Europol Flags 4,340 Links, Cannot Delete

Nine European countries, one coordinated operation, and a list of about 4,340 URLs linked to violent extremist material. Europol's action against The Com network, announced this week, made for a neat headline: thousands of harmful sites disrupted. The record says something narrower. The 4,340 figure refers to URLs sent on for removal, not links confirmed as taken down. No public source names the platforms that received the referrals, how many acted on them, or how quickly they did so (SC World, Iefimerida).

That distinction is where EU digital enforcement often becomes less impressive than the announcement around it.

Europol Can Flag. It Cannot Order.

Europol is a coordination agency. It brings police forces into the same room, consolidates target lists, and produces intelligence. It cannot order a platform to delete content. In this operation, its EU Internet Referral Unit worked with Spain's CITCO, the country's counter-terrorism and organised crime intelligence centre, to gather URL submissions from police in Belgium, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Portugal, Spain and Sweden. The list was cleaned up, duplicates were removed, and the consolidated package was sent on (Il Metropolitano, Origo).

Europol can flag. National authorities can compel. If content qualifies as terrorist material, governments can demand removal within one hour under the EU's Terrorist Content Online Regulation (TCO Regulation). If it involves child exploitation or incitement, national criminal law comes into play. The Digital Services Act creates notice-and-action systems for platforms operating in the EU (DSA). But the public record does not say which route was used for which URLs, or whether binding orders were issued at all.

For Maltese readers, this distinction is familiar. EU agencies often set the framework, but enforcement lands in national systems with different resources, priorities and political pressure points. In a small state, that gap is not theoretical. It decides whether an online threat becomes a police file, a platform ticket, or simply another URL passed around until it resurfaces elsewhere.

The Com is not a single website or formal organisation. It is a loose online ecosystem where violence, coercion and humiliation function as social currency. The Guardian's investigation of the 764 network, one branch of The Com, describes a "gamification of harm" in which blackmail, abuse of minors and violent instruction become status markers (The Guardian). Europol's 2026 Terrorism Situation and Trend Report classifies the network as nihilistic violent extremism: the methods are digital, but the result is exploitation and, at times, physical violence (Europol TE-SAT 2026).

The material referred included content promoting self-harm and suicide, child sexual exploitation, explosives manuals and harassment instructions. The severity is clear. The enforcement outcome is not.

The Difference Between a Notice and a Seizure

The Dutch record shows the gap. Alongside the Europol referral operation, police in Zeeland-West-Brabant ran a separate criminal investigation. On 21 July, they searched locations in Steenbergen, Rotterdam and Amsterdam and physically seized servers used by the pornographic site Motherless over suspected child sexual abuse material. That is a different kind of action: police took control of infrastructure, not merely links (Politie, NU.nl). Separately, Dutch authorities disclosed a 764/Com criminal case with a suspect detained, confirming that police are pursuing cases against the network, not just issuing notices (Politie).

That contrast matters beyond the Netherlands because enforcement capacity is uneven across Europe. Some participating countries have named investigators and active prosecutions. Others appear in Europol's announcement without visible national follow-up. The cost of that unevenness falls first on the children and victims inside the network, then on police forces with fewer resources, and finally on the public, which cannot see where EU power actually bites.

Malta is not named among the nine countries in this operation, but the issue is not distant. A country built around cross-border services, gaming platforms and digital finance depends on rules that can be enforced across jurisdictions. When that enforcement is left to informal referrals and platform discretion, the smallest states have the least leverage and the most to lose from opacity.

The Missing Removal Count

A Cambridge European Law Open study argues that the EU increasingly relies on platforms to carry out enforcement, raising fundamental-rights questions when private companies do work that looks like public authority. In this case, opacity is the sharper problem. The material referred was severe. The question is whether the operation produced measurable results or mainly produced an announcement.

Europol's real value is friction. It can force a decentralised network to reorganise, expose where it migrates after links are flagged, and generate leads for national investigators. That is worth doing. But Europol, the participating countries and the platforms that received 4,340 referrals owe the public a basic account: how many URLs were removed, under what authority, and what happened to the children caught inside the network. Until those figures are published, Europol has shown activity, not impact.