Following the global security law and the separatism law, the government continues its generalized offensive aiming at silencing all political opposition. Last Wednesday, the three “public security” files (PASP, GIPASP and EASP) were largely extended by three decrees (here, here, and there). They will allow the massive registration of political activists, their entourage (including their underage children), their health or their activities on social networks. Despite its limited resources, La Quadrature du Net does not intend to be overtaken by this widespread offensive. They will contest these decrees not only in the street, every Saturday within the coordination against the general security law, but also in court, before the Conseil D’État (French highest administrative autority).

History

In 2008, the DST (French Directorate of Territorial Surveillance) and the RG (Intelligence Service of the French police) were abolished and their missions were split between the DCRI (now DGSI, the general direction of internal security) and the DGPN (general direction of the national police). The files of former services were shared between the DCRI (which recovered in the CRISTINA file) and the DGPN (in a file then named EDVIGE). A historic mobilization against the excessive extent of information contained in EDVIGE had forced the government to withdraw the decree which authorized it.

In 2009, the government came back with two separate files which attempted to correct the worst criticisms made against EDVIGE (such as the tracking and listing of “political opinions”, health data or children). The two files are the administrative investigations file (EASP) and the public security violations prevention file (PASP), both managed by the police. In 2011, the GIPASP, the equivalent of the PASP for the gendarmerie, was created.

A 2018 report provides a good grasp of how these intelligence files work: in 2017, the PASP contained 43,446 notes on individuals, divided into half a dozen themes that could be summarized as follows:

illegal demonstrations;

violence and degradation linked to ideological protest;

violence and vandalism during sporting events;

violence linked to underground economies;

speech advocating hatred, assaults, stigmatization towards certain communities;

radicalization, virulent proselytism, inclinations to go abroad to a combat zone;

sectarian pressure;

These notes could contain particularly detailed informations: profession, physical addresses, email, photographs, public activities, behaviour, travel, …

Generalised registration of demonstrators

Until now, the intelligence files of the police (PASP) and the gendarmerie (GIPASP) have only concerned private individuals who were considered as dangerous by the authorities. Important novelty: since last week, these files may also apply to legal entities or “groups“. We can imagine it will concern associations, Facebook groups, squats, autonomous zones (ZAD in French), or even demonstrations.

If a record-file is opened for a protest, both PASP and GIPASP also enables to list the people who “maintain or have maintained direct and non-accidental relations” with this “group”. So far, the PASP and GIPASP files could only list the entourage of “dangerous persons” succinctly in the main record-file of the dangerous person. From now on, if the police consider it necessary, every member of the entourage may have a record-file almost as complete as the dangerous person’s record-file (online activities, places visited, lifestyle, photographs, etc.).

These two developments seem to formalize a (previously illegal) practice that was beginning to appear in the 2018 report: “some notes are limited to reporting collective facts, in particular for group phenomena or demonstrations, with a tendency to include in the process all persons who have been screened or arrested when there is no mention in the note of any personal fact that is alleged against them”. Thereby, all participants (“having maintained a direct and not accidental relationship”) to a demonstration (“grouping” considered dangerous) could be assigned a particularly detailed record based on information obtained by the police in the field (video captured by drones and mobile camera, for example) or on social media.

Automated registration

The three decrees greatly increase the variety and extent of information that may be recorded. This includes “lifestyle” and “online activities”. In its preliminary notice, the CNIL points out that “it applies to all social networks”, “data may be collected on active pages or accounts”, and “will focus on comments posted on social media and photos or illustrations posted online.” A form of surveillance that has become commonplace due to the absence of a legal framework, and all the more dangerous since it can easily be automated.
Concerned, the CNIL called for “explicitly excluding the possibility of automated data collection”. The government has refused to add such a reservation, obviously wishing to afford such techniques, which it already allowed itself to use in other matters (see our article on tax supervision)

Political opinions and health data

Individual notes may now contain information relating to “political opinions, philosophical or religious beliefs or trade union membership” where previously only information relating to “political, philosophical, religious or trade union activities” could be recorded.
With regard to persons considered as dangerous, the file will now be able to collect health data supposed to “reveal a particular dangerousness”: “addictions”, “psychological or psychiatric disorders”, “self-aggressive behaviour”. The CNIL emphasises that this information will not be “provided by a health professional [but] by relatives, family or the person concerned himself”. It is difficult to understand why the police would need such a variety of such sensitive data, other than to put pressure on and abuse the weakness of certain people.

Record-keeping of victims and children

Another overflow: the “PASP” and “GIPASP” can now contain detailed sheets on the “victims” of persons considered dangerous (without this notion of “victim” referring to a penal notion, being freely interpreted by the agents).
Even more serious: whereas, since their inception, the “PASP” and “GIPASP” prohibited the registration of children under 13 years of age, the new decrees now seem to indicate that only minors considered to be dangerous will benefit from this age protection. Thus, in theory, there is no longer anything to prevent the police from opening a file for a 5-year-old or 10-year-old child who is in the entourage of a person considered dangerous or because he or she was at a demonstration that radical.

File Overlap

The aforementioned 2018 report explains that “access to the PASP application is via the CHEOPS secure portal, which provides access, under the same configuration, to various national police applications [and which] has an original functionality that is currently being enriched by additional developments. This involves managing relevant links between individuals in the file, which results in the graphical creation of sociograms (leader of a group, members of the group, antagonists, etc.)”.

This constitution of social graphs directly echoes the entourage of “groupings” described above. But this comment also refers to another reality, described by the CNIL in its prior opinion: many categories of information included in the three files “will be manually fed by other processing” – agents will feed the PASP, GIPASP and EASP files by manually searching for information in other files. To facilitate their work, the new decrees provide that individual notes will mention whether the person concerned is also registered in one of the other 5 major police files (TAJ, N-SIS II, wanted persons file, FSPRT, files on stolen or reported objects and vehicles).

Facial recognition

Another novelty that considerably facilitates the cross-checking of files is that the decrees provide that the PASP, GIPASP and EASP participate not only in public security, but now also in “State security”, which is defined as covering the “fundamental interests of the Nation”. This is a very broad notion, which the 2015 Intelligence Act defined as covering things as varied as “France’s major economic and industrial interests”, compliance with France’s international commitments and the fight against undeclared demonstrations and gatherings. One of the interests of this legal concept is to give access to the photographs contained in the TES file, which is intended to centralise the photographs of all passport and identity card holders. Once obtained, the photographs can be added to the PASP or GIPASP and, why not, also to the TAJ, where they can be analysed by facial recognition (a device that we have already challenged in court).

Moreover, last week’s decrees took care to remove the mention which, since their origin, specified that both PASP and GIPASP “do not include a facial recognition device”. Reading the CNIL’s opinion, it is clear that the initial project simply planned to add a new facial recognition device to the PASP and GIPASP, in order to automatically identify the records corresponding to a person’s photograph: “the query by photograph must constitute a new possibility of querying the processing (like the name) […] for the purpose of determining whether the person whose photograph is submitted is already included in the processing”. This new system no longer appears in the decrees issued, as the government may have preferred to create bridges between the various existing devices rather than to deploy a complex new infrastructure. Or perhaps it simply preferred to postpone the legalization of this controversial feature.

Conclusion

While the law on global security might authorise techniques for capturing mass information (drones and pedestrian cameras), these three new decrees concern the way in which this information can be used and stored, for 10 years. Although, under the Global Security Act, all demonstrators may be filmed during a demonstration and, via the TAJ file, a large proportion of them may be identified by facial recognition, PASP and GIPASP have already prepared a complete file for them where all the information concerning them may be centralized, without this surveillance being authorized or even monitored by a judge.

The whole system, which is as complex as it is authoritarian, pursues the objective described in the recent White Paper on Internal Security: to bring police surveillance into a new technological era before the 2024 Olympics. We are preparing our appeal to challenge the validity of these decrees before the Council of State and will be out on the streets on Saturday 12 December, as we do every Saturday from now on, to fight against the widespread registration and surveillance of demonstrators.