Guilhem Giraud: “Thanks to artificial intelligence, mass surveillance has no limits!”

Since the attacks of September 11, 2001 in the United States, mass surveillance technologies have continued to develop. In the name of the fight against terrorism, many countries have implemented tools to massively capture data on their population. In authoritarian countries, it is above all a question of repressing opponents. In democracies, the authorities are also tempted by what they readily qualify as “technical solutions”. Sometimes these surveillance technologies can be bought by criminal groups, warns Guilhem Giraud, former engineer of the Territorial Surveillance Department (DST), which tells the behind the scenes of mass surveillance systems. This tapping specialist, recently author of

Confidences of a French intelligence agent (Robert Laffont editions), also warns about the ability of our smartphones and Gafam to take charge of our private data.

What exactly does the term “mass surveillance” mean?

In fact, I define mass surveillance negatively: surveillance is “mass” when it is not targeted. The job of the security forces is to collect information about interesting people. But as soon as we seek information on everyone in the hope of obtaining it indirectly on interesting people, it becomes mass surveillance.

The phenomenon spread throughout the world after the attacks of September 11, 2001. The United States then decided that the enemy could be everywhere. So everyone could be monitored in order to provide information to the security forces.

The whole population becomes suspicious…

Exactly. Which raises the question of the effectiveness of mass surveillance: how to manage such a quantity of information? For me, its effectiveness is close to zero. I saw this development happen when I started my career at the DST, the internal intelligence service [devenue Direction générale de la sécurité intérieure depuis, ndlr], when I did my military service there, in 1997-1998. At the time, surveillance was a police job. It was about collecting information about people who were of interest to state security.

From 2001, I noticed profound changes in doctrine, and when I came back to the DST as an engineer, I started to see this new mode of operation taking place. It reached its climax when the DST, which became DCRI then DGSI, acquired the Palantir system, after the 2015 attacks in Paris, under very strong political pressure. The Palantir system is typically a mass surveillance tool.

How is it used?

Designed in the United States, Palantir offers several possibilities. It is above all a tool that gives investigators visibility on a very large amount of information. The system is ready to accommodate all kinds of flows. Above all, it made it possible to exchange all this information between intelligence services.

The United States has created a de facto standard with this type of product. Once one, then two, three or four intelligence services of European countries have acquired Palantir, it becomes almost natural for the others to use it too, because they will be able to exchange information easier. What also characterizes mass surveillance is the facilitated circulation of information on the populations of various countries.

What types of personal data are concerned?

In France, as in many European countries, there is a fairly clear doctrine that protects citizens: mass surveillance essentially concerns what is called technical data, i.e. not conversations and their content , but anything that identifies a conversation: who did you call? When ? For how long ? On which GSM terminal were you located? If it is on the internet, on which site you were connected? What was your browsing history… But without going into more content.

When working in the field of surveillance, there is a very strong dichotomy between the content, which is what the person expresses, which is a matter of private life, protected by the criminal code, and the technical data, which is a domain a little gray since there are devices that can acquire this data in bulk.

Do the Americans monitor beyond these “technical” data or not?

This is indeed a very interesting point. I allow myself to doubt the effectiveness of mass surveillance because it generates so many data. And when we also talk about mass content, it means deploying absolutely phenomenal analytical capabilities. We can wonder if, in the end, we didn’t go through other ways of working. The principle of sobriety that we apply to the environment could also concern surveillance.

The challenge for the intelligence services is then to manage this mass of information…

Yes, they listen beyond the technical aspect of the data. There have been several scandals in the United States, which fortunately have not been detected here. Operators have been zealous across the Atlantic. In the wake of the 2001 attacks, the Patriot Act was passed almost unanimously by the American parliament. When the telecommunications operators saw this legislative object arriving in their landscape, they were zealous. They have not only made the technical data available, but they have allowed themselves to listen in on the conversations of Americans en masse.

For democratic regimes, what are the risks of drift?

Drift is the executive’s temptation to use technology because it’s easy. This is called “techno-solutionism”, which consists of considering that the technology is there, available, that it allows you to do many things and that you can show results.

It must be understood that the Internet, which monitors us through the Gafam [Google, Apple, Facebook, Amazon et Microsoft, ndlr], has a limit, it is the limit of the physical. The internet cannot know who you are in a room with when you are surfing. With technology, a central system can find out, via cell phones. And that strikes me deeply.

Is facial recognition a tool for mass surveillance?

I am less of a specialist in image surveillance, but for me, video surveillance is an in-between. We will capture a flow in a specific place. The same thing is done in telecoms when an operator provides investigators with a list of all the telephones that have reached a specific location. It is a valuable tool in an investigation.

So, I bring these two techniques together. Where it becomes mass surveillance is when this image capture device acts on an entire given territory. This is possible in countries that have a very specific configuration, such as that of the Persian Gulf monarchies. They concentrate most of human activity in city-states. You can crisscross the entire urban fabric with a network of surveillance cameras.

We must then wonder about the role of artificial intelligence, over and above this data capture, to automatically recognize faces and couple them to databases to deduce identities, to detect risky behavior, etc. . The result is that when you walk down the street, you are spied on.

Are cities like Dubai or Doha managed on this model?

I have not intervened on this type of device but what I understand with my experience leads me to think that this type of surveillance is in operation. These are cities that have put themselves in a position to be able to crisscross their territory to constantly monitor what people are doing. And with a layer of artificial intelligence, not having to deploy thousands of pairs of eyes monitoring control screens, but only escalating interesting cases.

For the last World Cup in Qatar, were we in this pattern?

Everything leads me to think so. There are technical limitations for this kind of event in terms of density and mass processing. There is a bottleneck in these mass surveillance devices. We build a system that feeds databases and servers with huge amounts of data. Artificial intelligence makes it possible to break the lock of human processing. I could even say that thanks to artificial intelligence, mass surveillance has no limits!

However, can we slow down these developments?

Today, the most worrying thing when we talk about mass surveillance is the ability of our everyday auxiliaries, smartphones, to spy on us through the applications deployed by Gafam. These companies have set up a complete ecosystem around them that allows them to capture data, monetize it, resell it to others who will use it. We saw this in the case of Cambridge Analytica, which used Facebook data to skew electoral processes somewhere.

Today, there is an absolutely phenomenal ability to capture high value information about people. When you put a thumbs up in an application you say a lot about who you are. It’s even more calibrated than a communication interception! You express what you feel. Imagine what these companies are able to know about you when you put 100, 500 or 1000 thumbs up.

This capacity produces an inexhaustible source and which has functions of which we have not yet defined all the contours. For example, I read in a specialized article in the United States that there was a project by Google, in a country in the Middle East, consisting in coupling the images captured by the applications on the population’s mobile phones with a government CCTV system.

This is called “crowdsourcing”. [la production participative, ndlr]. The idea is to ask the population to fulfill a function, and that, typically, the Gafam can do. Concretely, you make a personal video, which is intercepted by Google, in particular thanks to geolocation. Google then sends them back to a local government server which merges this feed with its databases.

It’s terrifying, because it means everyone is spying on everyone else, and the footage is then run through a central monitor.

Is the Pegasus spyware, developed by an Israeli company, part of mass surveillance?

It’s an industrial surveillance accident. The company that developed the Pegasus software obtained a blank check and the frank support of its government, in this case Israel. But somewhere they created a monster that came out of its cage. Now Mexican police fear that Pegasus has been sold to drug cartels who have used it for their benefit. You have an extremely powerful tool which is also privatized. For me, we are playing sorcerer’s apprentice. We are in a jungle.