Main provisions Intelligence Act (France)

1 main provisions

1.1 scope
1.2 oversight
1.3 wiretaps , access metadata
1.4 black boxes , real-time access metadata
1.5 computer network exploitation
1.6 international surveillance
1.7 data retention periods
1.8 redress mechanism

main provisions

this section summarizes main provisions of intelligence act.

scope

through article l. 811-3, act extended number of objectives can justify extrajudicial surveillance. these include:

national independence, territorial integrity , national defense;
major interests in foreign policy, implementation of european , international obligations of france , prevention of forms of foreign interference;
major economic, industrial , scientific interests of france;
prevention of terrorism;
prevention of: a) attacks on republican nature of institutions; b) actions towards continuation or reconstitution of groups disbanded (article l. 212-1 of criminal code); c) collective violence cause serious harm public peace;
prevention of organized crime , delinquency;
prevention of proliferation of weapons of mass destruction.

these surveillance powers can used law enforcement agencies not part of official intelligence community , combined staff on 45,000.

oversight

the existing oversight commission, commission nationale de contrôle des interceptions de sécurité, replaced new oversight body called national oversight commission intelligence-gathering techniques (commission nationale de contrôle des techniques de renseignement, or cnctr). composed of:

four members of parliament designated presidents of both chambers of parliament;
two administrative judges , 2 judicial judges designated respectively council of state , cour de cassation;
one technical expert designated telecom national regulatory authority (the addition of commissioner technical expertise main innovation).

the cnctr has 24 hours issue ex ante non-binding opinion regarding surveillance authorizations delivered prime minister before surveillance begins, except in cases of absolute emergency notified of surveillance measure within 24 hours upon deliverance (article l. 821-3).

for ex post oversight, cnctr has permanent, comprehensive , direct access records, logs, collected intelligence, transcripts , extractions of collected data. able conduct both planned , in premises these documents centralized (article l. 833-2-2). if irregularity found, can send prime minister recommendation can put end it. 1 hugely significant exception cnctr s oversight powers bulk of data obtained through data-sharing foreign intelligence agencies (article l. 833-2-3).

wiretaps , access metadata

techniques of communications surveillance covered act include telephone or internet wiretaps (l. 852-1), access identifying data , other metadata (l. 851-1), geotagging (l. 851-4) , computer network exploitation (l. 853-2), of subject authorization of renewable duration of 4 months.

black boxes , real-time access metadata

the act authorizes use of scanning device (nicknamed black boxes ) installed on infracturstures of telecom operators , hosting providers. article l. 851-3 of code of internal security provides that, sole purpose of preventing terrorism, automated processing techniques may imposed on networks of [telecom operators , hosting providers] in order detect, according selectors specified in authorisation, communications reveal terrorist threat.

another provision limited anti-terrorism allows real-time collection of metadata (article l. 851-3, terrorism , 4 months period). initially, provision targeted individuals identified [terrorist] threat . after 2016 nice attack, extended bill of state of emergency cover individuals related threat or belong entourage of individuals related threat . according la quadrature du net, means provision can potentially cover hundreds or thousands of persons (...) rather 11 700 individuals reported on french terrorism watchlist.

computer network exploitation

the act authorizes computer network exploitation, or computer hacking, method intelligence gathering. article l. 853-2 allows for:

access, collection, retention , transmission of computer data stored in computer system;
access, collection, retention , transmission of computer data, displayed on user s computer screen, entered keystrokes, or received , transmitted audiovisual peripheral devices.

considering intrusiveness of computer hacking, law provides these techniques authorized duration of 30 days, , when intelligence cannot collected other legally authorized mean.

the act grants blanket immunity intelligence officers carry on computer crimes computer systems located abroad (article 323-8 of criminal code).

international surveillance

the act provides chapter on surveillance of international communications , particularly relevant dgse s surveillance programs. international communications defined communications emitted or received abroad (article l. 854-1 , following). can intercepted , exploited in bulk on french territory reduced oversight. safeguards in terms of bulk exploitation , data retention lessened foreigners (though definition of foreigners technical, i.e. people using non-french technical identifiers ).

data retention periods

for national surveillance measures, once communications data collected intelligence agencies, retention periods following:

content (correspondances): 1 month after collection (for encrypted content, period starts after decryption, within limit of 6 years after initial collection);
metadata: 4 years (compared 3-year period before adoption of act).

for international surveillance, retention periods depend on whether 1 end of communication uses technical identifiers traceable national territory or not, in case national retention periods applicable, start after first exploitation , no later 6 months after collection (article l. 854-8). if both ends of communication foreign, following periods apply:

content: 1 year after first exploitation, within limit of 4 years after collection (for encrypted content, periods starts after decryption, within limit of 8 years after collection);
metadata: 6 years

the law fails provide framework limit staff access collected intelligence once stored intelligence , law enforcement agencies.

redress mechanism

the act reorganizes redress procedures against secret surveillance, establishing possibility introduce legal challenge before council of state after having unsuccessfully thought redress before cnctr.