The State of Surveillance in Tunisia

COMMUNICATIONS LANDSCAPE

Despite the economic crisis, political instability and social challenges, post-Arab Spring Tunisia has experienced major changes in the use of new communication technologies and social network platforms. The 2014 report of the International Telecommunication Union (ITU), entitled “Measuring the Information Society” [1] ranked Tunisia 99th in the world, down two places from 91st in 2013. Tunisia is second in the Maghreb region, behind Morocco. In the Arab world, the ITU ranks Tunisia 10th, far behind the Gulf countries.

In official statistics published by the Ministry of Higher Education, Scientific Research and ICT [2], in September 2014, there was a slight increase in fixed and mobile subscriptions with about 350,000 new customers in 2014. The Ministry identified the most important developments as being in the Internet sector. Since 2005, Tunisia has initiated a reform plan to develop internet access. As part of this plan the price of internet subscritions was regularly decreased. The average price of US$ 6.10 for ADSL 512 Kbps is considered the lowest in the region. As for the pricing of mobile internet, Tunisia is ranked 32th worldwide according to the ITU.

5.81 million users enjoy free internet access in Tunisia; the capacity of bandwidth has doubled from 50 Gb/s in 2010 to 100 Gb/s today. Half of the population is connected to the internet, as indicated by the penetration rate of around 52%. Most Tunisians use a 3G mobile connection, 63% according to the Ministry of Higher Education, Scientific Research and ICT and 72% according to the ITU.

A recent report on the use of social media in the Arab world [3] ranks Tunisia third in the Maghreb region in terms of numbers of social media users, with 4.6 million Facebook users, including 3.6 million via mobile access. The report ranks Tunisia first in the region for social media penetration. Twitter is less frequently used in the country, with only approximately 37,000 users (as of May 2014) while LinkedIn is used by around 415,000 Tunisians, as detailed in a 2014 study by the Tunisie Sondage polling institute.[4]

LEGAL LANDSCAPE

International conventions on privacy and human rights in general

Tunisia is a signatory of a number of treaties with privacy implications, including:

• the International Convention on Civil and Political Rights; and
• the African Charter on the Rights and Welfare of the Child.

Constitution

Elected in October 2011, the National Constituent Assembly’s main task was to draft the new constitution of the Second Republic of Tunisia. It is called a consensual constitution since it is the result of many compromises made among many political and ideological movements within the framework of a national dialogue. It was adopted on in January 2014 with a large majority; there were 200 votes in favor, 12 against, and 4 abstentions.

The new constitution has many advanced provisions related to human rights, including the preamble, which declares Tunisia to be respectful of human values ​​and universal principles of human rights. The second chapter is devoted to the affirmation of the rights and freedoms of every citizen. Article 24 deals with the protection of personal data and states:

“The State shall protect the privacy and inviolability of the home and confidentiality of correspondence, communications and personal data.”[5]

In addition, any Tunisian has the right to privacy and confidentiality of his correspondence, communications and personal data.

It is stated in Article 49 [6] that no constitutional amendment can remove rights and freedoms contained in Chapter 2. However, the same article provides for certain exceptions which can be set by law and applied in extreme cases such as those related to national security, maintenance of public order and the limitation of harm to others.

Various existing laws, specifically those found in the Criminal Code, restrict freedoms when it comes to safety issues.

Statutory law

The “political police” in Tunisia was the key actor in the abuses perpetrated by President Ben Ali during his 22 years in power. The police was under his command. Ben Ali’s career started in the security services, first in the army as director of the military security for over ten years, then as head of national security, later as secretary of state and then as interior minister. Once President of the Republic, Ben Ali devoted himself to strengthening the security framework, through more restrictive laws curtailing individual rights and freedoms, in particular, setting limits on the use of new communication technologies.

In addition to monitoring through official bodies and informants from the RCD former political party, certain pieces of legislation allowed for the arbitrary control of information systems. The National Assembly adopted Law No. 5/2004 of 3 February 2004 [7] for the purpose of guaranteeing the security of systems and public and private computer networks. But in the absence of a precise definition of the concept of “information security”, this law allowed the competent authorities, including the National Computer Security Agency (ANSI), under the cover of technical standard-setting, to exercise surveillance and censorship of the Internet.

Under Chapter 2 [8] of Decree No. 3026 of 2008, telecommunications providers (phone operators and internet service providers (ISPs)) are obliged to “meet the needs of national defense and security and public safety under the laws and regulations in force, and make available to the competent authorities the means necessary to accomplish their mission.” In this capacity the operator is required to comply with the instructions of the judicial authorities, military and police.

Similarly, the second article Decree No. 1250/2004 [9] obliges telecommunications operators, public and private ISPs and all companies that would deal with personal data to allow a periodic audit of their networks and computer systems.

Given that the Internet was not regulated at that time, the government used the Decree No. 501 of March 1997 [10] on telecommunications companies to carry out internet monitoring. Articles 1, 9 and 14 of that decree make ISPs responsible for content produced by third parties; therefore, in an indirect way, these texts allow providers to control and censor the digital content.

Added to these are the provisions of the Telecommunications Code, and in particular Articles 5 and 6, which grant power to the government in the allocation of permits — licences to operate — prior to the provision of telecommunications services. These articles were exploited by the extended family of President Ben Ali, whose businesses have been granted several licenses.

Article 9 of the Telecommunications Code details the conditions and procedures for the use of encryption in respect to Articles 86 [11] and 87 [12]. They pertain to a series of sanctions against improper use of telecommunications and use of encryption without prior permission of the authorities.

Furthermore, Decree No. 50 of January 26, 1978, which describes the state of emergency in the country, grants the right to authorities to control any type of publication media.

Yet a specific legal framework regulating the listening and monitoring of the content of correspondence, including online communications, is still missing. The Organic Law No. 63 of July 2004 on the protection of personal data does not provide exemptions or derogations from the application of data protection provisions.

Several restrictive laws continue to have effect even after the 2011 revolution and the “dismantling” of the police state of Ben Ali. The post-election government announced the creation of the Technical Agency for Telecommunications (ATT) through Decree No. 4506 of November 2013 [13]. It is meant to be under the supervision of the Ministry of Communication and Information Technologies, the public administrative establishment whose mission is to “provide technical support to the judicial investigations into the information systems of crimes and communication”.

The state has explicitly created a body to perform surveillance under the investigative orders from the judiciary, therefore, only in the case of investigations launched by a court. The data collected would serve as evidence for prosecutors and presented to the court. The decree also announced the creation in 2014 of a committee to follow up on the work of implementation of the ATT [14].

Still, this agency is considered illegal and unconstitutional [15], since its creation is a violation of the right to fair trial, because defendants can not challenge evidence compiled by the ATT. Furthermore, the agency began to exercise without any framework that defines the crimes they are mandated to investigate, since no law defines “crimes of information systems and communication” as mentioned in the 4506 decree.

These crimes of information systems, nonexistent until the ATT’s creation, have been defined and incorporated in a bill for the Suppression on Networks, leaked to the media in 2014[16]. In parallel, a draft Organic Law No. 09 on the fight against terrorism and the prohibition of money laundering [17] was tabled in the National Constituent Assembly. It contains five articles dealing with surveillance. The vote on the bill was blocked at a meeting before the drafting committee could finish its work and be replaced by the new parliament.

POLICIES

Freedom of Information

Freedom of information and the right of access to information have been for decades the focus of a battle between civil society and successive governments.

Tunisia acceded to certain international treaties that mention the right of access to information. Among these conventions the International Covenant on Civil and Political Rights (1968) and the UNESCO Guiding Principles for the Development and Promotion of Governmental Public Domain Information. Tunisia has also signed and ratified the United Nations Convention Against Corruption (UNFCCC) in September 2008.

On the local level, although no legislation was totally explicit and on access to information, there were various legal instruments such as Article 8 of the Constitution of 1959 and the Act of 2 August 1988 (section 3) which treat the communication of public records, as well as other circulars of the Ben Ali era for the creation and regulation of relationships with citizens’ offices or the creation of the Directorate General of Information whose mission was to intervene to assist journalists in their investigations in 2007.

No legal framework guarantees human rights nor press freedom by the law. Chapter 15 of the old Labor Code does not guarantee a reporter access to information as part of the exercise of his work. In addition, the former Tunisian Press Code punished as a crime any interference with the president and the dissemination of information likely to create a public order disturbance.

Decree Law No. 41 [18] on access to administrative documents of public bodies came into effect on 26 May 2011 and marked the launch of a new social and administrative culture. It was followed by an amendment supplementing it on 11 June 2011 by Decree Law No. 54 [19], Article 3 of which clearly states that “Any natural or legal person is entitled to access administrative documents as defined in Article 2 of this Decree, as well as to proactive disclosure upon request of the person concerned, subject to the exceptions provided for in this Decree.”

This set of laws require public bodies and other jurisdictions to establish a way to communicate to citizens documents and material information in order to promote a culture of transparency and improve relations with the government.

At the government level, several administrative data services have been launched on the portal Gov Data [20]. Even the Ministry of Internal Affairs has converted much information into open data [23] available online. On 5 May 2012, the government sent a circular [21] insistently demanding that all public structures apply the decree laws on access to information.

Regarding media affairs, the repressive press codes that had hampered investigative work and access to information have been repealed and replaced by Decree Law No. 115 of 2011 [22]. Article 10 of the decree reaffirms this right of access, stating “The journalist, just as any citizen, has a right of access to information, new data and statistics, he has the right to obtain communication with their different sources depending on the conditions, terms and procedures laid down by Decree Law No. 2011-41 “.

In September 2013, the Minister for Good Governance, announced the revision of the decrees of open gov, as they contain some vague provisions allowing a wide field to arbitrary interpretation but some items are formulated in a broad manner, thus hindering their application. Also among the shortcomings, the lack of control of the access application process to information made ​​by the citizen, and the answer to which, the latter may have recourse if his request was not met. As soon announced, the government launched a public consultation [23] to define with Tunisian adjustments to the Decree 41. After this public dialogue, a draft organic law [24] on the right of access to Information was tabled at the meeting, it should be studied by the new assembly elected representatives of the people.

In parallel, the work of the National Constituent Assembly culminated in the adoption of a new constitution in January 2014, which gives access to information a constitutional status. Article 32 [25] states that “The right of access to information is guaranteed. The State is working to ensure the right to access to communication networks. ” This article is a world first, since no other constitution explicitly has such a right in its text.

However, the regulatory framework around the access to information law is conditional on the law of protection of personal data, particularly Article 16 of Decree Law 41/2011, and also the limitations of protection of private information related to property rights, and if the requested documents affect a court decision or are confidential.

Furthermore, Article 17 of Decree 41/2011 sets out the exceptions to access to information under the framework of justice and limit the publication of information or documents that could be detrimental.

Identification and registration of subscribers

During the Ben Ali era laws required direct or indirect identification of telecommunications and internet users.

Since the Internet was not accessible to all in the 2000s, the state required to Internet cafes called “publinets” to keep an updated record of certain data about their customers. This practice is not widely respected today, as publinets are less frequently used with the advent of broadly accessible and cheaper internet and mobile internet.

Each customer must present documentary evidence of his or her identity in order to purchase and activate a SIM card. SIM operators must record customer data regarding their identities: name, surname, date of birth, address, and national identity numbers (CIN). Operators are also obliged to share the specifications of the obtained licenses in order to update this database.

Moreover, in March 2014 in a bilateral meeting between the Ministry of Internal Affairs and the Ministry of Information and Communication Technologies,the ministries decided to revise the procedures for allocating SIM cards and strengthen requirements governing submission of supporting documents [26]. In July 2014, the telecommunications regulator sent an order requiring Orange Tunisia to respect the rules governing the sale of SIM cards and the conclusion of subscription contracts [27].

In June 2014, the government launched a tender to recruit a research firm to deliver the development of a unique identifier for every citizen [28]. This project was created during the government of 2012-2013 [29], and was approved by a Council of Ministers in October 2014 [30].

Unlawful monitoring boxes

Under Ben Ali, “citizens [lived] in a constant state of doubt on the security and confidentiality of their communications” as Ben Wagner explains in its report on the export of surveillance technology including in Tunisia. Many were placed under physical and electronic surveillance, especially the political opponents of the government. Some were imprisoned and others became exiled and sought refuge in European countries.

Since the revolution, for a brief period of time, there was little persecution that appeared deliberately directed against a specific population group. Yet since 2012, with successive terrorist attacks in Tunisia, and in parallel, the disturbing presence of Tunisian elements fighting in Syria, the state is engaged in a battle against these groups, and has increased surveillance accordingly.

The national investigative unit on terrorist crimes within specialized services of the Directorate General of National Security is the police unit specialized in this field. It is dedicated to monitoring the internet-related crimes, and sometimes carries out “preventive operations” arrests often based on telephone and electronic communications as stated in the recent press releases of the Ministry of Interior [31].

Still, much surveillance remains illegal since no legal framework clearly defines online crimes as have been seen on the internet libertarians questioned by Nawaat during some arrests [32].

ACTORS

Regulatory bodies

The regulation of the information technology sector and communication in Tunisia began in the early 2000s with the enactment of the first telecommunications code in 2001. This code gave rise to the creation of a main regulatory authority in charge telecommunications: the national body of telecommunications (INT) [33] under the supervision of Ministry of Information and Communication Technologies [34].

The State has created the national agency of frequencies (ANF) [35] to regulate broadcast media. It is in charge of managing the frequency spectrum also under the Ministry of Information and Communication Technologies whose primary mission was to establish a regulatory framework that organizes the sector. The code establishes the national Office of the Telecast (ONT) [36] responsible for the creation, operation, maintenance and expansion of distribution networks.

As for the Tunisian Internet Agency (ATI) [37], created in 1996, was long regarded as a regulator of the internet. The agency acts as an Internet Service Provider and it is also an internet exchange point and registry responsible for the technical management of national domain names. The ATI was created to work on developing the internet in Tunisia, but will be diverted over a decade of this by requiring it to be host of the internet censorship and surveillance, without necessarily being formally mandated.

The National Agency for Computer Security (ANSI) [38] was created in 2004. Its role is the overall control of IT systems and networks within the various agencies, and ensures the implementation of the general strategy security of IT systems, while conducting a periodic audit of the systems. ANSI hosts “TunCERT” [39], an emergency response team responsible for monitoring and supervision with regard to cyber attacks, and offering advice and information relating to the national security of the virtual space.

Another actor in the sector and which is also under the supervision of PCM is the National Certification Agency (NDCA) [40], it is responsible for secure e-transactions and the Decree No. 2001-2727 of 20 November 2001 to make the approval of encryption systems.

In addition, the Center for Telecommunications Studies and Research (CERT) [41] (different from the TunCERT department under ANSI) provides technical expertise and study, and is the sole authority to approve and technically control the import terminals of public telecommunications networks and radio equipment.

Besides the above-mentioned structures that frame directly or indirectly the ICT space and have all worked together and in total opacity, the Higher Communication Council (CSC) provides oversight of the ICT space. It was created in 1989 by Decree No. 238 [42] but only recognized in 2008 through Law No. 30.

After amending the Telecommunications Code, in 2008, INT was supported in its role as principal regulator, specifically in relation to the Internet. The reinforced body thus became responsible for the regulation of Internet resources, such as registering domain names, which was formerly the mission of the ATI, which will nevertheless continue to exert the technical management side of this role.

It is important to note that the regulation of the Internet in Tunisia has never been transparent, so it is almost impossible to conclude definitively which actors are responsible for which mandates, even after the series of amendments made to the telecommunications code in 2013.

The National Body for the Protection of Personal Data (INPDP) [43], was created in 2004 through Law No. 63 which establishes the personal data protection regime in the country. In 2007, Decree No. 3003 defined its organization and functioning.

Shortly after the 2011 revolution, priority was given to the reform of the spectrum regulator of the communications technology sector. The functions of the agencies were redefined in order to ensure transparency. INT kept his role of ICT regulator. As for the broadcasting and the recommendations of the INRIC [44] responsible for the media sector reform, the High Independent Authority of Audiovisual Communication (HAICA) [45] was established in 2012. Its mission is to regulate the media sector. It was replaced under a constitutional body under Article 127 of the new Constitution [46].

Communications Service Providers

In 1997 Tunisia signed an agreement with the WTO [47] on the liberalization of telecommunications and the convention sector. It provided a schedule of work to be accomplished between 1999 and 2003, which required the allocation of a particular second mobile license, a license to a data transmission operator, a license for a fixed operator and the opening of the capital of the incumbent.

Under the WTO roadmap, and following the enactment of the Telecommunications Code in 2001, the authorities announced the end of the state monopoly in the telecommunications sector, held until then by the operator Tunisie Telecom. Market liberalization has allowed Ooredoo (former Tunisiana) to obtain a mobile telecommunications operator license [48] operational in 2002.

Subsequently, a second license for the establishment and operation of a public network for data transmission VSAT satellite was granted in 2004 to another private operator DIVONA Telecom. A third license was won by Divona-Orange, for the provision of fixed telecommunications services combined mobile services with 2G / 3G, and in 2009 [49] this operator will keep a monopoly on 3G for one year.

The operator Tunisie Telecom was partially privatized in July 2006, 35% of its capital granted to Emirati consortium TECOM-DIG in against of 3.05 billion dinars. The operator Ooredoo – when he was Tunisiana – had as main shareholders Wataniya Telecom and Orascom Telecom. But in 2012, after the seizure of the assets of the Ben Ali family, the Tunisian government has sold 15% of the forfeited shares, the operator Qtel and kept the remaining 10%. Qtel thus became the largest shareholder with 90% Ooredoo same time the operator gets fixed and 3G license [50].The state seized 51% of the Orange Telecom shares previously held by the son of Ben Ali, but as of early 2014 the legal battle is not over yet [51].

These problems with the law have allowed the state to be represented in the capital of two operators in addition to the 65% stake it owns at Tunisie Telecom, where it is represented by the Ministry of ICT.

However, the market remains quite opaque about the practices of the various operators and ISPs in the use of data collected from their customers. In March 2014, the National Consumer Institute (INC) has appealed to the three operators to safeguard the personal data of their customers [52] and to institute better governance practices.

Recent public statements regarding the arrest of groups considered “terrorists” ​​by the Special Crisis unit of the current government often indicated that these operations were carried out, based communication listener or monitoring Facebook pages. However, there is no concrete evidence to date of requests addressed directly to operators, confirming their cooperation with justice as has been reported [53].

Security and law enforcement agencies

After the revolution of January 2011, the transitional government announced in March that the Security Directorate of the State (DES), who officiated as the political police of Ben Ali, had been abolished [54]. This directorate under the Ministry of Interior but actually applied the directives from the palace of the presidency took care of tracks and installation of microphones as well as physical surveillance in Tunisia and abroad. IT collaborated with the Directorate General of Military Security (MSB) under the Ministry of Defence, the General Directorate of specialized services (DGHS) and other foreign intelligence services [55].

And because of the development of security risks, the government organized a conference-debate on the theme “Intelligence services in democratic rule of law: legitimation, organization and control” [56], the minister for good governance and combating anti corruption, invoked the urgency of implementing a strategic restructuring plan of the Tunisian security services on the basis of the German experience.

The government decided in late November 2014, to set up a new intelligence agency, security and defense under the Ministry of Defence. But the Decree No. 4208/2014 [57] creating the agency provides no more details on its operation or its financing, except that this project is supported and closely followed by the United States [58]. The defense minister has just told the media that “this structure will replace the general administration of military security, incorporating levels of the collection and analysis of information, and a third level responsible for determining the strategy to be adopted.” [59]

In the same week, the Tunisian Ministry of the Interior announced at a joint press conference with the British Embassy in Tunis the creation of a new strategic planning unit responsible for the management and prevention of hazards and terrorist attacks. Funding for the supervision of its agents and the provision of specialized equipment would be by donation from the British [60].

A few days before the end of 2014, without much detail, the head of government inaugurated two new poles, one “safe” for the fight against terrorism and organized crime and the second “judicial “specialized in terrorist cases [61], both depend, respectively, the Ministry of the Interior and the court of first instance of Tunis until the new Assembly of People’s Representatives vote the new anti-terrorism law.

In terms of international cooperation, however necessary to strengthen the fight against terrorism, Tunisia remains silent, despite rumors about the installation foreign bases in Tunisia [62].

EXAMPLES OF SURVEILLANCE

Under the government of President Ben Ali regime, multiple examples of surveillance of citizens were reported. Bloggers and activists were arrested and detained and requested to disclose the passwords to their email and Facebook accounts.[63] Diplomatic cables from the US embassy in Tunisia released by WikiLeaks have also documented surveillance of activists who had been trying to reach out to foreign diplomats for help. One cable condemned the situation as “a culture of paranoia about dealing with foreign governments” originating from the Ministry of Interior.[64]

The surveillance and pressure on embassy workers is also described at great length. In another cable, US diplomats described the surveillance of the embassy observation teams, in charge of monitoring the proper proceedings of the national elections in 2009[65] In a 2009 report about the state of human rights in Tunisia, the US embassy mentioned that human rights groups were surveilled by the government.[66]

TECHNOLOGIES

During his time in power, president Ben Ali had purchased a wide range of surveillance technologies.

Kamel Saadaoui – former director of the ATI from 2008 to revolution – mentioned Trovicor GmbH (formerly a unit of Nokia SIemens Network) as one of the companies used for voice and data interception on cell phone. According to a report published by Bloomberg, the company is said to have provided Tunisia’s phone companies with monitoring centres computers and also maintained their ability to feed calls and data to the listening posts, one of which included Ben Ali’s presidential palace.[67]

ETI A/S, a Danish company provided mobile data interception used to reconstruct online activities. This system is capable of tracking the websites a person visits and logs of e-mail correspondence. It is likely the product referred to is ETI’s X-Stream which, according to a brochure, possesses that exact capability.[68] Surveillance company Utimaco was reportedly hired to provide the infrastructure to relay the information the phone networks and the monitoring centres.[69]

According to a presentation obtained by Privacy International, the Tunisian Ministry of Interior had purchased surveillance technology from ATIS Systems. ATIS Systems, a Homburg, Germany company sells monitoring centres, internet monitoring, audio suveillance and location monitoring equipment. ATIS’ Klarios system is a monitoring centre that monitors, among other things, IP networks and voice networks.

Footnotes ▼