(Paris) – Draft legislation authorizing sweeping powers of digital surveillance is inconsistent with France’s international human rights commitments, Human Rights Watch said today. The bill, which has already won approval of the National Assembly’s Law Commission, would create a highly damaging model for other countries and should be reconsidered and revised, not rushed through the parliament.
The bill (“draft law on intelligence,” “projet de loi relatif au renseignement”), which was planned even before the Charlie Hebdo and Hyper-Casher supermarket attacks, is slated for plenary consideration by the National Assembly beginning April 13, 2015, under an accelerated legislative procedure that precludes a second reading. Serious flaws include expansive powers for the prime minister to authorize surveillance for purposes far beyond those recognized in international human rights law; lack of meaningful judicial oversight; requirements for private service providers to monitor and analyze user data and report suspicious patterns; prolonged retention periods for some captured data; and little public transparency.
“Though the goal of the bill is to place France’s surveillance practices under the rule of law, it in fact uses law to clothe a naked expansion of surveillance powers,” said Dinah PoKempner, Human Rights Watch general counsel. “France can do much better than this, especially if it wants to distance itself from the overreaching and secretive mass surveillance practices of the US and the UK that have attracted so many legal challenges.”
The bill recognizes at the outset both the right to privacy and the principle that interference with that right is legitimate only where necessary and proportionate. However, this positive start is swiftly undermined by an expansive list of seven “public interests” that might justify surveillance, including the nation’s “economic and scientific priorities,” “foreign policy,” and “the execution of international engagements.”
Unlike the protection of national security and public safety, these interests are not recognized in international human rights law as grounds for interference with basic rights and could be expansively interpreted to justify a huge range of data monitoring.
“The example of US law shows how easily vague standards can wind up justifying mass surveillance,” PoKempner said. “The draft’s sweeping mandate plainly contradicts France’s obligations under international human rights law and could be used to legalize a surveillance state.”
The bill’s requirement for service providers to install secret, unspecified, state-provided means of analyzing suspicious patterns – for example, visits to websites advocating terrorism, or contacts with persons under investigation – could potentially be applied to a virtually unlimited set of indicators, Human Rights Watch said.
That provision, which was recommended for deletion by the Digital Commission but retained by the Law Commission, has already caused concern that France will force private companies to become surrogate national security analysts with potentially disastrous consequences for online functionality and information security, consumer trust, and basic rights such as access to information, as well as freedom of expression and association. Companies will be required to keep their actions on behalf of the government confidential, further eroding transparency.
Human Rights Watch noted that many researchers, journalists, scholars, lawyers, and humanitarians visit websites promoting terrorism and speak with people connected to crimes to better understand and counter these abuses.
“Should the activities of independent organizations as a whole be under general monitoring and suspicion?” PoKempner said. “The most repressive governments might thank France for setting a legal precedent of forcing major Internet companies to monitor not just signs of ‘terrorism’ but signs of incipient dissent, or even just independent thought.”
The bill vests sole discretion to apply surveillance powers with the prime minister, who is supposed to consult in advance a new executive advisory body, the National Control Commission on Intelligence Techniques, but who is not bound to follow its advice. And even that consultation would be waived for real-time surveillance if there is a “very high risk” that the surveillance could not be conducted later.
The bill contains no requirement for judicial review of surveillance measures before they are put into effect, unless a majority of the nine appointed members of this commission disagree with the prime minister’s decision. In those rare cases, the matter would be referred to the State Council, France’s highest court for administrative justice, for review.
In contrast, it takes only one commission member to approve a measure, and if the commission is silent during a brief 24-72 hour review period, the measure could go into effect. While the commission is to make public reports, these will consist merely of accounts of the number of times it received challenges and advised against the use of surveillance techniques, and the number of times the prime minister nevertheless went forward.
“The bottom line is that the commission’s protective function is rather toothless,” said PoKempner.
The public will remain in the dark as to how many people were actually monitored, what targets or types of targets were approved, on what grounds, when or how surveillance was conducted, what material was collected and retained, or how many times the emergency bypass was used, Human Rights Watch said.
“It is difficult to see how people targeted – either directly or because of their unknowing associations, location, or other circumstance – will know they have been monitored so they can bring challenges to the State Council,” PoKempner said.
The bill includes other troubling aspects. Once approved, surveillance measures – which might include hacking and malware – may be indefinitely renewed without judicial scrutiny or notification to the target. Data obtained through surveillance may be subject, in some circumstances, to retention for five years or even indefinitely.
Many amendments have been proposed, some that would ameliorate problems and others that would exacerbate the bill’s conflicts with human rights law, Human Rights Watch said.
“Shortly after the September 11, 2001 attacks, the Bush administration rammed through the little-understood powers of the Patriot Act without much legislative debate or examination,” PoKempner said. “Prime Minister Valls insists this is no Patriot Act, but this type of surveillance mandate requires thoughtful examination, rather than a stampede through the parliament.”
