French officials can monitor internet users in real time under new law

French intelligence and government officials will be able to spy on internet users in real time and without prior legal authorisation, under a law passed on Wednesday.

The legislation, which was approved almost unnoticed, will enable a wide range of public officials including police, gendarmes, intelligence and anti-terrorist agencies as well as several government ministries to monitor computer, tablet and smartphone use directly.

The spying clause, part of a new military programming law, comes just weeks after France, which considers individual privacy a pillar of human rights, expressed outrage at revelations that the US National Security Agency (NSA) had been intercepting phone calls in France. The president, François Hollande, expressed his "extreme reprobation".

Article 13 of the new law will allow not just the security forces but intelligence services from the defence, interior, economy and budget ministries to see "electronic and digital communications" in real time to discover who is connected to whom, what they are communicating and where they are.

Despite concerns over the infringement of personal liberties, and the possibility of abuse of the blanket justification for snooping for the "prevention of organised crime", the military programming law cleared its final hurdle on Wednesday after members of the Sénat, the upper house of parliament, voted by 164 to 146 on Wednesday. The bill was earlier approved in the lower house, the Assemblée Nationale, by a similar majority.

An amendment rejecting article 13, tabled by senators from the Ecology party, was thrown out.

Government officials say the measure is necessary to combat terrorism, organised crime and economic or scientific espionage, and to protect national security. The defence minister, Jean-Yves Le Drian, insisted "public liberties will be covered" in the new law.

Until now, demands for phone taps or data intercepts were supposed to be authorised by a judge or the National Commission for the Control of Security Intercepts, a five-strong independent body made up of a former judge and a representative from each house of the French parliament plus two other delegates.

The government says the spying will be overseen by an "independent authority – the CNCIS – and by parliament". However, under the law, agencies have until 48 hours after surveillance has begun to seek approval from the CNCIS president and can continue while awaiting his decision. Technology firms belonging to the Association of Internet Services Communities (@SIC), including Google, Microsoft, Facebook, Skype and AOL, have criticised the scale of the proposed snooping.

In a statement @SIC expressed concern that the new law was an opening up of previously controlled "exceptional" security measures used to fight terrorism and crime, and allowed officials to tap into data under the blanket "prevention of organised crime" clause in the bill.

It said even now there was no "clear picture" of how surveillance of internet users was being conducted in France, nor on the amount of demands [for surveillance] made each year.

"When civil society and many others are alarmed at the daily revelations over this question [of surveillance] it is inconceivable that the French government should launch itself into this wild race to extend what were exceptional measures and offer numerous officials real-time access to internet users' data," it said.

It also criticised the "inaction" of the quango supposed to protect individual liberties in such cases, the Commission Nationale de l'Informatique and Liberties. CNIL says while it was asked to urgently report on other elements of the legislation, it was "not consulted" on article 13, but was reassured that there would be safeguards.

Opponents are considering whether to refer the legislation to the constitutional court, France's highest legal authority, over the question of public freedom.

Loïc Riviere, Secretary General of the French Association of Software and Internet Solutions Editors (AFDEL), which represents 350 French software and internet companies said: "We understand the need to fight the explosion of cyber-criminality and we're certainly not against those trying to ensure national security, but this [law] is not legally clear and is worrying.

"There is a suggestion that the government is only putting into law practices that already exist but there is concern that there are no concrete legal safeguards and that the only controls will be from administrators or ministers.

"It means for the surveillance services anything is possible and I fear this could be used for political ends, which has happened in the past."

Riviere added that the law was doubly worrying for his association's members.

"Recent scandals have already made [internet] users wary, and this law does nothing to reassure them. What worries our members is that if data confidentiality is not assured users might put their data elsewhere in the world where security is more lax."