“We must take back the initiative on the ground.” Faced with the multiple hacks which have hit French administrations, in particular the General Directorate of Public Finances (DGFiP) and the Ministry of National Education, Sébastien Lecornu called, Wednesday August 19, for the creation of a "new unit" to fight against cyberattacks targeting the "State information system".
In a letter addressed to the Secretary General of Defense and National Security, consulted by franceinfo, the Prime Minister requests the creation of "a contact team made up of agents from Anssi [the National Agency for Information Systems Security]", which will be "responsible for intervening on the front line, in the event of suspicion of a serious attack on the integrity of the State information system".
A team that “already exists” within Anssi
According to his letter, Sébastien Lecornu wants this new team to be “engaged in advance of potential crises, as soon as sensitive access is violated” to State systems, “during the crisis and afterward”. She would intervene directly on site, “alongside teams from the targeted ministry”. “This team already exists, it’s called Cert-FR!”, replies Vendée MP Philippe Latombe (Les Démocrates).
Within the Anssi operations sub-directorate, there is indeed a “Computer emergency response team” or Cert in English. “These agents are a bit like firefighters, who can be sent on site or act remotely, to establish a diagnosis and provide the first actions in the event of an attack,” a source familiar with the operation of the agency explains to franceinfo.
Anssi has already intervened directly within ministries or certain companies, in particular those labeled “operators of vital importance” by the State. Thus, “for three months in 2011, she intervened in Bercy (yes!) to remedy an intrusion for espionage purposes”, recalls on LinkedIn Christian Daviot, special advisor to the director general of Anssi between 2009 and 2020.
Similar interventions were triggered during the cyberattack against TV5 Monde in 2015, or from the Ministry of Foreign Affairs service Ariane in 2018, underline experts interviewed by franceinfo. “Sébastien Lecornu's proposal is therefore a misunderstanding of Anssi, because this is its primary role,” summarizes an analyst within a French private Cert. Contacted by franceinfo, the agency did not wish to comment on the creation of a new entity.
“We risk adding to the confusion”
The contours of the new brigade wanted by Sébastien Lecornu remain unclear. “We are all curious to know what form it will take,” says an expert within an independent French cybersecurity group. "Will the unit be integrated into Anssi? In the same sub-directorate as the Cert-FR, or outside? With what coordination? Will it be made up of Anssi agents who were already carrying out these missions, at the risk of undressing Paul to dress Jacques?", he asks.
Observers still note some new features, already required by the Prime Minister. The unit can thus be “reinforced occasionally by agents from the specialized service teams of the Ministry of the Armed Forces and Veterans and the Ministry of the Interior”, and must “allow the integration of reservists”, writes Sébastien Lecornu. “There is reason to mobilize civilian reservists who have chosen to enlist,” believes Jean-Michel Mis, vice-president of the Cybersecurity and digital sovereignty study group of the National Assembly from 2018 to 2022, now president of the influence firm Via Publica.
“We must use [the reservists] wisely: in the event of a crisis, I prefer that we call on agents trained for these missions and who make it their daily life.”
Jean-Michel Mis, president of the influence firm Via Publica
at franceinfo
The Prime Minister also affirms that this unit “will systematically send him an after-action analysis, in order to learn all the lessons from these attacks”. “Apparently, he considers that the current operational chain does not produce the expected effects in terms of reaction speed or quality of response to an incident,” analyzes the expert from an independent cybersecurity group for franceinfo.
Some, however, point out a risk: further increasing the complexity of the multitude of structures responsible for part of public cybersecurity. Each ministry already has its own Cert (or an equivalent called CSIRT). There are also territorial or sectoral CSIRTs, the Cyber Defense Command (Comcyber), the Cyber Crisis Coordination Center (C4)… Not to mention the investigation services on the police and gendarmerie side. “By creating a new unit, we risk adding confusion and needing an additional layer of coordination,” warns the expert from an independent cybersecurity group.
More resources and more protections
The political dimension of this announcement does not escape observers. According to Sébastien Lecornu's letter, the Secretary General of Defense and National Security must submit to the Prime Minister "a proposal for the organization and rules of engagement of this new cyber unit, as well as the resources allocated to it and the leader [who will be designated] at its head". The deadline was Friday August 21. “Three days to submit such an opinion is extremely short,” underlines former Loire MP (LREM) Jean-Michel Mis.
“The Prime Minister wanted to show that he reacted immediately, to avoid having to manage the cyber file in addition to the 2027 budget when parliamentary work resumes.”
Jean-Michel Mis, president of the influence firm Via Publica
at franceinfo
For the experts interviewed, this "new unit" is however not sufficient to resolve IT security problems in France. Many of them are instead calling for an increase in Anssi's budget – which in 2025 will have an envelope of 44.2 million euros and around 650 agents, according to its annual report. “We are asking a team to monitor the whole of France, with much fewer resources than the majority of companies that depend on it,” criticizes an analyst within a private Cert. “The cybersecurity job market is extremely competitive, and public sector salaries are not necessarily at the level to attract and retain talent in the long term,” adds Jean-Michel Mis.
Ahead of cyberattacks, "we need more protections: imposing the generalization of multi-factor authentication, the rapid change of leaked identifiers... Otherwise, we will seek to fill a leaky bathtub", recommends an expert within an independent French cybersecurity group. And downstream, "we should test the defenses of public systems constantly, with audits in real conditions, transparent conclusions and fines for entities that are not up to standard", demands the analyst from a private Cert.
“Anssi must be reinforced in its role”
“Anssi can recommend cybersecurity measures to a ministry, but in the end, it is this ministry which decides, and which will also arbitrate according to budgets or other factors”, describes a source familiar with the functioning of this administration. The agency "must be reinforced in its role, be able to impose sanctions and replace a failing authority", adds Jean-Michel Mis. “The gendarme must have a whistle and a revolver.”
The sector is unanimous on another point: it is necessary to transpose into French law the European directive NIS 2, which reinforces the obligations in terms of cybersecurity (protection, training, incident reporting, etc.) for many public and private entities, under penalty of financial sanctions. The text was adopted at European level in 2024, but is currently lost in the limbo of the parliamentary shuttle – to the point that the European Commission has taken legal action in the face of France's slowness.
