Once again, France had the occasion to catch up to other Western democracies when it comes to intelligence oversight. Six years after passing a first historic law on intelligence, French lawmakers are again debating the matter. They are going to decide whether the original text just needs to be amended or profoundly reworked to take into account fast-paced technological changes, new threats that emerged since then, and the increasing but already huge state powers to interfere with our privacy. The debate, which should have been opened in 2020 but was delayed due to the Covid-19 crisis, will unfold in the coming days. The final vote of the Parliament should take place by 31 July 2021.
Those who thought this reform could be a new start for democratic control over intelligence activities are already disappointed. In the minds of the government officials who wrote the bill, overthrowing the current structure of the legal and organisational intelligence framework is out of the question. To them, the proposed legislation is well-balanced with regards to the protection of civil liberties, and the overall framework has already proven its effectiveness in protecting the country against terrorism over the past years. The purpose is therefore to complement the regime with certain intelligence gathering techniques, but also to draw consequences from the judgment of the Court of Justice of the European Union of 6 October 2020 which opposed the massive collection by states of internet and telephone metadata.
“Weak signals”
If the text is voted as it stands, the hitherto experimental use of so-called “algorithms” in domestic intelligence could be perpetuated. Mainly dedicated to scanning communications in bulk to spot “weak signals” on the internet, it would still be restricted to terrorism prevention. The French government justifies the need for this surveillance capability by the fact that the terrorist threat has become domestic and comes from unknown individuals. But to make it operationally more fruitful, the new bill extends the scope of these algorithms beyond “classic” metadata to also cover URL addresses. In order to prevent abuses, there would be two different levels of oversight: As long as collected data remains anonymous and based on “selectors” – words, internet sites, purchases etc. – oversight will be light. If analysts need to go deeper in their research – name, addresses, content of communication etc. –, they will have to follow the current regulation for targeted interception that guarantees stronger safeguards. The Intelligence community says this approach will not give them more data. On the contrary, they claim that it will help them to minimize the number of targets thanks to more detailed information.
Bringing surveillance to the technological frontier
With this reform, the government also aims to provide new capabilities to the services. The bill includes a provision dedicated to the surveillance of a new generation of satellites. Small in size, placed by the thousands in low orbit, these satellites provide high-speed Internet access outside of traditional operators, and escape the “big ears” of intelligence. The government wants to fill this gap, just as it wants to legislate a way to bypass the technical hurdles posed by 5G networks.
Although, on paper, the bill seems to bring only a limited number of changes, the French government is definitely taking intelligence into the age of Artificial Intelligence (AI). It aims to authorise the use of mass collection of private communications data for the research and development of new surveillance tools based on machine learning. To become operational, AI needs to digest vast troves of real personal data. The proposed bill therefore distinguishes a “training phase,” during which overpowered algorithms will grind our data just to train AI models, and an “operational phase,” where personal data will, this time, be subject to the legal framework. To mitigate the risks of abuse, the text subjects this system to the oversight of the National Commission for the Control of Intelligence Techniques (CNCTR), an advisory but independent body, which issues an opinion on all government surveillance.
The black hole of data sharing
Finally, the proposed bill is also meant to put an end to the illegality of certain surveillance practices. Since 2016, a terrorism-related data storage center, nicknamed “the warehouse”, has been operating outside any legal framework. Article L. 863-2 of the Internal Security Code, also adopted in 2016, provides that intelligence agencies can “share all the information useful for the accomplishment of their missions”. As revealed by French newspaper Le Monde in April 2019, the executive decree that was supposed to define “the terms and conditions of these exchanges” has never been adopted, making “the warehouse” unregulated by law. To get it right, the government’s bill defines oversight regimes that vary according to the nature of the data exchanged and the level of authorisation of the recipient agency.
This desire for transparency will go no further. While the CNCTR has been asking over the past two years for a right of scrutiny over data sharing between French and foreign services, the proposed bill simply ignores the request. However, such an oversight mandate exists in countries of comparable intelligence power, such as the United Kingdom. It is the black hole in the legal and democratic control of intelligence in France, because no one knows the proportion of data – often massive – provided by partner services in the overall data used by the French intelligence community.
To justify its position, the French government can argue that even the European Court of Human Rights, in a judgment released on 25 May 2021 – the Big Brother Watch and Others v. the United Kingdom case – said that the British regime for sharing intercepted material from foreign intelligence agencies was legal. Some states regularly share material with their intelligence partners and even, in some instances, grant those intelligence partners direct access to their own systems.
Nevertheless, the Court stressed that the circumstances in which such a transfer may take place must be set out clearly in domestic law, while the transfer of material to foreign intelligence partners should also be subject to independent oversight – which is the case in the UK but not in France. In other words, the French government does not appear to be ready to reform itself on its own. In this history of French intelligence law, only European courts seem to be able to do so.