Whatever means the potential victim — be it a state, a company or even a group of individuals — has at its disposal to counter any threat, the first thing it must do is actually define and identify the nature of that threat. The EU is obviously no exception to this requirement. If one looks at the host of declarations adopted by the EU institutions since 9/11 one can discern a quite substantial evolution of threat definition post-9/11. Three phases can be distinguished.

In the immediate aftermath of the 9/11 attacks, EU statements were focused on the threat posed to the United States (US) as part of a more general global threat to ‘open’ and ‘democratic’ societies.^[9] While cross-border intelligence and law enforcement cooperation was immediately stepped up in order to identify and dismantle terrorist networks in the EU, such networks were treated as part of a global threat posed to Western societies by Al Qa’ida. In that sense, EU terrorist networks were seen as posing an ‘external’ threat. This ‘global’ definition also prevailed in the first more substantial legislative act in the fight against terrorism, the Framework Decision on Combating Terrorism of 13 June 2002. The Decision started with a strongly worded preamble that identified terrorism as ‘one of the most serious violations’ of the ‘universal values’ (human dignity, liberty, equality, solidarity, respect for human rights and fundamental freedoms) and ‘principles’ (rule of law and democracy) on which the EU is founded. Terrorism was also referred to as a global threat to democracy, human rights and economic and social development in line with the La Gomera Declaration that the European Council adopted in 1995.^[10] The main emphasis in this first common EU post-9/11 terrorist threat definition was clearly on a broad and rather undifferentiated threat of a global nature to the political, constitutional and socio-economic foundations of the EU and its member states. This emphasis was also reflected in the common definition of terrorist acts as this included the aim of terrorists seriously to destabilise or destroy ‘the fundamental political, constitutional, economic and social structures of a country’.^[11]

The rather undifferentiated global threat definition showed its limitations in the light of the growing evidence of the terrorist potential within some of the member states when logistical bases and cells in the United Kingdom (UK), Italy, Germany, Spain and Belgium were uncovered during 2002 and 2003. The adoption of the European Security Strategy ^[12] in 2003 formally marked the passage to a new phase with a more ‘internalised’ and differentiated threat perception. The Security Strategy not only identifies terrorism as the first of the ‘key threats’ the Union was facing in the security domain but also describes it as a threat having both an internal and an external dimension. The Security Strategy emphasises that terrorism not only endangers lives and causes huge costs but that it also ‘seeks to undermine the openness and tolerance of our societies’. Although maintaining the global nature of the threat, there is recognition also of an internal threat with a significant risk of ‘home grown’ terrorism. The Security Strategy also links terrorism with other international threats, in particular, the proliferation of weapons of mass destruction, ‘state failure’ (a concept not further defined in the EU texts) and organised crime, seeing terrorism as part of a differentiated set of interrelated internal and external security threats rather than an individual and isolated one.

The third, and current, phase started after the London attacks of July 2005 brought to the fore the full scale of home grown terrorism. This third phase found its full expression when the European Council, partly in response to the London attacks of July 2005, adopted the EU Counter-Terrorism Strategy on 15‑16 December 2005.^[13] The Counter-Terrorism Strategy broadly reaffirms the earlier threat assessment, but places an even stronger emphasis on the threat posed by ‘home grown’ terrorism through radicalisation and terrorist recruitment within the EU^[14] — an obvious reaction to the background of the Madrid and London attacks. The Strategy adds a further element to the common definition that deals more specifically with the EU’s particular vulnerability to terrorist activities. After re‑emphasising the threat posed by terrorism to the EU’s security, values and rights and freedoms, the text continues:

This addition provides a new element to the threat definition as the threat is presented as being, at least partially, due to the Union’s specific ‘openness’: terrorists may abuse the free movement of people across borders and the freedoms of the Internal Market. Accordingly, the threat is even more ‘internalised’ and more justification is provided — as the Strategy emphasises in the same paragraph — for ‘concerted and collective European action’. Finally, a further distinctive feature of this most recent stage of the EU’s threat definition is its diversification: The Counter-Terrorism Strategy no longer focuses almost exclusively on Al Qa’ida as did some of the earlier texts; it refers to Al Qa’ida only once, and even then only as an example.^[16] The European Union Strategy for Combating Radicalisation and Recruitment to Terrorism of November 2005, which is an integral part of the Counter-Terrorism Strategy, defines the terrorism perpetrated by Al Qa’ida ‘and extremists inspired by’ it as the main terrorist threat to the Union. Although ‘other types of terrorism … continue to pose a serious threat to EU citizens’ the Union’s response is going to focus on this main threat.^[17]

It is important to note that a considerable effort has also been made to avoid anything in the official definition of the threat that could make Islam or the Muslim world appear as the ‘threat’ or ‘enemy’. While Europol’s TE-SAT Report liberally uses the term ‘Islamist terrorism’ and ‘Islamist terrorist propaganda’,^[18] the EU’s Counter-Terrorism Strategy consistently employs very neutral language. The term ‘Islam’ appears only once and then only for the purpose of rejecting the claim of ‘a clash between the West and Islam’.^[19] Equally, in the Strategy for Combating Radicalization and Recruitment to Terrorism, two entire paragraphs are dedicated to the need to avoid linking Islam to terrorism and, in close cooperation with Muslim communities, to reject distorted views of Islam.^[20]

Compared with the initial focus on a largely ‘external’ global threat posed by Al Qa’ida the common EU threat definition has clearly evolved to encompass the concept of an ‘internal’ threat. It also reveals an appreciation of post-9/11 terrorism as a more differentiated and complex phenomenon, both inside and outside of the EU, than the activities of Al Qa’ida. As far as the new emphasis on the particular vulnerability of the EU is concerned, there is little doubt that terrorists can potentially benefit from the ‘openness’ of the EU’s internal borders and the provisions on free movement.^[21] A further positive element is that the threat definition clearly tries to avoid any simplified or simplistic identification of the post-9/11 terrorist threat with Islamist activities and the Muslim world.

The growing ‘internalisation’ of the threat definition in line with the realisation of a potential for internal radicalisation and recruitment has enhanced the perception of the post-9/11 terrorist threat as primarily a law enforcement challenge. In contrast to the US concept of the ‘war on terror’, for the EU the fight against terrorism has in fact remained a challenge to be met primarily by the use of law enforcement instruments. The reasons for that are partly historical and partly systemic.

Historically, one has to remember that several of today’s member states, especially the United Kingdom, Germany, Italy and Spain, have had to tackle serious terrorist threats since the 1970s. Although the countries concerned responded to the terrorist challenge with a range of measures that had serious implications for civil liberties, they did so primarily by adapting and toughening law enforcement instruments. Wherever significant suspensions of civil liberties and the use of military force was resorted to — such as by the British government in Northern Ireland — this was generally seen as a response in extremis and of doubtful effectiveness. In several member states, such as Germany, Italy and, more recently, France,^[22] the experiences with a strong law enforcement response to the challenge of terrorism were on the whole regarded as positive, with terrorist threats eventually receding again or at least being contained. The European experience with a law enforcement-focused approach has therefore been not only a long one but also, at least in some cases, an effective one. It has also received some qualified endorsement through the case law of the European Court of Human Rights, which has more or less systematically accepted the right of European countries to criminalise violent political behaviour.^[23] Although there has also been a growing perception in Europe that the post-9/11 terrorism challenge is qualitatively different from the more ‘traditional’ forms of earlier decades,^[24] many policy-makers in Europe continue to be influenced by their experiences with ‘old’ terrorism and the relative successes achieved by a law enforcement centred approach.^[25]

There is also a ‘systemic’ disposition of the EU towards a law enforcement response. Terrorism is mentioned in the Treaties only once, as one of the forms of crime that should be targeted ‘in particular’ in the context of the internal security mandate of Article 29 TEU (focusing on police and judicial cooperation in criminal matters). The security mandate of the Common Foreign and Security Policy (CFSP) to ‘strengthen the security of the Union in all ways’^[26] may be broad enough to include international action against security threats posed by global terrorism within the remit of the CFSP and the European Security and Defence Policy (ESDP) elements it comprises, and the latter include tasks of rescue, peacekeeping, crisis management and peacemaking (the so-called ‘Petersberg tasks’), which could obviously be of relevance to the fight against terrorism. Yet there is no explicit mention of the fight against terrorism as an objective of the CFSP, nor have any of the CFSP Petersberg tasks been linked to combating terrorist activity. Indeed, it seems far from certain that the EU could claim any legal competence to engage in a military operation abroad in order to prevent a terrorist attack on the EU, let alone to retaliate militarily against any such attack. Even if such a legal competence to act does exist, it seems highly improbable that, given the serious doubts in many EU capitals about both the legality and the effectiveness of military interventions abroad, the necessary unanimity in the Council for using ESDP instruments could be achieved. This contrasts rather strikingly with the US strategic culture and capability, which relies heavily on the use of ‘hard power’^[27] and must be counted among the contributory factors to the EU’s reliance on a law enforcement approach.

Yet the focus on law enforcement by the EU does not limit internal police and judicial cooperation measures. As indicated above the internal and external nature of the terrorist challenge is a core element of the EU threat definition, so that the response must necessarily be both an internal and an external one. Because of the complex and multifaceted nature of the identified challenge, the response must also be a multidimensional one involving, as the European Union Security Strategy of 2003 emphasised, a ‘mixture’ of means beyond policing and enhanced judicial cooperation.^[28]

This multidimensional approach forms the basis of the Counter-Terrorism Strategy of December 2005. It defines the strategic objectives of EU action in countering the terrorist threat. These objectives and the main measures to be taken are regrouped under the four headings of ‘PREVENT’ (radicalisation and recruitment), ‘PROTECT’ (citizens and infrastructure), ‘PURSUE’ (terrorists across borders) and ‘RESPOND’ (to the consequences of terrorist attacks). The Counter-Terrorism Strategy has the merit of providing a broad structure for the variety of EU measures, a list of priorities and a justifying narrative. Yet in terms of the substance of the action planned or taken, the key document remains the EU Action Plan against terrorism, which has been frequently revised and added to since September 2001.^[29] Together the Counter-Terrorism Strategy and the Action Plan, which currently comprises well over 200 individual measures, allow us to identify four key elements of the EU’s response to post-9/11 terrorism which will be dealt with in turn.

The EU has adopted a considerable number of legislative instruments to enhance cross-border law enforcement capabilities within the EU. The most important of these has been the already mentioned Framework Decision on Combating Terrorism of 13 June 2002.^[30] This provides not only for a common minimum definition of terrorist acts, focused on a specific intent to commit such an act and its actual or potential consequences for a country or an international organisation, but also for common minimum/maximum custodial penalties for directing (15 years) or participating in (eight years) a terrorist group. The common definition contains some vague and subjective elements,^[31] it does not regulate all aspects of the definition of terrorist acts as an offence, and its minimum/maximum penalty levels leave wide margins of discretion to the member states. Nevertheless, the common definition is substantial enough to provide a common platform for the comprehensive criminalisation and prosecution of terrorist offences throughout the Union.^[32] This platform is all the more important as several member states did not have specific provisions on terrorism as a criminal act in their criminal legislation or codes before the adoption of the Framework Decision. It is also worth noting that in its list of proscribed acts, the Framework Decision goes beyond the conventional acquis of the United Nations.^[33]

Much legislative activity has been focused on the financing of terrorism. In addition to measures freezing funds and property of certain presumed terrorists and terrorist groupings on the basis of Council Regulation (EC) 881/2002,^[34] there are other major instruments such as the Council Framework Decision on the Execution of Orders Freezing Property or Evidence of 22 July 2003,^[35] the Council Framework Decision on the Confiscation of Crime-Related Proceeds, Instrumentalities and Property of 24 February 2005,^[36] and the Directive on the Prevention of the use of the Financial System for the Purpose of Money Laundering and Terrorist Financing (the so-called ‘Third Money Laundering Directive’) of 26 October 2005.^[37]

Although not solely directed at terrorists, the adoption of the Framework Decision on the European Arrest Warrant of 13 June 2002^[38] was much accelerated because of anti-terrorism objectives, thereby generating one of the most advanced cross-border law enforcement instruments of the Union.^[39] The European Arrest Warrant, which provides for the arrest and transfer of wanted persons by the police and judicial authorities of one member state on demand from the authorities of another member state, can also be regarded as an instrument of cross-border operational cooperation between national authorities in the fight against terrorism.

As a further counter‑terrorism measure, the Commission introduced in 2003 a proposal for a Framework Decision on a European Evidence Warrant, on which political agreement was reached in the Council in June 2007.^[40] Similarly to the European Arrest Warrant, the Evidence Warrant constitutes an application of the principle of mutual recognition to a judicial decision in the form of a European Warrant, in this case for the purpose of obtaining from the authorities of other member state’s objects, documents and data for use in proceedings in criminal matters. The adoption on 15 March 2006 of Directive 2006/24/EC on the Retention of Telecommunication Data ^[41] was also motivated, at least in part, by counter-terrorism objectives. The Directive obliges telecommunication service providers to retain personal data such as the calling number, name and address of the subscriber and the identity of a user of an Internet Protocol address for a period of between six months and two years to ensure their availability for the purpose of the investigation, detection and prosecution of terrorism and other serious crimes.

In parallel to these legislative counter-terrorism measures in relation to criminal law, financial and data-retention issues, the EU has placed right from the beginning an emphasis on enhancing the operational interaction between the national law enforcement and criminal justice systems of member states. A host of measures have been taken or are under negotiation to increase multinational investigations and the supply of information to Europol; to enhance the common threat analysis capacity through Europol and the Situation Centre (SitCen) in the Council; and to improve the exchange of relevant data — such as crime registry data on convictions and lost and stolen passports. Key instruments adopted for primarily operational purposes include the Framework Decision on Joint Investigation Teams of 13 June 2002,^[42] the Council Decision on the Implementation of Specific Measures for Police and Judicial Cooperation to Combat Terrorism of 19 December 2002,^[43] the Council Decision on the Exchange of Information and Cooperation Concerning Terrorist Offences of 20 September 2005,^[44] the Council Decision on the Exchange of Information Extracted from the Criminal Record of 21 November 2005^[45] and the Framework Decision on Simplifying Exchange of Information and Intelligence Between Law Enforcement Agencies of 18 December 2006.

The most recent step concerns progress with the so‑called ‘principle of availability’, aimed at granting law enforcement officers access to all relevant law enforcement information available anywhere in the EU. In 2005, seven member states went ahead with the implementation of this principle by signing the so-called Prüm Convention.^[46] On 12 June, the JHA Council reached political agreement on a Draft Decision in relation to the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, which incorporates many aspects of the original Prüm Convention into the EU.^[47] It establishes, inter alia, the conditions and procedures for the automated transfer of DNA profiles, dactyloscopic data and certain national vehicle registration data as well as the conditions for the supply of information on terrorist suspects, even if not requested, in order to prevent terrorist offences. It also seeks to improve cross-border police cooperation through various measures, including joint operations.

All these measures are aimed at reducing obstacles to cross-border movements of law enforcement officers and/or law enforcement intelligence for operational purposes. Legislative mutual recognition and law enforcement instruments have therefore been complemented by action aimed at enhancing operational capabilities, although no operational powers have been transferred to EU structures as such (see below). This corresponds not only to the internal security dimension of the EU’s common threat definition, but also to the realisation that a variety of instruments are needed and that the EU is particularly vulnerable because of the abolition of controls at internal borders.

In parallel with the above developments, the Union has made extensive use of its external relations instruments to pursue counter-terrorism objectives. There has in fact been a ‘mainstreaming’ of the fight against terrorism in EU external relations.

Two elements should be distinguished here. One is the fact that the EU has, to a significant extent, developed its external action in the domain of law enforcement cooperation with third countries — the most notable example being cooperation with the US. This has not only led to the conclusion of two agreements of Europol with the US government on data-exchange^[48] and two EU‑US agreements on extradition and mutual legal assistance,^[49] but also to the exchange of liaison officers and invitations to US officials to participate in relevant EU Council working party meetings.^[50] This development should be regarded as quite significant, as EU external relations in the third pillar domain were rather poorly developed before the 9/11 attacks pushed them much higher up on the EU’s agenda. While US interests and pressures have had only a limited impact on internal EU approaches to the post 9/11 threat, they certainly greatly contributed to this ‘externalisation’ of the EU’s anti-terrorism action, pushing the EU in certain cases — such as the EU‑US agreement on the processing and transfer of Passenger Name Records (PNR) data^[51] — to a rather controversial extension of its external counter-terrorism measures. Specific forms of EU anti‑terrorism cooperation, though at a much less intensive level, have since also been developed with other major international partners, such as the Russian Federation.^[52]

The second element of the mainstreaming process has been a significant ‘cross‑pillarisation’ of anti-terrorism objectives that have spread to external relations in the second pillar (common foreign and security policy (‘CFSP’) and its military ancillary, the European Security and Defence Policy (ESDP)) and external economic relations (common commercial policy). Examples in CFSP include the systematic use of ‘political dialogues’ with third countries (such as China and India) or with groups of third countries (such as EUROMED, the Asian countries in the Asia‑Europe‑Meetings (ASEM) and the countries of the Gulf Cooperation Council). A further example is the very active role taken by the EU at the UN (such as EU participation in the UN Counter-Terrorism Executive Directorate (CTED) assessment missions to Morocco, Kenya, Albania, Macedonia and Tanzania in 2005).^[53] Examples in the first pillar context are the use of economic and financial aid and trade instruments of the EC to shore up the international coalition against terrorism and to support moderate reformers in countries with a high terrorist recruitment potential. Pakistan, for instance, has been granted preferential trade quotas in recognition of its contribution to the fight against terrorism.^[54]

Since September 2001, the EU has also been systematically negotiating the insertion of clauses on cooperation against terrorism and terrorist financing into trade and cooperation agreements. Other examples are the technical assistance measures provided to Algeria and Morocco for upgrading maritime, air and border security in the fight against terrorism and the support for upgrading Morocco’s counter-terrorism capabilities in fields like the combat against radicalisation in prisons.^[55] The EU is also contributing to the anti‑terrorism programs of the Jakarta Centre for Law Enforcement — and similar support for the African Union Counter-Terrorism Centre in Algiers is currently under negotiation.^[56] Overall this quite comprehensive use of external instruments across the different pillars in parallel with internal measures reflects the link between the internal and external side of the EU’s threat definition.

Most of the above-mentioned internal legislative and operational measures are essentially aimed at improving law enforcement and are in that sense repressive in nature. More recently, especially since the Madrid and London terrorist attacks demonstrated the ‘home grown’ dimension of the terrorist threat, the EU has moved towards complementing its repressive measures by enhancing its preventative measures. The principal result so far is the adoption in November 2005 of the already mentioned European Union Strategy for Combating Radicalisation and Recruitment to Terrorism.^[57] This Strategy is focused on disrupting the activities of networks and individuals that draw people into terrorism — through, inter alia, an increased monitoring of the internet (involving Europol), coordination of national measures against terrorist incitement as well as action programs both to encourage engagement with moderate Muslim organisations and to enhance language and other training for foreign Imams in Europe. The Strategy is marked by a strong emphasis on improving long-term integration and the dialogue with Muslim communities and religious authorities.^[58] Measures implementing the 2005 Strategy include:

Further measures with a particular focus on the ‘Islamist’ side of the threat include common monitoring and evaluation mechanisms of Islamist websites; encouraging Muslim communities not to rely on foreign Imams; and research on inter-faith dialogues in the 6^th and 7^th Research Framework Programs of the EU.^[61] External prevention measures have included the provision of training for police forces to reduce radicalisation potential in the Balkans; support for the build-up of an interfaith dialogue in Indonesia and the Mediterranean; and EU assistance to Algeria and Morocco on the identification of radicalisation patterns and preventative measures.^[62] This greater effort to understand and address the roots of ‘home grown’ terrorism reflects both the strong internal side of the EU’s threat definition and an appreciation of the complexity of the causes of terrorism.

Since 9/11 the mandate and actual role of the European police organisation Europol and of the cross-border prosecution unit Eurojust have been strengthened several times in terms of both their analysis functions and the support they receive for cross‑border investigations and prosecutions.^[63] The information flow from national authorities to these agencies has also been enhanced. Both institutions play a significant role in counter-terrorism both by providing cross-border assessments of anti-terrorism cases and by bringing national authorities together to work more effectively on such cases.^[64] In addition, the tasks of some existing structures, such as the SitCen in the Council and the Police Chiefs Task Force (PCTF), have been redefined or reoriented to allow for a new focus on terrorism. The SitCen, for example, has been enabled to receive and process information from national intelligence services. The PCTF, although a non-permanent body with ill-defined powers, has been effectively mandated to play a role in the implementation of a common crime intelligence model and the identification and transfer of best counter‑terrorism practices in local policing.^[65] Newly created institutional structures, such as the European Police College (CEPOL) and the new EU external border management agency FRONTEX have also been immediately assigned tasks in the fight against terrorism.^[66] The European Commission has undertaken a partial reorganisation to enhance its administrative capacity in the anti-terrorism field^[67] and has reallocated funding instruments for research into terrorist issues.^[68]

All this is clearly aimed at equipping the Union with a minimum of common response capacity, in addition to coordinated national capacities, to the defined common terrorist threat. Last but not least, with the creation of the Office of the EU’s Anti‑Terrorism Coordinator, a completely new senior office with a small supporting staff has been set up in the General Secretariat of Council in 2003 to monitor the implementation of the EU Action Plan and help coordinating EU and national counter-terrorism efforts.