PPL Surveillance internationale/Analyse/en : Différence entre versions

De La Quadrature du Net
Aller à la navigationAller à la recherche
(Page créée avec « The bill on international surveillance provides that only persons exercising in France a warrant or a profession mentioned in Article L. 821-7 (lawyer, journalist, parlia... »)
Ligne 68 : Ligne 68 :
 
=Insufficient guarantees from professions whose confidentiality is protected=
 
=Insufficient guarantees from professions whose confidentiality is protected=
  
In order to respect the jurisprudence Digital Rights of the CJUE, French Law must provide special protection for communications of person subject to professional secrecy such as journalist (whose sources' confidentiality is protected) or lawyer. French surveillance law brings a deficient protection to lawyers, journalists, MEPs and magistrates only regarding their professional correspondences. Now it is impossible to sort out a priori the private communications from the professional communication. This involves collection, processing and an "omission" from the intelligence services if the communications are private.
+
In order to respect the jurisprudence Digital Rights of the CJUE, French Law must provide special protection for communications of person subject to professional secrecy such as journalist (whose sources' confidentiality is protected) or lawyer. French surveillance law brings a deficient protection to lawyers, journalists, MPs and magistrates only regarding their professional correspondences. Now it is impossible to sort out a priori the private communications from the professional communication. This involves collection, processing and an "omission" from the intelligence services if the communications are private.
  
  

Version du 10 décembre 2015 à 16:20

Autres langues :
English • ‎français

Introduction

In July 2015, the French Constitutional Council validated the Surveillance Law as a whole, except for a few provisions including the paramount issue of international surveillance. According to the Constitutional Council, this provision, mute on the conditions of use, of retention, and the destruction of information collected as well as on the control exercised by the national commission on the control of intelligence techniques (CNCTR), did not provide adequate guarantees for citizens.

On 1 July, L'Obs published an article unmasking the existence of a secret decree by Nicolas Sarkozy in 2008, authorising the GDSE to spy on international communications transiting by the undersea cables that link Europe with the rest of the world. This decree had no legal basis whatever, and La Quadrature du Net, the FDN Federation and the French Data Network (FDN) therefore decided to attack it on 31 August before the Council of State via two procedures, one for interim suspension and the other at its basis. On 9 September, the Council of State rendered its decision rejecting the appeal, thereby establishing its intention not to give respect for privacy [private life] absolute urgency.

On 10 September, that is, the day following the rejection of the appeal, a bill on international surveillance was filed by two deputies. This bill, in reality, comes from the government, which -- to avoid publishing an impact study and a budgetary study -- preferred to have it presented as a proposed law.

This proposed law very clearly seems to have as its object to legalise existing practises disclosed by L'Obs. The vocabulary is interesting because it speaks no longer of an intelligence law but of international surveillance. It deals with massive surveillance of international communications, unrelated to possible threats. And oversight of the CNCTR, too weak in the framework of national intelligence, is next to nonexistent in this new bill. The text omits even a mention of agreements made among the various intelligence services of different countries (dealing with the exchange of data on their respective citizens, for example), leaving a gaping legal hole in agreements which can have severe ipacts on fundamental rights and on civil liberties.

The text consists of only two articles, one to add a chapter IV on measures for surveillance of international communications to the internal security law, and the other to fill out the law of administrative justice.

Disproportionate and unintelligible conclusions

The text refers to article L. 811-3 of the law of internal security, introduced by the intelligence law. Surveillance may be authorized "for the sole purpose of defense and of promoting the nation's fundamental interests". These are extremely broad conclusions, including the following list:

  • National security;
  • The essential interests of foreign policy and the execution of France's European and internal engagements;
  • France's essential economic and scientific interests;
  • The prevention of terrorism;
  • Preventing the reconstitution or maintenance of groups dissolved in application of article L. 212-1;
  • The prevention of organized criminality and delinquance;
  • The prevention of collective violence which seriously harms the public peace.

In their amicus curiae submitted to the Constitutional Council to support the parliamentary referral of the intelligence law, FDN, FFDN and LQDN have brought to light the disproportionality of certain conclusions as well as their unintelligibility. These conclusions are all reprised by the proposed law on international surveillance, permitting massive surveillance of communications for each of these conclusions, thus legalising all activities of counterespionage, economic espionage, but also espionage on civic organizations, broadly referred to by the text.

Mass surveillance

The text foresees the possibility for the intelligence services to massively collect all data on the communication systems designated by the Prime Minister (Art. L. 854-1 II). It leaves to the Prime Minister to decide which communication systems are covered. Nothing is specified in the law. So these authorizations will evolve along with the evolutions of communication techniques, without the citizens' being able to have a clear view of what techniques may be put in place by the intelligence services. No limit is foreseen to their duration.

Thus all data passing through these communication systems will be collected, and the Prime Minister's authorisations affect only the use of intercepted data. These authorisations will be extremely broad:

  • For a renewable period of one year for the non-individualised use of metadata for one or more of the conclusions given and the types of use set in place. This therefore means massive analysis of collected metadata with no prior goal; and the totality of all metadata (not relatable to France), including European citizens, can be massively gathered and used with no prior control.
  • For a renewable period of four months for communications or metadata originating from geographical zones (all of Africa, all of North America, all of South America), organisations (all of company X, all of NGO X), persons, or defined groups of persons. This measure allows putting in place massive surveillance of communications more or less target according to need. The argument of battling terrorism does not suffice to justify such surveillance; and the broad goals are economic espionage, counterespionage, or spying on civic organisations. Contrary to the black boxes which are restricted to the fight against terrorism, all these conclusions are valuable here.

Necessary amendments:

  • Include in the law the list of communication systems that may be uses
  • Exclude the possibility to put in place non-individualised use of intercepted metadata
  • Authorise only targeted collection and targeted use concerning specific groups or persons to be watched


Modifications by the Senate:
  • Only the Prime Minister will be able through a motivated decision, to select the networks of electronic communications on which the interceptions will be authorised. It will not be allowed to the persons selected by the PM. However, this modification does not bring a supplementary guarantee.
  • The authorisation of exploitation of the "non-individualised" connection data were about "the objectives pursued" and "the type of automatic processes that can be applied". The Senate added "the motivations of the measures" as well as "the service or services (...) in charge of this exploitation". The authorisation is always given for one year renewable. The modifications will allow to force to more precision on every given authorisation but do not give a major amelioration.
  • The same precisions were given by the authorisation of the exploitation for the communication or connection data.
  • The proposition included the possibility to exclude some subscription numbers or technical user identifications of all type of surveillance or in particular access conditions to communications. This proposal was deleted by the Senate. It was aiming at processing differently identified individuals (such as politicians for instance).

Inadequate protection for communication related to the national territory

The proposed law foresees the wholesale collection of all international communications, including those originating or received abroad. This implies collection by default of communications among persons whose identifiers can be connected to the national territory (French telephone number or French IP address), but whose communications will pass through a foreign country (using services whose servers are situated abroad like Google, Hotmail, and Skype, for example. For more details, see especially §9.1 of the amicus curiae brief.

It is specified that individual communication surveillance of persons using subscription numbeers whose technical identifiers can be connected to the national territory are not subject to this rule (French telephone number, French IP address). It will therefore be possible to collect these persons' communications, but those will be "instantaneously destroyed". The implies specific intervention to destroy communications connected to France -- automatic or manual, the text specifies nothing.

On the other hand, "French citizens" whose communications are not connected to the national territory do not benefit from the protection reserved for persons whose communications are connected to the national territory. The text introduces a rupture in the universality of rights between French citizens connected to the national territory and French citizen not connected to the national territory but also regarding European citizen who are not protected by the text. The instant destruction of the those communications (as soon as it is noticed that there are not connected to the national territory, i.e. after collecting and stocking) does not constitute a guarantee to the respect of privacy and liberties of communication and information.

Electronic communication between a person or an equipment connected to the national territory or another person not connected to the national territory are subject to common law but with a lengthening of the period of conservation of communication, lengthening totally unjustified.

Two exceptions are specified in the text and allowing intelligence services to put in place their international surveillance technique for communication connected to French territory. The persons who communicate from abroad who are:

  • subject to a security authorisation in application of the article L. 852-1 on the date who they left the French territory,
  • or identified as representing a threat to the fundamental interest of the Nation under the article L. 811-3.

On the one hand, it gives to the different intelligence services a right of communication, even the possibility for the DGSI (French National Services) to use DGSE techniques (French Foreign Services), without a prior notice of the CNCTR (Independent authority controlling the Services). On the other hand, the Prime Minister can decide alone and without any control that a person represents a threat regarding the fundamental interests of the Nation (notion that appears in the article 851-2 of the French Surveillance Law).

Necessary amendments:

  • Delete the second exception for the identified individuals representing a threat, considering the absence of definition of this notion
  • Forbid the massive collection of communications
  • In case of the precedent amendment wouldn't be adopted, foresee to bring back the length of conservation of communications when at least one person is connected to the national territory at the same length that provided in common law.

Insufficient guarantees from professions whose confidentiality is protected

In order to respect the jurisprudence Digital Rights of the CJUE, French Law must provide special protection for communications of person subject to professional secrecy such as journalist (whose sources' confidentiality is protected) or lawyer. French surveillance law brings a deficient protection to lawyers, journalists, MPs and magistrates only regarding their professional correspondences. Now it is impossible to sort out a priori the private communications from the professional communication. This involves collection, processing and an "omission" from the intelligence services if the communications are private.


The bill on international surveillance provides that only persons exercising in France a warrant or a profession mentioned in Article L. 821-7 (lawyer, journalist, parliamentarian, magistrate) cannot have their communications monitored individually because of the exercise of the warrant of profession.

Ainsi :

  • d'une part, il faut que les personnes exercent en France. Ainsi, les parlementaires, journalistes ou avocats européens (et a fortiori ceux qui exercent en dehors de l'Union européenne) peuvent faire l'objet d'une surveillance individualisée, dans le cadre de cette loi. La protection des sources des journalistes est totalement bafouée par cette disposition. En outre, cet article introduit une rupture d'égalité pour les avocats qui exercent en Europe ou ailleurs puisqu'ils ne peuvent plus assurer le secret professionnel.
  • d'autre part, les personnes exerçant en France ne sont toujours protégées que dans le cadre de l'exercice du mandat ou de la profession. Or il est impossible de définir à l'avance les communications qui relèvent du mandat ou de la profession et une telle disposition, déjà critiquée dans la loi sur le renseignement, implique l'écoute des communications pour permettre une distinction entre celles qui relèvent de la sphère privée et celles qui relèvent de la sphère professionnelle.
  • enfin il est bien spécifié que seule la surveillance individuelle est exclue pour les personnes exerçant en France. Ainsi, la collecte de masse des données et communication est possible.

Amendements nécessaires :

  • « Les personnes qui exercent un mandat ou une profession mentionné à l’article L. 821-7 ne peuvent faire l’objet d’une surveillance individuelle de leurs communications. » Cet amendement prévoit la mise en conformité avec le principe d'universalité des droits.
  • Les mots « à raison de l’exercice du mandat ou de la profession concernée » sont supprimés


Modifications apportées au Sénat : Aucune modification apportée au Sénat

Un allongement non justifiable de la durée de conservation des données collectées

Dans leur exposé des motifs, les députés Patricia Adam et Philippe Nauche justifient un allongement de la durée de conservation des renseignements collectés, par rapport au droit commun, par « la différence de situation dans laquelle se trouvent les personnes sous surveillance résidant à l'étranger, sur lesquelles les capacités d'intervention de l'État français sont plus limitées qu'à l'égard des personnes résidant en France. » Cette explication ne saurait justifier un tel allongement du délai de conservation, déjà extrêmement généreux dans le droit commun. Il faudrait ainsi en rester aux délais déjà importants accordés pour les collectes nationales, afin de respecter le principe d'universalité des droits.

Comme pour la loi sur le renseignement, il est laissé à la libre appréciation des services la nécessité de conserver ou non les données collectées, dans la limite des délais susmentionnés. Sans aucun contrôle réel, cette libre appréciation laisse trop de marge de manœuvre aux services au regard des atteintes aux droits et libertés que constituent ces collectes de masse.

Amendements nécessaires :

  • Correspondances : Revenir à 30 jours à compter du recueil (le texte prévoit 1 an à compter de l'exploitation et max 4 ans à compter du recueil)
  • Données de connexion : Revenir à 4 ans à compter du recueil (le texte prévoit 6 ans à compter du recueil)
  • Chiffrement : Revenir à 6 ans à compter du recueil (le texte prévoit 8 ans après le recueil)


Modifications apportées à l'Assemblée nationale : Les renseignements collectés peuvent être conservés au delà des durées mentionnées dans la loi s'ils contiennent des éléments de cyberattaque ou s'ils sont chiffrés, ou si ce sont des renseignements déchiffrés associés aux éléments chiffrés. Aucun délai n'est mentionné. Ces renseignements ne doivent être conservés que pour les besoins de l'analyse technique et notamment le décryptage. Cet ajout reprend la formulation de l'article L.822-2 §I du code de la sécurité intérieure, créé par la loi du 24 juillet 2015 relative au renseignement.

Un contrôle limité et a posteriori

La commission nationale de contrôle des techniques de renseignement (CNCTR) crée par la loi sur le renseignement est l'organe de contrôle des mesures de surveillance internationale. Cependant, si elle a le droit d’être informée de toute les autorisations données, son avis n'est pas nécessaire à la mise en place des techniques de surveillance internationale. Il n'y a donc aucun contrôle a priori. La CNCTR a accès aux dispositifs de traçabilité et aux renseignements collectés. Elle peut contrôler a posteriori et faire part au premier ministre des manquements. En cas d'abus, elle pourra saisir le Conseil d'État.

Il a été révélé à plusieurs reprises la conclusion d'accords entre différents services de renseignement portant par exemple sur l'échange de données de leurs citoyens respectifs. La possibilité pour les services français de signer de tels accords n'est même pas mentionnée dans le texte. Il est absolument nécessaire de prévoir un contrôle a priori de tels accords, ainsi que dans leur mise en œuvre par la CNCTR.

Cette proposition de loi semble très clairement avoir pour objectif de légaliser les pratiques existantes révélées par L'Obs. Le vocabulaire est intéressant car on ne parle plus d'une loi sur le renseignement, mais sur la surveillance internationale. Il s'agit bien d'une surveillance massive des communications internationales, indépendamment des menaces possibles. Et le contrôle de la CNCTR, trop faible dans le cadre du renseignement national, est quasi inexistant dans cette nouvelle proposition. Le texte omet même de mentionner la conclusion d'accords entre les différents services de renseignement de différents pays (portant sur par exemple), laissant un vide juridique béant sur des accords pouvant être extrêmement attentatoires au droits fondamentaux et aux libertés.

Amendements nécessaires ː

  • « La Commission nationale de contrôle des techniques de renseignement reçoit <insert>immédiatement</insert> communication de toutes les autorisations mentionnées au II ». Cet amendement a pour objectif de permettre une réaction immédiate de la CNCTR, à défaut d'être consultée dans le cadre de l'autorisation. Elle pourrait ainsi au moins s'opposer rapidement à la mise en œuvre d'autorisations.
  • Lors de la conclusion d'accords de coopération entre les services de renseignement français et ceux d'autres pays, la proposition est soumise à la CNCTR qui doit rendre son avis dans un délai maximal de deux semaines. Si malgré un avis négatif de la CNCTR l'accord est conclu, la CNCTR peut saisir le Conseil d'État. La CNCTR a un accès direct et permanent aux informations et aux échanges opérés dans le cadre de ces accords.
  • Prévoir des moyens humains et financiers suffisants pour la CNCTR pour un contrôle effectif.