France’s Protests Reveal Europe’s Expanding Surveillance of Dissent

In 1909, Barcelona appeared to be ablaze. Anarchists set fire to churches, convents, and monuments in revolt against Madrid's war in Melilla, and the journalist Antonio Loredo, watching from a window in Gràcia, gave the burning metropolis a name in the Argentine newspaper La Protesta: La Rosa de Foc, the rose of fire. The Rosa de Foc became shorthand for a Catalan capacity for revolt, and for the state's habit of answering revolt with brute force.

In October 2026, the Rosa de Foc returned to European streets, this time in France, where protestors have utilized the same tactics as their predecessors to the south. Students and yellow vests in France blockaded lycées, roundabouts, and refineries, with a refrain similar to Barcelona’s Setmana Trágica: rights, education, and a future for their young.

At the same time, the French government uses modern tools to surveil these disruptions, including spyware placed on organizers’ phones, app takedowns, and algorithmic cameras that scan crowds for potential “violent events.” These new algorithmic tools force us to question what remains of our democracies: how violence is determined, and where disruptive dissent belongs in the future of protest in the technological surveillance state.

When disruption becomes violence

In October 2019, a new social group, Tsunami Democràtic, brought that question to Catalonia’s streets. Spain's Supreme Court had sentenced nine Catalan leaders to between nine and 13 years in prison, and a movement called Tsunami Democràtic mobilized within hours, shutting down El Prat airport, blocking the AP-7 highway at the French border for 30 hours, and setting dinner tables across the asphalt at La Jonquera. The protest was organized through Telegram, Instagram, and a custom app that sent protest coordinates to its users' phones. Its manifesto explicitly committed participants to nonviolence: "We are predisposed to accept suffering rather than inflict it. We will not respond violently if we are attacked."

The state responded by recasting the movement as a security threat. The Guardia Civil asked GitHub to block the app, describing Tsunami as "a criminal organization that promotes terrorist attacks," and GitHub removed the download after the takedown order. Citizen Lab later documented at least 65 people connected to the independence movement targeted with Pegasus and Candiru spyware, among them lawyers, civil society leaders, and developers of digital voting tools. A terrorism investigation into Tsunami ran for nearly five years before it collapsed on a procedural ruling in July 2024. By then, the movement had been surveilled, deplatformed, and labeled terrorist, and it had never been convicted of anything. And yet, the organizers of the movement promised “Ho tornarem a fer,” or “we will do it again,” a call to exercise the right to protest even in the face of legal challenges.

The Catalan case brings us back to the age-old conversation around nonviolence. In his 1921 essay “Critique of Violence,” Walter Benjamin warned that nonviolent resolution may never fully succeed in changing the law, because the law rests on the state’s power to carry out and enforce violence. Arendt furthered this argument, claiming that violence can destroy power, but never fully create it. When the state reaches for a rubber bullet or a water hose, the means start to swallow the ends they were supposed to achieve. Judith Butler’s more recent Force of Nonviolence furthers this idea, locating the strength of nonviolence in its refusal to accept the frames that decide whose lives are important enough to mourn.

The Slovenian philosopher Slavoj Žižek brings this conversation into 2026. Subjective violence, like a burning dumpster, is easy to see with the plain eye. However, the system violence of the state typically stays invisible, and that invisibility is precisely what makes a burning dumpster look like a riot.

Tsunami’s organizers built theories of nonviolence into their infrastructure, not only in their doctrine, but in their organizing platform architecture – their app only activated when an existing member scanned a QR code, after which it sorted participants into small local cells, and released each action’s location shortly before it began, similar to miniVAN utilized for canvassing in the United States. This hyperlocal and real-time structure allowed for trusted communities to organize for disruption rather than planned violence. And yet, the movement was still met with force from the Spanish state and the Mossos d’Esquadra, Catalonia’s own regional force. It was also met with a subtler violence that tracked them on the same network their apps were hosted upon – a new surveillance system, first coined by Shoshana Zuboff, with the capacity to know and shape behavior by rendering human experiences as data. While Tsunami lived on Telegram, Instagram, and GitHub, this did not exclude them from state apparatuses focused on extracting, storing, and tracking their data as movements.

France’s protest map

This fall, a new wave of unrest brought the same tensions into focus in France. The student movement began September 21 outside a lycée in Créteil, where demonstrators protested teacher shortages, deteriorating school buildings and the pressures of Parcoursup, the algorithmic platform used to allocate higher education places.

By October 1, the Interior Ministry counted 1,027 lycées affected and 222 blockaded. On October 17, the yellow vests joined the students, and the ministry counted 550,000 people across 110 marches, a mobilization which ran on a crowdsourced map. Visitors pinned roundabouts, toll booths, refineries, fuel depots, train stations, and schools. The map asked for no name or address, routed volunteers to a Telegram channel, and promised to delete every listed action after December 31. By the morning of the protest, it listed nearly 1,300 actions. It did for France what Tsunami's app did for Catalonia, caching no accounts, no identities, and packaged with an expiration date. However, public maps are legible to everyone, including the state – so each pin that told a volunteer where to go also informed the police.

Quickly, the day turned violent. Masked protesters set a fire that largely destroyed the 140-year-old town hall in Limoges, and Prime Minister Sébastien Lecornu reported 1,200 arrests and 150 injured police officers – arrests have since reportedly reached 6,000. Amnesty International called the use of force against the student movement disproportionate. The government, for its part, attributed the movement to an operation by the far-left party La France Insoumise and its proxies, a familiar move that recasts a mass mobilization as a manipulation. Internationally, leaders were quick to frame the protests as an anomaly and a warning to the far-left, in advance of elections in the United States.

In August, France enacted the Ripost law, which extends the country's experiment with algorithmic video surveillance through the end of 2030 and widens the places where it can run. The Constitutional Council upheld it, noting that the system excludes facial recognition, as per the EU AI Act’s prohibited practices. Instead, the system detects predetermined "events" in crowds, and the state decides which events are violent.

However, this predetermination was only selective on paper, because in March 2026, the investigative outlet Disclose revealed that police and gendarmes had been using facial recognition software on their NEO work phones since at least 2022, which matched faces photographed during identity checks to the TAJ criminal records database, which holds up to 9 million frontal portraits. Among those scanned was a protester stopped as he left a gathering at Place de la République. In July, a second Disclose investigation found that the practice continued daily, months after the interior minister declared it banned. Officers’ own testimony indicated that it fell hardest on young people from working-class neighborhoods, people perceived as foreign or as visible minorities, and environmental and left-wing activists. The EU AI Act may restrict biometric identification in public space, but the phones in gendarmes’ pockets tell another story.

A European shift

France is one front of a wider shift. On the same day, protests over wages, rents, and education spread to Italy, Belgium, Portugal, Spain, and Albania. Italian Prime Minister Giorgia Meloni urged the country that no one has a right to set cities ablaze. Portugal's parliamentary affairs minister said the government "will not yield to shouts from the street."

Europe’s legal groundwork is shifting in ways that narrow the space for disruptive protest. Italy's 2025 security decree criminalized passive protest such as blocking a road with one's body, offenses the Council of Europe's human rights commissioner warned were "defined in vague terms." The United Kingdom proscribed the direct-action group Palestine Action under terrorism law in July 2025, and police then arrested dozens of people for holding signs in its support. Tsunami's dinner tables at La Jonquera would now be considered a crime in Italy, and its app would also become evidence in prosecution.

The pattern is not that every protest is nonviolent, or that governments should ignore arson and assault. It is that states can use broad security classifications and technical systems to extend their response from violent acts to the movements, tools and people associated with disruption.

Can policy protect protest?

First, platforms that host protest-coordination tools should publish government removal requests and explain their decisions. Where legally permissible, they should require a court order before disabling tools used for lawful assembly.

Second, the European Union should treat spyware deployed against civil society, lawyers, and journalists as a violation of the fundamental rights the EU Charter guarantees, with independent forensic review and effective remedies available to anyone who suspects infection.

Third, algorithmic video surveillance should be barred from public demonstrations. France's Ripost law leaves the definition of a suspicious "event" to the state. At minimum, any permitted use must have a clear legal basis, independent oversight and meaningful avenues to challenge surveillance decisions.

Fourth, protest tools should practice data minimization by design. The yellow vests' map, which collects no names and deletes its records at year's end, offers a working model, though organizers must also assess the risks created by location data and messaging platforms.

When Picasso was asked by a German officer standing before Guernica, "Did you do this?", he is said to have replied, "No, you did this." European governments face a similar challenge. The fires are real, and violence must be addressed. But so is the infrastructure that determines which gatherings are suspicious, which organizers become targets and which forms of dissent are treated as threats.