When Olivier Laurelli carried out a series of routine internet searches in the summer of 2012 he could have had no idea that his actions would land him in police custody for 30 hours and lead to a a 3,000-euro fine. Yet on Wednesday last week the court of appeal in Paris convicted the journalist, IT specialist and hacker of 'theft' and 'fraudulently' remaining in a computer system where he was not authorised to be.
Laurelli's 'crime' was to stumble across documents belonging to the French Agency for Food, Environmental and Occupational Health & Safety (Anses) during a Google search. The journalist, whose hacking and activist handle is 'Bluetouff', had been searching for documents about the Syrian regime as part of his involvement with a group that provides technical support for opposition groups in Syria, when he came across a working document relating to the agency. Intrigued, he dug deeper and found a series of the agency's files readily accessible. By accident he had entered the agency's 'extranet' where its researchers can swap working documents. An oversight by the agency's IT staff meant the extranet had not been secured and its content had been picked up and indexed by Google.
Laurelli soon realised that the documents were normally password-protected. However, noting that they were not of a confidential access, and having been able to find them simply through a Google search, the journalist decided to download 8,000 files. In August of that year an editor at the exposé journalism website Reflets.info with which Laurelli is involved used one of these documents as the basis for an article on 'silver nanoparticles'.
It was from the publication of this article on Reflets.info that the IT department at Anses became aware of the lack of security on their extranet and they contacted the police. The investigation was passed on to the French domestic intelligence agency the DCRI and Laurelli, who had taken no precautions to hide his identity, was quickly tracked down. His home was searched, some of his computer equipment was seized and he was detained for questioning for 30 hours.
The journalist's initial trial took place in April 2013 at the district court in Créteil south-east of Paris at which he was charged with 'fraudulent access to an automatic data processing system', remaining 'fraudulently' within that system, and with 'theft' of the documents. The judges quickly ruled that the fact these documents could be found in simple search results was the result of a mistake by Anses, and that they were in the public domain. They considered that the journalist had a “legitimate right to think that certain data on the site needed an access code and a password but that the data he recovered was freely accessible and he was perfectly able to stay inside the system”.
Therefore the, judges ruled, the accused could not be guilty of 'fraudulent access' or of 'fraudulently staying inside the system', still less of theft. Laurelli was acquitted on all charges. The verdict was accepted by Anses who recognised their responsibility in the affair. However, the prosecution authorities appealed.
The court of appeal hearing took place in Paris on December 18th, before judges who appeared not to have even a basic knowledge of the world of technology. The judge whose role it was to summarize the facts seemed unacquainted with the name 'Google', pronouncing it French-style as “gog-le”, whereas French people usually pronounce it the same way as native English speakers do. Nor did he appear to know what 'login' was, pronouncing the word French-style as “lo-jan”.
This made it difficult for the defence to explain how someone could come across the Anse documents by a simple online search. “But you still have to tap in the key words...?” asked one judge, doubtfully. “How can you get to questions of public health when you are looking for things on Syria?” As the hearing continued it became apparent, say the defence team, that the judges had a lurid idea of the internet and the documents that can be found there. “You don't care whether you're going to kill the entire planet?” asked one of the judges, indignantly, after Laurelli had just explained that the documents were clearly not confidential.
The prosecutor also admitted having some problems getting to grips with the subject. “I haven't understood even half of the terms I've heard today,” he told the court. “My children could easily explain all that to me but I think that in this case we must above all else simplify things and not get lost.” The prosecutor conceded that there had been failure on the part of Anses's extranet but he called into question the defendant's “good faith” noting: “You knew that this extranet was normally protected.”
Laurelli's defence lawyer Olivier Iteanu told the court: “It is quite astonishing to prosecute someone without understanding what one is accusing them of.” The lawyer pointed out that Anses itself had accepted it made a mistake and noted that the agency had not made itself a civil party to the proceedings, as it had the right to do. Iteanu also wondered whether the “harassment” of his client by the prosecution in appealing his acquittal was linked to the revelations made by his website in recent years.
However, in its ruling handed down last week the court accepted the prosecution’s arguments and overturned the original verdict, finding Laurelli guilty of fraudulently staying inside the Anses computer system and of theft, though not of fraudulent access. They sentenced the journalist to pay a 3,000-euro fine, a stiffer punishment than the 2,000-euro suspended fine demanded by the prosecution.
The ruling now means that any journalist or internet user could face prosecution for downloading a document that is supposed to be confidential but which has been mistakenly put on the web. Nor does the person have to used any subterfuge, technical skill or employed computer code; all they need to do is to have come across such material via a search engine, as Laurelli did.
After the verdict Laurelli's lawyer Olivier Iteanu told Mediapart that he was still baffled about why the prosecution authorities had chosen to appeal the original court's decision to acquit his client. “You could say that it is, among other things, a way of prolonging the surveillance on Olivier Laurelli. For example, it would allow them to keep his [computer] hard drives.”
Contacted by Mediapart, Anses was reluctant to discuss a court case it was not directly involved in. Its press office simply confirmed that the original problem arose from a “computer-related error” and that they had not joined in as a civil party to the criminal prosecution, something they were entitled to do under French law.
Olivier Laurelli, meanwhile, does not yet know if he will appeal the verdict, and says he was not completely surprised by the court of appeal’s decision. “In fact, it was quite in line with that court hearing. I was criticised for having stayed in a public space and of having stolen – and thus taken away – documents that I copied and did not take away. Faced with e-gnoramuses (1), I couldn't have expected anything less.”
------------------------------------------
1. Laurelli used the neologism“e-gnare” which means someone suffering from another recently-coined word “e-gnorance” - the condition of having little or no understanding of the digital world.
-----------------------------------------
English version by Michael Streeter