Tag Archives: Spain

COVID-19 lockdown measures to affect criminal patterns across Europe – Europe Analysis

Executive Summary

Since the introduction of COVID-19 restrictions in February-March, multiple countries across Europe reported a significant drop in home burglaries, violent robberies, and thefts. Meanwhile the region saw an increase in burglaries at commercial establishments, theft of medical supplies, as well as racial and domestic violence.

The expected economic downturn from the lockdown will likely lead to a return to pre-crisis rates or an increase in robberies and other violent crimes and in anti-establishment sentiments while presenting human traffickers new opportunities in the long-term.

In the short-to-medium term, the disruption of narcotics supply chains will likely lead to low-level drug dealers shifting to alternative crimes, such as burglary and armed robberies, and the sale of more dangerous alternatives. Going forward, supply shortages and increasing demand for illicit drugs may increase gang-violence as restrictions begin to ease.

Nonessential travel within Europe should be voided as per government directives amid COVID-19, while remaining cognizant of local criminal activity.

Current Situation

Decrease in home burglaries, violent robberies, and drug trafficking

Multiple countries have reported a shift in criminal activity since February when countries began implementing COVID-19 precautionary measures.

Spanish police recorded a roughly 50 percent decline in criminal offenses compared to the same period in 2019 since the partial lockdown on March 14.

French authorities reported a 45 percent drop in crime rates between March-April, with the most significant decreases seen in burglaries of accommodation, robberies with weapons, and vehicle thefts.

Italy witnessed a 72 percent decrease in home robberies in March 2020 compared to 2019, while other robberies dropped by roughly 54 percent and drug-related offenses by 46 percent.

Dutch, German, Greek, Irish, and Swedish authorities witnessed a similar reduction in thefts and burglaries, with thefts in Greece dropping by 25 percent as of April.

Slovenia witnessed a recent decrease in burglaries, robberies in residential areas, and property crimes compared to 2018.

Knife crime reportedly declined in London in the latter half of March, while public violence and home burglaries decreased across the UK.

The French anti-narcotics agency, OFAST, reported in early April that the suspension of air traffic significantly disrupted the inflow of cocaine. Reports also indicate that supply shortages have also been recorded in Germany since the closing of borders. Nonetheless, trafficking networks have attempted to smuggle drugs via cargo. In the UK, drug treatment experts warned that a drop in the supply of narcotics has resulted in users turning to more dangerous alternatives such as the synthetic opioid Fentanyl, which can be obtained with a prescription.

Increase in commercial burglaries, theft of medical supplies, domestic and racial violence

Despite the decrease in certain crimes, other offenses have witnessed an uptick.

Large numbers of scams, thefts, and the illegal sale of medical supplies were recorded across Europe in recent months. Three pharmacists in southern France were arrested for illegally reselling face masks, as per March 28 reports. Individuals were arrested in Hungary and the Netherlands for scamming individuals and hospitals into buying non-existent protective masks. On March 23, oxygen canisters were stolen from a hospital in the UK. Multiple incidents of verbal and violent attacks on healthcare workers and vandalism of ambulances were also reported across the region. Interpol stated that organized crime is thriving by trading in counterfeit goods due to an increased demand for medical and hygiene products.

Multiple countries recorded an increase in burglaries at closed commercial establishments, pharmacies, and other stores that remain open, with Madrid recording nine pharmacy robberies in one day. In Italy, theft and robbery of pharmacies has only decreased by about 13 percent compared to the overall drop of robberies of between 54 and 72 percent. Meanwhile, authorities in Sicily bolstered security near supermarkets and grocery stores as a result of an uptick in shoplifting.

There are also reports of organized criminal groups across southern Italy using the situation to extort local enterprises in need of short-term loans to cover the commercial losses.

In terms of anti-foreign sentiment, there have been a number of notable incidents targeting individuals of Asian descent in recent weeks. In the UK, the owner of a Chinese restaurant was attacked by a group in Hertfordshire, before being asked if the victim had COVID-19. An individual of Asian descent was assaulted in Munich, Germany, with the assailant spraying disinfectant in the victim’s face while yelling “corona.”

Finally, countries across Europe have reported a surge in domestic violence since the start of lockdowns. Within the first week since March 17, there was a 32 percent increase in France’s domestic violence cases and a 36 percent increase in Paris. Spain witnessed an 18 percent increase and the UK a 25 percent increase in calls and online requests concerning domestic abuse since the beginning of the lockdown.


Assessments & Forecast

Economic downturn resulting from lockdown to increase domestic burglaries, property vandalism, and organized crime in the medium-to-long term

Given that the lockdowns have significantly altered the activity of the public and criminals alike, the drop in residential burglaries, violent theft, public violence, and knife crimes is a direct effect of the quarantine measures limiting the opportunities for crimes of this nature. Therefore, it is unlikely for this trend to persist as restrictions begin to ease.

On the contrary, with the economic impact of the lockdowns likely to be felt well beyond their removal, domestic burglaries, thefts, and ATM robberies are liable to gradually rise following the easing of restrictions.

With studies following the economic crash in 2008 demonstrating a correlation between rising homicide and assault rates and economic downturns, the expected economic crisis is also liable to trigger an increase in violent crimes, especially among relatively socioeconomically underdeveloped communities. As a result of economic stress, violent robberies in relatively wealthier neighborhoods and vehicular theft are liable to rise as a means to earn money.

With certain sections of the society, especially urban youth, being likely to be disproportionately affected by the economic slowdown, these worst affected groups are liable to increasingly engage in criminal behavior. Rising poverty and unemployment resulting from the lockdowns are likely to create opportunities for organized criminal networks to increase trafficking activities and recruitment. Countries that already had a significant presence of organized crime are liable to witness increased activity. As demonstrated in southern Italy, such groups are liable to take advantage of the increased potential for human smuggling, extortion, racketeering, and money laundering, embedding themselves in local economies for the long-term. This may be exacerbated as criminal groups look to gain a footing in local businesses in order to benefit from any potential government bailouts which may look to help small businesses and the self-employed.

Popular discontent among the sectors of society most affected by job cuts and economic downturn will likely result in increasing anti-establishment sentiments and resentment towards governments and certain organizations. Companies that undertook more severe job cuts and failed to provide employees with adequate compensation are liable to be the primary targets of protests and vandalism in the months following the removal of lockdown measures.

Illicit drug shortages to see low-level dealers shift to alternative crimes in short-to-medium term and increase gang violence in the long-term

In addition to international border restrictions having significantly impacted the supply of illicit drugs from South America and Asia, they are likely to have reduced access to chemical precursors used in the production of methamphetamine, heroin, and cocaine that are largely procured from China. Given that travel restrictions to and from China were among the first to be introduced, the production of drugs has likely been impacted since January. The liquidity of trafficking groups has also likely been severely affected, especially among the mafia of Albania and Italy, with merchants unable to pay extortion fees amid lockdowns.

Due to movement restrictions during lockdowns, low-level criminals, who otherwise rely on the sale of drugs on the streets, are liable to resort to the other crimes, such as theft of medical supplies and burglaries or armed robbery to maintain a source of income. Additionally, due to shortages in the supply of heroin, dealers may also resort to the sale of more dangerous alternatives like fentanyl, which are easier to procure, store, and transport in smaller batches. In addition, supply chain issues will likely put considerable pressure on any domestic supplies in Europe, most likely Cannabis, which can be grown in makeshift greenhouses. This may catalyze a short term increase in local production, especially with police likely not focusing on such issues at present.

As restrictions begin to ease, while trafficking routes for illicit drugs will open up, the demand for cocaine and heroin is likely to be significantly higher than supply, especially in Western Europe. The resulting high prices are likely to lead to violent confrontations between gangs fighting over control of the limited supplies. With this, gun violence and homicide rates could see a rise following the reopening of borders. This is likely to be primarily focussed in urban and suburban areas that typically see high levels of gang activity anyway, as well as potentially in major port towns.

Anti-foreign attacks to recur amid COVID-19 and after opening of borders

That attacks against individuals of Asian descent were recorded in multiple countries early on in the outbreak indicates that anti-Asian sentiments are liable to persist beyond the immediate crisis, especially as multiple countries begin to question China’s handling of the crisis. This is liable to raise perceptions of a deliberate attempt by China to mismanage the pandemic, in addition to fears of Asians being carriers of the virus. Increased rhetoric by international political leaders sometimes referring to the virus as ‘Chinese virus’ is liable to further strengthen xenophobic sentiments.

This increases the likelihood of Asian-owned companies being the target of attacks, vandalism, and protests by nationalist and xenophobic groups. As quarantine restrictions ease, the risk of foreign nationals operating or residing in Europe being verbally or physically harassed is liable to persist into the medium-term. Furthermore, Asian-linked companies and enterprises may witness decreased sales due to such sentiments.

Finally, there remains a likelihood of general xenophobic sentiments persisting due to the fear of foreigners being virus carriers, as evidenced with French visitors being harrassed in the German border town of Gersheim in April. This may result in an overall decrease in intra-European travel and tourism into the medium-term, as well as travelers being subject to harassment and abuse.


Avoid nonessential travel within Europe as per government directives amid COVID-19 while remaining cognizant of local criminal activity.

Remain cognizant of possible scams and sale of counterfeit medical and hygiene supplies.

Foreign residents across Europe are advised to maintain heightened vigilance due to the elevated potential for racially motivated harassment.

Facilities that are currently non-operational due to COVID-19 restrictions are advised to take additional precautions against possible vandalism and burglaries.

Barcelona stabbing, one year after La Rambla attack, underscores continuing link between psychological instability and militant style attacks – Spain Analysis

Current Situation

On August 20, around 05:00 (local time), an individual armed with a knife reportedly attempted to enter a police station in Cornella de Llobregat, Barcelona and attack personnel, while shouting “Allahu Akbar”, before being shot dead. Reports indicate that the attacker was of Algerian origin and had lived in the area for several years.

The incident is reportedly being treated as a militant attack by authorities. However, police have claimed that they have no reason to believe that there are any direct links to major militant networks or that the assailant was connected to the cell that carried out the Barcelona attacks one year earlier. In addition, the testimony of his ex-wife indicated that the attacker had recently come out as homosexual, and was reportedly experiencing serious psychological instability and was suicidal due to confusion over how this could fit in with his Muslim faith. Some sources within the investigation have claimed that they do not believe the attack to be linked to jihad.

On August 16, a pro-Islamic State (IS) group published a poster on social media calling for attacks targeting police in Spain in both English and Spanish.

Click here to see Map Legend 


The August 20 attack is the latest in a series of violent or militant-related incidents involving North Africans or individuals of North African origins in south and south-west Europe over the past year.

In addition, on July 22, a 29-year old Canadian national of Pakistani origin, Faisal Hussain, killed two and injured three in a shooting in Greektown, Toronto. Hussain was allegedly also known to have had a history of psychological instability and had reportedly expressed concerns about his employment and financial situation to a friend prior to the incident. On July 25, the Islamic State (IS)-linked media outlet, al Amaq, reported that the attack was carried out by a soldier of the Caliphate in response to their call to target citizens of coalition nations.


Attack on police station underscores growing trend of violence copying Islamic State methods among psychologically unstable Muslim males

Despite claims that the attacker had a number of problems in his personal life, the possibility of links to wider militant trends cannot be ruled out. On the contrary, the fact that the attacker shouted “Allahu Akbar” and carried out the attack on the specific target that pro-IS groups had called for four days prior indicates that, even though he was likely not linked to any established militant cell, broader ideas of jihad informed part of his motivation. That is to say, while he may not have been looking to aid the goals of the Islamic State or avenge the deaths of Muslims, it is likely that, within his psychological instability, when thoughts of suicide arose, the concept of carrying out a jihadist attack was seen as a viable method. Possibly copying previous ‘suicide by cop’ attacks, in which the perpetrator intends to be killed by security forces. This assessment is further bolstered by the reports that his confusion over homosexuality was, in part, caused by an uncertainty about how it fit in with Islam.

With this in mind, the incident comes amid a continuing trend of psychologically unstable individuals, most of whom are migrants who adhere to the Muslim faith, carrying out attacks that mimic IS-inspired lone wolf incidents. Such attacks tend to be conducted by young males with mental health issues, who are, in part, influenced by the concept of jihadist militancy as a form of anti-establishment violence that has entered the West’s collective consciousness. Psychologically unstable individuals, and immigrants who perceive themselves to be disenfranchised and socially isolated from their community, whether it’s the Muslim or wider community, are copying IS-methods of attacks. In this sense, the media coverage of the various IS shootings and the general global trend of young men using mass violence as an outlet for frustration and disenfranchisement have merged.

Regardless of the psychological issues of the attacker, the fact that the incident came following the call from pro-IS groups means that online jihadist communities, and even Islamic State-linked media organizations, are likely to attribute the event to part of their ideology and larger plan. This is especially the case given the timing of the incident around the anniversary of the August 2017 attacks in Barcelona and Cambrils. In turn, this will perpetuate the aforementioned trend merging psychological instability and attacks that appear to be militant in nature.

Finally, the August 20 attack in Barcelona constitutes the latest in an ongoing trend of incidents related to violent attacks linked to Islamism from within the local North African community in north-eastern Spain and southern France. IS and IS-linked operatives have put a particular emphasis on recruiting in the region, due to the fertile ground for radicalization born from the feelings of disenfranchisement in both the established North African community and among North African migrants. These sentiments, which come partly due to perceptions of otherness within Spanish society and partly due to pressures put on from the local community, have the potential to lead young men towards violence, sometimes personally and sometimes linked to a militant organization.


Travel to Spain can continue while maintaining vigilance, due to the elevated threat of militancy.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security – Spain Analysis


During the afternoon hours of August 17, Spain experienced its first Islamic State claimed attack as a van plowed 500 meters into a crowd of people on the busy La Rambla street in central Barcelona, leaving 13 people killed and over 100 injured. The incident was subsequently claimed by the Islamic State who wrote that it was carried out by “soldiers of the Caliphate in Spain” and was intended to kill “Crusaders and Jews”.

Afterwards, during the evening hours of August 17, police located a second van in the town of Vic (80 km from Barcelona), which was hired at the same time as the van used in the initial attack, and was suspected to be a getaway vehicle.

At around 01:00 (local time) on August 18, a second car ramming incident took place in the city of Cambrils, around 100km southwest of Barcelona, in which one person was killed and six others injured. The attackers attempted to flee the vehicle on foot, allegedly wearing fake suicide belts before all five were killed by police.

More importantly, however, were the events that took place during the evening hours of August 16, less than 24 hours before the first car ramming incident. At this time, a large explosion was recorded in a small house in Alcanar, 160 km southwest of Barcelona and approximately 300 km from Ripoll. A police report, which was later released indicated that the occupants had been preparing a TATP-based explosive device, despite the blast initially being dismissed as a gas leak. The house was reportedly filled with over 100 canisters of propane and butane. Furthermore, sources indicate that the device being prepared in the house may have been intended to target Barcelona’s famous Sagrada Familia church.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Click here to see Map Legend 

Building the Terror Cell

Current reports suggest that the individuals involved in the attack all came from the area around the town of Ripoll, around 90 km north of Barcelona. Particularly, it appears that Abdelbaki Es Satty was the imam in Ripoll and is believed to have been instrumental in the radicalization and encouragement of the other seven younger individuals in carrying out the attack. Es Satty had been the imam since 2015 in Ripoll; however, he allegedly left “abruptly” in June 2017, and is suspected of using the time to start planning a militant attack.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

From 2010-2014 Es Satty served a four-year prison sentence in El Castellon, for a series of drug trafficking charges. It was during this time that he met and became friends with Rachid Aglif, who is serving an 18-year sentence for his role in the 2004 Madrid Train Bombings. Es Satty was also implicated in an operation in which he was involved in recruiting five individuals attempting to travel to fight in Iraq in 2006.

Other than Es Satty, the cell itself was built of young men of Moroccan heritage between the ages of 17 and 24-years-old. Reports indicate that all of them were born in Morocco and came to Spain at various times, all spending time or living in the town of Ripoll, where the cell appears to have been formed. Apart from Es Satty, there is no evidence to suggest that the other cell members had criminal records and no reported relations to other known radicals or militant networks. That said, a number of the members were reported posting increasing material on social media which pertained to topics typically associated with Islamism, including posts which spoke about the death of “infidels”, and contained excerpts of anti-Semitism common among radical Muslims.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Assessments & Forecast

Attack underscores emerging threat of homegrown cells in Europe

This attack is notable for numerous reasons, as despite the eventual act seeming to fit within the general pattern of attacks types (i.e. vehicular ramming) witnessed in Europe over the past year, it had the potential to be one of, if not the, deadliest, most damaging, and symbolic militant attacks by any group in Europe in years.

In this context, the incident on La Rambla on August 17 was clearly not the initial plan of attack. The connection between the attackers and Imam Es Satty, who was killed in the Alcanar explosion, as well as the almost immediate action following the explosion paints a clear picture that the explosives in Alcanar were meant to be used by the cell in a spectacular attack, and that the two eventual incidents were taken as a “plan b” method. Indeed, the use of fake explosive belts are indicative of a degree of organizing such a “plan b” approach. Furthermore, it is likely, given the speed with which they were carried out following the explosion on August 16, that the car ramming attacks were expedited in an attempt by the cell to carry out an attack before police investigations into the explosion foiled their plans and led to their arrests.

More telling, however, is the nature of the cell involved and what it says about the evolution and variety of threats from such militants in Europe. Indeed, we have seen that attacks range from Islamic State and copycat-inspired “lone wolf” attacks to much more organized and planned attacks, at times involving instructions from a central organization, such as the case in the Bataclan attack in Paris and the Brussels Airport attack. It is also important to note, that the lone-wolf attacks in and of themselves can range in death toll from one or a few dead from a stabbing, to scores killed in the Orlando night club shooting or Nice vehicular attack, two of the deadliest, yet simpler attacks by IS supporters.

The recent London Bridge and Boroughs Market attack was a new evolution along the range of lone-wolf Jihadist spectrum, as it involved a group of lone wolves cooperating with one another to form a cell. While the structure and formation of the London attack is not entirely clear, it appears that those involved were self-radicalized but connected to one another either by their own volition, namely via Jihadist messaging channels or were introduced to one another through such a channel or otherwise. That said, these individuals do not appear to have been organized by a central body or particularly experienced individual.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

The attack in Barcelona, for its part, appears to fall into the category of a “Homegrown Cell”, which has been rare in recent years. The origin of a homegrown cell can vary significantly and can be constructed by one radical and charismatic figure acting alone, such an individual working on behalf of a known group, or by a radical Islamist who has a connection to a known group to one degree or another but was not instructed by them.

In the case of the Barcelona cell, Abdelbaki Es Satty was the likely facilitator and builder of the cell. His recruiting background portrays him as someone with an understanding of the process of identifying targets for potential recruitment and likely having the personality to influence others in such a way. Additionally, he likely developed a greater familiarity with various terrorist techniques and principles during through this relationship with Rachid Aglif. We assess that Aglif and the attack he was involved in, in which 192 people were killed, served as an inspiration for Satty.

Beyond that, it is unclear if he did have guidance or instructions from Islamic State although the speed by which Islamic State released the official claim of the attack, may indicate their prior knowledge of his plans.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Homegrown cells allow for greater reach, more sophisticated, destructive attacks

While the individual “lone wolf” attack has the benefit of being much more challenging to predict and thwart, given that it involves only one individual and minimal planning, they are less likely to have as high of an impact as more organized attacks. Other than rare cases, such as Nice and Orlando, the majority of “lone wolf” attacks only involve a small number of casualties before the attacker is neutralized, even in the case of more advanced lone-wolf attacks, such as in London. On the other hand, while a cell composed of more trained and experienced Jihadists is able to carry out highly effective and destructive attacks, due to their expertise and manpower, the accumulation of many affiliated militants, in one area, alongside their communications and activities, is far more likely to arouse the suspicion of security forces and risk being thwarted.

In that regard, the Ripoll cell is an interesting balance in that it can balance the low-key nature of a lone wolf group with the greater planning and organization of a more advanced Jihadist cell. Islamic State can select known and trusted individuals online, or returning foreign fighters, and instruct them on the formation of a homegrown cell, and in some cases lend them material support or connect them with other experienced or useful individuals.

The Spanish cell was able to plan and almost execute what could have been one of the most significant European attacks, without being thwarted by security, because although they were many in number, their relationships seemed organic enough not to arouse suspicion and the fact that the more suspicious activity they did was conducted in a remote location and not in their home environment.  This allowed them to prepare a highly sophisticated attack plan, with multiple layers and back-ups, without outwardly appearing to be a militant cell.

Further attacks from similar cells should be expected across Europe

While the possibility of typical “lone wolf” attacks remains throughout the world, particularly in Europe and the West, the homegrown cell phenomenon is likely to become more common than previously witnessed. Given that IS have penetrated almost every country in Europe and have propaganda and media communications in most major languages it is likely that there are already similarly structured cells across the continent, built of local radicals bound together by online facilitators or one local IS-affiliate or even one individual who has a greater degree of exposure to Islamist methodologies. Additionally, as seen in the past, the “copycat effect” is likely to take hold, with similar cells conducting attacks in the coming months.

Furthermore, IS regularly encourages attacks throughout the continent and adjusts their instructions to the successes of previous attacks. In this context, it is highly likely that Islamic State, whether involved in the Barcelona attack or not, will learn from its successes and failures.

Thus, and as IS continues to lose territory in the Middle East, and tends to want to balance these losses with an appearance of being a global phenomenon, we assess that Islamic State may actively seek to ‘activate’ such cells in Europe. In this way, the organization will likely want to have more control over how, when, and where an attack will take place, and may currently be reaching out to foreign fighters who returned to Europe, or other connections they may have, in order to encourage them to build their own homegrown cells.

Furthermore, Islamic State will likely learn from the failure of being over ambitious. Es Satty likely looked up to Rachid Aglif and his involvement in the deadly Madrid attacks from 2004, and in seeking to match its casualty level, chose to develop an extremely large explosive device by a large number of terrorists rather than launching an attack earlier and at a lower capacity. With this, we expect that IS will encourage smaller attacks by smaller homegrown cells, but ones that have a far greater potential for success.


On the corporate level

We advise raising the awareness of employees and security personnel to unusual activity and behavior of fellow employees. Encourage your employees to report such observations whether at work or in their personal surroundings. Monitor local unusual developments in order to predict emerging threats in the vicinity of your interests, and follow the global terror trends and modi operandi, in order to adapt your security measures and preparations. Conduct surveys to check and evaluate the relevancy of your current security protocols.

On the institutional level

Additionally, identify the social groups and communities in your area that are more susceptible to radicalization, identify the leading individuals, and monitor their activities. Raise the public’s awareness regarding key indicators of unusual activity.

For more information about the terror threat in Europe and what you can do to be prepared, check out our white paper here.