French Constitutional Council Strikes Down “Blank Check” Provision in the 2015 Intelligence Act

Can intelligence agencies and their practice of secret state surveillance be reconciled with the rule of law? Is the unprecedented global debate on surveillance opened by the Snowden disclosures in 2013 bringing intelligence work closer to democratic standards?

Last week, the French Constitutional Council indirectly dealt with these pressing questions by striking down a blank-check provision in the 2015 Intelligence Act. The provision – article L. 811-5 of the Code of Internal Security – immunises “the surveillance and control of Hertzian transmissions” from traditional safeguards attached to secret state surveillance, like the authorisation of the Prime Minister and the ex ante opinion of an oversight commission.

The origin of “Hertzian surveillance”

Article L. 811-5 is a textbook case of the sort of loopholes found in legal frameworks surrounding intelligence that are designed to cover up for the most intrusive forms of surveillance without having to respect minimal procedural safeguards associated with the rule of law.

It was first adopted in 1991. At the time, the fashion in communications surveillance was not bulk hacking or fiber optic cables, but satellite interceptions. From the mid-1980’s on, the French foreign intelligence agency, the Direction Générale de la Sécurité Intérieure (DGSE) was busy building its network of intercept stations around the world, sometimes in cooperation with the German BND.

In the beginning, these early forms of large-scale collection and “bulk analysis” did not have any clear legal basis. Nor did judicial and administrative wiretaps for that matter. So in 1991, what had been a heated topic since the early 1970’s turned out to be unavoidable. After a condemnation by the European Court of Human Rights (ECHR) saying that the French legal basis for telephone wiretaps was not conducted “in accordance with the law,” the government rushed to Parliament to pass the Wiretapping Act of 1991. The Act laid down the first comprehensive framework to regulate telephone surveillance, creating an oversight commission (called CNCIS) entrusted with keeping intelligence agencies in check.

But all of this came with a huge caveat for satellite interceptions. The DGSE was still in the midst of a major infrastructural upgrade to develop its capabilities. To stop that plan was simply “out of the question” according to a former official of the Defense Ministry quoted in a 2001 article, and so a “derogation was requested by the highest authorities of the state.” A provision – article 20 of the bill – was passed to grant a blank check to the DGSE to intercept wireless communications. According to this provision, “measures taken by public authorities to ensure, for the sole purpose of defending national interests, the surveillance and the control of Hertzian transmissions” were not subject to the procedural safeguards laid out in the law. “National interests” and “Hertzian transmissions” remained undefined, but nobody in Parliament seemed to care.

A legal black hole in the 2015 Intelligence Act

Since then, article 20 has gone out of control. Recent reports point to the fact that it has been used not only as a legal basis for the surveillance of satellite transmissions as originally intended, but also for the domestic surveillance of WiFI, GSM and GPS communications, for access to metadata records as well as the large-scale surveillance of Internet traffic flowing through fiber optic cables (yes, even light flowing through a fiber optic cable creates radio waves!).

Even key officials have hinted at rampant abuse. For instance, former member of Parliament Jean-Jacques Hyest, who had taken part in the legislative debate over the 1991 Wiretapping Act and sit on the oversight commission from 2010 to 2014, is quoted in a 2016 article regarding the extra-legal surveillance of a political opponent of former President Sarkzoy as saying: “I have always said that it was unbearable to use article 20 for all and everything.” In 2013, Jean-Jacques Urvoas, who is now Minister of Justice and was rapporteur of the Intelligence Act in Parliament last year, reacted to an article on the large-scale collection of metadata by calling article 20 “the grey zone” that epitomised “the government’s incapacity to keep in check the methods of the [intelligence] services.” And in 2011, during criminal hearings, Bernard Squarcini, then head of the domestic intelligence agency, justified the use of the article to access the metadata records of one of Le Monde‘s journalists by “the frequent use of this text” to that end (thanks to the complicity of major French Internet Service Providers who complied with these abusive requests).

In light of such a contentious history, it came as a huge surprise to realise that article 20 had survived the major reform enacted in 2015 to correct the flaws of the antiquated 1991 Wiretapping Act, to legalise new surveillance techniques and, allegedly, bring new safeguards. During the parliamentary debate on the Intelligence Act in the Spring of 2015, none of the Bill’s numerous opponents both inside and outside of Parliament realised that, amidst all the legalese, the text simply relocated article 20 under article L. 811-5. It is only by chance that article 811-5 was “rediscovered” in April 2016 following a report from Le Monde on a case of political spying, just as a volunteer litigation team called Les Exégètes amateurs (in which I am involved) was wrapping up its legal briefs against the implementation decrees of the Intelligence Act filed before the Council of State, France’ supreme administrative court. The subsequent constitutional challenge brought in the name of the non-profit organisations La Quadrature du Net, Fédération FDN and FDN aimed to remedy this collective advocacy failure.

In its ruling issued on October 21^st, the Constitutional Council gave way to the arguments developed by the plaintiffs, stressing that the provision “does not define the nature of the surveillance and control measures that public authorities are allowed to take,” and that such measures are not subject “to any substantive or procedural safeguards” (§8). However, conceding to a government’s request, the Constitutional Council pushed back the effective abrogation of article L. 811-5 to January 2018, in order to give the government sufficient time to adopt a legislative patch.

The Council also highlighted that, pending the full abrogation, security agencies will have to “regularly inform” the revamped oversight commission, the Commission nationale de contrôle des techniques de renseignement (CNCTR), of the surveillance measures implemented under article L. 811-5. At this point, it is not clear what sort of measures will still be authorised until the deadline is reached, since the Council ruled that during this transitory period article L. 811-5 “shall not be interpreted as providing the basis for the interception of communications, the collection of metadata or the capture of computer data” already covered in the Intelligence Act (§12). We may have more information on the exact consequences of the ruling when the CNCTR releases its first annual report in the coming weeks.

Countering the Snowden Paradox

This constitutional ruling only relates to a short and overlooked provision of the Intelligence Act. It is nonetheless an important one, considering the extent to which this article has served as a major loophole justifying for many different forms of illegal surveillance in the past two decades. The ruling shuts off a 25-year-old convenient legal shield.

That being said, there are many other provisions in the Intelligence Act that are specifically designed to prevent any kind of effective oversight. One can think of the criminal immunity for hacking operations when they are conducted on equipment located outside of France, the provisions allowing for both domestic and international large-scale and suspicionless Internet surveillance, or the deliberate shielding of data-sharing between French agencies and their foreign partners from the scrutiny oversight commission, among others.

Now that the most blatant violation of fundamental rights contained in the Intelligence Act has been remedied, legal proceedings will resume on the rest of the law before the Council of State. In France and elsewhere, legal resistance continues against the “Snowden paradox,” that is, the fact that so far, intelligence reform is mostly serving to legalise and normalise forms of mass surveillance.