Privacy advocates have criticised French plans to expand digital surveillance as badly thought out and rushed.
A bill (“Projet de Loi Relatif au Renseignement”) – which was drawn up before the Charlie Hebdo and Hyper Casher supermarket attacks – is due to go before the National Assembly next week under an accelerated legislative procedure that dispenses with the need for a second reading.
However, international non-governmental organization Human Rights Watch (HRW) argues that the measures are packed full of problematic clauses.
Most notably, there is a lack of meaningful judicial oversight; requirements for private service providers to monitor and analyze user data (and report suspicious patterns); prolonged retention periods for some captured data; and little public transparency.
The charity lambastes the bill as a French version of the much criticised US Patriot Act.
“Though the goal of the bill is to place France’s surveillance practices under the rule of law, it in fact uses law to clothe a naked expansion of surveillance powers,” said Dinah PoKempner, HRW general counsel.
“France can do much better than this, especially if it wants to distance itself from the over-reaching and secretive mass surveillance practices of the US and the UK that have attracted so many legal challenges," she added.
The bill recognises the general right to privacy before setting out seven "public interests" that might justify surveillance, including the nation’s "economic and scientific priorities", "foreign policy", and "the execution of international engagements" 1.
International human rights law recognises the protection of national security and public safety as justifying surveillance. HRW warns the French laws extend well beyond that, and go towards laying the foundations of a surveillance state.
HRW singles out a measure calling for service providers to install secret, unspecified, state-provided means of tracking web traffic to terrorist websites.
The provision, which was recommended for deletion by the Digital Commission but retained by the National Assembly’s Law Commission, effectively turns ISPs staffers into surrogate national security analysts.
Service providers would be legally required to keep their actions (on behalf of the government) confidential, further eroding transparency.
"The most repressive governments might thank France for setting a legal precedent of forcing major net companies to monitor not just signs of 'terrorism' but signs of incipient dissent, or even just independent thought," PoKempner warned.
The bill contains no requirement for judicial review of surveillance measures before they are put into effect, unless a majority of the nine appointed members of a new executive advisory body, the National Control Commission on Intelligence Techniques, disagree with the French prime minister’s decision.
In those rare cases, the matter would be referred to the State Council, France’s highest court for administrative justice, for review.
In contrast, it takes only one commission member to approve a measure, and if the commission is silent during a brief one-to-three day review period, the measure could go into effect.
HRW argues that the French prime minister would be given wide-ranging powers to run surveillance ops practically unconstrained by the "rather toothless" new Commission.
Surveillance measures – which may include hacking and malware – could be indefinitely renewed without judicial scrutiny or notification to the target. Data obtained through surveillance may be retained for five years, or even indefinitely in some circumstances.
"Shortly after the [9/11] attacks, the Bush administration rammed through the little-understood powers of the Patriot Act without much legislative debate or examination," PoKempner concluded. "Prime Minister Valls insists this is no Patriot Act, but this type of surveillance mandate requires thoughtful examination, rather than a stampede through the parliament." ®
1 France, like most countries, is already busy spying on trade talks, foreign diplomats and the like, so these measures arguably regulate existing practice rather than adding new justifications for spying. For example, France is sometimes mentioned alongside the obvious suspects of Russia, China and Iran as a country actively involved in spying against US interests.