EDPS Opens Fact-Finding Into Europol Forensic Network and Pressure Cooker Claims

Europe’s top privacy supervisor for EU institutions is in the middle of a months-long fact-finding exercise into Europol’s data-processing environments, after a joint investigation by Computer Weekly, Correctiv and Solomon alleged that sensitive personal data sat for years in systems with weak logging, access tracking and password controls. Europol calls those characterisations incorrect. The European Data Protection Supervisor has not announced a finding of infringement. What is on the record so far is three overlapping stories: journalism claims, agency denials, and a supervisory process that is still gathering facts.

What the journalism alleged

The May 2026 investigation, expanded in follow-up reporting this week, described Europol’s Computer Forensics Network as a repository that grew far beyond forensic pre-processing. According to the reporters’ reading of leaked documents and anonymous accounts from former officials, the CFN held phone records, financial transactions, geolocation data and identity documents, including material on people who had never been suspected of a crime. Internal monitoring material from around 2019, as summarised in the reporting, flagged insufficient logging of administrative actions, no reliable way to track who had accessed or modified sensitive data, unrestricted software installation, and weak password management.

A separate strand of the same investigation focused on tools used by Europol’s Internet Referral Unit and referred to internally as the Pressure Cooker. The journalists portrayed that tooling as a fast-track path for processing data scraped from the open internet, and said leaked emails spanning several years described ongoing development of the internet-facing environment. Former officials quoted in the reporting characterised parts of the estate as a “shadow IT” space. Those are journalism allegations and anonymous testimony, not adjudicated findings.

The scale claims in the investigation are large and should be treated as reported figures, not independently verified counts here. By 2019, the CFN was described as holding at least two petabytes of data and, in a sample reviewed by Europol’s own data protection officer, nearly 25 million records across selected analytical projects. The same officer, Daniel Drewer, warned in a February 2019 internal report that the network was being used for more than forensic work and that regulatory action could threaten operational continuity. Those documents entered public view through the journalists’ Freedom of Information and leak-based reporting.

What Europol says in response

Europol has published a fact-check statement rejecting the “shadow database” framing. It says the Computer Forensic Network is part of its Forensic IT Environment, set up to process complex digital evidence and large operational datasets, and that the Internet Facing Operational Environment collects and assesses publicly available online information before relevant material enters the operational environment under applicable rules. Both environments, Europol says, have existed for years, evolved with the legal framework, and were not newly discovered or concealed.

On Pressure Cooker, Europol’s public line is careful. The agency describes the phrase as an internal ICT project-management term for acquiring, adapting or developing digital tools quickly while remaining compliant. Since 2017, it says, the term has been used for specific online tools supporting the Internet Referral Unit’s work to identify relevant online information under necessity and proportionality. Europol also told reporters that using the term since 2017 does not mean a new processing capability started that year, and that the underlying internet-facing environment dated to around 2015, before EDPS supervision of Europol began under the Europol Regulation in May 2017.

Timeline points Europol emphasises: it identified CFN governance, technical and security improvement needs in 2019 and says it proactively informed the EDPS and stood up a task force; 2022 amendments to the Europol Regulation added dedicated retention rules for large and complex datasets; and in 2025 it consulted the EDPS on further modernisation of IFOE components. The agency’s position is that disputes have been about improvements and modernisation of known environments, not about a secret parallel database built to evade EU law.

What the EDPS is actually doing

According to Computer Weekly’s November 6 report, the EDPS confirmed it is conducting fact-finding “to decide whether other (and which kind of) supervisory action is necessary.” That wording matters. Fact-finding is a preparatory supervisory step. It is not a formal finding of infringement, not an order to delete data, and not a fine. Supervisor Wojciech Wiewiórowski had earlier suggested in a press conference that much of what the journalists revealed was not new to the watchdog, which fits Europol’s claim of prior engagement but does not settle disputed characterisations of Pressure Cooker.

The same reporting says the EDPS understands Europol referred to Pressure Cooker only once in a single document, as a nickname for an existing system, and that the supervisor has refused to release a 2022 ICT working-plan document under freedom-of-information exemptions. Separately, in February 2026 the EDPS told the Joint Parliamentary Scrutiny Group it was closing years-long monitoring of Europol’s irregular big-data repositories even though 15 of 150 recommendations remained open, including items of “particular importance” and core CFN security measures. In a May written reply to MEP Saskia Bricmont, Europol said only three of ten CFN-related recommendations were fully resolved, with safeguards and further work under way on the other seven.

That sequence is awkward for anyone who wants a clean narrative. A supervisor can close a monitoring file with outstanding recommendations, keep watching specific tools through new fact-finding, and still withhold documents. Readers who follow EDPS guidance on AI risk management or the office’s updated DPO guidance for EU institutions already know the EDPS mixes soft guidance, inspections and hard orders; fact-finding sits toward the inquiry end of that spectrum.

Migration plans and what remains open

Europol says the remaining CFN recommendations will be closed by migrating to a New Forensic Environment. Much of that migration, it says, is done, with four of the original 25 Analysis Projects still to transfer, scheduled for the first quarter of 2027, after which the CFN can be decommissioned. Safeguards are said to be in place in the meantime. Those are Europol’s statements about its own roadmap, not EDPS confirmation that the roadmap cures every outstanding issue.

Open questions that neither a newsroom investigation nor an agency fact-check can close on their own include: whether logging and access controls on legacy forensic storage meet today’s expectations for criminal-intelligence systems; whether internet-facing collection tools were ever presented clearly enough for prior consultation when the Europol Regulation required it; and whether member-state data shared into those environments inherits the same audit problems. British MP David Davis, commenting on the May investigation, said that if the reported failures are true they raise oversight and legality concerns, including for UK data shared through Europol channels. That is a political reaction, not a court finding.

Five checks compliance teams can run without waiting for The Hague

Private organisations are not Europol, but the dispute maps onto familiar controls. Logging gaps, privileged sprawl and “temporary” tooling that never leaves the temporary lane show up in enterprise forensic labs and OSINT stacks too. A closed ticket or a migration slide deck is not proof that access can still be reconstructed after the fact.

1. Separate forensic intake from general analysis. If a lab environment holds raw dumps, malware samples or bulk extracts, document which cases those assets belong to and when they must leave. Treat indefinite staging as a retention failure, not a convenience feature.
2. Prove who touched what. Administrative actions, privileged sessions and data exports need immutable logs. If you can only “infer” that a file was opened, you do not have an audit trail a court or regulator will trust, a point that echoes security duties that survive even when data looks anonymous to outsiders.
3. Count administrator accounts like a risk inventory. Many admin rights plus weak password management is a classic integrity problem: anyone with those rights can alter evidence and the logs that would expose them.
4. Name shadow tooling in the register, not in Slack. Fast-track scrapers, referral-unit scripts and “pressure cooker” style projects should appear in the processing inventory with a DPIA trail. A nickname that never reaches the DPO is a governance signal.
5. Re-audit after migration, not before. Moving Analysis Projects to a new forensic environment only helps if the new system’s logging, access control and deletion workflows are tested with the same rigor as a privacy audit, not assumed from architecture diagrams. Digital forensics-minded accountability is the standard, not a press release.

Frequently asked questions

Has the EDPS found that Europol broke the law?

Not in the public record surrounding this fact-finding. The supervisor is gathering information to decide whether further supervisory action is needed. Earlier monitoring of big-data repositories closed with outstanding recommendations; that is not the same as a fresh infringement finding about Pressure Cooker.

Did Europol admit it ran a shadow database?

No. Europol’s published fact-check rejects that characterisation and says CFN and IFOE are established environments that have been subject to oversight and continuous improvement.

What is Pressure Cooker, according to each side?

Journalists describe tools used for rapid processing of internet-scraped data with weak formalisation. Europol describes an internal project-management nickname for IRU-supporting online tools inside a longer-standing internet-facing environment, not a secret unlawful database.

When does Europol say the old CFN goes away?

Europol says remaining Analysis Projects migrate in the first quarter of 2027, allowing CFN decommissioning and completion of outstanding recommendations. Schedules can slip; treat that date as Europol’s plan.

Oversight that arrives in chapters

Law-enforcement data systems rarely fail in a single dramatic moment. They accrete: an emergency after a terrorist attack, a forensic network that becomes the default warehouse, a nickname for tools that outrun the consultation calendar, a migration that takes years while recommendations sit half-closed. The EDPS fact-finding will eventually produce a clearer public signal—more questions, an inspection report, or formal action. Until then, the responsible reading is the least satisfying one: serious journalism raised specific control failures; Europol disputes the “shadow” label and points to proactive engagement; and Europe’s institutional privacy supervisor is still deciding what, if anything, to do next.