In 2021, the French government passed a major reform of the legislative framework for intelligence surveillance. But on several key issues, such as international data sharing, open source surveillance or the right to information, French law still lags behind international standards in intelligence oversight. This is all the more worrying given that the staff and resources of major French agencies have vastly expanded over the past few years.
Last summer, eight years after the revelations of whistleblower Edward Snowden, the French Parliament passed the first major revision of the Intelligence Act. Initially adopted right after the Paris attacks of January 2015, this piece of legislation was at the time presented by the rapporteur of the bill at the National Assembly, Jean-Jacques Urvoas, as a “progress in the rule of law.” But such framing obscured an important fact: the reform legalised surveillance measures that had been used for years in complete illegality, which should have led to criminal prosecutions against the political and administrative leaders who had authorised these programs.
The reform passed last year is certainly much less ambitious than its 2015 predecessor. However, it follows the same logic, well analysed by sociologists Laurent Bonelli, Hervé Rayner and Bernard Voutat, which consists in using the law to legitimise the action of the services and preserve their room for manoeuvre. Accordingly, the law provided legal backing for increasingly extensive surveillance capabilities – such as “black boxes” that scan Internet traffic to detect “suspicious” URLs (Article 13), data sharing between French agencies (Article 7), or the obligation for private tech companies to collaborate with the authorities to hack encrypted messaging (Article 10), while at the same time sheltering the services from strong oversight.
Yet, strengthening oversight should be a priority, given the role of intelligence in government. Since 2015, French intelligence agencies have seen their workforce increase by 30 percent, in particular to develop their technological capabilities. In this context, the use of various surveillance techniques have risen significantly, in particular in areas that are especially sensitive for civil rights. For example, the activity devoted to the surveillance of social movements – enshrined as an intelligence priority in 2019 following the yellow vests movement – has more than doubled in just three years, rising from 6% of total surveillance measures in 2017 to more than 14% in 2020.
Alas, during the latest reform, almost all proposals to strengthen oversight measures have gone unheeded, whether they came from the Parliamentary Delegation on Intelligence (the DPR, composed of members of the National Assembly and senators), the data protection authority (CNIL, which is supposed to control intelligence databases), or the National Commission for the Control of Intelligence Techniques (the CNCTR, which issues opinions on surveillance measures requested by the services).
International data-sharing out of control
For instance, following criticisms by civil society organisations during the parliamentary debate in 2015, the CNCTR has warned in several annual reports about an important oversight gap regarding the sharing of data between French intelligence services and foreign agencies. In France, the issue is all the more pressing considering that the data flows exchanged between the Direction Générale de la Sécurité Extérieure (DGSE) and the National Security Agency (NSA) have increased rapidly following the SPINS agreements, signed at the end of 2015 between France and the United States. Yet, the 2015 law explicitly forbid any oversight by the CNCTR over these international collaborations nurtured by networks of intelligence professionals enjoying a strong autonomy.
In its annual report published in 2019, the CNCTR cautioned that this “black hole” in intelligence oversight presented a major risk, since it could be used by French services to receive data from their counterparts that they would not have been able to obtain legally through the procedures provided by French law. The CNCTR advised that “a reflection [should] be carried out on the legal framework for data exchanges between French intelligence services and their foreign partners.”
In support of this request, the CNCTR referred to the case law of the European Court of Human Rights (ECHR), which again recalled in its Big Brother Watch v. United Kingdom judgment of May 25, 2021 that international data sharing should be governed by national law and subject to the oversight of an independent authority. According to a report by the Fundamental Rights Agency of the EU, France is currently the last European Union member state with no legal framework for these international data transfers.
Right to information of persons under surveillance
Another essential principle identified by European case law is the right to information of persons who have been subject to a surveillance measure, once such notice is no longer likely to hinder the investigation conducted against them by intelligence agencies. In a report published in January 2018, the CNCTR reviewed the relevant case law and mentioned several examples of foreign legislation – German law in particular – guaranteeing a procedure for notifying persons under surveillance and providing for a number of narrowly limited exceptions. The CNCTR conceded that, as French law stands, “persons under surveillance cannot be informed of the intelligence techniques implemented against them.” The 2021 reform bill completely overlooked this important issue, which is one key building block for ensuring the right to effective remedy.
The government has also set aside another requirement, again stressed by the French Council of State (supreme administrative court) in its ruling of April 21, 2021. In this decision, which otherwise largely sided with the government, the Conseil d’État echoed the CJEU’s La Quadrature du Net’s ruling by indicating that the opinions issued by the CNCTR on surveillance measures should be binding rather than merely consultative. In spite of the CNIL’s insistence that the 2021 reform bill should address this concern, both the government and the parliament refused to do so.
Lack of oversight on intelligence database
As for the joint desire of the DPR and the CNCTR to guarantee the latter a right of access to and a right of review over intelligence databases, it is facing fierce opposition from the services. As parliamentarians from the DPR have emphasised, this is a crucial stage in the oversight process, as it is the only way for the CNCTR to “ensure that no data has been collected, transcribed or extracted in disregard of the legal framework, or even in the absence of an authorisation granted by the Prime Minister.” And yet, some intelligence officials would like more leeway. A person from the Ministry of the Interior has complained about the regulatory burdens: according to them, “the police are required to do crazy things” and “even the smallest pizza vendor can cross-reference more computer data than our intelligence agencies.”
No legal framework for OSINT, infiltration and postal surveillance
The French legal framework around intelligence is also completely silent regarding other typical surveillance measures that are extremely sensitive from the point of view of civil rights. This is the case of the surveillance of letters and postal packages, or the infiltration of activist groups by intelligence agents. In the United Kingdom, in contrast, the Investigatory Powers Act of 2016 covers these two areas.
French law also makes no mention of so-called open source surveillance, especially on social networks such as Facebook or Twitter – an activity about which little has been leaked to the press but known to have grown in importance over the last ten years. The DPR recently confirmed it was the case: “[French] intelligence agencies collect and exploit intelligence of cyber origin from the innumerable sources freely available on the Internet (…).”
Still, despite such blatant oversight gaps, a high-ranking intelligence official found it justified to bemoan the bureaucratic burdens entailed by French law, claiming that “we have the most restrictive regulations in Europe: we have to constantly ask for authorisations from the CNCTR.”
Right to information and whistleblowing
Apart from the few bits of information that have emerged thanks to the small circle of specialised journalists with access to sources within the services, and apart from the scarce allusions offered by the CNCTR or by intelligence officials during parliamentary hearings, no information is provided on the nature of the technologies used by the services and their imbrication in the process of intelligence production, on the public contracts and the identity of the private subcontractors, nor even on the legal interpretations that are used within the services.
Here again, the comparison with other European intelligence powers reveals the French democratic deficit. To be convinced of this, one simply has to consult the report published in August 2016 by David Anderson during the parliamentary debate on the Investigatory Powers Act. This barrister in charge of the independent monitoring of anti-terrorism legislation reported on the technological capacities for bulk powers data collection and exploitation. He also gave several examples of use cases in which these technologies were employed and evaluated their operational relevance based on internal documents and interviews with senior intelligence officials.
In France, such a degree of transparency seems unimaginable for the moment. Even if the CNCTR has made some progress in the accuracy of the information it provides in its reports, it often sticks to mere descriptions of the state of the law and its evolution, or issues general statistics on the types of measures authorised and their purposes. This is still a far cry from the level of detail feeding the public debate and the work of parliamentarians, journalists or NGOs in countries such as the United Kingdom or Germany.
Also, following a recommendation of the Council of State in its 2014 report, Urvoas, the 2015 Intelligence Bill rapporteur at the National Assembly, had passed an amendment turning the CNCTR into an internal whistle-blowing channel for intelligence officers. But the provision remains very limited in scope (the government having successfully amended the proposal so as to create a lot of legal uncertainty for potential whistleblowers – in fact, to our knowledge, since it was first adopted, the provision has never been used). Lastly, by law, the court rulings of the Council of State’s special section and its general case-law remain secret (article L. 773-7 of the Code of Administrative Justice). All of these provisions affecting the right to information obviously fail to comply with international best-practices, such as those laid down in the Tshwane principles on national security and the right to information.
So despite the surprisingly optimistic findings of the UN Rapporteur for Privacy Joe Cannataci – who based on a country visit in 2017 wrote that “France sets a good example internationally” with the Intelligence Act –, the hard truth is that on many key issues, the French intelligence framework actually fails to comply with international standards.