Rand Paul largely correct that French electronic surveillance law is stronger than what U.S. has

Republican presidential candidate Rand Paul argued against excessive surveillance and the bulk collection of electronic communication data, saying the terrorist attacks in Paris and San Bernardino, Calif., show it isn’t successful.

"The Paris tragedy ... happened while we were still doing bulk collection," Paul said on the Dec. 6, 2015, edition of NBC’s Meet the Press. "All bulk collection. Also in France, they have a program a thousandfold more invasive collecting all of the data of all the French. Yet they still weren't able to see this coming."

We wanted to gauge whether the French system is far more invasive than the one in the United States.

Mass surveillance 101

The key U.S. surveillance laws include the Foreign Intelligence Surveillance Act, passed in 1978, and the USA Patriot Act, which was passed in 2002 following the 9/11 terrorist attacks.

Portions of these laws have been variously reauthorized and revised, but the most relevant parts for analyzing Paul’s claim have to do with two broad topics: the process for eavesdropping on specific targets, and the collection of "bulk" metadata, which is information about the timing and frequency of electronic communications but not the content.

France had already been engaged in bulk data collection on a scale similar to or even more expansive than the United States, according a 2013 report by leading French newspaper Le Monde.

But this year -- between the Jan. 7 terrorist attack on magazine Charlie Hebdo and the Nov. 13 attacks across Paris -- France clarified its policy with the passage of a new law on surveillance. The controversial law was initially passed in June and upheld in August by France’s Constitutional Council with some limited revisions.

Where the two countries’ surveillance programs are similar

The French approach mirrors that of the U.S. approach in several ways.

The French law requires Internet and telecommunications companies to install "black boxes" that vacuum up raw data about users that can be searched by computerized algorithm. This is broadly similar to the once-secret data-collection program known as PRISM, which came to light due to revelations by whistleblower Edward Snowden. (The current status of the bulk data collection program is somewhat murky; authorization for bulk data collection expired on June 1, 2015, and then was extended by lawmakers for six months on an interim basis to facilitate transition to a new system. That period has just ended.)

In addition, French law enforcement can seek permission to eavesdrop on specific targets, and that means that people who interact with those approved targets can have their communications scrutinized in that process as well, whether or not they themselves are suspected of being involved in illegal activities. This mechanism is broadly similar to the one in the United States. And French law enforcement, like U.S. law enforcement, has the ability under the law to conduct "warrantless" wiretaps that sidestep prior judicial approval, at least in some cases.

Finally, critics of both countries’ laws have said they both contain inadequate provisions for transparency and whistleblower activities. Snowden has previously said that weak whistleblower protections helped convince him to go public about the National Security Agency’s activities rather than following official protest channels.

These similarities aside, there are at least five ways in which France’s system is arguably more muscular than the one in the United States.

Where the French system goes further than the United States’ system

• Judicial review. Under the United States’ Foreign Intelligence Surveillance Act, law enforcement officials must go to a special judicial court to receive permission to conduct electronic surveillance of American citizens. Historically, law enforcement officials have generally gotten what they’ve wanted from the court, leading critics to question how much of a hurdle this is. Still, the fact that members of the judiciary are passing judgment on the government’s requests does provide at least a modicum of independent oversight.

Featured Fact-check

Andrew Tate

stated on March 26, 2024 in an X post

The ship that struck a Baltimore bridge “was cyber-attacked.”

By contrast, under the French system’s analogous body, only a minority of members of the National Commission for the Control of Intelligence Techniques -- six of 13 -- are judges. Another six are legislators and the last is a technical expert. The panel can be overruled by the prime minister.

"Because there is no opportunity for independent and neutral judges to decide whether surveillance of a particular target is justified (in the French system), there is a heightened risk that government officials might engage in improper monitoring," wrote Nathan A. Sales, a Syracuse University law professor in an analysis commissioned by the bar association of Paris while the law was being debated.

Sales held senior positions in the Justice Department and Department of Homeland Security under President George W. Bush and was involved in the drafting of the Patriot Act.

• Lack of "minimization." The United States’ system takes steps, albeit imperfect ones, to focus intelligence collection on suspicious behavior, thereby "minimizing" the amount of unrelated data swept up. These can involve restricting who can see the information, how long it may be retained, and whether or how it can be disseminated, Sales wrote.

By contrast, the French system has few if any such protections, Sales wrote. He suggested an area of particular concern is a "lack (of) any limits on the monitoring of privileged communications between attorneys and their clients."

• Search and seizure. One of the more contentious parts of the Patriot Act has involved delayed-notification searches -- that is, searches of properties in which the target not only isn’t present but is not even notified about the search until well after it takes place. These are sometimes called "sneak and peek" searches, or "sneak and steal" when it involves seizing and removing items from the location.

These types of searches existed before the Patriot Act, but their use was tightly constrained; the Patriot Act loosened the rules.

The French system, meanwhile, permits even more expansive action for tracking data and communications during such searches than the United States does, critics say. Under the French law, bugs, cameras and keystroke loggers could be planted during such searches, according to multiple media reports.

• Location-based surveillance. The French law allows the use of devices variously known as "proximity sensors," "cell site simulators," "IMSI catchers" or "Stingrays." Rather than targeting surveillance on a specific person, these devices allow surveillance of cellphone calls and text messages at a given location. Privacy advocates say this technology is likely to capture communications by uninvolved bystanders.

In the United States, it is Justice Department policy to seek a FISA probable-cause warrant before using such techniques. On paper, at least, that appears to be a tougher hurdle than what the French law includes.

• Going beyond terrorism. The Patriot Act includes terrorism in its title (it’s the final "t" in the acronym "patriot"), and at the FISA court, the government must show that the target is an "agent of a foreign power," which has generally been interpreted to mean a spy or a terrorist.

By contrast, the French law includes some broader justifications for action, including protecting France’s "economic, industrial and scientific interests" and prevention of "organized delinquency."

"In general, I think it’s accurate to say that French surveillance law is more permissive than U.S. surveillance law," Sales said in an interview.

Bob Turner, a professor at the University of Virginia’s Center for National Security Law, agreed.

"Our system is far more respectful of individual rights," Turner said. "The French have no equivalent to the Fourth Amendment (protection against search and seizure), and both law enforcement and intelligence services routinely collect data that would require a warrant here."

Our ruling

Paul said that "in France, they have a (surveillance) program a thousandfold more invasive" than the United States.’ "

The term "a thousandfold" is impossible to measure and is presumably a rhetorical flourish on Paul’s part. Still, we found five notable areas in which the French system offers law enforcement and government officials more unfettered tools than American officials have the ability to use.

We rate Paul’s statement Mostly True.