December 8 case

2018 - ?
Contents

On December 8, 2020 several raids took place across the country and nine people were arrested[1]. One person among them, Libre Flot, was under surveillance by French intelligence services since 2018, when he came back to France after spending a few months in Rojava[2]. The other eight people didn't all know each other but all knew Libre Flot. After the arrests, seven people (including Libre Flot) were accused of being part of a terrorist association that was planning attacks against French institutions.

To identify the phone numbers used by some of the defendants, investigators analyzed correlations between different sets of data, obtained through[3]:

Some of the defendants spent time in pre-trial detention, with durations ranging from 4 to 16 months. Libre Flot was detained in isolation for 16 months.

In a 2023 trial[4]:

Techniques used

NameDescription
Biased interpretation of evidence

The case was characterized by a lack of evidence that the defendants were planning a specific attack, and relied instead on interpretation of circumstantial evidence. Examples of this interpretation include[5]:

  • Libre Flot gained combat experience in Rojava, which was interpreted as an attempt to gain experience in order to carry out attacks in France.
  • Libre Flot stole fertilizer from a store, intending to use it to create small explosives. The theft was interpreted as an attempt to obtain fertilizer without leaving traces.
  • On two occasions, some of the defendants created small explosives from household or agricultural products, and detonated them in isolated areas where the explosions would not damage anything, which was interpreted as tests for possible future attacks (despite the defendants' claims that they were just doing it for fun).
  • Some of the defendants participated in airsoft games, which were intepreted as paramilitary trainings.
  • Handwritten notes of one of the defendants contained terms and phrases such as “weapons”, “recruitment”, “cleaning DNA”, “incendiary device” and “are we ready for a comrade to be wounded or killed?”, which were interpreted as indicative that the defendant was preparing an attack in France (despite the defendant's claims that the notes were about either airsoft or Rojava).
  • In private conversations, some of the defendants made light-hearted, boasting comments such as “I want to burn all the banks, all the cops” and “if a police officer was on ground, honestly I would finish him off”, which were interpreted as indicative of violent intentions.
  • The defendants used secure digital communication tools, which was interpreted as indicative of “clandestine behavior”.
Covert surveillance devices
Audio

A hidden microphone was installed in the truck where Libre Flot lived[3]. When the legal authorization for installing and using the microphone expired after two months, the microphone was remotely deactivated but not removed from the truck. It was removed several months later during the raids.

Another hidden microphone was installed in a small cabin used by some of the defendants.

Location

A covert location tracker was installed on a vehicle used by Libre Flot[3].

Video

A camera was installed outside a small cabin used by some of the defendants, filming the cabin[3]. It was seemingly installed about 10 meters from the cabin, on a tree trunk.

Evidence fabrication

Investigators mistranscribed or distorted conversations obtained through phone interception or hidden microphones to make them look suspicious[5]. For example, the term “lunettes balistiques” (ballistic goggles) used in a conversation was transcribed as “gilets balistiques” (ballistic vests) by intelligence services, and became “gilets explosifs” (explosive vests) in a report by the prosecutors in charge of the case.

Forensics
Trace evidence

During the raids, several objects (a stove, pans, gloves, spatulas) were analyzed for traces of products that could be used to create explosives[5].

House raid

During the raids, investigators found firearms and products that could be used to create explosives[5].

Interrogation techniques

When interrogating defendants during custody, investigators[5]:

  • Pretended that the defendants would not be charged if they snitched on the other defendants, which was a lie.
  • Threatened one of the defendants with sexual assault.
Physical surveillance
Covert

For several weeks, investigators staked out the homes of some of the defendants and tailed them when they moved[3]. In particular:

  • When investigators staked out a defendant's home, they took pictures of anyone who entered or left the home. If the defendant left, they were followed either by the surveillance operators conducting the stakeout or by other operators so that the stakeout could continue. If the defendant left in a vehicle, they were followed in a vehicle.
  • In one case, a defendant was followed into a store, and the surveillance operator took note of the items the defendant purchased and took a picture of them in the store.
Service provider collaboration
Mobile network operators

Investigators used the collaboration of mobile network operators to geolocate the phones of the defendants and of people close to them in real time and to record unencrypted phone conversations[3]. In particular:

  • In one case, investigators could not determine the phone number used by one of the defendants, but had determined that the defendant often moved around with another person, so they geolocated the other person's phone in real time to locate the defendant.
  • In one case, investigators followed one of the defendants as part of a physical surveillance operation, but lost sight of them. In the following hour, they geolocated the defendant's phone in real time to locate them. As a result, one hour after losing sight of the defendant, investigators regained sight of them and resumed the physical surveillance operation.
Targeted digital surveillance
IMSI-catcher

Investigators used an IMSI-catcher during physical surveillance operations to identify the phone numbers used by some of the defendants[3].