Legal Action against the French Surveillance Law

Paris, 11 May 2016 — The Exégètes amateurs, the legal team of La Quadrature du Net, FDN and FFDN, has submitted new legal briefs in its legal challenge before the French Council of State against the 2015 Intelligence Act and its implementation decrees. The briefs detail all the arguments developed against this dangerous law. For the most part, the strategy consists in mobilizing the case law of the European Court of Justice’s (ECJ). A very worrying provision completely overlooked during the parliamentary debate last year is also targeted with a constitutional challenge (called QPC procedure)¹The QPC is a French Constitutional Law procedure allowing persons involved in a pending case to ask the Constitutional Council to assess the constitutionality of the laws relating to the case at hand.

The analysis below is published on the Exegetes‘ website.

In June 2015, French newspaper Le Figaro titled: “Opponents to the Surveillance Law make their last-ditch effort”²Source: Le Figaro, 23 June 2015 [FR]. Not so! Since the partial validation of the Surveillance Bill by the French Constitutional Council last summer, we have been working to lodge a complaint with the French Council of State.

This Friday, we filed several new documents with the help of the Spinosi-Sureau law firm. These documents detail all of our arguments against French surveillance. Three years after the start of the Snowden revelations, while the Rule of Law buckles a little more each month under the battering of the Police State, we are now turning to judges to enforce our fundamental rights.

What is the scope of these actions?

On 30 November 2015, the Federation of non-profit Internet service providers (FDN Federation), La Quadrature du Net and the French Data Network³The first French non-profit Internet access provider. (FDN), intiatied proceedings against the first three decrees implementing the Surveillance Law.

Later on, following the publication of two additional decrees, two new challenges were introduced (one of which was filed by Igwan, a non-profit Internet access provider in the Antilles, member of the FDN Federation).

The goal of these actions is to demonstrate that those five decrees are contrary to our fundamental rights. To do so, we directly question the validity of the law they are meant to implement. This enables us to question the entire Surveillance Law.

Within which context do these actions take place?

This strategy is a direct extension of the one initiated after the adoption of the law in June 2015. At that time, we sent to the Constitutional Council an amicus curiae including numerous constitutional arguments against the law. The current action before the Council of State carries on this work, now with arguments based on the Charter of Fundamental Rights of the EU and the European Convention on Human Rights.

In parallel with our efforts, many complaints have been lodged before the European Court of Human Rights (ECHR) by organisations of journalists and lawyers. We strongly welcome these legal actions perfectly complementary to ours – our goal being primarily to obtain the enforcement of European law.

Where are we in the proceedings?

The first applications initiating the proceedings date back five months. They were only intended to meet the time limits for referring cases and therefore included a small portion of the arguments to raise.

We have developed these arguments over these last five months and submit them today to the French Council of State as supplementary statements. For their part, the French Prime Minister and the Defence Minister have already begun to respond. Hence, the exchange of arguments will continue.

What are our arguments?

Put it simply: our strategy is to mobilise the European Court of Justice’s (ECJ) case law, which has made landmark rulings concerning privacy protection these last months (see in particular the Digital Rights case and the Schrems case). With this in mind, if the French Council of State were to refuse to directly apply this case law, we would suggest it several preliminary rulings that it would then have to be referred to the ECJ.

All our arguments can be found in our writings, but these documents are voluminous (for example the main document is around 90 pages). Our goal here is to give a synthetic overview.

Purposes

It was already one of the arguments raised in the amicus brief that we filed before the French Constitutional Council last summer: the Surveillance Law allows the services to spy on the population for various reasons which are neither sufficiently restricted nor precise enough (the main interests of France’s foreign policy; the accomplishment of its European and international commitments; its main economical, industrial and scientific interests; preventing the organisation of illegal or incompletely declared demonstration; or preventing access or use of narcotics for personal consumption).

Being secret surveillance measures, this inaccuracy is extremely worrying and is, in our opinion, directly in violation with the Schrems ruling, which requires in particular “purposes which are specific, strictly restricted and capable of justifying the interference”.

Access to collected information

The law merely regulates the conditions of data collection (collection authorised not only for intelligence services but also for dozens of other administrative authorities, whose actual aggregate exceeds 45 000 persons).

However, it says nothing about how access to information gathered is organised internally, paving the way for arbitrary uses. This lack of legal framework is clearly contrary to the ECJ’s Schrems case.

So-called “international” surveillance

The provisions on international surveillance legalise the vast Internet traffic collection system implemented by the DGSE (French foreign intelligence services) since 2008 to catch up with the NSA and the GCHQ in this area. It is very large-scale surveillance: the Prime Minister is to designate the submarine cables and other networks on which the DGSE can connect and authorises it to set up mass interceptions of the traffic.

This indiscriminate surveillance of communications constitutes a frontal attack on the Rule of Law that is contrary to the case law of the ECJ and the ECHR, which require to specify the existence of a reasonable suspicion against the persons whose communications are intercepted. On this matter, the Dutch MEP Sophie in’t Veld just challenged those provisions before the CNCTR⁴National Oversight Commission for Intelligence-Gathering Techniques..

Finally, as the French Constitutional Council has validated, citizens under surveillance have no legal remedy to challenge the so-called international surveillance measures, which is blatantly violating European conventions.

Exchanges of data with foreign intelligence services

The Snowden documents have shown the growing importance of the cooperation agreements between Western intelligence agencies, which provide massive exchanges of data between services. But the Surveillance Law prohibits the oversight Commission, the CNCTR, access to data held by the French services that has been transmitted by their foreign counterparts. This way, it also prevents any oversight by the Council of State.

As we have put in our writings, “the British GCHQ and the German BND can collect the communications of French residents in application of provisions which, in their national law, fall under the surveillance of international communications, and can transfer them to their French counterparts of the DGSE, who therefore escape any supervision and control over the use of such personal data.” By disarming the CNCTR’s oversight, the Surveillance Law allows services to bypass the meagre safeguards applicable for national surveillance and deprive citizens of the right to an effective remedy against the collection and use of this data.

Black boxes

Last year, during the parliamentary debate of the Surveillance Law, the “black boxes” sparked heated debates. They did so for a good reason: the intelligence services can now force Telecoms operators and hosting providers to install tracking devices on their infrastructure for real-time scanning of all traffic, hoping to identify “weak signals” of terrorist activities . These “black boxes” would thus imply to scrutinise the communications of nearly the entirety of the population.

Again, this indiscriminate surveillance is contrary to EU law. But this provision also violates the spirit and letter of the 2000 European directive on the information society services (eCommerce Directive), which prohibits national authorities from imposing on Telecom operators and hosting providers “a general obligation […] to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity”.

Oversight by the CNCTR

This has been said time and again: the CNCTR only issues non-binding opinions on the permissions that the French Prime Minister delivers to the intelligence services to recourse to surveillance measures. Because this is optional, it carries tangible risks of abuse. By the same token, last year, the president of the former Commission highlighted that almost one quarter of negative opinions issued during the first term of 2015 had not been followed. However, European case law is clear: it requires collection and secret use of personal data to be subject to prior authorisation by an independent entity. Such is not the case in France.

Judicial remedy

The right to a judicial remedy before a special chamber of the Council of State was presented as a major advance provided by the Surveillance Law. This is actually a fool’s game, which brings reason of State and its secrecy in French law without providing the minimum guarantees necessary for a fair trial.

Indeed, all the documents submitted by the administration during the proceedings remain secret; the plaintiff and his/her lawyer will not have access to them. The jurisprudence of the Council of State itself will remain secret, and it will be impossible for an individual to know whether he/she was under surveillance. Again, these special rules are contrary to European case law concerning the right to a fair trial.

But there is more!

Back to the Constitutional Council? (surprise!)

We just asked for a priority preliminary ruling on the issue of constitutionality (QPC) that will have to pass the French Council of State’s scrutiny and will, hopefully, be referred to the Constitutional Council.

But why going back before the constitutional judges, when they have already largely deliberated on the Surveillance Law, rejecting most criticisms that we, as many others, submitted?

One key provision had, seemingly, been overlooked.

As for so many other discoveries, it was chance that brought our attention to it: on 12 April, like many people, we learnt from the French newspaper Le Monde how the DGSE had put politician Thierry Solère under surveillance in 2012, probably by using article 20 of the 1991 law. We did remember this article 20, which had been denounced as soon as in 2001 as being a potential basis for a vast surveillance system. Nevertheless, maybe unconsciously, we had assumed that its existence would end with the new Surveillance Law, whose objective, according to the Government, was precisely to put an end to unclear “a-legal” regimes, which this kind of provision had let flourish.

Hunting for this article 20, we found it as such, unchanged for the last 25 years, with merely a new numbering in the Surveillance Law as article L. 811-5 of the Internal Security Code.

This article specifies that “measures taken by public authorities to monitor and control wireless communications for the specific defense of national interests are not subject to the provisions of this book”.

For a start, the notion of “wireless communications” ⁵« transmissions empruntant la voie hertzienne » in French. might not be clear for everybody, and it is useful to provide a few examples. It might concern, for instance, all information sent:

• between a mobile phone and its relay antenna (GSM/3G/4G);
• between a WiFi hotspot and a computer, smartphone or tablet;
• by a laptop using a 3G or 4G dongle;
• between two Bluetooth devices (wireless microphones, etc);
• between a cordless phone and its station;
• between two ham radio practitioners or two walkie-talkies, etc.;
• by users of Satellite, WiMax, WiFi etc.;
• between an instant pay card and its station;
• by a GPS beacon;
• between an NFC chip (which you find in credit cards, or various other cards) and the reader.

Therefore, all “public authorities” – all state services (ministers, prefects, DGSE, DGSI, independent authorities, etc.) – may have recourse to any technique allowing “monitor and control” of these wireless transmissions, in the name of “the defence of national interests”.

Finally, and most importantly, these techniques are “not subject to the provisions” of the book VIII of the Internal Security Code which, being derived from the Surveillance Law, supervises all surveillance activities in France. That is to say, this wireless transmissions monitoring is a loophole, not covered by any binding legal framework.

Thus, the lawmaker leaves the door open for all sorts of surveillance measure by state services.

Should a person’s phone calls be destroyed after a set time once intercepted? Does an independent authority verify that the emails sent from a smartphone have been intercepted for a legitimate reason? What legal remedies are offered to citizens under surveillance? Nothing is specified on these matters.

Thus, all wireless communications are de facto excluded from the scope of the – still insufficient – control procedures established by intelligence techniques. In other words, while the Government claimed to supervise intelligence techniques, it merely did so for a few wired communication techniques. What is even more shocking is that during the legislative debates on the Surveillance Law, our attention was particularly drawn to the IMSI catchers. But these intelligence techniques are essentially not covered by the Surveillance Law, since they apply exclusively to wireless communication.

In the face of such a lack of safeguards, we can only expect the French Constitutional Council to follow its own case law and to censure this provision for “negative incompetence”⁶The notion of “negative competence” is a French Constitutional Law one, referring to cases where the legislator has overlooked his competence derived from the principle of legality (art. 34 of the French Constitution). The omission of this principle leaves the regulatory power with the task of regulating cases which should have been regulated in the law., as it had done so with the Surveillance Law by censoring the provisions pretending to regulate international surveillance.

Apart from this legal action, whose delays are strictly limited, we will certainly have to be patient since the Government will most likely run out the clock and try to avoid that any case be brought before a European jurisdiction. Three years after the beginning of the Snowden revelations, and facing the inertia of the European Parliament, it is now the judges’ turn to have the final say. Let us hope they will overcome the temptation of following the reason of State.