The parcels crossed borders. The evidence had to follow.

What happened

Parcels ignited in Germany, Poland and the UK in July 2024. Eurojust’s 6 March 2026 update describes a five-country joint investigation and 22 suspects. Suspected Russian intelligence links are allegations, not convictions. At Leipzig airport, one parcel ignited before aircraft loading.

Eurojust explains that joint investigation teams bring authorities together under an agreement for a specific investigation. Their information exchange operates within that framework; a software connection does not establish permission to share evidence.

The first report describes only one stop

Consider the information available at the beginning of an incident. A warehouse operator can describe what happened at a particular loading bay. A carrier may hold scans from earlier transfers. Another company may know the next destination. An investigator receives a report with a time, a location and an identifier, but those details do not yet explain the wider journey. This is an illustrative information problem, rather than a reconstruction of what each participant in this investigation knew.

The operational task is to preserve that first observation while asking what else can be established. Which identifier belongs to the physical parcel? Was a timestamp recorded when something happened, when it was scanned or when someone entered the report? Does an address identify a delivery location, an intermediary or a person? These distinctions affect the questions sent to partners. Combining records too early can turn an unverified assumption into a statement that looks settled simply because it appears on a map.

The connection is a finding, not an assumption

A consignment identifier, an address and a time can connect records held by different organisations. They can also mislead: addresses change, names repeat and parcel scans describe observations rather than a complete route. Investigators need to inspect the underlying evidence before accepting a link.

• Keep the source. Retain the original record, organisation, timestamp and basis for sharing.
• Show uncertainty. Distinguish a confirmed match from a proposed relationship or missing observation.
• Assign the next step. Give a verification task an owner and preserve the result in the case timeline.

From linked records to testable questions

A shared ontology can give shipments, places, people and events consistent meanings without flattening their differences. A shipment is not the same object as the vehicle carrying it. A sender name is not automatically a verified person. Two observations can refer to the same parcel while recording different stages of its movement. The model should preserve those relationships and the evidence supporting each one, so another analyst can inspect how a conclusion was reached.

Imagine an authorised carrier record arriving after an incident report. An analyst proposes a link, opens the original record and checks whether the identifiers and times agree. If the match is incomplete, a task asks a named partner to verify it. The answer becomes another sourced observation. A correction should be visible in the timeline rather than silently replacing the earlier interpretation. The useful result is a set of questions that can be resolved, with responsibility for each next step. A bigger collection of connected dots is not, on its own, stronger evidence.

European cooperation with controlled sharing

An illustrative Meridian project could map approved shipment records, locations and incident reports to a shared ontology. Local AI could assist with document summaries, while people verify links. Each deployment needs agreed permissions and sharing rules; a common picture does not mean unrestricted access to national datasets. This analysis does not imply involvement in the investigation or that Meridian would have prevented the incidents.

Start with a bounded investigative workflow

A sensible Meridian pilot would begin with an approved sample of shipment events and incident reports, a limited group of users and a clear question about the workflow. The first objective could be to reconstruct one authorised example from its source records and show precisely which links are confirmed, proposed or unresolved. Participants could then check whether the handover to a verification task retains the necessary context. That is a project to design and evaluate with users, not a claim that these organisations already use Meridian.

Useful evaluation criteria include whether another reviewer can retrieve the supporting source, whether conflicting timestamps remain visible and whether an unauthorised user is prevented from seeing restricted material. Required access enforcement, audit and retention controls must be implemented and accepted for the deployment. AI-generated summaries should point back to the documents reviewed and leave evidential decisions to investigators. The European sovereignty question is practical here: who operates the environment, who can maintain it, where processing occurs and which information crosses each organisational boundary. Those choices must support the investigative agreement.

A cross-border pattern becomes useful when each connection can be checked.