On June 5, 2023, about fifteen people were raided and arrested in France, accused of participating in the December 2022 sabotage of a factory of the French industrial company Lafarge[1]. The sabotage, which took place during the day and involved between 100 and 200 people[2], caused around 6 million euros of damage.
On June 20, 2023, about eighteen more people were raided and arrested in France, some of them in connection with the Lafarge sabotage[3].
Techniques used
| Name | Description | |
|---|---|---|
| Forensics | ||
| DNA | In one of the initial raids, police insisted that those arrested wear surgical masks to protect against Covid: the masks were later taken for DNA collection[4]. One person who refused to wear a mask had their underwear confiscated while in police custody, presumably for DNA collection[5]. | |
| House raid | Among the initial house raids, one was particularly thorough: cops searched under mattresses, behind sofa covers and in every drawer of every piece of furniture, inspected every book, notebook and piece of clothing as well as the dishes, and emptied packages of pasta and sealed jars[1]. | |
| Mass surveillance | ||
| Video surveillance | Immediately after the action, investigators requested CCTV footage from public transportation (buses, train stations, etc.), businesses, home surveillance systems, and municipal cameras, all within an extended perimeter of the action site[5]. In particular, footage of the interiors of buses appears to have helped identify people traveling to and from the action site[4]. Investigators also requested footage from highway toll booths, presumably to identify the occupants of known cars traveling on highways to or from the action site. | |
| Open-source intelligence | Investigators collected metadata from photos of the action posted online, including the name and serial number of a camera[5]. This helped them identify a person they accused of taking the photos. | |
| Service provider collaboration | ||
| Other | Investigators gave the serial number of a camera to the camera manufacturer, and the manufacturer gave them the name of the store where the camera was sold[5]. This helped investigators identify a person they accused of taking photos with the camera. | |
| Targeted digital surveillance | ||
| Authentication bypass | Investigators seized several encrypted smartphones in the raids and attempted to access their encrypted data, with varying results depending on the phone[5]:
| |
| Malware | Investigators made five requests to remotely install spyware[5]. Of these, one installation was successful (on an iPhone SE 2020) and provided access to a Signal group conversation. | |