Activity report

Among the information contained each year in the annual public report of the commission, one piece of information is particularly valuable. This is the number of people who are subject to surveillance in France using one of the techniques available to the intelligence services. The report for 2022 highlights a significant change.

In 2021, there were a little less than 23,000 people under surveillance. In 2022, there were a little less than 21,000, i.e. a decrease of nearly 9%. The difference between the two years is mainly due to the decrease in the number of persons monitored for the prevention of terrorism: nearly 1,500 fewer from one year to the next.

In fact, it is known that terrorism (which in France remains largely jihadist in nature) is hardly caused by structured organisations but rather by isolated individuals, who often are not socialised. The Commission therefore sees this evolution as a sign, not of a renunciation of terrorism, but of the ability of the services to adapt their surveillance to the evolution of the threat. It can be concluded that the intelligence services know how to optimise their capacities (the share of techniques dedicated to preventing the risk of interference by foreign powers is increasing significantly). But we will also venture to say that they have been able to integrate the principle of necessity laid down by law: in a democracy, intelligence must not be "routine"; the adaptation of surveillance to the evolution of the characteristics of the threat must be a constant concern.

***

With the same goal of applying the principles of necessity and proportionality in as realistic a manner as possible, the Commission, for its part, has endeavoured to enhance its dialogue with the services. It has worked in particular in an area where the balance between the need for intelligence and protection of not only privacy but also freedom of expression and assembly requires particularly careful consideration. These are requests for techniques based on the prevention of collective violence likely to seriously disrupt public peace, including the monitoring of political activism when it makes violence a means of action.

The Commission therefore made extensive use of requests for additional information to assess the merits of the surveillance requests submitted by the services. The challenge is not to limit itself to a motivation that is sometimes too abstract, or even stereotypical, but to engage in a genuine dialogue so that the Commission has a sufficiently precise and concrete knowledge of the circumstances justifying surveillance.

Still in the interests of careful consideration, it has more willingly accompanied its favourable opinions with reservations and conditions to limit the impact of the technique: reduction of the duration of authorisation, for example, or prevention of potential impact on other individuals in the target's circle. These limitations have been systematically included in the Prime Minister's authorisation decisions.

Finally, wishing to ensure the coherence of its opinions and to clarify matters for the services, the Commission has committed to "consolidate" its doctrine on the prevention of collective violence. Comparison of the terms of the law with the realities on the ground requires important legal qualification work. The Commission bears full responsibility for this. Although the law has opened the possibility of recourse to the courts in these matters, subject to defence secrecy, there is no real body of case law clarifying the interpretation of the law today.

A non-classified version (and therefore sometimes containing omissions) of the results of this consolidation work will be found in the appendix to this report.

***

The implementation of the legal framework for intelligence can therefore be improved: the Commission must not appear as a mere “one-stop-shop” with unpredictable positions, but as a true point of contact for the services.

As for the legal framework itself, as defined in 2015, it appears, seven years after its adoption, to be solid, relevant and well understood by the services in general. However, it has potential weaknesses, of which it is necessary to be aware in a timely manner.

In addition to defining some essential principles, this framework is structured around a list of techniques. Articles L. 851-1 to L. 855-1 of the French Internal Security Code set out the list of techniques that can be used by the intelligence services and define, for each, the conditions of use and control.

This choice of the legislator to define a type of instructions for use of each technique probably responds to the desire to control the surveillance activity as closely as possible. There is a counterpart. Over time, the technical context changes. Some techniques provided for by law lose some of their interest. This applies in particular to security intercepts. The effectiveness of traditional wiretap systems, which were the core of the technical monitoring system, is now being facing the increased use of encrypted messaging services. On the other hand, a technique such as the collection of computer data, which is increasingly controlled by the services, covers a wide range of possibilities under a single title, corresponding themselves to very different degrees of intrusion.

However, if we strive to understand the law in terms of the effectiveness of the control, we now come to a paradoxical result.

It is for the control of security intercepts, a "weakened" technique, that the commission has the most powerful means: these techniques are placed under quota; the data collected is centralised and kept by a third party service, the interministerial control group; the Commission can access it from its premises by direct link.

Conversely, the collection of computer data is not placed under quota. The data collected is not centralised, but kept by each user service, which uses it on its own systems. If it wants to access it (for example to verify that it is indeed within the scope of the collection authorisation, or that it is destroyed within the legal deadlines), the Commission must resort to outdated procedures: making appointments, physical travel of some of the thirteen representatives of the Commission, who are also responsible for examining the 90,000 annual authorisation requests, contending with poorly known processing systems, etc.

***

Let's be fair: the dialogue with intelligence services has ended up producing significant progress. Regular and concrete technical exchanges have been put in place. Conditions for access to certain data stocks have been developed and simplified. 

However, it seems difficult to go beyond this without a political decision being taken to pave the way for one of the only two measures capable of ending the paradox: either centralise all the collected data with the inter-ministerial control group, regardless of the technique used and the beneficiary service; or allow remote access by the Commission to the intelligence services systems, to the extent required for its control. It is established that this access does not raise any insolvable technical or safety difficulties.

While the number of persons monitored decreased in 2022, the number of requests for techniques continued to increase. In other words, monitoring is becoming more intense. The volume of data collected is increasing. The contrast ultimately becomes worrying between, on the one hand, the modesty of the human and technical resources of the Commission and, on the other hand, the sophistication of the tools of the services and the announced progression of their resources.

The international situation suddenly shows just how necessary the activity of the intelligence services is. In the interests of good democratic balance, their strengthening should go hand in hand with the facilitation of controls.

       
Serge LASVIGNES
 

The CNCTR (National Oversight Commission for Intelligence-Gathering Techniques) is publishing its seventh activity report. The report describes the findings from the Commission's inspections during 2022 and provides its insights into the framework governing the actions of the country's intelligence services, including a study on the surveillance of violent extremism. 

Since 2015, French law (incorporated within the "Internal Security Code") has entrusted the CNCTR with a mission to verify whether the intelligence-gathering techniques implemented within the operational chain for collecting and exploiting information are used in strict compliance with legislation. In turn, the CNCTR reports on its findings to Parliament and the public to the fullest extent permitted by national defence secrecy. 

To provide effective oversight, the Commission has been vested with the authority to act independently of the Government. The CNCTR's oversight activities are coordinated by a committee of nine members. They are designated as part of an appointment process that aims to strengthen the Commission's independence from the Government. The committee comprises:

• Four MPs, i.e. two deputies and two senators, appointed by the President of their respective chambers
• Two members of the Council of State, a court which hears disputes between the authorities and the public
• Two magistrates of the Court of Cassation, the supreme judicial court
• An expert in electronic communications

The President of the CNCTR is chosen by the President of the Republic from the members designated by the Council of State or the Court of Cassation. The President's appointment is subject to the provisions of Article 13 of the Constitution, which requires the National Assembly and the Senate to issue their prior public opinion before certain appointments.

The term of office for members is six years (however, MPs are appointed solely for the duration of their term of office within their relevant chamber).

Terms of office are not renewable, which is another measure aimed at ensuring the CNCTR's independence. In accordance with legislation, appointments ensure that women and men are equally represented within the Commission.
 

The CNCTR checks that intelligence-gathering techniques are used in accordance with the missions entrusted to the intelligence services and that their use is warranted on legitimate grounds that can legally justify the need for their implementation.

Subsequently, the CNCTR ensures that the resulting breach of privacy, especially infringements of the confidentiality of private correspondence, personal data protection and sometimes inviolability of the home, is proportionate to the severity of the threats or the scale of the challenges claimed by the intelligence services.

Oversight measures are reinforced when intelligence-gathering techniques target individuals whose activities democratically justify special protection, including MPs, magistrates, journalists and lawyers.

Ex-ante and ex-post oversight concerns the implementation of all the information-gathering techniques provided for by law and extends to all the intelligence services authorised to use such techniques, whether specialised intelligence services or services whose intelligence-gathering activities are merely part of their missions.

As in its previous reports, the Commission reports on its actions by publishing information that is as detailed as permitted by national defence secrecy.

Information is compared over a five-year period and focuses on the number of people under surveillance, the number of opinions issued by the Commission in response to requests for authorisation to implement intelligence-gathering techniques, the relative proportion of each technique, and the purposes claimed to support those requests.

In addition, the Commission reports on the number of prior opinions that it issued in 2022 in relation to requests for authorisation to conduct surveillance of international electronic communications (commonly referred to as "mass surveillance").
 

The CNCTR found that the number of individuals subject to intelligence-gathering techniques fell for the first time since 2015, decreasing from 22,958 people in 2021 to 20,958 in 2022. However, the number of requests to implement techniques continued to rise, ultimately reaching 89,502 requests for authorisation to conduct surveillance in 2022, which represents the highest level since the Commission was created. As in previous years, the least intrusive techniques (which involve collecting login data) are still the most widely used, but intelligence services used more techniques in 2022 that affected privacy: overall, the number of requests to install covert listening devices, capture images in private places and collect computer data increased by nearly 30% in the space of one year.  

In other words, although fewer individuals were under surveillance this year, the techniques used to monitor those same individuals were stepped up. This trend can be attributed to efforts by the intelligence services to target individuals with greater precision. It can also be explained by the growing difficulty in gaining access to the content of what is often encrypted communications.

When looking at the figures in greater detail, preventing terrorism is still the reason for the largest number of surveillance requests (up to 38%), but those surveillance measures have focused on a smaller group of people, i.e. nearly 1,500 less from one year to the next. The same trend can be seen with efforts to prevent collective violence. This reason for implementing surveillance measures concerned 2,692 people in 2022, compared to 3,466 in 2021. Finally, the report shows that the intelligence services are taking greater action against foreign interference. This reason for implementing intelligence-gathering techniques now represents 20% of the total number of surveillance requests, as well as the number of persons under surveillance, which is a much higher figure than over the previous eight years.

These findings reflect the changing face of the economic environment. At the same time, they show how intelligence services are capable of adapting to constantly evolving threats, particularly terrorism which today is less caused by structured organisations than isolated individuals, as well as shifts in the international arena, particularly since Russia's invasion of Ukraine.

As in its previous reports, the CNCTR notes that the intelligence services are concerned with upholding the law and that they endeavour to comply with the law when irregularities are committed, even though there are opportunities for improvement in their application of the legal framework. The number of negative opinions issued by the Commission in response to surveillance requests represented a rate of 1.6% in 2022 compared to 1.1% in 2021. This rise is a result of this year's greater use of the most intrusive intelligence-gathering techniques, an area where CNCTR exercises extreme caution, as well as heightened oversight of the use of techniques aimed at preventing collective violence. Monitoring political activism to prevent actions from escalating into violence is a sensitive issue. The CNCTR expects the intelligence services to substantiate their requests. 
 

When reporting on its careful oversight of such requests, the Commission considered it useful to accompany this report with a study into the surveillance of violent extremism. To the extent permitted by national defence secrecy, it provides a detailed presentation of the doctrine that the Commission has established through its opinions in defining the intelligence services' scope of action within the law.

Political or trade union beliefs are not intended to be monitored, but the situation changes when their expressions turn into acts of violence. In other words, only the methods and actions used to defend their beliefs can serve as justification for surveillance, and in no circumstances their actual beliefs. Therefore, the law only allows the intelligence services to monitor politically motivated actions for the purpose of preventing "collective violence that could seriously undermine public peace".

In this case, the issue of privacy protection overlaps the protection of the right to freedom of expression, opinion, association and assembly.

For nearly seven years, the CNCTR has striven to provide a specific definition of "collective violence that could seriously undermine public peace" within the meaning of the law. The Commission has also verified that the techniques requested to prevent such violence met the necessity and proportionality requirements common to French law and the case law of the European Court of Human Rights.

It has established a doctrine that this study (link to the English version) intends to present and explain without compromising national defence secrecy. This doctrine is not fixed. It takes account of the changes in the threats and behaviours that may be monitored and features a case-by-case analysis of each request submitted to the Commission for consideration.

The Commission has also produced a study (link to the French version) on the special system that applies to protected professions.  French law prohibits intelligence-gathering techniques from being used against MPs, magistrates, lawyers and journalists due to the performance of their mandate or profession.

This restriction does not mean that these people are granted immunity from intelligence-gathering techniques: they may be legally placed under surveillance if their behaviour reveals the existence of acts that fall outside the normal performance of parliamentary or professional activities and which constitute a threat to the Nation's fundamental interests.

A service may only be authorised to conduct surveillance on these people if it has submitted a specially substantiated request and only after the Commission has carried out an in-depth investigation. In particular, the Commission must ensure that the reasons specified in the request can be "dissociated", beyond all possible doubt, from the parliamentary or professional activities of the person concerned.
 

Finally, the report offers an outlook into the need to change ex-post oversight of the intelligence services' actions in light of the increasingly high-tech and sophisticated operating methods used to implement the intelligence-gathering techniques provided for by law.

In 2015, the legislator decided to grant that same institution the power to participate in the authorisation procedure governing the use of those techniques and oversee their implementation by the intelligence services. As a specific feature of the French system, appointing a single independent administrative authority to simultaneously provide ex-ante and ex-post oversight of the actions of the intelligence services guarantees greater efficiency in its mission to protect freedoms.
 

Once again this year, the CNCTR has given a positive overall assessment of the on-site investigations that it has performed. However, it emphasises that it is absolutely essential to modernise its oversight methods to keep pace with changes in the techniques used by the intelligence services (computer data capture, collection of large volumes of data, use of processing systems, etc.).

In 2022, the CNCTR carried out 121 documentary audits and on-the-spot inspections (all intelligence services combined). Thirty of those audits and inspections were devoted to monitoring international electronic communications, compared to just over 20 in 2021. In addition, the CNCTR made around 15 trips to the services' various territorial locations across the country, including in France's overseas communities.

In 2023, the CNCTR will continue stepping up its travel schedule to the various territories in an effort to strengthen its on-the-ground presence. The Commission's trips are aimed at providing greater oversight in direct contact with the services' employees, and gaining a clearer insight into their problems as well as any local difficulties.
 

The CNCTR maintains dialogue with its European counterparts through bilateral and multilateral meetings ever since the first meeting for Europe's national oversight authorities was organised in Paris in December 2018. The fourth such meeting took place in London in September 2022. At the invitation of his British counterpart, the CNCTR's President opened a discussion on how oversight authorities can better report on their activities to the public.

In October 2022, the CNCTR received the President and members of the authority entrusted by the Bundestag to oversee the actions of the intelligence services in the Federal Republic of Germany for the purpose of presenting French legislation on intelligence-gathering techniques and the Commission's remit. In November of the same year, a CNCTR representative attended an international forum of independent oversight authorities and government agencies organised by the Council of Europe on the subject of personal data protection and changes to the associated conventional framework.