RAMB      LL CASE STUDY REPORT Job      External Evaluation of Frontex Customer Frontex Type     Reporting template Case     Risk Analysis Date     13/04/2015 By       Tsvetelina Blagoeva 1.       Introduction The present case study is an in-depth investigation into risk analysis for the purpose of exploring the relation between the activities implemented by Frontex and the achievement of the Agency’s objectives. The case study focuses the data collection and the analysis on specific and explicit contribution chains from the actual activities to their long term results and impacts. Key to this analysis is the assessment of the credibility of the identified contribution links, based on the triangulation of different data sources, exploration of alternative explanations, external and internal drivers. 2.       Scope and methodology 2.1      Policy background The Frontex Regulation tasks the Agency with carrying out risk analysis activities and using their outputs as the basis of, among else: 1  Joint operations and pilot projects 2  Development of trainings 3  Deployment of Rapid Teams rd            4  Deployment of liaison officers to 3 countries Frontex carries out it risk analysis activities on the basis of a Common Integrated Risk Analysis Model (CIRAM). CIRAM was originally developed in 2002 by a European Council Expert Group and has been implemented by the Risk Analysis Unit (RAU) since 2004. The results of the risk analysis activities can be classified as strategic risk analysis and operational risk analysis products, which provide actionable intelligence on a broad range of subjects related to the management of the external borders of the European Union. In order to ensure that the Agency can carry out its mandate for the provision of risk analysis, Member States are responsible for providing situational updates and information 5 on potential threats at the external borders of the EU to Frontex. This is implemented through the Frontex Risk Analysis Network (FRAN). 1 Council Regulation (EC) No 2007/2004 (as amended), Art 3(1) para 4 2 Ibid., Art 4 para 6 3 Ibid., Art 8(d) (3) 4 Ibid., Art 11(3) 5 Ibid., Art 4 para 5 1/15

RAMB     LL In the context of its risk analysis activities, the Agency may also assess the capacity (equipment, resources) of the Member States to respond to challenges, threats and pressure at their external borders. When joint operations are ongoing, a dedicated team from the Risk Analysis unit monitors and analyses the operation. The Frontex Regulation specifies that personal data obtained in the context of a joint operation can be used for the preparation of risk analyses; however, in 6 the result of the risk-analyses, the data shall be depersonalised. As per the provisions of Regulation 1053/2013 on the evaluation and monitoring of the Schengen acquis, Frontex is to provide risk analysis to the annual evaluation programme and the planning of on-site visits.7 2.2     Scope of the case study The case study of Frontex’s risk analysis activities is to focus on how the Agency implements its operational and strategic risk analysis activities and explore how the outputs of these activities contribute to the overarching objectives of the agency. In order to map the links between resource inputs and results (see intervention logic), the case study will start with a discussion of the implementation of CIRAM and FRAN and trace their outputs onwards. 2.3     Intervention logic 6 Frontex Regulation, Article 11(c)(3) 7 Council Regulation (EU) No 1053/2013 of 7 October 2013 establishing an evaluation and monitoring mechanism to verify the application of the Schengen acquis and repealing the Decision of the Executive Committee of 16 September 1998 setting up a Standing Committee on the evaluation and implementation of Schengen 2/15

RAMB              LL Figure 1: Intervention Logic Strategic and Actionable operational intell igence is incorporated into             decisions are made FX develops and                                                      on the basis of strategic risk manages FRAN                                                       evidence-based analysis                                                       Efficient high and intelligence . MS collect and                                                                                                                     uniform level of provide data to FX                                                                                                                  control along the FX gathers     r                     Actionab le external border is ensured information from       Actionable      intelligence is                                 Optimal allocation MS, EU bodies and     intelligence is incorporated into                                  of resources for other international      available     operational risk                                 border checks and organisations                            analysis                                       surveillance JO participants collect and provide                                                                                                                   Bona fide border data to FX                                                                                                                        crossings are FX develops and                      Operational risk                                                         facilitated implements CIRAM                            analysis                     Operational are used in the              decisions are based development of               on evidence-based Operational Plans                  intelligence D      Activities Outputs Outcomes Results Impacts 3/15                                                                      Rambøll Management Consulting A/S DK reg.no. 60997918

RAMB    LL 2.4     Contribution story The link between the starting points for Frontex’s risk analysis activities and the end results and impacts can be traced through the following contribution hypothesis. IF FX develops and manages FRAN AND develops and implements CIRAM AND gathers information from MS, EU bodies and other international organisations, THEN actionable intelligence is available. IF actionable intelligence is available AND incorporated into strategic risk analysis, THEN strategic and operational decisions are made on the basis of evidence-based intelligence. IF actionable intelligence is available AND incorporated into Operational risk analysis AND these are used in the development of Operational Plans, THEN operational decisions are based on evidence-based intelligence. IF strategic and operational decisions are made on the basis of evidence-based intelligence THEN there is optimal allocation of resources for border checks and surveillance. IF there is optimal allocation of resources for border checks and surveillance THEN efficient high and uniform level of control along the external border is ensured AND bona-fide border crossings are facilitated. 2.5     Methodology The case study is based on evidence collected through desk research covering both publicly available and restricted documents as well as on interviews with the following sources:     FRAN participants from 2 MS     Representative of a MS hosting a JO     Head of Operational Risk Analysis     Representative of Strategic risk analysis     Representative of Frontex involved in Annual Programme of Work process     Representative of Frontex involved in JO Hermes 3.      Findings 3.1     Main activities The risk analysis activities of Frontex are based on the application of the Common Integrated Risk Analysis Model (CIRAM) for the collection and processing of data and the operation of the Frontex Risk Analysis Network (FRAN). Based on data collected through FRAN and reported from ongoing Joint Operations, Frontex’s Risk Analysis Unit (RAU) produces a range of strategic and operational risk analysis products, discussed in more detail under Sections 3.2 and 3.3. 4/15                                                                              Rambøll Management Consulting A/S DK reg.no. 60997918

RAMB    LL 3.1.1   Frontex Risk Analysis Network (FRAN) The Frontex Risk Analysis Network (FRAN) represents the EU borders analytical community by providing a link between the intelligence networks of individual European countries. FRAN provides the framework for sharing knowledge and producing analytical and strategic reports on the current state of play at the external borders.     monthly statistical data reporting on seven key indicators: (1) detections of illegal border-crossing, (2) refusals of entry, (3) detections of illegal stay, (4) asylum applications, (5) detections of facilitators, (6) detections of forged documents and (7) return decisions and effective returns     bi-monthly qualitative data reporting on: o the situation in third countries concerning issues affecting EU border security or illegal migration to the EU o the situation regarding illegal migration, cross-border crime activities and border- security issues along the external border of the EU o the situation with regard to detection of persons staying illegally within the EU border o national institutional changes influencing checks and surveillance along the external border as well as national migration policy – e.g. emergence of factors that can act as pull factors The FRAN Information Exchange System Annual Report for 2014 assess that since the beginning of information exchange in 2008, the timeliness of the monthly statistical reporting has been steadily improving – e.g. while in 2011 the number of reports uploaded within the deadline was on average 21, in 2013 this number has jumped to more than 25 and this positive trend was reported by Frontex RAU staff to have continued in 2014. So while in 2008 54% of the 360 reports were received on time, in 2013 87% of the 366 reports were timely. FRAN MS members assessed the operation of the network positively, noting the progressive improvement since its establishment and the value it adds in terms of availability of up-to- data of relevance for the management of the external borders. 3.1.2   Common integrated Risk Analysis Model (CIRAM) CIRAM is the framework under which Frontex and Member States work together in the area of risk analysis. Before CIRAM, data collection was incomplete and there were substantial differences in e.g. the definitions and baselines by different MS. In the development of CIRAM, an agreement was reached on a common set of indicators and on a regular process for data collection. The Frontex Regulation mandates the development and use of CIRAM by Frontex and while it does not oblige MS to use the model, a RAU representative assessed that many do. 8 The terminology defined in CIRAM is used by all MS in their provision of data and as confirmed 8 No overview of the exact number is available. 5/15

RAMB     LL by a FRAN member interviewed for the case study, the CIRAM methodology enhances the cooperation between MS and with RAU by enabling them to “speak in the same language”. While the contents of CIRAM have evolved over time to reflect the requirements and mandate of EU external border management, its fundamental purpose remains to establish a clear and transparent methodology risk analysis which would serve as a benchmark for analytical activities, thus promoting harmonisation and preconditions for efficient information exchange and cooperation in the field of border security.9 CIRAM relies on a four-tier access control model that involves gathering information from and disseminating risk analysis to a wide range of partners. Partners include border control authorities both within the Schengen area and at the external borders (e.g. Customs) as well as Member State actors in cooperating neighbouring countries and non-EU states farther afield. The main inputs for the Risk Analysis activities conducted under CIRAM are data inputs from the ongoing Joint Operations and the data provided through FRAN: In addition, RAU takes into account information identified in media reports of relevance. The strategic analysis largely rely on FRAN data, since data derived from joint operations is limited to that area and that time, whereas FRAN data offers a comprehensive overview on a monthly basis, also on sections of the external border where there are not any ongoing joint operations. Regarding asylum applications, Frontex try to collaborate with EASO which has a more detailed data collection. The collaboration has led to an improvement of the data available to Frontex compared to the data available from other sources. In addition, since January 2014 FRAN has started collecting data on passenger flows at the external borders, but the data is not yet available for all MS and is thus not yet possible to have an EU-wide overview of this indicator. 3.2     Main outputs In 2014 Risk Analysis Unit (RAU) produced:     60 strategic reports including 10 regular annual reports, 3 tailored reports, 14 quarterly reports with situational updates and analysis in MS, and selected regions neighbouring the EU, 39 strategic monitoring reports;     456 analytical products supporting the planning, implementation and evaluation of Joint Operations;     25 reports/contributions of other types, including briefings for the Agency’s Management, the EU Commission and others;     tested and launched a new monthly process of analytical reporting (in total 7 reports of various types covering 4 months); 9 Frontex 2012, Guidelines for risk analysis units 6/15

RAMB     LL     published 7 strategic reports for the general public via the Agency website.     4 regular Frontex Risk Analysis Network meetings,     2 meetings of the specialist network with MS on EU Document Fraud,     2 Tactical Risk Analysis meetings,     9 regional expert meetings/conferences and 2 regional technical workshop was organized.     In line with the tasks of Risk Analysis Unit within EUROSUR, in 2014 the following were undertaken: delivery of the content 276 products and basic services, completion of the Catalogue of Analysis Layer Products and Services update of the Eurosur Event Catalogue, finalization of the impact levels methodology and its implementation to land and sea border sections, pilot deliveries of analysis tools (led by ICT, with RAU inputs).10 Overall, the timeliness and quality of the products was assessed positively by both MS and Frontex users of the products. For the purpose of the analysis, additional details and characteristics of selected outputs selected for the case study are discussed in the next section. Overall, the quality of the products was assessed by the interviewed MS representatives as high and improving every year. 3.3     Analysis of processes connecting outputs, outcomes and results 3.3.1   Strategic Risk Analysis The goal of the strategic risk analysis activities of Frontex is to build up a picture of the situation, patterns and trends in irregular migration and cross-border criminal activities at the external borders, including trafficking in human beings. In the following, several different strategic risk analysis products are going to be discussed in more detail:      The Annual Risk Analysis report (ARA)      The Assesment of Operational Deployment document (AOD)      FRAN reports 3.3.1.1 Annual Risk Analysis The Frontex Annual Risk Analysis (ARA) presents a European summary of trends and developments along the external borders of the Member States of the EU. This analysis is based on information provided to Frontex by the EU Member States and Schengen Associated countries throughout the year, as well as information collected during Frontex Joint Operations and from open sources. The analysis starts with an overview of the situation before the border based on data for Schengen uniform visas. It then looks at the situation along the external border, based on trends in regular passenger flows, detections of illegal border-crossing, clandestine entries and refusals of entry. Finally, the report provides an update on the situation regarding persons staying illegally in the EU and third- country nationals returned.11 10 Products for the CPIP are not included in the list of products 11 Annual Risk Analysis 2014 7/15

RAMB     LL The ARA was deemed by interviewees to be of high quality and published in a timely fashion. The ARA is used by Frontex and MS in the process of decision involved in the planning of Frontex’s activities through the Programme of Work discussions and the ensuing bilateral talks with the MS. For example, in the Netherlands, the ARA is used in order to identify the need to support other countries in border guard activities through JOs due to pressure on the EU external borders. The ARA also provides MS with information which they use in the planning of their national border control and surveillance activities and connected policy areas. 3.3.1.2 Assessment for Operational Deployment The Assessment for Operational Deployment (AOD) is part of the Programme of Work of Frontex published in September. The assessment is not publicly available, as it contains confidential information. The aim of this risk analysis product is to describe the latest trends concerning the irregular migratory situation as an update of the Annual Risk Analysis, which is released in March. The Assessment is part of the Operational Planning Cycle of the Agency, and is produced in order to provide the basis for the bilateral talks with Member States to be held in October and the Plan of Operations. The AOD focuses on the border sections or border areas of the external borders of the EU which are likely to be affected by significant irregular migration flows and cross-border crime. The document gives a forecast on related modi operandi and phenomena, which require the coordination of reinforced operational measures at the external borders of Member States as one of the first steps of operational planning. The AOD is largely based on the data exchanged within the Frontex Risk Analysis Network (FRAN) and is also complemented with data gathered through the Joint Operation Reporting Application (JORA) from the areas of ongoing operational activities coordinated by Frontex and data made available in Eurosur. In addition, this report takes into account the Pulsar data set for air borders12 and the main findings of Frontex strategic reports such as European Document Fraud (EDF), as well as relevant Joint Operation reports and information collected through operational activities, in particular from debriefing irregular migrants. The AOD also features a forecast of migration trends, based on the extrapolation of current trends and patterns that are related to known factors that constitute certainties.13 When it comes to priorities of recommended measures/actions, the AOD takes into consideration the major risks identified in the Annual Risk Analysis report, which have been reviewed according to the situation during the first half of the year and information collected through ongoing operational activities. The recommendations try to address the pressure from the main identified migratory routes in the most cost effective way by specifying i.e. the area where activities should take place, the best possible period in which to place resources, as well as the type of human and technical resources necessary. 12 The Pulsar programme facilitated the weekly operational data collection from EU airports 13 Assesment of Operational Deployment 2015, Reg. No R098/2014,RAU/S2 8/15

RAMB     LL 3.3.1.3 FRAN reports FRAN Quarterly is a public available report that aims to provide a regular overview of irregular migration at the EU external borders, based on the irregular migration data exchanged among Member State border-control authorities within the cooperative framework of the Frontex Risk Analysis Network (FRAN) and its subsidiary, the European Union Document-Fraud Risk Analysis Network (EDF-RAN).14 The main purpose of the FRAN Quarterlies is to provide: 1. Feedback to the FRAN community in the context of information exchange; 2. A periodic update to the situational picture of irregular migration at EU level; and 3. Material for constructive discussion on reporting protocols and related trends and patterns. The FRAN Quarterly report is intended to simultaneously serve two objectives: firstly – to provide a clear summary of the situation at the external border of the EU, and secondly – to serve as an archive for future reference and comparative analyses. Feedback from interviewees confirmed that the reports fulfil their purpose. Several concrete examples were offered of the process through which data collected and summarised through FRAN guides the strategic and operational decisions of MS with regard to their border management activities. For example, information from the FRAN reports on the inland movements of migrants is used in the decision making process on allocation of resources – e.g. both the Dutch and the Finnish members of FRAN flagged up the noted trend of Kosovarians moving to Germany as a being relevant for the operational planning of their national border management authorities. In the Netherlands, the data provided by FRAN network on the increase of Eritreans and Syrians entering the EU in Italy prompted several steps: -    Frontex risk analyses have previously identified a route from those disembarking on the Italian islands or coast moving to the mainland and specifically Milan which is a hub for secondary movements. -    Based on this information, the Dutch Risk Analysis unit recommended the increased monitoring of flights from Italy and especially Milan for the detection of potential irregular travellers of Eritrean origin. -    Furthermore, in response to this information the Dutch Border Guard increased its capacities for random inland security checks at the Belgian border area, knowing (based on Frontex Risk Analysis) that this would be the route for entering the Netherlands on land, rather than e.g. through the German border area. The measures were deemed by the MS to have been effective in countering the flow of irregular migrants. 14 FRAN Quartelry Q3/2014 9/15

RAMB      LL In Finland, the FRAN member briefs the Finnish risk analysis unit on the contents of the monthly report from Frontex in order to inform them of the operational situation. Content deemed relevant for Finland’s situation awareness integrated into the MS’s quarterly and especially yearly products in order to provide a layer of European context to their national and regional analysis. While migratory pressure is mostly on the southern external border rather than in the north where Finland is located, the trends identified in strategic risk analysis are used by the MS in the decision making process on joint operations in the south they can contribute to. Based on the strategic risk analysis products, the Finnish Border Authority can, for example, identify the direction in the Mediterranean from which the impacts to Finland are the greatest and recommend that Finnish resources are used in an operation targeting this area. The same approach was reported to be used in the Dutch border management authority. 3.3.2   Operational Risk Analysis In addition to building up a bigger picture of the main trends in irregular migration and other phenomena in the medium and long term, Frontex also pays close attention to the daily developments in the areas of its joint operations at the external borders. Operational personnel made available by the Member States report back constantly via the HO coordination centres on noted changes in the modus operandi of facilitation networks and other factors affecting joint operations. 3.3.2.1 Tactical Focused Assessment While ARA and the AOD provide the basis for decision-making with regard to commissioning of joint operations, the Tactical Focused Assessment (TFA) is the risk analysis product that serves as the basis for the preparation of individual operations. The TFA covers any recent developments relevant to the scope of the JO, since almost half a year passes between the AOD and the actual start of the operation. The TFA is used to finalise the operational plan to determine exactly what types of technical equipment are most appropriate for a given operation - whether to use fast boats or larger craft or whether helicopters or aeroplanes would be best suited to a given environment, for instance. The precise location and time-scale of joint operations are also determined largely by the TFA. 15 The TFA offers recommendations regarding, i.e.:     the scope of the operational area     the deployment of assets     the deployment of experts in information gathering     the exchange of information and intelligence 3.3.2.2 Biweekly reports and Analytical Warning assessments During JOs, de-briefers carry out informal, voluntary and anonymous interviews with migrants apprehended during their attempts to cross the external board in an irregular 15 Tactical Focussed Assessment on Irregular Migration towards the Italian Sea Borders of Apulia and Calabria (Ionian Sea)Warsaw, 21-05-2012, Reg. No 6956, RAU S2/EC/DM 10/15