Security beyond borders.

Lebl, Leslie S.

AFTER SEPTEMBER 11, 2001, NATO's invocation of Article 5 committing members to the collective defense of U.S. territory dominated news reports from Europe. Then the media reported that the U.S. government had mostly declined European offers of help, in part because the Europeans lacked useful military capabilities. The resulting hurt feelings of the Europeans, together with American doubts that the Europeans had much to contribute to the fight against terrorism, certainly soured the transatlantic relationship.

That was the view from NATO circles, at any rate. A different view emerged from downtown Brussels, where the European Union also responded quickly to the 9/11 attacks. Within a week, EU leaders had publicly committed themselves to closer cooperation with the United States than ever before. The United States was slow to respond, just as it had been with NATO, for a variety of reasons. But the Europeans persisted, and within a short period of time a new dynamic emerged in the U.S.-EU relationship.

During the years since September 2001, the United States and the European Union have signed agreements previously thought unachievable and have worked together much more closely than ever before. In fact, the breadth of the cooperation in itself contributes to the difficulty of any review and analysis. Since September 11, there have been numerous transatlantic initiatives: to develop law enforcement cooperation; to extend the freezing of terrorist assets; to develop more secure procedures for container shipping, air passenger travel and issuance of travel documents; to improve export control systems and other nonproliferation measures; and to coordinate foreign policy, especially toward the Broader Middle East. The bilateral cooperation thus included both foreign and domestic policy officials from numerous agencies on both sides of the Atlantic.

However, the number of agreements signed and meetings attended does not in itself define the quality or success of the cooperation. The substance of the agreements is important, as is the degree to which they been implemented. Further, at the outset it was not clear whether any new U.S.-EU cooperation would come at the expense of bilateral cooperation between the United States and EU member states at the national level, or whether it would indeed provide its own added value.

Beyond the technical issues are wider ones associated with the goal of "building Europe." As more and more functions are concentrated in Brussels rather than in national capitals throughout Europe, it is not clear whether this will help or hurt U.S. interests. In part, the answer to that question will depend on whether the EU is able to persuade its citizens of the danger that terrorism poses to them, as well as the value of close cooperation with the United States on these issues. The United States also had to decide whether it should cooperate with the EU as a means of inducing European governments to tighten their counterterrorism regimes, or whether such cooperation might be limited and possibly damaged by public opposition with a strong tinge of anti-Americanism. In sum, the United States had to evaluate the potential effectiveness of the proposed new partnership.

September 11: Before and after

ON SEPTEMBER 10, 2001, the danger posed by terrorism was far from the minds of most Europeans. Of the 15 EU member states, only half had specific legislation identifying terrorism as a crime. While most had signed various UN conventions against terrorism over the years, many still had to complete the necessary ratifications. And various member states continued to provide sanctuary for individuals that other member states considered to be terrorists: ETA members found refuge in France; the UK refused to surrender alleged terrorists to France; and a major terrorist network, November 17, had operated with impunity for years on Greek territory.

In the EU Treaty of Amsterdam, which entered into force in 1997, the EU committed itself to establishing an internal "area of freedom, security and justice." In practical terms, that meant a common asylum and migration policy; a genuine European area of justice where decisions in one member state were recognized in the others; and a unionwide fight against serious organized and transnational crime. Specific goals were laid out at a European Council meeting in Tampere, Finland, in 1999.

However, progress toward these goals was slow. The EU had received a large number of immigrants and asylum-seekers in recent years but was far from developing coherent policies for integrating the new arrivals or identifying and dealing with potential terrorists. Nor had the EU succeeded in tightening its border security to counteract the ability of terrorists or international criminals to operate easily in Europe. Resistance from national police authorities stymied efforts to give the new European Police Office (Europol) any real power to gather and analyze intelligence or to coordinate police investigations in one or more member states. Transatlantic law enforcement cooperation also remained at the level of EU member states and the United States rather than between the United States and the EU.

The EU's response to the events of September 11 was immediate. Within a week, the justice and interior ministers of the 15 member states agreed on a package of anti-terrorist measures. The following day, a summit meeting of EU heads of state and government, known as the European Council, confirmed this new priority. (1) Their conclusions began with a section calling for solidarity and cooperation with the United States. They then set out key elements of a European policy to combat terrorism:

* Introduction of a European arrest warrant, so that wanted persons could be handed over directly from one judicial authority to another within the EU;

* Adoption of a common EU definition of terrorism as a first step toward greater harmonization of member state policies;

* A common EU list of terrorist organizations;

* Pooling of information on terrorism via Europol;

* A cooperation agreement between Europol and the relevant U.S. authorities by the end of 2001;

* All measures necessary to combat any form of financing for terrorist activities; and

* Improvement of air security.

Many of these measures had been recommended for some time; in the changed environment after September 11, there was a much greater chance that they would actually be implemented. And, indeed, the political pressure to make progress remained intense for several months so that several key issues were resolved in principle at the December 2001 meeting of the European Council. Before the meeting, Europol had signed an initial agreement with the United States. At the meeting, the European Council confirmed its agreement in principle on the European arrest warrant, a common definition of terrorist crimes, and the drawing up of a common list of terrorist organizations. (2)

European security strategy and 3/11

A SIDE FROM THE clear statement in the September 21 European Council Conclusions of the need to cooperate with the United States in fighting terrorism, the EU's formal response had little to do with traditional foreign policy concerns. That changed, though, after the Iraq war. One result of the painful dispute over Iraq was the Europeans' clear perception that they would never be able to act jointly if they disagreed on the threats they faced. To solve that problem Javier Solana, Secretary General of the Council of Ministers (3) and the EU's High Representative for Common Foreign and Security Policy, was asked to prepare a paper on a common EU security strategy.

The European Council adopted Solana's paper, the European Security Strategy (ESS), in December 2003. (4) The ESS set out for the first time a vision of EU strategic policy, identifying terrorism, proliferation of weapons of mass destruction, regional conflicts, failed states (e.g., Afghanistan, Sudan, or Somalia), and organized crime as the key security threats facing all the EU member states.

These security threats and principal security objectives defined in the ESS generally matched those of the United States and, in fact, the ESS specifically called for cooperation with the United States. This marked a significant evolution from the situation before September 11, when Europe appeared more concerned about environmental issues such as food safety while the United States was preoccupied by terrorism, the spread of weapons of mass destruction, and the nexus between the two.

Thus, the ESS provided a conceptual framework for policy cooperation between the EU and the United States. Many of the topics raised had already been discussed individually by the two sides but were now linked together for the first time. The ESS also aimed to break down internal EU barriers between foreign policy ("Pillar Two" issues) and domestic security ("Pillar Three" issues). (5) The EU's inability to crosswalk these two sets of issues bedeviled not only its internal coordination, but also its relations with third countries such as the United States.

As a direct result of the March 11 bombings in Madrid, the European Council adopted, on March 25, a "Declaration on Combating Terrorism." (6) The intent was clear: to send a strong message that the EU was united in the fight against terrorism. It aimed to increase internal EU cooperation and to discourage the perception that, following the Spanish elections, European governments might be open to terrorist blackmail. As such, it reinforced the EU's rejection of Osama Bin Laden's offer of peace and a truce to Europeans if they withdrew their forces from Muslim countries.

The most critical aspect of the declaration was the admonishment directed at justice and interior ministers who had failed to implement their prior commitments. To improve performance, EU leaders created a new position of Counter-Terrorism Coordinator, serving as deputy to Solana.

The declaration also included new proposals, of which several stand out: immediate adoption of the solidarity clause in Article 42 of the Constitutional Treaty; (7) numerous measures to enhance law enforcement cooperation within the EU, including making better use of Europol and Eurojust (the new EU agency for cooperation between national investigating and prosecuting authorities set up after September 11); improved data handling for law enforcement purposes, whether at the borders, over the internet or for airplane security; improved control over travel documents and the use of biometrics to enhance document integrity; establishment of a European Borders Agency by January 1, 2005, to help member states implement integrated management of the EU's external borders; and greater counter-terrorism powers for Solana from improved intelligence analysis.

From the EU perspective, the intent of the declaration is clear: The way to greater safety lies in "building Europe," as individual governments alone have very limited means of countering the terrorist threat. There should be more cooperation in law enforcement, more joint knowledge of the threats Europeans face, and greater flexibility in responding to those threats.

The Constitutional Treaty

FURTHER POWERS WILL be transferred from the member states to the EU in the proposed Constitutional Treaty signed October 29, 2004, which is expected to have a major impact on the EU's performance in these areas. The Treaty's ratification may take several years (and be subject to a number of national referendums). Many of its provisions in the areas of law enforcement and border security, however, could be adopted separately by the European Council, as was the Solidarity Clause mentioned above.

The treaty would, for the first time, transfer most EU decision-making in areas involving serious crimes from unanimity to qualified majority voting, the system used for "First Pillar" issues such as agriculture and trade. This would make it easier to reach decisions; it would also give the Commission greater powers to compel member state compliance in these areas. The European Parliament, which today acts mostly in an advisory capacity, would acquire a direct say, as it has for agriculture and trade. While more cumbersome, the "co-decision" procedure involving the Parliament should confer greater legitimacy on EU counter-terrorism policies. So should the enlarged role foreseen for the European Court of Justice, the judicial authority that interprets EU law, which is to gain full competence to review and interpret these legal instruments.

Second, the treaty would strengthen the EU's law enforcement and border security activities by central budget funding for agencies such as Europol, Eurojust, or the new European Agency for the Management of the External Borders. Currently these agencies depend on assessed contributions from member states, which come out of national budgets and may be subject to delays. The treaty would thereby reinforce an existing trend, as the EU's next multi-year budget proposal, which takes effect in 2007, contains a substantial increase for those security issues already in the central budget, reflecting public concerns about law and order, immigration, crime, etc.

In the interim, the European Council in November 2004 agreed on a follow-up program to the one approved in Tampere in 1999. The Hague Programme (8) continues and expands existing trends. Most important, it seeks to break down the barriers to providing law enforcement information across internal EU borders, a revolutionary goal with many benefits but also of considerable controversy. Further, it opens the door to European Parliament oversight of Europol and Eurojust, a measure that will contribute to the parliament's increasing involvement in counterterrorism. This involvement may provide greater democratic legitimacy; it will definitely increase the weight given to civil liberties and data privacy concerns.

The Hague Programme also calls for a long-term EU strategy on radicalization and terrorist recruitment. This issue has gained political momentum as people became more aware of the impact of radical Islamist activities. EU ministers have agreed that there is a problem but in practice still differ, either over the seriousness of the threat or over what to do about it. Both extremes represent a danger: either doing too little or opening the door to abuses.

Implementation

AT THE HIGHEST political level in Europe, as well as among bureaucrats in Brussels, the trend appears to be clearly in favor of greater EU integration and greater powers of central EU institutions to engage in counter-terrorist actions. But how have these decisions worked out in practice?

As a general rule, the EU's legal and institutional arrangements work slowly most of the time. Despite the popular image, the central EU institutions (the European Commission, Council of Ministers, and European Parliament) actually employ relatively few people. The Commission drafts EU framework laws and regulations, but they must then be incorporated into national laws and regulations. Most of that work, and all of the implementation, lies with the member states, and pressure applied on them to comply primarily takes the form of moral suasion rather than coercion (the "blame game" rather than sanctions). Thus, all EU achievements typically take time, and at any given moment compliance may lag in many member states. As noted above, that situation was even more marked in the area of "justice and home affairs," which includes law enforcement and border security.

So a great deal has changed. An EU that was struggling in September 2001 to show any significant progress on the Tampere goals has been transformed. The European Council in June 2004 advanced work in new as well as already established areas. For example, it gave Solana the go-ahead to develop an EU intelligence capability, and called for a range of studies on improving civil protection in case of a terrorist attack--initiatives that would have been unthinkable just a few years ago.

Yet the same conclusions also urged implementation of many past decisions. Despite the priority accorded, at least rhetorically, to the fight against terrorism, counter-terrorist measures lagged well behind established deadlines. As of July 2004, two of the 15 member states still had to adopt the common definition and penalties for terrorism, while even among the countries that had done so, none had applied them completely. It took until November 2004 for all but one member state to adopt the common arrest warrant, and several member states still had to ratify some of the relevant UN conventions. The European Council in December 2004 continued the pressure on member states to meet their commitments.

And, while new agencies and positions are being created, they have yet to prove their effectiveness. The new entities have limited authority and capability and cannot be considered as substitutes for national authorities. This was made clear by the Council's new counter-terrorism coordinator, Gijs de Vries, in his testimony before the U.S. House of Representatives: "Through its legislative work and policy initiatives the EU can do a lot to help national authorities work together internationally. The hard work of tracking down potential terrorists, preventing attacks and bringing suspects to justice remains the preserve of national services." (9) Europol's caseload rose 40 percent in 2003 over the previous year, and its FBI liaison position, which had been vacant, was filled in October 2004, but it still had a distance to travel to establish itself, particularly in the opinion of national police authorities.

The question of data privacy remains a large stumbling block toward progress on counter-terrorism in the EU. EU Directive 95/46/EC of 1995 forms the legislative basis for data protection; unsurprisingly, "there are still delays in implementation by some member states ... and a particular lack of quality in some transposed laws which shows clearly that some member states still need to amend their protection laws." (10) This issue, as will be shown below, looms large in debates on many transatlantic initiatives.

Law enforcement cooperation

IF IMPLEMENTATION OF the intra-European measures to combat terrorism has been slow, what of the enhanced U.S.-EU relationship that EU leaders made a priority?

Before September 11, just as national police authorities resisted the introduction of centralized police coordination, there was considerable reluctance to have the EU engage in law enforcement cooperation with third countries. However, Europol, the European Police Office, was seeking to sign agreements on such cooperation, particularly with the United States. From its perspective, a U.S. agreement would confer political clout as well as providing useful law enforcement information.

U.S. authorities responded cautiously to this initiative. The lack of support from EU national police forces brought into question Europol's effectiveness: Just how much information would Europol be able to provide U.S. authorities in return? Yet, if Europol concluded agreements with other countries first, those agreements could set precedents that might disadvantage U.S. interests. So the true value of any agreement might become clear only at a future date.

After September 11, the United States had additional reasons for hesitation. It sought to do nothing that might undercut its enhanced bilateral cooperation with national police authorities in the 15 member states. The last thing an American investigator pursuing an al Qaeda link wanted to hear was that his German counterpart, who had been communicating directly with him, had just been told everything now must go through Brussels--and that no one could say how long that would take. Finally, there was a practical problem: The U.S. officials needed for any negotiation were at the moment completely occupied with ongoing terrorist investigations.

In the end, not one but two agreements were signed. The first, concluded in December 2001, less than three months after 9/11, allowed for certain types of institutional cooperation. (11) The issue of most interest to the Americans, agreement on the transfer of personal data related to criminal investigations, was deferred to a second agreement concluded the following year. The ability to exchange such data was key to effective investigation of cases involving terrorism or other serious cross-border crime. However, EU laws specified that the EU could transmit personal data only to another state with the same legal framework to protect the privacy of such data--and the U.S. structure differed from the European one.

To solve this problem, the American side proposed that the principles of such protection, rather than the specific institutions set up to protect data, be examined. If the parties could agree that the purposes of both sides were similar and that different laws and institutions in practice accomplished the same goal, that understanding might form the basis for agreement. As one of the American negotiators pointed out, any agreement must rest on the degree of trust between the parties. (12) After an exchange of information on their respective principles and institutions for protecting personal data lasting the better part of a year, the United States and the EU signed a second Europol agreement in December 2002 allowing the transfer of such data for law enforcement purposes.

The Europol agreements were just the first step. The next step was the conclusion of an agreement on extradition and mutual legal assistance. Informal discussions on this subject began in the fall of 2002. The Europeans, once again, were interested in developing the U.S.-EU relationship. The U.S. side wanted to obtain flexibility from European states to allow extradition of their nationals--an important point, particularly as a number of terrorist suspects had become nationals of EU member states. The Americans remained cautious, though. While it might make sense to negotiate a single, updated agreement with the EU, they wanted to ensure that such a document would add to, rather than replace, existing extradition and mutual legal assistance agreements with member states. There might be value added, but the Americans had to be persuaded. The Europeans persisted, and at the U.S.-EU summit in spring 2002 President Bush agreed to negotiations.

In the end, negotiations resulted in two separate agreements, both signed in June 2003. For the European political elite and the media, the biggest issue appeared to be the possible extradition of an individual who could face the death penalty; while applicable for a number of serious crimes in the United States, it had been abolished in Europe. Critics said that the United States would force European countries to surrender such individuals.

This issue was, in fact, a red herring. For years, EU member states had extradited individuals to the United States only after ensuring that the death penalty would either not be imposed or, if imposed, not carried out. That arrangement is spelled out in the new U.S.-EU agreement:

 Where the offence for which extradition is sought is punishable by
 death under the laws in the requesting State and not punishable by
 death under the laws in the requested State, the requested State may
 grant extradition on the condition that the death penalty shall not
 be imposed on the person sought, or if for procedural reasons such
 condition cannot be complied with by the requesting State, on
 condition that the death penalty if imposed shall not be carried
 out. If the requesting State accepts extradition subject to
 conditions pursuant to this Article, it shall comply with the
 conditions. If the requesting State does not accept the conditions,
 the request for extradition may be denied. (13)

EU member states now have the option of keeping their bilateral standard regarding assurances or adopting this one.

The Europeans were not prepared to offer the unrestricted extradition of nationals that the American negotiators sought. The Americans did, however, obtain a more forthcoming text on mutual legal assistance than they had expected. (14) That agreement provided for a range of enhanced cooperation, including such items as the identification of bank information, joint investigative teams to facilitate criminal investigations or prosecutions, and the use of video conferencing for testimony by a witness or expert. A year earlier, even the video conferencing would have been an unprecedented step.

The Americans had also wanted the extradition agreement to reflect their concern about the European arrest warrant. Would it in practice become more, not less, difficult to extradite alleged criminals from Europe? The question arose from cases where another EU member state also wanted the individual in question. Would the member state holding the individual, as a matter of principle, extradite him/her to the requesting state bringing the most serious charge? Or would it on principle give preference to any request from another EU member state, a proposal made as the European arrest warrant legislation was developed?

The final text mirrors the compromise embedded in the legislation, namely, that the requested state shall consider "all of the relevant factors." It provides an exhaustive list of such factors, to include both "the places where each of the offences was committed" and "the seriousness of the offences." With this language, the United States should be better able to represent its interests in future cases involving competing requests.

The mutual legal assistance text also addresses questions of data privacy. It retains the right to place specific limitations on the use of data transmitted from one treaty partner to the other (i.e., limiting it to a given investigation or indictment, or a specified time period). But it excludes broader, generic restrictions; a European country cannot, for example, refuse to provide information unless the United States adopts the EU data privacy system: "Generic restrictions with respect to the legal standards of the requesting State for processing personal data may not be imposed by the requested State." Both agreements required the EU to ensure that each member state acknowledged, in a bilateral agreement with the United States, that the provisions of its existing extradition and mutual legal assistance treaties would continue to be applied (a requirement that has still not been fully met). (15) These bilateral agreements would show that each member state had obligated itself to the United States as well as to the EU. Both texts also allowed for the conclusion of future agreements between individual member states and the United States. Thus, these new EU agreements were clearly designed to provide "value added" to the existing web of transatlantic law enforcement cooperation.

Further law enforcement proposals figured prominently at the U.S.-EU summit a year later, in June 2004. Both sides committed themselves to an extensive list of measures designed to improve the detection, investigation, and prosecution of terrorists, as well as the prevention of terrorist attacks. While urging better implementation of the Europol, extradition, and mutual legal assistance agreements, they also called for new initiatives, such as developing strategies to prevent cyber attacks or working out better ways to use sensitive information to aid prosecutions of terrorists. The results of this summit reflected both the confidence gained in bilateral work since September 11 and the renewed sense of urgency in Europe after the Madrid bombings.

This cooperation continued in the fall of 2004. U.S. Attorney General John Ashcroft, as he had in 2002, met with justice and interior ministers of the 25 member states in September. Then and later, a number of bilateral agreements were signed to implement the U.S.-EU extradition and mutual legal assistance agreements--by EU standards, very rapid progress. The United States must still negotiate and conclude bilateral agreements with the 10 new EU member states.

Freezing terrorist assets

ON SEPTEMBER 11, 2001, the EU already had in place a system to implement United Nations resolutions freezing the assets of the Taliban and al Qaeda. In that system, the Council of Ministers was charged with publishing UN directives that would then be applied by the member states. The sanctions applied only to those two organizations; they did not extend to other terrorist groups.

After September 11, the EU set up a clearinghouse mechanism for member states to review alleged terrorists or terrorist organizations to determine which names should be added to the list. The final decision would then be made by the EU Council of Ministers. The goal was to take comprehensive action against terrorists around the world.

A united EU stand was effective symbolically, as it contributed to world condemnation of terrorist groups. It also changed the political climate in Europe, where a number of these organizations had been operating openly, often with public sympathy and support. In practical terms, a united EU stand contributed to the coordinated international action needed to disrupt the money flow. If successfully aligned, the EU and U.S. lists could form a powerful common tool in the fight against terrorism. The new system was more convoluted and slower than its U.S. counterpart, but by and large it worked. In some cases, the U.S. authorities added names to their list at the request of the EU.

Although the lists were largely the same, there were some divergences. The EU was very reluctant to add organizations to the U.S. list such as the Kurdish group PKK, Hamas, or Hezbollah. Over time, though, it did list the PKK (and, some time later, the PKK's successor organizations), as well as Hamas. Hezbollah still has not been designated.

The Europeans initially chose not to publish the full list of alleged terrorists and terrorist organizations. The Americans continued to urge them to do so for the political effect that such publication could have. In addition, they urged all member states to improve their national capability for actually freezing terrorist assets.

Freezing assets is not an easy task. Rapid action is required without advance notification, or any opportunity for the group to present its side of the story, if the effort is to succeed at all. However, there is a big gap between intelligence and evidence, and it may be difficult to prove that someone actually financed terrorism. In the U.S., neither the allegations against the al-Barakaat money-remitting system nor those against the Global Relief Foundation and Benevolence International Foundation charities resulted in a criminal case after assets were frozen. From a security viewpoint, given the technical difficulty of proving links to terrorist activities, disrupting suspected terrorist funding could still be useful in warding off terrorist attacks. However, such an approach raises clear questions of civil liberties.

Similar obstacles faced the Europeans. Any member state that froze assets on the basis of an allegation from another member state or third country was legally liable if the alleged terrorist was in fact innocent. Given the speed necessary for the asset freeze to be effective, the member state had very little time to assure itself of the solidity of the case. The EU sought to relieve the hardships of individuals suddenly deprived of their financial assets by allowing humanitarian payments from the frozen funds. Nevertheless, since September 11, roughly a dozen complaints have been filed that have made their way to the European Court of Justice.

Freezing assets, fortunately, was not the only objective. With more information on terrorist financing, governments could follow the money trail to learn more about the terrorists and their activities and possibly disrupt terrorist links and operations. In spring 2004, the United States and the EU renewed their efforts. Blocking terrorist financing figured prominently in the June 2004 U.S.-EU summit declaration. The two sides undertook to improve the effectiveness of asset-freezing and transaction-blocking laws and regulations, as well as to ensure that internal processes would be in place for reviewing proposals for designation. The declaration also included commitments to protect against the abuse of formal and informal financial institutions and to review the regulation of the nonprofit sector. And it confirmed public access to consolidated lists of all persons and entities subject to asset-freezing mechanisms.

In November 2004, finance ministers agreed to controls on cash entering or leaving the European Union, a step welcomed by U.S. authorities. In December the European Council called, among other things, for proposals to prevent the misuse of charitable organizations for the financing of terrorism, another step implementing the transatlantic agenda.

Border and transport security

FROM THE U.S. PERSPECTIVE, several of the most urgent counter-terrorist measures after September 11 fell in the area of border and transport security: how to check containers shipped to the United States, how to obtain advance information about the identity of air passengers, and how to make passports and visas more reliable documents. In these cases, the initiative came from the U.S. side, often as a result of strong congressional action, and elicited mixed reactions from Europeans.

The first negotiation concerned the new Container Security Initiative (CSI), a U.S. program to screen shipping containers at foreign ports before they depart for the United States. In early 2002, U.S. officials approached the European ports with the highest volume of exports to the United States; the port cities, member state authorities and shippers were typically eager to comply. They recognized the potential threat and wished to develop a system that would increase security yet allow legitimate shipments to proceed with as little hindrance as possible. Agreements were reached quickly, and arrangements, including stationing U.S. customs officials in the ports, were soon in place.

The European Commission, however, took issue with these agreements. It argued that, as transportation policy had been delegated to it by the member states, the latter should not be signing separate agreements with the United States. Beyond questions of competency, the Commission argued that selective implementation of new security arrangements would unfairly disadvantage those ports not covered, thus distorting trade. Eventually, agreement was reached on the Commission's lead role. In April 2004, it signed a bilateral agreement with the U.S. Department of Homeland Security calling for the prompt expansion of the CSI throughout the EU as well as closer cooperation and mutual assistance in customs matters between the two entities.

The second negotiation, responding to new U.S. legislation requiring all airlines flying to the United States to provide the Department of Homeland Security's Bureau of Customs and Border Protection (CBP) advance electronic access to data from the Passenger Name Record (PNR) system, ran into more serious problems. Ironically, the information now required by law had previously been supplied on a voluntary basis, so there was less to this initiative than met the eye. However, it alarmed Europeans concerned about the protection of private data and soon acquired a fair degree of notoriety.

For over a year, in a well-publicized dispute, the United States threatened European airlines with severe penalties if they did not provide the PNR data, and the Commission threatened the same if they did--although the United States agreed to suspend sanctions while negotiations on an agreement were in progress. In May 2004, the two sides agreed on an interim arrangement, (16) under which the airlines would provide certain items of data included in PNR records. The CBP, as a condition of reaching agreement, described in a nine-page document of "undertakings" the systems that would be used to protect the personal data so provided; the Commission in turn published an "adequacy finding" stating that these arrangements met EU data privacy requirements. (17)

This, however, is not yet the end of the story. The European Parliament challenged the agreement, holding more than one nonbinding vote to oppose it, and in June brought an action of annulment of the agreement to the European Court of Justice. The Court has not yet responded.

But perhaps the thorniest issue is that of the security of travel documents. U.S. post 9/11 legislation called for more secure passports and required the introduction by October 26, 2004, of biometric indicators (such as digitized photos or finger/iris scans) in passports of countries benefiting from the U.S. visa waiver program. (Under this program, nationals of 27 countries, 15 of which are EU member states, may enter without a visa.) The short time frame proved to be unrealistic, both for those countries and for the State Department, which sought to meet the same deadline for U.S. passports.

There were several obstacles. To begin with, for any system to be effective, it was essential to have common international technical standards to ensure interoperability of the new biometric technologies; the United States and the EU could not just set their own bilateral standards. Work at the International Civil Aviation Organization (ICAO) is ongoing. In addition, the reliability and usefulness of these indicators was uncertain, as was their value. For example, it was not clear that digitized finger scans would be significantly more reliable than digitized photos. And, once again, privacy advocates in the EU questioned the need for new technologies, as well as the ability of the U.S. government to adequately safeguard the data it collected on European nationals.

U.S. officials sought to extend the deadline for including biometrics in passports by two years; the U.S. Congress agreed to half that time frame, setting a deadline of October 26, 2005. In the interim, as of September 30, 2004, all foreigners (including those under the visa waiver program) will have to submit to digital finger scans and a digital photograph on entry. In late October, the United States adopted its first biometric facial recognition standard.

In the interim, EU policies evolved; in March 2004, the European Council called for the inclusion of biometric indicators in passports and visas, and in December, the Council of Ministers mandated facial and fingerprint indicators in all EU passports. The first must be done within 18 months, the second within 36. (18) Some questions have been raised as to how this will work in practice. Meanwhile, the U.S. government remains undecided about whether to follow the EU lead in adopting dual biometrics. Given uncertainties over technical requirements and data privacy, biometrics may well be the most visible and controversial counter-terrorist issue for some time to come.

All players--including the United States and the EU--must balance the requirements they set for foreigners with reciprocal treatment of their own citizens abroad. The debate among governments and between agencies over facial recognition technologies, or digital finger scans and/or iris prints, is politically sensitive and will continue to be so. The United States will have to balance its border security concerns with the need to avoid disruptions in legitimate travel patterns if large numbers of travelers must apply for the new passports en masse--particularly if it then turns out that actual security has not been significantly enhanced.

The potential disruptions from upgrading passport security are matched by others linked to proposals to end the U.S. visa waiver program. For several years, members of Congress had criticized the program. They were concerned that the passports in question could too easily end up in the hands of terrorists or other criminals. Belgian passports were an excellent case in point: They were being stolen from town halls around the country and consular posts abroad to be used by terrorists connected to Osama Bin Laden (19) and by alien smugglers (whose activity was though to fund a variety of terrorist groups).

Even though Belgium and other EU member states were able to certify that they had tightened their controls, (20) the issue was already well-entrenched in the Congress--and there was no doubt that terrorists continued to send people with access to European passports into the United States. Some used false documents; others were legal residents or nationals of European countries. Examples of the latter, known terrorists such as UK national Richard Reid and French national Zacharias Moussaoui, contributed to the pressure to eliminate the visa waiver program.

The Schengen accord, which lifted most EU internal borders, contains a "solidarity mechanism" (21) that requires them to act together. U.S. visa policy, on the other hand, is reciprocal by individual country. Thus, when U.S. authorities placed in question continued visa waivers for some EU member states, EU officials responded that "an attack on one is an attack on all" and threatened to impose visa requirements on Americans visiting any EU member state. The negative effect on the traveling public of imposing visas in either direction would be hard to overstate, and any such measure would do much to sour transatlantic relations even further and to undermine public support for counter-terrorist policies.

The visa issue was further muddied when Poland and the Czech Republic, as new EU members, sought visa-free treatment for their citizens. (22) Poland in particular was incensed that, despite its contribution to the war in Iraq, the United States treated its nationals less generously than other European citizens. U.S. authorities responded that U.S. legislation levied certain requirements individually on countries covered by the visa waiver program. Neither Poland nor the Czech Republic had yet met those conditions.

The European Commission has become embroiled in this dispute, as Poland and the Czech Republic asked for its assistance in defending the rights of their nationals under the European Community, rights the Commission is bound to protect. For the time being, the Commission has persuaded the new accession states not to invoke the "solidarity mechanism" against the U.S. or other countries that fail to grant full visa reciprocity. In October 2004, U.S. officials laid out for their EU counterparts the legal requirements for visa-free status. The issue may come to a head again in 2007 when the EU drops internal borders and the new states expect to be treated like "first-class" citizens with regard to immigration and visa issues.

The political turmoil over the visa waiver program has only made it more difficult to deal with the basic problem: Islamist terrorists have been using European passports to enter the United States precisely because those passports do not require visas. And while some of these may be fraudulent documents, many are genuine because terrorists can claim nationality in a European country.

After two years of often turbulent negotiations on transportation and border security, particularly those covering air passenger data, both sides inaugurated a high-level dialogue on these issues in April 2004. Officials realized that they could not afford the open transatlantic discord on security measures that was common on trade issues. The hope was to avoid some of the prior acrimony and establish a more positive dynamic between the United States and the European Union by giving mutual advance notice of new initiatives and discussing security problems in depth before developing concrete policies to address them.

This approach was confirmed at the June 2004 U.S.--EU summit. The two sides reaffirmed their commitment to increase maritime, port facility, and vessel security; to seek complementary approaches to airport, aircraft, and air cargo security; to formulate principles of aviation, port, and vessel security; and to explore cooperation on rail security. They also confirmed their decision to incorporate interoperable biometric identifiers in travel documents, as well as to improve information on lost and stolen passports. The second high-level meeting, in November 2004, discussed cargo security, travel document security policies, and use of advanced passenger data.

As late as the summer of 2001, U.S.-EU summits could best be characterized as labor-intensive nonevents. In fact, it was startling to think that two of the largest players in the international arena did such a poor job of talking to each other at the highest level. Almost nothing newsworthy ever happened; as one official put it, summit documents usually had more drafters than readers. Since September 11, these same summits have gradually been transformed into a primary vehicle for promoting counter-terrorism cooperation.

Recent summit declarations are remarkable not only for their breadth, but also for their coherence: They provide specific plans for joint work at the expert level that is to be monitored by senior officials. The successful model developed for border and transport security is thus being applied to many other areas. Both the United States and the EU have complex bureaucratic structures; with so much in flux in the search for new ways and means to combat terrorism, enhanced coordination is vital.

This summitry has contributed to a major revamping of the international system as international organizations like the International Civil Aviation Organization or the International Maritime Organization refocus on antiterrorism. A U.S. official likened the process to an ocean liner: It took a long time to get going but is now picking up speed. (23) If the United States and the EU can work together, they greatly improve their chances of initiating and steering this process.

EU plus U.S.

SEVERAL CONCLUSIONS CAN be drawn from this review of the European Union's counter-terrorism policy and U.S.-EU bilateral cooperation since September 11, 2001. First, the European Union is definitely acquiring more authority in key areas required to combat terrorism: law enforcement, financial controls, and border and transport security. That process is slow and uneven, characterized by undertakings made at the most senior levels of government that are then implemented haltingly, and it will take some time before the actual effect on the ground can be evaluated. However, the direction of change is clear--in part because these same tools are needed to combat other pressing problems, such as organized crime, drugs, trafficking in persons, or illegal immigration, that receive much public attention in Europe.

Second, were it not for continuing pressure from EU leaders, much less would likely have been accomplished at either the technical or political level. The Declaration on Combating Terrorism of March 2004, as well as the EU's quick and definite rejection of Bin Laden's offer, show how EU leaders react collectively when confronted with a terrorist emergency. Had they not been meeting regularly on these issues and focusing on the measures described above, it is doubtful that Europe would have responded as well as it did from September 11 to the present.

Third, as a result of this trend, the United States is rapidly developing a relationship with the EU in areas that formerly were the unique preserve of the EU member states. The progress of this new relationship has been uneven. Sometimes the U.S. has responded cautiously to EU initiatives, fearing to disturb existing arrangements with EU member states or create a new bureaucratic monster. At other times the EU has responded angrily to what it perceived as unreasonable, unilateral U.S. initiatives or demands, often the result of U.S. legislative requirements but complicated by the major bureaucratic reorganization that created the Department of Homeland Security. With sufficient attention from the most senior levels of government on both sides, the final result has been positive, but similar problems are sure to recur, whether over biometric indicators or the impact of various initiatives in the new U.S. intelligence legislation.

Fourth, the EU's efforts to develop counter-terrorism capabilities are intertwined with and reinforce its efforts to pursue a close relationship with the United States in this area. The United States is indeed contributing to "building Europe," whether consciously or not, because Europeans have determined that the only solution to their security problems is a stronger Europe. But U.S. actions will "build Europe" only to the extent that Europe itself takes the necessary internal steps to implement its own policies.

In addition, there are specific problems that will likely dominate future discussions. The EU must address the question of data privacy; concerns about protection of personal data have surfaced in almost all the cases cited above and will only increase as the EU seeks to expand its powers. The salience of this issue reflects the EU's "democratic deficit"--its poor image in the eyes of the European public--but its impact extends beyond internal EU debates. Failure to find an acceptable compromise will in effect doom future transatlantic security discussions while, from an American perspective, success could make a constructive contribution to the domestic U.S. debate on these same issues.

Europeans must not underestimate the importance to the United States of finding better ways to keep terrorists from exploiting the lack of travel restrictions between the United States and Europe. While those concerns are understandable, the United States must beware of imposing border controls so onerous that they disrupt travel. If that occurs, public anger on both sides of the Atlantic will be great, but the damage in Europe could be severe.

Delays in passing laws and implementing them could be attributed in part to EU institutional arrangements and in part to the difficulty of changes in areas so intimately linked to national sovereignty. But it is striking that these changes are so hard to make when law-and-order issues have become politically significant, with far-right parties springing up in a number of European countries in response to the perceived failure of governments to address these issues. Typically, these parties are also anti-EU. This, despite the results of opinion polls, such as one conducted in December 2003, that reported that over 70 percent of Europeans think joint decisions and actions are the best way to prevent and fight crime. (24) The EU must do more to persuade its citizenry that it is the means to guarantee public security and to develop a clear public consensus in support of its approach.

Neither U.S. nor EU political leaders have engaged the attention of their political elites with their counter-terrorist agenda. Officials on both sides of the Atlantic, well aware of the overall turbulence of the transatlantic relationship, have been at pains to keep foreign policy and counter-terrorist issues separate and to address problems within government channels rather than negotiating via the media. But while this approach undoubtedly has brought substantial benefits, it does have the downside of failing to educate either the public or the political elites about the true state of affairs. Nothing is kept secret, but the technical nature of the issues makes them harder to understand and less attractive than, say, foreign policy disputes.

Nor does this practical cooperation equate to agreement on the strategic approach to be taken in combating terrorism: Is this a fight to be conducted primarily at home or carried abroad to the enemy? The Europeans until now have overwhelmingly favored the former, particularly if what is under discussion is military action abroad. And they have firmly rejected talk of a "war on terror," preferring instead to call it the "fight against terrorism." The U.S. approach is shaped in part by the fact that the United States has long, porous borders, making a defensive policy alone extremely dangerous. Perhaps the EU, as it absorbs the reality of its long, porous, post-expansion borders, will come closer to the U.S. strategic perspective.

(1) "Conclusions and Plan of Action of the Extraordinary European Council Meeting on 21 September 2001," SN140/01, available at http://ue.eu.int/ueDocs/cms_Data/docs/pressData/en/ec/140.en.pdf.

(2) "Presidency conclusions--European Council Meeting in Laeken, 14 and 15 December 2001," SN 300/1/01 REV1. Available at http://ue.eu.int/ueDocs/cms_Data/docs/pressData/en/ec/68827.pdf.

(3) The Council of Ministers, the European Commission, and the European Parliament are central EU institutions located in Brussels. The European Court of Justice, mentioned later, is in Luxembourg.

(4) "A Secure Europe in a Better World--a European Security Strategy," adopted by the European Council on December 12, 2003, Brussels, available at http://www.consilium.eu.int/pressData/en/misc/78348.pdf.

(5) Under Pillar One the member states, acting in the Council of Ministers, decide on the basis of qualified majority voting (a weighted system) to delegate executive authority to the European Commission, including various enforcement powers. Most of what people think of as EU functions (trade, competition policy, etc.) come under Pillar One. Pillar Two covers foreign and security policy; these issues lie in the purview of the Council of Ministers and are decided on the basis of unanimity. The Commission's principal contribution to Pillar Two is in the related area of foreign assistance. In Pillar Three, or "justice and home affairs," member states vote in the Council of Ministers on the basis of unanimity, and the Commission plays a limited role. The different pillars reflect varying degrees of consensus on what the EU's role should be. The Constitutional Treaty would dismantle the formal pillar system.

(6) "Declaration on Combating Terrorism," European Council document, March 25, 2004, available at http://ue.eu.int/uedocs/cmsUpload/79635.pdf.

(7) Provisional consolidated version of the draft Treaty establishing a Constitution for Europe, European Council of Ministers Doc. CIG 86/04, Brussels, June 25, 2004, Art. 1-42, available at http://ue.eu.int/igcpdf/en/04/cg00/cg00087.en04.pdf. The solidarity clause calls on the Union and the EU member states to come to the aid of a member state that is the victim of terrorist attack, using military resources if necessary.

(8) "The Hague Programme: Strengthening Freedom, Security and Justice in the European Union," Presidency Conclusions--Brussels European Council, November 4-5, 2004, 14292/1/04 REV1, Annex 1, Brussels, December 8, 2004, 11-42. available at http://ue.eu.int/ueDocs/cms_Data/docs/pressData/en/ec/82534.pdf.

(9) Testimony of Gijs De Vries, in U.S.-European Cooperation on Counterterrorism: Achievements and Challenges, Joint Hearing before the Subcommittee on Europe and the Subcommittee on International Terrorism, Nonproliferation and Human Rights of the Committee on International Relations, U.S. House of Representatives, September 14, 2004, Serial No. 108-143, 24, available at http://www.house.gov/international_relations/euhear108.htm.

(10) Joanna Apap, Didier Bigo and Juliette Lodge, "Data Protection in Justice and Home Affairs: An Opportunity for Transatlantic Dialogue," Centre for European Policy Studies (January 2004). Available at http://www.ceps.be/wp/php?article_id=83.

(11) Secretary of State Colin Powell witnessed the signing of the first Europol agreement, in the Council of Ministers Justus Lipsius building in Brussels. Javier Solana noted with great pleasure that this was the first time a senior American official had come for business to "Europe's house." The connection of closer transatlantic ties to "building Europe" was clear.

(12) Conversation with the author. The role of trust and mutual understanding is also key in allowing the EU member states to cooperate on legal issues among themselves.

(13) "Agreement on extradition between the European Union and the United States of America," Official Journal of the European Union, 19.7.2003, L 181/27, Article 13, available at http://europa.eu.int/eurlex/pri/en/oj/dat/2003/l_181/l_18120030719en00270033.pdf.

(14) "Agreement on mutual legal assistance between the European Union and the United States of America," Official Journal of the European Union, 19.7., 2003, L 181/34, available at http://europa.eu.int/eur-lex/pri/en/oj/dat/2003/l_181/l_18120030719en00340042.pdf.

(15) Article 3, subparagraph 2(a) in each. The agreement on mutual legal assistance contained an additional provision, in subparagraph 3(a), requiring the EU to ensure that the provisions of the agreement were applied in member states that did not have an existing MLAT with the United States.

(16) "Council Decision of 17 May 2004 on the conclusion of an Agreement between the European Community and the United States of American on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection," Official Journal of the European Union, L 183/83 (20.5.2004), available at http:europa.eu.int/comm/external_relations/us/intro/pnr_agreement0504.pdf. The agreement was only temporary because it was based on allowing CBP officials electronic access to airline databases, which contained more information than the U.S. authorities required. This agreement is designed to last only until the airlines develop a new system for providing only the requested data.

(17) "Commission Decision of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States' Bureau of Customs and Border Protection," Official Journal of the European Union, L. 235/11 (6.7.2004), available at http://europa.eu.int/comm/internal_market/privacy/docs/adequacy/pnr/c-2004-1914/c-2004-1914_en.pdf. The CBP document, "Undertakings of the Department of Homeland Security Bureau of Customs and Border Protection (CBP)," dated May 11, 2004, is included as an annex. Also available as a Federal Register note, at http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=2004_register&docid=04-15642-filed.pdf.

(18) "Council Regulation (EC) No 2252/2004 of December 13, 2004 on standards for security features and biometrics in passports and travel documents issued by Member States," Official Journal of the European Union, 29.12.2004, L/385/1-6. The UK, Denmark, and Ireland are not covered by this regulation.

(19) The two men who assassinated Afghan Northern Alliance leader Ahmed Shah Massoud on September 10, 2001, were carrying Belgian passports.

(20) The December Council regulation also addresses this issue, requiring each member state to designate not more than one body to produce passports and travel documents.

(21) Art. 1(4) of Reg. (EC) No. 539/2001. The Schengen accords grew out of an agreement among five member states in 1985 and were incorporated into EU law by the Treaty of Amsterdam in 1999. For more information, see the background paper at http://europa.eu.int/scadplus/leg/en/lvb/L33020.htm.

(22) In fact, of the original 15 EU member states, Greece had not enjoyed visa-free status either. It, however, had declined to raise the issue. The two new EU members have chosen a more confrontational approach.

(23) William T. Pope, HIRC testimony, 42-43.

(24) The reference is to a Eurobarometer poll conducted in December 2003. See "Communication from the Commission to the Council and the European Parliament. Area of Freedom, Security and Justice: Assessment of the Tampere programme and future orientations," Commission of the European Communities, COM (2004) 401 final, Brussels, 2.6.2004, p.3.

Leslie S. Lebl is nonresident senior fellow of the Atlantic Council of the United States. An earlier version of this article appeared as a working paper of the American Consortium on European Union Studies.