Among the information contained each year in the annual public report of the commission, one piece of information is particularly valuable. This is the number of people who are subject to surveillance in France using one of the techniques available to the intelligence services. The report for 2022 highlights a significant change.
In 2021, there were a little less than 23,000 people under surveillance. In 2022, there were a little less than 21,000, i.e. a decrease of nearly 9%. The difference between the two years is mainly due to the decrease in the number of persons monitored for the prevention of terrorism: nearly 1,500 fewer from one year to the next.
In fact, it is known that terrorism (which in France remains largely jihadist in nature) is hardly caused by structured organisations but rather by isolated individuals, who often are not socialised. The Commission therefore sees this evolution as a sign, not of a renunciation of terrorism, but of the ability of the services to adapt their surveillance to the evolution of the threat. It can be concluded that the intelligence services know how to optimise their capacities (the share of techniques dedicated to preventing the risk of interference by foreign powers is increasing significantly). But we will also venture to say that they have been able to integrate the principle of necessity laid down by law: in a democracy, intelligence must not be "routine"; the adaptation of surveillance to the evolution of the characteristics of the threat must be a constant concern.
With the same goal of applying the principles of necessity and proportionality in as realistic a manner as possible, the Commission, for its part, has endeavoured to enhance its dialogue with the services. It has worked in particular in an area where the balance between the need for intelligence and protection of not only privacy but also freedom of expression and assembly requires particularly careful consideration. These are requests for techniques based on the prevention of collective violence likely to seriously disrupt public peace, including the monitoring of political activism when it makes violence a means of action.
The Commission therefore made extensive use of requests for additional information to assess the merits of the surveillance requests submitted by the services. The challenge is not to limit itself to a motivation that is sometimes too abstract, or even stereotypical, but to engage in a genuine dialogue so that the Commission has a sufficiently precise and concrete knowledge of the circumstances justifying surveillance.
Still in the interests of careful consideration, it has more willingly accompanied its favourable opinions with reservations and conditions to limit the impact of the technique: reduction of the duration of authorisation, for example, or prevention of potential impact on other individuals in the target's circle. These limitations have been systematically included in the Prime Minister's authorisation decisions.
Finally, wishing to ensure the coherence of its opinions and to clarify matters for the services, the Commission has committed to "consolidate" its doctrine on the prevention of collective violence. Comparison of the terms of the law with the realities on the ground requires important legal qualification work. The Commission bears full responsibility for this. Although the law has opened the possibility of recourse to the courts in these matters, subject to defence secrecy, there is no real body of case law clarifying the interpretation of the law today.
A non-classified version (and therefore sometimes containing omissions) of the results of this consolidation work will be found in the appendix to this report.
The implementation of the legal framework for intelligence can therefore be improved: the Commission must not appear as a mere “one-stop-shop” with unpredictable positions, but as a true point of contact for the services.
As for the legal framework itself, as defined in 2015, it appears, seven years after its adoption, to be solid, relevant and well understood by the services in general. However, it has potential weaknesses, of which it is necessary to be aware in a timely manner.
In addition to defining some essential principles, this framework is structured around a list of techniques. Articles L. 851-1 to L. 855-1 of the French Internal Security Code set out the list of techniques that can be used by the intelligence services and define, for each, the conditions of use and control.
This choice of the legislator to define a type of instructions for use of each technique probably responds to the desire to control the surveillance activity as closely as possible. There is a counterpart. Over time, the technical context changes. Some techniques provided for by law lose some of their interest. This applies in particular to security intercepts. The effectiveness of traditional wiretap systems, which were the core of the technical monitoring system, is now being facing the increased use of encrypted messaging services. On the other hand, a technique such as the collection of computer data, which is increasingly controlled by the services, covers a wide range of possibilities under a single title, corresponding themselves to very different degrees of intrusion.
However, if we strive to understand the law in terms of the effectiveness of the control, we now come to a paradoxical result.
It is for the control of security intercepts, a "weakened" technique, that the commission has the most powerful means: these techniques are placed under quota; the data collected is centralised and kept by a third party service, the interministerial control group; the Commission can access it from its premises by direct link.
Conversely, the collection of computer data is not placed under quota. The data collected is not centralised, but kept by each user service, which uses it on its own systems. If it wants to access it (for example to verify that it is indeed within the scope of the collection authorisation, or that it is destroyed within the legal deadlines), the Commission must resort to outdated procedures: making appointments, physical travel of some of the thirteen representatives of the Commission, who are also responsible for examining the 90,000 annual authorisation requests, contending with poorly known processing systems, etc.
Let's be fair: the dialogue with intelligence services has ended up producing significant progress. Regular and concrete technical exchanges have been put in place. Conditions for access to certain data stocks have been developed and simplified.
However, it seems difficult to go beyond this without a political decision being taken to pave the way for one of the only two measures capable of ending the paradox: either centralise all the collected data with the inter-ministerial control group, regardless of the technique used and the beneficiary service; or allow remote access by the Commission to the intelligence services systems, to the extent required for its control. It is established that this access does not raise any insolvable technical or safety difficulties.
While the number of persons monitored decreased in 2022, the number of requests for techniques continued to increase. In other words, monitoring is becoming more intense. The volume of data collected is increasing. The contrast ultimately becomes worrying between, on the one hand, the modesty of the human and technical resources of the Commission and, on the other hand, the sophistication of the tools of the services and the announced progression of their resources.
The international situation suddenly shows just how necessary the activity of the intelligence services is. In the interests of good democratic balance, their strengthening should go hand in hand with the facilitation of controls.