Directive on combating terrorism

See the legislative folder on the website of the European Parliament.

Introduction

The directive on combatting terrorism has been tabled by the European Commission after the terrorist attacks that took place in Europe in 2014 and 2015, in particular after the Paris attacks on 13 November. This directive aims at replacing the framework decision of 13 June 2002 on fighting terrorism. However, this project does not feature much new material, except for penalisation of travels in regions were terror operations take place and apology of terrorism.

Beside definition of terrorist infractions, the project includes a number of measures, for example turning certain terrorist activities into criminal offences.

• Apology of terrorism and "when committed intentionally, diffusion or publication in any other form of a message, with the intention to incite to committing" terrorist actions (article 5). However, this proposal is extremely blurry and the criteria of intention cannot sufficiently protect a person sharing messages considered as encouraging terrorist offences for information or liberty reasons.

• Travels abroad for terrorism purposes, "when committed deliberately, going to another country in order to commit terrorist offences". Again, this infraction is extremely wide and blurry.

This draft Directive will be discussed in the LIBE commission of the European Parliament on 3 May 2016 and will then go to plenary.

Follow changes on compromise amendments in LIBE Committee

Hohlmeier Report

On 9 March, the rapporteur, Monika Hohlmeier (EPP, Germany) presented her report including numerous amendments, some of which are very plainly geared towards Internet censorship.

Net censorship and blocking websites

Monika Hohlmeier tabled several amendments aiming at strengthening online repression and censorship, by focusing only on the use of the Internet by "fanatics worldwide" [Amendment 3] and on the difficulty to trace their online activity, thus justifying Member States cooperation in the detection and the deletion of illegal content such as those "[making] glorification and apology of terrorism, or dissemination of messages or images, including those related to victims of terrorism, used to propagate the terrorist cause". [Amendment 6]

Amendment 6 modifying recital 7 and amendment 40 introducing a new article 14bis on "webpages publicly inciting to committing terrorist offences", in order to "remove" or "block access" to "webpages publicly inciting to committing terrorist offences" [Amendment 6]. However, these amendments leave a large leeway for Member States to enforce any measures that they will seem appropriate, as long as the procedures are " transparent procedures and provide adequate safeguards, in particular to ensure that the restriction is limited to what is necessary and proportionate" [Amendments 6 and 40].

Monika Hohlmeier's safeguards do not protect against extra-judiciary repression of online content. The provisions advocated for by the German rapporteur seem tailored to fit the censorship measures that France has put in place, as to validate them at the European level, and specifically:

• one the one hand, the ability to require that online services (such as social networks and other hosts) monitor their users' communications in order to censor content;
• on the other hand, the ability for governments to require that ISPs block the websites on which such content would be published.

This measure would allow for extending private censorship and to trivialise administrative censorship, as France has done, by bypassing judicial control under the guise of avoiding the purported impediments of judiciary red-tape. However, considering the difficulty of judging what falls within glorification or apology of terrorism, the delegation of judiciary functions to private or administrative actors goes against the protection of fundamental rights.

Website blocking - tabled without the slightest impact study - shows itself to be a disproportionate freedom-limiting measure on communication. Considering that the blocking are very easily bypassed, these measures are no long-term solution against glorification and apology of terrorism. A number of technical means can be used to make distribution and diffusion of websites possible, notwithstanding that the actual impact on incitations to terrorism remains uncertain. A well-known method consists in setting up an encrypted tunnel, the so-called "proxy", that is a piece of software placed between a client and a server that allow two host computers to communicate with each other without transmissions ever reaching the actual server and being traceable. Furthermore, the inevitable risk of blocking perfectly legitimate content makes website blocking even more disproportionate.

Furthermore, experience from France shows the limits of this system. The person in charge authorised by CNIL to control blocking measures has published his activity report in April 2016.

• Article 6-1 of LCEN provides for content hosts and editors to be notified of the removal notice beforehand, with a 24-hour margin to remove the litigious content. However, the person in charge clearly indicates that this measure is bypassed without justification under the pretext that "in practice, editors and hosts are almost never identified". This constitutes a breach of law that attacks the rights of content hosts and editors who might have been notified but were not, without justification.
• The person in charge insists on the utmost difficulty to judge whether content "making an apology of terrorist actions or inciting to such actions" are illegal or not, which considerably reinforces the absolute need to recommand a judiciary process.
• The number of requests for blocking website with terrorist content amounted to 68 for 2015, which is a very low number
• The State of Emergency law, modified by the law of 20 November 2015, allows the Interior Minister to take "any measures to ensure interruption of any online public communication service that incites to committing terrorist actions or makes apologies of these" during the state of emergency. However, at the publication of the report, the Minister of the Interior had never used this disposition.

On the other hand, the French example provides interesting insights on the blattant lack of transparency of the blocking procedure. The law only provides for the block as such. However, the French government has set up a redirection of requests for blocked pages towards a webpage hosted by the Ministry of the Interior, explaining the reasons for the block. As the Exégètes Amateurs state in their appeal to the Council of State against that measure, this "automated redirection of Internet users to a Ministry of the Interior webpage constitutes an infringement on freedom of communication and on secrecy of correspondence that is not provided for in the law, as well as a violation of the dispositions of the law of 6 January 1978 on Computing, files and liberties." Thus, the lack of a judiciary process to guarantee transparency and respect of fundamental liberties has allowed the Government to set up an opaque procedure that infringes on liberties.

• The lack of transparency is blatant, as
  • neither the author, host or reader of the web page know what the charges are, what content is considered litigious on the blocked website, and none has any means to know the motivations for the block or the advancement of the procedure that led the administration to blocking the website
  • the list of blocked addresses is kept a secret and neither Internet users nor the persons directly concerned by the block are informed
  • the blocking procedure and the motives that may lead to blocking a website are nowhere specified.
• The Goverment is setting up an illegal processing of personal data, since the data transmitted through the redirection notably comprises the IP address

Considering the whole of these remarks, the amendments appear as an unacceptable attack against freedom of expression and freedom of information as laid down in Article 11 of the Charter of Fundamental Rights of the European Union. They should at least be amended to put back a judicial judge back into the core of the process, in order to stop any censorship through private or administrative means.

Sur la censure privée :

La censure privée - c'est-à-dire opérée par des acteurs privés, sur la base d'accords avec le gouvernement - n'est pas directement prévue dans la directive sur le terrorisme. Cependant l'amendement de compromis 2 (article 21a) préconise une coopération renforcée avec les entreprises notamment pour contrer la propagande terroriste. D'autre part, l'amendement de compromis 6 (considérant 7a) sur le retrait de contenu et le blocage de site mentionne « les actions volontaires prises par l'industrie de l'Internet pour prévenir les mauvaises utilisations de leurs services (..)&nbsp».

Or les récentes nouvelles du médiateur européen montrent les limites de ce types de mesures. La Commission européenne avait en effet institué le 3 décembre 2015 un forum de l'Internet rassemblant les gouvernements, EUROPOL et les entreprises du secteur de l'Internet pour lutter contre les contenus à caractère terroriste et les discours de haine en ligne. Mais l'absence de transparence totale de ce forum et l'exclusion de tout acteur de la société civile ou défendant les droits fondamentaux à la liberté d'expression ou à l'information, dénoncée notamment par EDRI, a conduit le médiateur européen à ouvrir une enquête formelle contre la Commission européenne.

Entre la censure privée encouragée par la Commission européenne via le forum de l'Internet et la censure administrative proposée dans la directive, la protection de la liberté d'expression semble devenir une option facultative, peu à peu laissée à l'abandon. Le Parlement européen semble malheureusement suivre la voie de la France, qui depuis deux ans choisit de lutter contre le terrorisme en affaiblissant les droits fondamentaux et les libertés.

Il est important néanmoins de mentionner les conclusions de l'étude comparative sur le blocage, le filtrage et le retrait de contenus illégaux sur Internet réalisée par l'Institut suisse de droit comparé à l'invitation du Secrétaire général du Conseil de l'Europe. La partie consacrée à la France indique que « la compatibilité du dispositif de blocage administratif des sites internet incitant à commettre des actes terroristes ou en faisant l'apologie avec la jurisprudence naissante de la Cour européenne des droits de l'homme en la matière n'est pas acquise. » En effet, « si la possibilité de restreindre la liberté d'expression sans intervention préalable d'un juge semble acquise pour le Conseil constitutionnel dans le cadre de sites internet qui « diffusent des images de pornographie infantile », il n'en reste pas moins que ce blocage sur ordre administratif repose sur un constat objectif, c'est-à-dire la présence d'images de pornographie impliquant des enfants. La qualification des notions de provocation à des actes terroristes et d'apologie du terrorisme peut toutefois s'avérer nettement plus délicate en ce qu'elle constitue un sujet beaucoup plus subjectif. »

Search of electronic evidences

The question of electronic evidences is vague in the report made by the Rapporteur Monika Hohlmeier, mostly through the amendments 19 and 20 (creating recitals 15 sexties and 15 septies). It is about coordination of States, through Eurojust especially, by "the collecting, sharing and admissibility of electronic evidences". But the amendment 20 point clearly the "anonymizers, proxy servers, Tor network [...]" and storage in remote servers ("in the cloud"). The amendment specifies that Member States "

Between the lines, the will of the rapporteur and states like France that support this measure is twofold: to address the issue of encryption and to increase dramatically the means of police investigation.

Encryption

Encryption tools and the development of technology under the concept of "privacy by design" are tools that allow individuals and companies to protect their communications. It is about the appropriation by individuals of the "right to privacy" and the "right to the secrecy of correspondences". These rights have a particular meaning considering the mass surveillance carried out by some States and the collection and processing of personal data by private companies. It is also used by companies to secure their activities, communications and transactions. Weakening encryption and "privacy by design" technologies by imposing device and software manufacturers to voluntarily introduce flaws (or "backdoors"), carries an unnecessary and disproportionate infringement of the right to privacy, breaks the confidence of users in the software and the hardware, and reduces firms' innovation capabilities.

Many actors, from Telecoms, government, police, or from legal community in Europe and the US in particular, have come out in favour of the possibility that public authorities to access information, even when encrypted.

But granting public authorities access to devices and encrypted data creates security problems, significantly weakening the encryption system. Cryptology specialists are extremely opposed to the creation of backdoors in encryption systems. Very recently, in a joint declaration, the ENISA Europol clearly stance against backdoors that will weaken intrinsically protections for all users against criminals.

The trend of some States is to bypass the issue of encryption by legislative means. In France, the Criminal Code, the Criminal Procedure Code and the Internal Security Code allow:

• to drastically increase the sentences for violations committed using an encryption tool [Article 132-79 of the Penal Code],
• the police to request from any person "having knowledge of measures applied to protect data" informations granting the access to the data [Art. 57-1 Code of Penal Procedure],
• to designate during an investigation or instruction "any legal person qualified to perform the technical operations to obtain the access to this information, the version in clear and, where a mean of encryption was used, the secret decryption agreement if necessary "[Article 230-1 of the criminal procedure code],
• to punish of three years of imprisonment and of a 45,000 euro fine the refusal to hand over to the judicial authorities of a secret encryption agreement that would have been used to prepare, facilitate or commit a crime or an offence [Article 434-15- 2 of the criminal code]. This penalty is increased to 270 000 in the bill against organized crime and terrorism currently in discussion,
• to require from cryptology manufacturers to hand in "within seventy-two hours" decryption keys [Article L871-1 of the Code of Interior Security],
• through the article 4 paragraph 6 of the bill against organized crime and terrorism, allows sealed to be open for "clearing up operations".

This legislative framework is in many ways at odds with the right to remain silent and right to the presumption of innocence (and therefore not to incriminate oneself), thus infringing the rights protected by Articles 6 (right to security) and 48 (presumption of innocence and respect for the rights of defence) of the [http : //www.europarl.europa.eu/charter/pdf/text_fr.pdf Charter of fundamental rights]. It would therefore be particularly dangerous to extend the powers of the administrative and judicial authorities in France and transpose them in other countries. The technical and legislative means used to access the encrypted data and devices must not reduce the scope of fundamental rights, nor jeopardize the freedom to use encryption tools,to protect the privacy and confidentiality of communications for instance.

Police investigative powers

The search for electronic evidence may also go through a sharp increase in police investigation methods with extremely broad powers, notably by extending remote access to computers without any warning to those affected. This can include both interception of communications, but especially actual remote search of specified computers.

While search systems are relatively framed and need to have, in France for example, the person's authorization - or in investigations of flagrante delicto his (or her) presence or the presence of witnesses, the remote searches are totally disproportionate and do not allow the preservation the fundamental rights protected by the Charter of fundamental rights of the European Union: right to respect for private and family life (Article 7), right to security (article 6), freedom of expression and information (Article 11), right to an effective judicial redress (Article 47) and defence (Article 48).

Corporate criminal responsibility

In November 2015, the European Parliament voted a report presented by Rachida Dati on the prevention of radicalization and recruitment of EU citizens by terrorist organizations. The report places particular emphasis on the responsibility of corporations " active in the field of the Internet and social networks and Internet service providers " in the fight against terrorism.

But the report recommends to encourage Member States to " consider instituting legal action, including criminal prosecutions, against companies active in the field of Internet and social networks and suppliers of Internet services who refuse to comply with an administrative or judicial request to delete illegal content or content glorifying terrorism on their online platforms ". According to the report, " refusal to cooperate or lack of deliberate cooperation by these online platforms on which such illegal content can therefore move freely, should be viewed as an act of complicity can be considered as a criminal intent or negligence, and [...] it is appropriate in this case, that those responsible are brought to justice "[Paragraph 16].

These provisions are dangerous and aim to make responsible platforms and hosting services of broadcasting messages glorifying terrorism, causing high risks of preventive censorship. Such provisions seriously endanger free speech of Europeans citizens.

The attempt to exacerbate the problem is significant: to give hosting services and platforms, most important vectors of free speech on the Internet, a quasi-judicial power, forcing them to define themselves legality of the content they host. But simply to force them to cooperate with police administrative decisions that bypass the judiciary power, to remove content considered as illegal by the police or the administration is dangerous, as it questions the principle of balance of powers, one of the pillars of our democracies. The judiciary power - including the power to censor - should not be sidelined in favour of the executive power, and should even less be extended to private companies.

The compromise amendments proposed by the rapporteur Monika Hohlmeier aim to insert these provisions in the Directive on combating terrorism. Once again this directive goes in the wrong direction by strengthening the security arsenal and opening a gaping door to administrative censorship and preventive content censorship, bringing therefore serious violations to freedom of speech and the right to information.

It is essential to put fundamental rights at the heart of the European project, to significantly strengthen the foundations of our democracies, including the balance of powers, which alone through its counter-power mechanisms can help to find the necessary balance in a rule of law.

Impact assessment

The European Commission forecasts that the impact studies must be developed, to consider the need for action at the European Union level as well as economic, social and environmental consequences of such an action, when the Commission's initiatives are likely to have important implications for economic, social or environmental regime.

The Commission even gives guidelines for the development of impact assessments including:

• A 12-week public consultation
• A clear description of who will be affected by the initiative

The Directive on combating terrorism will have profound implications for the rights and freedoms of European citizens and yet the European Commission has not found it necessary to take time to reflect on the impact of such a regulation, while in several Member States, laws extremely detrimental to the rights and freedoms are adopted or are being adopted, on behalf of the fight against terrorism.

We urgently need a deep reflection to be conducted not only by Member States but also by European institutions on the consequences of the development of security laws, with reviews and analyses of existing laws, their requirements, proportionality and effectiveness.