Tunisian activists fear that mass surveillance and Internet censorship may return to their country following the creation of a new “investigative” telecommunications agency. On November 6, the Tunisian government announced the establishment the Technical Telecommunication Agency (known by its French acronym ATT or A2T) by decree. Article 2 decree n° 2013-4506 [fr] summarizes the mandate of the agency:
The Technical Telecommunications Agency provides technical support to judicial investigations into ICT-related crimes. It is thus tasked with the following missions:
- Receiving and treating orders stemming from the judicial authority to investigate and record ICT-related crimes in accordance with the applicable legislation.
- Coordinating with the different public telecommunication network operators, access networks and all concerned telecommunication service providers in all of its listed missions in accordance with the applicable legislation.
- Exploiting national monitoring systems of telecommunication traffic in accordance with international human rights treaties and personal data protection laws.
ATT members still have yet to be appointed and the agency has not begun its activities. But it has already raised eyebrows among activists and bloggers who say decree n° 2013-4506 lacks necessary mechanisms for protecting user rights.
Article 5 of the decree states that the annual report on the ATT's activities will be “secret, unpublished and only sent to the government.” Activist Skander Ben Hamda called the ATT decree ‘dishonest‘:
This agency is similar to dozens of other agencies around the world established under the pretense of fighting cyber-crime or counter-terrorism which transform the State into a massive-surveillance State. The decree establishing this agency is dishonest: total absence of civil society and lack of transparency.
On Twitter, Tunisian Pirate Party member Raed compared the ATT to the US National Security Agency:
— RaedSSL ˙ ͜ʟ˙ (@Raed667) November 15, 2013
In a statement [ar] issued on November 20, Tunisia's Ministry of Information and Telecommunications Technology said that the creation of the agency aims to “protect the [country’s] national cyberspace from crimes.” The statement continued: “A set of guarantees on ATT’s activities have been made in order to consolidate respect for human rights, personal data protection, freedom of expression on the Internet and the right to access information.”
But this did not quell activists’ fears. In an interview with Global Voices, Internet freedom activist Dhouha Ben Youssef said, “The first problem is already in the form, the creation of this agency is made through a decree – not a law that must be voted by the National Constituent Assembly. Thus [there is] not even a debate.”
Unlike laws, decrees are issued by the government and do not require the parliament’s approval.
“Secondly, the introduction of the decree is based on a set of obsolete and repressive laws from the Ben Ali era,” Ben Youssef added.
The 2001 Telecommunication Code and the 2004 Privacy Law, were among the laws invoked by the government to establish the ATT. These two laws have deficiencies which make users vulnerable to judicial prosecution and state surveillance. Article 86 of the telecommunication code stipulates that anyone convicted of “harming others or disrupting their lives through public communication networks’’ may face up to two years in prison. This particular article has been used many times (before and after the revolution) to prosecute and convict bloggers and users.
Also concerning is the fact that Tunisia's data protection authority (INDPD) remains weak under the2004 Privacy Law. Among other deficiencies, the law allows state authorities to collect and process personal data without obtaining the consent of the INDPD.
The autonomy and neutrality of the new agency has also been called into question.
Under Decree Article 4, the agency’s general director shall be appointed by the ICT ministry. A Tunisian Pirate Party statement [ar] charged that Article 4 “strips neutrality and objectivity” from the agency’s work and “makes spying on the opposition possible.”
The Ministry has said that a “follow-up” committee will be appointed within the ATT, with the intention of ensuring “good exploitation of national systems monitoring the telecommunication traffic in respect of personal data protection and public freedoms.” Yet just like the agency itself, this committee will be led by the ATT's general director.
The follow-up committee will be comprised by five government representatives appointed from the ministries of Human Rights and Transitional Justice, Interior, National Defense, ICT and Justice. A judge will act as the committee’s vice president and the two remaining members will be selected from the country’s data protection authority (INDPD) and the High Commission for Human Rights and Fundamental Freedoms, a government institution.
— Moez Chakchouk (@mchakchouk) November 15, 2013
Indeed, amidst Tunisia's post-revolution legal and institutional vacuum the ATI often stepped in to assist judiciary investigations of cybercrime. ‘We don’t have any constraints but we try to help the court solve some cases, keeping a minimum surveillance,” Chakchouk said during the Freedom Online Conference in Tunis last June.
Tunisian activists have already launched the Stop #A2T campaign. “There is still time to get civil society and netizens involved,” said Ben Youssef. She suggested that the ATT board include a civil society representative. “By adding a representative at the A2T board, we'll be watching the watchers.”