Directive Terrorisme/en

See the legislative folder on the website of the European Parliament.

Introduction

The directive on combatting terrorism has been tabled by the European Commission after the terrorist attacks that took place in Europe in 2014 and 2015, in particular after the Paris attacks on 13 November. This directive aims at replacing the framework decision of 13 June 2002 on fighting terrorism. However, this project does not feature much new material, except for penalisation of travels in regions were terror operations take place and apology of terrorism.

Beside definition of terrorist infractions, the project includes a number of measures, for example turning certain terrorist activities into criminal offences.

• Apology of terrorism and "when committed intentionally, diffusion or publication in any other form of a message, with the intention to incite to committing" terrorist actions (article 5). However, this proposal is extremely blurry and the criteria of intention cannot sufficiently protect a person sharing messages considered as encouraging terrorist offences for information or liberty reasons.

• Travels abroad for terrorism purposes, "when committed deliberately, going to another country in order to commit terrorist offences". Again, this infraction is extremely wide and blurry.

This draft Directive will be discussed in the LIBE commission of the European Parliament on 3 May 2016 and will then go to plenary.

Follow changes on compromise amendments in LIBE Committee

Hohlmeier Report

On 9 March, the rapporteur, Monika Hohlmeier (EPP, Germany) presented her report including numerous amendments, some of which are very plainly geared towards Internet censorship.

Aiding and abetting: need to take into account the notion of intention

The original text of the directive included an article 16 too broad as it allowed considering in the scope of infractions any particular assistance, without defining the terms "aiding" and "abetting". Article 16, paragraph 1, was drafted as follows: "Each Member State shall take the necessary measures to ensure that aiding or abetting an offence referred to in Articles 3 to 8 and 11 to 14 is made punishable." Recital 11 proposed a very broad interpretation of the assistance provided or complicity, as it was enough to know that an operation would be used in whole or in part, for terrorism" to be punishable.

Here, the notion of intention is fundamental. Indeed, many tools are available for all, knowing that these tools may and can be used by people preparing and committing crimes. For example, car manufacturers know that cars are very useful to prepare or commit an offense (travel, flee, etc.). Similarly, many tools on the Internet, (email boxes, anonymization tools, encryption, etc.) are likely to be used for terrorism (or other crimes). However, neither the car manufacturers or developers of electronic tools intend to help the commission of offense. So this is the will and intention of aiding and abetting committing an offense that should be punishable and not only the knowledge.

But the compromise amendments - which are everything but compromises - tabled by Monika Hohlmeier take back those of the Commission in the recital 11 and the article 16, eliminating all notion of intention and leaving a very large leeway for Member States for the interpretation of those notions of aiding and abetting.

Net censorship and blocking websites

Monika Hohlmeier tabled several amendments aiming at strengthening online repression and censorship, by focusing only on the use of the Internet by "fanatics worldwide" [Amendment 3] and on the difficulty to trace their online activity, thus justifying Member States cooperation in the detection and the deletion of illegal content such as those "[making] glorification and apology of terrorism, or dissemination of messages or images, including those related to victims of terrorism, used to propagate the terrorist cause". [Amendment 6]

Amendment 6 modifying recital 7 and amendment 40 introducing a new article 14bis on "webpages publicly inciting to committing terrorist offences", in order to "remove" or "block access" to "webpages publicly inciting to committing terrorist offences" [Amendment 6]. However, these amendments leave a large leeway for Member States to enforce any measures that they will seem appropriate, as long as the procedures are " transparent procedures and provide adequate safeguards, in particular to ensure that the restriction is limited to what is necessary and proportionate" [Amendments 6 and 40].

Monika Hohlmeier's safeguards do not protect against extra-judiciary repression of online content. The provisions advocated for by the German rapporteur seem tailored to fit the censorship measures that France has put in place, as to validate them at the European level, and specifically:

• one the one hand, the ability to require that online services (such as social networks and other hosts) monitor their users' communications in order to censor content;
• on the other hand, the ability for governments to require that ISPs block the websites on which such content would be published.

This measure would allow for extending private censorship and to trivialise administrative censorship, as France has done, by bypassing judicial control under the guise of avoiding the purported impediments of judiciary red-tape. However, considering the difficulty of judging what falls within glorification or apology of terrorism, the delegation of judiciary functions to private or administrative actors goes against the protection of fundamental rights.

Website blocking - tabled without the slightest impact study - shows itself to be a disproportionate freedom-limiting measure on communication. Considering that the blocking are very easily bypassed, these measures are no long-term solution against glorification and apology of terrorism. A number of technical means can be used to make distribution and diffusion of websites possible, notwithstanding that the actual impact on incitations to terrorism remains uncertain. A well-known method consists in setting up an encrypted tunnel, the so-called "proxy", that is a piece of software placed between a client and a server that allow two host computers to communicate with each other without transmissions ever reaching the actual server and being traceable. Furthermore, the inevitable risk of blocking perfectly legitimate content makes website blocking even more disproportionate.

Furthermore, experience from France shows the limits of this system. The person in charge authorised by CNIL to control blocking measures has published his activity report in April 2016.

• Article 6-1 of LCEN provides for content hosts and editors to be notified of the removal notice beforehand, with a 24-hour margin to remove the litigious content. However, the person in charge clearly indicates that this measure is bypassed without justification under the pretext that "in practice, editors and hosts are almost never identified". This constitutes a breach of law that attacks the rights of content hosts and editors who might have been notified but were not, without justification.
• The person in charge insists on the utmost difficulty to judge whether content "making an apology of terrorist actions or inciting to such actions" are illegal or not, which considerably reinforces the absolute need to recommand a judiciary process.
• The number of requests for blocking website with terrorist content amounted to 68 for 2015, which is a very low number
• The State of Emergency law, modified by the law of 20 November 2015, allows the Interior Minister to take "any measures to ensure interruption of any online public communication service that incites to committing terrorist actions or makes apologies of these" during the state of emergency. However, at the publication of the report, the Minister of the Interior had never used this disposition.

On the other hand, the French example provides interesting insights on the blatant lack of transparency of the blocking procedure. The law only provides for the block as such. However, the French government has set up a redirection of requests for blocked pages towards a webpage hosted by the Ministry of the Interior, explaining the reasons for the block. As the Exégètes Amateurs state in their appeal to the Council of State against that measure, this "automated redirection of Internet users to a Ministry of the Interior webpage constitutes an infringement on freedom of communication and on secrecy of correspondence that is not provided for in the law, as well as a violation of the dispositions of the law of 6 January 1978 on Computing, files and liberties." Thus, the lack of a judiciary process to guarantee transparency and respect of fundamental liberties has allowed the Government to set up an opaque procedure that infringes on liberties.

• The lack of transparency is blatant, as
  • neither the author, host or reader of the web page know what the charges are, what content is considered litigious on the blocked website, and none has any means to know the motivations for the block or the advancement of the procedure that led the administration to blocking the website
  • the list of blocked addresses is kept a secret and neither Internet users nor the persons directly concerned by the block are informed
  • the blocking procedure and the motives that may lead to blocking a website are nowhere specified.
• The Government is setting up illegal processing of personal data among the data transmitted to it through the redirection, we find IP address , information about the web browser used (including the browser version and the operating system), the list of features and activated "add-ons", authentication cookies or session, etc.

Considering the whole of these remarks, the amendments appear as an unacceptable attack against freedom of expression and freedom of information as laid down in Article 11 of the Charter of Fundamental Rights of the European Union. They should at least be amended to put back a judicial judge back into the core of the process, in order to stop any censorship through private or administrative means.

'On private censorship':

Private censorship - i.e. carried out by private actors, based on agreements with governments - isn't directly in the directive on terrorism. Although, the compromise amendment 2 (article 21a) calls for a better cooperation with companies in particular to counter terrorist propaganda . Moreover, the compromise amendment 6 (recital 7a) on removing content and site blocking lists "voluntary action taken by the Internet industry to prevent the misuse of its services or to any support for such action by Member States (...)".

But the recent news from the European Ombudsman shows the limits of that types of measures. The European Commission has set up on 3 December 2015 the forum of the Internet bringing together governments, EUROPOL and companies in the sector of Internet to fight against terrorist content and online hate speech. But the lack of full transparency in this forum and the exclusion of any actor of civil society and defending the fundamental rights to freedom of expression or information, denounced under-investigation-had-internet-forum / notably by EDRI, led the Ombudsman to open a investigation formal against the European Commission.

Between private censorship encouraged by the European Commission through the EU Internet Forum and administrative censorship in the directive, the protection of freedom of expression seems to become an option gradually neglected. The European Parliament seems to unfortunately follow the path of France where two years ago chose to fight against terrorism by weakening the fundamental rights and freedoms.

Nevertheless it is important to mention the conclusions of the comparative study on blocking, filtering and removal of illegal content on the Internet conducted by the Swiss Institute of Comparative Law at the request of the Secretary General of the Council of Europe. Part on France states that " the compatibility of administrative blocking of websites inciting to terrorist offences or glorifying terrorism, with the emerging jurisprudence of the European Court of Human Rights does not exist yet. Indeed, "if the possibility of restricting freedom of expression without the prior intervention of a judge seems certain to the Constitutional Court for websites that "disseminate child- pornography content", it remains that this blockage on administrative is based on a objective observation: the presence of images of pornography involving children. The qualification of the notions of inciting to terrorism however, can be much more difficult in that it is a much more subjective topic."

Search of electronic evidences

The question of electronic evidences is vague in the report made by the Rapporteur Monika Hohlmeier, mostly through the amendments 19 and 20 (creating recitals 15 sexties and 15 septies). It is about coordination of States, through Eurojust especially, by "the collecting, sharing and admissibility of electronic evidences". But the amendment 20 point clearly the "anonymizers, proxy servers, Tor network [...]" and storage in remote servers ("in the cloud"). The amendment specifies that Member States "should therefore cooperate among each other notably through Eurojust and Europol and with the European Commission to ensure a coordinated approach in this field to improve the efficiency of dealing with the gathering, sharing, and admissibility of electronic evidence".

Between the lines, the will of the rapporteur and states like France that support this measure is twofold: to address the issue of encryption and to increase dramatically the means of police investigation.

Encryption

Encryption tools and the development of technology under the concept of "privacy by design" are tools that allow individuals and companies to protect their communications. It is about the appropriation by individuals of the "right to privacy" and the "right to the secrecy of correspondences". These rights have a particular meaning considering the mass surveillance carried out by some States and the collection and processing of personal data by private companies. It is also used by companies to secure their activities, communications and transactions. Weakening encryption and "privacy by design" technologies by imposing device and software manufacturers to voluntarily introduce flaws (or "backdoors"), carries an unnecessary and disproportionate infringement of the right to privacy, breaks the confidence of users in the software and the hardware, and reduces firms' innovation capabilities.

Many actors, from Telecoms, government, police, or from legal community in Europe and the US in particular, have come out in favour of the possibility that public authorities to access information, even when encrypted.

But granting public authorities access to devices and encrypted data creates security problems, significantly weakening the encryption system. Cryptology specialists are extremely opposed to the creation of backdoors in encryption systems. Very recently, in a joint declaration, the ENISA Europol clearly stance against backdoors that will weaken intrinsically protections for all users against criminals.

The trend of some States is to bypass the issue of encryption by legislative means. In France, the Criminal Code, the Criminal Procedure Code and the Internal Security Code allow:

• to drastically increase the sentences for violations committed using an encryption tool [Article 132-79 of the Penal Code],
• the police to request from any person "having knowledge of measures applied to protect data" informations granting the access to the data [Art. 57-1 Code of Penal Procedure],
• to designate during an investigation or instruction "any legal person qualified to perform the technical operations to obtain the access to this information, the version in clear and, where a mean of encryption was used, the secret decryption agreement if necessary "[Article 230-1 of the criminal procedure code],
• to punish of three years of imprisonment and of a 45,000 euro fine the refusal to hand over to the judicial authorities of a secret encryption agreement that would have been used to prepare, facilitate or commit a crime or an offence [Article 434-15- 2 of the criminal code]. This penalty is increased to 270 000 in the bill against organized crime and terrorism currently in discussion,
• to require from cryptology manufacturers to hand in "within seventy-two hours" decryption keys [Article L871-1 of the Code of Interior Security],
• through the article 4 paragraph 6 of the bill against organized crime and terrorism, allows sealed to be open for "clearing up operations".

This legislative framework is in many ways at odds with the right to remain silent and right to the presumption of innocence (and therefore not to incriminate oneself), thus infringing the rights protected by Articles 6 (right to security) and 48 (presumption of innocence and respect for the rights of defence) of the [http : //www.europarl.europa.eu/charter/pdf/text_fr.pdf Charter of fundamental rights]. It would therefore be particularly dangerous to extend the powers of the administrative and judicial authorities in France and transpose them in other countries. The technical and legislative means used to access the encrypted data and devices must not reduce the scope of fundamental rights, nor jeopardize the freedom to use encryption tools,to protect the privacy and confidentiality of communications for instance.

Police investigative powers

The search for electronic evidence may also go through a sharp increase in police investigation methods with extremely broad powers, notably by extending remote access to computers without any warning to those affected. This can include both interception of communications, but especially actual remote search of specified computers.

While search systems are relatively framed and need to have, in France for example, the person's authorization - or in investigations of flagrante delicto his (or her) presence or the presence of witnesses, the remote searches are totally disproportionate and do not allow the preservation the fundamental rights protected by the Charter of fundamental rights of the European Union: right to respect for private and family life (Article 7), right to security (article 6), freedom of expression and information (Article 11), right to an effective judicial redress (Article 47) and defence (Article 48).

Corporate criminal responsibility

In November 2015, the European Parliament voted a report presented by Rachida Dati on the prevention of radicalization and recruitment of EU citizens by terrorist organizations. The report places particular emphasis on the responsibility of corporations " active in the field of the Internet and social networks and Internet service providers " in the fight against terrorism.

But the report recommends to encourage Member States to " consider instituting legal action, including criminal prosecutions, against companies active in the field of Internet and social networks and suppliers of Internet services who refuse to comply with an administrative or judicial request to delete illegal content or content glorifying terrorism on their online platforms ". According to the report, " refusal to cooperate or lack of deliberate cooperation by these online platforms on which such illegal content can therefore move freely, should be viewed as an act of complicity can be considered as a criminal intent or negligence, and [...] it is appropriate in this case, that those responsible are brought to justice "[Paragraph 16].

These provisions are dangerous and aim to make responsible platforms and hosting services of broadcasting messages glorifying terrorism, causing high risks of preventive censorship. Such provisions seriously endanger free speech of Europeans citizens.

The attempt to exacerbate the problem is significant: to give hosting services and platforms, most important vectors of free speech on the Internet, a quasi-judicial power, forcing them to define themselves legality of the content they host. But simply to force them to cooperate with police administrative decisions that bypass the judiciary power, to remove content considered as illegal by the police or the administration is dangerous, as it questions the principle of balance of powers, one of the pillars of our democracies. The judiciary power - including the power to censor - should not be sidelined in favour of the executive power, and should even less be extended to private companies.

The compromise amendments proposed by the rapporteur Monika Hohlmeier aim to insert these provisions in the Directive on combating terrorism. Once again this directive goes in the wrong direction by strengthening the security arsenal and opening a gaping door to administrative censorship and preventive content censorship, bringing therefore serious violations to freedom of speech and the right to information.

It is essential to put fundamental rights at the heart of the European project, to significantly strengthen the foundations of our democracies, including the balance of powers, which alone through its counter-power mechanisms can help to find the necessary balance in a rule of law.

Impact assessment

The European Commission forecasts that the impact studies must be developed, to consider the need for action at the European Union level as well as economic, social and environmental consequences of such an action, when the Commission's initiatives are likely to have important implications for economic, social or environmental regime.

The Commission even gives guidelines for the development of impact assessments including:

• A 12-week public consultation
• A clear description of who will be affected by the initiative

The Directive on combating terrorism will have profound implications for the rights and freedoms of European citizens and yet the European Commission has not found it necessary to take time to reflect on the impact of such a regulation, while in several Member States, laws extremely detrimental to the rights and freedoms are adopted or are being adopted, on behalf of the fight against terrorism.

We urgently need a deep reflection to be conducted not only by Member States but also by European institutions on the consequences of the development of security laws, with reviews and analyses of existing laws, their requirements, proportionality and effectiveness.