A black sedan rolls along a small country road between fields of sunflowers, the passengers hidden behind the cars' tinted windows.

This is the route from Schoenhagen Airfield, and luxury cars are such a common sight that locals don't even raise their heads when they pass by.

Student or retired? Then this plan is for you.

Frank Buckenhofer, president of the German trade union for police and customs officers, described the approach to private air traffic as 'grossly negligent' and posing a 'major security risk'. (Photo: German Police Union)

By car, Schoenhagen is about 35 minutes from the centre of Berlin, and 25 minutes from the centre of Potsdam, the capital of the Brandenburg federal state. The airport's website describes it as "the perfect place to land." Only a loose chain link fence separates the airfield from the woods and meadows that surround it.

Standing in front of the small terminal's counter feels closer to waiting at a hotel reception desk than the bustle and stress of the major airports nearby.

X-ray machines and metal detectors are missing, as are the queues for security and fraught passengers that have become synonymous with modern air travel.

A friendly air traffic controller is responsible for reception and checking passports. He is an employee of the airport and not police or border control, but only if the travel is outside Schengen countries does he need to phone the federal police for a passport check.

This experience is typical of small airports around Europe and it's easy to see the appeal of such a way of flying.

Passengers arrive just 20 minutes ahead of the flight. In the words of one company's publicity material, private jets passengers can "skip commercial security clearance and even board from the tarmac."

Light-touch security

But can this light touch sometimes be taken too far?

In 2011, emails leaked from the UK Border Agency to the Guardian newspaper revealed the extent to which border checks for visitors to the UK were already being waived.

According to the Guardian, the leaked emails showed internal concerns that: "Thousands of passengers from all over the world arriving on private jets were allowed into Britain this summer without any passport checks as a matter of official policy."

The internal reports show that immigration and customs staff were instructed not to meet passengers on private charter flights, including executive jets, as part of the "light touch" targeted approach secretly adopted this summer".

Also in 2011, Europol issued a report which included a reference to the use of light aircraft by criminals.

The law enforcement agency stated that "there has been a noted rise in the use of light aircraft for trafficking drugs into the EU (e.g. from north and west Africa), and the number of suspicious flights between EU member states is also increasing. In addition to drugs, though, light aircraft are also now being used to facilitate illegal immigration, smuggle victims of human trafficking, and to traffic firearms, diamonds and bulk cash shipments for money laundering."

The report pinpointed the "lack of monitoring" as a "key facilitator for this rise in the use of light aircraft for trafficking".

Police worries

Seven years later, this is a view echoed by Frank Buckenhofer, president of the German trade union for policemen and customs officers, who described the approach to private air traffic as "grossly negligent" and that it poses a "major security risk".

He told Investigate Europe that "smaller airports, especially those with no surveillance controls, are an open door to smuggling and illegal entry."

Arnd Krummen, a member of the board of the same trade union and specialist in airport security and border control, describes the situation as "a major security risk" and describes private air travel as "the Achilles' heel for internal security."

He argues the need for greater controls, explaining that "it should be in the interest of the German federal government to allow border crossings only at airports where federal police are able to exercise professional controls."

But it is not just in Germany that concerns about the security of smaller airports. have been raised.

David Weinberger, an expert at the French National Institute for Security Studies describes the exemption of private jet data as a privilege for the rich with "a political side: people with private jets usually have good connections to the government."

That private jets have and are being used for criminal activity is not disputed: there are many successful prosecutions from all over Europe that show how successfully border control, police and customs have been apprehending those guilty or crimes.

Whether this will continue as governments turn to technology to secure their borders is questionable, because in the words of Frank Buckenhofer:

"If there is no 'control', then there are no 'cases'."

EU's new 'Passenger Name Record'

The situation for ordinary travellers and holiday-makers catching commercial flights is very different, as this year the EU's Passenger Name Record (PNR) took effect.

While all passengers travelling on commercial airlines will have their data collected, those travelling on private jets within the EU may be exempt if the EU member state authorities so wish it.

This leaves many to question the effectiveness of the directive, and its ability to meet its original goal, especially when the European Parliament's own statement about PNR sounds quite ambitious:

"EU-level measures such as the directive on Advance Passenger Information (API), the Schengen Information System (SIS) and the second-generation Schengen Information System (SIS II) do not enable law enforcement authorities to identify 'unknown' suspects in the way that an analysis of PNR data does."

The PNR – which came into force in May of this year – is, according to the EU Commission, "a record of each passenger's travel requirements held in carriers' reservation and departure control system."

The associated EU directive (which excludes Denmark) stipulates that airlines must twice transmit their passengers' data to central police authorities, once at the time of booking, and then again after boarding the aircraft, when it certain that the passenger is on, and will stay on the flight. This applies to international flights to and from EU airports.

The data collected can include passport and contact details, payment method, dates of travel, seat number and travel itinerary.

The information is available to all police authorities in the EU, and also in the US for five years, making the database one of Europe's biggest, and, as previously reported in EUobserver, it had a projected cost of around €500m.

Objections off the agenda

This mass collection and storage of personal data also made it a highly controversial project causing "serious problems for data protection and transparency" and was described as "a step into the surveillance society", in the words of the EU data protection commissioner, Giovanni Buttarelli, in September 2015.

However, the terrorist attacks in Paris in November 2015, and the need to do everything possible to prevent other attacks, pushed such objections off the agenda.

The then French minister of the interior, Bernard Cazeneuve, called critics "irresponsible" and accused them of not doing everything so "that we protect Europe from the risk of terrorism".

The then French prime minister Manuel Valls travelled to Strasbourg to make this point at the plenary debate. He was convincing enough and MEPs voted in the law, in April 2016, with 461 in favour, 179 against, plus nine abstentions. It was then adopted by the parliament and the council on April 27.

Aside from terrorism, the offences the directive aims to counter – 26 in total - are clearly laid out in Annex II of the legislation, and include money laundering, drug trafficking, human trafficking and trafficking in weapons.

But the legislative process was a long one, taking more than five years to pass, and in December 2015, amendments were made to exclude passengers flying on private jets from the database.

The justification given for this exclusion was that of technical difficulties, in that inclusion would oblige private passengers to use tickets in much the same way as commercial passengers.

Increasing use of private jets

Criticism of the loophole this created were raised by Portuguese Socialist MEP Ana Gomes who says the exemption of private jet data was clearly to: "privilege the richest, the ones who can travel in their private planes."

But could it also privilege the very criminals it was intended to stop?

Gomes argues that "governments are not serious when they announce that they are fighting terrorism and leave a hole in the law.

Not so, says Swedish Socialist MEP Anna Hedh.

While acknowledging that small airports lack the electronic gate-based system required by PNR, she maintains that the information can be obtained by other means, such as from the police or customs.

She told Investigate Europe that she did "not consider that the directive and national law create a back-door."

But even if Hedh is right, is there a danger that the PNR database will lead to a relaxing of security – an outsourcing to technology of what is currently the role of border control?

The use of private jets is increasing. German aviation data specialist WingX reported private business jets flew about 450,000 charter hours in Europe in 2017, a jump of more than 10 percent on the previous 12 months.

More than 102,000 departures were recorded at airports across Europe between June and September, marking the busiest quarter since 2009, it told Flightglobal.com, with Paris Le Bourget and Geneva, Switzerland the top destinations for charter customers.

In addition, new flight-sharing sites, marketing themselves as the 'Ubers of the sky', promise to bring private aviation to the masses.

Under the radar

Will the exclusion of this data allow criminal activity to fly under the radar?

Asked about the problem posed by private plane exemptions, the commission told Investigate Europe that it intended to review the situation by May 2020.

A spokesperson said: "The review of the directive, which the commission will conduct by 25 May 2020, will examine the necessity of including non-carrier economic operators within the scope of this Directive."

However, the commission also appeared to devalue the PNR programme by stretching the definition of data included in the original directive.

It told Investigate Europe: "The definition of 'Passenger Name Record' goes beyond the specific and universally known records in the airline's reservation systems or departure control systems and can include any "equivalent system providing the same functionalities".

"So, for example, an excel file, word document or a simple email containing some form of information on the passengers or travel itinerary could be considered as 'PNR', and hence the carrier may be subject to the obligation to transfer these data to the Passenger Information Unit."

The decision not to include private jet data was seen by many critics as a privilege for the rich, but one open to exploitation by criminal gangs, smugglers, people-traffickers and terrorists.

On 19 July, the European Commission started a series of legal actions against the half of EU's member states that have so far not implemented the Passenger Name Record, namely Austria, Bulgaria, Cyprus, the Czech Republic, Estonia, Finland, France, Greece, Luxembourg, the Netherlands, Portugal, Romania, Slovenia and Spain.

The countries have two months to answer before further legal action resumes.

Investigate Europe is a pan-European pilot project: a team of nine journalists from eight European countries who research topics of European relevance and publish with media partners Europe-wide. The project is supported by Germany's Hans Boeckler Foundation, Huebner & Kennedy Foundation, GLS Treuhand, Rudolf-Augstein Foundation, Norwegian's Fritt Ord Foundation, and the Open Society Initiative for Europe. The team cooperates with the NGOs Journalismfund and N-Ost. To this research contributed: Wojciech Ciesla, Ingeborg Eliassen, Nikolas Leontopoulos, Maria Maggiore, Leila Minano, Paulo Pena, Harald Schumann and Elisa Simantke.