Activity report

The National Oversight Commission for Intelligence-Gathering Techniques (CNCTR) has published its eighth activity report.

It presents the findings made during the controls it carried out in 2023.

It shares its thoughts on certain 'grey areas' of monitoring in two studies: one deals with the issues and boundaries of administrative surveillance when it is used to prevent organised crime; the other sets out the legal framework applicable when a 'target' is under surveillance through the persons in close contact with him or her, relatives, close friends or acquaintances.

This eighth report also includes a new section. The Commission considered that some light had to be shed on changes which, while not specifically involving intelligence, are likely to deeply transform its activity, either directly or indirectly. First and foremost, the very rapid developments of artificial intelligence. The report also focuses on the commercial development of cyber-intrusion equipment, with contributions from Henri Verdier, the French Ambassador for Digital Affairs, and Léonard Rolland, the Head of International Cybersecurity Policy at the French Ministry of Foreign Affairs.
 

The Commission issues an opinion (whether positive or negative) each time a service wishes to use an intelligence-gathering technique. When they were negative, the Prime Minister has always followed these opinions. This year was no different.

As in its previous reports, the CNCTR provides a precise account of all monitoring requests submitted to it for each type of intelligence-gathering technique, and shows how they have evolved over the recent period.

Both the number of people monitored and the techniques used increased in 2023 compared to the previous year.

94,902 requests for intelligence-gathering techniques (+6% compared to 2022 and +29.1% compared to 2019, the first year of statistical follow-up) were submitted by the intelligence services as part of domestic operations.

24,209 people were under surveillance using intelligence-gathering techniques(+15% compared to 2022 and +9% compared to 2019). This increase is linked to changes in the nature and intensity of the threat.

For the first time, the prevention of organised crime has become the main reason for surveillance in terms of the number of people involved. 7,058 people were monitored using intelligence-gathering techniques for that purpose, i.e., an 29% increase compared to 2022.

The number of people monitored for terrorism prevention purposes, which has been falling for several years as a result of the breaking up of networks, slightly rose compared to 2022 (+7.5%); 6,962 people were monitored using intelligence-gathering techniques for that purpose. In addition, the prevention of terrorism remains the most frequently provided purpose in terms of the number of techniques implemented (37.6% of requests). Such a large use of intelligence-gathering techniques is indicative of the intense level of surveillance.

Regarding the prevention of collective violence. In 2023, 2,551 people were monitored for this reason, compared to 2,692 in 2022 and 3,021 in 2019 (-15.6% compared to 2019). Nevertheless, this downward trend goes hand in hand with the stable number of techniques implemented, in a context where activists are constantly getting better at protecting themselves.

Finally, this report underlines the increase in the involvement of intelligence services against foreign interference. This purpose now accounts for more than 20% of the total number of techniques, as well as the number of people monitored, i.e., a much higher proportion than in the previous eight years. There was also a significant increase in the use of international communications monitoring (3,981 requests, compared to 3,715 the previous year).

As in the previous years, the least intrusive techniques, consisting of collecting metadata, remain the most widely used (accounting for almost 60% of requests for intelligence-gathering techniques). However, in 2023, the intelligence services made greater use of techniques that are more intrusive into private life. The number of requests for sound recording, image and video recordings made in a private setting or collecting computer data significantly increased over the past year: +14.7% more requests in 2023 for the recording of words spoken in a private capacity and the recording of images in a private setting compared to 2022; 5.5% rise for the recording of computer data.

In 2023, a new authorisation was granted for the implementation of an algorithm designed to detect connections likely to reveal a terrorist threat. This brings to five the number of authorised algorithms since the use of this technique by intelligence services was made possible in 2015.

This intensification of surveillance incorporates compliance with the law: the number of negative opinions issued by the commission on requests for surveillance has fallen by 20% (775 negative opinions compared to 974 in 2022), regardless of the technique, compared to 2022, i.e., 1.2% of all requests compared to 1.6% in 2022. This result is probably due to the fact that agents are more familiar with the legal framework, thanks to extensive training provided by the services and, on the part of the commission, a policy of in-depth discussions and dissemination of the doctrine.

The Commission does not confine itself to issuing opinions on the legality of the use of intelligence-gathering techniques. Downstream, it monitors the use made of the data.

With 136 documentary audits and on-the-spot inspections carried out in 2023, regardless of the service, the Commission achieved, with virtually constant human resources, the highest level of ex-post controls since it was created in October 2015.

As in its previous reports, the CNCTR notes that intelligence services, which now include entities responsible for disseminating and ensuring compliance with the legal framework, have made significant efforts to ensure that the law is complied with when techniques are used. However, these efforts could not prevent all the failures, some of which are recurrent.

Irregularities relating to the way in which the techniques have been implemented (non-compliance of perimeter, scope of application, for example, collecting information from people whose surveillance had not been authorised, etc.) are the most sensitive. Their number has significantly dropped.

However, although less serious, anomalies in the way technical products are used are worryingly recurrent.

The Commission is pleased to observe the progress made or in preparation, to make the conditions for its control easier. The new system, which is due to be operational in 2027, enabling data to be checked remotely, is crucial in this respect. However, with a very limited staff (13 agents) to both examine an ever-increasing number of requests for techniques and monitor their implementation, the commission is now reaching the limits of its capacity.
 

Next year, the legislator will have to act if it intends to extend the possibility of intercepting satellite telephone conversations. This will be an opportunity to slightly amend the legal framework and ensure that it better complies with the requirements of the European Convention for the Protection of Human Rights and Fundamental Freedoms. The Commission's report details a number of proposals along these lines.