How France Balances Fighting Foreign Disinformation (FIMI) & Protecting Democracy

Tackling disinformation, especially Foreign Information Manipulation and Interference (FIMI), aims to safeguard democratic institutions, processes and values. But is the fight against disinformation and the protection of democratic values necessarily mutually reinforcing objectives? Or can they clash? And if they do, how are democratic states striving to balance the two?

Securitization of disinformation in Europe

One risk to the protection of democratic values is the growing securitization of disinformation. This is particularly true in the European context, where Russia-sponsored FIMI is widely considered to be a significant and direct threat to the European Union’s democracy and security. FIMI has thus become a national security concern framed in terms of asymmetric information warfare. As a result, the vulnerability of European democracies is increasingly linked to structural transformations of the security order, which may legitimize ‘exceptional’ decision-making in order to ‘defend’ democracy.

Indeed, the securitizing logic is clearly visible in how the European Commission has labelled its recent initiatives aimed at safeguarding electoral processes in the EU. The Defence of Democracy package and the European Democracy Shield are important cases in point. Similarly, in its conclusions on democratic resilience, the Council highlighted how Russia’s war of aggression against Ukraine, as well as Russia’s instrumentalization of the conflict and use of hybrid tactics ‘further compound challenges faced by our democracies’, while ‘posing a growing threat to the security of the EU, its member states, and its partners’.

Risks posed by the Securitization Logic

The challenge has been recognized in the OECD report on tackling disinformation and strengthening information integrity. On the one hand, action is required to counteract the threat to democratic institutions and processes; but on the other hand, this action must not lead to greater information control in our democracies.

According to the Global Declaration on Information Integrity Online, risks include unduly restricting human rights online, especially the freedom of opinion and expression, under the guise of countering disinformation - including blocking or restricting access to online content, eroding privacy, and interfering with the ability of journalists, researchers or human rights activists to operate freely. Moreover, risks also concern restrictive measures imposed on VLOPs (very large online platforms) or the management of personal data, when identifying and analysing potential disinformation campaigns and the channels used by threat actors to spread disinformation.

Reconciling Countering FIMI and Protection of Democratic Values: The French Way

France provides a good example of how democratic states seek to reconcile countering FIMI and protecting democratic values. First, both French elections (foreign interference during the 2017 presidential election, or #MacronLeaks) and French international military posture (foreign information manipulation related to French army’s presence in Mali, or #affaireGossi) were major targets of Russia-sponsored FIMI attacks. Second, among EU member states, France exemplifies the highest levels of institutionalization in the national coordination system aimed at countering FIMI. It features a centralized model with a government-level coordination mechanism, and a specialized agency focused solely on countering FIMI - VIGINUM (fr. Service de vigilance et protection contre les ingérences numériques étrangères).

Legislation on Combating Information Manipulation in France

Two days before the second round of the French presidential election in May 2017 a hack-and-leak operation was launched in an attempt to undermine Emmanuel Macron’s candidacy. The hack targeted computers belonging to Macron’s campaign staff and leaked 15 GB of stolen data, including over 20 thousand emails, which were mixed with fake news and forged documents. The leak was disseminated on Twitter (now X) through a coordinated effort involving both trolls and bots with the hashtag #MacronLeaks appearing in almost half a million tweets within 24 hours. The interference failed, insofar as Macron won the election with over 66% of the vote.

Adoption of the Law on Combating Information Manipulation was a direct result of this interference. The law stipulated that media outlets owned or controlled by foreign states can be suspended within the three months leading to an election, if the false news is obvious, widely and artificially disseminated, and likely to disturb the public order or election integrity. The law also introduced a fast-track judicial procedure to remove false information during this three-month period. Yet the law proved highly controversial and was rejected twice by the French Senate. Concerns related to both the ‘effectiveness of the proposed provisions’ when it comes to tackling foreign interference in the electoral process, and the “risks of disproportionate constraints on freedom of speech”. These controversies continued to exert a marked cooling effect well into the year 2021 when the mandate of the VIGINUM agency was being established. The concern was that VIGINUM could be easily de-legitimized politically as a ‘ministry of truth’ aimed at getting president Macron re-elected in 2022.

French State Agency Dealing with Foreign Digital Interference

When VIGINUM was created the government’s goal was to avoid political backlash and the de-legitimation of the agency as a tool for restricting citizens’ rights and censoring opposition. To avoid such a risk, clear criteria were developed to distinguish domestic information manipulation and interference (DIMI) from foreign information manipulation and interference (FIMI), while focusing exclusively on the latter and considerably narrowing its scope of monitoring. Accordingly, VIGINUM was only allowed to monitor and analyse FIMI related to the nation's fundamental interests, as defined by the French penal code - i.e., territorial integrity, security, and the republican form of government. The agency was restricted to using only open-source data, and was prohibited from interacting with other users, i.e., joining private groups or creating avatars. Its focus was solely on massive, purposeful, artificial, or automated dissemination of manifestly inaccurate or misleading content. An independent Ethical and Scientific Committee provided oversight.

Restrictions Related to Automated Processing of Personal Data

Once established, the agency needed tools to identify and analyse FIMI. The question of whether automated processing of personal data should be used to identify foreign digital interference led to another political controversy. According to the parliamentary Commission on Information and Liberties, a full legislative bill was necessary: data collection has considerable impact on citizens right to privacy and the protection of personal data, and could be allowed only if strictly necessary to achieve the intended aim, and if sufficient guarantees were provided to safeguard fundamental principles of data protection and privacy. However, the government bypassed parliament and proceeded with an executive decree.

In line with the decree, VIGINUM must obtain authorization for each FIMI campaign monitoring involving automated data collection, and then must delete the collected data within four months. To protect digital rights and civil liberties, manual monitoring must first assess whether automated content dissemination is occuring before automated data collection is authorized.. The mandate for automatic collection was very narrow, so much so that in 2023 the Ethical and Scientific Committee recommended expanding VIGINUM’s mandate to include monitoring of automatic content dissemination on smaller online platforms with fewer than five million users in France.

Striking the Right Balance?

Over the last three years VIGINUM revealed major FIMI operations conducted by Russia-related actors that targeted electoral processes, media (Doppelganger), as well as the Paris Olympic Games. The agency has consistently focused on massive artificial and automated content distribution (bots) to avoid accusations of censorship against freedom of speech (as with trolls). Similarly, VIGINUM works exclusively on FIMI - to prevent accusations of censoring opposition. Aware of both legal and political risks, the French government has adopted a cautious approach, while at the same time succeeding in creating a specialized agency to counter FIMI, serving as a model forEU member states. However, trade-offs persist, and discussion continues as to whether effectiveness of countering FIMI is hindered by too narrow a mandate or whether on the contrary, the securitization logic has weakened parliamentary oversight while further strengthening the executive’s claim to operate under exceptional circumstances.