Article 17 of France’s new military programming law provides for the creation of a ‘passenger name record’ (PNR) and ‘advanced passenger information’ (API) database which records the details of air travel passengers using French airports.
The information collected is used for the profiling of passengers on a large scale, essentially differentiating ‘normal’ travellers from ‘suspect’ ones according to criteria such as their declared destinations and means of payment.
The grouped database, called a ‘Passenger Information Unit’ (‘unité information passagers’), or UIP, is presented as a tool with which to combat terrorism and organised crime. It will record all information given by passengers during travel reservations over a period of five years. The only exclusion will be information concerning air travellers within mainland France; the French Senate had proposed, unsuccessfully, that this exception be also extended to flights between European Union (EU) member states.
The move comes ahead of a planned European Commission (EC) directive on the issue, which has been delayed over several years by strong opposition from parties of the Left in the EU parliament. They broadly argue that the project is at present a disproportionate infringement on civil liberties.
Enlargement : Illustration 1
“The PNR database is indispensable for our intelligence services but also for the judicial [criminal investigation] police services given what’s at stake in knowing of the international trips [carried out] by individuals attached to Al Quaeda-linked movements and criminal traffic,” said French defence minister Jean-Yves Le Drian, speaking as the draft text of the law passed before the lower house, the National Assembly, on November 29th.
PNR information, which is collected by airline companies at the time of travel reservation, is rich in personal details: these include the complete itinerary of a passenger, the address for payment of the travel, credit card numbers, details of travel agencies used, the identities of travelling companions, seat numbers, food preferences, declared health problems and contact details in the country a passenger is flying to.
In the US, following legislation introduced following the September 11th 2001 terrorist attacks, this data is systematically provided to the Department of Homeland Security and the intelligence services. In the intervening years, the EU has successfully negotiated with the US to include certain safeguards regarding personal privacy in the transfer of PNR information to the American authorities, notably with regard to EU personal data laws.
The latest agreement on this was approved by the European Parliament in 2012, and followed a prior deal reached in 2007.
The UIP is to be managed by about 60 staff, while the list of those police and intelligence services that will have access to it is yet to be established under a decree. Beyond terrorist activity, it also targets criminal activity across 31 types of criminal behaviour (a list of these in French is available here), and which include human trafficking and racist acts, paedophilia and arms smuggling.
The data will not include such personal details as ethnic origin, religious beliefs, political opinions and sexual behaviour.
The UIP can be used either to monitor the travel of a person already identified in relation to criminal activity, or to identify individuals whose “manner of travelling presents a risk”.
Until now, just a few EU member states have used such data on air travellers, and only the United Kingdom has a fully-operational system using the PNR scheme.
“We’re in a totally idiotic situation, [with] Europe having to collect information for the benefit of American services, without having access to it,” said a source from the French Senate’s defence affairs committee, whose name is withheld.
Before the new French legislation, none of the country’s investigating agencies other than the customs services were allowed to access API information, which is stored within a French database created in 2006 and called the ‘Airline Passenger File’ (‘fichier des passagers aériens’), or FPA.
The limited nature of information on the FPA was underlined by the French Senate in a document on the recent defence programming legislation, and which justified the creation of the new ‘Passenger Information Unit’: “In the event, only those passengers leaving for or coming from 31 sensitive countries are the subject of a minimal surveillance by this means,” it stated. “Thus, if a person travels to a sensitive country via a stopover in Europe or a country that is not [considered as] a sensitive destination, the intelligence services are not informed.”
The Senate document cited the case of Toulouse gunman Mohamed Merah, a 23 year-old Islamist who murdered seven people in March 2012 in a series of shootings in and around the southern city of Toulouse. “The current system did not allow for the evaluation of the radicalization of the person concerned”, it found, adding that “the PNR data would have allowed for moving faster during the investigation”.
Socialist Party Member of Parliament (MP), Jean-Jacques Urvoas, who is chairman of the National Assembly’s committee for constitutional laws, agreed: “It’s a counter reaction of the Merah case, where we saw clearly that people don’t take direct flights,” he commented. “So, to know the travel process of people can be useful.”
However, the French intelligence agency, the DCRI, did in fact know of almost all of Mohamed Merah’s many journeys abroad, and had that information well before he went on his killing spree in 2012. The DCRI was informed in November 2010 by the French armed forces’ security agency, the DPSD, that Merah had been identified in the Afghan city of Kandahar.
It is now established that he managed to enter Pakistan in mid-August 2011 without being discovered at the time. According to French weekly L’Express, Merah travelled via the Persian Gulf state of Oman, which does not figure among the 31 countries considered to be ‘sensitive’ destinations to which details of direct travellers is systematically logged. Despite this, the DCRI also learnt of Merah’s covert journey to Pakistan early in September 2011, and had prepared to question him upon his return.
These events clearly demonstrate that it was not because of a hitherto lack of information that the DCRI failed to intervene earlier in Merah’s case.
'Every passenger becomes a suspect'
In a 2011 document presenting the stalled directive, entitled ‘The Use of Passenger Name Record data for the Prevention, Detection, Investigation and Prosecution of Terrorist Offences and Serious Crime', the EC argues for the use of PNR data in the fight against organised crime, claiming that in 2009 it accounted “exclusively or essentially” for between “65% to 75%” of drug hauls in Sweden and 95% in Belgium – where the seizures of a total of 278.9 kilos of cocaine, plus heroin and other drugs, were attributed to intelligence gained from the use of PNR information. It added that in the UK, the use of PNR data led to the seizure of 212 kilos of cocaine and 20 kilos of heroin over a six-month period in 2010.
A parliamentary source whose name is withheld summed up the type of practical use the data would be put to: “If it is noticed that in a flight coming from Miami the guy in fact left from Columbia he will be checked by customs on his arrival,” he said. “If his point of departure was Peshawar, there is every possibility that it would be the DCRI that checks his bags, his papers and verifies who he is staying with.
A French Senate report sets the criteria used in such profiling as being subject to an evaluation by police and intelligence services of “the evolution of trafficking and operational means [employed] by criminal and terrorist networks”.
In the text of its 2011 presentation of the proposed directive for the use of PNR data, the EC states: “For example, an analysis of PNR data may give indications on the most usual travel routes for trafficking people or drugs which can be made part of assessment criteria. By checking PNR data in real-time against such criteria, crimes may be prevented or detected.”
“A concrete example given by a Member State is a case where PNR analysis uncovered a group of human traffickers always travelling on the same route. Using fake documents to check in for an internal flight, they would use authentic papers to simultaneously check in for another flight bound for a third country. Once in the airport lounge, they would board the internal flight. Without PNR it would have been impossible to unravel this human trafficking network.”
In 2008, the European Data Protection Supervisor (EDPS - a supervisory authority that ensures EU institutions process personal data in respect of the right to personal privacy), criticised such profiling methods. In its report entitled ‘Opinion of the European Data Protection Supervisor on the draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes’, it noted: “The main concern of the EDPS relates to the fact that decisions on individuals will be taken on the basis of patterns and criteria established using the data of passengers in general. Thus decisions on one individual might be taken, using as a reference (at least partially), patterns derived from the data of other individuals. It is thus in relation to an abstract context that decisions will be taken, which can greatly affect data subjects. It is extremely difficult for individuals to defend themselves against such decisions.”
In a discussion on the use of PNR in the French upper house in 2009, centre-right UDI party Senator Yves Détraigne, member of the Senate’s Commission for the Supervision of the Application of Laws, commented: “The principle criticism over these indifferent gatherings of data is the a priori consideration of each [traveller] as a suspect. This personal data is kept in case it might prove to be interesting at another time.”
On April 27th 2013, the European parliament's Committee on civil Liberties, Justice and Home Affairs rejected the EU's draft Directive on the use of PNR. Amid the fallout of the revelations by former US National Security Agency contractor Edward Snowden of practices of mas surveillance by US and UK inteklligence services, the current resistance to the EC directive makes it unlikely to be adopted for some time yet.
"The EU proposal was rejected for reasons that had nothin,g to do with its content," commented British European Parliament member (MEP), Timothy Kirkhope, who is the civil liberties committee's shadow rapporteur for the proposals of the European Conservatives and Reformist Group's proposals on data protection reform. These people who think it is important to control the exchange of information, Liberals and Socialists, wanted a form of blackmail to push the commission to move on personal data protection."
"It is ridiculous because the directive will bring extra security and extra protection", he added. "It will give a common standard within the EU, introducing basic rules. We have no guarantee that the French system will have the same protection."
Indeed, the EC draft directive proposes that personal data be made anonymous after a period of 30 days, whereas there is no such stipulation in the new French framework for using PNR.
-------------------------
English version by Graham Tearse