France under mass-surveillance? The French Constitutional Council and the limits on the Intelligence Service’s powers

The new French law on intelligence was passed on 24 July 2015. Despite an array of human rights based objections, the law has recently withstood the scrutiny of the French Constitutional Council. It deemed the establishment of the Independent Commission and the a posteriori oversight of an administrative judge to be an adequate check for the broad authorization of the executive to conduct mass-surveillance. The Council found that due to these safeguards the law struck a fair balance between the requirements of public safety and fundamental rights guarantees.

Why a law on intelligence?

While the adoption of the Intelligence Law was accelerated by the Charlie Hebdo and  Hyper-Casher supermarket terror attacks, the Government already started work on a draft legislation in the summer of 2014, given that “France was one of the last Western democracies not to have a comprehensive and consistent legal framework to govern the activities of its intelligence services. In July 2014, the President of the Republic and the Government decided to fill this gap with a special Act”. The law goes beyond counter-terrorism and covers intelligence activities broadly. The Act added a provision to the Interior Security Code that defines the goals that intelligence services can legitimately pursue. Prevention of terrorism is just one of the seven legitimate state interests listed, besides national independence, economic, scientific and industry protection, foreign policy or the execution of international engagements. Nevertheless, by the fear they provoked, the January attacks in France have greatly facilitated the adoption of the law. The Government put forward this aspect of the bill, although its scope is broader, to justify its quick adoption.

The law legalizes intelligence techniques that have previously been in use without any legal regulation. It distinguishes counter-terrorism tools from processes that can be used in other fields. For the purposes of counter-terrorism action, intelligence services are now allowed to use black boxes and real-time surveillance. Despite the wide scale objection of various tech companies and an open letter to the French PM, internet providers will be forced to install black boxes on their networks. Black boxes are complex algorithms that produce a bulk analysis of internet metadata to track suspicious behavior, for example, the time and frequency of use of a given site, keywords used and contacts made. Neither the people, nor the content are individually identified. Beyond the general mass surveillance carried out via black boxes, the law also allows for real-time surveillance that concerns specific people. Individuals previously identified as presenting a terrorist threat could be placed under permanent surveillance on the grounds of this provision. Over 3000 people could be implicated by the measure.

The definition of “terrorism” is provided by the criminal code that includes a long list of acts of terrorism, from willful attacks on life and physical integrity to computer offences; provided that those are committed intentionally in order to disrupt public order through intimidation or terror. It is left for the Prime Minister to assess, in the light of this definition, and under the control of the administrative judge, whether an act falls under the scope of terrorism.

In the other fields, the authorities are allowed to use less intrusive devices, like an “ISMI Catcher”, wiretapping, real-time location of people and objects. “ISMI Catchers” are fake relay transmitters, or spy devices, that record all types of telephone, internet or text message conversations in an area. Their use is allowed in exceptional cases and in a subsidiary manner. The authorities can also install recording and filming devices in people's homes or cars. They are allowed to bug their computers, cell phones and other digital devices. Thus, the law gives extensive powers to authorities to monitor people online and offline. However, getting the measure adopted was child’s play for the Government.

Government and civil society responses

Not surprisingly given the post-terrorism context, the parliament has overwhelmingly approved the bill. There was no serious opposition to the draft in the assemblies. While the Intelligence Act made international headlines – as the “Spy Bill” or the “Patriot Act” of France – among ordinary French citizens it has not sparked opposition on a similar scaleneither the civil protests nor local NGO resistance have become a nation-wide phenomenon. It is not easy for people to understand what the law really allows and on what scale it extends, due to technical issues and administrative-legal jargon. Above all, French citizens were satisfied with a reaction that aims to protect their security even if it requires a weakening of their right to privacy.

However, various organizations from rights groups, to lawyers, to tech companies have expressed their concerns. Two main criticisms were formulated. The first one scrutinized the broadness and vagueness of the seven listed state objectives that under the new law can justify surveillance. For example, Amnesty International pointed out how the law “allows the Prime Minister to authorize intrusive surveillance measures as a means to achieving broad and undefined goals such as “major foreign policy interests”, protecting France’s “economic, industrial and scientific interests” or preventing “collective violence” and “organized delinquency”. Human Rights Watch underlined that “[u]nlike the protection of national security and public safety, these interests are not recognized in international human rights law as grounds for interference with basic rights (…)”. Beyond the substantive concerns, the second criticism pertains to the procedure itself, more precisely the absence of a priori judicial approval. The Prime Minister can under the new law order surveillance after simply seeking advice from a newly created Commission specifically dedicated to such approvals.

To challenge the constitutionality of the bill, several organizations submitted amicus curiae briefs to the Constitutional Council. Lawsuits were filed before the constitutional judge by the parliamentary opposition and even some MPs of the majority, and on a rare instance, the President of the Senate and the President of the Republic himself. This is the first time in the history of the 5^th  Republic that the Head of State refers a law to the Constitutional Council. A move that might seem surprising, since the law was proposed by President Hollande’s party, he made clear that the referral aims to silence criticism over the (un)constitutionality of the Act.

Constitutional Council: limits that must not be crossed

The Council validated the new Intelligence Law, finding that the Act strikes a balance between the guarantees of constitutional rights, especially the right to privacy and the legitimate state objectives of the Act, in particular the defense of public safety. However, the judge of the Constitutional Council struck down two provisions. The first provision would have allowed intelligence services to use their monitoring tools in (undefined) “emergency situations” without referring to the Commission or seeking authorization from the Prime Minister. For the Council, this provision was a “clearly disproportionate breach of the right to respect for privacy and for the secrecy of correspondence”. It indicates that intelligence agencies are not constitutionally allowed to carry out surveillance without any authorization. The constitutional judge also struck down a provision that allowed intelligence services to spy on communications sent to or received from abroad, on the ground that lawmakers had not sufficiently defined the conditions for its use. Finally, to validate the law, the Council has insisted on the importance of the role of the oversight bodies, the Commission and the administrative judge, in ensuring that the implementation of the law respects the requirement of necessity and proportionality. Now that the Act was passed, two main implementation questions remain open: the issue of black-boxes and the efficacy of the safeguards.

Black boxes: an extensive surveillance for a controversial efficiency

The Act authorizes the automatic analysis of connection data with the sole aim of detecting online patterns of behavior typically displayed by terrorists. The law provides several guarantees: user anonymity is preserved, the content of messages are not monitored and it can be used only to pursue a counter-terrorism objective. Opinions over the efficacy of black boxes remain divided and more clarity can only be expected from the first annual report of the Commission.

Sufficient safeguards?

Undoubtedly, the new act constitutes a progress compared to the previous law. Previously, intelligence services used most of their monitoring devices outside of any rules and without any real control. Technically, the law provides a three-step procedure for any surveillance operation:

- first, a reasoned written request from a minister;

- secondly, a reasoned advice from the new National Commission for the Control of Intelligence Techniques (CNCTR), an independent administrative authority composed of judges, MPs and an engineer specializing in IT and digital technology;

- thirdly, the authorization of the Prime Minister, who is not bound to follow the Commission’s advice (and consequently can override a negative opinion of this Commission).

Is this control inferior to a prior judicial control? There is no doubt about it. Was a prior judicial control legally required? No. Indeed, the scheme adopted is not contrary to the French legal tradition. A prior authorization of a judge is required only in a criminal proceeding, not in a preventive administrative procedure. As the intelligence services operate only in a preventative way, the Constitutional Council reiterated that under French law their actions do not need to be previously authorized by a judge.

Are the safeguards sufficient? Firstly, the CNCTR is independent from the Prime Minister. Its members themselves are independent from the executive, and come from the legislative and judicial branches but the Commission also includes an IT expert. Secondly, the CNCTR will give reasoned advice, so that the Prime Minister knows why the Commission approves, or expresses its reservations to surveillance. It also benefits from permanent access to data on the surveillance operation, including the start date, agents involved, statements, registers, records, information collected, transcripts etc. And the Commission has the right to formulate recommendations.

Furthermore, in its public annual report, it will be able to make public its disagreement with the Prime Minister, by disclosing, for example, that its advice was not followed. Furthermore, the Commission has money, agents and offices. It also benefits from permanent access to all the data   and offices of the intelligence agencies. Thirdly, a judicial oversight is provided since the Commission, as well as private persons are allowed to lodge a complaint with the administrative judge. An authorization will be annulled if it does not meet the conditions provided by the law, for example, use of black boxes for other means than counter-terrorism, monitoring of political parties, trade unions or peaceful protest movements.

As of now, this procedure stands without precedence, yet it represents an important guarantee along with the Council power to immediately suspend an operation. The one-month deadline for the Council to rule on the surveillance provides a speedy guarantee. The annual report and the right to refer to the administrative judge will be powerful means of pressure on the Prime Minister. These tools, in the hands of the CNCTR, represent a strong incitement for the Executive to follow the advice of the Commission.

Conclusion

While the future use (or abuse) of France’s new Intelligence Act is yet to be seen, its legal framework appears to strike a fair balance between public safety and the guarantee of constitutional rights - and cannot reasonably be equated with the Patriot Act of the U.S. Among the various safeguards the Act introduces, the role of the CNCTR is paramount. This Commission is destined to play a decisive role not only in the implementation of the Intelligence Act but also in the future of guaranteeing the right to privacy in France.

Olivier Le Bot is Professor of public law at Aix-Marseille University (Study and Research Group on Constitutional Justice - GERJC)