
The European Cybercrime Centre (EC3) was set up by Europol to strengthen the law enforcement response to cybercrime in the EU and thus to help protect European citizens, businesses and governments from online crime.
Since its establishment in 2013, EC3 has made a significant contribution to the fight against cybercrime and it has been involved in many high-profile operations and hundreds of operational-support deployments.
At the level of operations, EC3 focuses on the following types of cybercrimes:
The support provided extends also to tackling criminality on the Dark Web and alternative platforms.
Key objectives
EC3 offers operational, strategic, analytical and forensic support to Member States’ investigations. For each of the cybercrime types mentioned above, EC3:
- serves as the central hub for criminal information and intelligence;
- supports operations and investigations by Member States by offering operational analysis, coordination and expertise;
- provides highly specialised technical and digital forensic support capabilities to investigations and operations;
- provides support to EU crisis management structures, within the scope of Europol’s mandate, and facilitates the operational, technical and strategic collaboration between law enforcement agencies (LEAs) and other relevant cyber communities and EU institutions, bodies and agencies (e.g. Eurojust, EEAS, ENISA, CERT-EU, Commission, Council, etc.);
- provides 24/7 operational and technical support to LEAs for immediate reaction to urgent cyber incidents and/or cyber crises via stand-by duty and the EU Law Enforcement Emergency Response Protocol (EU LE ERP);
- hosts and facilitates the efforts of the Joint Cybercrime Action Taskforce (J-CAT) in combating cybercrime;
- supports training and capacity-building, in particular for the relevant authorities in Member States;
- provides a variety of strategic analysis products that enable informed decision-making on combating and preventing cybercrime;
- provides a comprehensive outreach function connecting law enforcement authorities tackling cybercrime with the private sector, academia and other non-law enforcement partners;
- contributes to the preparation and delivery of standardised prevention and awareness campaigns and activities in the cybercrime-mandated areas.
Operational highlights
In 2021:
- EC3 and the J-CAT were involved in the takedown of one of most significant botnets of the past decade, EMOTET.
- EC3 and the J-CAT achieved important successes against ransomware, including arrests and infrastructure takedowns: Operation TALPA, Operation FIFTH ELEMENT and Operation GOLD DUST/ QUICK SAND.
- A total of 18 children were tentatively identified and two offenders apprehended as a result of the 10th edition of Europol’s Victim Identification Taskforce (VIDTF).
- The No More Ransom project marked its fifth anniversary. The portal is available in 37 different languages and offers more than 120 tools capable of decrypting over 150 different types of ransomware that have assisted more than 6 million people worldwide.
Key output
Each year, EC3 publishes the Internet Organised Crime Threat Assessment (IOCTA), its flagship strategic report on key findings and emerging threats and developments in cybercrime.
Structure
EC3 takes a three-pronged approach to the fight against cybercrime: expertise and stakeholder management, forensics and operations.
Expertise and Stakeholder Management Teams:
- establish and maintain partnerships with key stakeholders
- coordinate prevention and awareness initiatives
- ensure the development of standardised training
- perform strategic and tactical analysis
- perform forward-looking and technology assessments
- monitor and assess pertinent policy and legislative discussions and measures and advise decision makers
Document and Digital Forensics Teams:
- focus on providing (on-the-spot) forensics support
- conduct research and development
- maintain a decryption platform ready to support investigations
Operations Teams:
- support in investigating:
- cybercrimes committed by organised groups, particularly those generating large criminal profits such as online fraud;
- cybercrimes which cause serious harm to their victims, such as online child sexual exploitation;
- cybercrimes (including cyberattacks) affecting critical infrastructure and information systems in the European Union;
- criminality on the Dark Web and alternative platforms.
- collect and process cybercrime-related information from public, private and open sources
- identify emerging threats and patterns and share them with relevant stakeholders through products such as the OSINT Dashboard
Working together
In 2010, Europol together with the European Commission and the EU Member States established the European Union Cybercrime Task Force (EUCTF), a trust based network whose role is to identify, discuss and prioritise the key challenges and actions in the fight against cybercrime.
EC3 hosts and supports the Joint Cybercrime Action Taskforce (J-CAT) which is comprised of cyber liaison officers from various EU Member States, non-EU law enforcement partners and EC3. The Taskforce members propose, select and work together on high-profile cases for investigation.
The EC3 Programme Board provides the Centre with direction on how to best achieve its goals and fulfil its officially assigned tasks, building on partnerships, shared responsibility and cooperation with all Board members.
Dedicated Advisory Groups have been created in order to foster closer cooperation between EC3 and leading non-law enforcement partners in key domains such as internet security, telecommunications and financial services.
EC3 works on ensuring that every global partner can play a role in the joint fight against cybercrime. It has therefore established the Secure Platform for Accredited Cybercrime Experts (SPACE), where experts can exchange best practices and further expand the global knowledge base on cybercrime.
Europol is a key partner of the International Cyber Offender Prevention Network (InterCOP) network. InterCOP consists of 26 countries in total and is funded by a three year Internal Security Fund (ISF) provided by the European Commission.
- The InterCOP network aims to connect international law enforcement agencies in order to share expertise and jointly develop, carry out and evaluate cyber offender prevention initiatives for maximum impact.
- It aims to engage public and private sector stakeholders whose skills, resources, and reach are needed alongside law enforcement efforts to create a safer digital environment and guide young individuals with cyber skills in the right direction.
- The Netherlands is the project lead of the InterCOP project, to which the UK, Finland, Sweden, and Portugal co-signed.
Cyber Offender Prevention (COP) is increasingly recognised as an effective and necessary response to cyber criminality alongside investigative efforts.
- The Dutch Police’s National High Tech Crime Unit has launched several campaigns to inform youngsters about the illegality of certain cyber activities such as DDOS-attacks and using Remocyberte Access Trojans (RAT). Additionally, it promotes the use of educational games that enforce cyber norms and cyber safety such as Framed and Hackshield.
- For at risk youth, or those who have already crossed the line, initiatives such as re-b00tcmp have been developed in cooperation with private and public partners such as municipalities, the Probation Service (Halt and Reclassering), the Child Care Service, the Protection Board and the Public Prosecution Service.
Do you want to stay up to the date with the latest EC3 and cybercrime news? Then follow our dedicated Twitter cyber account: @EC3Europol
Tags
EC3 Updates
Results (494 items)