How Europol Works: A 3-Part Guide

Today we want to share with you some really interesting and unique information that will at least broaden your horizons in the field of security, and at most you will learn how Europol works?

This article has a video format with the author's comments and a first-person story about his visit to the main building of the Europol administration. Link to video

Part 1 Behind the scenes of Europol: a tour into the heart of European cybersecurity

Our speaker managed to talk to an employee of such an organization, and now we are ready to share knowledge and experience with you, dear readers of the CyberYozh channel. Surely, many of you have heard about the organization that proudly bears the name Interpol – an international police organization, like Interpol there is an organization called Europol, it is engaged in the investigation of crimes committed on the territory of Europe.

Moreover, the offenders do not even have to be in Europe to commit a crime there. The fact is that it may be related to personal data, to a person located in the territory of the European Union, to a local bank, or to stores, companies, payment gateways, etc. So, Europol is engaged in investigating crimes committed in Europe.

Many of you may not know, but the headquarters of this organization is located in The Hague, where we were lucky enough to be. In fact, in any country in the world, intelligence agencies recruit students to work for them, so they often hold open days and excursion hours. And our team was able to get there together with students from Leiden University. An excursion was organized just for them.

Now we want to take a break and talk about cinema, a little later you will understand why. Surely many of you have watched various films about hackers. One of these films is the movie “Who Am I?” By the way, from a purely cinematic point of view, “Who Am I?” is a pretty cool movie. Of course, if you are in the know, many details may cause a grin, but it is the same as judging the work of doctors by the series “House M.D.”

In cinematography, there are often certain assumptions that are created to make the picture pleasant for the user. That is why various adventures, unusual situations, and so on always happen there. And in the film “Who Am I?” Europol was shown, where the main character carried out a small sabotage in the metropolis, and, in fact, that is where we ended up.

Europol consists of several buildings. The grey building is not particularly remarkable, except for the Europol sign. Ordinary people work there, during the tour they showed us what and how it works there, to be honest, it was not particularly interesting. We talked to various people there, with representatives of different positions. And in fact, at the very end we got to the department that investigates crimes in the information environment – the information security department, if you can call it that.

In this department, we had an interview with a person holding the post of deputy head of the department. The employee's appearance was absolutely unremarkable, except for his height. This person used to be a part of the so-called Europol tactical group. Surely, you will be curious to know what a tactical group is? It is something like an operational group, only it does not operate in the territory of a certain city or, for example, a district. It operates on the territory of the entire European Union. That is, conventionally speaking, as he told us, he carried out arrests and special operations in various parts of Europe. And he shared a lot of interesting details, answered our questions, which the representative of our team had prepared in advance.

So, what would you like to tell us? Europol can conduct an investigation for years. This is due to the fact that Europol actually works according to protocols, and they do not have the goal of achieving any indicators. That is, as we know, for example, police officers of the former CIS often fulfill the plan. For example, in their reports they write: “we detained so many drug dealers, such and such a number of rapists, if there were no rapists, then we created rapists, planted prohibited substances ourselves, and so on.” Europol does not have this. That is, for them the most important thing is to identify networks. For example, if there is a suspect, then you need to follow him, keep an eye on him, etc.

And in particular, here is what the employee told us interesting: even if you are a completely “white” person, but you communicated with someone who is of operational interest, that is, with someone who is involved in something illegal, then you are automatically, so to speak, on the list. In other words, you are already in the Europol database. And if something happens in the future, any request from the Europol database will allow you to find out that the person was connected, for example, with someone who was imprisoned or with someone who was accused of something or is wanted.

Europeans are a leisurely people, even phlegmatic. However, this is their approach to work. To be honest, it sometimes inspires fear. That is, we understand that, for example, in the CIS, a certain person broke someone's nose on the street, then in an hour or a day the police came to him, that is, there is some certainty. In Europol, however, a completely different principle operates: if someone did something bad, then no one comes for him. Why does no one come? This creates in a person, as we understand, such an illusion of security and gives him additional carelessness. That is, if he sees that no one came for him, then he will continue to commit the same offenses, thus increasing and increasing his evidence base.

Part 2 Detention tactics: jurisdiction, surveillance and Europol secrets

So, we stopped at the point that Europol can conduct investigations for years. And the most important thing for the organization is to identify not just one crime, but networks, that is, to find out who and how is connected to certain individuals, groups and events.

Now we want to tell you how jurisdiction is distributed. In other words, we will analyze when a crime was committed on the territory of Europe and a certain evidence base was collected. Europol can transfer the collected materials to Interpol, and they can subsequently carry out arrests in virtually any country in the world. Of course, we understand that North Korea is an exception.

Europol has the right not to immediately transfer all data to Interpol. Employees can monitor criminals and suspects for a long time, and often do not see any need for haste. For example, if a person, say, a suspect, applied for a visa to France, then, oddly enough, Europol will make every effort to obtain a visa. Surely you will ask, why does this happen?

The answer to this question is quite trivial, it is profitable for Europol, because they need to catch this person. When a certain person, say, interesting for Europol, receives a visa, the organization immediately becomes aware that most likely a visit of this character to the EU country is expected. However, it is worth noting that applying for a visa and coming are different things. There are also situations when citizens of some countries do not need visas to Europe, that is, visiting the European Union is possible in a visa-free regime, for example, for Ukraine. Recently, a huge number of investigations are connected with Ukraine in such areas as hacking, botnet, proxy botnet, etc. A citizen of Ukraine can come to Europe without any problems and, we repeat, without a visa.

But there are loopholes here too, you can track a person planning a visit to Europe from the moment he buys a plane ticket. As soon as such a purchase has been made, information about it and the buyer is immediately transferred to Europol.

Let's imagine that the suspect has checked in at his airport, say, somewhere in Kazakhstan, boarded a plane and is waiting for his flight. Europol is already aware of this and the organization's employees immediately leave for the scene. Surely, you can imagine the following picture: a special forces group is preparing to detain the attacker, tanks are rolling along the runways, and helicopters are flying nearby. But in reality, this does not happen. The person who gave us the interview explained this by the fact that as soon as the suspect passes passport control, not yet an accused, but a suspect, absolutely nothing will happen. The employee said that detentions at the airport should only be made in the most extreme cases.

This is explained by security policy.

Firstly, if a person who, let’s say, came to passport control, is immediately detained by a capture group, then this could be a signal for his possible accomplices who were flying on the same flight.

Secondly, there are onlookers with phones. They, oddly enough, pose the greatest danger. They can start filming the process, after which the information can fly around social networks. For example, someone was detained at the Brussels airport, a person with a camera might want to hype it up and post the video, say, on TikTok. Such leaked videos can be a big problem, since they can again be a signal for the suspect's accomplices and warn of the detention.

Thirdly, after September 11, airports are objects of increased danger, and any abnormal action such as people with weapons can cause panic in people and lead to undesirable consequences. These are the three main reasons why a person will not be detained even at passport control.

Until a person has had a stamp put in their passport at passport control, they are not yet legally in the territory of the European Union. As soon as passport control is passed, the suspect is followed. In fact, surveillance begins from the moment the baggage is received. In order not to scare off the attacker, they are not openly watched or insured by a certain group of people, because no one knows what a person might do in an emergency. What if he takes people hostage or decides to commit suicide. That is why Europol employees use the following technique: a Europol employee stands next to the baggage claim belt with a small suitcase, which is used for hand luggage, and supposedly waits for her baggage. That is, from the outside it looks like the girl arrived on the same flight and is simply waiting for her baggage. Agree, nothing remarkable!

After the suspect has received his luggage. The woman with the suitcase continues to accompany him, of course, at a certain distance. At the moment of exiting the city, where the green and red corridors are located, that is, customs inspection, the offender will be asked to undergo a personal inspection.

This is a fairly classic procedure, and as a rule, it also does not raise any suspicions. The suspect's luggage is taken to the belt, and he is carefully invited into the next room, the door to which is closed, and then the Europol officers work with him. This is how a standard detention takes place, which is carried out within the framework of the Europol protocol. Then the detainee is carefully taken out through a separate exit and put in a car, after which he is brought to the local police station, where they continue to talk to him, and where he is placed in a temporary detention facility, let's call it that. Subsequently, various other procedural actions take place with the suspect. We were interested in exactly how and at what stage a person is detained.

But we managed to ask a few more questions to the Europol employee. The questions were as follows: is it possible that the crime is proven, but the criminal is not detained at customs? And we were told that this option is also really possible. And the difference here is in the purpose for which this person came. If, say, such a person came just to relax, his guilt has already been proven, all connections and accomplices have been identified, then he can be immediately taken into custody. But if this person can meet with someone, conditionally important for the investigation, on the territory of the European Union, then he can be monitored throughout his stay. This process can take up to the moment of return departure. And in this situation, the criminal will be detained after he has checked in, checked in his luggage and passed passport control, that is, a completely opposite story. And it is at this point that he will be detained right at the exit from the European Union.

Then a few more interesting questions were asked: from which countries are the largest number of crimes in the cyber sphere currently occurring? The employee immediately named three countries: Russia, Ukraine and, for some reason, Nigeria. Nigeria, apparently, because of the scam four, one nine, but this is purely our assumption. The scam four, one nine, by the way, is quite common even at the moment. And Europol can severely punish a person for it.

Part 3 Europol does not forget: answers to questions and lessons from the past

In the final part of the material we would like to give answers to other popular questions from our subscribers. We would like to thank our expert for the information provided Dmitry Vektora T13

We answer one of the most popular questions among our audience: what happens if the crime was committed a long time ago, and the fraudster has managed to improve? In this case, the system does not actually change. The investigation can be suspended until new information/data about the offender is received. This does not mean that the charge will be dropped even after a long period of time. In other words, Europol remembers everything and we will return to this a little later.

Our subscribers are also concerned about data encryption. When asked what you do if a criminal's data, device or computer is encrypted, the Europol employee did not give any answer. Here we can only guess why he was unable to comment on our request.

There were still many questions regarding the mobile phone. The Europol representative answered the following: in absolutely any point in the world, the subscriber's location is calculated down to several meters. For example, even if the device is unknown and does not have a SIM card, it will still be calculated. And even if this device belongs to your friend who just came to you for coffee, it will still be possible to calculate it.

To sum it up for everyone who wants to do “bad” things, the situation is as follows: you can commit a crime now and be punished for it many, many years later. On our YouTube channel, we have repeatedly talked about how well scammers lived, but what do you think is happening to them now? You guessed it, almost all of them are now behind bars and deprived of their freedom. The CyberYozh team strongly advises against breaking the law.

Write in the comments what questions you would ask a Europol employee if you were lucky enough to meet him in person. In fact, we asked more questions concerning the technical part. We discussed this and much more at a joint course from the CyberYozh team and Dmitry Vektor T13.

Thank you for your attention! We hope you found it interesting.