France and Cyber security

New destructive practices are developing in cyber space, including criminal use of the Internet (cyber crime), including for terrorist purposes; large-scale propagation of false information and manipulation; espionage for political or economic ends; and attacks on critical infrastructure (transport, energy, communication, etc.) for the purposes of sabotage.

Coming from State or non-State groups, these cyber attacks:

  • Know no border or distance;
  • Are difficult to trace: it is very hard to formally identify the true culprits, who are often acting under the cover of unwitting relays (botnets) or proxies;
  • Can be carried out with relative ease, with little cost or risk for the attacker. They aim to jeopardize the smooth functioning of communication and information systems (CIS) used by citizens, businesses and administrations, and even the physical integrity of infrastructure that is crucial to national security.

Cyber security covers the entirety of security measures that could be taken to defend against these attacks. The constant increase in the sophistication and intensity of cyber attacks in recent years has led most developed countries to toughen their resilience and adopt national cyber security strategies.

A robust national initiative being ramped up

France adopted a national cyber security strategy in 2015. This Strategy aims to accompany French society’s digital transition and address the new challenges of changing uses of digital technology and the associated threats: It focuses on five goals:

  • Guaranteeing national sovereignty,
  • Providing a strong response to acts of cyber crime,
  • Informing the public,
  • Making digital security a competitive advantage for French businesses,
  • Enhancing France’s voice on the international stage.

This strategy has since been supplemented by:

  • France’s international digital strategy
    The strategy was presented by the Minister for Europe and Foreign Affairs in December 2017. It compiles all the strategic goals France promotes in the digital field around the three pillars of governance, the economy and security.
  • Strategic Review of Cyber Defence (in French)
    The Strategic Review of Cyber Defence was entrusted to the General Secretariat for Defence and National Security (SGDSN) by the Prime Minister and presented in February 2018. It sets out a doctrine to manage cyber crises. This review clarifies the goals of a national cyber defence strategy and confirms the relevance of the French model and the primary responsibility of the government in this field.

Many players contribute to the efficacy of this French approach from technical and operational standpoints.

  • The French Network and Information Security Agency (ANSSI) was created in 2009 and is the national cyber security authority. Acting as a genuine “first responder” in French cyber space, ANSSI is responsible for preventing (including from a normative perspective) and reacting to IT incidents affecting sensitive institutions. It also organizes crisis exercises on a national level. ANSSI currently employs 600 people and continues to grow.
    Lien vers l’ANSSI
  • The French Ministry for the Armed Forces has a two-fold mission to ensure the protection of the networks underpinning its action and integrating digital warfare into military operations. In order to consolidate the Ministry’s work in this field, a cyber defence operational chain of command (COMCYBER), under the orders of the Armed Forces Chief of Staff, was created in early 2017.
  • The role of France’s Ministry of the Interior is to combat all forms of cyber crime against national institutions and interests, economic stakeholders and government authorities, and individuals. It draws on specialized central services and the local networks of the national police, national gendarmerie and internal security forces. These forces are responsible for investigations aimed at identifying and prosecuting cyber criminals. They also contribute to prevention and outreach work with relevant audiences.

Stability and international security in cyber space

Enhancing strategic stability and international security in cyber space is a French priority. The Ministry for Europe and Foreign Affairs coordinates France’s work on “cyber diplomacy”. This work is carried out in a European and international framework.

Guaranteeing European strategic digital autonomy

Within the European Union, France defends an ambitious vision and the concept of the “EU’s digital single market”, a key aspect of our collective capacity for initiative and action. This mission is three-fold:

  • Technological aspect
    The European Union’s industrial policy supports cutting-edge research and development in order to foster the deployment of secure digital technologies and services. It must be possible to assess the reliability of these services. Ensuring the security of all digital components will also help give a competitive advantage to European products and services.
  • Regulatory aspect
    The European Union’s external policy needs to set down regulations taking into account the competitiveness needs and potential of digital technology while continuing to protect citizens, businesses and Member States in accordance with our common values such as the right to privacy and protection of personal data, and the protection of critical infrastructure.
  • Capacity aspect
    The European Union has an essential role to play in promoting and supporting the development of the cyber defence capabilities of public and private entities within the Member States and EU institutions themselves, drawing on European expertise. It can also provide support in the fields of training and instruction, creating synergies and avoiding duplication of capabilities.

Above and beyond these dimensions, operational cooperation needs to be stepped up between EU Member States. The aim is to establish pan-European tools to share technical information on threats, supporting preparation and rapid response in the event of cyber attacks. The creation in 2017 of the EU Cyber Diplomacy Toolbox (CDT) to combat cyber attacks is a full-fledged aspect of this cooperation.

Mobilizing the international community through the Paris Call

The Paris Call for Trust and Security in Cyberspace demonstrates France’s active role in promoting a safe, stable and open cyber space. This high-level political declaration marks renewed commitment to the fundamental issue of stability in cyber space. The Paris Call was presented at the Paris Peace Forum on 12 November 2018 and was promoted by the French President at UNESCO before the Internet Governance Forum. It shows France’s ability to widely support its vision for cyber space regulation.

The text was supported by more than 500 entities including States and businesses. It recalls fundamental principles, such as the applicability of international law and human rights to cyber space, and mentions a number of principles such as responsible behaviour of States, the State monopoly on legitimate violence, and acknowledgement of the specific responsibilities of private stakeholders, that are part of France’s vision for a safe cyber space.

The inclusive approach of the Paris Call highlights the need for a multi-stakeholder approach to drawing up standards and best practices in order to reliably and securely enjoy the opportunities offered by the digital revolution. France intends to review, with its foreign government partners but also the private sector and civil society, the role and specific responsibilities of private stakeholders in strengthening the stability and international security of cyber space.

Promoting the stability of cyber space in international forums

Within the UN, where the rules of responsible behaviour in cyber space are discussed, France has taken part in the last five meetings of the Group of Governmental Experts (GGE) on cyber security, the work of which has helped put cyber space on the agenda of the international based on the Charter of the United Nations and to guide governments with a view to prevention, cooperation and non-proliferation in cyber space.

France is active in other international forums where cyber security issues are tackled, including:

  • Within NATO, France instigated the adoption by the 28 Nations of a Cyber Defence Pledge during the Warsaw Summit in June 2016. This pledge recognized cyber space as a field of operations and now commits NATO to defending itself in cyber space as it does in the land, air and maritime fields. In May 2018, France hosted the first ever Cyber Defence Pledge Conference.
  • At the G7, the Ise-Shima Cyber Group was created in 2016 and helped achieve the adoption of a “G7 Declaration on Responsible States Behavior in Cyberspace” in 2017. Under its 2019 G7 Presidency, France will put forward proposals to promote compliance.
  • At the OSCE, which has established itself as a key regional forum for defining and implementing confidence-building measures for cyber space, France continues to promote an ambitious agenda for the effectiveness of these measures to enhance transparency, cooperation and confidence between the Organization’s member countries.

Updated: January 2019