Patching the French Intelligence Bill

English   Français

This wiki page suggests possible amendments to the French Intelligence Bill (2015). It is still under construction and its contents could be thoroughly modified in the coming days.

INTRODUCTION

The Intelligence Bill introduced before the French Council of Ministers on 19 March 2015 is presented by its defenders as a text which protects fundamental rights. This technical text would be nothing more than a way to legalise policies and techniques which were up to now common but not regulated, and as such to create better safeguards. Move along, nothing to see here!

As the French government has chosen to burry its head in the sand since the beginning of Edward Snowden's revelations regarding the NSA and GCHQ spying methods, this argument might be used as a successful public relations strategy. For nearly two years, the French government has indeed managed to avoid any actual debate on the French services' practices, altough some of the revelations have shed light on the DGSE (French foreign intelligence agency) and the exchange of data with the NSA. Instead of a transparent democratic debate, French officials have mostly weathered the storm, simply issuing denials without ever explaining how the French system works.

This bill would as such help render the process as clean as it gets. For Prime Minister Manuel Valls, the text would even forbid mass surveillance! The underlying message being pushed here is that the French system would be defined in opposition to the American and British surveillance schemes.

But the argument doesn't hold once the text is examined in detail one looks at the text in detail. Several provisions are actually directly inspired by the law and the methods used by the NSA and GCHQ and do indeed legalize tools of mass surveillance (in particular with automated Internet trafic analysis "black boxes" designed to detect “suspicious behaviour” (art. L. 851-4) or provisions on so-called 'international surveillance'

(art. L. 854-1) which will authorize bulk data collection). The will to set loose hacking and cyberattacks carried beyond French borders also echoes the recent revelations regarding the British, US and Canadian agencies' practices. Finally, despite what its champions claim, the text is in many ways a step backwards in relation to the existing law and practices: for instance, specific and crucial control processes currently carried out by the CNCIS (National Commission for the Control of Security Interceptions) are being dismantled, whereas the field of intervention of intelligence agencies is widely extended.

Only the citizens' mobilisation, in France and across the world, can make a change whilst the the government tries to force this bill through. In actual fact, the Valls-Urvoas (Prime Minister and the Bill's rapporteur) tandem in the National Assembly will enable the government and its majority to join forces during an rushed legislative procedure, while the "post-Charlie" mood and the securitarian drift by the opposition conservative party (the UMP) might contribute to stifling the democratic and parliamentary debates.

The points raised below highlight the dangers of the bill while pointing at possible amendments. To be acceptable and allow intelligence agencies to do their work while respecting the rule of law, the text must indeed be deeply amended.

SCOPE RESTRICTIONS

Forbid mass surveillance and predictive measures

Article L.851-4 provides that the Prime Minister may require that telecom operators and online service providers to detect, via automated means, suspicious pattern connexion data or online behavior, whose anonymity would be lifted if a terrorist threat were to be revealed. This provision seems to be inspired from the British model, as a similar mechanism was debated as early as 2000 when the RIP Act was adopted and eventually included within the Act's section 12 (this issue would be raised again in 2008, during a [http://www.theregister.co.uk/2008/10/07/detica_interception_modernisation/ modernisation plan criticised for the extravagant expenses it incurred at the time).

Such means for extensive scanning of online communications at the network or server levels amount to a massive processing of personal data. As such, they are contrary to the jurisprudence established by both ECHR and ECJ. The government's argument that this surveillance relates to raw, anonymous data is completely at odds with technical realities. This provision introduces a mass surveillance using technical devices and algorithms in which no transparency is possible. It is moreover contrary to the French Data Protection Act, which provides that "no decision which produces legal effects in respect of a person may be taken on the sole basis of the automated processing of data." It must therefore be repealed.

Restricting the scope of the "international commitment" public interest

Several provisions enlarge the various "public interests" that may be invoked to engage in intelligence gathering activities. The Government argues that the reference to the implementation of France's international commitments among those public interests aims to use the intelligence techniques to prevent the proliferation of weapons of mass destruction. While this goal may be laudable, the international commitments of France are a too broad and ill-defined legal category, which would allow for an indefinite extension of the legal basis for the use of surveillance. To comply with international law, the French law must be amended to ensure that it expressly mentions specific international obligations (treaties, agreements, conventions) justifying the use of intelligence gathering techniques.

Repealing the "collective violence" public interest

Article L. 811-3. extends the intelligence services' powers to include the "prevention of collective violence likely to cause serious harm to the public peace." The extremely broad wording of this public interest allowing exceptional monitoring techniques poses serious risks of arbitrariness. It could for instance easily be invoked to engage in the surveillance of social movements. Given the serious risks it poses to the most basic political rights, this provision must be deleted.

Repealing the "key scientific and economic interests" public interest

The legalisation of economic and scientific espionage in the country without any judicial oversight results in a disproportionate interference with both right to privacy and freedom of enterprise. If the information sought is not directly linked to the fight against industrial espionage, in which case the surveillance can be part of a criminal investigation, then the recourse to exceptional monitoring techniques cannot be justified.

Limiting by law the number of intelligence agencies

Article L. 811-4 of the bill empowers the government to unilaterally increase the number of executive agencies falling under the Minister of Defense, the Minister of the Interior as well as the Ministers for the Economy, Budget or Customs which may use intelligence techniques. In impact assessment, the Government is openly considering to give "certain police services" the broad surveillance powers provided in the bill . However, the scope of the competent authorities in regard to preventive and extrajudicial surveillance should remain limited to the minimum necessary, and the government does not provide any justification for the need to expand the already large number of beneficiary services (DGSE, DSPDs, DRM, DGSI, Tracfin and DNRED). Thus, given the fact that the increase in the number of relevant services acquiring and accessing "intelligence" leads to a greater risk for civil liberties, but also in order to ensure the predictability of the law, the number and nature of the beneficiary services must remain limited and must be subject to the law rathen than executive decrees. This provision should be repealed.

Limiting the surveillance of targets' entourage

Article L 852-1 will authorize the interceptions of the communications passed by "individuals close to the person who is the object of the authorisation" when they "are likely to act as an intermediary, voluntary or not, or on their behalf or may provide information pursuant to the end result for which the authorisation was granted." This provision may significantly increase the number of people likely to be monitored in a preventive and extra-judicial framework. It must be clarified to ensure that only those who are known to actually act as a direct and voluntary intermediary or whom have a direct link with the ongoing investigation may be affected by this provision.

Forgoing the extension of the time during which metadata may be exploited

The bill extends from three to five years the period during which intelligence agencies can keep hold and make use of traffic metadata. This very long duration is not necessary, and the government had failed to provide any evidence justifying the extension. The three-year period currently applied is already an exception to the regime applicable to other collected data, which must be destroyed after a period of 1 to 12 months.

Limiting the retention period for encrypted data and correspondence

Article L. 822-2 provides that the time limit for the retention of collected information (one to twelve months depending on the case) starts from the time of their decryption. This provision would allow services to retain data or correspondence (e.g. e-mail) for years before deciphering them and using it. For this reason, it is necessary to limit this period to a period of 30 days during which the data will be stored in an encrypted state, giving the agencies will enough time to perform a technical analysis. In addition, the article provides that the metadata attached to the encrypted content is subject to the same retention periods. This metadata being "in plaintext" (legible by everyone), this provision restricts the right to privacy even though the encrypted contents have not been decrypted. Here, the retention period prescribed for metadata (3 years) should apply.

"INTERNATIONAL" SURVEILLANCE AND UNIVERSAL RIGHTS

Limiting the "international surveillance" regime to communications transmitted and received abroad

In Article 854-1, the bill defines "international surveillance measures" as communications "sent or received abroad." Now, in the case of the Internet, most of French residents' communications are obviously "made or received abroad", particularly in the US where the largest service provider's servers are located. It is therefore completely misleading to coin them "international surveillance", since these provisions will directly and massively impact French citizens and residents.

All these provisions must be interpreted as a crude attempt to circumvent the already very weak protections contained in the bill. What is more, the provision actually raises additional walls of secrecy around the "implementation of surveillance rules", providing that these rules will be defined in an "unpublished" executive decree. In addition, the text does not bring any protection regarding the authorisation collection, retention, destruction or control procedures relating to these operations, merely referring once again to decree to be adopted at a later stage. Finally, derogatory rules will apply to the collected data: in a move contradicting France's commitment to universal rights protection, the text allows for special guarantees when the data can be 'linked' to the French national territory, and therefore to French citizens (similar to British RIP Act of 2000). These guarantees, however, come rather short of those applied to 'national' surveillance, since the retention time for intercepted communications starts from "the date of first use," instead of the date of collection.

In sum, the provision will allow the mass collection of communications to or from abroad, which can be stored indefinitely until they are processed and analysed and finally used by the agencies. In fact, the provision seems modeled on section 702 of the US law FISA, which is at the heart of the controversy surrounding Snowden's revelations. The scope of this provision must therefore necessarily be limited, by stressing that international monitoring only affects communications "issued' and received" abroad.

Upholding the universality of human rights

The Snowden revelations are shedding light on the scandalous NSA or GHCQ practices, which invoked the foreign element of data collection to violate national laws (in particular through cooperation mechanisms and data exchange agreements) and also significantly violate foreign nationals' rights to privacy. To reverse these trends, France must show its commitment to the universality of rights, in accordance with Article 1 of the Universal Declaration of Human Rights, particularly in regards to the right to privacy and communications confidentiality. To do this, the legislation must request that any surveillance measures, even when communications are issued and received abroad, be submitted to the control of an independent authority. This legal and ethical position is reinforced by some technical considerations: in its feedback notice (pdf) on the bill , ARCEP (the national telecom regulatory agency) points out, for example, that "in light of the way the bill is drafted, it could be difficult for telecom operators to effectively determine under which regime the international communications sent or received on the national territory fall under" (since even communications sent of received in France can be routed at some point across French borders).

Repealing legal immunity for international hacking operations

France must opppose the frantic state-sponsored hacking arms race. However, the bill'sArticle 10 amends the Penal Code in order to shelter intelligence agencies' employees from all criminal proceedings in connection with computer crime when it comes to carrying out their missions "outside the national territory" (more specifically when they engage in the intrusion, capture, destruction of computer systems). With Internet and the transnationalisation of communications, the notion of "national territory" is too restrictive to ensure an effective protection of rights. In fact, many French residents use computer systems located outside their borders to communicate over on the Internet and store their data. Hacking, even when conducted outside the country, must not result in any criminal immunity and the CNCTR (an executive agency which will replace the CNCIS in controlling intelligence gat must also be given genuine control over this activity.

CONTROL & TRANSPARENCY

Provide the CNCTR with adequate means ?sufficient resources

The CNCTR must be able to carry out its regulatory control duties by leveraging sufficient human, material and technical resources. By merely providing an access to records kept by the agencies as well as the possibility for the Prime Minister to transmit all or part of the intelligence agencies' own reports, the bill marks a major step back compared to the post control system currently in place. The proposed law must also provide for the CNCTR to be able to audition the agencies' directors or technical managers, a direct access to the collected data and the possibility to conduct audits in the various agencies premises (scheduled or unexpected visits). Furthermore, the CNCTR must have sufficient human resources to conduct its post control monitoring requirements, for example by providing that the commission is supported by an investigative team with the appropriate technical and legal expertise. In addition to collegiality, to insure that the principle of adversarial proceedings is respected of limit an adversarial approach, In addition to collegiality, and to insure that the principle of adversarial proceedings is respected, a position as 'Right for Privacy Defense Lawyer' to assist the monitored individuals should be created, modeled on the FISA law reform proposals currently discussed by the US Congress.

Ensure the collegiality of the CNCTR

In the bill's current form, Article L.821-3 allows the president of the CNTR to give his sole approval to a request from the Prime Minister. If in doubt, he may decide to consult with the commission. By contrast, a simple majority is required from the commissioners to terminate an authorisation. Within the CNCTR, the authorisations requests must be submitted to the whole of the commissioners, and the opinion of the committee must be the result of a simple majority of the votes cast, respecting the timelines provided for in the bill. The adoption of a recommendation to stop the implementation of an intelligence gathering scheme must happen under the same conditions. procedure must be on the same terms. When such recommendation is not acted upon, (Article L. 821-6), a qualified majority made up of a third of the commissioners should suffice to refer the case to the Council of State. All commissioners must be in a position to publish their personal opinion on the activities of the Commission in its annual report, in accordance with the confidentiality agreement for the protection of the fundamental interests of the Nation.

Repeal or limit the "absolute emergency" procedure without prior authorization

The preliminary check carried out by the CNCTR runs the serious risk of being circumvented by the absolute emergency procedure, especially since the agencies will have all the means at their disposal to arrange for an 'absolute emergency'. This provision should be repealed or at least closely regulated, for instance by limiting the number of times it can be called upon to five a year.

Forgo real-time metadata capture with no prior control and no time limits

To prevent terrorism, Article L. 851-3 allows for the connection data belonging to people "previously identified as posing a threat" to be collected in real-time, directly from the operators'networks, with no time frame. Consequently, this provision ensures a real-time metadata capture without any preliminary control from the CNCTR. This control must be restored, if appropriate with a derogation from the usual thirty day period in place for information or documents gathering authorisations. Additonally, the provision must specify that agents can not directly tap into the operators'networks but the operators must transmit the data, if necessary in real-time (as is currently the case per the Internal Security Code, amended by the Defence Planning Act: Article R. 246-7 states that "the information request laid down in Article L. 246-3 must be fulfilled by the network's operator").

Reporting the cases to the judicial authorities

In the bill, there is no set framework to define when and according to which criteria the exceptional preventative intelligence surveillance scheme must give way to a full judicial enquiry with the safeguards it brings to those targeted. As such, there is a good chance that the judge will not be involved in an investigation relating to breaches of the law discovered through the collected intelligence, the elucidation of which should normally come under his remit. The judicial court is therefore likely to stay away from investigations into offenses disclosed by the collected information, and the elucidation normally within its mission. The law should provide that once the constituent elements of a crime are identified as part of the collection of intelligence, judiciary must be involved. The CNCTR will also exercise control to ensure that the services transmit as soon as possible to the judicial authority records which warrant the opening of an investigation.

Expanding the opportunity to use advocacy associations

In Article L. 841-1 under the bill,those who have the capacity to involve the Council of State for the purposes of an appeal include only the CNCTR, judicial authorities or "anyone with a direct and personal interest" act. This excludes including advocacy associations, often more able to defend civil liberties in front of the state, particularly with regard to illegal surveillance. It is therefore necessary to broaden the appeal capabilities.

Ensure transparency about situations of illegality

Where a finding of illegality by the State Council in the implementation of intelligence collection, it may be sufficient to stop the collection and eventually condemn the State to compensate the applicant for the damage, without which no one can be aware of the nature of illegalities. Similarly, if there was infringement, the lifting of secrecy invoked for national security grounds is subject to the Advisory Commission of the secrecy of national security. The law should ensure transparency on the illegalities of situations observed, with adapted procedures.

Renounce criminalization of revelations about the monitoring programs

Article 7 revises the provisions for punishment, including when a specific intelligence technique is implemented. This criminalization prevents disclosure of public interest in this area, including through journalistic investigations. These provisions must be repealed.

Protecting whistleblowers within services

A procedure must be established to allow whistleblowers to bring to the knowledge of the CNCTR or the special section of the State Council all practices clearly contrary to the legal framework (joined one of the proposals of the State Council in sound report 2014). The findings of illegality or violation should lead to an end of it and public report in a manner appropriate to the activities of the intelligence services.

Protecting people subject to professional secrecy

To comply with the law Digital Rights of the ECJ, French law must provide special protection for the communications of persons subject to professional secrecy, such as journalists (including the protection of the confidentiality of sources) or lawyers. The bill should be amended accordingly.

Ensure transparency on the means of analysis and processing intelligence

To ensure predictability of the legal provisions relating to administrative supervision, the State must disclose certain aspects of the functioning of the technical apparatus (see § 68 stop ECHR /pages/search.aspx?i=001-87208 Liberty v. the United Kingdom, 1 July 2000). This requirement is all the more necessary as the practices and tools in the field have been ongoing in complete illegality, and that for many years. Respecting in a manner appropriate to the missions of the intelligence services, CNCTR must bring to the public the general information on IT equipment, types of algorithms and other tools of technical analysis of the processed data collected by service .

Ensure control of the files of the intelligence services by the CNIL

The CNIL opposed estoppel when asking the Government to repeal existing laws that exclude the control of regularity from the perspective of the "Data Protection" law. CNIL estimates in its opinion on the bill that such control "is a fundamental requirement to establish the legitimacy of these files in the rights and freedoms of citizens." The bill should be amended to allow the CNIL to exercise such control, in a manner appropriate to the activities of the intelligence services, and in cooperation with the CNCTR.