France's Government Aims to Give Itself--and the NSA--Carte Blanche to Spy on the World

The United States makes an improper division between surveillance conducted on residents of the United States and the surveillance that is conducted with almost no restraint upon the rest of the world. This double standard has proved poisonous to the rights of Americans and non-Americans alike. In theory, Americans enjoy better protections. In practice there are no magical sets of servers and Internet connections that carry only American conversations. To violate the privacy of everyone else in the world, the U.S. inevitably scoops up its own citizens' data. Establishing nationality as a basis for discrimination also encourages intelligence agencies to make the obvious end-run: spying on each other's citizens, and then sharing that data. Treating two sets of innocent targets differently is already a violation of international human rights law. In reality, it reduces everyone to the same, lower standard.

Now France's government is about the make the same error as US practice with its new "Surveillance des communications electroniques internationales" bill, currently being rushed through the French Parliament. As an open letter led by France's La Quadrature du Net and signed today by over thirty civil society groups including EFF, states, France's legislators' must reject this bill to protect the rights of individuals everywhere, including those in France.

By legalizing France's own plans to spy on the rest of the world, France would take a step to establishing the NSA model as an acceptable global norm. Passing the law would undermine France's already weak surveillance protections for its own citizens, including lawyers, journalists and judges. And it would make challenging the NSA's practices far more difficult for France and other states.

The new bill comes as a result of France's Constitutional Council review of the country's last mass surveillance bill, which passed with little parliamentary opposition in July. The Council passed most of that bill on the basis of its minor concessions to oversight and proportionality, but rejected the sections on international surveillance, which contained no limits to what France might do.

France already spies on the world. In July, the French newsmagazine L'Obs revealed a secret decree dating from at least 2008, which funded a French intelligence service project to intercept and analyze international data traffic passing through through submarine cable intercepts. The decree authorized the interception of cable traffic from 40 countries including Algeria, Morocco, Tunisia, Iraq, Syria, Sub-Saharan Africa, Russia, China, India and the United States. The report states that France's intelligence agency, the General Directorate for External Security (DGCE), spent $775 million on the project.

Given that the Constitutional Council implied that such practices are almost certainly unlawful as is, the French government has now scrambled to create a framework that could excuse it.

Under the new proposed law, France's intelligence agencies still have an incredibly broad remit. The law concentrates the power to grant wide-ranging surveillance permission in the office of the Prime Minister, who can sign off on mass surveillance of communications sent or received from overseas. Such surveillance can be conducted when in the "essential interests of foreign policy" or "[the] essential economic and scientific interests of France", giving the executive the widest possible scope to conduct surveillance.

The original surveillance law included limits on data retention when spying on French nationals (30 days for the content of communications, four years for metadata, six years for encrypted data). The new international limits are much longer--one year, six years, and eight years respectively. The law's authors do not justify this longer period, nor do they explain how the intelligence agencies will be able to separate data from each class of target without collecting, analyzing and filtering them all.

The collapsing divide between the lawful, warranted surveillance of ordinary citizens, and the wide-ranging capabilities of the intelligence services to collect signals intelligence on foreign powers and agents, has ended up corroding both domestic and global privacy rights. The U.S. has taken advantage of the lesser protections for non-U.S. persons to introduce the dragnet surveillance of everyone who uses the Internet outside the U.S. Because unprotected foreigners' data is mixed up with somewhat more protected communications of Americans, the U.S. government believes that it can "incidentally" scoop up its own citizens' data, and sort it out later under nobody's oversight but its own.

If the French Parliament passes this bill, it will mean that France has decided to embody and excuse the same practices as the NSA in its own law. It is a short-sighted attempt to cover France's existing secret practices, but the consequences are far-reaching. The limited protections that were included in the original surveillance bill--including assurances that French journalists, judges and lawyers would be protected from dragnet surveillance--will be undermined by their inevitable inclusion in the vacuuming up of all international traffic.

Any attempt by the EU countries to rein back the NSA's surveillance plan by calls for the United States to respect international human rights standards, and data protection principles, will provoke the response that the U..S is simply exercising the powers that an EU member has already granted itself.

By creating and excusing a double standard France's government dooms everyone to a single, lower standard. It cannot simply shrug off its responsibilities to human rights, its partners in Europe, and the privacy rights of foreigners. If it does so, it will end up undermining the French people's privacy and security as much as it undermines that of the rest of the world.