French Intelligence Laws

Two intelligence law have been passed in France in 2015:

• The intelligence law on internal intelligence activities
• The international intelligence law

Both laws have been integrated to the fifth chapter of the internal security code (Code de sécurité intérieure, or CSI).

Why two laws?

The intelligence law on internal intelligence activities, among other legal actions against it, was referred before the French Constitutional Council by the President. The Constitutional Council deemed the law constitutional, except its chapter on intelligence techniques covering international communications (for procedural matters). For this reason, the part of the law dealing with intelligence techniques deployed for international interception is a second law.

The intelligence law on internal intelligence activities

The intelligence law on internal intelligence activities was passed on the 24th of July 2015, through the fast-track procedure.

The international intelligence law

The international intelligence law was passed on the 30th of November.

Chapitre IV : Des mesures de surveillance des communications électroniques internationales Chapter IV: Surveillance techniques for international electronic communications

Article L854-1

Under the conditions set forth in the present chapter, surveillance of communications emitted from or received abroad may be authorised, solely for the purposes of defense and promotion of the fundamental interests of the Nation as mentioned in article L. 811-3. This surveillance is exclusively covered by this chapter, whether it relates to the content of the communication or to its metadata.

Measures taken in this respect cannot be designed for individual monitoring targeting communications of people using subscription numbers or identifiers traceable to the national territory, unless these people are communicating from abroad, and were either the targets of an authorisation allowing security interception issued pursuant to Article L. 852-1 on the date on which they left the country or are identified as posing a threat to the fundamental interests of the nation mentioned in Article L. 811-3.

Subject to the specific provisions of the third paragraph of this article, when it is apparent that the intercepted electronic communications are being exchanged between people or equipment using subscription numbers or identifiers traceable to national territory, including when such communications transit through through equipment non-traceable to national territory, they shall be immediately deleted.

Article L854-2

I. -The Prime Minister shall designate, by a reasoned decision, the electronic communications networks over which interception of communications emitted from or received abroad will be permitted, within the limits laid down in Article L. 854-1.

II. -Upon reasoned request by ministers or their deputies mentioned in the first paragraph of Article L. 821-2, the Prime Minister or one of the delegates mentioned in Article L. 821-4 may authorise the non-individualised exploitation of intercepted metadata.

The authorisation establishes:
1º The pursued objective(s) among those mentioned in Article L. 811-3;
2º The reason(s) for action;
3° The service(s) referred to in Article L. 811-2 in charge of the exploitation of connection data;
4º The type of automated processes that may be deployed, indicating their objective. The authorisation is issued for a maximum period of one year, renewable under the same conditions as laid down in the present paragraph/section (II).

III. Upon reasoned request by ministers or their deputies mentioned in the first paragraph of Article L. 821-2, the Prime Minister or one of their delegates may also issue authorisation to exploit intercepted communications or exploit metadata alone.

The authorisation establishes:
1º The pursued objective(s) among those mentioned in Article L. 811-3;
2º The reason(s) for action;
3º The geographical areas or concerned organisations, groups or individuals;
4º The service(s) mentioned in Article L. 811-2 in charge of this operation.
The authorisation is issued for a maximum period of four months, renewable under the same conditions as laid down in the present paragraph/section (III).

Article L854-3

Persons holding an office or praticing a profession in France as mentioned in Article L. 821-7 may not be subject to individual monitoring of their communications due to their excercising their mandate or profession.

Article L854-4

Interception and exploitation of communications as defined by the present chapter shall be subject to traceability mechanisms established by the Prime Minister after consultation with the National Supervisory Commission for Intelligence-Gathering Techniques. The Prime Minister shall establish the terms of the centralisation of the collected information.

Article L854-5

Subject to the specific provisions of Article L. 854-8, intelligence collected under this chapter shall be deleted after a period of: 1. Twelve months after the first exploitation for correspondence, within a period of four years following their collection; 2. Six years following their collection for metadata. As for encrypted information, the allowed duration for exploitation starts from its decryption. It may not be retained for over eight years after collection.

To the extent strictly necessary for the needs of technical analysis, and excluding use for the surveillance of the concerned individuals, information collected under the present chapter that contains elements of cyberattack or that is encrypted, including decrypted associated information, may be retained beyond the durations mentioned in this article.

Notwithstanding the first five paragraphs, intelligence pertaining to a request that the Council of State has received may not be destroyed. Upon expiration of the time periods set forth in the present article, they are retained for the sole purposes of proceedings before the Council of State.

Article L854-6

Subject to the specific provisions of Article L. 854-8, the information collected under the present chapter is utilized by the service or services referred to in Article L. 811-2 designated by the authorisation.

Intelligence may not be collected, transcripted or extracted for purposes other than those mentioned in Article L. 811-3.

Transcripts or extractions must be destroyed once their retention is no longer essential to the pursuit of the objectives mentioned in the same Article L. 811-3.

Destruction of collected information, transcripts and extractions is performed by individually designated and authorized agents and is recorded.

Article L854-7

The conditions laid down in Articles L. 871-6 and L. 871-7 apply to material operations performed by electronic communications operators for the deployment of the measures provided for in Section I of Article L. 854-2.

Article L854-8

When the intercepted correspondence refers to subscriber numbers, or to technical identifiers that are traceable to the national territory, they are exploited in accordance with the IV and V of Article L. 852-1 and retained and deleted in accordance with Articles L. 822-2 to L. 822-4, subject to the oversight of the National Supervisory Commission for Intelligence-Gathering Techniques. The retention period for correspondence starts from its first exploitation, but may not exceed six months from its collection. Metadata associated with such correspondence is retained and deleted in accordance with Articles L. 822-2 similar to L. 822-4.

Article L854-9

The National Supervisory Commission for Intelligence-Gathering Techniques shall be informed of all decisions and authorisations referred to in Article L. 854-2. It shall enjoy permanent, comprehensive and direct access to traceability instruments referred to in Article L. 854-4, the collected intelligence, to transcripts and performed extractions as well as to records referred to in Article L. 854-6 . Upon request, it may review the technical devices necessary for the execution of the decisions and authorisations. If surveillance of persons referred in the third paragraph of Article L. 854-1 has not already been the object of a specific authorisation, their identity is promptly communicated to the Commission.

The Commission may request all elements necessary to the accomplishment of its missions from the Prime Minister.

Article L. 833-3 is applicable to checks carried out by the Commission under this section.

On its own initiative or by request of any person wishing to verify that no surveillance measure is irregularly being performed against them, the Commission shall ensure that the measures implemented under this chapter meet the conditions that it specifies as well as those defined by the regulations made thereunder and the decisions and authorisations of the Prime Minister or his delegates. It shall notify the claimant that it has carried out the necessary checks, without confirming nor denying the deployment of surveillance measures.

When it finds a violation of the present chapter, the Commission issues a recommendation to the Prime Minister to cease the violation, and if necessary to delete the collected intelligence. If the Prime Minister does not follow the recommendation or if the results are deemed insufficient, the matter may be brought before the Council of State, ruling in accordance with Chapter III of Title VII bis of Book VII of the Code of Administrative Justice, by the President or by at least three members of the Commission.

The Commission may submit at any time to the Prime Minister the recommendations and observations it considers appropriate to perform its oversight function with regard to the application of the present chapter.