A group of internet activists, writers of computer code and lawyers are waging legal guerilla warfare against the raft of new surveillance laws being rushed through by the French government. These 'hacktivists' painstakingly sift through all sections of the new laws and decrees that implement them, looking for mistakes rather as computer coders go through code line by line looking for 'bugs'.
The individuals involved in this project, which has already led to around ten formal legal challenges already filed or about to be filed, come from groups fighting for the freedom of the internet and internet neutrality, and have dubbed themselves “amateur scholars”. These organisations are the campaign group La Quadrature du Net and internet access associations French Data Network (FDN) and the Fédération des Fournisseurs d’Accès à Internet Associatifs (FFDN).
The fact that the new Paris headquarters of one of these groups, La Quadrature du Net, which opened in March and which also hosts the hacktivist legal team, still bears the name 'Chemla' in gold letters on its doorway is no coincidence. For these offices belong to Laurent Chemla, one of the leading figures in French 'hacktivism' and a pioneer in using the courts to defend digital freedoms.
“It's no small thing to be at Laurent Chemla's place,” says 'Nico', not his real name, a lawyer who works for the new team of internet-legal activists. “He was one of the first who enabled us to understand that the law was also a tool at our disposal. And that at a time when some of the founders of La Quadrature were just 16!”
Laurent Chemla, who has held a 0.10% stake in Mediapart since its creation in 2008, made a fortune at the start of the 2000s by creating and then selling the leading domain name registration and hosting site Gandi. But before that he was one of France's leading hackers. He was the first person to face proceedings – and be acquitted – for digital hacking in the 1980s, the era of the French information system Minitel.
Ten years later, in the mid-1990s, Chemla was involved in the creation of the internet users' association the Association des Utilisateurs d’Internet (AUI), which fought against a legal amendment seeking to block access to certain websites. In 1996 France's highest constitutional authority, the Conseil Constitutionnel, declared the amendment unconstitutional. However, since then measures blocking access to sites have been adopted, targeting paedophile sites in 2011 and sites supporting terrorism in 2014.
So it is perhaps appropriate that the current struggle against restrictions on internet freedom is taking place in Chemla's old Paris flat which he rents to La Quadrature and which provides the meeting place for the hacktivist legal team – though this is not an expression the activists like. “No! We're not a legal team!” insists Benjamin Bayart, president of the FFDN. Indeed, the group of around ten individuals who have worked together since the start of 2015 are keen to emphasize their internet and computer background. So while the group does include several lawyers and law students, they draw on their hacktivist roots and approach the law in the same way that one examines software.
“A guy who has done some code can have more ability than a lawyer in this type of case,” explains Nico. “He will have very rigorous reasoning, based on logic. He is used to understanding a system and detecting 'bugs'.” So rather than 'legal team' these legal 'debuggers' prefer to describe themselves as “amateur scholars”. This was the expression used by socialist Member of Parliament Jean-Jacques Urvoas, who piloted the deeply controversial new surveillance law through the National Assembly, to describe opponents of his bill in July 2015.
Enlargement : Illustration 1
The group's main targets are the official decrees that implement new laws in this domain. These include two decrees, published in February and March 2015, that block access to certain websites and the decree implementing article 20 of the defence planning law, the loi de programmation militaire (LPM), of December 2013 that allows the collection of data in “real time” direct from the networks. Another decree they are examining is a secret one issued in 2008, the contents of which were revealed by L'Obs magazine in July this year, and which authorises the mass surveillance of international communications.
“It all began with the first legal proceedings, in December 2014, against article 20 of the LPM,” says Félix Tréguer, another “amateur scholar” and a law researcher at the EHESS research centre and the Center for International Studies and Research (CERI). “It was Hugo who spotted the decree's publication, carried out on the sly between Christmas and the New Year, and who alerted us via the internal list.”
The 'Hugo' in question is lawyer Hugo Roy who says: “It's not by chance that the first proceedings targeted the LPM.” Another member of the team, Arthur, explains: “The fact that we were unable to refer this bill to the Conseil Constitutionnel had stuck in our throat. The UMP [editor's note, right-wing opposition party now re-named Les Républicains] MPs who could have referred it had come under enormous pressure.”
“We worked on this legal challenge throughout the whole of January,” says Hugo. “Then in February the first decree relating to the terrorism law and the removal from search engines of sites supporting terrorism was published, and a month later there was the decree on the administrative blocking of these same sites. Then, still in March, the debate started on the surveillance law...”
Gradually the small team organised itself and became more professional. At the start of 2015 they were helped by lawyer Patrice Spinosi, who represented them without a fee in several actions, in particular appearing in front of the Conseil Constitutionnel. Slowly the 'amateur scholars' grew in confidence as they became aware that a whole new field of action was opening up to them.
“At the start we were a little bit on the defensive. We were afraid of getting started, of lacking resources, even of legal proceedings being started,” admits Nico. “But in fact, the opposite happened. Not only did we succeed in drafting and lodging different actions, but the more we dug the more we found bugs. This work allowed us to give ourselves a judicial framework, to arm ourselves with new arguments.”
The French version of 'cause lawyering'
In fact, the team's knowledge of texts and procedures, whether at a national or a European level, is impressive. Just as a computer expert combs through each line of code in software to find bugs there, the 'amateur scholars' dissect the government's legislative texts and decrees with surgical precision. That was how Benjamin Bayart came across a blunder in the decree implementing article 20 of the LPM, a mistake that is one of the keystones of their challenges before the country's top administrative court, the Conseil d'État.
“Article 20 of the LPM creates four articles,” explains Bayart. “Among these article 246-4 says that it needs to be complemented by an implementing decree. That was indeed published, and in its introduction it did make reference to 246-4. The problem is that all the rest of that decree in fact refers to another article, 246-1. It's a good example of a drafting bug!”
However, the launching of numerous proceedings is not simply an uncontrolled and frenetic procedural attempt to attack the legislative texts anyway they can. On the contrary, the legal challenges form part of a strategy, a new concept of activism that aims to take the fight into new domains. “We're inspired by 'cause lawyering',” says Félix Tréguer. This term, which was first coined in the United States, refers to the use of the law for the common good, for the defence of the weakest.
“In the United States this practice is used a great deal by different movements fighting for civil rights. There are many lawyers who are involved, and there are also 'law clinics' open in universities, offering pro bono legal advice in a particular domain: the environment, immigration...the judicial is integrated into activism and constitutes a field of combat,” says Félix Tréguer. He cites as a model the US-based Electronic Frontier Foundation, the influential and respected organisation whose slogan is 'Defending your rights in a digital world'.
“In France, even if some associations such as GISTI [editor's note, an immigrants' rights group] have been precursors in this domain, there is very little 'cause lawyering' in our culture,” says Tréguer. “We have a much more closed approach. In general we in France take the view that once a law's been voted through [the issue] is lost, there's nothing more to be done.”
In this vision of hacktivism, however, the use of legal action is in itself a form of activism because it forces the authorities to adopt a position, to make certain points clear. “Our work is both judicial and technical,” explains Nico. “We're not doing this to annoy them. We want to force the government to look into the technical side, to reconcile the legal and technical analyses. One of the big problems with the texts is that they are very imprecise on essential technical questions. For example, when the law allows for the blocking of sites but doesn't detail what is understood by that. Is it the whole site? Some pages? The answer has very concrete technical consequences. This lack of precision is thus detrimental to citizens.”
The majority of the six legal actions so far lodged by the 'amateur scholars' have been to the Conseil d'État. Others will be lodged between now and the end of the year against the decrees implementing the surveillance legislation passed in July 2015 and against the legislation on international surveillance that is currently being examined by the French Parliament. But the team's best chances of legal victories are perhaps at a European level, at the European Court of Human Rights, whose role is to ensure states respect the European Convention on Human Rights, and the European Court of Justice (ECJ), which ensures that EU member states correctly apply European treaties.
Neither court has held back from condemning European countries for breaches of the law. Indeed, when it comes to digital freedoms the ECJ has issued two resounding rulings. In the first, in April 2014, the European judges quite simply struck down a European directive on the storing of personal data in the context of the fight against terrorism and organised crime, citing its intrusive character which the court said was contrary to the principle of respect for people's private lives. This decision already forms the legal basis for one of the actions being brought by the 'amateur scholars' against legislation governing the communication of personal data.
The second case was in early October 2015, when the European Court annulled the so-called 'Safe Harbor' accord between Europe and the United States that allowed American firms to transfer data that they had collected on European citizens to the US. The judges considered that the surveillance measures employed by the US's National Security Agency meant that there was no guarantee of an adequate level of protection for European citizens' data. Yet with its planned law on international surveillance France is ready to vote through measures similar to those that led to the US being condemned in this case.
Lawyers and journalists go to the European Court of Human Rights
The judicial guerilla warfare against government legislation is not limited to this team of hacktivists. Alongside his work for the 'amateur scholars', lawyer Patrice Spinosi is also taking a case to the European Court of Human Rights on behalf of the trade body for legal affairs journalists, the Association confraternelle de la Presse Judiciaire (APJ), as well as on behalf of the seven members of its ruling committee, claiming that the new surveillance law is an infringement of the right of journalists to keep their sources secret.
The same lawyer is also preparing to take other cases against this new law, on behalf of the head of the Paris Bar, barrister Pierre-Olivier Sur, the Paris Bar itself and the Confédération Nationale des Barreaux (CNB), which represents barristers in the French regions. Another lawyer, Alexis Guedj, is meanwhile due to launch several actions against the same law from the journalist representative bodies the Syndicat National des Journalistes (SNJ) and the Fédération Internationale des Journalistes (FIJ).
These different actions are principally based on the absence of sufficient guarantees given to professionals and citizens against clear infringements of their fundamental rights: in particular the protection of sources for journalists and professional secrecy for lawyers.
As far as the press is concerned, there are two major grievances. First of all, knowing that everyone's communications and electronic exchanges can be spied on without anyone knowing, the surveillance law is an attack on the freedom of expression. More precisely it is an infringement of the right of journalists to keep their sources secret, something which is guaranteed under article 10 of the European Convention on Human Rights. It is also an infringement of a person's “right to respect for his private and family life” provided for under article 8.
The lawyers also argue that in their case the surveillance law is an infringement of a person's right to a “fair hearing” as outlined in article 6 of the convention.
The judges at the European Court of Human Rights will have to consider the imprecision of some terms in the surveillance law, the absence of supervision over the use of black boxes and algorithms to monitor internet data, and finally the absence of prior supervision by a truly independent authority of the data that is collected. “This system allows a massive infringements of rights. We were sold it as a law that protects, but it's a dangerous law,” Patrice Spinosi told Mediapart. “The assertion of the principle, in this legislation, that one cannot eavesdrop on journalists or lawyers in the exercise of their profession, is not accompanied by any mechanism of protection. It's an abstract guarantee, theoretical, which permits any abuse.”
His colleague Alexis Guedj, shares this analysis. “The surveillance law potentially includes several attacks on the protection of sources. There's the issue of black boxes, imitation phone towers [editor's note, often called IMSI-catchers, and used to intercept mobile phone calls], and the collection of login data. The first problem is that the boundaries of the law are very difficult to define. Yet the European Court of Human Rights defined a long time ago what a good law must be like. And that in particular it must allow journalists to 'adjust their conduct'. Which is today impossible. If a journalist client came to ask me if he might be under surveillance, I would certainly not be capable of answering him.”
Alexis Guedj also argues that the guarantees put forward in the legislation are “insufficient”. The lawyer explains: “This law is a backwards step in relation to the 2010 Dati law [editor's note, a law named in reference to the former justice minister Rachida Dati] on the protection of sources, which was certainly not perfect, but which nonetheless included some advances. The supervision provided under the intelligence law, whether it is the [new monitoring body set up under the law the Commission Nationale de Contrôle des Techniques de Renseignement (CNCTR)] which delivers a non-binding opinion or the Conseil d'État that citizens can apply to in very restricted circumstances, is insufficient. Moreover, the monitoring will be carried out after the fact, when the damage has been done,” says Guedj.
“Finally, this law will have direct consequences on the right to information,” he argues. “According, once again, to the European Court of Human Rights journalists should be the 'watchdogs of democracy'. If sources know they are going to be identified, they'll no longer contact them. And if the sources dry up then in the end it's information itself that is put at risk. It must be understood that the protection of sources is not a right in favour of journalists, but indeed all citizens.”
In fact, the surveillance law authorises mass surveillance, not just to warn about terrorism, “criminality and organised crime” and “collective violence” which constitutes a “serious breach of public peace”, it also protects “major foreign policy interests” and “economic, industrial and scientific interests”. In other words, it is catch-all legislation. A suspect could thus be spied on, located and tracked thanks to their telephone and all their digital communications. Their home, vehicle and computer could all be searched. Their conversations – like those of people close to them and people nearby – could be recorded in a café, a restaurant, a train station, a court, thanks to these IMSI-catchers. In short, one would know about all their private and professional activities, and even those of their 'entourage'.
Now that the Conseil Constitutionnel has validated the surveillance law, say the lawyers, there is no remaining legal recourse in France, which is why Europe is the next step. For the European Court of Human Rights to hear a case, there needs to be a victim of the alleged breach of the convention. In the current spate of cases this should not present an obstacle as lawyers and journalists could potentially have been spied upon as soon as the surveillance law came into force.
If these actions do survive the filter process at the European Court of Human Rights, then a ruling on the substantive issues could be delivered in three to four years, the usual time period for the examination of a serious case. Traditionally the European court attaches more importance to the right to protect sources than the French judiciary; the planned bill from justice minister Christiane Taubira aimed at reinforcing this area has still not been presented to the National Assembly.
The European Court of Human Rights, which is more close to Anglo-Saxon law than French law, is particularly vigilant on the right to information. In a 1992 case the court referred to the “pre-eminent role of the press in a State governed by the rule of law”, and in a 1996 case it stated that the “protection of journalistic sources is one of the basic conditions for press freedom” and that in its absence “sources may be deterred from assisting the press in informing the public on matters of public interest”. The court went on to state in a 2007 case that the protection of sources is not “a mere privilege” but is indeed “part and parcel of the right to information” and that the press plays “an essential role in a democratic society”.
----------------------------------------------------------------------------
- The French version of this article can be found here.
English version by Michael Streeter