ISSN 1977-0677

Official Journal

of the European Union

L 393

European flag  

English edition

Legislation

Volume 63
23 November 2020


Contents

 

II   Non-legislative acts

page

 

 

REGULATIONS

 

*

Council Implementing Regulation (EU) 2020/1744 of 20 November 2020 implementing Regulation (EU) 2019/796 concerning restrictive measures against cyber-attacks threatening the Union or its Member States

1

 

 

DECISIONS

 

*

Council Implementing Decision (EU) 2020/1745 of 18 November 2020 on the putting into effect of the provisions of the Schengen acquis on data protection and on the provisional putting into effect of certain provisions of the Schengen acquis in Ireland

3

 

*

Council Decision (CFSP) 2020/1746 of 20 November 2020 amending and updating Decision (CFSP) 2018/340 establishing the list of projects to be developed under PESCO

12

 

*

Council Decision (EU) 2020/1747 of 20 November 2020 on the position to be taken on behalf of the European Union within the Joint Committee established under the Agreement between the European Union and Japan for an Economic Partnership, as regards the amendment of Appendices 2-C-1 and 2-C-2 to Annex 2-C on Motor Vehicles and Parts

17

 

*

Council Decision (CFSP) 2020/1748 of 20 November 2020 amending Decision (CFSP) 2019/797 concerning restrictive measures against cyber-attacks threatening the Union or its Member States

19

EN

Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.

The titles of all other Acts are printed in bold type and preceded by an asterisk.


II Non-legislative acts

REGULATIONS

23.11.2020   

EN

Official Journal of the European Union

L 393/1


COUNCIL IMPLEMENTING REGULATION (EU) 2020/1744

of 20 November 2020

implementing Regulation (EU) 2019/796 concerning restrictive measures against cyber-attacks threatening the Union or its Member States

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Regulation (EU) 2019/796 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (1), and in particular Article 13(1) thereof,

Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy,

Whereas:

(1)

On 17 May 2019 the Council adopted Regulation (EU) 2019/796.

(2)

On 30 July 2020 the Council adopted implementing Regulation (EU) 2020/1125 (2), which added six natural persons and three entities or bodies to the list of natural and legal persons, entities and bodies subject to restrictive measures set out in Annex I to Regulation (EU) 2019/796.

(3)

Updated information has been received for two listings of natural persons.

(4)

Regulation (EU) 2019/796 should therefore be amended accordingly,

HAS ADOPTED THIS REGULATION:

Article 1

Annex I to Regulation (EU) 2019/796 is amended in accordance with the Annex to this Regulation.

Article 2

This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 20 November 2020.

For the Council

The President

M. ROTH


(1)  OJ L 129 I, 17.5.2019, p. 1.

(2)  Council Implementing Regulation (EU) 2020/1125 of 30 July 2020 implementing Regulation (EU) 2019/796 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (OJ L 246, 30.7.2020, p. 4).


ANNEX

In Annex I to Regulation (EU) 2019/796, under the subheading ‘A. Natural Persons’, entries 1 and 2 are replaced by the following entries:

 

Name

Identifying information

Reasons

Date of listing

‘1.

GAO Qiang

Date of birth: 4 October 1983

Place of birth: Shandong Province, China

Address: Room 1102, Guanfu Mansion, 46 Xinkai Road, Hedong District, Tianjin, China

Nationality: Chinese

Gender: male

Gao Qiang is involved in "Operation Cloud Hopper", a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

"Operation Cloud Hopper" has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as "APT10" ("Advanced Persistent Threat 10") (a.k.a. "Red Apollo", "CVNX", "Stone Panda", "MenuPass" and "Potassium") carried out "Operation Cloud Hopper".

Gao Qiang can be linked to APT10, including through his association with APT10 command and control infrastructure. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating "Operation Cloud Hopper", employed Gao Qiang. He has links with Zhang Shilong, who is also designated in connection with "Operation Cloud Hopper". Gao Qiang is therefore associated with both Huaying Haitai and Zhang Shilong.

30.7.2020

2.

ZHANG Shilong

Date of birth: 10 September 1981

Place of birth: China

Address: Hedong, Yuyang Road No 121, Tianjin, China

Nationality: Chinese

Gender: male

Zhang Shilong is involved in "Operation Cloud Hopper", a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

"Operation Cloud Hopper" has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as "APT10" ("Advanced Persistent Threat 10") (a.k.a. "Red Apollo", "CVNX", "Stone Panda", "MenuPass" and "Potassium") carried out "Operation Cloud Hopper".

Zhang Shilong can be linked to APT10, including through the malware he developed and tested in connection with the cyber-attacks carried out by APT10. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating "Operation Cloud Hopper", employed Zhang Shilong. He has links with Gao Qiang, who is also designated in connection with "Operation Cloud Hopper". Zhang Shilong is therefore associated with both Huaying Haitai and Gao Qiang.

30.7.2020’.


DECISIONS

23.11.2020   

EN

Official Journal of the European Union

L 393/3


COUNCIL IMPLEMENTING DECISION (EU) 2020/1745

of 18 November 2020

on the putting into effect of the provisions of the Schengen acquis on data protection and on the provisional putting into effect of certain provisions of the Schengen acquis in Ireland

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen acquis (1), and in particular Article 4 thereof,

Whereas:

(1)

By Decision 2002/192/EC, and in accordance with Article 4 of Protocol No 19 on the Schengen acquis integrated into the framework of the European Union, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union (‘Protocol No 19’), the Council authorised Ireland to participate in certain provisions of the Schengen acquis.

(2)

In accordance with Article 4(1) and 4(3) of Decision 2002/192/EC, the provisions referred to in Article 1 of that Decision are to be put into effect, between Ireland and the Member States and other States for which those provisions have already been put into effect, when the preconditions for the implementation of those provisions have been fulfilled in all of those Member States and other States, by an implementing decision taken by the Council, acting with the unanimity of its members as referred to in Article 1 of Protocol No 19 and of the representative of the Government of Ireland. The Council may set different dates for the putting into effect of different provisions by subject area.

(3)

On 8 January 2018, Ireland expressed its intention to commence implementation of the following parts of the Schengen acquis: the Schengen Information System (‘SIS’) and the related data protection rules.

(4)

By letter of 7 July 2020, Ireland expressed its intention to commence implementation of the following parts of the Schengen acquis: judicial cooperation, drugs cooperation, police cooperation and Article 26 of the Convention implementing the Schengen Agreement (2) (the ‘Schengen Convention’). In that letter, Ireland also expressed its intention to implement Article 27 of the Schengen Convention, including Council Directive 2002/90/EC (3) and Council Framework Decision 2002/946/JHA (4) which constitute its subsequent developments, as well as Council Decisions 2008/149/JHA (5) and 2011/349/EU (6), as from 1 January 2022.

As regards the Decision of the Executive Committee of 22 December 1994 (7), it is Ireland’s intention to commence implementation of that Decision as from 1 July 2022.

(5)

Ireland thus indicated that it was now ready to provisionally put into effect the provisions of the Schengen acquis referred to in Article 1 of Decision 2002/192/EC in so far as they relate to the functioning of SIS (‘the provisions related to the functioning of SIS’), judicial cooperation, drugs cooperation, police cooperation and Article 26 of the Schengen Convention, with the exception of Article 27 of the Schengen Convention as well as Decisions 2008/149/JHA and 2011/349/EU and the Decision of the Executive Committee of 22 December 1994, which should be implemented at a later stage.

(6)

With respect to the evaluation of Ireland for the purpose of verifying that the necessary conditions for the application of the relevant parts of the Schengen acquis in which Ireland requested to participate have been met, Council Regulation (EU) No 1053/2013 (8) applies. However, given the fact that some of the provisions of the Schengen acquis in which Ireland participates should apply on a provisional basis, with the evaluations carried out only at a later stage, it is necessary to streamline the procedures for follow-up and monitoring provided for in Regulation (EU) No 1053/2013 in case those evaluations demonstrate that the conditions for the application of the relevant parts of the Schengen acquis have not been met by Ireland.

(7)

Regulation (EU) 2018/1862 of the European Parliament and of the Council (9) governs the establishment, operation and use of SIS in the field of police cooperation and judicial cooperation in criminal matters. Once applicable, that Regulation will replace Council Decision 2007/533/JHA (10), which currently applies in those matters.

(8)

Compliance with data protection requirements is a precondition for the provisional application of the provisions related to the functioning of SIS. In line with Regulation (EU) No 1053/2013, and based on the Commission’s multiannual and annual evaluation programmes established pursuant to that Regulation, the data protection evaluation took place between 19 and 23 November 2018, and the Commission adopted an evaluation report on 9 August 2019.

(9)

The evaluation report concluded that Ireland meets the necessary conditions for the application of the provisions of the Schengen acquis referred to in point (a)(ii) of Article 1 of Decision 2002/192/EC in so far as they relate to data protection, therefore allowing those provisions, to be put into effect by Ireland.

(10)

In accordance with Article 1(1) of Commission Implementing Decision (EU) 2015/450 (11), it has been verified that, from a technical point of view, the national system (N.SIS) of Ireland is ready to integrate into SIS.

(11)

Since Ireland has made the necessary technical and legal arrangements to process SIS data and exchange supplementary information, it is possible to set a date from which the provisions related to the functioning of SIS should be applied on a provisional basis in Ireland. The application of this Decision should allow for SIS data, as well as supplementary information and additional data, to be transferred to Ireland. The concrete use made of these data exchanges would allow for the verification of the correct application of the provisions related to the functioning of SIS in Ireland, through the applicable Schengen evaluation procedures.

(12)

Given that the Schengen acquis was conceived and functions as a coherent ensemble, it is the view of the Council that any partial application by Ireland of the provisions of the Schengen acquis in which it participates must respect the coherence of the subject areas which constitute the ensemble of the acquis. Therefore, in order to apply on a provisional basis the provisions related to the functioning of SIS, it is necessary that Ireland, provisionally, put into effect the provisions of the Schengen acquis relating to judicial cooperation, drugs cooperation, police cooperation and Article 26 of the Schengen Convention from the same date as the provisional putting into effect of the provisions related to the functioning of SIS, namely as from the date of application of this Decision.

(13)

Within six months of the date of application of this Decision, evaluation visits should be carried out in Ireland to verify whether SIS is functioning properly and whether Decision 2007/533/JHA is being applied correctly. Within 12 months of the date of application of this Decision, evaluation questionnaires should be sent to, and evaluation visits should be carried out in, Ireland, as appropriate, to evaluate the application of the provisions of the Schengen acquis relating to judicial cooperation, drugs cooperation, police cooperation and Article 26 of the Schengen Convention in order to demonstrate that the requirements relating to all relevant legislation and operational activities have been satisfied.

(14)

Given the importance of the coherence in the application of the Schengen acquis and the importance of SIS as a compensatory measure in the area of freedom, security and justice, and given the fact that some of the provisions of the Schengen acquis in which Ireland participates should apply on a provisional basis, with the evaluations carried out only at a later stage, a mechanism should be put in place to withdraw the operational access of Ireland to SIS (‘the mechanism to withdraw operational access of Ireland to SIS’) in case those evaluations conclude that the conditions for the application of the provisions related to the functioning of SIS have not been met by Ireland. The same mechanism should apply in case evaluations conclude that the conditions for the application of the provisions of the Schengen acquis relating to judicial cooperation, drugs cooperation, police cooperation and Article 26 of the Schengen Convention necessary for the proper functioning of SIS have not been met by Ireland. In both cases, Ireland should cease to be entitled to have operational access to SIS. The Council should to that effect, by means of an implementing decision, set a date from which the provisions related to the functioning of SIS are to cease to apply to Ireland, and adopt the transitional arrangements necessary to exchange supplementary information concerning alerts issued in SIS before that date. eu-LISA should make the necessary arrangements to disconnect Ireland from SIS.

(15)

This Decision should therefore put into effect, provisionally, the provisions related to the functioning of SIS and the remaining provisions referred to in Article 1 of Decision 2002/192/EC, with the exception of Article 27 of the Schengen Convention as well as Decisions 2008/149/JHA and 2011/349/EU and the Decision of the Executive Committee of 22 December 1994 which should be put into effect provisionally at a later stage. Upon successful completion of the evaluations concerning the provisions that are provisionally put into effect, and without prejudice to the mechanism to withdraw operational access of Ireland to SIS, the Council should, within 24 months of the date of application of this Decision, examine the situation with a view to adopting, in accordance with Article 4(1) of Decision 2002/192/EC read in conjunction with Article 4 of Protocol No 19, an implementing decision setting the date for their final putting into effect.

(16)

As regards Article 27 of the Schengen Convention and Decisions 2008/149/JHA and 2011/349/EU, Ireland should put them into effect provisionally as from 1 January 2022 at the latest. As regards the Decision of the Executive Committee of 22 December 1994, Ireland should put it into effect provisionally as from 1 July 2022 at the latest. Ireland should notify to the Council the date from which it will commence the application of those provisions accordingly.

(17)

Regulation (EU) 2016/94 of the European Parliament and of the Council (12) repealed several decisions of the Executive Committee belonging to the Schengen acquis and referred to in point (c) of Article 1 of Decision 2002/192/EC because they had become obsolete. Those decisions are not therefore to be put into effect by Ireland. Such is the case for the Decisions of the Executive Committee SCH/Com-ex (93) 14 (improving practical cooperation between the judicial authorities to combat drug trafficking), SCH/Com-ex (98) 52 (handbook on cross-border police cooperation) and SCH/Com-ex (99) 11 rev 2 (agreement on cooperation in proceedings for road traffic offences).

(18)

As regards Iceland and Norway, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters’ association with the implementation, application and development of the Schengen acquis (13), which fall within the area referred to in Article 1, point G, of Council Decision 1999/437/EC (14).

(19)

In accordance with Article 2 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway on the establishment of rights and obligations between Ireland and the United Kingdom of Great Britain and Northern Ireland, on the one hand, and the Republic of Iceland and the Kingdom of Norway, on the other, in areas of the Schengen acquis which apply to these States (15), the Mixed Committee established pursuant to Article 3 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters’ association with the implementation, application, and development of the Schengen acquis has been consulted in accordance with Article 4 of the latter Agreement with regard to the preparation of this Decision.

(20)

As regards Switzerland, this Decision constitutes a development of provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (16) which fall within the area referred to in Article 1, points G, H and I, of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC (17).

(21)

In accordance with Article 5 of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, the Mixed Committee established pursuant to Article 3 thereof has been informed about the preparation of this Decision.

(22)

As regards Liechtenstein, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (18) which fall within the area referred to in Article 1, points G, H and I, of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU (19),

HAS ADOPTED THIS DECISION:

Article 1

1.   The provisions referred to in point (a)(ii) of Article 1 of Decision 2002/192/EC, in so far as they relate to data protection, including the relevant provisions of the acts constituting the developments of the Schengen acquis adopted after the adoption of Decision 2002/192/EC and listed in the Annex to this Decision, shall be put into effect by and apply to Ireland in its relations with the Kingdom of Belgium, the Republic of Bulgaria, the Czech Republic, the Kingdom of Denmark, the Federal Republic of Germany, the Republic of Estonia, the Hellenic Republic, the Kingdom of Spain, the French Republic, the Republic of Croatia, the Italian Republic, the Republic of Latvia, the Republic of Lithuania, the Grand Duchy of Luxembourg, Hungary, Republic of Malta, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Poland, the Portuguese Republic, Romania, the Republic of Slovenia, the Slovak Republic, the Republic of Finland and the Kingdom of Sweden, as from 1 January 2021.

2.   The following provisions, including the relevant provisions of the acts constituting the developments of the Schengen acquis adopted after the adoption of Decision 2002/192/EC and listed in the Annex to this Decision, shall be put into effect by and apply to Ireland in its relations with the Kingdom of Belgium, the Republic of Bulgaria, the Czech Republic, the Kingdom of Denmark, the Federal Republic of Germany, the Republic of Estonia, the Hellenic Republic, the Kingdom of Spain, the French Republic, the Republic of Croatia, the Italian Republic, the Republic of Latvia, the Republic of Lithuania, the Grand Duchy of Luxembourg, Hungary, Republic of Malta, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Poland, the Portuguese Republic, Romania, the Republic of Slovenia, the Slovak Republic, the Republic of Finland and the Kingdom of Sweden, on a provisional basis and subject to the conditions specified in this Decision, as from 1 January 2021:

(a)

the provisions referred to in point (a)(ii) and (iii) of Article 1 of Decision 2002/192/EC, in so far as they relate to the functioning of SIS; and

(b)

the remaining provisions referred to in Article 1 of Decision 2002/192/EC.

3.   By way of derogation from paragraph 2 of this Article:

(a)

Article 27 of the Schengen Convention, including Directive 2002/90/EC and Framework Decision 2002/946/JHA, which constitute its subsequent developments, as well as Decisions 2008/149/JHA and 2011/349/EU, shall be put into effect by and apply to Ireland, on a provisional basis, as from 1 January 2022 at the latest;

(b)

the Decision of the Executive Committee of 22 December 1994 shall be put into effect by and apply to Ireland, on a provisional basis, as from 1 July 2022 at the latest.

Ireland shall notify to the Council the date from which it will commence the application of the provisions referred to in this paragraph.

4.   As from 4 January 2021, SIS alerts as defined in point (a) of Article 3(1) of Decision 2007/533/JHA and as referred to in Chapters V (alerts in respect of persons wanted for arrest for surrender or extradition purposes), VI (alerts on missing persons), VII (alerts on persons sought to assist with a judicial procedure), VIII (alerts on persons and objects for discreet checks or specific checks) and IX (alerts on objects for seizure or use as evidence in criminal proceedings) of that Decision, as well as supplementary information and additional data as defined in points (b) and (c) of Article 3(1) thereof, connected with those alerts, shall be made available to Ireland in accordance with that Decision.

5.   As from 15 March 2021, Ireland shall enter data into SIS and use the SIS data, as well as supplementary information and additional data referred to in paragraph 4, in accordance with Decision 2007/533/JHA.

Article 2

1.   By 30 June 2021, evaluation visits shall be carried out in Ireland in accordance with the relevant procedures provided for in Regulation (EU) No 1053/2013, in order to verify whether SIS is functioning properly and whether Decision 2007/533/JHA is being applied correctly.

2.   By 31 December 2021, evaluation questionnaires shall be sent to, and evaluation visits shall be carried out in, Ireland in accordance with the relevant procedures provided for in Regulation (EU) No 1053/2013, in order to verify whether the requirements concerning all relevant legislation and operational activities have been satisfied and the provisions of the Schengen acquis relating to judicial cooperation, drugs cooperation, police cooperation and Article 26 of the Schengen Convention are being applied correctly.

3.   The evaluation reports drawn up in accordance with the relevant provisions of Regulation (EU) No 1053/2013 shall take into account the state of preparation for the application or, if applicable, provisional application, by Ireland of the provisions referred to in Article 1(3) of this Decision.

4.   The evaluation reports shall be submitted to the Council. Those reports shall conclude whether the conditions for the application of the relevant provisions of the Schengen acquis in the particular area have been met by Ireland. In case an evaluation report concerning one of the areas judicial cooperation, drugs cooperation, police cooperation or Article 26 of the Schengen Convention concludes that the conditions for the application of the relevant provisions of the Schengen acquis in Ireland in that area have not been met by Ireland, that evaluation report shall explicitly state if and how the non-implementation of those conditions affects the proper functioning of SIS. In the light of the findings and the assessments contained in those evaluation reports, Article 15 of Regulation (EU) No 1053/2013 shall apply.

5.   By way of derogation from Article 16 of Regulation (EU) No 1053/2013, Ireland shall provide the Commission and the Council with an action plan to remedy any deficiencies identified in the evaluation reports within one month of the date of adoption of the recommendations referred to in Article 15 of that Regulation.

In case the Commission concludes in its assessment that the action plan provided by Ireland is inadequate or in case the evaluation reports identified any of the deficiencies as seriously affecting the proper functioning of SIS and that deficiency is not remedied by Ireland within a period of six months from the date of adoption of the recommendations referred to in Article 15 of Regulation (EU) No 1053/2013, Ireland shall cease to be entitled to have an operational access to SIS until the conditions for the application of those provisions have been met by Ireland.

To establish whether Ireland has remedied the identified deficiencies and whether the conditions for application of the relevant provisions of the Schengen acquis have been met, the Commission shall submit to the Council an assessment at the end of the six-month period referred to in the second subparagraph. The Commission shall also transmit that assessment to the European Parliament.

In case the assessment concludes that the conditions for the application of the relevant provisions of the Schengen acquis necessary for the proper functioning of SIS have not been met by Ireland, the Council shall, within one month of the date of that assessment, by means of an implementing act:

(a)

set a date from which point (a) of Article 1(2), Article 1(4) and (5), shall cease to apply; and

(b)

adopt the transitional measures necessary to ensure the exchange of supplementary information concerning alerts issued in SIS before the date referred to in point (a) of this subparagraph.

eu-LISA shall make the necessary arrangements to disconnect Ireland from SIS.

The Council shall, as appropriate, examine the situation with a view to adopting a new decision, by means of an implementing act, setting the date for the provisional putting into effect by Ireland of the provisions referred to in point (a) of Article 1(2) of this Decision.

6.   Without prejudice to paragraph 5 of this Article, upon successful completion of the evaluations, the Council shall, by 31 December 2022, in accordance with Article 4(1) of Decision 2002/192/EC read in conjunction with Article 4 of Protocol No 19, examine the situation with a view to adopting an implementing decision setting the date for the final putting into effect by Ireland of the provisions referred to in Article 1(2) and (3) of this Decision.

The implementing decision referred to in the first subparagraph of this paragraph shall take into account the state of application of the provisions referred to in Article 1(3).

Article 3

This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union.

It shall apply as from 1 January 2021.

Article 4

This Decision shall apply in accordance with the Treaties.

Done at Brussels, 18 November 2020.

For the Council

The President

M. ROTH


(1)  OJ L 64, 7.3.2002, p. 20.

(2)  Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders (OJ L 239, 22.9.2000, p. 19).

(3)  Council Directive 2002/90/EC of 28 November 2002 defining the facilitation of unauthorised entry, transit and residence (OJ L 328, 5.12.2002, p. 17).

(4)  Council Framework Decision 2002/946/JHA of 28 November 2002 on the strengthening of the penal framework to prevent the facilitation of unauthorised entry, transit and residence (OJ L 328, 5.12.2002, p. 1).

(5)  Council Decision 2008/149/JHA of 28 January 2008 on the conclusion on behalf of the European Union of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 50).

(6)  Council Decision 2011/349/EU of 7 March 2011 on the conclusion on behalf of the European Union of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating in particular to judicial cooperation in criminal matters and police cooperation (OJ L 160, 18.6.2011, p. 1).

(7)  Decision of the Executive Committee of 22 December 1994 on the certificate provided for in Article 75 to carry narcotic drugs and psychotropic substances (SCH/Com ex (94) 28 rev.) (OJ L 239, 22.9.2000, p. 463).

(8)  Council Regulation (EU) No 1053/2013 of 7 October 2013 establishing an evaluation and monitoring mechanism to verify the application of the Schengen acquis and repealing the Decision of the Executive Committee of 16 September 1998 setting up a Standing Committee on the evaluation and implementation of Schengen (OJ L 295, 6.11.2013, p. 27).

(9)  Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).

(10)  Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007, p. 63).

(11)  Commission Implementing Decision (EU) 2015/450 of 16 March 2015 laying down test requirements for Member States integrating into the second generation Schengen Information System (SIS II) or changing substantially their directly related national systems (OJ L 74, 18.3.2015, p. 31).

(12)  Regulation (EU) 2016/94 of the European Parliament and of the Council of 20 January 2016 repealing certain acts from the Schengen acquis in the field of police cooperation and judicial cooperation in criminal matters (OJ L 26, 2.2.2016, p. 6).

(13)  OJ L 176, 10.7.1999, p. 36.

(14)  Council Decision 1999/437/EC of 17 May 1999 on certain arrangements for the application of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis (OJ L 176, 10.7.1999, p. 31).

(15)  OJ L 15, 20.1.2000, p. 2.

(16)  OJ L 53, 27.2.2008, p. 52.

(17)  Council Decision 2008/146/EC of 28 January 2008 on the conclusion, on behalf of the European Community, of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 1).

(18)  OJ L 160, 18.6.2011, p. 21.

(19)  Council Decision 2011/350/EU of 7 March 2011 on the conclusion, on behalf of the European Union, of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating to the abolition of checks at internal borders and movement of persons (OJ L 160, 18.6.2011, p. 19).


ANNEX

List of acts constituting developments of the Schengen acquis which shall be provisionally put into effect by Ireland

1.   

Council Act of 29 May 2000 establishing in accordance with Article 34 of the Treaty on European Union the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union (provisions referred to in Article 2(1) of that Convention) (OJ C 197, 12.7.2000, p. 1).

2.   

Council Directive 2001/51/EC of 28 June 2001 supplementing the provisions of Article 26 of the Convention implementing the Schengen Agreement of 14 June 1985 (OJ L 187, 10.7.2001, p. 45).

3.   

Council Act of 16 October 2001 establishing, in accordance with Article 34 of the Treaty on European Union, the Protocol to the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union (provisions referred to in Article 15 of that Protocol) (OJ C 326, 21.11.2001, p. 1).

4.   

Council Directive 2002/90/EC of 28 November 2002 defining the facilitation of unauthorised entry, transit and residence (OJ L 328, 5.12.2002, p. 17(1).

5.   

Council Framework Decision 2002/946/JHA of 28 November 2002 on the strengthening of the penal framework to prevent the facilitation of unauthorised entry, transit and residence (OJ L 328, 5.12.2002, p. 1(2).

6.   

Council Decision 2003/170/JHA of 27 February 2003 on the common use of liaison officers posted abroad by the law enforcement agencies of the Member States (OJ L 67, 12.3.2003, p. 27).

7.   

Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ L 261, 6.8.2004, p. 24).

8.   

Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the exchange of information and intelligence between law enforcement authorities of the Member States of the European Union (OJ L 386, 29.12.2006, p. 89).

9.   

Council Decision 2006/560/JHA of 24 July 2006 amending Decision 2003/170/JHA on the common use of liaison officers posted abroad by the law enforcement agencies of the Member States (OJ L 219, 10.8.2006, p. 31).

10.   

Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007, p. 63).

11.   

Council Decision 2008/149/JHA of 28 January 2008 on the conclusion on behalf of the European Union of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 50(3).

12.   

Council Decision 2011/349/EU of 7 March 2011 on the conclusion on behalf of the European Union of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating in particular to judicial cooperation in criminal matters and police cooperation (OJ L 160, 18.6.2011, p. 1(1).

13.   

Council Regulation (EU) No 1053/2013 of 7 October 2013 establishing an evaluation and monitoring mechanism to verify the application of the Schengen acquis and repealing the Decision of the Executive Committee of 16 September 1998 setting up a Standing Committee on the evaluation and implementation of Schengen (OJ L 295, 6.11.2013, p. 27).

14.   

Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

15.   

Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).

16.   

Regulation (EU) 2019/1240 of the European Parliament and of the Council of 20 June 2019 on the creation of a European network of immigration liaison officers (OJ L 198, 25.7.2019, p. 88).

17.   

Regulation (EU) 2020/493 of the European Parliament and of the Council of 30 March 2020 on the False and Authentic Documents Online (FADO) system and repealing Council Joint Action 98/700/JHA (OJ L 107, 6.4.2020, p. 1).


(1)  This provision shall be put into effect provisionally as from 1 January 2022.

(2)  This provision shall be put into effect provisionally as from 1 January 2022.

(3)  This provision shall be put into effect provisionally as from 1 January 2022.


23.11.2020   

EN

Official Journal of the European Union

L 393/12


COUNCIL DECISION (CFSP) 2020/1746

of 20 November 2020

amending and updating Decision (CFSP) 2018/340 establishing the list of projects to be developed under PESCO

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, in particular Article 46(6) thereof,

Having regard to Council Decision (CFSP) 2017/2315 of 11 December 2017 establishing permanent structured cooperation (PESCO) and determining the list of participating Member States (1),

Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy,

Whereas:

(1)

On 11 December 2017, the Council adopted Decision (CFSP) 2017/2315.

(2)

Point (e) of Article 4(2) of Decision (CFSP) 2017/2315 provides that the Council is to establish the list of projects to be developed under permanent structured cooperation (PESCO), reflecting both support for capability development and the provision of substantial support within the means and capabilities to common security and defence policy (CSDP) operations and missions.

(3)

On 6 March 2018, the Council adopted Decision (CFSP) 2018/340 (2) establishing the list of projects to be developed under PESCO.

(4)

On 6 March 2018, the Council adopted a Recommendation (3) concerning a roadmap for the implementation of PESCO (the ‘Recommendation’).

(5)

Paragraph 9 of the Recommendation specifies that the Council should update the list of PESCO projects by November 2018 to include the next set of projects, in accordance with the procedure set out in Article 5 of Decision (CFSP) 2017/2315, which provides in particular that the High Representative of the Union for Foreign Affairs and Security Policy may make a recommendation concerning the identification and evaluation of PESCO projects, on the basis of assessments provided by the PESCO secretariat, for the Council to take a decision, following military advice by the Military Committee of the European Union.

(6)

On 25 June 2018, the Council adopted Decision (CFSP) 2018/909 (4) establishing a common set of governance rules for PESCO projects.

(7)

On 19 November 2018, the Council adopted Decision (CFSP) 2018/1797 (5) amending and updating Decision (CFSP) 2018/340.

(8)

On 14 May 2019, the Council adopted a Recommendation (6) assessing the progress made by the participating Member States to fulfil commitments undertaken in the framework of PESCO.

(9)

On 12 November 2019, the Council adopted Decision (CFSP) 2019/1909 (7) amending and updating Decision (CFSP) 2018/340.

(10)

On 5 February 2020, the PESCO Secretariat informed the Council that the project members of the project ‘European Union Training Mission Competence Centre (EU TMCC)’ had decided to close the project.

(11)

Decision (CFSP) 2018/340 should therefore be amended and updated,

HAS ADOPTED THIS DECISION:

Article 1

The text appearing in the Annex to this Decision replaces Annex II to Decision (CFSP) 2018/340.

Article 2

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 20 November 2020.

For the Council

The President

M. ROTH


(1)  OJ L 331, 14.12.2017, p. 57.

(2)  Council Decision (CFSP) 2018/340 of 6 March 2018 establishing the list of projects to be developed under PESCO (OJ L 65, 8.3.2018, p. 24).

(3)  Council Recommendation of 6 March 2018 concerning a roadmap for the implementation of PESCO (OJ C 88, 8.3.2018, p. 1).

(4)  Council Decision (CFSP) 2018/909 of 25 June 2018 establishing a common set of governance rules for PESCO projects (OJ L 161, 26.6.2018, p. 37).

(5)  Council Decision (CFSP) 2018/1797 of 19 November 2018 amending and updating Decision (CFSP) 2018/340 establishing the list of projects to be developed under PESCO (OJ L 294, 21.11.2018, p. 18).

(6)  Council Recommendation of 14 May 2019 assessing the progress made by the participating Member States to fulfil commitments undertaken in the framework of permanent structured cooperation (PESCO) (OJ C 166, 15.5.2019, p. 1).

(7)  Council Decision (CFSP) 2019/1909 of 12 November 2019 amending and updating Decision (CFSP) 2018/340 establishing the list of projects to be developed under PESCO (OJ L 293, 14.11.2019, p. 113).


ANNEX

‘ANNEX II

CONSOLIDATED UPDATED LIST OF THE PROJECT MEMBERS OF EACH INDIVIDUAL PROJECT

Project

Project Members

1.

European Medical Command

Germany, Belgium, Czechia, Estonia, Spain, France, Italy, Hungary, Netherlands, Poland, Romania, Slovakia, Sweden

2.

European Secure Software defined Radio (ESSOR)

France, Belgium, Germany, Spain, Italy, Netherlands, Poland, Portugal, Finland

3.

Network of logistic Hubs in Europe and support to Operations

Germany, Belgium, Bulgaria, Greece, Spain, France, Croatia, Italy, Cyprus, Lithuania, Hungary, Netherlands, Poland, Slovenia, Slovakia

4.

Military Mobility

Netherlands, Belgium, Bulgaria, Czechia, Germany, Estonia, Greece Spain, France, Croatia, Italy, Cyprus, Latvia, Lithuania, Luxembourg, Hungary, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland, Sweden

5.

European Training Certification Centre for European Armies

Italy, Greece

6.

Energy Operational Function (EOF)

France, Belgium, Spain, Italy

7.

Deployable Military Disaster Relief Capability Package

Italy, Greece, Spain, Croatia, Austria

8.

Maritime (semi‐) Autonomous Systems for Mine Countermeasures (MAS MCM)

Belgium, Greece, Latvia, Netherlands, Poland, Portugal, Romania

9.

Harbour & Maritime Surveillance and Protection (HARMSPRO)

Italy, Greece, Poland, Portugal

10.

Upgrade of Maritime Surveillance

Greece, Bulgaria, Ireland, Spain, France, Croatia, Italy, Cyprus

11.

Cyber Threats and Incident Response Information Sharing Platform

Greece, Spain, Italy, Cyprus, Hungary Portugal

12.

Cyber Rapid Response Teams and Mutual Assistance in Cyber Security

Lithuania, Estonia, Croatia, Netherlands, Poland, Romania

13.

Strategic Command and Control (C2) System for CSDP Missions and Operations

Spain, Germany, France, Italy, Luxembourg, Portugal

14.

Armoured Infantry Fighting Vehicle / Amphibious Assault Vehicle / Light Armoured Vehicle

Italy, Greece, Slovakia

15.

Indirect Fire Support (EuroArtillery)

Slovakia, Italy, Hungary

16.

EUFOR Crisis Response Operation Core (EUFOR CROC)

Germany, Spain, France, Italy, Cyprus

17.

Helicopter Hot and High Training (H3 Training)

Greece, Italy, Romania

18.

Joint EU Intelligence School

Greece, Cyprus

19.

EU Test and Evaluation Centres

France, Sweden, Spain, Slovakia

20.

Integrated Unmanned Ground System (UGS)

Estonia, Belgium, Czechia, Germany, Spain, France, Latvia, Hungary, Netherlands, Poland, Finland

21.

EU Beyond Line Of Sight (BLOS) Land Battlefield Missile Systems

France, Belgium, Cyprus

22.

Deployable Modular Underwater Intervention Capability Package (DIVEPACK)

Bulgaria, Greece, France, Romania

23.

European Medium Altitude Long Endurance Remotely Piloted Aircraft Systems ‐ MALE RPAS (Eurodrone)

Germany, Czechia, Spain, France, Italy

24.

European Attack Helicopters TIGER Mark III

France, Germany, Spain

25.

Counter Unmanned Aerial System (C‐UAS)

Italy, Czechia

26.

European High Atmosphere Airship Platform (EHAAP) – Persistent Intelligence, Surveillance and Reconnaissance (ISR) Capability

Italy, France

27.

One Deployable Special Operations Forces (SOF) Tactical Command and Control (C2) Command Post (CP) for Small Joint Operations (SJO) – (SOCC) for SJO

Greece, Cyprus

28.

Electronic Warfare Capability and Interoperability Programme for Future Joint Intelligence, Surveillance and Reconnaissance (JISR) Cooperation

Czechia, Germany

29.

Chemical, Biological, Radiological and Nuclear (CBRN) Surveillance as a Service (CBRN SaaS)

Austria, France, Croatia, Hungary, Slovenia

30.

Co‐basing

France, Belgium, Czechia, Germany, Spain, Netherlands

31.

Geo‐meteorological and Oceanographic (GeoMETOC) Support Coordination Element (GMSCE)

Germany, Greece, France, Austria, Portugal, Romania

32.

EU Radio Navigation Solution (EURAS)

France, Belgium, Germany, Spain, Italy, Poland

33.

European Military Space Surveillance Awareness Network (EU‐SSA‐N)

Italy, Germany, France, Netherlands

34.

Integrated European Joint Training and Simulation Centre (EUROSIM)

Hungary, Germany, France, Poland, Slovenia

35.

EU Cyber Academia and Innovation Hub (EU CAIH)

Portugal, Spain

36.

Special Operations Forces Medical Training Centre (SMTC)

Poland, Hungary

37.

Chemical, Biological, Radiological and Nuclear (CBRN) Defence Training Range (CBRNDTR)

Romania, France, Italy

38.

European Union Network of Diving Centres (EUNDC)

Romania, Bulgaria, France

39.

Maritime Unmanned Anti‐Submarine System (MUSAS)

Portugal, Spain, France, Sweden

40.

European Patrol Corvette (EPC)

Italy, Greece, Spain, France

41.

Airborne Electronic Attack (AEA)

Spain, France, Sweden

42.

Cyber and Information Domain Coordination Centre (CIDCC)

Germany, Spain, Hungary, Netherlands

43.

Timely Warning and Interception with Space‐based TheatER surveillance (TWISTER)

France, Germany, Spain, Italy, Netherlands, Finland

44.

Materials and components for technological EU competitiveness (MAC‐EU)

France, Spain, Portugal, Romania

45.

EU Collaborative Warfare Capabilities (ECoWAR)

France, Belgium, Spain, Hungary, Poland, Romania, Sweden

46.

European Global Remotely Piloted Aircraft Systems (RPAS) Insertion Architecture System

Italy, France, Romania


23.11.2020   

EN

Official Journal of the European Union

L 393/17


COUNCIL DECISION (EU) 2020/1747

of 20 November 2020

on the position to be taken on behalf of the European Union within the Joint Committee established under the Agreement between the European Union and Japan for an Economic Partnership, as regards the amendment of Appendices 2-C-1 and 2-C-2 to Annex 2-C on Motor Vehicles and Parts

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 207(4), first subparagraph, in conjunction with Article 218(9) thereof,

Having regard to the proposal from the European Commission,

Whereas:

(1)

The Agreement between the European Union and Japan for an Economic Partnership (1) (‘the Agreement’) entered into force on 1 February 2019.

(2)

Annex 2-C to the Agreement, on Motor Vehicles and Parts, provides in Appendix 2-C-1 a list of UN Regulations applied by both Parties and in Appendix 2-C-2 a list of UN Regulations applied by one of the Parties and not yet considered by the other Party.

(3)

Since the signing of the Agreement and as a result of the progress in regulatory discussions in the United Nations Economic Commission for Europe (UNECE), both Parties now apply two additional UN Regulations that were not listed in Appendix 2-C-1. Furthermore, two UN Regulations that were listed in Appendix 2-C-2 are now applied by both Parties and are to be transferred to Appendix 2-C-1. Appendices 2-C-1 and 2-C-2 should therefore be updated in accordance with Article 9 of Annex 2-C to the Agreement. Such an update will increase the legal certainty for economic operators as regards the regulatory framework for the preferential trade relations between the Parties.

(4)

Pursuant to paragraph 3 and subparagraph 4(b) of Article 23.2 of the Agreement, in accordance with the respective domestic legal procedures of the Parties, the Joint Committee may adopt decisions to amend Appendices 2-C-1 and 2-C-2 to Annex 2-C to the Agreement.

(5)

It is appropriate to establish the position to be taken on the Union’s behalf within the Joint Committee, as the proposed decision of the Joint Committee will be binding on the Union.

(6)

The position of the Union within the Joint Committee should therefore be based on the draft decision of the Joint Committee,

HAS ADOPTED THIS DECISION:

Article 1

The position to be taken on the Union’s behalf within the Joint Committee established under the Agreement between the European Union and Japan for an Economic Partnership, as regards the amendment of Appendices 2-C-1 and 2-C-2 to Annex 2-C to the Agreement, shall be based on the draft decision of that Joint Committee (2).

Article 2

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 20 November 2020.

For the Council

The President

M. ROTH


(1)  OJ L 330, 27.12.2018, p. 3.

(2)  See document ST 12431/20 on http://register.consilium.europa.eu


23.11.2020   

EN

Official Journal of the European Union

L 393/19


COUNCIL DECISION (CFSP) 2020/1748

of 20 November 2020

amending Decision (CFSP) 2019/797 concerning restrictive measures against cyber-attacks threatening the Union or its Member States

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particular Article 29 thereof,

Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy,

Whereas:

(1)

On 17 May 2019 the Council adopted Decision (CFSP) 2019/797 (1).

(2)

On 30 July 2020 the Council adopted Decision (CFSP) 2020/1127 (2), which added six natural persons and three entities or bodies to the list of natural and legal persons, entities and bodies subject to restrictive measures set out in the Annex to Decision (CFSP) 2019/797.

(3)

Updated information has been received for two listings of natural persons.

(4)

Decision (CFSP) 2019/797 should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

The Annex to Decision (CFSP) 2019/797 is amended in accordance with the Annex to this Decision.

Article 2

This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 20 November 2020.

For the Council

The President

M. ROTH


(1)  Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (OJ L 129 I, 17.5.2019, p. 13).

(2)  Council Decision (CFSP) 2020/1127 of 30 July 2020 amending Decision (CFSP) 2019/797 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (OJ L 246, 30.7.2020, p. 12).


ANNEX

In the Annex to Decision (CFSP) 2019/797, under the subheading ‘A. Natural Persons’, entries 1 and 2 are replaced by the following entries:

 

Name

Identifying information

Reasons

Date of listing

‘1.

GAO Qiang

Date of birth: 4 October 1983

Place of birth: Shandong Province, China

Address: Room 1102, Guanfu Mansion, 46 Xinkai Road, Hedong District, Tianjin, China

Nationality: Chinese

Gender: male

Gao Qiang is involved in “Operation Cloud Hopper”, a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

“Operation Cloud Hopper” has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as “APT10” (“Advanced Persistent Threat 10”) (a.k.a. “Red Apollo”, “CVNX”, “Stone Panda”, “MenuPass” and “Potassium”) carried out “Operation Cloud Hopper”.

Gao Qiang can be linked to APT10, including through his association with APT10 command and control infrastructure. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating “Operation Cloud Hopper”, employed Gao Qiang. He has links with Zhang Shilong, who is also designated in connection with “Operation Cloud Hopper”. Gao Qiang is therefore associated with both Huaying Haitai and Zhang Shilong.

30.7.2020

2.

ZHANG Shilong

Date of birth: 10 September 1981

Place of birth: China

Address: Hedong, Yuyang Road No 121, Tianjin, China

Nationality: Chinese

Gender: male

Zhang Shilong is involved in “Operation Cloud Hopper”, a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

“Operation Cloud Hopper” has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as “APT10” (“Advanced Persistent Threat 10”) (a.k.a. “Red Apollo”, “CVNX”, “Stone Panda”, “MenuPass” and “Potassium”) carried out “Operation Cloud Hopper”.

Zhang Shilong can be linked to APT10, including through the malware he developed and tested in connection with the cyber-attacks carried out by APT10. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating “Operation Cloud Hopper”, employed Zhang Shilong. He has links with Gao Qiang, who is also designated in connection with “Operation Cloud Hopper”. Zhang Shilong is therefore associated with both Huaying Haitai and Gao Qiang.

30.7.2020’.