The French government claims its new Intelligence Bill is defined in opposition to the American and British models – but this just doesn't hold once the text is examined. Quite the contrary.
During a rally against the new Intelligence Bill in Paris, April 2015. Demotix/Yann Korbi. All rights reserved.
On 19 March , French Prime Minister Manuel Valls organised a press conference to announce the Intelligence Bill that his government had just adopted and was presenting to Parliament. Confronting the media, Valls sought to dismiss growing concerns that the bill, the contents of which had been leaked to the press a few days earlier, would undermine the right to privacy. “This has nothing to do with the generalised surveillance of citizens”, Valls said to journalists. He even went on to claim that the bill would “forbid” mass surveillance.
This posture came all the more naturally to the French Government as it has kept its head down and weathered the storm since the Snowden disclosures began almost two years ago. Even when documents exposing the cooperation between the French General Directorate for External Security (DGSE) and the NSA and other Five-Eyes agencies (the LUSTRE agreement) came to light, public officials either refrained from any comment or issued denials. Today, the Valls government is claiming that the bill is simply a matter of securing the legitimate intelligence collection practices of the French security services, which hitherto lacked a proper legal framework.
These reassurances, however, do not survive proper scrutiny. A close reading of the Bill shows that it authorises the government to engage in preventive surveillance of private communications and public spaces for a broad range of motives – from terrorism to economic espionage and the monitoring of social movements – without proper ex ante control. It also orchestrates the legal whitewashing of mass surveillance, and legalizes tools and policies that directly echo those of other surveillance superpowers, like the US, the UK or Germany. Three examples are particularly telling.
Black boxes: legalizing “plug-and-spy” surveillance devices
The most fiercely debated item of the bill relates to so-called Internet “black boxes” aimed at detecting terrorist threats. Article 2 makes provision for the Prime Minister to require telecom operators and online platforms to install technical devices on their infrastructure (networks or servers) that will use custom algorithms to detect suspicious online behaviour.
According to examples quoted by government ministers and high-ranking officials in the intelligence community, the goal is to detect the use of particular encryption protocols or web browsing habits. Though the government denies this is the case, there is every indication that these black boxes will deploy some kind of Deep Packet Inspection (DPI) technology.
From a British and American perspective, these black boxes are hardly news. In the UK, a similar provision was debated as early as 2000, and eventually subsumed in the Regulatory Investigative Powers Act, section 12. More recently, documents leaked by Mark Klein – a former AT&T employee turned whistleblower – revealed that the NSA had implemented DPI technologies to monitor Internet traffic on US soil.
Of course, the technology will be provided by the private sector. Mark Klein's documents showed the NSA's DPI gear was built by a division of Boeing. In France, a likely candidate to manufacture these black boxes is the home-grown Qosmos, a worldwide expert in DPI technology. Qosmos has nurtured close ties with the French intelligence services and even received public funding through the French sovereign fund in 2011. The company is also at the centre of an investigation by a Parisian judge specialised in crimes against humanity for its role in providing censorship and surveillance tools to the Libyan and Syrian dictatorships.
Quite daringly, the government claims such black boxes have nothing to do with mass surveillance, arguing that they will only scan “anonymous” metadata, while only a small portion of suspicious data will trigger further investigations. From a legal perspective, however, it is clear that these devices amount to a massive processing of personal data, including that of people for whom there is no suspicion of direct or indirect relationship to a crime. As such, they run counter to the case law of the EU Court of Justice and that of the European Court of Human Rights.[1] Moreover, as leading computer experts have long argued, such data-mining systems are bound to be ineffective when it comes to finding “the needle in the haystack”, leading to huge amounts of false leads and investigative dead-ends.
International surveillance: negating the universality of human rights
In article 3, the French Intelligence Bill defines “international surveillance measures” as communications “sent or received abroad” and then goes on to establish a minimal framework for the surveillance of such international communications. The bill's rapporteur, Jean-Jacques Urvoas, argues this is a major step forward since until now international surveillance was left unregulated.
However, as was implicitly recognised by the head of the DGSE in parliamentary hearings, surveillance activities carried on beyond French borders will remain completely unregulated. The provision is actually drafted in a way that makes it only applicable to the interception of international communications when conducted from French territory. In sum, French agencies will be able to massively tap into global communications networks located under French jurisdiction or anywhere else in the world, and then legally store, retrieve and analyse collected data on French territory.
In that regard, the provision echoes the collection practices at the heart of the unfolding BND scandal in Germany (authorized under the G-10 law that regulates the surveillance activities of intelligence agencies) as well as section 702 of the US FISA law. Considering that most of French residents' online communications are “made or received abroad” – particularly in the US or in other European countries where the servers of the largest online service providers are located – it will be used against national citizens and residents, much like FISA section 702 for “US-persons”. Intelligence agencies will therefore use it to circumvent the protections provided for national surveillance, such as the ex ante opinion issued by the intelligence oversight commission. As for foreigners, they will remain completely “fair game”.
So why are the bill's advocates completely confident that the provision is compliant with human rights standards? In their defence, they quote a recent study on “fundamental rights in the digital sphere” conducted by the Council of State – the French supreme court for administrative justice. The latter invoked the jurisprudence of the European Court of Human Rights to back up a contested legal premise according to which “(...) the fact that there are lesser safeguards surrounding the interception of communications when it is located abroad rather than on the [national] territory is justified”.
Traditionally, such a dual regime distinguishing national and international surveillance has been justified by the practical limitations to the ability of states to engage in mass surveillance outside of their territory. But in the age of global and digital communications networks, where whole civilian populations have become subject to systematic surveillance, this outdated “laissez-faire” approach does not only completely negate the universality of human rights when it comes to foreigners. It also leads to opportunistic strategies where the cross-border nature of communications is used to bypass the checks-and-balances that protect the state's own citizens, all within the comfort of the national territory.
Secret trials: procedures for unaccountability
Finally, the government alleges that the bill brings more protection to fundamental rights by opening the possibility of legal redress. According to the text, any person who thinks they might be subject to preventive surveillance will be able to have their day in court by appealing to the Council of State.
But this new procedure has many loopholes. First, it is unclear how individuals will be able to demonstrate that they have “a direct and personal interest” in bringing a case against what are by definition clandestine operations. More importantly perhaps, the procedure heavily relies on secrecy, as intelligence agencies will be able to submit classified material to judges and make oral arguments during closed-door in camera sessions. In the name of national security, these evidence and arguments will remain inaccessible to claimants and their lawyers.
Once again, this provision seems modelled on other surveillance superpowers. They particularly bring to mind one of the most worrying trends in British law: the growing resort to “Closed-Material Procedures” (CMPs) in national security cases. According to a recent EU Parliament study on the use of secrecy in courts (as discussed on openDemocracy), such secret procedures come with important challenges:
“(...)The use of information and materials provided by intelligence communities, which are kept secret and not disclosed to the defendants in the name of national security, not only sparks debate in terms of respect for fair trials, equality of arms and fundamental rights. It also poses important questions linked to the changing practices of the intelligence communities and the extent to which materials provided by these services in courts is properly scrutinised by judicial authorities.”
Although the secret procedures created by the French bill have a much narrower scope than British CMPs – they are limited to cases of alleged illegal surveillance –, they also come with less protections. For instance, there will be no security-vetted lawyers allowed to access secret material and participate in closed-door hearings so as to defend the claimants' interest (so-called “special advocates”). This is all the more worrying considering the institutional arrangements undermining the independence of the Council of State: half of its judges are directly designated by the President and many go back and forth between the Council's benches and high-ranking jobs in the executive branch during the course of their career. Such proximity only reinforces the risk that magistrates will uncritically rely on intelligence information based on a presumption of good faith, thereby protecting government interests in cases of illegal surveillance.
Can the French political system resist mass surveillance?
These three examples reveal only some of the many dangers contained in France’s Intelligence Bill. But they clearly show how untruthful the public relations strategy of the Valls Government is. The notion that France’s surveillance apparatus is defined in opposition to the American and British models just does not hold good once the text is examined in detail. Quite the contrary: we see similar technical, legal and procedural devices being used to subject whole populations to surveillance, while sheltering the reason of state from appropriate checks and balances.
Manuel Valls is confident the bill will sail through Parliament. The terrorist threat and the collective trauma ensuing from the Paris attacks is of course playing into the hands of the government. Many leaders of the main opposition party, the UMP (conservative) are engaging in a securitarian horse-race, warning that they will oppose any measure hindering the power of the intelligence services. As for his own majority, Valls knows he can rely on the bill's rapporteur, Jean-Jacques Urvoas, one of his most loyal allies in the Socialist Party, who is a member of several intelligence oversight agencies and one of the bill's key architects.
Finally, though the government quite paradoxically claims the law was not “dictated by circumstances”, it has chosen to trigger a fast-track parliamentary procedure, allowing only one reading of the bill in each chamber of Parliament. From this perspective, the adoption of the Intelligence Bill is a matter of weeks (after adopting a few amendments mid-April, the National Assembly will hold a formal vote on May 5 before the bill goes to the Senate floor, probably in June).
Yet, opposition to the bill is unprecedented. Digital rights groups, international human rights organisations as well as judges and lawyers unions are teaming up. They are joined by prominent institutions like the data protection authority as well as media and international organisations. Several officials of the Council of Europe or the United Nations also came out strongly against this law. Even the president of the CNCIS – the French intelligence oversight commission – denounced the legalisation of mass surveillance practices as amounting to “trawl fishing” rather than “targeted harpooning”.
If the government were to get the approvals of the Parliament and the French constitutional court despite this near-unanimous opposition, it would be yet further evidence of the profound crisis of a political system determined to distort the truth if necessary, to break away from the rule of law.
[1] See, e.g., ECHR, Amann v. Switzerland, February 16th, 2000, §69: “The Court reiterates that the storing by a public authority of information relating to an individual’s private life amounts to an interference within the meaning of Article 8. The subsequent use of the stored information has no bearing on that finding.” See also EUCJ, Digital Rights v. Ireland, April 28, 2014, §57: The Court invalidated the 2006 data retention directive after finding that the latter “cover[ed], in a generalised manner, all persons and all means of electronic communication as well as all traffic data without any differentiation, limitation or exception being made in the light of the objective of fighting against serious crime.”
from openDemocracy https://www.opendemocracy.net/digitaliberties/f%C3%A9lix-tr%C3%A9guer/france%E2%80%99s-intelligence-bill-legalises-mass-surveillance
via IFTTT