Intelligence Act (France)
The French Intelligence Act of 24 July 2015 (French: "loi relative au renseignement") is a statute passed by the French Parliament. The law creates a new chapter in the Code of Internal Security aimed at regulating the surveillance programs of French intelligence agencies, in particular those of the DGSI (domestic intelligence) and the DGSE (foreign intelligence). History. The Intelligence Bill was introduced to the Parliament on 19 March 2015 by French Prime Minister Manuel Valls and presented as the government's reaction to the Charlie Hebdo shooting. Despite widespread mobilization, the Bill was adopted with 438 votes  in favor, 86 against and 42 abstentions at the National Assembly and 252 for, 67 against and 26 abstentions at the Senate. It was made into law on 24 July 2015. Although framed by the government as a response to the Paris attacks of January 2015, the passage of the Intelligence Act was actually long in the making. The previous law providing a framework for the surveillance programs of French intelligence agencies was the Wiretapping Act of 1991, aimed at regulating telephone wiretaps. Many surveillance programs developed in the 2000s—especially to monitor Internet communications—were rolled out outside of  any legal framework. As early as 2008, the French government's White Paper of Defense and National Security stressed that "intelligence activities do not have the benefit of a clear and sufficient legal framework", and said that "legislative adjustments" were necessary. Main provisions. This section summarizes the main provisions of the Intelligence Act. Scope. Through article L. 811-3, the Act extended the number of objectives that can justify extrajudicial surveillance. These include: These surveillance powers can also be used by law enforcement agencies that are not part of the official "intelligence community" and whose combined staff is well over  45,000. Oversight. The existing oversight commission, the "Commission nationale de contrôle des interceptions de sécurité", was replaced by a new oversight body called the "National Oversight Commission for Intelligence-Gathering Techniques" ("Commission nationale de contrôle des techniques de renseignement", or CNCTR). It is composed of: The CNCTR has 24 hours to issue its "ex ante" non-binding opinion regarding the surveillance authorizations delivered by the Prime Minister before surveillance begins, except in cases of "absolute emergency" where it is simply notified of the surveillance measure within 24 hours upon deliverance (article L. 821-3). For "ex post" oversight, the CNCTR  has "permanent, comprehensive and direct access to records, logs, collected intelligence, transcripts and extractions" of collected data. It is able to conduct both planned and in the premises where these documents are centralized (article L. 833-2-2). If an irregularity is found, it can send to the Prime Minister a "recommendation" so that she can put an end to it. One hugely significant exception to the CNCTR's oversight powers are the bulk of data obtained through data-sharing with foreign intelligence agencies (article L. 833-2-3). Wiretaps and access to metadata. Techniques of communications surveillance covered by  the Act include telephone or Internet wiretaps (L. 852-1), access to identifying data and other metadata (L. 851-1), geotagging (L. 851-4) and computer network exploitation (L. 853-2), all of which are subject to authorization of a renewable duration of 4 months. Black boxes and real-time access to metadata. The Act authorizes the use of scanning device (nicknamed "black boxes") to be installed on the infrastructures of telecom operators and hosting providers. Article L. 851-3 of the Code of Internal Security provides that, "for the sole purpose of preventing terrorism, automated processing techniques may be  imposed on the networks of [telecom operators and hosting providers] in order to detect, according to selectors specified in the authorisation, communications that are likely to reveal a terrorist threat. Another provision limited to anti-terrorism allows for the real-time collection of metadata (article L. 851-3, for terrorism only and for a 4 months period). Initially, the provision targeted only individuals "identified as a [terrorist] threat". After the 2016 Nice Attack, it was extended by a Bill of the state of emergency to cover individuals "likely to be related to a threat" or who simply belong to "the  entourage" of individuals "likely related to a threat". According to La Quadrature du Net, this means that the provision can now potentially cover "hundreds or even thousands of persons (...) rather than just the 11 700 individuals" reported to be on the French terrorism watchlist. Computer Network Exploitation. The Act authorizes computer network exploitation, or computer hacking, as a method for intelligence gathering. Article L. 853-2 allows for: Considering the intrusiveness of computer hacking, the law provides that these techniques are authorized for a duration of 30 days, and only "when intelligence cannot be collected by any other legally  authorized mean." The Act also grants blanket immunity to intelligence officers who carry on computer crimes into computer systems located abroad (article 323-8 of the Criminal Code). International surveillance. The Act also provides chapter on the "surveillance of international communications", particularly relevant for the DGSE's surveillance programs. International communications are defined as "communications emitted from or received abroad" (article L. 854-1 and following). They can be intercepted and exploited in bulk on the French territory with reduced oversight. Safeguards in terms of bulk exploitation and data retention are lessened for foreigners (though the definition of foreigners is  technical, i.e. people using non-French "technical identifiers"). Data retention periods. For national surveillance measures, once communications data are collected by intelligence agencies, retention periods are the following: For international surveillance, retention periods depend on whether one end of the communication uses a "technical identifiers traceable to the national territory" or not, in which case the "national" retention periods are applicable, but they start after the first exploitation and no later than six months after collection (article L. 854-8). If both ends of the communication are foreign, the following periods apply: The law fails to provide any framework to  limit staff access to collected intelligence once it is stored by intelligence and law enforcement agencies. Redress mechanism. The Act reorganizes redress procedures against secret surveillance, establishing the possibility to introduce a legal challenge before the Council of State after having unsuccessfully thought redress before the CNCTR. Criticism and legal challenges. During the Parliamentary debate, the bill faced severe criticism from several organizations including National Commission on Informatics and Liberty (CNIL), National Digital Council, Mediapart, La Quadrature du Net. The implementation decrees of the French Intelligence Act are currently undergoing a series of legal challenges by French civil society organizations  La Quadrature du Net, French Data Network and Fédération FFDN before the Council of State.