Operational support to cybercrime cases

Cybercrime continues to grow and attracts criminals exploiting new opportunities offered by modern technologies.

Following a steep increase during the COVID-19 pandemic that forced society to shop, communicate and work more online, cybercrime has evolved into a significant threat to fundamental rights, democracy, and international peace and stability.

During 2022, Eurojust supported 442 cybercrime cases (44 more than in 2021), ranging from investigations into ransomware to criminal encryption.

Action against criminal website offering ‘spoofing’ services to fraudsters: 142 arrests

Crime: A website allowing fraudsters to impersonate trusted corporations or contacts to access sensitive information from victims causes an estimated worldwide loss in excess of EUR 115 million. Fraudsters who sign up and pay for these so-called ‘spoofing’ services are able to anonymously make calls, send recorded messages and intercept one-time passwords by impersonating entities (such as banks, retail companies and government institutions) for financial gain.

Action: A case is opened at Eurojust in October 2021 at the request of the UK authorities. National authorities from 10 countries support the investigation. In an international coordinated action involving judicial and law enforcement authorities in Europe, Australia, the United States, Ukraine and Canada, 142 website users and administrators are arrested across the world in November 2022. The main website administrator is arrested in the United Kingdom on 6 November.

Result: On 8 November 2022, the website and server are seized and taken offline by US and Ukrainian authorities.

Eurojust's Role: The Agency plays a key role in facilitating the judicial cross-border cooperation among all parties involved. Two coordination meetings are hosted by Eurojust to coordinate the national investigations and prepare for the international action.

Criminal use of encrypted communications

The criminal use of encryption is increasingly used by criminal organisations to evade investigation and prosecution. Judicial authorities and law enforcement therefore increasingly depend on encrypted digital data, which is difficult to access legally, to proceed with such investigations.

During 2022, Eurojust continued to provide Member States with crucial assistance in cases related to encrypted communication platforms. Since Eurojust’s support to the investigations related to the EncroChat communication platform in 2020 and the Sky ECC communication platform in 2021, the Agency has dealt with thousands of ‘spin-off’ cases. Since April 2021, Eurojust’s French Desk has processed around 2 000 requests for MLA and European Investigation Orders (EIOs) in ‘spin-off’ cases related to the decryption of Sky ECC communications.

During the 13th Plenary Meeting of the European Judicial Cybercrime Network (EJCN) in December 2022, experts discussed the lawful access, jurisprudence and admissibility of encrypted digital evidence, with a focus on the EncroChat, Sky ECC and Anom Encrypted Networks.

In September 2022, the EU Innovation Hub for Internal Security held its annual event in Brussels, organised in cooperation with the Community of European Research and Innovation for Security. The discussions focused on encryption and AI, the Hub’s priorities for 2022. Eurojust participated together with other EU agencies, the EU institutions, research and technology organisations, internal security practitioners and academic experts from the EU Member States.

Under the theme ‘Shaping responsible solutions for internal security’, the 2022 annual event focused on the need to develop effective security solutions while also meeting citizens' privacy, transparency and accountability expectations.

Criminals are increasingly leveraging the benefits of modern technology, such as encryption and cryptocurrency platforms, making the work of innovation labs crucial to ensure judicial authorities and law enforcement can stay one step ahead. Eurojust’s Vice-President delivered a keynote speech based on Eurojust’s experience in the EncroChat case, underlining the successful elements needed to fight against the criminal use of encrypted communications.

  Creating synergies between public authorities and private operators, as well as between law enforcement and judicial authorities of different countries, is the only way forward to effectively combat the cross-border criminal exploitation of encrypted communication platforms.

Ransomware

The scale and impact of ransomware attacks have increased significantly over the past years, affecting the core interests of individuals, businesses and governments. More and more complex forms of ransomware are emerging.

The 2022 edition of Eurojust’s Cybercrime Judicial Monitor featured a special focus on ransomware investigations. The report concludes that the success of criminal investigations and prosecutions depends more than ever on close cross-border cooperation between public authorities, private companies and victims. Public-private cooperation is particularly valuable in such cases, as companies can preserve and provide the data and evidence investigators need to investigate crimes and identify criminals.

Ransomware is a global problem, requiring judicial communities across the world to join forces. In a dedicated workshop organised by Eurojust and the U.S. Department of Justice in June 2022, judicial experts and practitioners shared best practices and discussed how to enhance collaboration to confront ransomware attacks.

The event brought together more than 100 prosecutors, law enforcement representatives and experts from the private sector and non-governmental organisations, representing 27 countries. Participants shared their experiences, best practices, and lessons learned in directing an investigation to a successful outcome, including by collaborating with the tech and private sectors. Law enforcement officers also discussed adversaries’ tactics and the latest investigative techniques. Other topics on the agenda included transnational cooperation during ransomware investigations, victim remediation, and prosecution of criminal organisations.

In November 2022, a second international workshop on conducting criminal investigations of ransomware attacks was organised by Eurojust and the Council of Europe’s Cybercrime Programme Office. The workshop brought together experts from across the world to share information on trends and techniques of ransomware attacks, the latest tools that are available to investigate and prosecute such offences, and how to engage in international cooperation.

Online fraud

Online fraud continues to affect numerous victims in Europe and across the globe. This type of cyber-enabled crime, which often affects individuals and has a low financial impact, is widespread and difficult to punish.

During the 13th EJCN Plenary, cybercrime judicial experts and practitioners shared best practices and recommendations on how to investigate this type of fraud and protect victims. Participants also discussed online investment platform scams and how to cooperate effectively with non-EU countries and virtual asset service providers.

Cryptocurrencies

Cryptocurrencies are posing new challenges to law enforcement and judicial authorities. The growing use of cryptocurrencies and other virtual assets by legitimate businesses, as well as by criminal networks, makes it necessary for judicial authorities to become familiar with their nature and connected challenges.

During the 12th EJCN Plenary in June 2022, cybercrime judicial experts and practitioners analysed the current EU framework on virtual currencies and how it can address cyber-enabled crime. Various legal and practical aspects of the seizure of virtual currencies and blockchain-based assets were also discussed.

In October 2022, the EJCN in cooperation with the private sector, delivered several webinars for practitioners, featuring key players in the cybercrime field, on topics including blockchain technology. These webinars were hosted and supported by Eurojust.

Based on the experience of taking down the world's largest marketplace on the dark web (Hydra Marketplace), participants explored the advantages of cooperating with the private sector when dealing with the seizure of assets and the compensation of cybercrime victims.

Developments from the SIRIUS project on cross-border access to electronic evidence

Over half of all criminal investigations today involve a cross-border request for electronic evidence. Due to the ongoing development of new technologies, more criminal investigations than ever are dependent on prompt, secure and legal means of sharing electronic evidence across borders.

The Scientific Information Retrieval Integrated Utilisation System (SIRIUS) project is a central reference point in the European Union for knowledge sharing on cross-border access to electronic evidence. It offers a variety of services to law enforcement and judicial authorities, such as guidelines, training sessions and tools, to help with accessing data held by OSPs. SIRIUS serves a community of competent authorities from over 40 countries, representing all EU Member States, the European Public Prosecutor’s Office and a growing number of third countries. The project is co-implemented by Eurojust and Europol, in close partnership with EJN, and supported financially by the European Commission’s Service for Foreign Policy Instruments.

The SIRIUS annual conference took place in November 2022, and brought together 800 participants of law enforcement and judicial authorities from over 20 countries, as well as OSPs, to discuss the way forward on cross-border access to electronic evidence. Participants analysed the process of obtaining electronic evidence in various jurisdictions and crime areas, and delved into the rapidly developing field of Open Source Intelligence.

Highlights from the SIRIUS EU Digital Evidence Situation Report 2022 were also presented at the conference. The joint report of Eurojust, Europol, and the European Judicial Network, presents the experiences of EU Member States’ competent authorities and OSPs with cross-border access to digital evidence in criminal investigations.

The report finds that there was a 36% increase in the volume of requests for data to OSPs in 2021, while the number of Emergency Disclosure Requests increased by 29%. The success cases presented in the report illustrate how digital evidence is crucial in all crime areas. The report confirms that the SIRIUS platform remains the number one source of information for law enforcement and judicial practitioners seeking know-how on data acquisition methods in cross-border circumstances.

US-EU expert group on obtaining (e-)evidence

In November 2022, Eurojust organised a kick-off meeting of the US-EU expert group on obtaining evidence via MLA from the United States. The aim of the expert group is to facilitate the swifter execution of MLA requests for gathering evidence in the United States. The members of the expert group receive thorough training on the US legal framework for gathering evidence. The expert group currently consists of experts from 29 countries, including the United States, EU Member States, Albania, Montenegro, Norway, Serbia, Switzerland, the United Kingdom and Ukraine. These experts attended the kick-off meeting together with representatives from National Desks and Liaison Prosecutors stationed at Eurojust, representatives from the European Judicial Network, the European Judicial Cybercrime Network, the SIRIUS Project, the European Public Prosecutor’s Office and the European Commission.

Enhanced support to the European Judicial Cybercrime Network

The EJCN, supported by Eurojust, consists of a network of judicial authorities specialised in countering the challenges of cybercrime, cyber-enabled crime and investigations in cyberspace. In 2022, EJCN participants discussed current criminal trends and analysed cases to improve future cybercrime investigations. Based on these experiences, the Network organised several webinars during 2022 with key players in the cybercrime field.

The Network also contributed expert input to Eurojust’s Cybercrime Judicial Monitor, covering legislative developments in the areas of cybercrime, cyber-enabled crime and electronic evidence.

At the end of 2022, the Council supported the creation of a secretariat to provide enhanced support to the European Judicial Cybercrime Network. The secretariat’s modalities, resources and implementation will be elaborated during the course of 2023.

Cybercrime policy developments

While cybercrime is proliferating and the complexity of obtaining electronic evidence, often stored in foreign, multiple, or unknown jurisdictions, is increasing, the powers of law enforcement are limited by territorial boundaries. As a result, very few cybercrime cases reported to criminal justice authorities lead to prosecutions or court decisions.

To respond to this challenge, the 2nd Additional Protocol to the Budapest Convention on Cybercrime was opened for signature at the Council of Europe in Strasbourg in May 2022. The Protocol provides tools for enhanced cooperation and disclosure of electronic evidence – such as direct cooperation with service providers and registrars and immediate cooperation in emergencies or JITs – that are subject to various rules and data protection safeguards.

In November 2022, a political agreement was reached on the electronic evidence legislative package. The Regulation and Directive[1] will allow European judicial and law enforcement authorities to quickly and more efficiently secure and obtain electronic evidence. The role of the SIRIUS project and the European Judicial Network as knowledge repositories of cross-border access to electronic evidence is acknowledged in the Regulation.

Eurojust closely followed these policy developments in 2022, as both the 2nd Additional Protocol and electronic evidence legislative proposals will positively impact the Agency’s ability to get justice done in the cybercrime area in the future.

[1] Regulation on European Production and Preservation Orders for electronic evidence in criminal matters; Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings.