Bure criminal association case

Investigators installed a covert location tracker on a vehicle, where it remained for about a month^[3].

Traces of accelerants were collected from items recovered after demonstrations and analyzed^[3].

Investigators analyzed storage devices by automatically extracting files containing the following keywords relevant to the investigation^[3]:

• “Action”.
• “Andra”, the agency responsible for the Cigéo project.
• “Bindeuil”, the name of the building that was attacked during the June 21, 2017 demonstration.
• “Hibou” (“owl”), a name used by people fighting against Cigéo to refer to themselves.
• “Incendie” (“fire”).

DNA traces were collected from^[3]:

• Items recovered after demonstrations, including fireworks, Molotov cocktails, a lighter, and rocks used to break windows.
• Items found during raids, including clothing, gas masks, helmets, and containers filled with gasoline or other substances.

Investigators were unable to match the vast majority of the DNA traces they collected to anyone. Notable exceptions were:

• A DNA trace from a Molotov cocktail found in a raid matched an individual in the national DNA database.
• A DNA trace from the lid of a jar containing materials that could be used to build explosive devices, found in a raid, matched an individual in the national DNA database.
• A DNA trace from a lighter recovered after a demonstration matched another trace from an earlier, unrelated case, but did not match anyone in the national DNA database.

Fingerprints were collected from items found during raids, including a notebook, sheets of paper, gas masks, helmets, Molotov cocktails, and containers filled with gasoline or other substances. The vast majority of the fingerprints collected did not match anyone. Some of the fingerprints collected matched individuals in the national fingerprint database^[3].

Investigators extensively used police files to establish links between people, including databases of driver's licenses and registered vehicles, as well as records of arrests, judicial proceedings and convictions^[3].

Investigators used footage from the demonstrations, recorded by surveillance cameras and police forces, to^[3]:

• Identify a person who was only partially masked, with their eyes, glasses, and forehead visible.
• Match a person who looked pregnant based on their belly, seen in a demonstration, to a person who gave birth a few months later.

Investigators^[3]:

• Followed one of the people who were arrested for a few hours on one occasion, and for a few minutes on another, to find out where they lived.
• Spent several days conducting static surveillance on a place associated with the struggle against Cigéo (a few isolated buildings surrounded by fields). For up to 16 hours a day they took notes and pictures of people and vehicles entering and leaving the location.

Investigators used the collaboration of mobile network operators to^[3]:

• Establish links between people.
• Geolocate phones in real time.
• Record a large number of phone conversations, including conversations that took place between the moment a call was placed and the moment it was answered (i.e., while the phone was ringing).
• Identify the phone numbers that were active around Bure during three demonstrations that took place there in February, June, and August 2017, including 55 numbers that were active during all three demonstrations.

Investigators used the collaboration of banks to obtain the bank records of organizations fighting against Cigéo^[3]. The bank records of one organization included a 500€ transfer entitled “participation manif 18 fev” (“contribution to the February 18 demonstration”), in reference to a demonstration in which people attacked a building associated with Cigéo.

The owner of a supermarket in a town about 20 km from Bure told investigators that he had seen customers buying an unusually large amount of denatured alcohol (15 liters), and gave the receipt to the investigators.

Investigators bypassed the authentication of five encrypted storage devices found in raids^[3]:

• One hard drive by using the very simple password “stopcigeo”, which they presumably guessed.
• One hard drive by using a password they found on a post-it note under the computer containing the hard drive.
• One hard drive by using a password given to them in custody by the owner of the computer containing the hard drive.
• Two hard drives by using passwords they found in a text document on a previously decrypted hard drive.

Investigators used IMSI-catchers to identify the phone numbers of people who lived in places associated with the struggle against Cigéo or who participated in demonstrations^[3].