are key partners in crime prevention as well as in providing assistance and support to victims, with a particular need amongst administrations in border regions. This work will be brought together in an Agenda for tackling organised crime. More than one third of the organised crime groups active in the EU are involved in the production, trafficking or distribution of drugs. Drugs addiction led to over eight thousand overdose deaths in the EU in 2019. The bulk of drug trafficking operates across borders with many of the profits infiltrating the legal economy. A new EU Agenda on Drugs will strengthen the efforts of the EU and Member States in the areas of drug demand and supply reduction, defining joint actions addressing a common problem and reinforcing the dialogue and cooperation between the EU and external partners on drug issues. Following an evaluation of the European Monitoring Centre on Drugs and Drugs Addiction, the Commission will assess whether its mandate needs updating to meet new challenges. Organised crime groups and terrorists are also key players in the trade of illegal firearms. Between 2009 and 2018, 23 mass-shooting incidents occurred in Europe, which killed over 340 people. Firearms are often trafficked into the EU through its immediate neighbourhood. This points to a need to reinforce coordination and cooperation both within the EU and with international partners, particularly Interpol, to harmonise the collection of information and reporting on firearm seizures. It is also essential to improve the traceability of weapons, including on the internet, and ensure information exchange between licensing and law enforcement authorities. The Commission is putting forward a new EU Action Plan against firearms trafficking and will also assess whether the rules on export authorisation and import and transit measures for firearms are still fit for purpose. Criminal organisations treat migrants and people in need of international protection as a commodity. 90% of the irregular migrants arriving in the EU are facilitated by a criminal network. Migrant smuggling is also often intertwined with other forms of organised crime, in particular trafficking in human beings. Apart from the huge human cost of trafficking, Europol estimates that globally the generated annual profit for all forms of exploitation from human trafficking amounts to €29.4 billion. This is a transnational crime feeding on illegal demands from within and outside the EU and impacting all EU Member States. The poor record in identifying, prosecuting and convicting these crimes requires a new approach to step up action. A new comprehensive approach to trafficking in human beings will draw together the threads of action. In addition, the Commission will present a new EU Action Plan against migrant smuggling for 2021-2025. Both strands will focus on combatting criminal networks, boosting cooperation and support the work of law enforcement. Organised crime groups – as well as terrorists – also seek opportunities in other fields, especially those generating high profits at a low detection risk, such as environmental crime. Illicit hunting and trading of wildlife, illegal mining, logging, and illegal waste disposal and shipments, have become the fourth largest criminal business around the world. There has also been criminal exploitation of emission trading schemes and energy certificate systems, as well as the misuse of funding allocated to environmental resilience and sustainable development. As well as promoting action by the EU, Member States and the international community to step up efforts against environmental crime, the Commission is assessing whether the Environmental Crime Directive is still fit for purpose. Trafficking in cultural goods has also become one of the most lucrative criminal activities, a source of funding for terrorists as well as organised crime and it is on the rise. Steps should be explored to improve the online and offline traceability of cultural goods in the internal market and cooperation with third countries where cultural goods are looted as well as providing active support to law enforcement and academic communities. Economic and financial crimes are highly complex, but they affect millions of citizens and thousands of companies in the EU every year. Combatting fraud is crucial and requires EU-level action. Europol, along with Eurojust, the European Public Prosecutor’s Office and the European Anti-Fraud Office support Member States and the EU in protecting the economic and financial markets and safeguarding EU taxpayers’ money. The European Public Prosecutor’s Office will become fully operational late in 2020 and investigate, prosecute and bring to judgment crimes against the EU budget, such as fraud, corruption and money laundering. It will also tackle cross-border VAT fraud costing taxpayers at least €50 billion every year. The Commission will also support the development of expertise and of a legislative framework in emerging risks, such as crypto-assets and new payment systems. In particular, the Commission will look at the response to the emergence of crypto-assets such as bitcoin and the effect these new technologies will have on how financial assets are issued, exchanged, shared and accessed. There should be zero tolerance for illicit money within the European Union. Over thirty years, the EU has developed a solid regulatory framework for preventing and combatting money laundering and terrorist financing, in full respect of the need to protect personal data. Nevertheless, there is growing consensus that the implementation of the current framework needs to be significantly improved. Major divergences in the way it is applied and serious weaknesses in the enforcement of the rules need to be addressed. As detailed in the Action Plan of May 2020 , work is under way to assess options to enhance the EU’s framework for anti-money laundering and countering terrorist financing. Areas to explore include the interconnection of national centralised bank account registries, which could significantly speed up access to the financial information for Financial Intelligence Units and competent authorities.

Profits of organised crime groups are estimated at €110 billion per year in the EU. The current response includes harmonised legislation on confiscation and asset recovery, to improve the freezing and confiscation of criminal assets in the EU and to facilitate mutual trust and effective cross-border cooperation between Member States. However, only about 1% of these profits are confiscated , which allows organised crime groups to invest in the expansion of their criminal activities and to infiltrate the legal economy, and in particular small and medium enterprises, which have difficulties in access to credit, are a key target for money laundering. The Commission will analyse the implementation of the legislation and the possible need for further common rules, including on non-conviction based confiscation. The Asset Recovery Offices, key actors in the asset recovery process, could also be equipped with better tools to identify and trace assets in a speedier way across the EU in order to step up confiscation rates. There is a strong link between organised crime and corruption. It has been roughly estimated that corruption alone costs the EU economy €120 billion per year. The prevention and fight against corruption will continue to be subject to regular monitoring under the rule of law mechanism as well as the European Semester. The European semester has assessed challenges in the fight against corruption such as public procurement, public administration, the business environment or healthcare. The Commission’s new annual rule of law report will cover the fight against corruption and enable a preventive dialogue with national authorities and interested stakeholders at EU and national level. Civil society organisations can also play a key role in stimulating the action of public authorities in preventing and fighting organised crime and corruption, and these groups could usefully be brought together in a common forum. Due to their cross-border nature, another key dimension is cooperation and assistance on organised crime and corruption with neighbouring regions to the EU. Key actions ·Counter-Terrorism Agenda for the EU, including renewed anti-radicalisation actions in the EU ·New cooperation with key third countries and international organisations against terrorism ·Agenda on tackling organised crime, including trafficking in human beings ·EU Agenda on Drugs and Action Plan 2021-2025 ·Assessment of the European Monitoring Centre for Drugs and Drug Addiction ·2020-2025 EU Action Plan on Firearms trafficking ·Review of legislation on freezing and confiscation and on Asset Recovery Offices ·An assessment of the Environmental Crime Directive ·An EU Action Plan against Migrant Smuggling, 2021-2025 4.A strong European security ecosystem A genuine and effective Security Union must be the common endeavour of all parts of society. Governments, law enforcement, the private sector, education and citizens themselves need to be engaged, equipped, and properly connected to build preparedness and resilience for all, particularly the most vulnerable, victims and witnesses. All policies need a security dimension and the EU can make a contribution at all levels. In the home, domestic violence is one of the most serious security risks. In the EU 22% of women have experienced violence by an intimate partner. EU accession to the Istanbul Convention on preventing and combatting violence against women and domestic violence remains a key priority. Should the negotiations remain blocked, the Commission will take other measures to achieve the same objectives as the Convention, including proposing to add violence against women to the list of EU crimes defined in the Treaty. Cooperation and information exchange One of the most critical contributions the EU can make to protecting citizens is through helping those responsible for security to work well together. Cooperation and information sharing are the most powerful tools to combat crime and terrorism and pursue justice. To be efficient, it needs to be targeted and timely. To be trusted, it needs to be used with common safeguards and controls. A number of EU instruments and sector specific strategies have been set up to further develop operational law enforcement cooperation between Member States. One of the main EU instruments supporting law enforcement cooperation between Member States is the Schengen Information System, used to exchange data on wanted and missing persons and objects in real time. The results have been felt in the arrest of criminals, seizures of drugs and the rescuing of potential victims. However, the level of cooperation could still be improved through streamlining and upgrading the available instruments. Most of the EU legal framework underpinning operational law enforcement cooperation was designed 30 years ago. A complex web of bilateral agreements between Member States, many outdated or underused, risks fragmentation. In smaller or landlocked countries, law enforcement officers working across borders have to carry out operational actions following, in some cases, up to seven different sets of rules: the result is that some operations, such as hot pursuits of suspects over internal borders, simply do not happen. Operational cooperation on new technologies such as drones are also not covered by the current EU framework. Operational effectiveness can be supported by specific law enforcement cooperation, which may also help to provide key support to other policy goals – such as providing security input for the new assessment of foreign direct investment. The Commission will look at how a Police Cooperation Code might support this. Member States’ law enforcement authorities have increasingly made use of support and expertise at EU level, while EU INTCEN has played a key role in promoting the exchange of strategic intelligence between Member States Intelligence and Security Services providing intelligence situational awareness in favour of EU institutions. Europol can also play a key role in expanding its cooperation with third countries to counter crime and terrorism in coherence with other EU external polices and tools. However, Europol today faces a number of serious constraints – notably as regards the direct exchange of personal data with private parties – which hinders it from effectively supporting Member States in combating terrorism and crime. Europol’s mandate is now being assessed to see how it should be improved to ensure that the Agency can fully perform its tasks. In this context, relevant authorities at EU level (such as OLAF, Europol, Eurojust and the European Public Prosecutor’s Office) should also cooperate more closely and improve the exchange of information. Another key connection is with the further development of Eurojust to maximise the synergy between law enforcement cooperation and judicial cooperation. The EU would also benefit from more strategic coherence: EMPACT , the EU policy cycle for serious and international organised crime, provides a criminal intelligence-led methodology for authorities to jointly tackle the most important criminal threats affecting the EU. It has resulted in important operational results in the past decade. Based on practitioners’ experience, the existing mechanism should be streamlined and simplified to better address the most pressing and evolving criminal threats for a new Policy Cycle 2022-2025. Timely and relevant information is key for the daily work of pursuing crime. Despite the development of new EU level databases for security and border management, much information is still located in national databases or exchanged outside these tools. The result is a significant additional workload, delays, and an increased risk that key information is missed. Better, quicker and simplified processes, involving all the security community, would bring better results. The right tools are essential if information exchange is to meet its potential in the effective pursuit of crime with the necessary safeguards so that data sharing respects data protection laws and fundamental rights. In light of technological, forensic and data protection developments, and changed operational needs, the EU could consider if there is a need to modernise instruments such as the 2008 Prüm Decisions, establishing automated exchange of DNA, fingerprint and vehicle registration data, to enable the automated exchange of additional data categories that are already available in Member States’ criminal or other databases for the purpose of criminal investigations. In addition, the Commission will look into the possibility to exchange police records to help identify if any police record on a person exists in other Member States, and facilitate access to these records once identified, with all the necessary safeguards. Information on travellers has helped to improve border controls, reduce irregular migration, and identify persons posing security risks. Advanced Passenger Information data are the biographic data for each passenger collected by air carriers during check-in and sent in advance to the border control authorities at destination. The revision of the legal framework could allow for more effective use of the information, while ensuring compliance with data protection legislation and facilitating the flow of passengers. Passenger Name Records (PNR) is the data provided by passengers when booking flights. The implementation of the PNR Directive is key, and the Commission will continue to support and enforce this. Moreover, as a mid-term action, the Commission will launch a review of the current approach on PNR data transfer to third countries. Judicial cooperation is a necessary complement to police efforts to fight cross-border crime. Judicial cooperation has gone through a more profound change in the last 20 years. Bodies such as the European Public Prosecutor’s Office and Eurojust need to have the means to function to their fullest extent or be reinforced. Co-operation between judicial practitioners could also be enhanced, through further steps on the mutual recognition of judicial decisions, judicial training, and information exchange. The goal should be increased mutual trust among judges and prosecutors, central to smooth cross-border proceedings. The use of digital technologies can also improve the efficiency of our justice systems. A new digital exchange system is being set up to transmit European Investigation Orders, mutual legal assistance requests and related communications between Member States, supported by Eurojust. The Commission will work with Member States to accelerate the roll-out of the necessary IT systems at the national level. International cooperation is also key to effective law enforcement and judicial cooperation. Bilateral agreements with key partners play a key role in securing information and evidence from beyond the EU. Interpol, one of the largest inter-governmental criminal police organisations, has an important role. The Commission will look at possible ways of reinforcing cooperation with Interpol, including possible access to Interpol databases and the strengthening of operational and strategic cooperation. Law enforcement authorities in the EU also rely upon key partner countries to detect and investigate criminals and terrorists. Security partnerships between the EU and third countries could be stepped up in order to increase cooperation to counter shared threats such as terrorism, organised crime, cybercrime, child sexual abuse and trafficking in human beings. Such an approach would be based on common security interests and builds on established cooperation and security dialogues. As well as information, exchange of expertise can be of particular value in increasing the preparedness of law enforcement to non-traditional threats. As well as encouraging exchanges of best practice, the Commission will explore a possible EU-level coordination mechanism for police forces in case of force majeure events such as pandemics. The pandemic has also proven that Digital Community Policing, accompanied by legal frameworks to facilitate online policing, will be fundamental in tackling crime and terrorism. Police-community partnerships, off and online, can prevent crime and mitigate the impact of organised crime, radicalisation and terrorist activities. The connection from local to regional to national and EU police solutions is a key success factor for the EU Security Union as a whole. The contribution of strong external borders Modern and efficient management of external borders has the dual benefit of maintaining the integrity of Schengen and providing security for our citizens. Engaging all relevant actors to make the most of security at the border can have a real impact on the prevention of cross-border crime and terrorism. Joint operational activities of the recently strengthened European Border and Coast Guard contribute to the prevention and detection of cross-border crime at the external borders and beyond the EU. Customs activities in detecting safety and security risks in all goods before they arrive in the EU and in controlling goods when they arrive are crucial in the fight against cross-border crime and terrorism. The forthcoming Action Plan on the Customs Union will announce actions to also strengthen risk management and to enhance internal security, including in particular by assessing the feasibility of a link between relevant information systems for security risk analysis. The framework for interoperability between EU information systems in the area of justice and home affairs was adopted in May 2019. This new architecture seeks to improve the efficiency and effectiveness of the new or upgraded information systems. It will lead to faster, more systematic information for law enforcement officers, border guards and migration officials. It will help correct identification and contribute to fighting identity fraud. To make this a reality, implementation of interoperability should be a priority, both at political and technical level. Close cooperation between EU agencies and all Member States will be paramount in order to achieve the goal of full interoperability by 2023. Travel document fraud is considered one of the most frequently committed crimes. It facilitates the clandestine movement of criminals and terrorists, and plays a key role in trafficking in human beings and in the drugs trade. The Commission will explore how to extend existing work on the security standards of EU residence and travel documents, including through digitalisation. As of August 2021, Member States will start issuing identity cards and residence documents according to harmonised security standards, including a chip containing biometric identifiers that can be verified by all EU border authorities. The Commission will monitor the implementation of these new rules, including the gradual replacement of documents currently in circulation.