France has adopted on November 15th, 2001 a new law, known as "Loi relative à la sécurité quotidienne". While the draft law was in discussion in the French Parliament, 13 extra provisions have been introduced by the government right after September 11. 3 of these adopted measures deal with data retention of Internet communications and with the use of cryptography, granting extended powers to the law enforcement authorities.
Although the contents of this measures, as well as their introduction at that step of the legislative process, were claimed as unconstitutional by most of civil rights defenders, the law passed and the French Constitutional council was not given the opportunity to examine it.
The speech will detail these provisions, explain the context in which they were adopted and what was at stake in their adoption, and show their articulation with the international legislation (European Directives and Council of Europe Cybercrime Convention).



Conference:

First, I would like to thank Marco Cappato and his team for organising this conference which gives me today the opportunity to share with you some information on the French situation and its articulation with the International context, with regards to cybercrime and data retention.

I hope this description of the French situation will show you what could be or what are already the consequences at the national level of the newly adopted Directive on Personal Data Protection in the Telecommunication Sector.

Overview of the French legislation

Let me get back to the French context specifically. We have three main legislative texts in France which are concerned with these issues of cybercrime and data retention. The first one is still a draft law, it is called "the Information Society draft Law" (“Projet de loi sur la société de l’information”). This text was intended to be a transposition of the e-commerce European Directive, so the text is dealing with e-commerce, infrastructure, ISP liability, …, like in the e-commerce Directive, plus cybercrime. It is still a draft law, but it was an interesting process since a large consultation has been started by the Government in October 1999, and the finalised text has only been submitted as a draft law to the French National Assembly in July 2001.

The second text which deals with cybercrime and data retention is called "The Freedom of Communication Law" (“Loi sur la liberté de communication”). This law was adopted on August 2000. Initially, it had nothing to do with Internet, since it was a revision of the French audio-visual communication law : its was mainly dealing with digital TV, new licences, etc. However, some provisions on ISP liability were introduced in it as amendments during the discussion in Parliament, after a highly publicised trial in France, where an ISP has been sued for content hosted on the Web.

The third important text that we have is called the “Daily Safety Law" ("Loi sur la securité quotidienne", abbreviated as LSQ). This law was adopted on mid-November 2001. Again, this text was initially only covering issues like municipal police, driving safety, etc., but after September 11 attacks, provisions on cybercrime and data retention were introduced in this law, in a global package of 13 amendments, so called "anti-terrorism measures”.

“Freedom of Communication” Law

Now let me tell you what are the provisions regarding the Internet in the Freedom of Communication Law. There are provisions on content filtering and on host provider liability. The content filtering provisions says that access providers must provide filtering software to their suscribers. However, there is no penalty if they don't do that. On the host provider liability issues, it’s was first a notice and take down provision but this was declared unconstitutional in France. There is still a notice a take down provision but the notice and take down ordercan only be made by the judge.
The data retention provisions in this text say that ISPs must keep content provider identification data so that the judicial authorities may ask for these data.

The good news in this law is that ISPs are now under professional secrecy and there is a high penalty if they don’t comply with this obligation. The bad news is that the exact type of the data and the retention procedure on modalities as well as on the duration of the retention of data, should be specified by an application decree which we are still waiting although the law was adopted on August 2000 in France.

The last provision in this Freedom of Communication Law is concerned with privacy and anonymity.it’s a. Content providers must put their contact details on their web site. The only exception is for individuals, who may use pseudonyms, when their ISP knows their contact details.

“Daily Safety” Law – Data Retention

The second important text is the "loi sur la sécurité quotidienne" (LSQ), which includes provisions on data retention and provisions on the use of cryptography.

First, the data retention Article - ironically these provisions are assessed in Article 29 of this law - applies to Telecom operators as well as to internet access providers. It was supposed to be more or less a transposition of the European Union Directive on Telecommunications of 1997 (not its recently revised version, of course) with some restrictions, and these restrictions are precisely on the retention of communication data, so that this retention is allowed during up to one year.
The type of these communication data - which we don’t know exactly what they could be - and the actual duration of the retention, are again left to an application decree which we are still waiting. The data is said to be retained for the purpose of prevention, investigation, detection and prosecution of criminal offences.

There is one good news, however : the data should only allow identification of users and of the technical characteristics of communications. Nevertheless, this cannot be anymore considered as good news since we don’t know what are exactly how the “traffic data”, the “identification data”, and the “communication data” are defined. These data should not reveal the content of communication, be it e-mail content or the content of the visited web site. The penalty for ISPs who don’t comply whit these provisions are high: one year jail and 75,000 Euros fine.

Let’s come now to the issues at stake with these data retention provisions: first of all, there is a continuum between the so called “communication” or “traffic” data on the one hand and the content data on the other hand, because of new internet architecture and protocols, because of new software used, etc. It becomes difficult to distinguish between these two types of data. The consequences of these provisions, in practice, will allow to know who is writing to whom and who is consulting what on the Internet, as perfectly shown by Erich Moechel in his speech.

This law also raises a problem with respect to the French Constitution : my organisation, IRIS, and others NGos, have claimed that these provisions are unconstitutional. Indeed, Article 34 of the French Constitution says that fundamental freedoms can only be limited by law, and this will be done in the case of the LSQ with an administrative decree.
As a matter of fact, only one month after the LSQ has been adopted in France, the use of the retained data has already been extended to administrative bodies, mainly financial administrative bodies, in the Finance law which has been adopted in December 2001.

This is to be noted since these provisions, like the others so-called "anti-terrorism" provisions, were justified by September 11 attacks, while in fact these provisions on data retention, as well as provisions on the use of cryptography, were already included in the LSI “Information Society draft law” which, as I previously said, has already been submitted to the French National Assembly on July 2001, obviously before the attacks occured.

In addition, these provisions are unneeded, since the AFA (“Association française des fournisseurs d´accès”, the French association of ISPs) has published a document evaluating the requests for data that they have received from the judicial authorities, and it is stated in this public document that they received approximately 500 request monthly.

Although these provisions are unconstitutional, as some people and organisations claimed, this law was not submitted to the French Constitutional Council. The reason is simply, and this was publicly confessed, that there has been a political agreement between the Majority (at this time, the Socialists), and the Opposition (right). They have then jointly decided not to submit this law to the French Constitutional Council.

“Daily Safety” Law – Cryptography

There are others provisions in this LSQ (“Loi sur la securité quotidienne”), which deal with the use of cryptography and they are stating the conditions for decrypting encrypted data.

First, these provisions state that the public prosecutor or the judge may ask any expert to decrypt data. If they suspect a crime or an offence which penalty is more than two years jail, then special security means may be used by the prosecutor or the judge, which are covered by the very famous French ”secret défense” : this would lead to a procedure where no control and no opposition would be allowed.

Furthermore, cryptography tool providers should provide decryption keys to authorised agents (authorised by the Prime Minister) upon request, and the penalty for not complying with this obligation is two years jail and 30,000 Euros fine.

The last provision states that anyone having access to decryption keys should provide them, and the penalty is very high again: three years jail and 45,000 Euros fine. The keys should be provided upon judicial request when cryptography has been is used for commission, preparation, or facilitation of a suspected crime or offence.

Let me analyse what are the issues at stake. First of all the judicial control is not ensured: in France, the public prosecutor may start investigations before any crime or offence has been committed, so “suspected” is an important word in the text of the law.
Second, these provisions allow for self-incrimination, and they thus contradict the French law. Third, professional secrecy is not any more guaranteed for some professions, for example lawyers who may exchange encrypted e-mails with their clients. Finally, these provisions on cryptography were, like the data retention provisions, already included in the draft law on information society before September 11 attacks. The same political agreement between the majority and the opposition applied to avoid its examination by the French Constitutional Council.

Actions against the LSQ

There have been a lot of actions, campaigns and protests in France against the LSQ.
Important campaigns have been launched against the whole package of so-called “anti-terrorism” measures introduced in the LSQ. These campaigns were organised by many trade-unions, lawyers associations, the French Humans Rights League, etc. My own organisation (IRIS) has also been involved a lot in these campaigns.

In France, not anyone can challenge the constitutionality of a law: only a group of 60 members of Parliament, or one of the four highest personalities (the President of the Republic, the Prime Minister, the President of the National Assembly and the President of the Senate) can do that; we have sent letters to all these people asking them to submit the law to the Constitutional council but they have ignored this request.

After the adoption and the promulgation of the LSQ, the only remaining possible action was to file a complaint against France with the European Commission, and that is what my organisation has done, claiming that this law is violating the European legislation, mainly the two Directives on personal data protection of 1995 and 1997.

This case is still pending, the complaint is under examination, and I know that there is a lot of debate even inside the Commission; we are still waiting for the final decision but I understand that it is a very politically sensitive issue.

Articulation with the international context

Let’s examine first the European union context, with the revision of the personal data protection in the Telecommunication sector Directive. The provisions on data retention of the French LSQ already implements the provisions of article15(1) of the new Directive. As a matter of fact, it is ironical to know that France has already been condemned for not implementing in due time the two Directives on personal data protection of 1995 and 1997. This Member State has now implemented the new Directive even before it has been adopted at the EU level…

The second articulation with the international context is between the cryptography provisions of the LSQ and the cybercrime Convention of the Council of Europe. We can say that the LSQ provisions on cryptography are implementing Article 19 of the cybercrime Convention, which deals with search and seizure of stored computer data. This Convention has been signed by France , but it still needs a ratification law.

Future developments

There is now in France a new majority, with a new government and a new National Assembly. We are still waiting for the decree for both laws: “Freedom of Communication” law and “Daily Safety” law. We don't know what will happen with the text of “Information Society” draft law because it has to be re-submitted to the new National Assembly.

As a matter of fact, today there is a presentation to the French Council of Minister of a new legislation on security and extension of law enforcement authorities powers. We have to check the content of this law to see if there is anything regarding the Internet; in fact the extension of law enforcement authorities powers has been one of the most important measures promised by the new majority during the election period.

Note (update reprinted from GILC Alert, the Global Internet Liberty Campaign Newsletter, Volume 6, Issue 5, 23 July 2002, available www.gilc.org)

On 17 July 2002, the French National Assembly adopted in its first reading a Law for Orientation and Programming for Internal Security (Loi d'Orientation et de Programmation pour la Sécurité Intérieure-LOPSI). Among other things, the plan will grant law enforcement authorities direct access to the personal data of Internet users, which will be retained by telecom operators and Internet service providers. This would change current laws that mandate government agents to file a requisition addressed to the relevant telecommunications provider before they can get the desired personal information. LOPSI was submitted to the Assembly through an emergency procedure, and a draft document is expected to appear this fall detailing and implementing the means for such direct access. The government's purported justification for such a provision is to overcome "the incapacity of the public or private institutions [including] telecom operators ... to answer within [a] reasonable time the requisitions carried out by the legal senior police officers at the request of the judicial authority".

The proposal has already generated a fair amount of criticism. In a detailed analysis, Imaginons un Réseau Internet Solidaire (IRIS-a GILC member) noted that LOPSI would abrogate one of the few procedural checks left against government surveillance-the required filing of a requisition. By removing this requirement, IRIS warned that the legal regime would increase the likelihood of abuse. Moreover, the group raised the possibility that the LOPSI and its progeny could be used to coalesce personal information into a single centralized database, making it even easier for government agents to spy on unsuspecting innocent civilians.

To many observers, LOPSI represents just the latest in a series of French government moves that have badly eroded privacy rights online. Previously, the French government had approved a package of security measures popularly known as LSQ (short for "la Loi n°2001-1062 du 15 novembre 2001 sur la Sécurité Quotidienne"), which contained language allowing "technical data involved in a communication" to be kept for up to one year. IRIS filed a complaint against LSQ with the European Commission, but the Commission has yet to make a formal decision on the matter.

An IRIS press release on this subject is available at
http://www.iris.sgdg.org/info-debat/comm-lopsi0702.html
To read an IRIS analysis of LOPSI, click
http://www.iris.sgdg.org/documents/lopsi.html

Annex – About IRIS

Presentation: IRIS (Imaginons un réseau Internet solidaire) is a non profit French NGO founded in October 1997. IRIS objectives are the promotion of a public service infrastructure for permanent connectivity to the Internet, the action in favor of Free speech and Privacy, and the promotion of a non-commercial Internet.
Membership: In France, IRIS is a member of the DELIS coalition (Droits et libertés face à l'informatisation de la société: www.delis.sgdg.org), and of the R@S (Réseau associatif et syndical: www.ras.eu.org). At the European level, IRIS is a founding member of the EDRi federation (European Digital Rights: www.edri.org). At the International level, IRIS is a member of the GILC coalition (Global Internet Liberty Campaign: www.gilc.org).
Activities: IRIS is active at the National level (institutional hearings and consultations, raising awareness of NGOs and trade-unions with regards to political and social stakes of the Internet, publishing analyses and reports, participating in conferences,…), at the European level (working groups of the European Commission on illegal and harmful content and on cybercrime) and at the International level, mainly through the GILC coalition.
Details: More information are available or IRIS web site: www.iris.sgdg.org.