After the Paris terrorist attacks of 2015, the French Parliament passed an unprecedented overhaul of the legal framework for intelligence surveillance. As the government is due to propose changes to the Intelligence Act later this year, stakeholders diverge on the scope of the upcoming reform. To preserve the overall balance struck in 2015, however, only light-touched interventions are warranted.
Until the law of 24 July 2015, French intelligence services worked in a situation of structural illegality. Until then, the legislative framework (since 1978) only allowed them to establish databases, engage in telephone wiretaps (since 1991), and access communication metadata (since 2006). Lacking a comprehensive legal basis, their entire activity was prohibited by the criminal code while contradictorily being mandated by the government.
In 2015, because of necessity and actual political will, this situation finally changed. The then-adopted law was drafted to avoid the ravages of time. To avoid legal obsolescence brought about by inevitable technological developments, lawmakers were less concerned with the technical aspects of intelligence gathering than with the nature of the interference (e.g. infringing on the secrecy of communications, on the inviolability of the home, etc.) and the nature of the collected intelligence (data, words, images, geographical location, etc.). Likewise, in order to establish a new approach to implementation and control, the 2015 Intelligence Act articulates five fundamental principles: 1) proportionality, 2) subsidiarity, 3) individualisation, 4) centralisation, and 5) territoriality, as well as general criteria for oversight.
Such a principled approach — which is quite unusual in the French legislative field — is mostly due to the fact that the law was long in the making; drafting began in 2011, a parliamentarian consensus on the general orientation of the law was struck in 2013, and interministerial work began in September 2014.
Algorithmic surveillance: The need for a true parliamentary debate
The terrorist attacks of January 2015 however, impacted the planned schedule. While these events accelerated the examination of the text by a few weeks, they also led the government — advised by intelligence services — to introduce two provisions: one devoted to real-time surveillance of metadata (Article L.851-2 of the Code of Internal Security, CSI) and another one on ‘algorithmic surveillance’. The latter being snooping devices installed at the level of data-centers or telecom networks, to detect communications matching selectors tied to ‘terrorist’ activity (L.851-3). Resulting from technological solutionism aggravated by the crisis, these provisions departed from some of the above-mentioned principles (proportionality, individualisation, and centralisation), and led to a strong interference in private life.
In reaction, parliament stated Article L. 851-3 would be adopted as a ‘sunset provision’ set to expire on 31 December 2018 – that is unless parliament were to renew these surveillance powers after an impact assessment proved they were decisive in the fight against terrorism. However, in 2017, the law of 30 October extended the time limit, while applying the ‘sunset clause’ approach to other provisions – a tendency symptomatic of democracies fraught with hesitations. The Intelligence Act was thus promised a second parliamentary debate, one which would have to take place before 31 December 2020. Crucial issues underpin this upcoming debate and I will highlight the main ones in the rest of this article.
The first has to do with traffic scanning technologies used to detect what intelligence analysts call “weak signals” corresponding to ‘terrorist activities’ (a provision that has been nicknamed “the algorithm” or “black boxes” in the French context). For more than two years after the adoption of the 2015 Intelligence Act, French domestic intelligence failed to use these new surveillance powers allowing for scanning communications en masse at the level of a telecom network or a datacenter to automatically detect suspicious metadata. It now seems indispensable to organise a real parliamentary debate enlightened by a non-classified and detailed assessment report – especially considering the law itself mandates such a report. This debate should in particular address the conditions of production of the various algorithms used to spot weak signals — in particular the data sets used to develop these algorithms — their effectiveness and usefulness, or potential bias.
Furthermore, if the system were to be renewed, it seems essential to renew limitations in scope so that it can only be used in the fight against terrorism. Lawmakers should also ensure that the provision and its use are subject to periodic assessment.
Preserving the multi-stakeholder balance
Any legislative endeavour gives rise to a range of positions taken by the various actors involved in the debate. The Intelligence Act is of course no exception, especially considering that it directly affects fundamental rights. Let us provide an overview of the different postures at play.
- For one, parliamentarians will try to take advantage of this legislative vehicle to increase their mandates in terms of oversight of the intelligence agencies. Meanwhile, the oversight body — the National Commission for the Control of Intelligence Techniques (CNCTR) — will also push for broadening its mandate, in particular to control data-sharing activities between French intelligence and their foreign counterparts.
- The CNCTR will also promote a stronger alignment in the oversight of domestic and foreign surveillance activities, and call for the introduction of more formal improvements in the drafting of the law.
- As for the government, it might be tempted to increase the surveillance powers of intelligence agencies so as to not be accused of inaction in this area, while intelligence agencies may seek to alleviate a burdensome oversight framework, or to change provisions that hinder their ability to adapt to new technological developments (such as 5G).
- Finally, non-profit organisations and other public agencies focusing on fundamental rights will try to replay the debate of 2015 — which they lost — with arguments on the role of judicial judges or the need to restrict the powers of intelligence agencies.
Each of these stakeholders can find its path in the upcoming debate, but they should not destabilise the balance struck in 2015, particularly with regard to the principled approach that led to its legislative elaboration. The desire shared by all stakeholders to influence the outcome according to their political preference should not lead to amendments that do not fill a proven gap. As things stand, however, there are few demonstrated shortcomings.
Making the Intelligence Act consistent and addressing oversight gaps
The main shortcoming results from a direct consequence of the Intelligence Act itself: the massification of collected data. In 2015, lawmakers were hardly aware of an issue that would come to the fore in late 2016, when the DGSI (the main domestic intelligence agency) announced a partnership with Palantir to lead big data analytics on its troves of data. The use of big data analytics to make sense of all the collected information is an important topic which deserves further scrutiny, and possibly new legislative measures. Moreover, important questions should be asked about technological research into Big Data. It would be a waste not to take advantage of the troves of ‘raw data’ collected by intelligence agencies in order to train algorithms based on machine-learning techniques, thus enabling France to position itself in international competition on these key technologies.
Lawmakers should also clarify the legal framework surrounding data sharing between French intelligence agencies. Creating so-called “fusion centers” — where agencies can pool collected data and related intelligence — is normally forbidden, especially considering the French data protection authority’s strict interpretation of the 1978 law on “computing and freedom”. In 2015, lawmakers sought to allow such data sharing through the adoption of a dedicated provision, article L.863-2, but whether this constitutes a sufficient legal basis is still subject to debate. To overcome these legal hurdles, I have proposed to approach data sharing as a data collection capability of its own right, subject to a dedicated framework implemented on a case-by-case basis after review by the CNCTR. This topic will most certainly be central in the upcoming legislative debate on the reform of the Intelligence Act.
All of these considerations argue in favour of strengthening oversight powers, especially those in the hands of the government. In this respect, the principle of centralisation could be strengthened under the auspices of the Interministerial Control Group (GIC), which acts as an intelligence operator between the different relevant government ministries to implement domestic surveillance measures. On that front, the relevance of setting up a dedicated SIGINT agency — common to various French agencies — should be considered, in particular from the point of view of control, pooling, and efficiency.
Many other subjects need covering to provide for a real, wide-ranging legislative debate in the French Parliament. However, these important changes should go hand-in-hand with the meticulous work of legislative re-drafting, made necessary by the amendments introduced to the 2015 Intelligence Act since it was first tabled.
In particular, legislative improvements should make it possible to dispel inaccuracies in the use of some notions — for instance, the Intelligence Act confuses ‘data’ with ‘intelligence’ — so as to give the Intelligence Act the status of the major benchmark that it deserves. To the extent that it results from a careful international comparison and a detailed analysis of the case law of the European Court of Human Rights — and considering that French lawmakers have progressively built up a framework of complementary oversight mechanisms and effective remedies — the Intelligence Act could easily serve as a source of inspiration for other countries going through intelligence reform. This, however, would require taking a step back from the specificities of French legalese, which is not an easy task.
Activate antidelphin invasión protocol.