Can French intelligence agencies handle the terabytes of data that they just got permission to collect?
There is a measure of irony to the landmark intelligence bill that passed the lower house of France’s Parliament on Tuesday: It is intended to legalize some activities that French spies are already doing illegally. With militant fighters streaming back into Europe from the battlefields of Syria, Iraq, and Libya, French authorities have more radicals to keep track of than they have police officers to shadow them. That has left the French security apparatus deeply strained, and the bill passed Tuesday embraces digital mass surveillance as a solution to the manpower problem: What can’t be tracked by a team of undercover officers can perhaps — and “perhaps” is the operative word — be more efficiently monitored by banks of computers.
The bill approved by a vote of 438 to 86, with 42 abstentions, has been intensely criticized by civil society groups and privacy activists for its embrace of mass surveillance in the form of what the French government calls “black boxes,” devices that will be installed on the servers of French Internet service providers to suck up data and spot terrorists engaging in suspicious behavior that might tip investigators to a possible attack.
In short, French spies are taking a page out of the U.S. National Security Agency’s playbook and hoping that effectively spying on their own citizens can prevent future strikes. But they are doing so with significantly fewer resources than their American counterparts. “In the U.S. you spend $52 billion on national security,” said Ricardo Baretzky, president of the European Centre for Information Policy and Security, referring to the so-called American intelligence community’s “black budget.” “What is happening here is that they are trying to do the same thing at one-hundredth of the cost.”
The January attacks in Paris on the office of satirical weekly Charlie Hebdo and a kosher supermarket revealed that French security organs lack the resources to track the many radicals within the country. Not every one of those potential militants could be followed by a team of undercover operatives. But every one of their emails could — in theory, anyway — be intercepted. By collecting a maximal amount of data and running it through powerful computers armed with sophisticated algorithms, French counterterrorism operatives hope to uncover possible terrorists and close gaps in the country’s security.
Analyzing enormous amounts of data using algorithms presents another raft of problems. Such methods frequently return false positives — how to separate, for example, researchers working on al Qaeda from those looking to join the organization? It’s also unclear that they deliver results. In the United States, the National Security Agency (NSA) has struggled in the aftermath of leaker Edward Snowden’s revelations to provide evidence that its own efforts to collect enormous reams of metadata have managed to foil any terrorist plots. With fewer financial resources devoted to its intelligence community, it’s unclear whether France will be able to staff the kind of intelligence operation that manages American mass surveillance efforts.
Perhaps more importantly, the measure moving through the legislature also fails to spell out what will happen to the data once it’s collected. “It is one thing to collect information, but what do you do with that information?” David Benichou, one of eight investigative judges in Paris charged with handling counterterrorism cases, told Foreign Policy. “It doesn’t say anything about that.”
One of the French government’s principal arguments in favor of the bill is that it is necessary to bring under a legal regime tactics that its spies are already using, and Benichou applauded the measure for that reason: “It is a good first step to clarify what intelligence can do.” The law now heads to the Senate for review, where it is likely to pass. In addition to authorizing digital surveillance methods, the bill also broadens the categories under which surveillance can be used to include economic, scientific, and foreign-policy interests. Other new categories include cases aimed at preventing collective violence and disruptions of public order that might harm national security or the “republican institutions” of France.
Although the bill has been under development for at least two years, it was fast-tracked in the aftermath of the attacks on Charlie Hebdo and the kosher supermarket in Paris. The attacks, carried out by two gunmen affiliated with al Qaeda in Yemen and another who had pledged allegiance to the Islamic State militant group, made apparent the threat posed by terrorist groups to France — and the French security services’ apparent inability to predict when militants long on their radar screens were finally getting ready to act.
In the aftermath of the attacks, France announced increases in the number of individuals working to fight extremism and pledged to increase defense spending, with more troops devoted to homeland security. The intelligence bill is one part of an attempt to beef up France’s capabilities to detect and prevent terrorist attacks. In the last 15 years, intelligence agencies around the world have vastly expanded their ability to intercept and collect communications data, and as France is now poised to join the ranks of countries employing the tools of mass digital surveillance, Baretzky believes that the key to better security is not necessarily broader collection tools but better cooperation: “If we want to do it correctly, we have to integrate our European intelligence services with the NSA and GCHQ,” he said, referring to the American and British electronic surveillance agencies.
According to Benichou, the challenge for French authorities charged with stopping terrorist attacks runs much deeper than just gaining more vast powers. “Intelligence has worked for a long time on counterspying, and in counterspying you value secrets, but in counterterrorism it is the contrary: You should share your information with other agencies. The problem is that we want that intelligence work on counterterrorism in a new way,” he said.
These responses to terrorism are part of a painful debate in France that cuts to the heart of its history as a country founded on ideals of liberty and equality. “Charlie Hebdo was targeted as an extreme symbol of freedom of speech,” said Frédérick Douzet, a professor at University of Paris 8’s French Institute of Geopolitics and an expert on cybersecurity. “People marched to defend the values of liberty and freedom of speech and the press. The way this project is framed threatens to hurt the very same values that people marched for.”
The broad categories under which surveillance tools may be deployed under the law means that protest groups may be targeted under the law, Douzet said. “The way it’s framed in the bill, it leaves a lot of interpretation enlarging the scope of surveillance,” she said. “We are moving from targeted surveillance to mass surveillance, and whether these very intrusive methods produce results is very unclear.”
Given the vast expansion of surveillance, civil liberty activists are up in arms that the measure will undermine democratic norms. Félix Tréguer, a founding member of digital rights group La Quadrature du Net, said the bill “effectively legalizes mechanisms of mass surveillance” while at the same time failing to include the oversight mechanisms necessary to make the legal regime governing surveillance take into account human rights concerns or transparency.
On this, French judges agree with rights activists. “This bill is unbalanced; it goes too far with no proper controls in place since most of the power will lie with the prime minister,” the judges’ union said in a statement. In stripping the bill of oversight powers while drafting it, Benichou said, French legislators had acted as if they were afraid of the judiciary.
For these reasons, the bill has often been described as the French version of the U.S. Patriot Act. And on many levels, that’s an appropriate analogy. Like its American counterpart — passed in the panic of the 9/11 attacks and currently up for renewal — the measure has been hurried through the legislature, despite its complicated, highly technical nature. “We’re talking about a surveillance program that goes way beyond counterterrorism but is being sold in the context of the trauma of a terrorist attack and justifies extraordinary means and procedures,” Douzet said. “The way it is being sold is very comparable.”
Photo credit: ALAIN JOCARD/AFP/Getty Images