Post Brexit EU (In)Security

In 2014, Theresa May, then Home Secretary, presented to Parliament a series of Impact Assessments examining the benefits for the United Kingdom of continuing its participation within the European Union’s security and policing arrangements such as Europol, the European Arrest Warrant (EAW) and the second generation Schengen Information System (SIS II). The conclusions reached were unequivocal – these and other EU security measures were deemed vital in dealing with “European [foreign terrorist] fighters coming back from Syria”, preventing British criminals from evading justice abroad and foreign criminals from hiding in Britain. The result of the 2016 Referendum on the UK’s Membership in the EU, or rather the subsequent (lack of) negotiations on security matters, has the potential to substantially change both the EU-UK specific security landscape and the wider cross-border EU security landscape.

In December 2018, the House of Commons’ Home Affairs Select Committee published a critical report on the security preparations by the UK for exiting the EU. The Committee noted a “concerning lack of progress in securing the UK’s future relationship with Europol and the EAW”. Further, the Committee expressed deep apprehension at the “EU’s resistance to UK participation in the SIS II database given the importance of this security cooperation to both the UK and the EU.” There is thus a “significant risk that the UK and the EU are facing a security downgrade”. To date, the discourse on Brexit has been dominated by intense and recurring evaluations of the Withdrawal Agreement, UK’s changing date of departure, the Northern Ireland backstop and the impact on cross-border trade. What the following discussion proposes to do instead is to address the impact of Brexit on EU security by taking turns in outlining the role of the three key mechanisms within the overall EU security and policing framework.

European Arrest Warrant (EAW) and Extraditions

One of the core benefits of the EAW is the simplified procedure through which an EU member state can issue a warrant for an arrest and extradition; this warrant is valid throughout the entire EU bloc. Under an EAW, an EU country can no longer refuse to surrender its own nationals unless it takes over the execution of the prison sentence against the wanted individual. As a “double criminality check” is not required for 32 categories of offences, it is not necessary for an offence to be an offence in both countries provided that the offence is sufficiently serious. EAW are subject to strict time limits – final decisions in the extraditing country must be made within 60 days of arrest or within 10 days if the defendants consent to the surrender. The surrender must happen as soon as possible on a date agreed between the authorities concerned and no later than 10 days after the final decision on the execution of the EAW. The case of Hussain Osman, one of the failed 21/7/2005 London bombers, demonstrates how swiftly an EAW can work in comparison to alternative schemes. Osman and his compatriots had targeted 3 Tube trains and a bus – in an attempted repeat of the 7/7/2005 attack – but the devices failed to explode. Within 8 days, Hussain Osman was arrested in Rome. He was returned to the UK within 56 days. Overall, the EAW is considered to be substantially faster than the previous arrangements based on the 1957 European Convention on Extradition.

According to the UK’s Institute for Government, an EAW-based extradition takes on average 48 days, whereas an extradition under the rules of the 1957 Convention can take up to a year. The lack of Convention provisions on mutual recognition of judicial orders triggers this lengthy process. Due to this absence of appropriate provisions, EU member states are not obliged to directly recognise and act on judicial orders from another member state. A particularly illustrative example is the request to extradite Rachid Ramda, who was wanted by the French authorities in connection with a series of terrorist bombings in France between July and October 1995 which resulted in a number of deaths and injuries. The French government made 3 requests in 1995 and 1996 for Ramda’s extradition. The first 2 request were in relation to the Paris Metro attacks in October 1995 and the Paris rapid transit system; the third was in respect of alleged participation in a criminal association with the aim of committing acts of terrorism. Ten long years elapsed before he was eventually surrendered from the UK to France in 2005. In total, there were 9 separate legal proceedings to extradite Ramda. If the UK was to leave the EU without any agreement (the ‘no deal’ scenario), until the conclusion of a security treaty or close security partnership with the EU, Britain would have to rely solely on the provisions and operation of the 1957 Convention. Lengthy cases such as Ramda’s could return to haunt British and other courts across Europe.

There is another significant disadvantage of the 1957 Convention in comparison to the EAW. Under Article 6 of the Convention, a contracting party can refuse to extradite its own nationals. A number of EU member states have made the necessary reservation under Article 6 allowing them such a refusal including France, Germany and the Netherlands – countries deemed by Europol to have a substantial number of FTFs looking to return to Europe. These reservations appear to be still in force. In addition, extradition under the Convention could be barred even if a reservation has not been entered but there is a domestic constitutional bar in place. EU member states with such a legal barrier to extradition include Austria, Belgium, Ireland, Italy and Sweden. The operation of the constitutional bar in Ireland and Italy does not have effect if the surrender of their own nationals is provided for by relevant extradition arrangements such as the EAW. However, there is no clarity on what the position would be if extraditions are not governed by the EAW. A refusal to extradite a national would not necessarily result in an individual or individuals avoiding prosecution – proceedings would have to be transferred to the executing state. This, however, may not always be possible or desirable and could place a substantial burden on the victims and witnesses. In short, a ‘no-deal’ Brexit could create substantial extradition and prosecution challenges across Europe at a time when the threat of cross-border terrorism requires continued and “unlimited security cooperation”.

The Withdrawal Agreement reached between the UK and EU, does make provisions for an on-going use of the EAW scheme by the UK during an agreed transitionary period following exit from the EU. Any EAW requests made before the transitionary period ends will be processed. Nevertheless, under the Withdrawal Agreement, an EU member state may refuse to execute a warrant for one of its own nationals during the transition period. Similarly, the UK could declare that it will not surrender UK nationals to that state. There is the additional complication that the Court of Justice of the European Union (CJEU) is the arbiter for disputes arising under the EAW scheme. Bringing an end to the jurisdiction of the CJEU has been one of the UK government’s core negotiating priorities or “red lines”. In other words, even if the UK is to leave the EU subject to the Withdrawal Agreement, in its present or in a revised format (a ‘deal’ scenario), the current access to the EAW will most likely change. However, as has been widely publicised and discussed, the Withdrawal Agreement has been resoundingly rejected by the UK Parliament on 3 separate occasions. It is likely to be voted down for a fourth time in early June. Thus, at present, there is no clarity on what future access the UK will have to the EAW scheme when it eventually leaves the EU. Concomitantly, there is no certainty if there will be a transition period at all.

At this point of the security (and general Brexit) negotiations stagnation, it is unclear how long consultations and discussions on extradition/EAW-emulating arrangements will take. There is also no indication when more sustained and focused security treaty negotiations may take place. The examples of Iceland and Norway – non-EU members but part of the Schengen agreement – suggest that a long and protracted process will be forthcoming. Both countries began negotiations over extradition mechanisms with the EU in 2001. While an agreement was eventually reached in 2014, it has yet to be ratified and is thus not yet operational.

Aside from the lengthy negotiation process, there are two other significant differences between the EAW scheme and the Iceland/Norway–EU agreement. The Iceland/Norway–EU arrangement enables all parties to refuse extradition of their own nationals. More significantly, under Article 6, it includes a “political offence” exception in respect to terrorism offences. In practice, if this provision is ever utilised, an EU member state could refuse to extradite a suspected terrorist to Iceland or Norway, and vice versa, if their terrorism-related offences are regarded as political in nature. While it is only speculation at this point if such an exclusion would form part of a future UK-EU agreement, the exceptions demanded from both the EU and Norway and Iceland during the negotiations had an impact on the length of time it took to reach an agreement. In conclusion, any negotiations on continued cooperation within the EAW mechanism will most likely be complex, protracted and unlikely to lead to a parallel arrangement as efficient and effective as the EAW.

Access to European Data Systems

The EAW scheme does not operate independently of other EU security and policing mechanisms. Its functioning relies on a number of key data-sharing tools that are central to EU member states’ cooperation in security matters. These tools allow for a wide range of information to be exchanged on a real-time basis; the data includes information on suspects wanted for arrest or questioning, stolen vehicles, missing persons, criminal records, DNA and fingerprint data and criminal offences. The core EU data systems are:

• The Second Generation Schengen Information System (SIS II), which contains information on EAWs, foreign terrorist fighters, and dangerous objects;
• The European Criminal Records Information System (ECRIS), which ensures swift exchange of information on convictions made in other member states;
• The Prüm system for sharing databases for DNA profiles, vehicle registration data, and fingerprints;
• Passenger name record (PNR) data, which flags individuals travelling to other states and provides a rich data set, allowing analysis of travel patterns.

As both the Prüm and the PNR systems have been expressly mentioned in the Political Declaration accompanying the Withdrawal Agreement, the discussion below will focus on SIS II and ECRIS, neither of which have been mentioned. SIS II contains information on over 35,000 people wanted under an EAW as well as alerts on suspected foreign fighters, missing or wanted individuals and alerts on people and objects (for example dangerous weapons) of interest to EU law enforcement agencies (2017 statistics – the latest available). SIS II allows the law enforcement agencies of the participating countries to share and receive alerts in real time, thus expediting and easing cooperation in border security and policing. Each country participating in SIS II has a SIRENE (Supplementary Information Request at the National Entry) Bureau, which provides additional information on alerts and coordinates activities in relation to SIS II alerts. SIS II contains 76.5 million alerts, automatically flags information to European policing partners and permits discreet markers allowing the monitoring of an individual’s movements. In comparison, the Interpol equivalent (I-24/7) contains a fraction of the alerts and requires partners to actively check Interpol notices thus slowing down the process of obtaining information.

Under Article 36 (3) of the SIS II Decision, a state may issue an alert for discreet checks in respect of an individual who is suspected of terrorist activities or is deemed to pose a domestic or transnational security threat. At the end of 2017, nearly 130,000 Article 36 SIS II Decision discreet or specific check alerts were issued. The statistics do not provide a breakdown of how many of these were discreet national security alerts under Article 36(3). Overall, SIS II can play a significant role in tracking individuals under surveillance by intelligence agencies. It has been described as “absolutely crucial” to intelligence sharing; losing access to it poses the serious risks of (severely) limiting the information exchange and sharing between the UK and the EU. Losing access to ECRIS would equally have substantial practical implications – a response to a request about a foreign national’s criminal history would take an average of 66 days, compared to 10 days under ECRIS. Neither the text of the Withdrawal Agreement nor the Political Declaration provide for continued access by the UK to SIS II or to ECRIS. Instead, the Declaration envisages mechanisms that might “approximate” these capabilities. The limited negotiations since November/December 2018 have not offered any further clarity.

The significance of transferring data, both within the EU and across third countries, in the context of collective security cannot be overstated. As the UK is an important and regular contributor of information to these systems, there is naturally a mutual interest in continued UK access to the EU databases. According to oral evidence by Sajid Javid, the current Home Secretary, the UK is a top 3 contributor to ECRIS and a top 5 contributor to SIS II. In addition, there were approximately 16,000 hits in SIS II based on UK information in 2017. While the Home Office is optimistic about reaching an arrangement, there are no existing models for third country data exchange covering the degree of data-sharing in criminal justice and security matters that the UK is likely to be seeking post Brexit. SIS II will be particularly challenging as access to it is currently restricted to EU member states and Schengen countries.

The recent EU agreements on data exchange with the US (on personal data protection) and Canada (on passenger name records), which, in comparison, involve more limited levels of data exchange, encountered significant legal challenges with the CJEU adopting a strict approach to privacy and data protection rights. Further, there have been arguments made from within the EU that ECRIS should be available to EU member states only while SIS II should be accessible by either EU member states or countries within the Schengen Area. At present there is no adequate contingency in the event of the UK losing access. A failure to retain access to SIS II and ECRIS has been described as “a significant downgrade” of policing and security capabilities at a time when cross-border crime and terrorism related security threats are increasing.

SIS II and ECRIS are not the only vital intelligence sharing tools the current operation of which may be significantly impacted by Brexit. Continued membership in Europol, or an alternative arrangement which maintains the core features of UK’s current Europol membership, has been described as the “most important priority among all the Justice and Home Affairs measures that the UK would be poised to leave behind upon exiting the EU.”

Involvement with Europol

According to reports commissioned by the UK government on the UK’s cooperation with the EU on matters of justice, security and home affairs, the UK utilises Europol more than almost any other member state. As such, it was rather unsurprising that in November 2016, the UK Government announced that it would opt into the new Europol Regulation despite the result of the June 2016 Brexit Referendum. The core argument for opting in was to “maintain our current access to law enforcement intelligence from other EU Member States which is held in Europol and to the analysis and links made by Europol in cross-border cases for the remaining time that we are in the EU.” An additional argument was put forward by the UK’s National Crime Agency (NCA) – the UK would be in a stronger negotiating position to remain part of the EAW mechanism and the SIS II database if it was still a Europol member.

The significance of a continuing Europol membership was further stressed by Sir Julian King, Commissioner for the Security Union, who cited Operation Fraternité as an example of the contribution Europol can make in counter-terrorism efforts. Following the Brussels and Paris attacks, the French and Belgian authorities contacted Europol’s counter-terrorism cell, exchanged information and asked the cell to work through the information in the hope that this would offer extra context or leads. By relying on its international contacts on terrorist finance tracking, the Europol counter-terrorism cell was able to generate new leads, which contributed to the progress made by France and Belgium in tracing the perpetrators of the attacks.

Europol does have a strong record of operational cooperation with non-EU countries even though its membership is limited to EU member states. It has two distinct forms of partnership with third countries: a) strategic agreements which provide for the exchange of general intelligence, strategic and technical information and b) the more extensive operational agreements. Its 20 operational partners, which include Interpol, the USA, Switzerland and Australia can access many Europol services, station liaison officers at the Europol headquarters and access Europol’s messaging facility. However, operational partners do not sit on the Europol Management Board and as such have no formal say in the strategic priorities or direction of the agency. Third country parties cannot lead operational projects but can join them subject to the unanimous agreement of all member states. The significant difference between full and operational membership lies in the level of access provided to Europol’s main database – the Europol Information System. Full members can have access “even from the field”; third countries can only “channel information and make inquiries” (Robert Wainwright – former Director of Europol).

Perhaps the most crucial challenge lying ahead of any EU-UK security negotiations is the coming into effect of the new Europol Regulation. Europol’s existing operational agreements were concluded before its current legal framework. As Robert Wainwright noted himself in oral evidence in front of the Home Affairs Committee, the UK might be the first country to seek operational cooperation with Europol under the new arrangements. There is thus no “tried and tested route: effectively, the UK will have to test a new procedure”. The new Regulation provides for two possibilities: a) the EU has to conclude an international agreement with the UK as a third country or b) the Commission has to make a data adequacy decision. What the UK is aiming for is “access and a partnership that is different from and closer than currently exists for any other non-member states”. There is one precedent for a deal beyond an operational agreement – the relationship between Denmark and Europol. Crucially, however, Denmark negotiated this bespoke arrangement while remaining an EU member state. This agreement is a hybrid arrangement somewhere between a full member and a third party in acknowledgement of Denmark’s continued EU membership. Further, the agreement requires Denmark to recognise the jurisdiction of the CJEU. As noted previously, removing the UK from the jurisdiction of the CJEU is one of the British Government’s negotiating priorities.

Thus, as this is the first time a Member State has left the EU, there is no precedent for what a future relationship between the UK and Europol might involve. The UK negotiation “red lines” pose additional challenges. The new legal framework for Europol, the Europol Regulation effective from May 2017, gives the CJEU jurisdiction over any arbitration relating to an EU contract. It also allows the European Data Protection Supervisor to oversee the processing of personal data by Europol. The Data Protection Supervisor can refer a matter to the CJEU or intervene in actions brought before the CJEU. In its assessment of the UK government’s post-Brexit security preparation, the Home Affairs Committee expressed serious concern that there has been no progress in the negotiations between the UK and the EU on this matter. The Political Declaration contains no detail on the UK’s future relationship with Europol.

Conclusion

In summary, transitional arrangements agreed as part of the current or an amended version of the Withdrawal Agreement are crucial in the areas of police and security cooperation, national and cross-border operations and immigration. Regardless of whether the UK leaves the EU with or without a deal, UK-EU security operations and intelligence cooperation will be put at significant risk. The Political Declaration and the Withdrawal Agreement lack detail and clarity in respect of both a future security partnership and arrangements at UK-EU borders. In particular, there is very little clarity and certainty offered by the Political Declaration on continued UK-EU cooperation on security matters via Europol, the relevant criminal databases and through extradition mechanisms and the EAW. Further, the EU has so far been reluctant to consent to continued UK participation in SIS II post-Brexit. Taken together, these developments – or rather lack of progress – suggests that there is a substantial risk that the UK and the EU face a considerable security downgrade. Most significantly perhaps, insufficient preparations have been made for negotiating a security treaty. Thus, without a security backstop in the Withdrawal Agreement, the possibility that any transitional arrangements will expire before the future security partnership is concluded is quite tangible.