PUBLIC WiFi IN FRANCE

Since the early 2000s, WiFi hotspots that allow access to the Internet via wireless networks have multiplied in French public places. Users equipped with WiFi-compatible mobile devices (laptops, mobile phones, personal assistants) can thus connect to the Web or to professional applications (extranet, etc.) while traveling or staying at a hotel, for example.

However, the rise of WiFi has raised a new problem in the fight against crimes related to new technologies. While it is possible to be clearly identified when using traditional means of communication (landline and mobile telephony, internet access at home), WiFi hotspots offer a means of communication that allows one to operate anonymously and therefore with impunity.

Among the offences related to the use of the Internet, we distinguish:

Fraud and cybercrime:

• Invasion of privacy
• Online scam
• Hacking private networks

Cybercrime:

• Child pornography
• Organized crimes
• Terrorism…

To respond to these growing threats, the French State has put in place, in accordance with European directives, a legislative framework aimed at limiting the anonymity of public WiFi users, with the aim of ensuring the security of citizens, while guaranteeing respect for individual freedoms.

This section aims to provide, based on the regulations in force, the essential clarification on the responsibilities and risks inherent in the provision of a WiFi service.

 

Bodies responsible for regulating public WiFi in France

ARCEP The Electronic Communications and Postal Regulatory Authority was created in 1996 to regulate competition in the telecommunications sector. This authority also monitors compliance with emission standards.

CNCIS The National Commission for the Control of Security Interceptions is an independent administrative authority responsible for ensuring compliance with the provisions relating to correspondence sent by electronic communications.

CNIL The National Commission for Information Technology and Civil Liberties was established by Law No. 78-17 of January 6, 1978. This independent authority sets the rules relating to information technology, files and civil liberties.

HADOPI Hadopi is an institution exclusively dedicated to the dissemination of works and the protection of rights on the Internet. It creates an unprecedented precedent that will help to change the debates and problems encountered by copyright on the Internet.

THE JUDICIAL AUTHORITY* The judicial authority ensures compliance with public WiFi regulations. To do this, it relies on investigations by the police and the national gendarmerie services within the framework of a classic judicial requisition. An administrative requisition procedure specially created for the fight against terrorism allows the services concerned, such as the Territorial Surveillance Directorate (DST), to act more quickly. *Ministry of the Interior

What is an Internet Service Provider (ISP)?

Article L32 of the Postal and Communications Code considers the following to be internet access providers:

• Providers of access to electronic communications networks accessible via a WiFi terminal,
• Individuals whose business specifically involves offering a paid online connection service, such as managers of “cybercafés”,
• People who offer, in a public setting, an internet connection to their customers or visitors, including hotels/restaurants, airports or public transport.

 

OPENING A PUBLIC WiFi ACCESS MEANS BECOMING AN INTERNET ACCESS PROVIDER.

Practical case

A carrier wishes to offer Internet access to its passengers; there are two options available to it:

He decides to call on an Internet Access Provider; that is to say a professional declared to ARCEP, with the aim of entrusting him with his public access service. Consequence: the carrier is not considered an electronic communications operator. He is not subject to regulation, his Internet Access Provider taking charge of the proper compliance with legal obligations on his behalf.

He decides to manage his access service himself. He buys WiFi equipment and then calls on a telephone operator who will be responsible for deploying and possibly maintaining the equipment. Consequence: The carrier is considered an Internet Access Provider. He has the obligation to declare his activity to ARCEP, he pays the annual administrative tax based on his turnover (in K€) and the proper compliance with all the legal obligations inherent to his status as an operator.

THE REGULATION Definitions and principles set out in Article L32 of the Postal and Electronic Communications Code. Electronic communications "Electronic communications means the emission, transmission or reception of signs, signals, writings, images or sounds, by electromagnetic means." Network open to the public “A public network means any electronic communications network established or used for the provision of electronic communications services to the public or of communications services to the public by electronic means.” Operator “Operator means any natural or legal person operating an electronic communications network open to the public or providing an electronic communications service to the public.”

Extract from the general conditions of French telecommunications operators

Orange

Article 38

• "PROVISION OF THE CARD BY ORANGE BUSINESS SERVICES 38.2. Unless prior written authorization is obtained from Orange Business Services, the Customer shall not associate the Card with technical solutions intended to reroute Communications by any technical process, to pool a Service among several Users, or to establish connections. In general, and in particular in such cases, Orange Business Services reserves the right to suspend and then terminate the Order concerned. The Customer will then be billed retroactively for Communications based on a metered rate that would be applicable to him."

Article 44

• "SPECIAL CASE OF ACCESS TO A SERVICE INCLUDING UNLIMITED COMMUNICATIONS within the framework of the Service concerned, the Customer and its Users prohibit any fraudulent use such as in particular: the use of unlimited Communications for commercial purposes (resale of unlimited Communications), the association of Cards with any traffic rerouting solution, except with the express agreement of Orange Business Services, the uninterrupted use of the package by means in particular of automatic and continuous dialing of numbers on the Line, sending of mass SMS messages in an automated manner or not. In the event of non-compliance with reasonable behavior relating to unlimited voice communications, Orange Business Services reserves the right to suspend the Service. In the event of fraudulent use, except for the exception specified in the paragraph below, Orange Business Services reserves the right to suspend the Service and then terminate the Order concerned in accordance with the provisions hereof. In the event of use of Unlimited Communications for commercial purposes (in particular resale of Unlimited Communications), Orange Business Services will terminate the Order concerned automatically and without notice.

Bouygues

Article 9.3

• "Furthermore, concerning unlimited communications offers, the Customer shall refrain from any fraudulent use such as in particular: the use of unlimited communications for commercial purposes (resale of communications), the use of "voice" offers or services for data usage purposes, in particular for the needs of Machine to Machine type applications."

Article 7.6

• "Without prejudice to the application of the preceding provisions, more specifically with regard to SIM cards, the Customer shall refrain from any use with a radio connection box or with any other technical solution intended to modify the routing of the Service and/or optional services."

SFR

Article 3

• "The Subscriber is solely responsible for the use and storage of the SIM card, and shall not duplicate it. The SIM card may not be used by the Subscriber to offer a commercial offer to a third party. More generally, the Subscriber shall not make any commercial use of the access to the SFR network made available to him, in particular by allowing third parties to access the SFR network in return for compensation, particularly financial. The SIM card may not be used by the Subscriber, by a telecommunications network operator or by a telecommunications service provider, for the purpose of modifying the routing of a telecommunications service on a public telecommunications network. In particular, it may not be used in radio boxes, either for transmission or reception. Any fraudulent use of the SIM card, or use contrary to these conditions, shall incur the personal liability of the Subscriber."

Obligations of a WiFi operator

Providing WiFi access to the public must be done in compliance with the regulatory framework in force in France.

The collection and storage of technical data for one year.

The law of January 2006¹ introduces into the French Postal and Telecommunications Code² provisions that require electronic communications operators to retain certain technical data concerning their users for a period of one year. Indeed, the new obligations must allow the authorities to have sufficient evidence in the event of a search for evidence in the context of preventing acts of terrorism.

This obligation obviously concerns WiFi³ operators.

Categories of information that must be retained:

• Information allowing toidentify the user
• Data relating to communication terminal equipment used
• technical characteristics as well as the data, the schedule, the longer term,, and the lieu of each communication
• Data relating to additional services requested or used and their suppliers
• The data allowing toidentify the recipient(s) of the communication

Operators are not required to create user-specific files: Organizations providing a WiFi connection may choose to offer this service without identifying individuals. They are then only required to hold the technical data created by the use of their services. Operators must only keep technical data. They must not keep information relating to the content of communications: the text of an SMS, the subject and content of an email, etc.

 

The National Commission for the Control of Security Interceptions (CNCIS) may at any time carry out checks relating to technical communications operations. Failure to comply with this law is punishable by criminal penalties: up to 5 years of imprisonment and a fine of 300.000 euros.

THE REGULATION ¹ Law No. 2006-64 of 23 January 2006 on the fight against terrorism and covering various provisions relating to security and border controls. “In order to prevent acts of terrorism, agents of the police and national gendarmerie services may require operators to communicate the data stored and processed by the latter.” ² Articles L34-1 and L34-1-1 of the French Postal and Electronic Communications Code “Persons who, as part of a principal or secondary professional activity, offer the public a connection enabling online communication via network access, including free of charge, are subject to compliance with the provisions applicable to electronic communications operators.” ³ Opinion No. 2005-0918 of October 13, 2005 on the draft law relating to the fight against terrorism.

Compliance with wave emission standards

In order to prevent any risk related to WiFi waves on public health, the Electronic Communications and Postal Regulatory Authority (ARCEP) has set the conditions for the emission of electromagnetic waves emitted by WiFi terminals. These conditions were taken up by decree no. 2002-775 of May 3, 2002, which legislated on the frequency and power of waves emitted by WiFi terminals.

Frequency:

The lower the frequency of a wave, the more likely it is to penetrate matter and therefore have an impact on exposed individuals. ARCEP has set the level of electromagnetic fields produced by public WiFi networks at 2540 MHz.

For comparison, FM radio and mobile telephony (GSM) both use much lower, and therefore more harmful, frequencies with frequencies between 87,5 and 108 MHz on the one hand and between 900 and 1900 MHz on the other respectively.

The power :

LARCEP has set the power of waves emitted from a WiFi terminal at a maximum limit of 0,1 Watt, i.e. a power 20 times lower than that of mobile phones (2 Watts). The distance between the transmitter and the individual significantly reduces the power of the waves. Indeed, at a distance of 20 centimeters from the WiFi terminal, the energy of the waves is already divided by two and beyond 50 centimeters it is even divided by ten.

EXPERT OPINION

The Health and Radiofrequencies Foundation concluded, during a scientific meeting organized in October 2007, that "the studies conducted to date have not identified any impact of radiofrequencies on health below the legal power limits." The French Agency for Environmental and Occupational Health Safety (AFSSET), which serves as a reference in terms of health advice on the impact of radiofrequencies, has given the same opinion on WiFi. In its report on Mobile Telephony dated April 2005, ARSSET concluded as follows: "exposure to WiFi is always in the far field (at least 50 cm) and the transmission power is low. With regard to WiFi technology, the very low powers involved, as well as the high frequencies, imply much lower exposure compared to that of traditional mobile telephony."

Failure to comply with WiFi emissions standards is punishable by criminal penalties: up to 6 months' imprisonment and a fine of €190.

 

Respect for users' individual freedoms

Personal data must be collected fairly and must be used for specific, explicit and legitimate purposes.

The collection of personal data must first have received the consent of the person concerned and these must be freely consultable and modifiable. Only the collection and processing of technical data defined in article L.34-1 of the French Postal and Electronic Communications Code (see page 6) are exceptions to the rule of prior agreement. Apart from these technical data, the Data Protection Act applies to the collection and processing of all personal data.

Failure to comply with the Data Protection Act is punishable by criminal penalties: up to 5 years' imprisonment and a fine of €300.

THE REGULATION Law of January 6, 1978 on Information Technology and Civil Liberties: “Information technology must not infringe on human identity, human rights, privacy, or individual or public freedoms.”

SPECIFIC REGULATIONS FOR VEHICLES

ECE R10 standard

On-board equipment must meet electromagnetic compatibility standards. Directive 95/54 EC introduces the following concepts:

• functions related to the "direct control" of the vehicle, by which we mean all functions that can act: by degradation or change in the engine, gear change, braking, suspension, etc., likely to affect the driver's position, for example: the memory seat, the positioning of the steering wheel, likely to affect the driver's visibility such as the parts linked to the windshield wipers.
• functions related to the driver and his passengers, to other road users: example: airbag
• functions likely to create confusion for the driver or other road users: optical disturbances (e.g.: flashing lights, brake lights, false information from indicator lights), significant acoustic disturbances (e.g.: alarm, horn)
• functions related to the operation of data buses: blocking of data transmission
• special functions such as odometer, tachograph

ECE R 118 standard

Relating to the fire behavior of certain categories of motor vehicles. This is the wire between the external antenna and the WiFi box, which must be fire resistant according to the standard.

The commitments of a responsible internet service provider:

WIIBUS guarantees you an on-board WiFi service in full compliance with current regulations and its developments.

• The necessary technical data are collected, stored and processed on secure platforms and systematically transmitted to the authorities as part of legal requisitions.
• Respect for individual freedoms is guaranteed and no personal data is collected or used without the prior consent of the person concerned.
• All installations comply with the standards issued by ARCEP on the frequency and power of electromagnetic wave emissions. Trust WIIBUS, it is the assurance of a WiFi service that complies with regulations