Freedom on the Net 2016 - France

Key Developments, June 2015-May 2016

• The prolonged state of emergency initiated by President Hollande after the Paris terrorist attacks on November 13, 2015 significantly expanded the powers of authorities to conduct house arrests, raids, and searches of electronic devices, without prior judicial authorization (see Legal Environment and Surveillance, Privacy, and Anonymity).

• The Paris attacks impacted the number of requests to take down pro-terrorism content, as administrative measures enabled the blocking and de-indexing of infringing websites without authorization from a judge. State of emergency legislation in turn empowered the interior minister to take any measures to interrupt online public communications services inciting or glorifying terrorist acts (see Blocking and Filtering and Content Removal).

• New legislation has also bolstered the state's surveillance apparatus. In July 2015, the French Constitutional Council approved almost all provisions of a new intelligence law which requires internet service providers to install devices to monitor users' "suspicious behavior" and provide access to intelligence agencies (see Legal Environment and Surveillance, Privacy, and Anonymity).

• Parliament adopted a law to fight against organized crime, terrorism, and their financing in May 2016, enabling prosecutors to eavesdrop as part of their investigations, and establishing criminal sanctions for frequently visiting sites glorifying or inciting terrorist acts (see Legal Environment and Surveillance, Privacy, and Anonymity).

Introduction:

Measures to address terrorist threats have impacted France's internet freedom environment by expanding government surveillance powers and limiting judicial oversight.

As France continued to reel from the horrific Charlie Hebdo attack in January 2015, a series of coordinated attacks stunned Paris on the night of November 13, 2015. Islamic State (IS) gunmen and suicide bombers targeted restaurants, bars, a major stadium, and a concert hall, killing 130 people and injuring hundreds more. The attacks prompted hundreds of raids throughout the country.^[1] The suspected ringleader, Abdelhamid Abaaoud, a Belgian national, was killed after a long gun battle during a police raid in the Paris suburb of Saint-Denis just a few days after the events.^[2]

The Paris attacks triggered draconian measures from the government, with the declaration of a state of emergency on November 13, 2015. Extended for a third time through the end of July 2016, and again for six months following a deadly terrorist attack in Nice on July 14, these emergency measures significantly expanded authorities' powers, such as allowing house arrests and searches without judicial oversight. Provisions on electronic searches allowed authorities to access and copy user data without clarifying safeguards concerning the use of this data, even when no wrongdoing has been uncovered. State of emergency legislation also granted powers to the interior minister to immediately interrupt online communication services deemed to "incite or glorify terrorist acts."^[3] In this context, United Nations human rights experts raised concerns about "excessive and disproportionate restrictions on fundamental freedoms" in France, including "the lack of clarity and precision of several provisions of the state of emergency and surveillance laws."^[4]

A series of legislative changes to address threats to national security sought to expand government surveillance powers and introduce stricter measures to tackle terrorist content online. The antiterrorism law passed in November 2014 outlined prison sentences for the broad offense of "apology for terrorism" online. In early 2015, two decrees outlining administrative measures for the blocking and de-indexing of websites for terrorist content were harshly criticized by free speech advocates. Parliament also adopted a new intelligence law on June 24, 2015, granting intelligence agencies the power to intercept electronic communications in real-time and request the immediate handover of user data from ISPs, without prior court approval. The French Constitutional Council subsequently declared three of the law's provisions unconstitutional in July 2015, including one that would have allowed interception of all international electronic communications. However, following the November 2015 terrorist attacks and the declaration of the state of emergency, an amended proposal related to the monitoring and surveillance of international electronic communications was adopted.^[5]

While France has traditionally maintained a relatively open and accessible internet, several actions on the part of successive administrations have raised concerns from internet freedom groups and free speech activists. During this coverage period, the controversial law on the distribution and protection of creative works on the internet, known as HADOPI, received renewed criticism after the French Senate released a report recommending more drastic sanctions against piracy and fewer "educational measures."

Obstacles to Access:

France's internet penetration continued to increase, reaching nearly 85 percent in 2015. The current ICT market is open, highly competitive, and has benefited from the privatization of the state-owned company France Telecom.

Availability and Ease of Access

Committed to providing widespread access to high-speed broadband, the French government has been has been implementing an ambitious national plan to deploy high-speed broadband throughout France by 2022, mobilizing public and private investments totaling 20 billion euros (US$22 billion) over 10 years.^[6] The government predicts its plan will benefit 50 percent of the population by the end of 2016.^[7] In April 2015, the French parliament approved an amendment to the telecoms component of France's economic reform law, known as the Loi Macron, requiring telecom operators to improve mobile coverage throughout the country. The law will ensure that residents of an estimated 170 municipalities, which currently have no access to mobile services, will be covered by mobile networks by 2017. Failure to comply with the obligations can result in sanctions from the telecoms regulator.^[8]

In 2015, the International Telecommunication Union (ITU) estimated an internet penetration rate of 84.7 percent.^[9] Fixed broadband penetration also increased, from 40.1 percent in 2014 to 41.3 percent in 2015, with almost 27 million subscriptions.^[10] Wireless broadband subscriptions reached 48.8 million subscriptions in December 2015.^[11] Nonetheless, some demographic disparities in internet usage still persist: for example, mobile penetration ranged from 65.3 percent in the Paris area to 42.7 percent in urban areas with less than 50,000 inhabitants.^[12] Most at-home users have access to broadband connections, while the remaining households are connected either through dial-up or satellite services, usually due to their rural location.^[13]

The average monthly cost of broadband internet access in France is approximately EUR 30 (USD $43), for both ADSL, and fiber-optic connections, which is fairly affordable for a large percentage of the population whose average net monthly income is 2,202 euros (USD $2,400).^[14] Companies such as Free Telecom offer cheap internet access and mobile contracts through bundled deals. Speeds are fast, with Akamai data reporting connection speeds of 8.9 Mbps peak connection speeds of 43.2 Mbps at the end of 2015.^[15]

According to the ITU, mobile penetration in 2015 reached 102.6 percent in 2015, up from 97.4 percent in 2012.^[16] Recent figures show that in 2015, 54.7 percent of the population accessed the internet via mobile, projecting 65.2 percent in 2017.^[17]

Restrictions on Connectivity

There were no restrictions on connectivity reported during the coverage period. There is no central internet backbone, and ISPs are not required to lease bandwidth from a monopoly holder. Instead, the backbone consists of several interconnected networks run by ISPs and shared through peering or transit agreements. There are also a number of Internet Exchange Points (IXPs) in France,^[18] which contribute to improved access and lower consumer prices.^[19]

ICT Market

There are no significant business hurdles to providing access to digital technologies in France. The main ISPs are Orange, Free, Bouygues Telecom, and Numericable-SFR (SFR was a division of Vivendi that was sold to Numericable).^[20] Others such as NRJ Mobile, Virgin Mobile, Cofidis Mobile, and Darty make use of the main ISPs' networks, reselling the services.^[21]

Numericable, after beating Bouygues' bid to acquire SFR, showed further interest in expanding its market presence by offering to buy Bouygues, its smaller loss-making rival, for 10 billion euros. The owner, Martin Bouygues, rejected the bid. Both the Economy Minister Emmanuel Macron and the Budget Minister Christian Eckert were against the deal, believing that consolidation was not the best move for the sector.^[22] In the wake of their loss of SFR to Numericable and the buyout offer, Bouygues has been keen to prove they are a growing concern and accused Numericable of breach of contract.^[23] Most recently, Orange showed interest in purchasing Bouygues for the same price, but negotiations failed in April 2016.^[24]

Regulatory Bodies

The telecommunications industry in France is regulated by the Regulatory Authority for Electronic and Postal Communication (ARCEP),^[25] while competition is regulated by France's Competition Authority and, more broadly, by the European Commission (EC).^[26] The commissioner of ARCEP is appointed by the government, but as an EU Member State, France must ensure the independence of its national telecommunications regulator. Given that the French state is the main shareholder in Orange, the country's leading telecom company, the EC stated that it would closely monitor the situation in France to ensure that European regulations were being met.^[27] The EC has previously stepped in when the independence of national telecommunications regulators seemed under threat, notably in Romania, Latvia, Lithuania, and Slovenia.^[28] ARCEP remains an independent and impartial body and decisions made by the regulator are usually seen as fair.

Net neutrality was in the news when the new European Regulation related to net neutrality was adopted in November 2015 and came into effect in April 2016.^[29] In September, ARCEP, working with European counterparts (the Body of European Regulators of Electronic Communications), released four factsheets regarding the implementation of the new regulations concerning net neutrality. The factsheets summarized key points in four areas: traffic management, commercial practices, optimized services that are distinct from internet access, and the quality of internet access services.^[30] ARCEP will be in charge of overseeing the application of net neutrality in France, with strengthened transparency obligations of operators and ISP commercial practices (bundling, zero-rating, and sponsored data) under particularly scrutiny.

Limits on Content:

In the wake of deadly terrorist attacks in France, attention over mechanisms to counter pro-terrorist content online reached new levels during this period of coverage. Expanded state of emergency legislation enabled the interior minister to immediately censor any website deemed to promote terrorism or incite acts of terrorism. The HADOPI anti-piracy law was also back in the news due to a proposed update to its tenets, prompting criticism from internet rights watchdogs.

Blocking and Filtering

France does not generally engage in any politically motivated blocking of websites. YouTube, Facebook, Twitter and international blog-hosting services as a whole are freely available. However, since the Charlie Hebdo and November 2015 attacks in Paris, the government has released statements suggesting that limiting fundamental rights of citizens would serve public safety,^[31] and terrorist-related content has been subject to censorship.

A decree issued in February 2015 outlined administrative measures to block websites containing materials that incite or condone terrorism, as well as sites that display child pornography.^[32] The decree implemented article 6-1 of the Law on Confidence in the Digital Economy (LCEN), passed in 2004, as well as article 12 of new antiterrorism law passed in November 2014.^[33] The administrative authority, in this case the Central Office for the Fight against Crime related to Information and Communication Technology (OCLCTIC), is in charge of creating a blacklist of sites containing infringing materials, and must review the list every four months to ensure that blacklisted sites continue to contravene French law. OCLCTIC can request editors or hosts to remove the content, and after a 24 hour period it can request ISPs to block the site.^[34] Users trying to access those pages are redirected to a website from the Ministry of Interior indicating why the site was blocked and avenues for appeal.Shortly after the decree was announced, five websites were blocked with no judicial or public oversight under suspicion of containing terrorism-related information.^[35]

A first activity report covering the period between March 2015 and February 2016 noted that French authorities made 312 requests to block sites (some of them were made available again after the removal of infringing content). Administrative blocking requests for terrorist content targeted 68 sites, compared to 244 sites displaying child pornography. The Paris attacks in November 2015 significantly impacted the number of overall requests to censor content linked to terrorism (see also Content Removal).^[36]

Meanwhile, under the extended state of emergency legislation first adopted in November 2015, the interior minister was given the power to block websites and social media, taking "any measure to ensure the interruption of any public communication service online that glorifies or incites acts of terrorism."^[37] Although the National Commission on Informatics and Liberty (CNIL) noted in its April 2016 report that the "implementation methods of this measure have not been specified, and to date, the Minister of Interior has not resorted to it."^[38]

While no "over blocking" was reported during this period, a chief concern remains the lack of judicial oversight in the blocking of websites that incite or promote terrorist acts. The procedure is supervised by the CNIL, the data protection agency. As an administrative authority, CNIL can also refer requests to the administrative court should they be unhappy with any action taken by the OCLCTIC. Some commentators have lamented that while CNIL was founded to protect internet freedoms, it is now overseeing the restriction of those same rights.^[39]

Content Removal

French authorities are fairly transparent about what content is prohibited and the reasons behind specific content removal requests. Incitement of hatred, racism, Holocaust denial, child pornography, copyright infringement, and defamation are illegal. Article R645-1 of the French criminal code outlaws the display of the emblems, uniforms, or badges of criminal organizations, under penalty of a fine.^[40]

As stipulated in the 2014 anti-terrorism law, the administrative authority (OCLCTIC) can request editors and hosts to remove content that incites or apologizes for terrorism, as well as sites that display child pornography; after a 24 hour period it can request ISPs to block the site (see Blocking and Filtering).^[41]

A government decree issued on March 4, 2015 also allows for the delisting of online content from search results using a similar administrative procedure supervised by CNIL.^[42] Under this decree, OCLCTIC submits requests to search engines, which then have 48 hours to comply. The OCLCTIC is responsible for reevaluating de-indexed websites every four months, and requesting the relisting of websites where the incriminating content has been removed. According to CNIL's report, between March 2015 and February 2016, French authorities made 855 de-indexing requests (of which 386 were for pro-terrorist content, and 469 for child pornography), as well as 1,439 removal requests (of which 1,286 were for pro-terrorist content, and 153 for child pornography content). Content was removed in 1,179 of cases.^[43]

CNIL reportedly gave the green light for all of these removal and de-indexing requests, except in one case: a photo that was widely circulated on social media and blogs, showing the aftermath of the Bataclan concert hall in Paris, where gunmen claimed the lives of 90 victims on November 13, 2015.^[44] CNIL argued that only the context of the photo's publication could determine whether it was inciting or glorifying terrorism. OCLCTIC subsequently followed this recommendation.

The anti-piracy law HADOPI, originally passed in June 2009^[45] and supplemented by a second law in October 2009^[46] was once again in the news in 2015. In July 2015, the digital rights group La Quadrature du Net (LQDN) strongly objected to a Senate report from July 2015 that proposed an extra-judicial administrative fine, giving HADOPI the right to essentially bypass the legal procedure if they so desired.^[47] LQDN also pointed out that the report drew on earlier recommendations,^[48] which would mean HADOPI had the power to act as content monitors, carrying out private policing of copyright.^[49] In a surprise move, parliament adopted a proposal in April 2016 to suppress HADOPI by February 2022,^[50] but the Senate voted to reverse this move.^[51] HADOPI functions by responding to copyright infringers with a graduated response, starting with an email warning for the first offense, followed by a registered letter if a second offence occurs within six months. If a third offence occurs within a year of the registered letter, the case can be referred to the court, and the offender may receive a fine as a possible sanction.^[52]

The legal debate over the right to be forgotten also escalated in the past year. In June 2015, the French data protection agency CNIL ordered Google to extend the "right to be forgotten" ruling across all of its sites that can be accessed within the country, including Google.com and not just Google.fr.^[53] Google raised concerns that the move would set a dangerous precedent for authoritarian governments, who could also request that Google apply national laws extraterritorially.^[54] An informal appeal by Google was rejected in September 2015, and CNIL threatened to take action against Google with fines of approximately EUR 300,000 should they refuse to comply.^[55] In early February 2016, Google announced that it would comply by removing certain search results across all EU domains.^[56]

A ruling in early February 2016 by a Paris court established that Facebook could be sued in France for removing the account of a French user who posted an image of a 19th century painting of a naked woman by Gustave Courbet. A French court will now be entitled to hear the case, brought by the account's Parisian user. Facebook had argued that cases concerning their terms and conditions could only be heard by a Santa Clara, CA court, where its headquarters are based. This was dismissed by a Paris appeals court, which ruled that should the case involve a French user, it can be heard in France. The decision can be appealed to France's highest court.^[57]

Media, Diversity, and Content Manipulation

France is home to a highly diverse online media environment. Self-censorship online is minimal, and there were no reports of the French government proactively manipulating content online. There are no recent cases of paid government commentators and discriminatory allocation of advertising.

Meanwhile, government measures to counter terrorist propaganda online have taken center stage in the wake of deadly terrorist attacks. The French government recently introduced a communication campaign against extremist radicalization aimed at preventing and tackling jihadist propaganda online^[58] and has turned to the private sector to discuss plans to counter extremist discourse and terrorist propaganda.^[59]

Digital Activism

French digital rights and advocacy groups, such as La Quadrature du Net (LQDN), are very active in the country, playing a significant role in protesting the government's recent moves to expand surveillance and blocking measures without judicial oversight.^[60] In the past, LQDN successfully lobbied the European Parliament for an amendment to the European Union Telecoms Package to ensure that no restrictions on internet access could be imposed without prior judicial approval.^[61]

The #NuitDebout movement is a recent example of a large scale digital campaign. Launched in March 2016 to protest against newly adopted labor reforms, activists used their own online radio and TV stations and various social media channels to share information and organize large nightly assemblies at the Place de la République in Paris. The protests were subsequently replicated in other cities across the country. The movement has since broadened to include other important issues and has taken a critical stance on France's political system, calling for social and political change.^[62]

Violations of User Rights:

Both in the lead up and in reaction to terrorist attacks, a series of legislative changes have raised concerns among digital and human rights activists. The prolonged state of emergency initiated after the Paris terrorist attacks in November 2015 has significantly expanded the powers of authorities to conduct house arrests, raids, and searches and seizures of devices, without judicial oversight. New laws to address threats to national security have also bolstered the state's surveillance powers and introduced stricter measures to tackle terrorist propaganda online.

Legal Environment

In accordance with the 1789 Declaration of the Rights of Man,^[63] France's constitution guarantees freedom of speech.^[64] The European Convention on Human Rights, of which France is a signatory, provides for freedom of expression, subject to certain restrictions which are "necessary in a democratic society."^[65]

Since November 2015, broad new powers under the state of emergency have raised concerns among human rights and digital activists.^[66] While Prime Minister Manuel Valls declared on November 19 that it was a "short term response,"^[67] the state of emergency was subsequently extended three times to beyond this report's coverage period.^[68] The state of emergency includes provisions on electronic searches (see Surveillance, Privacy, and Anonymity).^[69] The state of emergency also empowered the interior minister to take "any measure to ensure the interruption of any online public communication service that incites the commission of terrorist acts or glorifies them."^[70]

Meanwhile, measures to address terrorism were already in place prior to the November 2015 state of emergency. The antiterrorism law passed in November 2014 penalizes online speech deemed as "apology for terrorism" (apologie du terrorisme) with up to seven years in prison and a EUR 100,000 (US$100,000) fine. Online penalties are harsher than offline, which is subject to five years in prison and a EUR 75,000 fine.^[71] Another law adopted by parliament in May 2016 and enacted in June 2016 "on the fight against terrorism and organized crime" also provides sentences of up to two years in prison or a EUR 30,000 fine for frequently visiting sites that glorify or incite terrorist acts, unless these consultations are done in "good faith," such as journalistic or research activities (see also Surveillance, Privacy, and Anonymity).^[72]

In a positive step, following a process of public consultation, the National Assembly adopted a "Digital Republic" bill in January 2016, covering a wide range of issues such as access to public data, safeguards for net neutrality, and the protection of personal data. The bill reached the final stage of the parliamentary process in September 2016.^[73]

Prosecutions and Detentions for Online Activities

During the coverage period, multiple sentences were handed down to online users for glorifying terrorism.^[74]

In February 2016, police arrested the owner of a website (Darkness.su) that provides anonymous messaging services for failing to cooperate with authorities in an investigation linked to a series of fake bomb threats against schools around the world. A group called "Ev4cuati0nSquad" had allegedly placed threatening calls using the messaging service. He was taken in for questioning after refusing to provide police with the encryption key to allow authorities access to the data.^[75]

Surveillance, Privacy, and Anonymity

Surveillance has escalated in recent years, not least with the enactment of a new surveillance law in June 2015, which was passed in the wake of the attacks on Charlie Hebdo by armed extremists earlier that year. The Loi Relatif au Renseignement , or Intelligence Law,^[76] allows for intelligence agencies to conduct electronic surveillance without a court order and requires ISPs to install so-called "black boxes," algorithms that analyze users' metadata for "suspicious" behavior in real time.^[77] The French Constitutional Council subsequently declared three of the law's provisions unconstitutional in July 2015, including one that would have allowed the interception of all international electronic communications. However, an amendment enabling mass surveillance of electronic communications sent to or received from abroad was later adopted on November 30, 2015, shortly after the Paris attacks on November 13, for the purposes of "defending and promoting the fundamental interests of the country."^[78]

Under the state of emergency established in November 2015, the authorities were granted powers to access and copy user data, with little judicial oversight and without clarifying safeguards concerning the use of this data.^[79] The constitutional council struck down the provision allowing the authorities to copy user data in February 2016, citing the lack of judicial oversight.^[80] A new version of this provision was reintroduced in July 2016, adding certain judicial guarantees.^[81]

The newest law related to the fight against organized crime and terrorism, adopted by parliament in May 2016 and enacted in June 2016, has also elicited strong reactions from the public.^[82] The law notably expands special investigation methods to prosecutors and investigating judges, which were previously reserved for intelligence services. This includes bugging private locations, using phone eavesdropping devices such as IMSI catchers, and night-time searches.^[83]

Other recent regulations on electronic surveillance were passed in December 2013 and came into force in January 2015, as part of a routine military spending bill (the Military Programming Law, or LPM). Article 20 of the LPM significantly expanded electronic surveillance of French residents and businesses by requiring ISPs to hand over data such as phone conversations, emails, internet activity, personal location data, and other electronic communication data to public authorities. The powers relate to the General Directorate for Internal Security (DCRI), three intelligence agencies under the Ministry of Defense, as well as anti-money-laundering and customs agencies. Under the law, these agencies can conduct surveillance without prior court approval for purposes of "national security," the protection of France's "scientific and economical potential," and the prevention of "terrorism" or "criminality."^[84] The office of the prime minister authorizes surveillance and the National Commission for Security Interception ( Commission nationale de contrôle des interceptions de sécurité , CNCIS) must be informed within 48 hours in order to ensure its approval.^[85] Critics have pointed out that the CNCIS lacks appropriate control mechanisms and independence from political interference, given that the CNCIS is composed of only three politicians.^[86] On the other hand, the government argued that the law provides an improved legal framework for practices that have already been in place for years.^[87]

Article 23 of LOPPSI 2, adopted in 2011, grants the police with the authority to install malware – such as keystroke logging software and Trojan horses – on a suspect's computer in the course of counterterrorism investigations, although authorization must come from a court order.^[88]

Regarding user privacy protections, a French order in February 2016 from the European Data Protection Authority ruled that Facebook was not allowed to track non-users in France or transfer personal data to U.S. servers. Facebook tracks the online movements of its users via its tracking cookies and plugins on third party websites, even if they are logged out, but this will not be legal to do to European citizens under the new order. French authorities said Facebook would be fined if they did not comply within three months.^[89]

Intimidation and Violence

There were no reported physical attacks against bloggers or online journalists in France. Under the state of emergency however, human rights groups have documented abusive searches and house arrests based on suspected terrorist-related activity.^[90] Regional media reported on a number of raids and seizures specifically targeting suspects of online activism and propaganda.^[91]

Technical attacks

According to the Global State of Information Security Survey 2016, the number of recorded cyberattacks in France has grown by 51 percent in the last year – which translates to approximately 21 attacks per day – compared to 38 percent globally.^[92]

One of the main cybersecurity headlines in 2015 was the hacking of the television and online news outlet TV5Monde on April 8, 2015. Hackers claiming to belong to the Islamic State breached the company's information systems, overriding TV5Monde's broadcasted programming for more than three hours and disabling live broadcasts for a day on 11 channels. The group, which called itself "CyberCaliphate," also hacked the news company's website and social media accounts.^[93] News reports suggest that the cyberattackers were able to gain access by phishing three employees of the company who clicked on an infected email in January.^[94] The Twitter account of French newspaper Le Monde was also hacked by supporters of the Syrian government in January 2015. In the weeks after the terrorist attacks against Charlie Hebdo , authorities reported some 19,000 cyberattacks against French websites.^[95]

Notes:

1 "Paris Attacks: What Happened on the Night," BBC News , December 9, 2015, http://bbc.in/1MEFrPj.

2 "Paris Attacks: Who were the attackers?" BBC News , January 19, 2016, http://bbc.in/1j9Ynx8.

3 Human Rights Watch, "France: New Emergency Powers Threaten Rights," November 24, 2015, http://bit.ly/1P8yL1Q; See also: La Quadrature du Net, "A Police State to Avoid Any Critical Evaluation?" November 19, 2015, http://bit.ly/2cFVLoh.

4 OHCHR, "UN rights experts urge France to protect fundamental freedoms while countering terrorism," January 19, 2016, http://bit.ly/20e9Jkh.

5 Law 2015-1556, November 30, 2015, http://bit.ly/2eWT2N1.

6 "Plan France Très Haut Débit," official website, accessed September 22, 2016, http://www.francethd.fr.

7 "Le Plan France Très Haut Débit," gouvernement.fr, September 8, 2016, http://bit.ly/21kmjzc.

8 International Telecommunications Union (ITU), "French government approves amendment mandating rural mobile expansion," April 21, 2015, http://bit.ly/1VSNxbn.

9 ITU, "Percentage of Individuals using the Internet (2000-2015)," accessed September 22, 2016, http://bit.ly/1cblxxY.

10 ITU, "Fixed-broadband subscriptions, 2000-2015," accessed September 22, 2016, http://bit.ly/1cblxxY.

11 OECD, "Total fixed and wireless broadband subscriptions by country," accessed September 22, 2016, http://bit.ly/1cP4RGV.

12 Statista, "Mobile internet usage penetration in France from 2010 to 2014, by urban area size," March 21, 2013, accessed February 11, 2016, http://bit.ly/2eku0Fs.

13 Ariase, "L'ADSL et la fibre optique en France" [ADSL and Broadband Access in France], accessed February 12, 2016, http://bit.ly/2eHNZft.

14 "Les salariés français gagnent en moyenne 2202 euros net par mois," [French employees earn on average 2,202 Euros a month], Le Figaro , September 16, 2015, http://bit.ly/1P0QG6W.

15 Akamai, The State of the Internet, Q4, 2015 Report, accessed September 22, 2016, http://akamai.me/2b5MgzU.

16 ITU, "Mobile-cellular subscriptions 2000-2015," accessed September 22, 2016, http://bit.ly/1cblxxY.

17 Statista, "Mobile phone internet user penetration in France from 2014 to 2017," accessed February 12, 2016, http://bit.ly/2eHPKcE.

18 Internet Exchange Points, Data Centre Map, accessed February 12 2016, http://bit.ly/2dzlzY4.

19 "Internet Service Providers and Peering v3.0," DrPeering International, accessed February 12, 2016 http://bit.ly/1joJCaC.

20 Ruth Bender, "Vivendi Accepts Altice Offer to Buy 20% Numericable-SFR Stake," Wall Street Journal , February 27, 2015, http://on.wsj.com/2f5YxrP.

21 Jerome Tranie, "Fastest ISPs 2014: France," PC Mag , June 19, 2014, http://bit.ly/2euIzHk.

22 Leila Abboud and Dominique Vidalon, "France's Numericable SFR makes fresh bid for Bouygues Telecom – sources," June 21, 2015, http://reut.rs/2eyefKt.

23 Elsa Bembaron, "Bouygues Telecom sues Numericable," August 26, 2015, http://bit.ly/1he450b.

24 Geraldine Amiel, Marie Mawad, and Francois De Beaupuy, "Orange-Bouygues Deal Collapse Ends Months of Tense Diplomacy," Bloomberg , April 4, 2016, http://bloom.bg/2dABccT.

25 ARCEP, "Autorité de Régulation des Communications Électroniques et des Postes," http://bit.ly/1RImAXo.

26 "Autorité de la concurrence," accessed February 12, 2016, http://bit.ly/1frpn7J.

27 "ARCEP must remain independent vis-a-vis government – EC," Telecompaper , January 14, 2011, http://bit.ly/1k5gzJe.

28 Arjan Geveke, "Improving Implementation by National Regulatory Authorities," European Institute of Public Administration, 2003, accessed February 12, 2016, http://bit.ly/2dAAlJ2.

29 EU Regulation 2015/2120, November 25, 2015, http://bit.ly/2efzIeu.

30 ARCEP, "Net Neutrality," September 2015, accessed February 12, 2016, http://bit.ly/1NDlZIP.

31 "Valls : 'La sécurité est la première des libertés" [Valls : Security is the first of liberties], La Depeche , January 7, 2016, http://bit.ly/2eydvoA.

32 Decree 2015-125 of February 5, 2015, http://bit.ly/2cqSoRr.

33 "L'impossible et controversé blocage des sites Internet djihadistes," [The impossible and controversial blocking of jihadist sites], Le Monde , September 13, 2014, http://bit.ly/2dfofWV.

34 The blocking order can be issued immediately if the editor does not provide information stipulated under article 6-III of LCEN. See: Article 12, Law 2014-1353 of November 13, 2014, http://bit.ly/2eeaTwZ.

35 Lucie Ronfaut, "La France bloque pour la première fois des sites Web de propagande terroriste" [France blocks terrorist propaganda websites for the first time], Le Figaro , March 16, 2015, http://bit.ly/2eAyTsT.

36 "Blocages de sites web, le bilan de la Cnil," [Website blockings, CNIL's report], Libération , April 15, 2016, http://bit.ly/1T9zkIa; See also: Alexandre Linden, "Rapport d'activité de la personne qualifiée" [Activity Report], March 2015 – February 2016, CNIL, accessed September 1, 2016, http://bit.ly/2eAO4Ch.

37 Law 2015-1501 of November 20, 2015, http://bit.ly/1qraiKQ See also: Daniel Severson, "France's Extended State of Emergency: What New Powers Did the Government Get?" Lawfare , November 22, 2015, http://bit.ly/1OYBpSl; Glynn Moody, "French state of emergency allows website blocking, device search powers," Ars Technica , November 20, 2015, http://bit.ly/1XeWKf1.

38 Alexandre Linden, "Rapport d'activité de la personne qualifiée" [Activity Report], March 2015 – February 2016, CNIL, accessed September 1, 2016, http://bit.ly/2eAO4Ch. EDRI, "France implements Internet censorship without judicial oversight," March 11, 2015, accessed February 12, 2016 http://bit.ly/1CasJYJ.

39 Julien Lausson, "Apologie du terrorisme: un ado poursuivi à cause d'un dessin sur Facebook" [Apology of terrorism: a teenager prosecuted because of a drawing on Facebook] Numerama , January 17, 2015, http://bit.ly/1ZDWSsl.

40 Elissa A. Okoniewski, "Yahoo!, Inc. v. Licra: The French Challenge to Free Expression on the Internet," American University International Law Review 18, 1, 2002, http://bit.ly/1LOzaFS.

41 See Article 12, Law 2014-1353 of November 13, 2014, http://bit.ly/2eeaTwZ.

42 The decree implements modifications to the 2004 LCEN that were made under the 2011 LOPPSI 2 and the 2014 antiterrorism law. See: Decree 2015-253 of March 4, 2015, http://bit.ly/2ctwhi3.

43 Alexandre Linden, "Rapport d'activité de la personne qualifiée" [Activity Report], March 2015 – February 2016, CNIL, accessed September 1, 2016, http://bit.ly/2eAO4Ch.

44 "Le gouvernement demande à Facebook et Twitter de censurer une photo du Bataclan," [Government asks Facebook and Twitter to censor a photo of the Bataclan], Le Figaro , November 18, 2015, http://bit.ly/1YgahVR.

45 Law 2009-669 of June 12, 2009, http://bit.ly/2dAON3J.

46 Law 2009-1311 of October 28, 2009, http://bit.ly/2eAOvw7.

47 Loïc Hervé and Corinne Bouchoux, "Rapport d'information au nom de la commission de la culture, de l'éducation et de la communication (1) par la mission d'information sur la Hadopi" [Information report in name of the commission on culture, education and communication by the information mission on Hadopi], Senate, Extraordinary Session 2014-2015, July 8, 2015, http://bit.ly/2eHIEn8.

48 La Quadrature du Net, "Rapport MIQ : le vrai visage du SOPA à la française" [MIQ Report: the true face of the French SOPA], May 12, 2014, http://bit.ly/2eI8WqS.

49 La Quadrature du Net, "Rapport Hadopi au Sénat: le pire est devant nous!" [HADOPI Report to the Senate: the worst is ahead of us!], July 9, 2015, http://bit.ly/1MmSx4K.

50 Amaelle Guiton, "La fin d'Hadopi, une agonie politique" [The end of Hadopi, a political agony], Libération , April 30, 2016, http://bit.ly/1SUW2np.

51 Elsa Trujillo, "Les sénateurs sauvent la Hadopi de la disparition," [Senators vote to save Hadopi from disappearance], Le Figaro , May 26, 2016, http://bit.ly/1RxskAH.

52 Guillaume Champeau, "HADOPI: An FAQ to learn all," Numerama , February 10, 2016, http://bit.ly/2dRVwdH.

53 CNIL, "Right to delisting: Google informal appeal rejected," September 21, 2015, http://bit.ly/1NGpDz2.

54 Peter Fleischer, "Implementing a European, not global, right to be forgotten," Google Europe Blog, July 30, 2015, http://bit.ly/2dgeyHK.

55 Samuel Gibbs, "French data regulator rejects Google's right-to-be-forgotten appeal," The Guardian , September 21, 2015, http://bit.ly/1Kvr6nf.

56 Danielle Correa, "'Right to be forgotten' extended to all Google domains in EU," SC Magazine UK , February 12, 2016, http://bit.ly/2dzFTbB.

57 "Court says Facebook nude painting case can be tried in France," Reuters , February 12, 2016, http://reut.rs/1PKGzCL.

58 "Stop Jihadism" website, accessed September 1, 2016, http://www.stop-djihadisme.gouv.fr/.

59 Martin Untersinger and Morgane Tual, "Contre la propagande djihadiste en ligne, le gouvernement se tourne vers le secteur privé," Le Monde , May 9, 2016, http://bit.ly/2cJBtdS.

60 La Quadrature du Net, "Who are we?" accessed February 15, 2016, http://bit.ly/2dzGBpm.

61 Danny O'Brien, "Blogging ACTA across the globe: the view from France," Electronic Frontier Foundation, January 2010, accessed February 15, 2016, http://bit.ly/2eXcb1u.

62 Elisabetta Ferrari, "#nuitdebout: 5 things to know about the movement that's spreading through France (and maybe Europe)," Media Activism Research Collective, April 16, 2016, http://bit.ly/1WxvCel.

63 "The free communication of ideas and opinions is one of the most precious of the rights of man. Every citizen may, accordingly, speak, write, and print with freedom, but shall be responsible for such abuses of this freedom as shall be defined by law." See: Declaration of the Rights of Man 1789, September 1, 2016, http://bit.ly/1AgkDwp.

64 Guy Carcassonne, "The Principles of the French Constitution," published on the website of the Embassy of France in Washington, DC, November 28, 2007, http://bit.ly/1X4r11P.

65 European Court of Human Rights, European Convention on Human Rights, accessed September 1, 2016, http://bit.ly/1foTq0D.

66 "Human Rights Watch, "France: New Emergency Powers Threaten Rights," November 24, 2016, http://bit.ly/1P8yL1Q.

67 "Discours de Manuel VALLS, Premier ministre, Projet de loi sur la prorogation de l'état d'urgence, Assemblée nationale" [Speech by Manuel Valls, Prime Minister: bill on the extension of the state of emergency, National Assembly], gouvernement.fr, November 19, 2015, http://bit.ly/2duhrIJ.

68 See: Declaration of the State of Emergency, November 14, 2015; First extension of three months, Law 2016-162, February 19, 2016; Second extension of two months, Law 2016-629, May 20, 2016; Third extension of six months, Law 2016-987, July 21, 2016.

69 La Quadrature du Net, "A Police State to Avoid any Critical Evaluation?" November 19, 2015 http://bit.ly/1kNOJlk; See also: Glynn Moody, "French state of emergency allows website blocking, device search powers," Ars Technica , November 20, 2015, http://bit.ly/1XeWKf1.

70 Law 2015-1501 of November 20, 2015, Article 11, http://bit.ly/2evb2MQ.

71 Law 2014-1353 of November 13, 2014, http://bit.ly/1T1dzwE.

72 Law 2016-731 of June 3, 2016, http://bit.ly/2cS1zAO.

73 The bill came into force outside the period of coverage of this report, on October 7, 2016. See: Law 2016-1321 of October 7, 2016, http://bit.ly/2eAVW6D.

74 See for example: "A Nice, une Franco-Tunisienne condamnée à trois ans de prison pour apologie du terrorisme," [Franco-Tunisian woman sentenced to three years in prison in Nice for apology of terrorism] Le Monde , 18 June, 2016, http://bit.ly/2eIhRbJ; "Condamné pour apologie du terrorisme sur internet" [Condemned for apology of terrorism online], La Depeche , November 21, 2015, http://bit.ly/2dMZyU2; "Apologie du terrorisme sur Twitter : un ado condamné à 2 ans de prison ferme" [Apology of terrorism on Twitter : teenager sentenced to two years of prison], Numerama , December 11, 2015, http://bit.ly/2e1yaiF; Une peine record à Montpellier pour un homme accusé d'apologie du terrorisme sur internet [Record sentence in Montpellier for man accused of apology of terrorism online], France 3 Languedoc-Roussillon , August 31, 2016, http://bit.ly/2dAXv24.

75 Florian Reynaud and Soren Seelow, "Alertes à la bombe dans les lycées : le jeune homme placé sous le statut de témoin assisté" [Bomb alerts in high schools: young man placed under the status of an 'assisted witness'], Le Monde, February 10, 2016 , http://bit.ly/1SIGtlg.

76 Law 2015-912 of July 24, 2015, http://bit.ly/1SMCPq3.

77 Angelique Chrisafis, "France passes new surveillance law in wake of Charlie Hebdo attack," The Guardian , May 5, 2015, http://bit.ly/1Qj1XAK.

78 Law 2015-1556 of November 30, 2015, http://bit.ly/2eWT2N1.

79 La Quadrature du Net, "A Police State to Avoid any Critical Evaluation?" November 19, 2015, http://bit.ly/1kNOJlk; See also: Glynn Moody, "French state of emergency allows website blocking, device search powers," Ars Technica , November 20, 2015, http://bit.ly/1XeWKf1.

80 Jean-Baptiste Jacquin, "Etat d'urgence : le Conseil constitutionnel censure les saisies informatiques lors des perquisitions" [State of emergency : Constitutional Council censors IT seizures during searches], Le Monde , February 19, 2016, http://bit.ly/2eB8z1u.

81 Alexandre Boudet, "La version 4 de l'état d'urgence est la plus musclée depuis novembre 2015" [Version 4 of the state of emergency : the most beefed up version since November 2015], Huffington Post , July 27, 2016, http://huff.to/2e1B8Uz.

82 Law 2016-731 of June 3, 2016, http://bit.ly/2c7knag; See also : Jean-Baptiste Jacquin, "La France se dote de la loi antiterroriste la plus sévère d'Europe" [France gets the strictest antiterrorist law in Europe], Le Monde , May 12, 2016, http://bit.ly/2eB2jqA; Donald Hebert, "Ce qui fait polémique dans le projet de loi Urvoas contre le terrorisme" [What is generating constroversy with the Urvoas bill against terrorism], Nouvel Obs , March 3, 2016, http://bit.ly/2dB1uLL.

83 "No Government has done more to counter terrorism to date," gouvernement.fr, July 17, 2016, http://bit.ly/2eB98bw; Laetitia Valy, "Lutte contre le terrorisme : les 3 nouveautés à ne pas manquer !" [Fight against terrorism: three novelties not to miss!], Net-Iris , June 13, 2016, http://bit.ly/2evOIEA.

84 Alexandre Entraygues, "France – New 'Patriot Act' imposes surveillance obligations," Linklaters, January 31, 2014 http://bit.ly/1LOD6X5.

85 Kim Willsher, "French officials can monitor Internet users in real time under new law," The Guardian , December 11, 2013, http://bit.ly/18mtHm0.

86 Guillaume Champeau, "La DGSI investi du pouvoir de surveiller les communications sur internet" [The DGSI granted surveillance powers over the internet], Numerama , May 2, 2014, http://bit.ly/2extbqS.

87 Scott Sayare, "France broadens its surveillance power," The New York Times , December 14, 2013, http://nyti.ms/1MBpsFD.

88 Emilien Ercolani, "Loppsi : qui pourra installer les mouchards informatiques?" [Loppsi: Who could install spywares?], L'informaticien , November 7 2011, http://bit.ly/1MBpDkh.

89 Rakesh Krishnan, "French Orders Facebook to Stop Tracking Non-Users or Face Fines," The Hacker News , February 9, 2016, http://bit.ly/2dN6KPL.

90 Human Rights Watch, "France: Abuses under State of Emergency," February 3, 2016, http://bit.ly/1SZmwpH; Amnesty International, "France: Upturned lives: The disproportionate impact of France's state of emergency," February 4, 2016, http://bit.ly/1ZFuUeJ.

91 See for example: "Perquisition à Hérouville : 'Activisme et propagande sur Internet'" [Raid in Hérouville : Activism and propaganda on the internet], Ouest-france.fr , November 20, 2015, http://bit.ly/2e1vAcm. Philippe Trouchaud, "The Global State of Information Security, Survey 2016 – Turnaround and Transformation in cybersecurity," PriceWaterhouse Coopers France, October 2015, accessed February 16, 2016, http://pwc.to/1NLowjA.

92 Elodie Gaillard, "Press Release in 2015," PriceWaterhouse Coopers France, October 15, 2015, http://pwc.to/1Phurem.

93 Angelique Chrisafis and Samuel Gibbs,"French media groups to hold emergency meeting after Isis cyber-attack," The Guardian , April 9, 2015, http://bit.ly/1PlUUrz.

94 Jean-Paul Marthoz, "Cyberattacks rattle French, Belgian media outlets," Committee to Protect Journalists (blog), April 16, 2015, http://bit.ly/2evSI8b.

95 Aurelien Breeden and Alissa J. Rubin, "French Broadcaster TV5 Monde Recovers After Hacking," New York Times , April 9, 2015 http://nyti.ms/1DuINn0.