Bure criminal association case

2017 - ?
Contents

Diagram of the organizations fighting against Cigéo and their members, made by investigators (personal information censored by the No Trace Project).

In 2017 and 2018, around 20 house raids took place in France and around 10 people were arrested and accused of various crimes related to the struggle against Cigéo, a project to build a radioactive waste disposal facility in Bure, France[1]. Some of the people were accused of organizing or participating in demonstrations in which people attacked police forces and buildings associated with Cigéo, including a demonstration on June 21, 2017, in which a small fire broke out in a building while civilians were inside. Some of the people were charged with possession of explosive materials. Some were accused of being part of an association de malfaiteurs (criminal association)[2].

After a trial in 2021 and an appeal in 2023, three people were given 4-month suspended sentences, and the others were acquitted.

Techniques used

NameDescription
Covert surveillance devices
Location

Investigators installed a covert location surveillance device on a vehicle, where it remained for about a month[3].

Detection dogs

Detection dogs were used in one of the raids[3].

Forensics
Arson

Traces of accelerants were collected from items recovered after demonstrations and analyzed[3].

Digital

Investigators analyzed storage devices by automatically extracting files containing the following keywords relevant to the investigation[3]:

  • Action”.
  • “Andra”, the agency responsible for the Cigéo project.
  • “Bindeuil”, the name of the building that was attacked during the June 21, 2017 demonstration.
  • Hibou” (“owl”), a name used by people fighting against Cigéo to refer to themselves.
  • Incendie” (“fire”).
DNA

DNA traces were collected from[3]:

  • Items recovered after demonstrations, including fireworks, Molotov cocktails, a lighter, and rocks used to break windows.
  • Items found during raids, including clothing, gas masks, helmets, and containers filled with gasoline or other substances.

Investigators were unable to match the vast majority of the DNA traces they collected to anyone. Notable exceptions were:

  • A DNA trace from a Molotov cocktail found in a raid matched an individual in the national DNA database.
  • A DNA trace from the lid of a jar containing materials that could be used to build explosive devices, found in a raid, matched an individual in the national DNA database.
  • A DNA trace from a lighter recovered after a demonstration matched another trace from an earlier, unrelated case, but did not match anyone in the national DNA database.
Fingerprints

Fingerprints were collected from items found during raids, including a notebook, sheets of paper, gas masks, helmets, Molotov cocktails, and containers filled with gasoline or other substances. The vast majority of the fingerprints collected did not match anyone. Some of the fingerprints collected matched individuals in the national fingerprint database[3].

House raid

During the raids, investigators found[3]:

  • Various items consistent with items used in demonstrations: containers filled with gasoline or other substances, fireworks, Molotov cocktails, and a large number of helmets.
  • A backpack containing both a written document with a person's name and materials that could be used to build incendiary or explosive devices.
  • An unencrypted computer containing both a person's resume and a document describing what happened during the June 21, 2017 demonstration.
  • Numerous reports of sensitive meetings containing people's names or pseudonyms, both on paper and on unencrypted storage devices.
International cooperation

Some of the people that were arrested had participated in demonstrations against the 2017 G20 summit in Hamburg, Germany[3]. Because of this, German investigators cooperated with French investigators, including by being present when the people were interrogated after their arrest.

Mass surveillance
Police files

Investigators extensively used police files to establish links between people, including databases of driver's licenses and registered vehicles, as well as records of arrests, judicial proceedings and convictions[3].

Video surveillance

Investigators used footage from the demonstrations, recorded by surveillance cameras and police forces, to[3]:

  • Identify a person who was only partially masked, with their eyes, glasses, and forehead visible.
  • Match a person who looked pregnant based on their belly, seen in a demonstration, to a person who gave birth a few months later.
Open-source intelligence

Investigators visited a Facebook page associated with the struggle against Cigéo and then analyzed the Facebook profiles of everyone who had “liked” the page[3].

Physical surveillance
Covert

Investigators[3]:

  • Followed one of the people who were arrested for a few hours on one occasion, and for a few minutes on another, to find out where they lived.
  • Spent several days conducting static surveillance on a place associated with the struggle against Cigéo (a few isolated buildings surrounded by fields). For up to 16 hours a day they took notes and pictures of people and vehicles entering and leaving the location.
Service provider collaboration
Mobile network operators

Investigators used the collaboration of mobile network operators to[3]:

  • Establish links between people.
  • Geo-locate phones in real time.
  • Record a large number of phone conversations, including conversations that took place between the moment a call was placed and the moment it was answered (i.e., while the phone was ringing).
  • Identify the phone numbers that were active around Bure during three demonstrations that took place there in February, June, and August 2017, including 55 numbers that were active during all three demonstrations.
Other

Investigators used the collaboration of banks to obtain the bank records of organizations fighting against Cigéo[3]. The bank records of one organization included a 500€ transfer entitled “participation manif 18 fev” (“contribution to the February 18 demonstration”), in reference to a demonstration in which people attacked a building associated with Cigéo.

The owner of a supermarket in a town about 20 km from Bure told investigators that he had seen customers buying an unusually large amount of denatured alcohol (15 liters), and gave the receipt to the investigators.

Targeted digital surveillance
Authentication bypass

Investigators bypassed the authentication of five encrypted storage devices found in raids[3]:

  • One hard drive by using the very simple password “stopcigeo”, which they presumably guessed.
  • One hard drive by using a password they found on a post-it note under the computer containing the hard drive.
  • One hard drive by using a password given to them in custody by the owner of the computer containing the hard drive.
  • Two hard drives by using passwords they found in a text document on a previously decrypted hard drive.
IMSI-catcher

Investigators used IMSI-catchers to identify the phone numbers of people who lived in places associated with the struggle against Cigéo or who participated in demonstrations[3].