French senate formally votes intelligence bill

The French senate formally voted the intelligence bill (known in France as "Loi Renseignement") today, about a month after it had been adopted by Parliament. The new law incorporates numerous worrying provisions that could be described as intrusive and detrimental to the right to privacy. It has since its inception provoked considerable uproar amongst the supporters of fundamental freedoms. Many voices around the world rose to express concern about its provisions. Amnesty International considered that the bill “would give the French authorities extremely broad surveillance powers running against fundamental principles of proportionality and legality 1”, while Mozilla publicly regretted that the French government “was rushing this proposal through Parliament, with little to no consultation of key stakeholders2”.

The intelligence bill was among other things criticised for being a rushed and circumstantial response to the January 2015 Paris terror attacks; it is more likely, however, that the project has been in the works for about one to two years, and that the current context simply acted as a catalyst. In a post-Snowden era, such a move from France could sound surprising and out-of-place, to say the least. As a counterpoint, the U.S. senate passed the Freedom Act on 2 June 2015, thereby establishing a symbolic limitation of the NSA surveillance.

“Black boxes”

One of the most discussed provisions of the new law is certainly related to the creation of “black boxes”. Even if it is possible to highlight similarities with the American collection procedure that has been abolished by the Freedom Act, the French “black boxes” actually consist of a substantially different modus operandi. As they currently stand, they refer to actual devices that are directly interfaced with the infrastructure of internet service providers (ISPs). They are set up so as to enable the analysis of metadata in real time. Algorithms will be used to detect and report suspicious behaviours and profiles to the authorities. The whole process does not require the approval of a judge. As of today, the only limitation was introduced by the French government itself – an attempt to appease the most vigorous critics. Through an amendment adopted by the Senate, the metadata collected via the use of “black boxes” will have to be processed within sixty days and will have to be destroyed at the end of this period, except in cases “of serious evidence confirming the existence of a terrorist threat 3”.

Even with such limitations, the very existence of such “black boxes” is not without raising several questions about the legality of these actions, both in terms of privacy and proportionality. The French government ensures that collecting metadata is more respectful of fundamental rights and privacy than collecting the data itself; however, the flaws in this reasoning have been demonstrated on numerous occasions. As Matt Blaze explained in the context of the NSA phone metadata collection, “metadata is our context. And that can reveal far more about us (…) than the words we speak. Context yields insights into who we are and the implicit, hidden relationships between us 4”.

A technically inadequate apparatus

Beyond criticism related to fundamental freedoms, the technical operation mode of “black boxes” has also been questioned in depth. In an internal note dated 30 April 2015, the French Institute for Research in Computer Science and Automation (INRIA) has argued that “black boxes” could not ensure proper anonymisation and would potentially produce many false positive results 5. Besides the inherent limitations of the whole apparatus, the efficiency of the system itself is rather questionable, as experts from the INRIA explained that using a virtual private network (VPN) would easily allow internet users to circumvent metadata collection.

Ultimately, there is more to the new law than “black boxes”. The fact that the French National Commission on Informatics and Liberty (CNIL, for its acronym in French) is excluded from the entire collection process - or other provisions, such as the use of IMSI catchers (IMSI refers to International Mobile Subscriber Identity), are equally worrying.

The new surveillance apparatus raises issues that go well beyond political affinities and stirs, at best, bewilderment in and outside of France. A last hope could come from the Constitutional Council 6, as some members of the Parliament and senators expressed their will to file a referral 7. Should they fail to collect the 60 signatures required to do so, the French President himself announced back in April 2015 he intended to refer to the Council 8.