# US Technology Companies and State Surveillance in the Post-Snowden Context: Between Cooperation and Resistance

Félix Tréguer

► To cite this version:

Félix Tréguer. US Technology Companies and State Surveillance in the Post-Snowden Context: Between Cooperation and Resistance. [Research Report] CERI. 2018. halshs-01865140

HAL Id: halshs-01865140

https://shs.hal.science/halshs-01865140

Submitted on 30 Aug 2018

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
UTIC Deliverable 5

US Technology Companies and State Surveillance in the
Post-Snowden Context:

Between Cooperation and Resistance

Author: Félix Tréguer (CERI-SciencesPo)
# Executive Summary

This deliverable looks at the growing hybridization between public and private actors in the field of communications surveillance for national security purposes. Focusing on US-based multinationals dominating the digital economy globally which became embroiled in the post-Snowden debates (companies like Google, Apple, Facebook, Microsoft, Yahoo), the report aims at understanding the impact of the Snowden scandal on the strategies of these companies in relation to state Internet surveillance.

To that end, the report identifies seven factors that are likely to influence the stance of a given company and its evolution depending on the changing context and constraints that it faces across time and space. These factors are: the firm's internal corporate culture, the pressure coming from the human rights field, the importance of user trust on these companies' businesses, their sensitivity to regulatory changes, the identification of the firm managers to the power elite, the firm's dependence on public procurements and, finally, the existence of criminal sanctions for non-cooperation.

The report then applies this constraint structure affecting the participation of large Internet firms in public-private surveillance assemblages through two case-studies looking at post-Snowden debates in the United States and in France. We observe important differences depending on the considered country in the initial phase of the scandal (2013-2015). In the US, we first see overt and multi-pronged resistance strategies being staged, which can be read as an instance of double-dealing (in the sense that commitments to human rights actually reinforced the position of these firms in their respective markets). In France these companies faced a much more antagonist environment, partly resulting from existing public-private alliances, and their initial attempt at resistance to the expansion of state surveillance capacities was immediately denounced by government officials as hypocritical, considering their own commercial surveillance practices. This subsequently led to much less intense and much more discreet forms of resistance.

But overtime, from 2015 on, the influence of the human rights field withered along with the media attention devoted to state surveillance. Through securitization discourses, the agenda became dominated by terrorist threats and similar trends towards greater cooperation materialised on both sides of the Atlantic – especially regarding the issue of the monitoring and takedown of terrorism-related content on online platforms –, suggesting strong transnational field effects. As a consequence, while we note variations depending on the companies and the two countries under consideration, the public-private stand-offs eventually resulted in coherent mechanisms producing similar outcomes.

In concluding the deliverable, we build on these case studies to argue that such ongoing public-private hybridization processes need to be framed in the context of wider shifts affecting modern bureaucracies – with the growing importance of data governance for modern state power –, and point to the adverse impact of these trends on the rule of law.
# Table of Contents

<table><tr><td>Executive Summary</td><td>2</td></tr><tr><td>1. Introduction</td><td>4</td></tr><tr><td>1.1 Goal of the deliverable</td><td>7</td></tr><tr><td>1.2 Brief literature review</td><td>7</td></tr><tr><td>1.3 Methodology of this report</td><td>10</td></tr><tr><td>1.4 Research Questions & Outline</td><td>11</td></tr><tr><td>2. Hypothesis on the Constraint Structure of Large Internet Firms in Debates on State Surveillance</td><td>13</td></tr><tr><td>2.1 Internal corporate culture</td><td>13</td></tr><tr><td>2.2 Pressure from human rights field</td><td>14</td></tr><tr><td>2.3 User trust and business stakes</td><td>15</td></tr><tr><td>2.4 Regulatory stakes</td><td>17</td></tr><tr><td>2.5 Identification to and dependency on power elite</td><td>17</td></tr><tr><td>2.6 Firm's dependence on public procurements</td><td>18</td></tr><tr><td>2.7 Criminal sanctions</td><td>19</td></tr><tr><td>3. (Re)configuration of Public-Private Assemblages in Internet Surveillance: Case-Studies</td><td>22</td></tr><tr><td>3.1 US: "Big Tech" stages resistance</td><td>22</td></tr><tr><td>3.2 France: Facing established public-private alliances</td><td>46</td></tr><tr><td>4. Conclusion: Changing Bureaucracies, Security & the Rule of Law</td><td>61</td></tr><tr><td>References</td><td>65</td></tr><tr><td>Appendix 1: Roundtable "The Internet, Private Actors and Security Challenges" (CERI, October 9th, 2017)</td><td>71</td></tr><tr><td>Programme</td><td>71</td></tr><tr><td>Draft transcription by Barthélémy Michalon</td><td>72</td></tr></table>
# 1. Introduction

In June 1831, a Frenchman under the name of Alexandre Ferrier sought to create the first privately-held optical telegraph ling between Calais, in Northern France, and London. Ferrier was an adventurous entrepreneur who did not back away from bold ideas. After all, such a privately-owned telecommunications infrastructure could not only serve the interest of French industry barons willing to track stock prices in the world financial capital, but also to the French government who could use it for its diplomatic communications. Moreover, there was no law sanctioning the *de facto* monopoly of the French state over telegraph networks.

Ferrier was bold, but he also knew that he would be more cautious to ask the government for an explicit authorization. In turn, Casimir Périer, head of the government, wanted an informed opinion on the matter. Yes, Ferrier's proposal was unusual but, after all, many political and business elites agreed that the telegraph could be a boon for the emerging industrial revolution (Flichy, 1991). Could the government seriously consider keeping its monopoly over the telegraph? Many thought not.

## Privatizing the telegraph?

But Alphonse Roy, the man Périer turned to in order to make up his mind, had an entirely different view on the matter. As the newly-appointed Director of the Telegraph Service at the Ministry of Interior, Roy wrote a letter that offered a more-than- tepid response to Ferrier's project. “Mr. Ferrier's request is entirely inadmissible,” he wrote. And so no one could be mistaken, he added: “The claim that a telegraph line owned by individuals could be established across the strait to extend the line of the State that ends in Calais, and that it could be of any service to the government, is something completely illusory.”

Why? First of all, as Roy explained, “the Administration would never entrust diplomatic secrets to agents who are not responsible to her (...).” But the argument seemed specious. For one thing, every diplomatic cable was encrypted in Chappe code and, according to historian Paul Charbon, was “completely unintelligible for those in charge of transmitting it” (Charbon, 1991). More crucially, the heart of the matter was the absolutely unthinkable notion that the French state might lose its monopoly over telecommunications infrastructure. As Roy argued more convincingly, “the existence of this telegraph communication would necessarily harm the present privilege of the government to be the first instructed of all important news.”

Over the next six years, the French administration worked on a plan to retain its monopoly over the deployment and exploitation of telegraph networks, while starting to open its use to the general public. In 1837, the Minister of the Interior, Adrien de Gasparin, appeared before the Parliament to defend a new law designed to put that plan into effect. The goal was to criminalise every transmission not sanctioned by the government and not sent over its own lines.

Speaking before the house, Gasparin tried to stir support by referring to the “revolt of the Canuts”, a social unrest that had taken place a few years earlier among textile factory workers in Lyon. At the time, the only people who would have been sentenced under the new law were petty speculators who had fraudulently transmitted financial news to businessmen in Bordeaux, Lyon or Marseilles,
allowing their rich clients to take advantage over their competitors still dependent on the postal
service. But these did not seem as dangerous for the regime as the rebellious workers protesting the
violence of the industrial revolution. According to Gasparin, "it is by organizing themselves like the
French administration that they tried to defeat us" (Gasparin, 1837). "Many elements of success
failed them," he stressed, "but we can affirm without exaggeration that it was especially the
telegraph that failed them." According to the Minister, the latter would have allowed insurgents "to
impress upon their movements a formidable precision" by spreading the word of the rebellion to
various industrial centers across the country.

After highlighting the risk of sedition that the liberalisation of the telegraph would entail, Gasparin
moved to the core of the matter. Yes, he assured the members of Parliament, the government had
tried "to reconcile the interest of public order with those of industry" by breaking the monopoly and
by establishing a governmental surveillance of private telegraph lines. "We do not like monopolies
for themselves", swore Gasparin. "We would be glad to extend to everybody the facilities which the
telegraph has brought to the Government. But the guarantees that we are offered are truly illusory."

"No doubt," he claimed, the operators working on these private lines "would faithfully transmit the dispatches delivered to them by our intermediary." And "of course," he continued, "we would be careful to examine these dispatches, and to let pass only those which appear innocent." "But how can we be certain that a hidden meaning has not been attached, through certain conventions, to the sentences that would appear to be the most harmless?" According to him, a privatized telecommunications infrastructure was a challenge that the modern state simply could not handle. All the techniques of power institutionalized since the 16th century to control the subversive effect of the printing press while allowing it to serve the interests of the state and of early capitalism would come crumbling.

The growing privatization of telecommunications network

In many respect, Foy and Gasparin fought a rear-guard battle. From the 1840s on, the development
of the electrical telegraph would accelerate national and transnational communications flows, as the
industrial revolution spurred the demand for communications. By the end of the 19th century, private
corporations did not only make extensive use of the telegraph and of the new communication
technology of the time, the telephone, but also played a growing role in the construction and
management of national and international infrastructures (Barty-King, 1980; Headrick, 2012).

Fast-forward 150 years. Neo-liberal policies launched in the 1980s have dismantled the public and
private monopolies over telecommunications networks. After the powerful telecommunications
corporations and media industries, the "Internet revolution" has given way to a new generation of
private actors who exert unprecedented power over transnational computer networks. Despite the
early cyberlibertarian hopes – as the late countercultural icon John Perry Barlow wrote in 1996 at
the address of world governments, "you have no moral right to rule us nor do you possess any
methods of enforcement we have true reason to fear" (Barlow, 1996) – states have found ways to
transpose their traditional techniques of power to the digital realm (Goldsmith & Wu, 2006). And
when they do – for instance to engage in the large-scale monitoring of Internet communications –
they do so in interaction with many private actors who own parts of the multi-layered architecture
of global communication networks.
## Private actors in post-Snowden controversies

Beyond the role of private actors in these secret surveillance practices, many private companies also engage in the debates regarding state security practices and their impact on the digital ecosystem. For one, the Snowden controversies unleashed in June 2013 show the various types of actors mobilized around these issues. At the early stage of the UTIC project, we undertook a Web cartography of post-Snowden controversies, using a Web-curation tool developed by Sciences Po's Medialab (Jacomy, Girard, Ooghe, & Venturini, 2016).

<figure><img src="image_2.png" /></figure>

Web cartography of actors mobilised in post-Snowden controversies. Private actors are in the upper-left corner in red color. Explore online at: https://frama.link/A3W9CoY

In these controversies on Internet surveillance, various categories of private actors got involved. As a starting point, we chose to regroup them in the following, rather classical topology:

* Multinationals firms of the digital economy, whether there are US-based Information Technology (IT) firms, large platforms or hosting providers collecting vast amounts of data, or telecom operators. They appear as both actors and targets of these controversies, as they are pointed out for their participation in state surveillance apparatuses.
* National and regional digital economy companies (again, online services, hosting and access providers) offering alternative services to those pointed out as exposed to the NSA and other Five-Eyes surveillance programs.

* Cybersecurity providers, who took the opportunity of the Snowden disclosures to promote their services and other technical counter-measures to companies and public institutions willing to better protect their data assets from spying and surveillance.

* Trade groups and lobbies, engaged in negotiations with public authorities, either with the goal of enacting reforms of applicable surveillance or of calling for tougher cybersecurity policies to protect "digital sovereignty".

**1.1 Goal of the deliverable**

One need to take these categories with care. They tend to obscure the complex power struggles not only between these sub-sectors but also within them (Bourdieu, 2014b). Their agents are engaged in multi-faceted distinction strategies that need to be traced to understand how post-Snowden debate on surveillance has impacted them.

In first analysis, it looks like the controversies unleashed by the Snowden documents deeply affected the power relationships between the various actors involved in or mobilized around state surveillance practices. For private actors – and especially the US-based multinational online service providers, software editors and online platforms on which this deliverable focuses –, it first seemed as if the debate has significantly undermined the influence of intelligence agencies on a significant part of various private actors of the digital economy, while investigative journalists, lawyers and human rights defenders in various Non-Governmental Organizations (NGOs) and politicized hackers and engineers saw a boost in their ability to influence these actors. But as this deliverable will show, the situation is actually more nuanced and varies depending on the countries, sub-sectors of the digital economy and the very companies under consideration.

To account for this complexity, we need to understand why, in a given context, some companies choose to collaborate with intelligence agencies, while others are more inclined to resist getting implicated in state surveillance apparatus. To that end, we need to identify the factors that are likely to influence the stance of a given company and its evolution depending on the changing context and constraints that it faces across time and space. But before we delve in this analysis, let us give an overview of the existing literature most relevant to our task.

**1.2 Brief literature review**

Our analysis of post-Snowden conflicts between private actors involved in the digital economy and states draws from, and hopes to contribute to, two main streams of literature.

**The public-private distinction in critical security studies**

The first important stream comes from political science and international relations. An important reference in this regard is Tim Mitchell's *Limits of the State* (1991). This seminal article was written in reaction to post-Marxist conception of the state which were influenced by cybernetics and offered to think of the "political system" (rather than the state) as an information processing apparatus (see,
e.g., Easton, 1957), or which – from the late 1970s on – purported to “bring the state back in” by focusing on decision-making processes. Mitchell aimed at offering a third way, going back to the crucial and difficult question of the boundary between society and the state. According to him,

> “the elusiveness of the state-society boundary needs to be taken seriously, not as a problem of conceptual precision but as a clue to the nature of the phenomenon. Rather than searching for a definition that will fix the boundary, we need to examine the detailed political processes through which the uncertain yet powerful distinction between state and society is produced” (idem, p. 78).

Accordingly, Mitchell calls for studying the state not “as a free-standing entity, whether an agent, instrument, organization or structure, located apart from and opposed to another entity called society”, but rather as a multiplicity of political arrangements that produce structural effects that maintain social and political order. From this perspective, “the boundary of the state is merely the effect of such arrangements and does not mark a real edge. It is not the border of an actual object (idem, p. 94). Rather, “producing and maintaining the distinction between state and society is itself a mechanism that generates resources of power.” Delving on the relationship between public administrations and private sector organizations like energy multinationals or private banks, Mitchell however goes on to caution that:

> “The approach to the state advocated here does not imply an image of the state and private organizations as a single, totalized structure of power. On the contrary, there are always conflicts between them, as there are between different government agencies, between corporate organizations, and within each of them” (p. 90).

Mitchell's response builds on the work of French theorists like Bourdieu and Foucault, to whom we will get back in the conclusion of this report. But to sum their influence, both offered new ways for questioning taken-for-granted notions like the state and, as a consequence, develop a more complex understanding of power relations. Mitchell's approach takes up Foucault's invitation to study the “state” as power practices rather than through – mostly legal – concepts deriving from the “state's internal rationality”. It also echoes the work of Pierre Bourdieu, who approximately at the same time as Mitchell as questioning the limits of the state, was giving his “On the State” lectures at the College de France between 1989 and 1992, in which he for instance stressed that “the state (...) is not a bloc, it is a field” (Bourdieu, 2014a).

This line of thinking became increasingly influential as the sub-field of critical security studies emerged from the mid-1990s on (Peoples & Vaughan-Williams, 2010). With the rise of security privatization in the context of neo-liberal economic policies and given the opposition to these processes, a growing number of scholars paid attention to the public-private distinction (Abrahamsen & Leander, 2015). Subjects like the role of private security guards, the role of private companies in the logistics of military forces, subcontractors in the intelligence field all became part of a growing field of inquiry which, in its critical component, aimed at questioning the public-private distinction. For instance, looking at private security firms, Abrahamsen and Williams, argued that “the significance and impact of security can only be understood by moving beyond the public-private distinction, with the recognition of how these distinctions are being reconfigured into networks and practices indicative of new relations of power” (Abrahamsen & Williams, 2010).

Against those insisting that the privatization of security was one more evidence of the weakening of
traditional state sovereignty, the authors argued that “privatization is not a challenge to prevailing structures of authority, but is embedded in, and inseparable from, transformations in governance.” Looking at laying new theoretical foundations for understanding how private security is historically and socially constituted, the authors introduce the concept of “global security assemblages”:

> "[Global security assemblages are] transnational structures and networks in which a range of different actors and normativities interact, cooperate and compete to produce new institutions, practices and forms of deterritorialized security governance" (p. 90).

The notion of “assemblage” here refers to the way security governance is increasingly achieved through fluctuating arrangements of networks of state, corporate and voluntary actors. As other authors drew the notion of assemblage to other theoretical foundations (e.g. deleuzian like (Haggerty & Ericson, 2000), Abrahamsen and Williams ground it in Bourdieu’s notion of “fields” to highlight the evolution of material, symbolic and cultural forms of capital within the security field. Rather than the erosion of state power highlighted by some theorist of globalization, their approach builds on Saskia Sassen’s concept of “disassembly” to highlight the fact that assemblage is actually a *process* whereby some components of state are configured in new power structures as formerly public functions are transferred to the private sector.

To come back to the role played today by large technology companies in the field of state surveillance, there nothing “natural” or “normal” about it. This is what the historical anecdote that opens up this report helps us remember. But at a more theoretical level, the public-private category – which has become a central theme in security studies (Williams, 2010),– also helps see ongoing processes in a way that can teach us something about the changing nature of state power.

## Surveillance and the political economy of the digital

Our research topic can also be situated in the history of public-private hybridization in the development and use of information and communication technologies. From the work of Edwin Black on the role of IBM in the Holocaust (2012) to Christophe Lécuyer’s history of Silicon Valley (2007) and approaches anchored in political history (Mattelart, 2010), political economy (Foster & McChesney, 2014) but also journalistic inquiries that take a historical perspective (Harris, 2014; Levine, 2018), many references point to the World War II and Cold War origins of the computer industry and of today’s surveillance society.

These histories of US technology industries are complemented by critical approaches at the intersection of political theory and political economy. Among them, some insist on breaking away with the naive conception of the network society as being abstracted from capitalism, instead pointing to the continuity between contemporary actualization of capitalism and previous periods (McChesney, 2013; Schiller, 2000). Dan Schiller refers to the “digital capitalism” to:

> “point to a new phase change in a five-hundred-year history that has been marked by abiding tendencies: capital's continually extended use of wage labor, its search for new and often contested side of commodification, and its episodic crises, wherein rampant financial speculation triggers a fall into depression and economic stagnation” (Schiller, 2014)

Building on these analytical corrections, other authors aim to complement what are seen as shortcomings in surveillance studies. In his work on surveillance, Christian Fuchs for instance
underlines the the general lack of consideration of Marx's work in surveillance theories (Fuchs, 2013). Against Anthony Giddens' claim that Marx ignored surveillance altogether, the author shows that for Marx, both economic and state surveillance played a key, complementary role by sustaining the capitalist logic of capital accumulation. At the theoretical level, he argues that the notion of accumulation can help unify various approaches of surveillance. He ends by underlying that although capitalism and the rise of the bourgeois class led to the separation of the private and the public spheres and hence of the notion of privacy, the latter is constantly threatened by capitalism: "An antagonism between privacy ideals and surveillance is therefore constitutive for capitalism."

Exploring these contradiction in the context of social media platforms, Fuchs and Trottier further stress the significance of social media in the history of surveillance (Fuchs & Trottier, 2015). For them, online social media represent the first type of media to bring together three forms of sociality (cognition, communication, cooperation) and the various social roles or identities taken by social actors in the different structures of social life (state, the economy and culture, and the intersection of these three spheres with the civil society). The boundaries between these different spheres of social life becomes more liquid as communicative action is absorbed in a single profile on integrated socio-technical platforms, who have commercial incentives to collect the most extensive amount of data about their users. According to the authors, the convergence of these commercial social media and state policing has three major implications: the rise of categorical suspicion, increased social sorting and the normalization of surveillance.

Coming from a background in psychology and economics, Shoshana Zuboff has also taken up the notion of “surveillance capitalism” coined by Bellamy Foster and McChesney (2014) to point to a new evolution of capitalism, whereby data extraction and analysis become a new managerial paradigm wielding a new form of power alien to democratic institutions. According to Zuboff:

> "Surveillance capitalism is immune to the traditional reciprocities in which populations and capitalists needed one another for employment and consumption. In this new model, populations are targets of data extraction. This radical disembedding from the social is another aspect of surveillance capitalism's anti-democratic character" (Zuboff, 2015).

Of course, as this report will show, the very logic of surveillance capitalism runs through other institutional spheres. As David Lyon writes, "not merely have the technolgies of surveillance been hugely upgraded, but surveillance practices are also common to all organizations" (Lyon, 2015), and not least those associated with the security field.

## 1.3 Methodology

Building on this background, we have adopted a interdisciplinary methodology in this report, by mixing political sociology, Science & Technology studies as well as policy and legal analysis to understand the strategies of large technology companies – and more specifically US tech companies – in the post-Snowden context.

In the second part of the report, where we describe and analyze these strategies by looking at specific episodes to underline variations, we draw on the methodological toolbox of contentious politics, a sub-field of political sociology (Tilly & Tarrow, 2015). By "episodes", we mean "bounded sequences of continuous interaction, usually produced by an investigator's chopping up longer streams of contention into segments for purposes of systematic observation, comparison, and
explanation” (p. 39).

To analyze these episodes and track the continuities and changes in the relationship between state actors and private companies with relation to Internet surveillance, we use public positions as expressed or relayed in the media, public hearings, official reports, blog posts. We also look at statements produced as part of national reforms of legal rules attached to intelligence and surveillance, as well as court cases on these issues. Finally, when useful, we also resort to the Snowden archive, look at the technical deployments and offer legal analysis when they help shed light on the strategies of these companies or of state actors.

This desk research is complemented by five interviews, almost all with senior corporate affairs executives in leading US technology companies. Questions asked during interviews touched on:

* the internal dimension of the post-Snowden debates, that is how they affected the way Internet companies approach issues related to Internet surveillance internally, internal procedures surrounding sensitive political matters, policy priorities, etc.

* the relationship of policy officers tasked with handling issues related to security and law enforcement with their counterparts in other companies, or privacy advocates working for advocacy groups, NGOs, etc.

* the effect of post-Snowden debates on the relationship of these firms with states, how they dealt with post-Snowden privacy claims, securization strategies used by state officials to promote greater cooperation between Internet firms and law enforcement and intelligence agencies, etc.

During these semi-structured interviews, conducted in various settings (privately over-the-phone or during a dedicated public conference), we sought to get a better understanding of the power dynamic at play in the contentious episodes that we were studying, try to go beyond the veil of secrecy and public-relation strategy put forth by these actors. Although we were not always successful, in some cases we were able to obtain information that shed new light on behaviors and strategies that were hitherto hard to explain. The internal workings of multinational companies – all the more when we specifically consider their dealings with intelligence and law enforcement agencies – remain for the most part secret, and more time and resources would have been necessary to benefit from more extensive “insider knowledge”.

## 1.4 Research Questions & Outline

Through this report, we sought to answer several research questions:

* The most significant one relates to how the strategies of major Internet firms are debated and decided upon, to locate the spaces of struggles that determine whether a given company in a given context to decide where that company should fall on the cooperation-resistance (to participation to secret state surveillance) axis. We started from the premise that these spaces are disseminated across several social spaces, some internal to the companies or the digital economy sector, some external and occupied by state actors and security professionals, or human rights defenders and privacy advocates, across which senior policy officers in these companies navigate.
* Beyond the spaces and the “where”, we wanted to know “why”, that is what are the factors determining whether these companies collaborate or resist to surveillance; and more specifically what are the effect of the proximity (or lack of thereof) of Internet firms with security professionals on the strategies of the various actors engaged in the controversies. Here, variations can be temporal or spatial, evolving across time or changing depending on which country/region is considered.

* Beyond observable behaviors, this research sought to provide evidence of the fact that the field of state surveillance is exposed to particular effects resulting from it also being a stage, a place where a significant part of the struggle is a public one, relayed by major media outlets. This publicity shapes the actors' strategy, and our analysis will aim to locate instances of “double-dealing”, that is cases “whereby leaders, managers, officials or delegates of a field appear to be acting in a disinterested or principled manner 'for the field' and its values” but are actually serving their own interests (Webb, Schirato, & Danaher, 2002).

* Finally, and perhaps most importantly, this deliverables looks at “post-Snowden surveillance debate” as one of the many battle fronts of a process whereby modern states and associated practices of power are being reconfigured through their relationships with private sector technology firms. In other words, through various assemblages in which the forms of capital associated with surveillance capitalism gain a higher status in the administrative field, the “regimes of surveillance” championed by firms like Google or Faecbook have structural effects that reconfigure the political arrangements that we call the state.

To investigate these questions, we first offer some hypothesis on the “constraint structure” in which large Internet firms evolve. Then, as a way to test these hypothesis and showcase variations in the outcomes of post-Snowden contention of the strategies of these companies, we track several episodes of contention that are reconfiguring the public-private security assemblages in the field of state surveillance in the aftermath of the Snowden disclosures in the US and in France. In the concluding section, we go back to history and political theory to gather key takeaways regarding contemporary public-private assemblages tasked with controlling information flows.
## 2. Hypothesis on the Constraint Structure of Large Internet Firms in Debates on State Surveillance

To begin our inquiry, we propose a “constraints structure” regarding the factors that influence how a firm will fall in the cooperation/resistance spectrum. Based on prior knowledge and working in an inductive approach inspired by “Grounded Theory” (Glaser & Strauss, 1999), we have refined a set of working assumptions. These interdependent factors are exemplified by facts and anecdotes and are aimed at working as a heuristic model as we begin to explore some of our research questions.

### 2.1 Internal corporate culture

“Don’t be evil”. Google’ historic, and naive, company motto is but one illustration of the fact that Silicon Valley public-facing companies built on an image of liberty and altruism historically attached to Internet technologies. As Barbrook & Cameron wrote in their seminal article on the *The Californian Ideology*, this credo is characterised by a “a mix of cybernetics, free market economics, and counter-culture libertarianism” (Barbrook & Cameron, 1995). Even today, according to Christopher Soghoian, a senior policy analyst studying surveillance technologies at the American Civil Liberties Union, “even though they have an awful reputation on consumer privacy issues, when it comes to government privacy, they generally tend to put their users first”. “There’s this libertarian, pro-civil liberties vein that runs through the tech companies.”<fnref n="1" />

On June 6th 2013, The Washington Post and The Guardian released articles, respectively written by Laura Poitras and Glenn Greenwald, revealing the existence of the PRISM program. Greenwald’s article opened with the following lines: “The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian.”<fnref n="2" /> The article stressed that “although the [NSA’s] presentation claims the program is run with the assistance of the companies, all those who responded to a Guardian request for comment on Thursday denied knowledge of any such program.” And indeed, the companies denied the existence of “direct access” of the NSA or the FBI to their servers. They claimed to be following the law, but that they had never heard of such a programme.

For them, the PRISM disclosure opened a long sequence during which through public relations and change in corporate practices, they sought to distance themselves from the US establishment. But although it remained veiled by secrecy, there were also signs that the revelations provoked strong distress from within these companies, with many of their employees being puzzled and shocked to hear that they could indirectly be taking part in the surveillance apparatus on which investigative journalists were shedding light. One of our interviewees, who was working at Yahoo at the time, remembers the suspicious look of many of its colleagues at the time:

> “Something I mostly remember is a lot of shock, a lot of e-mails, a lot of phone calls, from colleagues, from friends asking “what is it exactly you’re doing?” Perhaps a weird

<footnote n="1">1. Quoted in Miller, C. C. (2013, June 13). Secret Court Ruling Put Tech Companies in Data Bind. *The New York Times*. Retrieved from http://www.nytimes.com/2013/06/14/technology/secret-court-ruling-put-tech-companies-in-data-bind.html?pagewanted=all;</footnote>

<footnote n="2">2. Greenwald, G., & MacAskill, E. (2013, June 13). NSA Mines User Data of Facebook, Google and Others. Retrieved March 13, 2018, from https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data</footnote>
look from other teams saying, “well, is it actually legal what you are doing on the fifth
floor?”. So, a lot of questions, [as I was] struggling to reconcile what I was reading in
the press and what I was actually doing” (Appendix 1).

In a sector whose corporate culture is marked by what Boltanski and Chiapello have called the “new spirit of capitalism” (Boltanski & Chiapello, 1999) and that base their public image on the emancipatory potential of new technologies, these revelations may have caused a form of cognitive dissonance. Whether we consider lawyers and other legal workers whose task is to craft and advertise the privacy policies of these companies while balancing human rights with antagonist business objectives, or engineers who identify themselves with the politicised branch of the hacker movement (Coleman, 2011), it is likely that such personnel will exert a form of pressure on the company’s leaders to push for policies that can better respect the rights of their users. This is all the more true that public advocates like Snowden himself tried to stir the political conscience of engineers and computer scientists across the digital sector in his public appearances.<fnref n="3" />

In a more recent illustration, the partnership between the US Department of Defense and Google to provide solutions aimed at analysing drone footage also sparked discontent internally.<fnref n="4" /> During a speech in the Fall of 2017, Eric Schmidt, then still Executive-Chairman at Google-Alphabet, explained that “there’s a general concern in the tech community of somehow the military-industrial complex using their stuff to kill people incorrectly.”<fnref n="5" />

## 2.2 Pressure from human rights field

On of the first elements likely to influence the cooperation-resistance of companies providing some
forms of public utilities is the pressure exerted by public groups devoted to the protection of human
rights. In the US, the aftermath of the first Snowden disclosures, NGOs like the Electronic Frontier
Foundation, which have historically nurtured strong ties with Silicon Valley companies, engaged in
various strategies aimed at pushing them to adopt resistance strategies, for instance by beefing up
their encryption standards.

These episodes where private companies are exposed to pressure form the human rights field can
have a lasting impact on their stance and position vis-à-vis law enforcement. If a companies has a
record of handling human rights scandal, it is more likely to have developed internal procedures and
codes of conduct aimed that pursuing their business interests while conforming to international
human rights standards.

One interesting example is Yahoo. The Snowden disclosures revealed that, in 2007, Yahoo resisted its enrolment into the PRISM programme. In front of the Foreign Intelligence Surveillance Court (FISC), the company argued that it should be able to offer some transparency to its users on the amount of data handed over to the FBI by virtue of so-called National Security Letters, which went against the no-disclosure requirements. The stand-off eventually led the FBI to threaten Yahoo of a

<footnote n="3">3. See, e.g.: Couts, A. (2014, March 10). Edward Snowden at SXSW: Encryption is the answer to NSA surveillance. Retrieved February 17, 2018, from https://www.digitaltrends.com/web/edward-snowden-sxsw-2014-speech-live/</footnote>

<footnote n="4">4. Conger, K. (2018, March 6). Google Is Helping the Pentagon Build AI for Drones. Retrieved March 9, 2018, from https://gizmodo.com/google-is-helping-the-pentagon-build-ai-for-drones-1823464533
Conger, K. (2018, May 14). Google Employees Resign in Protest Against Pentagon Contract. Retrieved 15 May 2018, from https://gizmodo.com/google-employees-resign-in-protest-against-pentagon-con-1825729300</footnote>

<footnote n="5">5. Quoted in: Conger, K. (2018, March 6). Google Is Helping the Pentagon Build AI for Drones. Retrieved March 9, 2018, from https://gizmodo.com/google-is-helping-the-pentagon-build-ai-for-drones-1823464533</footnote>
$250 000 fine per day for its non-compliance and to a legal challenge on which we will come back.<fnref n="6" />

So a puzzling question is: what are the factors that can help explain such a resistance? At this stage, these are just hypothesis, but it is worth noting that in 2005, Yahoo became embroiled in an intense scandal when the company chose to hand over personal information it held over a Chinese dissident named Shi Tao, leading to Shi's arrest, incarceration and subsequent condemnation to a 10-year jail term. This episode turned into a public relation disaster. In 2006 and 2007, it led to litigation and public hearings at the US Congress. In front of a panel where members attacked Yahoo's co-founder Jerry Yang, accusing the companies executives of being “moral pygmies” and asking them to “beg for forgiveness” to Shi's mother who was in attendance on that day.<fnref n="7" /> Parallels were also made by Congress members with the Holocaust.

During this episode, Yahoo pledges to be working with human rights organizations on an industry code of conduct aimed at protecting human rights. It would eventually lead to a pan-industry commitment to joining the Global Network Initiative. According to one of our interviewees who worked at Google:

> "Yahoo! was the first company to implement a program that was a Human Rights program, so you had a department within the company where you would have called some people that were hired to review a lot of the policy decisions on data, on surveillance, some on advertising, depending on the exact scope, to think about all those issues from a Human Rights angle in a systematic way" (Appendix 1).

What is for sure is that by the time the FBI required Yahoo to join the PRISM programme, the company had been embroiled in a hard-hitting scandal and many of its lawyers and executives were necessarily very sensitive to the human rights implications of collaborating with law enforcement and intelligence agencies, and were in a strong positions to plead for resistance.

But the case of Yahoo also illustrates how rapidly these strategies can shift. Eventually, Yahoo lost its case before the FISC and in the first 10 months of 2013, Yahoo users were the most targeted in the combined requests sent by both the NSA and the FBI.<fnref n="8" /> Also, in 2016, Reuters reported based on testimonies by inside sources that the board of the company had responded favourably to a request of the NSA to install a scanning device on its data centers to monitor the content of messages. The Chief Technology Officer was not informed of this operation and allegedly resigned when he became aware of the scheme (see below).<fnref n="9" />

## 2.3 User trust and business stakes

Companies operating in competitive markets, even when they are in dominant positions, are usually more dependent on the trust of their users. This is all more true in the digital sector where, as teams at Google are used to say, “competition is just one click away”.

<footnote n="6">6. Zetter, K. (2014, September 11). Feds Threatened to Fine Yahoo $250K Daily for Not Complying With PRISM. Retrieved March 13, 2018, from https://www.wired.com/2014/09/feds-yahoo-fine-prism/</footnote>

<footnote n="7">7. AP, (2007, November 7). Yahoo Criticized in Case of Jailed Dissident. *The New York Times*. Retrieved from https://www.nytimes.com/2007/11/07/technology/07yahoo.html</footnote>

<footnote n="8">8. Kelion, L. (2014, February 4). Tech firms detail NSA-FBI demands. *BBC News*. Retrieved from http://www.bbc.com/news/technology-26031092</footnote>

<footnote n="9">9. Reuters. (2016, October 4). Yahoo secretly scanned customer emails for US intelligence-sources. Retrieved October 5, 2016, from http://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSKCN1241YT</footnote>
At the peak of the Snowden controversy, leaders of the US digital sector became wary of the impact of the revelations on their short-term and long-term business prospects. Groups like EFF were informing the public about alternatives to dominant services through its “PRISM break” website, documenting of the free software, decentralized alternatives to dominant services.<fnref n="10" /> Abroad, other large companies and public officials were stressing the need for national institutions and critical service and infrastructure providers to review their data management policies, and move away from US-based providers and relocate their data – an attempt at restoring “digital sovereignty” that has been denounced as “digital nationalism” by critics (Chander & Lê, 2015; Bauer, Lee-Makiyama, van der Marel, & Verschelde, 2014; for a critique of arguments in favour of digital nationalism, see Kuner, 2015).

For the computing and IT industry, this caused much concern. Think tanks and trade groups in Washington drafted reports on the potential financial losses of the Snowden debacle.<fnref n="11" /> Companies like Google and Facebook insisted on the importance of restoring their “users’ trust” and staged their commitment to protecting their users’ rights. Their initial reaction was to denounce a misrepresentations and exaggerations in the commentaries offered on PRISM (as Google's CEO and Chief Legal Officer wrote at the time, “the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday.”).<fnref n="12" /> They also claimed that they followed legal procedures (“we provide user data to governments only in accordance with the law. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process”). And finally, they asked for more transparency (“this episode confirms what we have long believed— there needs to be a more transparent approach”), and even staged these demands(Google's Chief Legal Officer, David Drummond, wrote an open letter to the offices of the Attorney General and the Federal Bureau of Investigation asking for transparency on the number of National Security Letters it received, and what data was served in response).<fnref n="13" /> As one Microsoft interviewee puts it:

> “The question of trust really went on the top of the discussion with the customers, with the government (not only the agencies but also the policy-makers), because at that time they realised that this question of trust could impact a lot the development of technology across the world” (Appendix 1).

But business interests can also push a company to indirectly cooperate with law enforcement, by providing new avenues for surveillance. For instance, Web 2.0 around 2005 and the “movement of the cloud” prominent around 2010 were not only a marketing phenomenon, but also an industry trend that led major Internet firms to concentrate hosting capacities (Mosco, 2014), thus theoretically reducing the transaction costs associated with state surveillance (law enforcement agencies have fewer actors to whom they can send request, allowing for smoother processes). Today, so-called “Big Data”, “Artificial Intelligence” and “Machine Learning” represent new technical and business paradigms for which companies in the IT sector invest a lot of money in

<footnote n="10">10. See https://prism-break.org/en/</footnote>

<footnote n="11">11. See, e.g., Bauer, M., Lee-Makiyama, H., van der Marel, E., & Verschelde, B. (2014). *The Costs of Data Localisation: Friendly Fire on Economic Recovery* (ECIPE Occasional Paper No. 12). Brussels: European Centre for International Political Economy. Retrieved from http://www.ecipe.org/app/uploads/2014/12/OCC32014_1.pdf</footnote>

<footnote n="12">12. Drummond, D. (2013, June 11). Asking the U.S. government to allow Google to publish more national security request data. Retrieved March 13, 2018, from https://googleblog.blogspot.com/2013/06/asking-us-government-to-allow.google-to.html</footnote>

<footnote n="13">13. Idem.</footnote>
R&D.<fnref n="14" /> By doing so, they nurture innovations that will be appropriated by law enforcement and intelligence agencies for their surveillance apparatuses. Research & Development is a major locus of the hybridization of public and private actors in the security field, and holds a prominent place in the history of the Internet (Levine, 2018).

## 2.4 Regulatory stakes

A series of regulatory stakes can also be a factor determining the room for manoeuvre of Internet firms. Multinational companies in the digital economy are indeed exposed to a number of regulatory stakes that can push them towards cooperation with state surveillance actors (McChesney, 2013).

For instance, such cooperation can be a way to gain backing and support from public authorities on regulatory issues that are seen as key for the company. Large players in the digital economy are particularly exposed to antitrust legislation and more generally competition law, but also to issues such as taxation, copyright law, privacy standards, etc.

At the international level, attention to regulatory stakes can also enable various forms of support, be it diplomatic backing in the context of trade negotiations (Powers & Jablonski, 2015) or even more simply access to relevant intelligence. For instance, in the context of the negotiations on the EU-US Privacy Shield, which regulates the transfer of personal data belonging to EU citizens from Europe (point of collection) to the US (point of storing), the US Department of Commerce defended the interests of the US digital sector, and likely developed its negotiating strategies in close partnerships with the leading corporations of the digital sector.

## 2.5 Identification to and dependency on power elite

In trying to understand the likelihood of a given company to resit to or cooperate with state surveillance, and important question to consider is the sociology of its stakeholders and chief executives.<fnref n="15" /> Silicon Valley firms have a reputation of having leaders that are overtly defiant of traditional political circles, and sometimes stage a West Coast / East Coast opposition.<fnref n="16" /> And as soon as cooperation leads to loss in user trust and starts undermining a company's financial prospects, stakeholders and investors might also push towards resistance, especially when there is public pressure coming from the human right field.

One interesting hypothesis that can't be explored in the context of this deliverable is whether the opening of a company's stock to external and institutional investors reinforces the incentive for cooperation, and/or a move towards a more traditional type of management, with executives that

<footnote n="14">14. Levy, S. (2016, June 22). How Google is Remaking Itself as a “Machine Learning First” Company. Retrieved June 29, 2016, from https://backchannel.com/how.google-is-remaking-itself-as-a-machine-learning-first-company-ada63defcb70#.9cckskrs9</footnote>

<footnote n="15">15. Pour rappel : en décembre 2014, dans les entreprises citées dans PRISM, nombre d'entre elles se situaient dans le peloton de tête des plus hautes valorisations boursières de l'économie américaine. Apple, qui aime rappeler ses origines contre-culturelles, détient ainsi la première place, suivie de près par Microsoft (3ème) et Google (4ème).</footnote>

<footnote n="16">16. For instance, regarding Apple, see: Lesne, C. (n.d.). Tim Cook et les « valeurs » de la Vallée. Retrieved February 26, 2016, from http://www.lemonde.fr/ameriques/article/2016/02/25/tim-cook-et-les-valeurs-de-la-vallee_4871702_3222.html</footnote>

<footnote>Panzarino, M. (2015, June). Apple's Tim Cook Delivers Blistering Speech On Encryption, Privacy. Retrieved June 15, 2015, from http://social.techcrunch.com/2015/06/02/apples-tim-cook-delivers-blistering-speech-on-encryption-privacy/</footnote>

<footnote>Romm, T. (2015, August 27). Apple Takes Washington. *Politico Magazine*. Retrieved from http://www.politico.com/magazine/story/2015/08/tim-cook-apple-washington-politics-121821</footnote>
have been socialized in the same milieu as administrative and political elites. This is for instance a
point made by WikiLeaks founder, Julian Assange, regarding Google/Alphabet's Eric Schmidt and
other senior executives at Google, whose professional or personal trajectories are closely
intertwined with personnel of the US State Department (Assange, 2014). This is also something
pointed out Frank Pasquale, who points out that "the Silicon Valley, the highest financial sphere in
New York and the pinnacle of military intelligence form a block that is increasingly unified"
(Pasquale, 2015). We will come back to this issue later on. For now, let us mention some of the
factors that may push for greater interdependencies between the tech industry and the state's
security apparatus.

## 2.6 Firm's dependence on public procurements

A firm's final decision on whether or not to collaborate might depend on how much of its revenues are dependent on public tender tied to the defense and security sector. Such business dependency is true of companies that have developed a strategy for "large accounts" customers – for instance, Microsoft extracts around 2bn euro from European public-sector entities every year –,<fnref n="17" /> and who are regular bidders for technology-related public tenders. For instance, in October 1992, during the first so-called "Crypto War", as AT&T was about to market its first publicly-available telephone terminals equipped with encryption features, the head of the FBI, was able to call AT&T's CEO to offer a him a deal: Rather than use the encryption system developed by AT&T's own engineers, Sessions proposed that the telco giant instead use a system developed by the NSA and the National Institute of Standards and Technology (NIST) – a system that would become known as the "Clipper Chip" (Levy, 2001). The FBI's key asset in this bargain was of course the purchasing power of the state, as AT&T was then renegotiating a contract with the federal government that was worth over $10bn. More recently, in 2007, a former Qwest Communications International executive alleged that the government retaliated to the company's refusal to join a surveillance program by revoking opportunities for hundreds of millions of dollars (the government refused to comment on the executive's allegations).<fnref n="18" />

But such dependence is not only true of large multinationals. Small tech companies – some of
which appear in our graph – can also become strongly related to national security professionals. In
the surveillance field, it is particularly the case of smaller companies providing software analytics
solutions, like Qosmos or Palantir, or even SMEs infused with a particular “hacker ethos” and
specialized in the trade of software vulnerabilities, like HackingTeam or Vupen, or in “spyware”
devices. Because of their technical know-how, these companies have developed strong relationships
with some of the most powerful intelligence agencies. We can assume that such mutual dependency
results overtime to an homogenization of the involved actors’ dispositions.

Another important aspect to the emergence of a "surveillance-industrial complex" (Ball & Snider, 2014) is the role of the army and intelligence community in developing or funding technologies that will become key assets for US firms. In other words, they do not act only as provider of technology with the government, but the later can use federal R&D budgets and other funding programs to act a

<footnote n="17">17. Schumann, H., & Simantke, E. (2017, May 13). Europas fatale Abhängigkeit von Microsoft. Retrieved February 13, 2018, from http://www.tagesspiegel.de/weltspiegel/sonntag/cyber-attacken-auf-staatliche-it-europas-fatale-abhaengigkeit-von-microsoft/19628246.htmlID</footnote>

<footnote n="18">18. Shane, S. (2007, October 14). Former Phone Chief Says Spy Agency Sought Surveillance Help Before 9/11. The New York Times. Retrieved from https://www.nytimes.com/2007/10/14/business/14qwest.html</footnote>
prescriber and incubator of relevant technologies. One oft-cited example in this regard is the Central Intelligence Agency (CIA)'s venture capital firm In-Q-Tel.<fnref n="19" /> Another example is the NSA's Technology Transfer Program (TTP), which is part of the Office of Research and Technology Applications. The program is used to make technologies like firewalls, new cryptology tools and other technologies available to the private sector. The NSA says that the TTP has contributed $346 million to the US' GDP in the past decade, and has created around 1 300 jobs.<fnref n="20" /> Of course, these trends are not specific to the US. For instance, in the EU, R&D research programmes are also a major locus of public-private hybridization in security policy (Bigo, Jeandesboz, Martin-Mazé, & Ragazzi, 2014; Siokas, 2018).

## 2.7 Criminal sanctions

The last factor is a tool that states can use to force cooperation, namely criminal sanctions targeting tech companies who would refuse to comply.

In the US, failure to abide to surveillance request – conveyed either through a National Security letter or a FISA court order – is punishable by law, as companies like Yahoo and Lavabit have come to know. The FISC's rule of procedure provide that “if a person or entity served with a Court order (the "recipient") fails to comply with that order, the government may file a motion for an order to show cause why the recipient should not be held in contempt and sanctioned accordingly.”<fnref n="21" /> Dissuasive fines may be imposed, but jail sentences are also theoretically in order.<fnref n="22" />

Companies might react differently to the possibility of being found in “contempt of court” and therefore sanctioned, but the likely outcome is obedience. Although an appeal to the Foreign Intelligence Review Court (FISCR) is possible, such appeals are rare. As of 2008, only two rulings has been issued by the court, the second of which resulted from Yahoo’s insistence. According Judge Reggie Walton – the presiding judge of the FISA court who wrote in July 2013 a lengthy reply to questions by Congress members –, this is was the first and only time that a company had ever argued before the FISCR.<fnref n="23" /> This was to no avail, however, as the FISCR asserted the constitutionality of the Protect America Act of 2007’s provisions that lifted the warrant requirement for the surveillance of foreign intelligence targets “reasonably believed” to be outside the United States).<fnref n="24" /> According to the judge:

> “Notwithstanding the parade of horribles trotted out by the petitioner, it has presented no evidence of any actual harm, any egregious risk of error, or any broad potential for abuse. (...) Our decision [to uphold the contentious provisions of the Protect America

<footnote n="19">19. Yannuzzi, R. E. (2007). *In-Q-Tel: A New Partnership Between the CIA and the Private Sector*. Central Intelligence Agency.</footnote>

<footnote n="20">20. New NSA technology goes on sale. (2017, July 19). Retrieved March 13, 2018, from https://www.intelligenceonline.com/government-intelligence/2017/07/19/new-nsa-technology-goes-on-sale,108255127-bre</footnote>

<footnote n="21">21. United States Foreign Intelligence Surveillance Court Rules of Procedure. http://www.uscourts.gov/sites/default/files/Rules%20of%20the%20Foreign%20Intelligence%20Surveillance%20Court.</footnote>

<footnote n="22">22. Palmer, B. (2013, June 13). What Happens When You Defy a Secret Government Order? *Slate*. Retrieved from http://www.slate.com/articles/news_and_politics/explainer/2013/06/nsa_surveillance_what_if Google and verizon re-fused_to_hand_over_data.html</footnote>

<footnote n="23">23. The letter is available at: https://www.leahy.senate.gov/imo/media/doc/Honorable%20Patrick%20J%20Leahy.pdf</footnote>

<footnote n="24">24. *In re Directives [redacted text]* Pursuant to Section 105B of the *Foreign Intelligence Surveillance Act*, n°. 08-01 (Foreign Intelligence Surveillance Court of Review, Jan 15, 2009). Available at https://fas.org/irp/agency/doj/fisa/fiscr082208.pdf</footnote>
Act] recognizes that where the government has instituted several layers of serviceable safeguards to protect individuals against unwarranted harms and to minimize incidental intrusions, its efforts to protect national security should not be frustrated by the courts”.<fnref n="25" />

Under those circumstances, using legal avenues to resist a FISC court order seems almost certain to fail.

The other secret procedure often used for surveillance purported by US intelligence agencies are “National Security Letters.” National Security Letter (NSL) are an administrative subpoena created in 1978 and issued by the FBI without any judiciary approval. NSL often come with a non-disclosure clause that forbids the recipient from revealing the content and the very existence of the letter, except to a lawyer (so-called “gag order” provisions).

Companies have sometimes challenged NSL, and sometimes managed to strike down the “gag order” (Brust, 2012; Manes, 2015; Weinstein, 2015). For instance, in 2004, a small New York-based ISP called Calyx Internet Access Corporation created in 1994 to serve nonprofit organizations and alternative media outlets challenged a gag order received. This was the first of three lawsuits that put NSL in the spotlight and the growing abuse of the system following changes introduced by the 2001 PATRIOT Act. A 2006 report by the Department of Justice’s Attorney General also found that the FBI had “used NSLs in violation of applicable NSL statutes, Attorney General Guidelines, and internal FBI policies” (Doyle, 2015).

<figure><img src="image_3.png" /></figure>

<footnote n="25">25. Idem.</footnote>
As we will see, NSL have been one of the focus of post-Snowden surveillance reform in the US, and they have become a better avenue for resisting surveillance orders, or at least giving them more publicity.

A third legal avenue for surveillance are search, issued by a court. In the midst of the Snowden debate, in the summer of 2013, the Texas-based encrypted email service Lavabit was thus ordered to give to the FBI the private keys of its Secure Sockets Layer (SSL) system, so as to enable the government to monitor the communications of Lavabit's most famous customer: Edward Snowden. Lavabit's founder and operator, Ladar Levison, refused to comply and was forced – not after FBI attempts at dissuading him from such a move – to shut down its business.<fnref n="26" />

In France, the 2015 Intelligence Act provides no clear legal avenue for companies would like to challenge surveillance requests, but an appeal before the Council of States is theoretically possible. There is however no indication of such lawsuit, while there is multiple evidence that large telecom firms like Orange have complied with surveillance requests whose legality was extremely doubtful, e.g. for the development of the DGSE extensive surveillance program from 2008 on or to help domestic intelligence spy on investigative journalists (Tréguer, 2016a, 2016b). The law however criminalizes the fact of refusing to comply with a surveillance order is punished by a two-year imprisonment term and a €150 000 fine (article L. 881-2 of the Code of Internal Security, or CIS). The same sentences apply to unauthorized disclosures regarding the "existence of the deployment" of a given surveillance technique (article L. 881-1 CIS). We have found no evidence that such sanctions have ever been used.

Similarly in the UK, during the parliamentary debate on the 2016 Investigatory Powers Act, a legal obligation on companies to assist UK intelligence and law enforcement agencies' surveillance activities was also created. The Act also contains a new criminal offence for these companies or their personnel to reveal that data has been requested.<fnref n="27" />

<footnote n="26">26. Zetter, K. (2016, March 17). A Government Error Just Revealed Snowden Was the Target in the Lavabit Case. Retrieved February 15, 2018, from https://www.wired.com/2016/03/government-error-just-revealed-snowden-target-lavabit-case/</footnote>

<footnote n="27">27. See: UK Government, 2016, "Investigatory Powers Bill: Obligations on Communications Service Providers". Available at: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/530557/Obligations_on_CSPs_Factsheet.pdf</footnote>
### 3. (Re)configuration of Public-Private Assemblages in Internet Surveillance: Case-Studies

In this section, we apply this framework of constraint structure developed in the previous section to understand the strategies of private and state actors in the aftermath of the Snowden disclosures. Constraint structures vary in time, space and according to the business sector and the company under consideration. In what follows, we focus on two different settings, namely the United States and France, and large consumer-facing online service providers.

#### 3.1 US: “Big Tech” stages resistance

In the private sector, the most spectacular reactions to the Snowden disclosures undoubtedly came from large online services providers. As already mentioned, some of the first disclosures on the PRISM program led these companies to being accused of actively collaborating with US intelligence outside of any legal framework. But other would follow, for instance the MUSCULAR programme were the same companies were pointed at for weak computer security practices that allowed the NSA to collect their traffic at it moved across their data centers spread out across the world.<fnref n="28" />

Of course, these online service providers were not the only companies being put in the spotlight. Even before Snowden, revelations pointing to the cooperation of companies like AT&T with the NSA surveillance programs had made the headlines. Such revelations – especially those of whistleblower Mark Klein from 2006 on –, were even the source of an amendment passed in the summer of 2008 to give retroactive immunity for the telecom companies that had engaged in these actions outside of any clear legal framework (Wagner, 2009). The Snowden disclosures only added to existing evidence.<fnref n="29" />

But for large online service providers, the Snowden disclosures and the scandal that ensued was a first. As already mentioned looking at Google's initial response, the allegations that the US government had direct access to these companies servers did not fare well. As one of our interviewees at Facebook put it, “there was a lot of shock and surprise and the fact that these allegations were being made and the fact that the US government was not correcting them” (Appendix 1).

The internal corporate culture, external pressure from the human rights field as well as the fear of losing user's trust led these companies to roll out a multi-pronged resistance strategy.

<footnote n="28">28. Peterson, B. G., Ashkan Soltani, and Andrea. (2013, November 4). How we know the NSA had access to internal Google and Yahoo cloud data. *Washington Post*. Retrieved from https://www.washingtonpost.com/news/the-switch/wp/2013/11/04/how-we-know-the-nsa-had-access-to-internal-google-and-yahoo-cloud-data/</footnote>

<footnote n="29">29. See, e.g.: Gallagher, R., & Moltke, H. (2016, October 16). The NSA's Spy Hub in New York, Hidden in Plain Sight. Retrieved November 17, 2016, from https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-york-hidden-in-plain-sight/</footnote>

<footnote>Koop, P. (2015, August 31). FAIRVIEW: Collecting foreign intelligence inside the US. Retrieved September 8, 2015, from http://www.matthewaid.com/post/128102123831/the-nsa-att-fairview-global-fiber-optic-cable</footnote>
## Multi-pronged resistance in the aftermath of Snowden

Resistance took different forms. Here we make a distinction between technical resistance, legal resistance, and political resistance.

### Technical resistance

Technical resistance is probably the most significant response brought by the Tech industry, one that would have the most significant impact at the operational level for intelligence and law enforcement agencies.

**Counter-measures:** In the immediate aftermath of Snowden, many of these companies accelerated the rolling-out of encryption and other computer security features that had been lingering on for years. Ensuring SSL/TLS connections for all these companies products, offering users encryption features on their terminals (smartphones especially), rolling out end-to-end encryption of communications content, etc.: Google, Microsoft, Facebook, Apple significantly increased the level of computer security on their products and servers. To give just a snapshot of these trends, Yahoo announced through a blog post of its Chief Information Security Official a series of new features in April 2014 that exemplifies the wider industry response:

> "When I joined Yahoo four weeks ago, we were in the middle of a massive project to protect our users and their data through the deployment of encryption technologies as we discussed [in November 2013].

> So today, we're updating you on our progress:

* Traffic moving between Yahoo data centers is fully encrypted as of March 31.

* In January, we made Yahoo Mail more secure by making browsing over HTTPS the default. In the last month, we enabled encryption of mail between our servers and other mail providers that support the SMTPTLS standard.

* The Yahoo Homepage and all search queries that run on the Yahoo Homepage and most Yahoo properties also have HTTPS encryption enabled by default.

* We implemented the latest in security best-practices, including supporting TLS 1.2, Perfect Forward Secrecy and a 2048-bit RSA key for many of our global properties such as Homepage, Mail and Digital Magazines. We are currently working to bring all Yahoo sites up to this standard.

* Users can initiate an encrypted session for Yahoo News, Yahoo Sports, Yahoo Finance, and Good Morning America on Yahoo (gma.yahoo.com) by typing "https" before the site URL in their web browser.

* A new, encrypted, version of Yahoo Messenger will be deployed in coming months<fnref n="30" />.

Following the revelation of the MUSCULAR program in late-October 2013, Google issued a swift

<footnote n="30">30. Stamos, A. (2014, April 2). Status Update: Encryption at Yahoo. Retrieved February 17, 2018, from https://yahoo.tumblr.com/post/81529518520/status-update-encryption-at-yahoo</footnote>
response the next month by announcing to start encrypting of its traffic between its data centers.<fnref n="31" />
People in charge of information security at Google responded to the news with anger and defiance.
As the news about MUSCULAR started to emerge, Google security team engineer Brandon
Downey wrote a post on its blog expressing his “personal opinion”; “Fuck these guys”. A few days
later, another Google security engineer, Mike Hearn, announced the following:

> “I now join [Downey] in issuing a giant Fuck You to the people who made these slides. I am not an American, I am a Brit, but it's no different – GCHQ turns out to be even worse than the NSA... The traffic shown in the slides is now all encrypted and the work the NSA/GCHQ staff did on understanding it, ruined.”<fnref n="32" />

In these “personal” take on the matter, resistance is clearly displayed, and it is such reactions that made the news then. But if took a matter of days or months for these companies to upgrade their policies and practices after the Snowden disclosures, why had not they been established before? When asked these questions, our interviewees would use the same justifications as those issued at the time: these efforts at beefing up their information security standards had been underway for quite some time even before the Snowden disclosures. For instance, a high-level public affairs director at Microsoft claims that “we were already working on the security and we had made at this time already a lot of investment” (Appendix 1). A Google executive argued that “Google didn’t necessarily make any changes, although it certainly accelerated ongoing efforts that already existed at the time in terms of security (...) and educating its users” (idem). According to Rubinstein and Van Hoboken (2014) these technological fixes were a way to ensure that surveillance of their users’ communication would happen with their knowledge and assent, thereby reinforcing their position in the security field.

**Pressure from human rights and computer security fields:** These moves were called for by NGOs like EFF who called for and tracked progress regarding computer security at leading US tech firms through “scorecards,” but also prominent public advocates like Edward Snowden himself, who regularly called on these companies to act to make surveillance more difficult through encryption. In October 2014, Snowden addressed technology professionals at the South by Southwest festival. In addition to a “policy response” to mass surveillance, he insisted that:

> “there’s also a technical response. And it’s the makers, it’s the thinkers, it’s the development community that can really crack those solutions to make sure we’re safe. You guys who are in the room now are all the firefighters. And we need you to help fix this.”<fnref n="33" />

The moves of these companies towards technical resistance need to be located in the more global context of the wake-up call that the Snowden disclosures issued to the “field of computer security;” dominated by actors with a strong technical capital, working as computer engineers, system administrators, cryptographers, etc. They are the social group that better grasps the technical intricacies of the modern-day surveillance, helping other actors to make sense of the Snowden

<footnote n="31">31. Miller, Rich. (2013, September 9). Google Boosting Encryption Between Data Centers. Retrieved 13 May 2018, from http://www.datacenterknowledge.com/archives/2013/09/09/google-boosts-encryption-between-data-centers</footnote>

<footnote n="32">32. Gallagher, S. (2013, November 6). Googlers say “F*** you” to NSA, company encrypts internal network. Retrieved May 26, 2015, from http://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/</footnote>

<footnote n="33">33. Couts, A. (2014, March 10). Edward Snowden at SXSW: Encryption is the answer to NSA surveillance. Retrieved February 17, 2018, from https://www.digitaltrends.com/web/edward-snowden-sxsw-2014-speech-live/</footnote>
documents while engaging in a sustained effort aimed at improving computer security.

An important subgroup of the field are independent actors developing technical counter-measures, increasing the cost of surveillance through decentralized architectures and/or the use of cryptography. These tools are developed by small independent companies or non-profit collectives who typically display a “hacktivists” ethos, with the aim of democratizing the resort to such alternative tools. And to an extent it succeeded. It is often thanks to these small independent hacker collectives that tech multinationals were able to improve the security of their products and services. For instance, Facebook announced the experimentation of PGP encryption for email notifications with end-users. To do so, the company relied on a software developed by the open source GnuPG encryption project, which had been stalled for years due to lack of funding and benefited from $50,000 donation by Facebook in mid-2015.<fnref n="34" /> Facebook messaging tools and that of its subsidiary WhatsApp also began to use an end-to-end encryption solution called TextSecure developed by the small company called Open Whisper Systems, which develops Signal, a messaging application.<fnref n="35" />

Other important subcategories in the field of computer security which had a significant impact on these developments in the private sector include engineering professional groups (e.g. IEEE), cybersecurity experts (like CERTs) and Internet governance fora (in charge of developing or promoting Internet standards IETF or ISOC). While some of these groups had long warned about the surveillance capabilities of intelligence agencies, others have received the Snowden controversy as a wake-up call and launched new initiatives aimed at boosting computer security (Rogers & Eden, 2017). As recognized institutions dominated with a scientific ethos, these actors played an important role in bringing certification to the political claims of hacker collectives.

The overall effect of the Snowden disclosure, it seems, was to significantly increase the weight of the “computer security” field relative to other fields involved in post-Snowden controversies on surveillance, and therefore of the multipositioned actors present in this field in the other social settings in which they evolved. To keep afloat as the whole field was upgrading the “state of the art” of computer security to reflect the knowledge gains associated with the Snowden disclosures, large online service providers had some catching up to do, and accelerated technical developments that had been in the making but were arguable already overdue. In the post-Snowden context, NGOs, hackers, standard-making bodies collaborated with industry players, e.g. with the creation of Internet Security Research Group (ISRG) which set up “Let’s Encrypt” campaign aimed at speeding up the development of encryption in Web browsing.

Technical resistance coming from large multinationals and the wider “computer security field” has apparently had a strong effect on the surveillance capacities of law enforcement and intelligence agencies, leading to revived controversies on encryption as we will see. According to General James Clapper, then the US Director of National Intelligence, “as a result of the Snowden revelations, the onset of commercial encryption has accelerated by seven years”.<fnref n="36" /> Clapper said he based his

<footnote n="34">34. Moody, G. (2015, June 1). Facebook users can now add OpenPGP keys for improved email security. Retrieved June 1, 2015, from http://arstechnica.co.uk/security/2015/06/facebook-users-can-now-add-openpgp-keys-for-improved-email-security/</footnote>

<footnote n="35">35. moxie. (2014, November 28). Open Whisper Systems partners with WhatsApp to provide end-to-end encryption. Retrieved February 17, 2018, from https://signal.org/blog/whatsapp/</footnote>

<footnote n="36">36. McLaughlin, J. (2016, April 25). Spy Chief Complains That Edward Snowden Sped Up Spread of Encryption by 7 Years. Retrieved May 2, 2016, from https://theintercept.com/2016/04/25/spy-chief-complains-that-edward-snowden-sped-up-spread-of-encryption-by-7-years/</footnote>
comments on NSA forecasts issued three years earlier.

<figure><img src="image_4.png" /></figure>

Percentage of Web Pages Loaded by Firefox Using HTTPS (source : Let's Encrypt).

Legal resistance

Another front of resistance of large online service providers is litigation. And here, we can see three
main fronts in the litigation strategies set forth by these companies to alleviate surveillance
capabilities: transparency, encryption and access to data held in the cloud.

**Litigating for transparency:** The first was a demand that was made really early after the first disclosures. It consisted in decreasing the level of secrecy surrounding the requests issued by law enforcement and intelligence agencies to these companies. For instance, Yahoo filed a case before the FISC with the aim to declassify its 2008 challenge, which it said would show that it had sought to resist its inclusion in the PRISM program and point to some of the ways in which the court by narrow down the range of information sought after by the government.<fnref n="37" />

With regards to detailed statistics about national security surveillance, the legal fight had also started before, and was only made more visible in the aftermath of Snowden. As previously mentioned, the gag orders often attached to National Security Letters and FISA warrants was one of the main criticism issued against this legal avenue for surveillance requests, and that debate had been going on since the mid-2000s. Some progress was being made. For instance, in March 2013, Google was able to report on the first aggregate amounts of NSL that it received, and the number of users affected by incremental range of 1,000.<fnref n="38" /> But in the aftermath of Snowden, many of the problems identified with NSL and the FISA requests only became more acute. Through court action and litigation, and alongside NGOs like EFF, tech companies tried to enact meaningful changes in this field. In June 2013, Microsoft and Google joined efforts to file a lawsuit before the FISC to ask the court to be able to disclose some data about the data requests authorized by the court.<fnref n="39" />

<footnote n="37">37. Ackerman, S. (2013, July 30). Justice Department to declassify key Yahoo surveillance orders. Retrieved February 19, 2018, from http://www.theguardian.com/world/2013/jul/30/justice-department-declassify-yahoo-surveillance-orders</footnote>

<footnote n="38">38. Transparency Report: Shedding more light on National Security Letters. (n.d.). Retrieved February 19, 2018, from https://googleblog.blogspot.com/2013/03/transparency-report-shedding-more-light.html</footnote>

<footnote n="39">39. Arthur, C. (2013, June 28). Microsoft joins Google in demanding to disclose FISA requests. Retrieved February</footnote>
While doing so, they also started releasing information about aggregates of the number of data requests they had received in the previous month to correct the impression resulting from the PRISM media coverage alleging that US intelligence had unlimited access to these companies' servers. For instance, Facebook and Microsoft's disclosures covered the second half of 2012: Facebook said it received between 9,000 and 10,000 requests from federal, state and local authorities for customer data during that period, while Microsoft said it received between 6,000 and 7,000. The numbers blended for the first time NSL and FISA requests.

Such disclosures had been validated by the FBI and the Department of Justice. Through the FISA lawsuit introduced by Google and Microsoft, these companies and the US government managed to strike a deal in January 2014 to give separate aggregate number for FISA requests and NSL. The deal also allowed the company to break down FISA requests to indicate whether the requests were related to the content of accounts or non-content information (such as subscriber name). “The administration is acting to allow more detailed disclosures about the number of national security orders and requests issued to communications providers, the number of customer accounts targeted under those orders and requests, and the underlying legal authorities,” attorney general Eric Holder and director of national intelligence James Clapper said in a joint statement. The announcement echoes Barack Obama’s speech of January 14th, 2014 in which the president had called for “new reporting methods” whereby “communications providers will be permitted to disclose more information than ever before to their customers.”<fnref n="40" />

But the deal remained a small step forward. As the Guardian reported, “the disclosures are to be nonspecific, listed by the thousand and subject in some cases to a six-month delay – speaking to the large quantities of data that the government still plans on collecting from its technology partners. In order to be more specific about the amount of data turned over, the companies must be less specific about the type of data it is. The deal also explicitly points to a delay of up to two years on revealing information on data collected under surveillance programs the National Security Agency may yet develop.”<fnref n="41" />

**Litigating for strong encryption:** Another major litigation effort came in the wake of the terrorist attack of San Bernadino in December 2015, when the FBI sought to force the “cooperation” of Apple in developing codes aimed at circumventing the full-disk encryption features that had been rolled out as part of the firm’s technical resistance in the aftermath of Snowden (note that only the data of the five days prior to the attack were inaccessible – older data had been synchronized on iCloud and was handed over to US authorities). After the Charlie Hebdo attacks on 2015, mounting criticism against the growing resort to encryption features by the US tech industry came from the French, the British and the US governments.<fnref n="42" /> That sequence reached a peak in the US in late-2015,

<footnote>19, 2018, from http://www.theguardian.com/technology/2013/jun/28/microsoft.google-fisa-united-states-government</footnote>

<footnote n="40">40. McCarthy, T. (2014, January 17). Obama announces new limits on NSA surveillance programs – live reaction. Retrieved February 19, 2018, from http://www.theguardian.com/world/2014/jan/17/obama-nsa-surveillance-reforms-speech-live</footnote>

<footnote n="41">41. Dredge, S. (2013, June 18). Yahoo joins Facebook, Google and others in revealing US surveillance requests. Retrieved February 19, 2018, from https://www.theguardian.com/technology/2013/jun/18/yahoo-reveals-us-surveillance-requests-nsa</footnote>

<footnote n="42">42. Watt, N., & Wintour, P. (2015, January 15). David Cameron seeks cooperation of US president over encryption crackdown. Retrieved from http://www.theguardian.com/uk-news/2015/jan/15/david-cameron-ask-us-barack-obama-help-tracking-islamist-extremists-online

Yadron, D. (2015, January 16). Obama Sides with Cameron in Encryption Fight. Retrieved from http://blogs.wsj.com/digits/2015/01/16/obama-sides-with-cameron-in-encryption-fight/</footnote>
early-2016. In 2014, Apple had extended encryption to text messages and other forms of data on their smartphones, announcing that for all devices running iOS 8 or later version, it would not be able to perform the sort of “data extractions” in response to search warrants. But in the case of the San Bernardino attacker’s iPhone, Apple was presumably still able to bypass the encryption by developing some bits of code. Using a 1789 statute providing the court extensive authority, the FBI therefore sought to force Apple into developing it.43 During this sequence, much of the computer industry and telecom companies like AT&T intervened in the case in defence of Apple.44 Blackberry and Bill Gates, Microsoft’s retired founder, were some of the few exceptions.45 As Gates was making the news as “backing the FBI” in the ongoing dispute,46 Microsoft President and Chief Legal Officer Brad Smith insisted that “trust is the absolute foundation of our entire industry”, and that strong encryption was one of the way of restoring it.47

Here again, tech firms that got involved in the debate would count on the support of the wider “computer security” field, who saw encryption has absolute necessity, and joined in the debate to bring certification to the companies’ claims. A key development in this regard was the publication of a report by Harvard’s Berkman-Klein Center for Internet & Society, co-authored by people like Joshep Nye or Bruce Schenier (Project, 2016). Published in February 2016, as the Apple-FBI stand-off was ongoing, it presented the following conclusions:

> “Although we were not able to unanimously agree upon the scope of the problem or the policy solution that would strike the best balance, we take the warnings of the FBI and others at face value: conducting certain types of surveillance has, to some extent, become more difficult in light of technological changes (...).

> However, the question we explore is the significance of this lack of access to communications for legitimate government interests. We argue that communications in the future will neither be eclipsed into darkness nor illuminated without shadow. Market forces and commercial interests will likely limit the circumstances in which companies will offer encryption that obscures user data from the companies themselves, and the trajectory of technological development points to a future abundant in unencrypted data, some of which can fill gaps left by the very communication channels law enforcement fears will “go dark” and beyond reach.”

Meanwhile, US public authorities appeared extremely fragmented. While prosecutors sided with the FBI, even NSA officials like James Clapper or Michael Hayden as well as the Secretary of Defense defended the industry's position from a cybersecurity standpoint.48 Despite disagreements from

<footnote n="43">43. Jeong, S. (2015, October 13). The Obscure 1789 Statute That Could Force Apple to Unlock a Smartphone. Retrieved February 21, 2016, from http://motherboard.vice.com/read/writs-and-giggles</footnote>

<footnote n="44">44. See the joint brief from Amazon.com, Box, Cisco Systems, Dropbox, Evernote, Facebook, Google, Lavabit, Microsoft, Mozilla, Nest Labs, Pinterest, Slack Technologies, Snapchat, WhatsApp, and Yahoo!. Briefs from the American Civil Liberties Union, the Electronic Frontier Foundation, Access Now, and the Center for Democracy and Technology also supported Apple. https://www.apple.com/newsroom/2016/03/03Amicus-Briefs-in-Support-of-Apple/</footnote>

<footnote n="45">45. Champeau, G. (2015, December 18). Blackberry s'oppose au chiffrement de bout en bout. Retrieved January 6, 2016, from http://www.numerama.com/business/135533-blackberry-plaide-contre-le-chiffrement-de-bout-en-bout.html</footnote>

<footnote n="46">46. Kulwin, N. (2016, February 23). Bill Gates Is Backing the FBI in Its Case Against Apple. Retrieved February 23, 2016, from https://recode.net/2016/02/22/bill-gates-is-backing-the-fbi-in-its-case-against-apple/</footnote>

<footnote n="47">47. Barss, P. (2016, March 1). “Trust in technology has been eroded” says Microsoft. Retrieved March 3, 2016, from http://www.infosecurity-magazine.com/news/rsac-trust-in-technology-eroded/</footnote>

<footnote n="48">48. Manach, J. M. (2016, March 31). Crypto: pourquoi l'ex-chef de la NSA défend Apple. Retrieved April 3, 2016, from http://bugbrother.blog.lemonde.fr/2016/03/31/crypto-pourquoi-lex-chef-de-la-nsa-defend-apple/ Perlroth, N. (2016, March 2). Defense Secretary Takes Position Against a Data ‘Back Door.’ The New York Times. Retrieved from</footnote>
intelligence committee members,⁴⁹ Congress-members were also aligned with the position of the tech industry.⁵⁰

Eventually, the legal stand-off was never legally resolved, as the FBI pulled out of the case when it announced that a small digital forensic company had been able to provide assistance in unlocking the phone.⁵¹ Fragmented over the issue, the Obama administration apparently stuck to the middle-ground option outlined in the draft options paper on approached to encryption from the US National Security Council (NSC) from mid-2015, that is a few months before the San Bernadino case made headlines.⁵² The document defined this approach as “calling on deferring legislation and other compulsory actions” against the use of encryption features by the US computer industry:

> “(...) The administration would seek industry's voluntary assistance to modify their technologies to address law enforcement's concerns” Alternatively, “the administration [could] still ask providers to assist law enforcement in any way that they can within their current technological framework. In either case, these calls for assistance could be done publicly or privately, depending on the preferred engagement framework.”

This sequence marked the end of a major episode during which the antagonism between the industry and major actors of the US law enforcement nexus could be staged. It is this option of “deferring legislation” and sticking to the status quo that has prevailed up until now.

**Limiting access to cloud data:** The third important front for the litigation strategies of US online service providers was the legal regime associated with online “cloud” data. Two cases are of particular importance in this regard.

In June 2014, the Supreme Court of the United States issues its first significant ruling on surveillance since the first Snowden disclosures. In *Riley v. California*,⁵³ it unanimously held that the warrantless search and seizure of digital contents of a cell phone during an arrest is unconstitutional. According to Chief Justice John G. Roberts:

> “Modern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans “the privacies of life”. The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought.”

He went on to explain that:

> “Treating a cell phone as a container whose contents may be searched incident to an arrest is a bit strained as an initial matter. But the analogy crumbles entirely when a cell

http://www.nytimes.com/2016/03/03/technology/defense-secretary-takes-position-against-a-data-back-door.html

49. Ackerman, S., & Francisco, S. T. D. Y. in S. (2016, March 1). Congress tells FBI that forcing Apple to unlock iPhones is “a fool’s errand.” *The Guardian*. Retrieved from

http://www.theguardian.com/technology/2016/mar/01/apple-fbi-congress-hearing-iphone-encryption-san-bernardino

50. Ackerman, S., & Francisco, S. T. D. Y. in S. (2016, March 1). Congress tells FBI that forcing Apple to unlock iPhones is “a fool’s errand.” *The Guardian*. Retrieved from

http://www.theguardian.com/technology/2016/mar/01/apple-fbi-congress-hearing-iphone-encryption-san-bernardino

51. Armerding, T. (2017, January 30). FBI v. Apple: One year later, it hasn't settled much. Retrieved January 31, 2017, from http://www.csoonline.com/article/3160485/mobile-security/fbi-v-apple-one-year-later-it-hasn-t-settled-much.html

52. US National Security Council. (2015). *Draft options paper on strategic approaches to encryption*. Washington DC.

53. Riley v. California, No. 13-132, 573 U.S.(2014).
phone is used to access data located elsewhere, at the tap of a screen. That is what cell phones, with increasing frequency, are designed to do by taking advantage of 'cloud computing (...). The United States concedes that the search incident to arrest exception may not be stretched to cover a search of files accessed remotely—that is, a search of files stored in the cloud."

U.S. companies did not intervene directly in the case, but exactly a year after the first Snowden disclosures, they helped put the highlight on this first major win for the right to privacy. According to Microsoft's legal counsel Brad Smith, "for those of us at Microsoft and other tech companies who are seeking to ensure that the Fourth Amendment protects information stored in the cloud, these are encouraging words." "Both the judicial and legislative branches have taken new steps to protect privacy. It's not unreasonable to hope that now more than ever, there is an important opportunity to bring people together to address next-generation privacy issues," he added.<fnref n="54" />

Another major case regarding access to online data is currently being litigated by the Supreme Court: The *Microsoft Ireland* case (Christakis, 2017). The case originates from a December 2013 ruling whereby a US judge ordered Microsoft to give to US authorities access to the content of emails and subscriber information of a suspect in a drug trafficking case that were held on servers located in Ireland, invoking the Stored Communications Act of 1986. Microsoft refused to comply with that demand that sought to circumvent the international mechanisms of mutual legal assistance normally applicable, saying that the Act had no extraterritorial effect. The Court of Appeal of the Second Circuit sided with Microsoft, and the government appealed to the Supreme Court, which accepted to review the case in October 2017. Deputy Solicitor General Jeffrey Wall argued that the Appellate Court's order had led Microsoft, Google and Yahoo to deny law enforcement's request to accessing information stored on servers outside the United States, hampering criminal investigations. But separately the Department of Justice has also indicated that "Google has reversed its previous stance and informed the government that it will comply with new Section 2703 warrants outside the 2nd Circuit (while suggesting that it will appeal the adverse decisions in one or more existing cases)."<fnref n="55" /> Given these disparities in prevailing legal interpretations, a clarification through the Supreme Court decision would have clarified the scope of the relevant statute. It was bound to have far-reaching implications, and many parties have intervened in the case through amicus cruiae, like business organizations from Germany or France, the European Commission and Members of the European Parliament, and many NGOs.<fnref n="56" /> According to Theodore Christakis, a professor in international law:

"If the Supreme Court finds in favour of the US government, that means that, tomorrow, the US authorities could, for example, issue a mandate requiring Microsoft or another cloud provider operating in the United States (Apple, Amazon, IBM, Google, Facebook etc.) to submit the "content data" of a French national suspected of a crime in the United States (including, for example, a journalist accused of undermining US national security), even though this French citizen lives in France and his data are stored by the relevant supplier in France, and this without using an international request for legal

<footnote n="54">54. SMith, B. (2014, June 28). The privacy week that was. Retrieved February 19, 2018, from https://blogs.technet.microsoft.com/microsoft_on_the_issues/2014/06/28/the-privacy-week-that-was/</footnote>

<footnote n="55">55. Kravets, D. (2017, September 14). Google stops challenging most US warrants for data on overseas servers. Retrieved February 15, 2018, from https://arstechnica.com/tech-policy/2017/09/feds-google-stops-challenging-most-us-warrants-for-data-on-overseas-servers/</footnote>

<footnote n="56">56. United States v. Microsoft Corp, Docket N° 17-2. http://www.scotusblog.com/case-files/cases/united-states-v-microsoft-corp/</footnote>
assistance or any other form of cooperation with the French authorities" (Christakis, 2017).

In late March 2018 however, Microsoft filed a brief supporting the Department of Justice to dismiss the case, arguing that it was now pointless considering that Congress had passed a new legislation on transborder access to online data.<fnref n="57" /> An unconvincing justification considering that the new Act fails to solve the issue at hand in that case.<fnref n="58" /> But the Supreme Court agreed and dismissed the case.<fnref n="59" /> We come back to the CLOUD Act at the end of the following subsection.

## Political resistance

Technical and legal resistance are always accompanied by lobbying efforts aimed at influencing policy-makers. Since 2013 – and beyond the issues already mentioned which also mobilized the lobbying teams of online service providers (e.g. encryption, transparency, transborder access to cloud data, etc.) – three important reforms of US surveillance laws led to joint resistance strategies. These were coordinated by the various industry players, who even moved to set up a joint-public relation campaign through ReformGovernmentSurveillance.com, sponsored by AOL, Facebook, Google, Microsoft, Twitter, Yahoo and others. On December 9th, 2013, these companies placed a full-page advertisement in major newspapers to broadcast an open letter to President Barack Obama and Congress asking them “to take the lead and make reforms that ensure that government surveillance efforts are clearly restricted by law.”

**Patriot Act Section 215:** The first full-fledged campaign for coalition would come 18 months later when section 215 of the Patriot Act, on which was based many of the NSA's surveillance programs.<fnref n="60" /> In May 2015, an appellate court ruled that the Patriot Act did not authorize the National Security Agency to collect Americans' calling records in bulk. But given the national security interests at stake, the judge decided to let Congress take action, since Section 215 of the Patriot Act would expire on the first of June.<fnref n="61" /> The debate in Congress was fierce, but in a last minute move and with the implication of the Obama White House, new provisions were adopted to provide a new legal basis for the surveillance capacities that relied on the Patriot Act. The USA Freedom Act, was it would be called,<fnref n="62" /> was thus adopted on June 2nd, 2015, after more than 20 other attempts at reforming the surveillance powers of US agencies had failed.<fnref n="63" /> Besides responding to the tech

<footnote n="57">57. Microsoft calls for dismissal of U.S. Supreme Court privacy fight. (2018, April 4). *Reuters*. Retrieved from https://www.reuters.com/article/us-usa-court-microsoft/microsoft-calls-for dismissal-of-u-s-supreme-court-privacy-fight-idUSKCN1HA2KH</footnote>

<footnote n="58">58. "Because Ireland is not party to an executive agreement, Microsoft now is faced with a compulsory production order that has extraterritorial reach and nothing in the CLOUD Act permits a motion to quash the warrant or requires a court to conduct a comity analysis using the same factors that would be required if there were an executive agreement in place." See: Gidari, A. (2018, April 9). What will Microsoft and Ireland do with the new CLOUD Act warrant? Retrieved April 10, 2018, from https://iapp.org/news/a/does-the-cloud-act-raise-more-questions-than-it-answers/</footnote>

<footnote n="59">59. Supreme Court dismisses warrant case against Microsoft after CLOUD Act renders it moot. (2018, April 17). Retrieved April 19, 2018, from http://social.techcrunch.com/2018/04/17/supreme-court-withdraws-warrant-case-against-microsoft-after-cloud-act-renders-it-moot/</footnote>

<footnote n="60">60. P/K, G. door. (n.d.). Electrospaces.net: Section 215 bulk telephone records and the MAINWAY database. Retrieved January 22, 2016, from http://electrospaces.blogspot.fr/2016/01/section-215-bulk-telephone-records-and.html</footnote>

<footnote n="61">61. Stempel, J. (2015, May 7). NSA's phone spying program ruled illegal by appeals court. *Reuters*. Retrieved from https://www.reuters.com/article/us-usa-security-nsa/rsa-phone-surveillance-not-authorized-u-s-appeals-court-idUSKBN0NS1IN20150507</footnote>

<footnote n="62">62. The name of the Act stands for: Uniting and Strengthening America by Fulfilling Rights and Ending Eavesdropping, Dragnet-collection and Online Monitoring Act.</footnote>

<footnote n="63">63. Gallagher, R. (2013, October 29). U.S. Lawmakers Launch Assault on NSA Domestic Snooping. *Slate*. Retrieved</footnote>
companies' request for greater transparency (e.g. by creating new avenues to challenge gag orders attached to National Security Letters or imposing new reporting requirements on US authorities), the Act prohibits NSA to collect and store domestic call records in bulk. Instead, the NSA must apply for a warrant from the FISA Court, which approves specific and targeted selectors to be provided to telecommunication providers, who use them for querying their own databases and only these results are handed over to NSA. The Act also enabled the presiding judges of the FISA courts to designate five individuals to serve as amicus curiae during cases that entails novel or significant interpretation of the legal framework. During the whole legislative process on the bill; the "Reform Government Surveillance" industry group was very active in pushing for legislation that would contribute to "rebuilding the essential element of trust not only in the technology sector but also in the U.S. government." According to the companies, "as a result of increasing concern about the level of access the U.S. government has to user-generated data held by technology companies, many domestic and foreign users have turned to foreign technology providers while, simultaneously, foreign jurisdictions have implemented reactionary policies that threaten the fabric of the borderless internet."⁶⁴ After the bill was adopted, it reacted with a short statement:

> "We commend the Senate for passing the USA Freedom Act, a bill that makes significant progress in reforming U.S. government surveillance programs and practices. The action today shows the United States' leadership in ensuring transparency and accountability of government actions that impact the privacy and trust of Internet users."⁶⁵

As we can see, trust was again central theme to the concerns voiced by the industry. We will discuss the actual impact and shortcomings of this reform in the following section.

**US Judicial Redress Act:** In January 2016, the coalition also celebrated the adoption of the US Judicial Redress Act, adopted by the US to make good on its promise to grant EU citizens a right to redress before US courts to protect their privacy rights, which was made in the context of the negotiations of the so-called Privacy Shield agreement.⁶⁶

In June 2016, human rights NGOs and industry joined forces when Congress started considering a bill that would have expanded surveillance powers exerted under the framework of Nation Security Letters defined by the Electronic Communications Privacy Act (ECPA) of 1986. According to a letter sent by this new coalition to the proposed amendment would have extended the range of subscriber information available to law enforcement to new categories of items, such as the websites that a person visited, the time spent on those sites, email metadata, location information and IP addresses.⁶⁷ This was a significant extension compared with the existing language of the ECPA, which was drafted before the advent of the Internet and limited such subscriber information to "the name, address, length of service, and local and long distance toll billing records." The effort

from

http://www.slate.com/blogs/future_tense/2013/10/29/sensenbrenner_and_leahy_s_usaFreedom Act seeks to curb nsa_domestic_spying.html

64. https://reformgs.tumblr.com/post/118692011732/rgs-joins-coalition-urging-house-leadership-to

65. https://www.aclu.org/sites/default/files/field_document/ectr_coalition_letter_6-6.pdf

66. Reform Government Surveillance Applauds the Senate Judiciary Committee on the Judicial Redress Act, Urges Swift Action in the Full Senate. (2016, January 28). Retrieved February 20, 2018, from
https://reformgs.tumblr.com/post/138233977817/reform-government-surveillance-applauds-the-senate

67. Tech firms say FBI wants browsing history without warrant. (n.d.). Retrieved February 20, 2018, from
https://www.engadget.com/2016/06/07/fbi-ecpa-ammendment-browsing-metadata-no-warrant/
was successful in killing the bill.<fnref n="68" /> The coalition has been supporting another bill, the Email Privacy Act, which would close a loophole of the existing ECPA which allows the government to obtain access emails, data in cloud storage more than 180 days old, without a court warrant.

**FISA Section 702:** One last important effort specific to the US was the renewal of Section 702 of FISA, which expired at the end of 2017. In a letter sent to the leadership of the US Congress in late February 2017, the coalition listed its priorities regarding government surveillance. Regarding FISA Section 702, the letter underlined that:

> "As Congress moves towards reauthorizing these powers, we would support changes to Section 702 that enhance transparency, provide greater programmatic oversight, and strengthen protection of sensitive personal data. Among the reforms that we would like to work with you on are narrowing the type of information that can be collected under Section 702; requiring judicial oversight for searching the contents of 702 material for the communications of a US person (given that US persons are not the target of 702); allowing companies to disclose the number of requests they receive by legal authority; further declassification of FISA Court orders; and providing greater transparency around how the communications of US persons that are incidentally collected under Section 702 are searched and used, including how often it is " queried " using identifiers that are tied to US persons."<fnref n="69" />

FISA Section 702 has been described as a “crown jewel” of the intelligence community in the US, a provision that underlies the most important of its surveillance programs. And as early as March, the Trump administration made clear that it would seek a “permanent and clean” reauthorization, meaning that no substantive changes would be brought to the law.<fnref n="70" /> This was against stressed in September in a letter sent by the Attorney General Jeff Sessions and the Director of National Intelligence Daniel R. Coats to Congress leadership.<fnref n="71" />

On January 11th 2018, Congress passed the FISA Amendments Reauthorization Act, which will remain valid until 2023. The later fails to respond to the concerns of privacy advocates, although it slightly increases the level of transparency and protection for US-persons.<fnref n="72" /> Legal experts argue that

<footnote n="68">68. Empowering Law Enforcement to Keep America Safe Act of 2016. https://www.congress.gov/bill/114th-congress/senate-bill/3369/all-info</footnote>

<footnote n="69">69. See also the demands made by the trade group CCIA in May 2017: “First, reauthorization legislation should codify recent changes made to “about” collection pursuant to NSA’s Upstream program. This reform would merely codify changes already embraced by the U.S. government with the imprimatur of the Foreign Intelligence Surveillance Court (FISC) to correct deficiencies that implicate the constitutional rights of U.S. citizens. Second, reauthorization legislation should require judicial oversight for government queries of the contents of 702 material for the communications of U.S. persons (given that U.S. persons are not the target of 702). Third, reauthorization legislation should narrow the definition of “foreign intelligence information” under FISA to reduce the likelihood of collecting information about non-U.S. persons who are not suspected of wrongdoing. Fourth, increasing oversight and transparency of Section 702 collection will improve confidence in both its utility and lawfulness. Companies should be allowed to disclose the number of requests they receive by a legal authority and should be permitted to make more granular disclosures concerning the volume of national security demands that they receive. We also support further declassification of FISC orders. Finally, there should be greater transparency around how the communications of U.S. persons that are incidentally collected under Section 702 are searched and used, including how often 702 databases are queried using identifiers that are tied to U.S. persons.” https://www.ccianet.org/wp-content/uploads/2017/05/702-letter-201705-FINAL.pdf</footnote>

<footnote n="70">70. Volz, D., & Holland, S. (2017, March 1). White House supports renewal of spy law without reforms: official. Reuters. Retrieved from http://www.reuters.com/article/us-usa-trump-fisa-idUSKBN16855P</footnote>

<footnote n="71">71. Letter by Attorney General Sessions and Director of National Intelligence Coats Urging Congress to Reauthorize Title VII of the Foreign Intelligence Surveillance Act. (2017, September 11). Retrieved February 21, 2018, from https://www.justice.gov/opa/pr/letter-attorney-general-sessions-and-director-national-intelligence-coats-urging-congress</footnote>

<footnote n="72">72. Kohse, E. (2018, January 18). Summary: The FISA Amendments Reauthorization Act of 2017. Retrieved February</footnote>
its implementation could lead to upgraded procedures to protect the rights of US residents and
foreigners alike, in a way which might alleviate some of the concerns undermining the legal
prospects of the Privacy Shield agreement in Europe.<fnref n="73" /> Overall, the Bill responded to the major
issues voiced by the industry, although the absence of progress for non-US persons and the resulting
risks for the Privacy Shield agreement represent a liability for them.

**The CLOUD Act:** On March 23rd, 2017, US President Donald Trump signed into law the CLOUD Act (or Clarifying Lawful Overseas Use of Data Act). This piece of legislation – first presented by the Department of Justice in mid-2016 –<fnref n="74" /> was added in last minute to a spending bill revise the legal framework regulating US law enforcement access to online data stored overseas as well as access do data by foreign law enforcement authorities to data held in the US. The goal is to provide a streamlined legal avenue to bypass MLAT procedures and limit the extra-territorial effects of the Stored Communications Act (the later was opposed by tech firms and debated in the context of the Microsoft Ireland case, see above).

The Bill passed with wide-ranging support from the tech sector (which took an active role in
crafting it)<fnref n="75" /> but was criticized by human rights organizations. According to EFF:

* "Enable foreign police to collect and wiretap people's communications from U.S. companies, without obtaining a U.S. warrant.

* Allow foreign nations to demand personal data stored in the United States, without prior review by a judge.

* Allow the U.S. president to enter "executive agreements" that empower police in foreign nations that have weaker privacy laws than the United States to seize data in the United States while ignoring U.S. privacy laws.

* Allow foreign police to collect someone's data without notifying them about it.

* Empower U.S. police to grab any data, regardless if it's a U.S. person's or not, no matter where it is stored."<fnref n="76" />

The main criticism coming from NGOs is one underlying the lack of debate on these complex issues.

"Microsoft, who call for the dismissal of the case pending before the Supreme Court on whether the US government could seek access to data stored in Ireland outside of MLAT procedures as a result of the adoption of the Act, instead stresses that the text provides important safeguards:

<footnote>19, 2018, from https://www.lawfareblog.com/summary-fisa-amendments-reauthorization-act-2017</footnote>

<footnote n="73">73. Goitein, E., & Litt, R. (2018, February 20). A Way Forward on Section 702 Queries. Retrieved February 21, 2018, from https://www.justsecurity.org/52737/section-702-queries/</footnote>

<footnote n="74">74. Wong, C. M. (2017, September 18). US Cross-Border Data Deal Could Open Surveillance Floodgates. Retrieved September 20, 2017, from https://www.hrw.org/news/2017/09/18/us-cross-border-data-deal-could-open-surveillance-floodgates</footnote>

<footnote n="75">75. See, e.g.: Walker, K. (2017, June 22). Digital security and due process: A new legal framework for the cloud era. Retrieved July 4, 2017, from http://www.blog.google:443/topics/public-policy/digital-security-and-due-process-new-legal-framework-cloud-era/</footnote>

<footnote n="76">76. Ruiz, D. (2018, March 22). Responsibility Deflected, the CLOUD Act Passes. Retrieved April 10, 2018, from https://www.eff.org/deeplinks/2018/03/responsibility-deflected-cloud-act-passes</footnote>
"First, the CLOUD Act creates the authority and framework for the U.S. to establish international agreements that on a reciprocal basis will enable law enforcement agencies to access data in each other's countries to investigate and prosecute crimes. These 21st century agreements will supplement the older and slower Mutual Legal Assistance Treaties, or MLATs, that governments around the world understandably have been complaining about. These new agreements can combine digital and other modern processes to enable law enforcement to work effectively and quickly.

Second, the CLOUD Act protects privacy and other human rights by stipulating that these international agreements can only be established with countries that protect privacy and other human rights and by subjecting the Executive Branch's assessment of these aspects to congressional review (...).

Third, the CLOUD Act creates strong norms to govern surveillance requests in the new international agreements. These effectively incentivize governments to update their digital privacy laws to ensure that law enforcement requests are narrow, incorporate specific rule of law protections, are subject to judicial review or oversight, and meet baseline legal standards around accountability and transparency.

Fourth, the CLOUD Act ensures that these new international agreements will not become vehicles for requiring cloud service providers to create back doors to break encryption. The Act states explicitly that terms of these agreements "shall not create any obligation that providers be capable of decrypting data or limitation that prevents providers from decrypting data."<fnref n="77" />

Despite these reassurances, the fact remains that the CLOUD Acts furthers entrenches the privatization of the justice system, by giving to tech companies the only possibility to oppose a specific access request from a third country after the US government has passed a bilateral agreement with that country, where MLAT procedures entrusted judges with that task. Also, it gives a new leverage to the US government (the fact of granting a third country a bilateral agreement under the CLOUD Act) which will likely be used to further the diplomatic interests of the US at the expense of human rights. These are just some of the most obvious problems of a text that is reaped with ambiguities.<fnref n="78" />

In Europe, the adoption of the CLOUD Act has raised concerns considering the upcoming proposal for a "directive on electronic evidence," presented on April 17th, 2018.<fnref n="79" /> EU Justice Commissioner Vera Jourova reacting by bemoaning the US move which narrows down the range of options available to European lawmakers and in effect pre-empt their debate: "Unfortunately," she said, "the US Congress has adopted the US Cloud Act in a fast-track procedure, which narrows the room for the potential compatible solution between the EU and the US," she said in a statement.<fnref n="80" /> The timing indeed suggests that this was precisely the goal of this rushed adoption. The UK and the US

<footnote n="77">77. Smith, B. (2018, April 3). The CLOUD Act is an important step forward, but now more steps need to follow. Retrieved April 9, 2018, from https://blogs.microsoft.com/on-the-issues/2018/04/03/the-cloud-act-is-an-important-step-forward-but-now-more-steps-need-to-follow/</footnote>

<footnote n="78">78. See: Singh Guiliani, N., & Shah, N. (2018, March 16). The CLOUD Act Doesn't Help Privacy and Human Rights: It Hurts Them. Retrieved April 10, 2018, from https://lawfareblog.com/cloud-act-doesnt-help-privacy-and-human-rights-it-hurts-them</footnote>

<footnote n="79">79. Security Union: Commission facilitates access to electronic evidence. (2018, 417). Retrieved April 19, 2018, from http://europa.eu/rapid/press-release_IP-18-3343_en.htm</footnote>

<footnote n="80">80. Nielsen, N. (2018, March 26). Rushed US Cloud Act triggers EU backlash. Retrieved April 10, 2018, from https://euobserver.com/justice/141446</footnote>
have, for the past two years, been negotiating an agreement that will now be updated to respect the
new US legal framework. The EU Commission is expected to follow suit on similar negotiations.

The limits of resistance: the extractive data economy and the Snowden paradox

These three different types of resistance made the news. But here and there, one could also see that
much of what these actors could have done to better protect privacy was simply not done.

On the issue of encryption for instance, much of the efforts of large communication provider
consisted in respecting the state of the art. They did not go much further. In launching new products
for instance, they often disregarded implementing strong encryption by default. It was the case of
Google with its new messaging service called Allo. A FBI source reacted to the news by saying that
“having this as an opt-in feature is certainly useful to us”.<fnref n="81" /> Sometimes, like in the case of
Microsoft’s Skype, significant changes in the functioning of the software failed to introduce any
new protection for privacy, and no indication was given regarding the use of encryption.<fnref n="82" /> The
strong encryption features, even when they are used by default, only relate to content, which allows
the companies to mine metadata and still extract many information that is useful on their
consumers’ behavior to serve them with targeted advertising, and which can be handed over to law
enforcement.<fnref n="83" /> The fact is that much of the digital economy is built on personal data and profiling
(Casilli, 2017; Fuchs, 2013; Fuchs & Trottier, 2015), and the protection of users privacy must
always be balanced against that reality. Despite the privacy-by-design pledges and internal review
mechanisms, the business-models of these companies and the very nature of modern-day
technologies like Artificial Intelligence create inescapable limits on what we have referred to here
as “technical resistance.”

Even when encryption may render some surveillance techniques less attractive to intelligence
agencies (for instance Deep Packet Inspection techniques), the fact remains that these companies
are territorially headquarted and infrastructurally anchored in the US make them prone to the full
legal power of US authorities.

Yahoo's roll-out of SSL encryption on its products in 2014 made real-time surveillance of its traffic
from backbone networks impracticable. So intelligence agencies issued a directive – presumably
authorized by the FISC – forcing that traffic scanning to take place from within Yahoo's data
centers, according to the revelations made by Reuters in October 2016:

"Yahoo Inc last year secretly built a custom software program to search all of its customers' incoming emails for specific information provided by U.S. intelligence officials, according to people familiar with the matter.

<footnote n="81">81. Nakashima, E., & Tsukayama, H. (May 2016). People like Edward Snowden say they will boycott Google's newest messaging app. Retrieved May 23, 2016, from https://www.washingtonpost.com/news/the-switch/wp/2016/05/21/why-people-like-edward-snowden-say-they-will-boycott-googles-newest-messaging-app/</footnote>

<footnote n="82">82. Bright, P. (2016, July 20). Skype finalizes its move to the cloud, ignores the elephant in the room. Retrieved July 20, 2016, from http://arstechnica.com/information-technology/2016/07/skype-finalizes-its-move-to-the-cloud-ignoresthe-elephant-in-the-room/</footnote>

<footnote n="83">83. Biddle, S. (2016, September 28). Apple Logs Your iMessage Contacts — and May Share Them With Police. Retrieved September 29, 2016, from https://theintercept.com/2016/09/28/apple-logs-your-imessage-contacts-and-may-share-them-with-police/</footnote>

<footnote>Fox-Brewster, T. (2017, January 22). Forget About Backdoors, This Is The Data WhatsApp Actually Hands To Cops. Retrieved February 21, 2018, from https://www.forbes.com/sites/thomasbrewster/2017/01/22/whatsapp-facebook-backdoor-government-data-request/</footnote>

<footnote>Rees, M. (2016, July 21). Windows 10 : pourquoi la CNIL met en demeure Microsoft. Retrieved July 21, 2016, from http://www.nextinpact.com/news/100719-windows-10-pourquoi-cnil-met-en-demeure-microsoft.htm</footnote>
The company complied with a classified U.S. government demand, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said three former employees and a fourth person apprised of the events.

Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to an intelligence agency's request by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time.

It is not known what information intelligence officials were looking for, only that they wanted Yahoo to search for a set of characters. That could mean a phrase in an email or an attachment, said the sources, who did not want to be identified.”<fnref n="84" />

In this case, what is interesting to note is that Reuters' source indicate the company's board and general counsel failed to implicate the information security team, which found the scanning program a few week after its installation eventually led to the departure of Yahoo's Chief Information Security Officer Alex Stamos.<fnref n="85" /> This suggests that even through they may have been put at the forefront of the public-relation strategies of the companies to rebuilt user trust, information security personnel remain rather weak at the board level. Also, Reuters' revelations came one month after the company had revealed that in 2014, “state-sponsored” hackers had access to 500 million customer accounts. What is also interesting is that Yahoo apparently did not challenge the directive as it had in 2007. According to Reuters, “Mayer and other executives ultimately decided to comply with the directive last year rather than fight it, in part because they thought they would lose.” Asked whether they had received similar surveillance orders, other companies (which most likely would not be legally allowed to say if it were the case) said that they had not. Google and Apple made clear that if they had, they would have challenged them in court.<fnref n="86" />

When it comes to legal and political resistance, they too have their limits. The case of the US indeed confirms that despite an increased degree of transparency, surveillance reform introduced since 2013 in liberal regimes with powerful intelligence agencies leads to what we have called a “Snowden paradox” (Tréguer, 2017a): Intelligence reform, rather than rolling-out capacities for large-scale and suspicionless surveillance, has provided a detailed legal basis for these capacities, bringing a few new safeguards and slightly decreasing the level of secrecy to secure their legality and legitimacy.

As we have seen, the main progress has been on the front of transparency. But the USA Freedom

<footnote n="84">84. Reuters. (2016, October 4). Yahoo secretly scanned customer emails for US intelligence-sources. Retrieved October 5, 2016, from http://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSKCN1241YT</footnote>

<footnote n="85">85. According to Reuters: “Some Yahoo employees were upset about the decision not to contest the more recent edict and thought the company could have prevailed, the sources said. They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company's security team in the process, instead asking Yahoo's email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources. The sources said the program was discovered by Yahoo's security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in. When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails. Stamos's announcement in June 2015 that he had joined Facebook did not mention any problems with Yahoo.”</footnote>

<footnote n="86">86. Conger, K. (n.d.). Twitter, Microsoft, Google and others say they haven't scanned messages like Yahoo. Retrieved October 5, 2016, from http://social.techcrunch.com/2016/10/04/twitter-microsoft-and.google-say-they-havent-scanned-messages-like-yahoo/</footnote>
Act for the first time codifies the principle of bulk collection in US law.<fnref n="87" /> The legislative changes around NSL allowing a judge to review attached gag orders has been selectively used by companies like Google and Facebook.<fnref n="88" /> These and other reforms had no actual effect on limiting large-scale surveillance conducted by US intelligence. Consider these take-aways from the 2016 transparency report published by the Office of the Director of National Intelligence (ODNI) in March 2017:

* "Even after steps were taken to reduce the collection of phone call metadata—ending bulk collection of phone company records and limiting collection to specific requests against records held by telecommunications providers—the National Security Agency collected over 151 million phone call records while tracking only 42 targets.

* The number of Foreign Intelligence Surveillance Court (FISC) "probable cause" orders [for people inside the US] issued per year has stayed relatively steady, with 1,559 orders issued by FISC applying to an estimated 1,687 targets—336 of whom are "US persons." However, the total number of "targets" tracked through Internet surveillance and other means under FISA's Section 702 has steadily climbed well beyond that, reaching a total of 106,469 tracked individuals in 2016.

* The number of queries against the data collected through Internet taps for information about Americans by the NSA and CIA also grew year over year in 2016. The report estimated that 5,288 "known US person" searches were conducted against content gathered with "upstream" collection—up from 4,672 in 2015.

* A more accurate count of the number of times the intelligence community searched for information on Americans comes from the report's "estimated number of queries concerning a known US person of unminimized noncontents information"—in other words, searches specifically looking for Americans by identifying metadata, such as name or phone number. In 2013, there were 9,500 of these; by 2016, that number had grown to 30,335."<fnref n="89" />

As was repeatedly said since 2013 – and during out interviews (Appendix 1) –, the resistance strategies of Big Tech firms were already ongoing before Snowden. For many companies – especially those like Yahoo who had already faced human rights scandals –, there was already an understanding of the fact that secrecy and lack of public knowledge on the reality of the large-scale surveillance capacities and the lack of appropriate safeguards undermined their reputation. The Snowden disclosures only intensified them and pushed companies to put these fights in the public realm in order to restore user trust. According to an executive from Facebook who was not working there at the time of the first disclosures:

> "The change that the Snowden revelations did for my colleagues was that suddenly those topics, which were part of a long list of topics we were covering, were pushed

<footnote n="87">87. Sacks, S. (2015, May 13). USA Freedom Act Passes House, Codifying Bulk Collection For First Time, Critics Say. Retrieved August 31, 2015, from https://theintercept.com/2015/05/13/usa-freedom-act/</footnote>

<footnote n="88">88. According to EFF: ""While a handful of Silicon Valley giants including Apple, Dropbox, Pinterest, and Uber all committed to invoking reciprocal notice for every NSL, we're disappointed that others, such as Google and Facebook choose only to confront NSL gag orders on a case-by-case basis. The NSL system is broken and companies should invoke reciprocal notice systematically." Cardozo, N. (2017, July 10). Requiring Judicial Review for Every Gag Order Is a Simple Way to Have Our Backs: Apple Does but Google and Facebook Fall Short. Retrieved February 19, 2018, from https://www.eff.org/deeplinks/2017/07/requiring-judicial-review-every-gag-order-simple-way-have-our-backs-apple-does</footnote>

<footnote n="89">89. Gallagher, S. (2017, May 3). US Intelligence "transparency report" reveals breadth of surveillance by NSA, others. Retrieved February 20, 2018, from https://arstechnica.com/tech-policy/2017/05/us-intelligence-transparency-report-reveals-breadth-of-surveillance-by-nsa-others/</footnote>
front and center, and that US surveillance reform suddenly became one of the main priority, the legislation we were working on and most of our lobbying efforts were being directed toward that topic" (Appendix 1).

Oftentimes, media coverage overly emphasised the antagonism between private actors and the government. For instance, commenting on the Apple-FBI fights and the unwillingness of the Obama administration to introduce legislation to limit encryption, Benjamin Wittes, editor in chief of Lawfare and a Senior Fellow in Governance Studies at the Brookings Institution, said it provided "a vivid illustration of how overrated the power of the so-called national security state really is when its interests don't coincide with those of Silicon Valley."<fnref n="90" /> That statement seems exaggerated, as one key lesson of the internal White House memo that Wittes comments in this post is also that the government clearly contemplated the possibility of "voluntary assistance," possibly in a "private" way to avoid the chilling effects that publicity might have on such cooperation. We know from the Snowden archives that prior to 2013, the NSA spends $250 million a year to work with tech companies to make commercial software – and in particular encryption software – more exploitable.<fnref n="91" /> Regarding the FBI-Apple dispute, research actually suggests that compared to the encryption debates of the 1990s, the camp of those defending "strong encryption" matured, diversified and put forward new-found arguments regarding the importance of encryption (Schulze, 2017). It also counted prominent supporters from "deep state" circles at the NSA or the Pentagon, which can likely be attributed to the growing importance of the cybersecurity field within it.

So rather than overemphasising the divide between public and private actors, these traditional distinctions deserve to be blurred and the complex struggles and negotiation processes regarding surveillance put in a broader context. What we are pointing at is the fact that despite the "staged resistance" in the aftermath of Snowden, large technology companies remain increasingly tied to national security policies. In that process, they are only fostering their integration in the field of the state and, besides surveillance, there are plenty of other issues on which the state officials in the security field and technology companies can see eye to eye.

This is true of another national security issue that has strong adverse effects on human rights: the censorship of another national security issue also problematic from a human rights perspective but less sensitive in terms for public relation, that of online terrorist content. In the US and Europe, there has been a growing pressure on online service providers to police the content shared by their users in a extra-judicial setting, and companies have reacted by hiring more staff, subcontracting companies, and developing automatic filtering tools. Despite human right concerns, that cooperation is taking place without any legal pressure being leveraged against the companies.

Ahead of a meeting in the Silicon Valley in February 2016 between Cabinet members, intelligence officials and tech companies, the then White House press secretary Josh Earnest told reporters that "many of these technology companies that are participating in the meeting today are run by patriotic Americans and would want to cooperate."<fnref n="92" /> A key aspect of the discussion laid in understanding

<footnote n="90">90. Wittes, B. (2015, September 18). The Obama Administration's Encryption Wrangling. Retrieved February 19, 2018, from https://www.lawfareblog.com/obama-administrations-encryption-wrangling</footnote>

<footnote n="91">91. Borger, J., Ball, J., & Greenwald, G. (2013, September 6). Revealed: how US and UK spy agencies defeat internet privacy and security. Retrieved February 22, 2018, from http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security</footnote>

<footnote n="92">92. Quoted in: Jose, D. Y. J. C. W. in S., & California. (2016, January 8). Silicon Valley appears open to helping US spy agencies after terrorism summit. *The Guardian*. Retrieved from</footnote>
how technology could be used to boost censorship and propaganda efforts.⁹³ A few months later, companies like Google and Facebook were announcing major innovations in their efforts on extra-judicial automated censorship – something that the government would not be able to do considering the “First amendment” issues raised by such policies: Reuters reported that “some of the web’s biggest destinations for watching videos have quietly started using automation to remove extremist content from their sites.”⁹⁴ There was no public comment from the company, somewhat contradicting their pledge to transparency.

## Completing the integration of Big Tech to the US state in the age of “data governance”

In its seminal work on the “power elite” (Mills, 1959), U.S. sociologist Charles Wright Mills observed to the power positions in the political, economic and military sectors to conclude that there was a triangle of power, within which a small number of people could occupy power positions that were interchangeable and circulating. Mills noted in particular that proximity of business and government officials could be seen by the ease and frequency with which men passed from one realm to another, – a phenomenon that become known as the “revolving door”. He also asserted that the growing structural integration of these three sectors was the result of each of the elite domains becoming both larger and more centralized, and increasingly integrated with other spheres.

Now, the companies on which this deliverable focuses on have become in less than three decades the highest market valuations globally. Tech is now the largest sector in global capitalization, amounting to 3,582$bn, before financials (3,532$bn), consumer goods (2,660$bn), health care (2,300$bn), oil & gas (1,411$bn) or telecommunications (859$bn).⁹⁵

http://www.theguardian.com/technology/2016/jan/08/technology-executives-white-house-isis-terrorism-meeting-silicon-valley-facebook-apple-twitter-microsoft

93. The agenda of the meeting listed the following questions: “How can we make it harder for terrorists to leveraging the internet to recruit, radicalize, and mobilize followers to violence?

b. How can we help others to create, publish, and amplify alternative content that would undercut ISIL?

c. In what ways can we use technology to help disrupt paths to radicalization to violence, identify recruitment patterns, and provide metrics to help measure our efforts to counter radicalization to violence?

d. How can we make it harder for terrorists to use the internet to mobilize, facilitate, and operationalize attacks, and make it easier for law enforcement and the intelligence community to identify terrorist operatives and prevent attacks? https://www.theguardian.com/technology/2016/jan/07/white-house-summit-silicon-valley-tech-summit-agenda-terrorism

94. Menn, J., & Volz, D. (2016, June 25). Exclusive: Google, Facebook quietly move toward automatic blocking of extremist videos. Reuters. Retrieved from http://www.reuters.com/article/us-internet-extremism-video-exclusive-idUSKCN0ZB00M

See also: Facebook says Artificial Intelligence has sped up removal of terrorist content. (2017, November 29).
Retrieved February 22, 2018, from https://www.usatoday.com/story/tech/2017/11/28/facebook-says-artificial-intelligence-has-sped-up-removal-terrorist-content/903615001/

95. PricewaterhouseCoopers. (2017). Global Top 100 Companies by market capitalisation (31 March 2017 update). Retrieved from https://www.pwc.com/gx/en/audit-services/assets/pdf/global-top-100-companies-2017-final.pdf
<table><caption>Table: 2017 Global Market Capitalization (Source: CapIQ. Market value data as of 5/26/2017).</caption><thead><tr><th>Rank</th><th>Company</th><th>Region</th><th>Industry Segment</th><th>Current Market Value ($B)</th><th>2016 Revenue ($B)</th></tr></thead><tbody><tr><td>1</td><td>Apple</td><td>USA</td><td>Tech - Hardware</td><td>$801</td><td>$218</td></tr><tr><td>2</td><td>Google / Alphabet</td><td>USA</td><td>Tech - Internet</td><td>680</td><td>90</td></tr><tr><td>3</td><td>Microsoft</td><td>USA</td><td>Tech - Software</td><td>540</td><td>86</td></tr><tr><td>4</td><td>Amazon</td><td>USA</td><td>Tech - Internet</td><td>476</td><td>136</td></tr><tr><td>5</td><td>Facebook</td><td>USA</td><td>Tech - Internet</td><td>441</td><td>28</td></tr><tr><td>6</td><td>Berkshire Hathaway</td><td>USA</td><td>Financial Services</td><td>409</td><td>215</td></tr><tr><td>7</td><td>Exxon Mobil</td><td>USA</td><td>Energy</td><td>346</td><td>198</td></tr><tr><td>8</td><td>Johnson & Johnson</td><td>USA</td><td>Healthcare</td><td>342</td><td>72</td></tr><tr><td>9</td><td>Tencent</td><td>China</td><td>Tech - Internet</td><td>335</td><td>22</td></tr><tr><td>10</td><td>Alibaba</td><td>China</td><td>Tech - Internet</td><td>314</td><td>21</td></tr><tr><td>11</td><td>JP Morgan Chase</td><td>USA</td><td>Financial Services</td><td>303</td><td>90</td></tr><tr><td>12</td><td>ICBC</td><td>China</td><td>Financial Services</td><td>264</td><td>85</td></tr><tr><td>13</td><td>Nestlé</td><td>Switzerland</td><td>Food / Beverages</td><td>263</td><td>88</td></tr><tr><td>14</td><td>Wells Fargo</td><td>USA</td><td>Financial Services</td><td>262</td><td>85</td></tr><tr><td>15</td><td>Samsung Electronics</td><td>Korea</td><td>Tech - Hardware</td><td>259</td><td>168</td></tr><tr><td>16</td><td>General Electric</td><td>USA</td><td>Industrial</td><td>238</td><td>120</td></tr><tr><td>17</td><td>Wal-Mart</td><td>USA</td><td>Retail</td><td>237</td><td>486</td></tr><tr><td>18</td><td>AT&T</td><td>USA</td><td>Telecom</td><td>234</td><td>164</td></tr><tr><td>19</td><td>Roche</td><td>Switzerland</td><td>Healthcare</td><td>233</td><td>51</td></tr><tr><td>20</td><td>Bank of America</td><td>USA</td><td>Financial Services</td><td>231</td><td>80</td></tr></tbody><tfoot><tr><td colspan="3">Total</td><td></td><td>$7,207</td><td>$2,497</td></tr></tfoot></table>

Not only are Silicon Valley companies dominating the global world of business, their influence of politicians has reached impressive proportions. In the US, the strong relationship between Google and the Obama administration and the Democratic Party has been well documented. Eric Schmidt, Executive Chairman of Google from 2001 to 2017 and of Alphabet Inc. from 2015 to 2017, became a member of President Obama's transition advisory board, before joining the President's Council of Advisors on Science and Technology (PCAST). He was joined to that latter position by Adrian Aoun, Google Artificial Intelligence's chief. As for Google Internet Evangelist Vint Cerf, he was appointed to the National Science Board (2013-2018); while former Google board member and venture capitalist John Doerr seated on the now defunct President's Council on Jobs and Competitiveness and President's Economic Board (2009-2013).

But this fact speaks to a much broader trend, documented by the US-based Campaign for Accountability who worked on the growing exchanges of personnel between Google and governments on both sides of the Atlantic through its "Google Transparency Project".<fnref n="96" /> According to the project:

"The Google Transparency Project has so far identified 258 instances of "revolving door" activity (involving 251 individuals) between Google or related firms, and the federal government, national political campaigns and Congress during President Obama's time in office. That included:

* 53 revolving door moves between Google and the White House. Those involved 22 former White House officials who left the administration to work for Google, and 31 Google executives (or from Google's main outside firms) who joined the White House, or were appointed to federal advisory boards.

<footnote n="96">96. https://googletransparencyproject.org/</footnote>
* 28 revolving door moves between Google and government positions involving national security, intelligence or the Department of Defense. Seven former national security and intelligence officials and 18 Pentagon officials moved to Google; while three Google executives moved to DoD.

* 23 revolving door moves between Google and the State Department during the Obama administration. Eighteen former State Department officials joined Google, while five Google officials took up senior posts at the State Department.

* 9 moves between Google and its outside lobbying firms and the Federal Communications Commission, which handles a growing number of regulatory matters with a major impact on the company's bottom line.”<fnref n="97" />

<figure><img src="image_5.png" /></figure>

<footnote n="97">97. Google's Revolving Door (US). (2017). Retrieved February 13, 2018, from https://googletransparencyproject.org/articles/googles-revolving-door-us</footnote>
Now, in the aftermath of Trump's election, many have described as growing divorce between the incoming Republican administration and the tech industry. In December 2016, Trump supporter and venture capitalist Peter Thiel organized a meeting between leader of the tech industry and the then President-elect. Attendees included Microsoft CEO Satya Nadella, Apple CEO Tim Cook, Jeff Bezos of Amazon and The Washington Post, Larry Page and Eric Schmidt of Alphabet and Google, Facebook COO Sheryl Sandberg, Elon Musk of Tesla and SpaceX, Oracle CEO Safra A. Catz, Microsoft CEO Satya Nadella, Intel CEO Brian Krzanich, Cisco CEO Chuck Robbins, and IBM CEO Ginni Romett. Trump commented about the pro-Democratic leanings of these companies, and what he saw as a boost in popularity among them after his elections. "They're all talking about the bounce. So right now everybody in this room has to like me – at least a little bit – but we're going to try and have that bounce continue," he said.<fnref n="98" /> Later on, there would be widespread criticisms coming from the tech industry regarding Trump's immigration and climate policies.<fnref n="99" />

But at many level of the US government, the integration of large tech firms in the administrative field in advancing. This began under the Obama administration, as analysed by Evgeny Morozov (Morozov, 2013), and continues to this day. In late-March 2017, Donald Trump signed a memorandum order establishing the “American Technology Council”, an initiative led by its son-in-law and Senior Advisor Jared Kushner to modernize the US public sector.<fnref n="100" /> The Council includes cabinet members and staffers, including the Secretary of Defense, the Secretary of Commerce, the Director of National Intelligence, and the U.S. Chief Technology Officer. During the first meeting of the council, in April, Apple CEO Tim Cook, IBM CEO Ginni Rometty, Microsoft CEO Satya Nadella, Amazon CEO Jeff Bezos, and Oracle co-CEO Safra Catz. In June 2017, the White House organized its “tech week”. This is an account of the meeting that speaks to the sort of issues discussed then:

> "Building on work that began under Obama, the Trump White House believes federal agencies should behave more like the private sector, not just in the way they buy and use technology but in the services they offer citizens who need to interact with Washington.

> For the nation's tech heavyweights, however, those reforms aren't just the stuff of a modern, digitally minded government — they're also potential business opportunities. And executives like Cook, Schmidt and Bezos sought to shape the Trump administration's thinking on those issues during an afternoon of closed-door

<footnote n="98">98. Jardin, X. (2016, December 14). Trump meets with tech leaders: Apple, Facebook, Google, Amazon, IBM, Microsoft, Oracle, Tesla, Intel. Retrieved December 15, 2016, from https://boingboing.net/2016/12/14/trump-meets-with-tech-elite-fr.html</footnote>

<footnote n="99">99. Isaac, D. S., Mike, & Benner, K. (2017, January 29). Silicon Valley's Ambivalence Toward Trump Turns to Anger. *The New York Times*. Retrieved from https://www.nytimes.com/2017/01/29/technology/silicon-valleys-ambivalence-toward-trump-turns-to-anger.html</footnote>

<footnote>Kerstetter, J. (2017, June 2). Tech Roundup: Divide Between Trump and Silicon Valley Grows. *The New York Times*. Retrieved from https://www.nytimes.com/2017/06/02/technology/tech-roundup-divide-between-trump-and-silicon-valley-grows.html</footnote>

<footnote n="100">100. O'Brien, S. A. (2017, May 1). Trump creates American Technology Council to “modernize” federal digital services. Retrieved February 22, 2018, from http://money.cnn.com/2017/05/01/technology/trump-american-technology-council/index.html</footnote>
brainstorming sessions.

A session on cloud computing, for example, featured some of the industry's leading players: Keith Block, the chief operating officer and president of Salesforce, as well as the chiefs of Intel and IBM, multiple sources confirmed to Recode. They discussed the ways the U.S. government can cut down on some 6,000 costly data centers in its control and shift those responsibilities to the private sector, a move that could mean a windfall for any tech company that might someday win such contracts.

The Trump administration also focused on federal procurement — and it devoted a brainstorming workshop to the sort of reforms the White House can proffer to make it easier for the U.S. government to buy the most cutting-edge tools on the market.

There, it was the likes of some of Washington's most aggressive tech sellers — like Palantir, which provides its data-sifting tools to U.S. national security agencies — offering their thoughts on ways to lower barriers, sources told Recode. Amazon and Oracle also attended those sessions.

One of Silicon Valley's leading venture capitalists, John Doerr, even brought the leader of one of his portfolio companies — Nuna Health — to the procurement meeting. The firm, run by Jini Kim, compiles and extracts insights from health care data, specifically from Medicaid. And speaking later at a public roundtable with the president, Doerr urged Trump to be the “data liberation administration” — releasing more of the government's stores of data, particularly around health care, for private-sector use.

“If you set the data free,” he said, “the entrepreneurs can do the rest.”<fnref n="101" />

Eric Schmidt, then the executive chairman of Google's parent company Alphabet, said that Trump helped foster “a huge explosion of new opportunities.” As suggested by the Google Transparency Project, Schmidt's behavior since the election of Trump has been that of a mediator of a corporation, and even a whole industry increasingly “ingratiating itself with the Trump administration while cashing on the resistance.”<fnref n="102" />

These reconfiguring public-private assemblages designed for the age of “data governance” are also developing in the national security field. In March 2016, Schmidt was also appointed by Ash Carter, then Secretary of Defense, as chairman of the Defense Innovation Board (DIB) of the Department of Defense, a position that he still holds at the time of writing despite him quitting its official positions at Alphabet/Google in January 2018.<fnref n="103" /> On its webpage, the DIB is described as an innovation think-tank:

“Through pilot programs and experiments within DoD, the DIB can bring in new perspectives from the private sector and academia, work with DoD partners to test

<footnote n="101">101. Romm, T. (2017, June 20). Behind the scenes at President Trump's private talks with the tech industry. Retrieved June 21, 2017, from https://www.recode.net/2017/6/20/15838646/trump-apple-amazon-google-microsoft-tech-week</footnote>

<footnote n="102">102. Google ingratiates itself with the Trump Administration... While cashing in on the resistance. (2017). Retrieved February 13, 2018, from https://googletransparencyproject.org/articles/google-ingratiates-itself-trump-administration</footnote>

<footnote n="103">103. Gabrielle, L., & Georeen, T. (2018, January 22). US military, Silicon Valley: Partnership will revolutionise the battlefield. Retrieved February 13, 2018, from http://www.foxnews.com/tech/2018/01/19/us-military-teams-up-with-silicon-valley-to-revolutionize-battlefield.html</footnote>

<footnote>Pellerin, C. (2017, October 25). Defense Innovation Board Chair: Recommendations Making an Impact. Retrieved February 13, 2018, from https://www.defense.gov/News/Article/Article/1353822/defense-innovation-board-chair-recommendations-making-an-impact/</footnote>
hypotheses, gather data, and encourage the imagination and critical thinking need to consider new solutions. This process is rapid, creative, collaborative, and ultimately saves time and money.”<fnref n="104" />

In one of its recommendation entitled “Forge New Approach to Data Collection, Sharing, and Analysis”, the DIB makes the following analysis of the importance of data to 21st century statehood:

> "Data is the 21st century equivalent of a global natural resource, like timber, iron, or oil previously – indispensable for sustaining military innovation and advantage. The next global conflicts will be fueled by data. The rapidly expanding power of new mathematical and computing techniques to reveal insights into intentions and capabilities, and to enhance accuracy, lethality, and speed, depend on immense data sets to train algorithms and from which to extract information. The data that provide the raw materials from which to identify patterns, as well as the anomalies that defy them, constitute the fuel that powers the engine of Machine Learning (ML). Whoever amasses and organizes the most data first will sustain technological superiority, so it is incumbent upon the Department to collect, store, share, analyze, and protect its data faster and better than its competitors. Data must be regarded as one of the most powerful resources in the Department’s arsenal.”<fnref n="105" />

Companies like Google indeed and their executives are selling solutions that are aimed at expanding the technological superiority and “efficiency” of these apparatus at “ultra-low-coast” (see below). According to the LinkedIn profile of Scott Frohman, “through the use of Google's capabilities remade for the enterprise, the government gets innovation fast and with significantly reduced cost.”

<figure><img src="image_6.png" /></figure>

### Scott Frohman

Bringing Ultra-low-cost, Radical Innovation to
Defense and Intelligence

Washington D.C. Metro Area

Computer Software

Current Google

Previous SAS, Google, Rational Software (acquired by IBM)

Education Georgetown University McDonough School of Business

500+
connections

C

Caption of the LinkedIn profile of Scott Frohman, Google's Director of Defense and Intelligence Sales since April 2017 (June 2018).

Data and algorithmic governmentality are becoming the norm of bureaucratic procedures, leading to new organizational patterns that heavily rely on the experience of the technology sector. In France too, the same logic can be seen.

<footnote n="104">104. http://innovation.defense.gov/Recommendations/</footnote>

<footnote n="105">105. Recommendations Defense Innovation Board. (October 2017). Retrieved February 22, 2018, from http://archive.is/IXaXR</footnote>
## 3.2 France: Facing established public-private alliances

In the US, one could argue that online service providers and software editors started from positions very external to the US government. But if the PRISM slides – or the increasing lobbying of these companies in Washington DC – are any indication, their progressive integration to the US state apparatus was engaged more than a decade ago.

In France, this process was still in a very early phase when the Snowden disclosures started in mid-2013. At first, the disclosures only reinforced existing public-private assemblages. Business and regulatory stakes further complicated the matter, giving US tech companies much less leeway to stage resistance.

### A first and failed attempt at resistance

As we have explained elsewhere (Tréguer, 2017a), legal controversies around communications surveillance did not start with Snowden. In the 1980s, several scandals and condemnations of France by the European Court of Human Rights (ECHR) has already led to the adoption of basic legal framework for extra-judicial state surveillance. In 2001 and 2006, the adoption of blanket data retention and access to metadata for anti-terrorism purposes re-ignited a debate. But generally speaking, the secrecy surrounding intelligence activities and the general lack of interest of much of the human rights field ensured that telecom companies – and in particular the former state monopoly Orange – and the state could cooperate, even outside of a proper legal framework, to advance the capacities of intelligence agencies. Hosting providers – the legal status that most US tech companies surveyed in the report have in France – had to provide subscriber information upon request, but for the most part, they remained a marginal component of the public-private dispositifs used to monitor Internet communications.

French national security policymakers were very much aware that the existing framework failed to comply with the standards of the European Court of Human Rights (ECHR). And so intelligence reform was announced for the first time in 2008, under the presidency of Nicolas Sarkozy (2007-2012). But the reform then lingered, which in turn created the political space for the parliamentary opposition to carry the torch. By the time the Socialist Party got back to power, in 2012, its officials in charge of security affairs were the ones pushing for a sweeping new law that would secure the work of people in the intelligence community and, incidentally, put France in line with democratic standards.

Then came Edward Snowden. At first, the Snowden disclosures deeply destabilized these plans, creating a new dilemma for the proponents of legalization: On the one hand, the disclosures helped document the growing gap between the existing legal framework and actual surveillance practices, exposing them to litigation and thereby reinforcing the rationale for legalization. But on the other hand, they had put the issue of surveillance at the forefront of the public debate and therefore made such a legislative reform politically risky and unpredictable.

In late 2013, a first attempt at partial legalization (widening access to metadata) gave rise to new coordination within civil society groups opposed to large-scale surveillance, which reinforced these fears. Ironically, the controversies was started by a trade group that included companies like Google and Microsoft. The *Loi de programmation militaire* (or LPM, a military planning bill) had been
debated in Parliament since October 2013, and an amendment was introduced in the Senate to
vastly expand the range of metadata accessible to intelligence agencies, including in real-time,
apparently to legalize some of the “deep packet inspection” techniques that intelligence agencies
had been experimenting since 2009.<fnref n="106" />

It shouldn't have, but the amendment did come as a surprise to many in the advocacy sphere, to the extent that it even went unnoticed for quite some time. Eventually, on November 20th, the Association des services de l'Internet communautaire (ASIC) -a professional lobbying organization representing online social services including Google France, AOL, eBay, Facebook, Microsoft, Skype and French companies like Deezer or Dailymotion- released a brief on article 13.<fnref n="107" /> The later was framed as an infringement on the right to privacy, and ASIC called on the government and lawmakers to adopt a “moratorium” on any text creating “rules of exception” for accessing users’ data. ASIC also started a petition to relay these calls on the platform change.org (the later would end up only 45 “supporters”).

At first, only minor online tech media relay these calls. But six days later, on November 26th, the
prominent conservative news-paper Le Figaro releases a sensationalist article entitled: “Telephone,
Internet: The State Will Soon Be Able to Spy on Everything.”<fnref n="108" /> The article relayed the analysis of
ASIC, with quoted of the organization’s head.

On December 3rd, the leading (though relatively small) French digital rights advocacy group, La Quadrature du Net, finally reacted with a press release (both in French and English) denouncing article 13: “How is it possible,” it asked, “that after only a few months of Edward Snowden’s revelations the French government proposes a bill so detrimental to our fundamental rights?” It was relayed by the anglophone and influential tech blog Boing Boing.

The next day, on December 4th, the Minister of Digital Affairs, Fleur Pellerin, was interviewed in Le Monde. The interview's headline stressed that, since the first Snowden disclosure, she was "the first member of the government to react on surveillance of the digital sphere." In the interview, Pellerin introduced what would become an important justification in the coming months (both in intelligence policy debate and cybersecurity debates): Pellerin framed the Snowden disclosures - which had documented the role of Silicon Valley corporations in US surveillance programs- as a confirmation that these "hegemonic" private actors were a major threat for privacy and broader European interests, casting their defense of digital rights in France as a sign of their double-dealing on the issue

The mobilization against article 13 was short and intense, but it eventually failed. Despite an
attempt at public resistance, US tech companies would soon face an hostile context fueled by
securitization discourse from French officials and their local competitors, leading them to tread
much more carefully and discretely on these issues.

<footnote n="106">106. Tréguer, F. (2017, November 15). Renseignement : derrière le brouillard juridique, la légalisation du Deep Packet Inspection. Retrieved from https://halshs.archives-ouvertes.fr/halshs-01649986/document</footnote>

<footnote n="107">107. Association des Sites Internet Communautaires Internet Communautaires. (2016, March 18). Surveillance de l'Internet, accès aux données d'utilisateurs : pour un moratoire sur les régimes d'exception. Retrieved January 18, 2017, from http://archive.is/firXs</footnote>

<footnote n="108">108. Leclerc, J.-M. (2013, November 25). Téléphone, Internet: l'État pourra bientôt tout espionner. Retrieved March 18, 2016, from http://www.lefigaro.fr/actualite-france/2013/11/25/01016-20131125ARTFIG00570-telephone-internet-l-etat-pourra-bientot-tout-espionner.php</footnote>
Immediately post-Snowden, a growing antagonism between the French state and US companies

Three general lines of justification were used by the French government and its private allies to discredit, or weaken, the position and public standing of US tech companies in the aftermath of Snowden.

"Digital sovereignty": The Snowden disclosures, by displaying the secret forms of cooperation between US tech companies and US agencies, led to renewed concerns regarding France's strategic interest and the fact that these companies with significant market power in France – both for average consumers and many private and public institutions – might in fact be a proxy for the US government. That was for instance the description offered by Bernard Barbier, former technical director at the French Directorate General for External Security (DGSE):

"The Americans feel like they are ten to fifteen years ahead of us, and put the GAFAs (Google, Apple, Facebook, Amazon] and the old Europe back to back. They have introduced vulnerabilities in a number of tools to turn them into cyber-weapons, and this vulnerability is turned against us. The Americans have no intention to abandon their supremacy and their lead. For them, cyberspace will be the cyberspace of the GAFAs. And the GAFAs are associated with the NSA."<fnref n="109" />

Another example of similar securization discourse could be found in the 2015 report of the Secrétariat Général de la Défense et de la Sécurité Nationale (SGDSN) on “digital security.” After having mentioned state-sponsored and non-state cyberattacks and other forms of cybercriminality and espionage, the report goes on to stress that:

"A new challenge has emerged: the accumulation of digital wealth by an oligopoly of companies using their dominant position to hinder the arrival of new entrants and capture the added value of this emerging economy that will exploit data to invent new services, improve our daily life, or increase the availability of public services. Among this data are first and foremost our personal data, including those attached to our privacy. Mastering this mass of data opens the door to economic destabilization and to sophisticated forms of propaganda, or of guidance of beliefs and habits. In this sense, this challenge – because of its national scale and strategic stakes – directly affects defense and national security."<fnref n="110" />

These statements must be put in the context of the fierce competition, and fear, that French and other European “legacy” technology companies must face in the digital age, as they try to challenge or resist the domination of US companies. In this regard, the Snowden disclosures allowed these companies and their allies in government to renew their calls for public policies that would reinforce their positions in the digital sector. The argument of “digital sovereignty” thus helped legitimize state subsidies – decided much earlier in 2009 – of €285 millions in two projects of “sovereign clouds” for data storage – one headed by Orange, the other by SFR. These led to

<footnote n="109">109. François, P.-O. (2015, September 21). Cyberattaques : «Beaucoup de pays se font passer pour des Chinois». Retrieved September 6, 2016, from http://www.liberation.fr/futurs/2015/09/21/beaucoup-de-pays-se-font-passer-pour-des-chinois_1387621</footnote>

<footnote n="110">110. Secrétariat Général de la Défense et de la Sécurité Nationale. (2015). La Stratégie nationale pour la sécurité du numérique : une réponse aux nouveaux enjeux des usages numériques. République française. Retrieved from http://www.ssi.gouv.fr/actualite/la-strategie-nationale-pour-la-securite-du-numerique-une-reponse-aux-nouveaux-enjeux-des-usages-numeriques/</footnote>
commercial failures, despite the fact that other French companies (and that we called “independent” in the introduction) were already offering similar commercial offers.<fnref n="111" /> But these were much smaller in size and most importantly much more autonomous from the state – OVH for instance resisted the pressure from the government to unilaterally discontinue its service to WikiLeaks in the midst of the “Cablegate” in December 2010 (Tréguer, 2015) and later opposed the Intelligence Bill.

In 2014, a French executive decree modified article R.153-2 of the Monetary and Financial Code to subject the investments of foreign firms in the field of network security and online communications to the prior approval of the state.<fnref n="112" /> In April 2016, the ministry of the Interior also orderes public authorities willing to archive their digital data to do so by using so-called “sovereign clouds”.<fnref n="113" />

At the national and European levels,<fnref n="114" /> the adoption cybersecurity policies since 2011 had led to the formation of new relationships between the administrative field and European companies in business sectors deemed of strategic interest (beyond tech, in the energy, transportation, military sectors) (e.g. (Pohle, Hösl, & Kniep, 2011; Poupard, 2016). The negotiations around the “Network Information Security” (NIS) directive provided a illustration of these trends, with the formation of a European cybersecurity cyber-militaro-industrial complex<fnref n="115" /> This echoes processes that had taken place a few years earlier in the United States (Brito & Watkins, 2011), but in Europe these were also fueled by the Snowden controversies from 2013 on.

**Fundamental rights:** The second line of justification was that of fundamental rights. We have already seen how a Minister of François Hollande used them to dismiss the arguments put forward by a trade group comprised of many US companies against the expansion of state surveillance in France. Such a defense line was adopted on many occasions, especially in 2015 during the legislative debate on the Intelligence Bill. Bernard Cazeneuve, the Minister of the Interior, for instance said in mid-April at the National Assembly that the critics of the Bill were missing the real danger:

> "The Internet operators hold our personal data, and I'm sure that many of them use extraordinarily intrusive techniques regarding our own existences (...). This does not raise any problem when it is done by big international trusts (...) but when a state offers to prevent terrorism on the Internet, it is suspected of pursuing unworthy ends!"<fnref n="116" />

Even the ruling of the Court of Justice of European Union striking down the “Safe Harbor” agreement between the EU and the US in 2016 would be used to favor the adoption of mandatory

<footnote n="111">111. Cuny, D. (2015, January 13). Le cloud à la française, histoire d'un flop ? Retrieved May 2, 2015, from http://www.latribune.fr/technos-medias/informatique/20150113triba29598d73/le-cloud-a-la-francaise-histoire-d-un-flop.html</footnote>

<footnote>kitetoa. (2015, March 13). France Cyber Security : une idée française de la sécurité française... : Reflets. Retrieved March 30, 2015, from http://reflets.info/france-cyber-security-une-idee-francaise-de-la-securite-francaise/</footnote>

<footnote n="112">112. Décret n° 2014-479 du 14 mai 2014 relatif aux investissements étrangers soumis à autorisation préalable. https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000028933611&categorieLien=id</footnote>

<footnote n="113">113. https://francearchives.fr/file/f7ace4517613a246583fd2dd673a0e6d0f86c039/static_9151.pdf</footnote>

<footnote n="114">114. See for instance the project of “sovereign cloud” in Germany: Stupp, Catherine. (2015, August 20). Germany to set up “Bundescloud” [Text]. Retrieved August 20, 2015, from http://www.euractiv.com/sections/infosociety/germany-set-bundescloud-316939</footnote>

<footnote n="115">115. For an illustration, see for instance: ANON., (2016, January 26). For the first time, the European Cybersecurity Industry Leaders Propose Recommendations Towards European Cybersecurity Policy. In : *Thales Group* [en ligne]. [Consulté le 1 juillet 2016]. Disponible à l'adresse : https://www.thalesgroup.com/en/critical-information-systems-and-cybersecurity/press-release/first-time-european-cybersecurity.</footnote>

<footnote n="116">116. Tréguer, F. (2015, June). Etats et entreprises à l'assaut de la vie privée. *Le Monde Diplomatique*.</footnote>
obligations to store digital data regarding European citizens in Europe.<fnref n="117" /> French tech companies and their “sovereign cloud” projects were thus framed as a way to better protect the privacy of French citizens.<fnref n="118" />

An interesting – although ill-fated – initiative in this regard was the announce in early 2014: ensuring the encryption of the email services provided French Internet access providers (Orange, SFR-Numéricable, Free, Bouygues and LaPoste.net). A charter to that effect was signed a year later, promising that email communications would be encrypted between French providers. But end-to-end encryption was not in order, which made the announcement a quite deceptive one for privacy advocates. According to the director of the *Agence Nationale pour la Sécurité des Systèmes d'Information* (ANSSI), the cybersecurity agency in charge of negotiating the charter with French providers, it was necessary to ensure that “points in clear” would be available for law enforcement purposes so as to “make encryption and lawful interception co-exist.”<fnref n="119" />

**A "joint responsibility" in the face of terrorism:** The third line of justification reinforcing traditional alliances between security professionals and “legacy” private actors. For instance, in August 2016, Bernard Cazeneuve, France’s interior minister, met his German counterpart Thomas de Maizière to discuss new measures that would limit the use of encrypted communications across the EU, saying it was “a central issue in the fight against terrorism.”<fnref n="120" />

In that context, the European competitors of US tech companies have therefore tried to play the card of contrasting their own approach to national security challenges to that of their US counterparts playing the “resistance” card. As European head of states and law enforcement officials put growing pressure n companies like Whatsapp, Google or Apple whose newly implemented encryption features made surveillance and other investigatory tools less effective, some of the companies with close ties to the government readily affirmed their commitment to voluntarily cooperating with the government.

Stéphane Richard, CEO of Orange – whose close ties with French intelligence have been documented –,<fnref n="121" /> for instance lashed at Google for its “encrypted data” going in “that go to data centers we know nothing about.”<fnref n="122" /> This language echoes the framing of encryption adopted by the *Service central de l'informatique et des traces technologiques* of the French investigatory police, who shortly after the November 2015 Paris attacks said that “industrial actors, especially American

<footnote n="117">117. Rees, M. (2016, April 29). Les sénateurs interdisent le traitement des données françaises stockées hors Europe. Retrieved April 29, 2016, from http://www.nextinpact.com/news/99675-les-senateurs-interdisent-traitement-donnees-francaises-stockees-hors-europe.htm</footnote>

<footnote n="118">118. AFP. (2014, July 7). «Big data» : le plan de la France pour concurrencer les géants américains. Retrieved March 24, 2015, from http://www.lefigaro.fr/secteur/high-tech/2014/07/07/01007-20140707ARTFIG00046-big-data-le-plan-de-la-france-pour-concurrencer-les-geants-americains.php</footnote>

<footnote n="119">119. Champeau, G. (2014, February 20). Les e-mails de France seront chiffrés et stockés en France. Retrieved March 23, 2015, from http://www.numerama.com/magazine/28502-les-e-mails-de-france-seront-chiffres-et-stockes-en-france.html</footnote>

<footnote>Rees, M. (2015, October 5). Une charte avec les FAI français pour le chiffrement des flux emails. Retrieved October 5, 2015, from http://www.nextinpact.com/news/96749-une-charte-avec-fai-francais-pour-chiffrement-emails.htm</footnote>

<footnote n="120">120. Jones, S. (2016, August 22). EU spymasters lobby for change in encryption law. *Financial Times*. Retrieved from http://www.ft.com/cms/s/0/08fe566e-679e-11e6-ae5b-a7cc5dd5a28c.html</footnote>

<footnote n="121">121. Follorou, J. (2014, March 20). Espionnage : comment Orange et les services secrets coopèrent. *Le Monde.fr*. Retrieved from http://www.lemonde.fr/international/article/2014/03/20/dgse-orange-des-liaisons-incestueuses_4386264_3210.html</footnote>

<footnote n="122">122. Graillet, G. (2014, December 11). Le P-DG d'Orange défie Google. Retrieved March 9, 2015, from http://www.lepoint.fr/economie/le-pdg-d-orange-cogne-sur-google-11-12-2014-1888830_28.php</footnote>
ones, constantly innovate with the purpose of privatizing stored data to make it inaccessible to any third party that does not detain the codes.”<fnref n="123" /> Michel Combes, then CEO of the telecom equipment manufacturer Alcatel, said that “it would not be illogic to allow public authorities to know when goes on on the networks, in an appropriate legal framework.”<fnref n="124" />

## Towards greater cooperation

These forms fo cybersecuritization reinforcing the traditional alliances between the French state and some of its “national digital champions” put US tech companies in an uncomfortable positions. As a matter of fact, during the 2015 debate on the French Intelligence, rather than the full-flegded resistance witnessed in late-2013, or later in the United States and in the UK – although probably to a lesser degree –, gave way to much more discreet forms of opposition. Microsoft, Facebook, Twitter and Google’s lobbyists were invited for a committee hearing.<fnref n="125" /> But subsequently, even though French independent companies from the tech sector led a small campaign against the Bill (nicknamed “Ni pigeons ni espions”), US companies did not join.

They would however file an amicus brief in June 2015 when the adopted bill was sent for constitutional review through the trade group ASIC. Other than that, their attitude was one of a readiness to adapt their business practice to restore the confidence of their large account customers. While resisting calls for creating new obligations to store data in France or Europe, US tech companies have been increasingly showcasing their investments in European infrastructures and European digital economies and shield them from US intelligence and law enforcement (a strategy that also explains why the *Microsoft Ireland* case is of such great importance).<fnref n="126" /> We will come back on some of these business initiatives, but for the purpose of this deliverable, of even greater importance is these firms’ increasing willingness to cooperate with the French and other European governments on national security issues.

**Streamlining surveillance requests:** Despite the antagonist rhetoric fuelled by European lawmakers like former French minister Bernard Cazeneuve, the collaboration between US tech firms and law enforcement officials have been making important progress in the past few years.

In 2014, France created a new position at the Interior Ministry, that of a so-called “cyber-prefect.”<fnref n="127" /> Announced by Cazeneuve, it aimed at coordinating France’s policies with respect to “cyberthreats.” After a position of adviser on cyberthreats to the minister, it would take in January 2017 the form of a decree establishing “interministerial delegate for security industries and the fight against cyberthreats” (*délégué ministériel aux industries de sécurité et à la lutte contre les cybermenaces*).<fnref n="128" /> The later provides that the delegate shall act:

<footnote n="123">123. Borredon, L., & Untersinger, M. (2016, February 19). Chiffrement : les enjeux du conflit Apple-FBI touchent la police française. Retrieved February 22, 2016, from http://www.lemonde.fr/pixels/article/2016/02/19/chiffrement-et-terrorisme-les-enjeux-du-conflit-apple-fbi-touchent-la-police-francaise_4868385_4408996.html</footnote>

<footnote n="124">124. Barroux, D., Counis, A., & Schmitt, F. (2015, March 1). Michel Combes : « Le patriotisme économique n’est pas un gros mot ». Retrieved March 9, 2015, from http://www.lesechos.fr/tech-medias/hightech/0204190139261-michel-combes-michel-combes-le-patriotisme-economique-nest-pas-un-gros-mot-1097709.php#</footnote>

<footnote n="125">125. http://www.assemblee-nationale.fr/14/rapports/r2697.asp</footnote>

<footnote n="126">126. Microsoft Announces Plans to Offer Cloud Services from German Datacenters. (2015, November 11). Retrieved March 9, 2018, from https://news.microsoft.com/europe/2015/11/11/45283/</footnote>

<footnote n="127">127. Lausson, J. (2014, June 5). La France aura son “cyberpréfet.” Retrieved February 11, 2018, from https://www.numerama.com/magazine/29589-france-cyberprefet.html</footnote>

<footnote n="128">128. Décret n° 2017-58 du 23 janvier 2017 instituant un délégué ministériel aux industries de sécurité et à la lutte contre les cybermenaces au ministère de l'intérieur. https://www.legifrance.gouv.fr/eli/decret/2017/1/23/INTA1635805D/jo</footnote>
"in the framework of the national strategy for digital security and tranversal policies of the ministry of the interior, in particular those relative to purchase and to the security and governance of information and communication systems.

In order to develop and protect the industrial and technological capacity of the nation in the field of security and the fight against cyber-threats, he initiates partnerships and defines plans of action at the level of the ministry.

He also ensures the dialogue of the Ministry of the Interior and of the various involved ministries, and between the Ministry of the Interior and public and private actors, such as security industries, including in its international dimension."

After the Paris attacks of January 2015, Bernard Cazeneuve decided to put greater pressure on US companies. Like the Obama officials would do a few months later, he decided to travel to the Silicon Valley in February 2015 to call for greater cooperation. There, he met with Apple's Technology Vice-President Bud Tribble, Rachel Whetstone and David Drummond from Google Public Affairs and Business Development teams, but also Facebook and Twitter's Vice-Presidents for Government Affairs, Elliot Schrage and Colin Crowell.<fnref n="129" /> Cazeneuve congratulated Microsoft for its cooperation in transmitting the content of the emails of the Hotmail account of one of the Paris attackers. This was addressed by Marc Mossé, director of Public Affairs in Europe:

"I remember the Charlie Hebdo attack, we were asked by the French government to provide some information. We have been able to provide the data in 45 minutes while the terrorists were still active, and it has been done according to the US law in case of emergency when people could be killed or there is a risk for the life of people you can give access to data in certain circumstances we have been able to provide this data in 45 minutes so there is an efficient way to collaborate and at the same time to respect the due process of law" (Appendix 1).

A similar process unfolded ten months later:

"When the Bataclan attack started (...) I turned on the TV and I looked at the events and I called my colleagues, well, in fact at the highest level of the company and I said "something is happening in Paris, I don't know what, it could be extremely serious and we have to be ready to answer the questions that could come from the law enforcement department" (...). We have been able to provide information in no more than 90 minutes during this attack. So there is way to collaborate in respect of the law and it's important to remind it because, again, I do not see any opposition between public safety and privacy, and it's not new because of technology."

This form of cooperation that conformed with the US law that these companies must comply with was therefore already undergoing. But through this new dialogue fostered by the US executives and the French minister, it would break new grounds.

The content of the talk held in Silicon Valley in February 2015 remained secret but another meeting was convened for April 2015 in Paris to "touch base of the commitments adopted, make [our] demands even more precise and come up with a code of good conduct." In April, the meeting was held, along with the French association of Internet Access Providers. Google, Microsoft, Facebook

<footnote n="129">129. Cassini, S., & Rauline, N. (2015, February 23). Bernard Cazeneuve en Californie pour convaincre les géants du Net. Retrieved February 26, 2018, from https://www.lesechos.fr/23/02/2015/LesEchos/21883-091-ECH_bernard-cazeneuve-en-californie-pour-convaincre-les-geants-du-net.htm</footnote>
Apple and Twitter announced that they would contribute to training law enforcement officers to help them understand the US legal framework for which they had to abide for surveillance requests made outside of “Mutual Legal Assistance Treaty” (MLAT) procedures. A “permanent point of contact between the Ministry and the providers” was also announced.<fnref n="130" /> Headed by the “cyberprefect”, its aim was to allow for a sustained dialogue.

According to one of our interviewees – a French executive of one of these US companies who have attended the meetings this “group of contact” –, since mid-2015, the group has been convening roughly every trimester. On the issue of surveillance, one of its main tasks has been to update law enforcement officials about the launch or update of new products and services that might have consequences for their work, to training sessions regarding the applicable legal framework and corresponding procedures within the legal teams of the companies, to provide law enforcement with “model forms” based on US law to streamline surveillance requests that are compatible with US law and therefore do not require going through the complex and time-consuming MLAT procedures.

Despite the bellicose rhetoric of Cazeneuve, of other French politicians and law enforcement officials, this form of cooperation may have played a role in the sustained growth in the data handled to French administrative and judiciary law enforcement in the past years. In the first semester of 2013, Google was served with 2,011 requests by French authorities (it complied with 49 % of them); Facebook 1,547 requests a (39 % compliance rate). In the first semester of 2017, Google was served with 5,661 requests by French authorities (it complied with 63 % of them); Facebook 4,700 requests a 74% compliance rate). That makes for a 360% and 570% increase in the number of requests for which some data was produced, respectively.

**Fostering privatised censorship:** Like in the US, a key goal for French authorities was also to accelerate the takedown of terrorist-related content on the platforms of large online providers. During his trip in California February 2015, Cazeneuve praised these actors for their cooperation, insisting that “they now take content down more rapidly and efficiently than before.”<fnref n="131" /> Their “reaction time” upon notice from public authorities was then said to be of the order of 15 minutes against months some time before.

The visit coincided with the adoption of an implementation decree that opened new avenues for the administrative takedown of online terrorist propaganda, by forcing cooperation of hosting and access providers with sanctions of up to one year imprisonment and a $75 000 fine.<fnref n="132" /> The second report of the member of the French Data Protection Authority tasked with the supervision of this administrative censorship, released in Spring 2017, points to the rapid development of this system, with a two-fold increase in the number of items taken-down by hosting providers (a category which includes social media and search engines) and a three-fold increase in the number of websites blocked by the French police.<fnref n="133" />

<footnote n="130">130. Cassini, S. (2015, April 23). *Terrorisme : accord entre la France et les géants du Net*. Retrieved April 23, 2015, from http://www.lesechos.fr/journal20150423/lec2_high_tech et medias/02124922454-terrorisme-accord-entre-la-france-et-les-geants-du-net-1113723.php</footnote>

<footnote n="131">131. Idem.</footnote>

<footnote n="132">132. Décret n° 2015-125 du 5 février 2015 relatif au blocage des sites provoquant à des actes de terrorisme ou en faisant l'apologie et des sites diffusant des images et représentations de mineurs à caractère pornographique. https://www.legifrance.gouv.fr/eli/decret/2015/2/5/INTX1502813D/jo/texte</footnote>

<footnote n="133">133. Linden, A. (2017). *Rapport d'activité 2016 de la personnalité qualifiée prévue par l'article 6-1 de la loi n° 2004-575 du 21 juin 2004 créé par la loi n°2014-1353 du 13 novembre 2014 renforçant les dispositions relatives à la lutte contre le terrorisme (mars 2016-février 2017)*. Paris: CNIL. Retrieved from</footnote>
But besides these legal avenues that are much criticized but still inscribed in a legislative
framework, the forms of cooperation between the French Ministry of Interior and US tech
companies regarding censorship can also be based on the private law of the firm's terms of service.
This trend that is reflected in the transparency reports released by firms like Google, but the later
fails to make clear what is the legal basis for the takedown when it is mandated by the executive
branch.

<https://www.cnil.fr/sites/default/files/atoms/files/vd_rapport_blocage_2016.pdf>
<figure><img src="image_7.png" /></figure>

Figure: Number of takedown orders sent by public authorities either judicial (blue) or executive/administrative (red) at the global (a) and French (b) levels (source: Google's Transparency Report).<fnref n="134" />

Since 2015, France and the UK have been the European leaders of this push toward privatized censorship, the institutions of the European Union have also been accompanying these trends.<fnref n="135" />

<footnote n="134">134. https://transparencyreport.google.com/government-removals/by-country/FR?country_item_amount=group_by:branches;authority:FR&lu=country_request_amount&country_request_amount=growth_by:branches;authority:FR</footnote>

<footnote n="135">135. See, e.g.: Commission initiative with social media platforms and civil society shows progress. (2017, June 1). Retrieved June 2, 2017, from http://europa.eu/rapid/press-release_IP-17-1471_en.htm
Fioretti, J. (2016, December 5). Web giants to cooperate on removal of extremist content. Reuters. Retrieved from http://www.reuters.com/article/us-internet-extremism-database-idUSKBN13U2W8</footnote>

<footnote>UK looking to increase pressure on internet firms over extremist material: minister. (2017, May 28). Reuters. Retrieved from http://www.reuters.com/article/us-britain-security-manchester-technolog-idUSKBN18O0BT</footnote>
The European Commission and Europol have indeed convened regular meetings and pushed large online platforms to sign a code on hate speech in 2016.<fnref n="136" /> In its report on the activity of its “Internet Referral Unit” created in 2015 to weed out extremist content online, Europol makes clear that these censorship activities are conducted outside of any legislative framework:

> “A referral activity (meaning the reporting of terrorist and extremist online content to the concerned online service provider) does not constitute an enforceable act. Thus, the decision and removal of the referred terrorist and extremist online content is taken by the concerned service provider under their own responsibility and accountability (in reference to their Terms and Conditions).”<fnref n="137" />

The oversight of these activities is plagued with important shortcomings from a human rights perspective,<fnref n="138" /> but they are gaining increasing importance as the French and British approaches to cooperation seems to be replicated at the EU level.<fnref n="139" /> This process is still ongoing. In November 2017, the French government tasked its “Digital Ambassador,” David Martinon, with negotiating with US companies for the takedown of illegal content.<fnref n="140" /> More recently, the French Prime Minister Edouard Philippe announced that platforms should aim at taking litigious content down within one hour open publication,<fnref n="141" /> and in 2017, Germany adopted the “NetzDG law” which gives platforms a 24-hour deadline to take down hateful speech upon notice when it is deemed “obviously illegal.”<fnref n="142" />

These moves, which are sometimes but not always backed by the force of law like in the German

<footnote n="136">136. Hern, A. (2016, May 31). Facebook, YouTube, Twitter and Microsoft sign EU hate speech code. Retrieved June 8, 2016, from http://www.theguardian.com/technology/2016/may/31/facebook-youtube-twitter-microsoft-eu-hate-speech-code</footnote>

<footnote>Monroy, M. (2016, June 29). New Europol regulation due to enter into force from May 2017 – oversight is likely to remain superficial. Retrieved July 15, 2016, from https://digit.site36.net/2016/06/29/new-europol-regulation-due-to-enter-into-force-from-may-2017-oversight-is-likely-to-remain-superficial/</footnote>

<footnote n="137">137. Europol. (2016). *EU Internet Referral Unit - YEAR ONE REPORT* (p. 11). Retrieved from https://www.europol.europa.eu/content/eu-internet-referral-unit-year-one-report-highlights</footnote>

<footnote n="138">138. Baker, J. (2016, July 4). Europol's online censorship unit is haphazard and unaccountable says NGO. Retrieved July 4, 2016, from http://arstechnica.com/tech-policy/2016/07/europol-iru-extremist-content-censorship-policing/ Monroy, M. (2016, June 29). New Europol regulation due to enter into force from May 2017 – oversight is likely to remain superficial. Retrieved July 15, 2016, from https://digit.site36.net/2016/06/29/new-europol-regulation-due-to-enter-into-force-from-may-2017-oversight-is-likely-to-remain-superficial/</footnote>

<footnote n="139">139. Computer support to analyze IS propaganda. (2017, April). Retrieved March 8, 2018, from https://www.europol.europa.eu/publications-documents/computer-support-to-analyze-propaganda</footnote>

<footnote>Disruptive efforts by industry and law enforcement force jihadist sympathisers to seek new platforms to disseminate terrorist propaganda. (2017, September 15). Retrieved March 8, 2018, from https://www.europol.europa.eu/newsroom/news/disruptive-efforts-industry-and-law-enforcement-force-jihadist-sympathisers-to-seek-new-platforms-to-disseminate-terrorist</footnote>

<footnote>EU law enforcement joins together with Facebook against online terrorist propaganda. (2018, January 18). Retrieved March 8, 2018, from https://www.europol.europa.eu/newsroom/news/eu-law-enforcement-joins-together-facebook-against-online-terrorist-propaganda</footnote>

<footnote>Europol coordinates EU-wide hit against online terrorist propaganda. (2017, May 7). Retrieved March 8, 2018, from https://www.europol.europa.eu/newsroom/news/europol-coordinates-eu-wide-hit-against-online-terrorist-propaganda</footnote>

<footnote>Europol coordinates fifth joint operation to flag online terrorist content. (n.d.). Retrieved March 8, 2018, from https://www.europol.europa.eu/newsroom/news/europol-coordinates-fifth-joint-operation-to-flag-online-terrorist-content</footnote>

<footnote n="140">140. Eschapasse, B. (2018, April 2). David Martinon : « Le monde est en état de cyberguerre froide permanente ». Retrieved April 10, 2018, from http://www.lepoint.fr/high-tech-internet/david-martinon-le-monde-est-en-etat-de-cyberguerre-froide-permanente-02-04-2018-2207326_47.php</footnote>

<footnote n="141">141. La France prête à pousser l'UE à légiférer sur les contenus terroristes. (2018, February 26). Retrieved February 26, 2018, from http://www.contexe.com/numerique/briefing/2018/02/26/#briefitem-83434</footnote>

<footnote n="142">142. Aleksandra, K. (2017, November 30). Phantom Safeguards? Analysis of the German law on hate speech NetzDG. Retrieved from https://www.law.kuleuven.be/citip/blog/phantom-safeguards-analysis-of-the-german-law-on-hate-speech-netzdg/</footnote>