Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
In this episode, we explore key findings from our 2026 European Law Enforcement Survey, including cross-border crime, crime-terror convergence, SIGINT challenges and data fusion gaps. Cognyte’s survey of 200 law enforcement professionals reveals how crime is evolving, where investigations break down and what agencies need to stay ahead.
As criminal tactics grow more sophisticated and investigations become increasingly data-intensive, many law enforcement agencies still lack the analytics and AI capabilities required to keep pace.
Read the full survey results
Watch it on YouTube
Transcript
European Law Enforcement Survey 2026
The Disappearing Physical Clue
[Speaker 3] (0:00 – 0:17)
Welcome to Cognite Audio Briefs, where we unpack what’s happening around the world and the forces shaping today’s security landscape. Each episode explores how technology can help law enforcement, intelligence, and military agencies turn complex data into clarity, insight, and decisive action.
[Speaker 2] (0:26 – 0:32)
Think about the last package you ordered online. It probably arrived in 48 hours, right?
[Speaker 1] (0:32 – 0:33)
Easily. Sometimes next day.
[Speaker 2] (0:33 – 0:47)
Yeah, exactly. It got scanned a dozen times, routed through these massive robotic warehouses, and just moved flawlessly through an incredibly complex global logistics network to land exactly on your welcome mat.
[Speaker 1] (0:47 – 0:49)
It is a modern marvel, really.
[Speaker 2] (0:49 – 1:01)
It is. But now I want you to imagine a local detective trying to find, I mean, just one single gram of synthetic fentanyl hidden somewhere inside that moving mountain of cardboard.
[Speaker 1] (1:01 – 1:02)
Oh, they can’t. It’s impossible.
[Speaker 2] (1:02 – 1:10)
Right. They absolutely can’t. And that visual completely shatters the comforting, classic Hollywood procedural we all grew up with.
You know, the trope.
[Speaker 1] (1:10 – 1:12)
Oh, yeah. The trench coat. The yellow tape.
[Speaker 2] (1:12 – 1:23)
Exactly. A crime happens. The detective ducks under the tape and just starts looking for physical anomalies.
They’re dusting a windowsill for fingerprints or bagging a smoking gun. It’s a physical puzzle.
[Speaker 1] (1:24 – 1:36)
And that cinematic script is incredibly satisfying because it implies that criminals always leave tangible, visible clues in the real world. You know, things a sharp-eyed investigator can just pick up with tweezers.
[Speaker 2] (1:36 – 1:38)
But that’s not how it works anymore, is it?
[Speaker 1] (1:38 – 1:50)
Not at all. If you look at the reality of modern European law enforcement today, the system isn’t dealing with a few hidden physical clues anymore. It is buckling under a completely different type of pressure.
[Speaker 2] (1:50 – 1:51)
Because everything is digital now.
[Speaker 1] (1:52 – 1:58)
Exactly. The battle has morphed from physical presence to sheer, overwhelming digital complexity.
[Speaker 2] (1:58 – 2:05)
Which brings us to the core of our deep dive for you today. We are looking at this fascinating survey by Cognite.
[Speaker 1] (2:05 – 2:07)
Yeah, it’s a really comprehensive piece of research.
[Speaker 2] (2:07 – 2:19)
It really is. They gathered insights from 200 European law enforcement professionals. So these are the people actively working at federal agencies, state police, financial intelligence units, border customs, you name it.
[Speaker 1] (2:19 – 2:21)
The people actually on the ground doing the work.
[Speaker 2] (2:22 – 2:44)
Right. And our mission today is to explore this data to understand why the very nature of catching bad guys is currently drowning in data and why the old playbook is just burning to the ground. If you were wondering why you should care about the daily operational hurdles of a European intelligence unit, it’s because this shift directly impacts the security of your own community.
[Speaker 1] (2:44 – 2:44)
Absolutely.
[Speaker 2] (2:45 – 2:58)
It dictates the safety of your online shopping ecosystem and the literal mail arriving at your front door. OK, let’s unpack this. But knowing that physical clues are disappearing doesn’t really help us if we don’t know who is making them disappear.
Who’s Really Behind Europe’s Serious Crime
[Speaker 1] (2:58 – 2:59)
Right. You have to know the players.
[Speaker 2] (2:59 – 3:04)
Yeah. We used to just look for massive cartels, but the data shows something much harder to track now.
[Speaker 1] (3:04 – 3:13)
It does. The survey breaks down the perpetrators of serious crimes across Europe, and the distribution is incredibly wide. I mean, we still have the heavy hitters.
[Speaker 2] (3:13 – 3:14)
The big guys.
[Speaker 1] (3:14 – 3:29)
Yeah. Forty-three percent of serious criminal activity is driven by massive, highly sophisticated transnational groups. These organizations operate with the logistics, the payrolls, and the budgets of a Fortune 500 company.
[Speaker 2] (3:29 – 3:31)
Wow. But that’s not even half the threat.
[Speaker 1] (3:31 – 3:37)
No, it’s not. Smaller groups, which the survey defines as three or more people, they account for 30 percent of the threat.
[Speaker 2] (3:38 – 3:38)
OK.
[Speaker 1] (3:38 – 3:43)
And then lone actors, so individuals operating entirely by themselves, make up 27 percent.
[Speaker 2] (3:43 – 3:46)
I have to pause on that split because it seems like a complete logistical nightmare.
[Speaker 1] (3:46 – 3:47)
It really is.
[Speaker 2] (3:47 – 4:03)
I mean, how can one single intelligence agency possibly build an apparatus to handle both extremes? You need a massive international surveillance grid to take down a multinational cartel moving tons of product across oceans.
[Speaker 1] (4:03 – 4:05)
Right. You need satellites and international task forces.
[Speaker 2] (4:05 – 4:17)
But that exact same agency is somehow supposed to be granular and sensitive enough to catch a lone actor radicalizing in a basement somewhere, someone who might not even have a prior criminal record.
[Speaker 1] (4:17 – 4:19)
Yeah, it’s a nearly impossible ask.
[Speaker 2] (4:19 – 4:23)
It pulls an agency’s resources in completely diametrically opposed directions.
Crime and Terror Are Converging
[Speaker 1] (4:23 – 4:31)
It creates a massive operational strain. And the survey reveals a chilling statistic that complicates that dynamic even further.
[Speaker 2] (4:32 – 4:32)
What’s that?
[Speaker 1] (4:32 – 4:42)
Sixty nine percent of the respondents report that collaboration between these criminal syndicates and terrorist organizations has actively increased over the last two years.
[Speaker 2] (4:42 – 4:46)
Wait, really? The gangsters and the terrorists are working together.
[Speaker 1] (4:46 – 4:56)
They are. The lines between the profit driven gangster and the ideologically driven terrorist are blurring. What’s fascinating here is the underlying business logic driving that collaboration.
[Speaker 2] (4:57 – 4:57)
Business logic.
[Speaker 1] (4:58 – 5:01)
Yeah. It is a purely financial, rational market decision.
[Speaker 2] (5:02 – 5:06)
Wait, so ideological terrorists are just like signing corporate contracts with local gangs?
[Speaker 1] (5:06 – 5:16)
In a practical sense, yes. I mean, historically, if a terror network wanted to execute an operation in Europe, they had to build their own bespoke physical infrastructure from scratch.
[Speaker 2] (5:16 – 5:17)
Which takes a lot of time and money.
[Speaker 1] (5:18 – 5:30)
Exactly. They had to smuggle their own operatives across borders, buy their own safe houses, source untraceable weapons themselves. Doing that is incredibly expensive, it is highly visible, and it is very risky.
[Speaker 2] (5:30 – 5:37)
Right, because every time you build a new node in an illicit network, you create a new opportunity for intelligence agencies to spot you.
[Speaker 1] (5:37 – 5:44)
Precisely. So instead of building that expensive, risky infrastructure, terrorists are now essentially subcontracting.
[Speaker 2] (5:45 – 5:45)
Subcontracting, wow.
[Speaker 1] (5:45 – 5:48)
Yeah, they are just leasing it from local criminals who already have it set up.
[Speaker 2] (5:48 – 5:55)
It’s essentially crime as a service, like a dark web Airbnb or an Uber for illicit logistics.
[Speaker 1] (5:55 – 6:07)
That captures the dynamic perfectly. Instead of ideological alignment, it’s purely transactional. I mean, nearly four in 10 of these partnerships, so 39%, are strictly about sharing existing trafficking routes.
[Speaker 2] (6:07 – 6:09)
Wow, just paying a toll to use the road.
[Speaker 1] (6:09 – 6:16)
Basically. And another 21% involves criminals physically conducting operations or attacks on behalf of terror groups.
[Speaker 2] (6:16 – 6:18)
They’re just hiring hitmen, essentially.
[Speaker 1] (6:18 – 6:22)
Exactly. And 19% involves shared money laundering services.
[Speaker 2] (6:23 – 6:27)
So the traditional boundaries are just completely gone. The infrastructure is totally agnostic now.
[Speaker 1] (6:27 – 6:28)
Totally agnostic.
[Speaker 2] (6:28 – 6:37)
A smuggler who specializes in moving illicit goods across a border, I mean, they don’t care about the political ideology of the client holding the cash.
[Speaker 1] (6:37 – 6:38)
They just care about the cash.
[Speaker 2] (6:38 – 6:55)
Right. On Monday, that smuggler uses a hidden compartment in a commercial truck to move a shipment of synthetic narcotics for a local drug kingpin. And then on Tuesday, they use the exact same hidden compartment to move assault rifles for an extremist cell.
[Speaker 1] (6:56 – 7:02)
The transaction is purely financial for the criminal, but the outcome is geopolitical for the terrorist.
[Speaker 2] (7:02 – 7:04)
That is terrifying.
Europe’s Border Threats: Drugs in the West, Weapons in the East
[Speaker 1] (7:04 – 7:14)
It is. And knowing that terror groups and cartels are now sharing the exact same logistical infrastructure, we have to look at exactly where these networks are physically piercing Europe’s borders.
[Speaker 2] (7:15 – 7:16)
Right. The geography of it.
[Speaker 1] (7:16 – 7:20)
Yeah, because the vulnerability of a border is almost entirely dictated by its geography.
[Speaker 2] (7:20 – 7:24)
That makes total sense. The survey breaks down the continent’s top cross-border threats, right?
[Speaker 1] (7:24 – 7:34)
It does. The top three overall are drug trafficking at 51 percent, weapons trafficking at 46 percent, and migrant smuggling at 42 percent.
[Speaker 2] (7:35 – 7:40)
But there isn’t just a blanket threat across the continent. The data shows a pretty massive regional divide.
[Speaker 1] (7:40 – 7:47)
A huge divide. If we connect this to the bigger picture, the mechanism of that divide becomes really clear.
[Speaker 2] (7:47 – 7:48)
OK, lay it out for us.
[Speaker 1] (7:48 – 7:57)
Well, in Western Europe, the primary concern is overwhelmingly drugs. Fifty-eight percent of respondents cite it as their top threat.
[Speaker 2] (7:58 – 8:01)
Because Western Europe represents massive affluent populations.
[Speaker 1] (8:01 – 8:09)
Exactly. High disposable incomes. It is the ultimate destination market for narcotics.
But when you look at Eastern Europe, the pattern completely flips.
[Speaker 2] (8:09 – 8:10)
What’s the top set there?
[Speaker 1] (8:11 – 8:17)
Weapons trafficking jumps to the number one spot at 48 percent, followed closely by migrant smuggling at 45 percent.
[Speaker 2] (8:17 – 8:24)
Because Eastern Europe features these long, highly complex land borders that sit directly adjacent to active conflict zones.
[Speaker 1] (8:25 – 8:31)
Precisely. Eastern Europe is the physical funnel, the gateway, while Western Europe is the destination market where the product is finally sold.
[Speaker 2] (8:32 – 8:33)
Got it. The funnel and the market.
Ports, Borders and the Mailroom: Where Criminals Slip Through
[Speaker 1] (8:34 – 8:47)
And when the survey asked these law enforcement professionals to identify the top physical entry points these criminals exploit to get through that funnel, the answers really highlight how modern infrastructure is being weaponized against us.
[Speaker 2] (8:47 – 8:50)
Right. Because they are using the systems we rely on.
[Speaker 1] (8:50 – 8:55)
Exactly. Number one is shipping ports at 28 percent. Number two is land borders at 20 percent.
[Speaker 2] (8:55 – 9:04)
Here’s where it gets really interesting. The number three physical entry point at 15 percent is the postal and parcel system.
[Speaker 1] (9:04 – 9:06)
Fifteen percent. It’s staggering.
[Speaker 2] (9:06 – 9:17)
Fifteen percent. So nestled right between your next day Amazon packages and the birthday card from your grandmother, there could be synthetic drugs, counterfeit pharmaceuticals or components for an assault rifle.
[Speaker 1] (9:17 – 9:19)
Yep. Moving right along the same conveyor belt.
[Speaker 2] (9:19 – 9:26)
But I have to push back on this. If we know the shipping ports and the mail systems are the entry points, why not just track the digital manifests?
[Speaker 1] (9:27 – 9:27)
What do you mean?
[Speaker 2] (9:28 – 9:36)
Surely massive million dollar shipments of contraband leave some sort of logistical paper trail that customs can flag, right?
[Speaker 1] (9:36 – 9:43)
You would think so. But criminals are actively exploiting the mathematical impossibility of comprehensive physical inspections.
[Speaker 2] (9:44 – 9:45)
Mathematical impossibility?
[Speaker 1] (9:45 – 9:48)
Yeah. They use a logistical practice called bulk breaking.
[Speaker 2] (9:48 – 9:49)
Okay. How does that work?
[Speaker 1] (9:50 – 10:10)
Well, imagine a cartel wants to move a million dollars worth of synthetic drugs. Instead of trying to smuggle that in a single shipping container, which represents a single point of failure that a customs agent might flag on a manifest, they break that shipment down. Into smaller boxes?
Into 5,000 individual small parcels. Oh, wow.
[Speaker 2] (10:10 – 10:24)
So they might rent a warehouse just outside the border, divide the product into tiny padded envelopes, use automated postage software to print 5,000 unique shipping labels with stolen identities, and just drop them in 500 different mailboxes.
[Speaker 1] (10:24 – 10:28)
Yeah. That’s exactly how it works. They distribute the risk across the entire postal network.
[Speaker 2] (10:28 – 10:29)
That is devious.
[Speaker 1] (10:29 – 10:41)
They know customs officials are playing a volume game against next day delivery guarantees. You literally cannot open, swab, and inspect millions of packages moving on high speed conveyor belts.
[Speaker 2] (10:41 – 10:45)
Right. If they checked everything, the global economy would grind to a halt.
[Speaker 1] (10:45 – 10:54)
Exactly. The sheer velocity of modern commerce provides the perfect cover. The physical borders are effectively overwhelmed by sheer volume.
[Speaker 2] (10:55 – 11:04)
Honestly, it’s hard enough for customs to find my lost luggage, let alone intercept 5,000 tiny envelopes of contraband scattered across a continent.
[Speaker 1] (11:04 – 11:06)
It’s a needle in a haystack of needles.
Encryption and Burner Phones Are Beating Traditional Surveillance
[Speaker 2] (11:06 – 11:19)
Right. So if the physical borders are effectively overwhelmed by volume, investigators naturally have to rely on digital intelligence to track these suspects. I mean, if you can’t catch the package, you catch the communication about the package.
[Speaker 1] (11:20 – 11:21)
That was the old strategy, yes.
[Speaker 2] (11:21 – 11:27)
So the survey reveals that there is a massive systemic failure happening in traditional investigative tech.
[Speaker 1] (11:27 – 11:39)
The survey points to a few very specific technological culprits. 46% of agencies blame the widespread use of end-to-end encryption and virtual private networks, or VPNs.
[Speaker 2] (11:39 – 11:41)
Okay, that makes sense. Everyone uses encrypted messaging now.
[Speaker 1] (11:41 – 11:47)
Right. And another 40% cite the shift to alternative networks, like criminals using satellite communications.
[Speaker 2] (11:47 – 11:49)
Wow, satellite networks.
[Speaker 1] (11:49 – 11:59)
Yeah. Then another 40% point to device proliferation, meaning suspects aren’t just using one phone anymore. They’re communicating across smartwatches, connected vehicles, gaming consoles.
[Speaker 2] (11:59 – 12:01)
Sending messages through a video game chat.
[Speaker 1] (12:01 – 12:08)
Exactly. And 38% say criminals are simply rapidly swapping out burner phones faster than a legal warrant can even be drafted.
[Speaker 2] (12:08 – 12:10)
So what does this all mean?
[Speaker 1] (12:10 – 12:10)
In what sense?
The Data Fusion Gap: Piecing Together a Fragmented Digital Trail
[Speaker 2] (12:11 – 12:26)
Well, if I’m a veteran detective and I have spent 20 years mastering street smart interrogation skills, reading body language, flipping informants, is my entire career suddenly obsolete just because I don’t know how to trace a decentralized finance blockchain ledger?
[Speaker 1] (12:27 – 12:39)
It’s a fair question. Unless an investigator has highly specialized training to connect that digital wallet back to a real-world identity, the suspect simply closes their laptop and the evidence vanishes into the digital ether.
[Speaker 2] (12:39 – 12:44)
So police need to piece together a suspect’s digital footprint from incredibly fragmented clues.
[Speaker 1] (12:45 – 12:45)
Very fragmented.
[Speaker 2] (12:46 – 12:49)
But human brains aren’t built to process this scale of data.
[Speaker 1] (12:49 – 12:57)
They are not. Which is why 55% of agencies report that they need the ability to fuse diverse data sources.
[Speaker 2] (12:57 – 12:58)
Data fusion.
[Speaker 1] (12:58 – 13:16)
Think about it. If you can’t read the text message because it’s encrypted gibberish, you need to know exactly where the phone was physically located when the message was sent. Right.
You need to know who owned the car parked next to that location and whose credit card bought the gas for that car an hour earlier.
[Speaker 2] (13:16 – 13:19)
You have to piece the whole world together around the message.
[Speaker 1] (13:20 – 13:33)
Exactly. You have to combine SIGINT with open source intelligence OSINT, like public social media posts and digital forensics. But these agencies largely lack the correlation technology to actually do it.
[Speaker 2] (13:33 – 13:46)
And the regional tech gaps are massive here too. I mean, looking at the survey, in Western Europe, 49% of agencies report a severe lack of digital forensics correlation. And in Eastern Europe, 53% lack adequate video analytics capabilities.
[Speaker 1] (13:46 – 14:01)
Which leads to what is arguably the most tragic statistic in this entire deep dive. Because these agencies lack the automated technology to correlate all this fragmented data, human investigators are forced to manually scrub through terabytes of information.
[Speaker 2] (14:01 – 14:05)
Manually. Just scrolling through spreadsheets and video feeds.
[Speaker 1] (14:05 – 14:12)
Exactly. And as a result, investigative teams estimate they lose, on average, 25% of their operational time.
[Speaker 2] (14:13 – 14:21)
25%. Think about what that actually looks like in practice. That is the equivalent of having a quarter of your entire police force out sick every single day.
[Speaker 1] (14:22 – 14:23)
It’s a massive drain on resources.
Conclusion: Breaking Down Data Silos Is the Only Way Forward
[Speaker 2] (14:24 – 14:31)
Well, to summarize the journey of this deep dive, modern safety isn’t just about local mayors promising to put more squad cars on the street.
[Speaker 1] (14:31 – 14:32)
No, not at all.
[Speaker 2] (14:32 – 14:41)
That is a comforting but deeply outdated idea. The threat we are facing is borderless, it is entirely digitized, and it is moving at the speed of a microchip.
[Speaker 1] (14:41 – 14:42)
It really is.
[Speaker 2] (14:42 – 14:55)
Breaking down these data silos and adopting advanced AI isn’t just a fancy tech upgrade for police departments. It is literally the only way to protect your community, secure your ports, and ensure the safety of the mail arriving at your house.
[Speaker 1] (14:56 – 15:11)
And I want to leave you, the listener, with a final scenario to ponder on your own. What happens to the global landscape when entirely unregulated, deeply interconnected terror and criminal networks begin fully automating their own illicit operations with advanced AI?
[Speaker 2] (15:11 – 15:12)
Oh, wow.
[Speaker 1] (15:12 – 15:28)
If cartels begin using AI to autonomously optimize their smuggling routes in real time based on weather and police deployment, or to write custom unbreakable encryption protocols on the fly, or to automatically launder money across decentralized blockchains at the speed of light, I mean, how will humanity ever catch them?
[Speaker 2] (15:29 – 15:37)
That is a terrifying technological arms race to picture. Thank you so much for joining us on this deep dive. Keep asking those tough questions.
The post European Law Enforcement Survey 2026: Key Finding Audio Brief appeared first on Cognyte.
Article Link: https://www.cognyte.com/blog/european-law-enforcement-survey-transcript/