Surveillance “in accordance with the law”
to retrieve intelligence, but may also include, for
example, copying data directly from a computer”.154
Bulk equipment interference requires a foreign focus.155
MI5 suggests that bulk equipment interference “can be
sometimes the only method by which [they] can acquire
the data” and “plays an important role in making up for
the loss of intelligence that may no longer be obtained
through other techniques, such as interception.” Prior to
the IPA’s entry into force, the bulk powers interference
technique was never used in the United Kingdom.156
The French legal framework defines international
communications as communications sent or received
from abroad. They should transit on French soil.164 As
soon as a communication can be linked to a French
identifier (such as a French telephone number), the
data are immediately destroyed, unless the person is
already under surveillance or represents a threat to the
nation.165 Furthermore, MPs, lawyers, judges and media
professionals working in France cannot be placed under
surveillance when travelling abroad.
The French parliament adopted the Law on
international surveillance in November 2015.157 The
Constitutional Court reviewed the bill and confirmed
its constitutionality.158 The law entered into force on
2 December 2015, amending the Interior Security Code.
International surveillance shall pursue the same aims
as national surveillance, as defined in Article L. 811-3 of
the Interior Security Code.
In the Netherlands, the new Act on the Intelligence
and Security Services 2017 (Wet op de inlichtingenen veiligheidsdiensten 2017) extends the powers of
the intelligence services to intercept network traffic,
email and phone communications. The new legislation
permits the General Intelligence and Security Service
(Algemene Inlichtingen en Veiligheidsdienst, AIVD) and
the Military Intelligence and Security Service (Militaire
Inlichtingen- en Veiligheidsdienst, MIVD) to use
several surveillance techniques; however, this report
does not deal with military intelligence services. Most
importantly, the law enables the services to perform
“investigation-mandated interception” of data.166 For
the purposes of this law, “interception” means tapping,
receiving, recording and monitoring in a targeted
manner any form of telecommunication or data transfer
through automated means, irrespective of where this
takes place.167 This includes the power to undo the
encryption of conversations, telecommunications or
data transfers. An explanatory memorandum states
that investigation-mandated interception of data targets
certain geographical areas and certain data streams.168
Essentially, the investigation-mandate interception of
data is a form of general surveillance of communications
to the extent that it does not provide any limits to the
amount of data that can be intercepted or the size of
the targeted geographical area. Within the power of
the investigation-mandated interception of data, AIVD
can demand telecommunications service providers to
transfer their customers’ data to AIVD.169 The providers
do not have any discretion. To exercise these powers,
However, the procedure is different. Article L. 854-2
prescribes three scenarios.159 First, the prime minister
can authorise the surveillance of international
communication networks, without time limitations.
Second, based on a request by a minister, the prime
minister can authorise the exploitation of untargeted
metadata collected on international communication
networks. According to Warusfel, this type of measure
is similar to those done via algorithms at the national
level and amounts to ‘mass surveillance’.160 Third,
the prime minister can authorise the exploitation of
targeted content data and metadata. The law provides
for the prime minister to issue authorisations without
a prior opinion by the CNCTR. The French oversight body
only performs ex post controls over the implemented
measures.161 Interestingly though, since May 2016,
pursuant to a request by the prime minister, the CNCTR
agreed to deliver ex ante opinions on requests for
the exploitation of collected data.162 After a one-year
trial phase, this informal temporary agreement was
extended in March 2017.163
154 Ibid. p. 34.
155 United Kingdom, Investigatory Powers Act 2016, s 176(1)(c).
Not yet into force and will be brought into force in due
course by means of regulations made by the Secretary of
State (See United Kingdom, Investigatory Powers Act 2016,
Explanatory Note).
156 Anderson, D. (2016), p. 184.
157 France, Law No. 2015–1556 on international surveillance
(Loi n° 2015-1556 du 30 novembre 2015 relative aux
mesures de surveillance des communications électroniques
internationales), 30 November 2015.
158 France, Constitutional Court (Conseil constitutionnel),
No. 2015-722 DC, 26 November 2015.
159 France, DPR & CNCTR (2017), p. 53 and following.
160 See Warusfel, B., in Gohin, O. and Latour, X. (eds.) (2016),
p. 353.
161 France, Interior Security Code (Code de la sécurité
intérieure), Art. L. 854-9.
162 Ibid. Art. L. 854-2 (III).
163 France, CNCTR (2016), p. 45 and 47. See also France,
DPR & CNCTR (2017), p. 54.
164 France, Adam, P., Parliamentary Delegation on
Intelligence (2017), p. 71.
165 France, Interior Security Code (Code de la sécurité
intérieure), Art. L. 854-1.
166 The Netherlands, Act on the Intelligence and
Security Services 2017 (Wet op de inlichtingen- en
veiligheidsdiensten 2017), Art. 48.
167 Ibid.
168 The Netherlands, Prime Minister, Minister of General
Affairs / Minister of the Interior and Kingdom Relations /
Minister of Defence / Minister Security and Justice (MinisterPresident / Minister van Algemene Zaken / Minister van
Binnenlandse Zaken en Koninkrijksrelaties / Minister van
Defensie) (2016), Draft Act on the Intelligence and Security
Services 20... (Wetsvoorstel Wet op de inlichtingen- en
veiligheidsdiensten 20..), Explanatory Memorandum.
169 The Netherlands, Act on the Intelligence and
Security Services 2017 (Wet op de inlichtingen- en
veiligheidsdiensten 2017), Art. 53.
47