European Union Agency for Law Enforcement Cooperation (incl. EC3)

History & facts. Europol coordinates cross-border investigations, provides analyses and operational support, but does not itself carry out arrests — sovereignty remains with the member states. The EC3 was opened on 11 January 2013 at Europol's headquarters in The Hague and bundles the fight against cyber-dependent crime, the distribution of child sexual abuse material and payment fraud; it is also active in the area of the dark web. The EC3 offers member states operational, strategic, analytical and forensic support; its head reports to the leadership of Europol. Europol is to be distinguished from European Union Agency for Cybersecurity (ENISA) (the European Union (EU) cybersecurity agency) and from the European Cybersecurity Competence Centre (ECCC) in Bucharest.

Outlook & recommendation. For companies, Europol/EC3 is relevant above all as background: in serious, cross-border incidents (such as large ransomware campaigns), investigations often converge via the national police and the EC3. The practical first contact in an emergency, however, is the national point of contact — in Germany the Central Cybercrime Contact Point (ZAC). Those who document incidents cleanly and forensically considerably increase the value of a later prosecution — a reason to consider Digital Forensics and Incident Response (DFIR) and evidence preservation from the outset.