France’s Military Cyber Strategy – Paris Adds Its Two Cents to Cyber Warfare

Earlier this year, France announced its new Military Cyber Strategy, which addresses both defensive cyber warfare and public elements for military cyber warfare. Collectively, these two pieces put forth France’s official position on offensive and defensive cyber warfare. What’s notable about this document is that it conveys perspectives on how the French military to operate in cyberspace, and more importantly, how the military will use offensive activities, particularly as a force multiplier in conflict. Such activities can include any combination of intelligence gathering, mitigating adversarial cyber capabilities, and deception operations.

The Military Cyber Strategy is the latest evolution of French thinking on how to operate and deter activities in cyberspace. In 2018, France published its Strategic Review of Cyber Defence, a national level strategy document that prioritizes France’s seven main principles when it come to cyber defense: protecting information systems; active defense and coordinated response; digital sovereignty; effective punishments for cyber crime; promote a culture of information security; help improve a digital Europe; help forge an international consensus on controlled governance of cyberspace. Similar philosophies are inherent in France’s 2008 White Paper on Defense and National Security.

France has long been considered a cyber-capable country though it has seemingly escaped the efforts of private security firms tracking alleged nation state cyber espionage, deception, propaganda, etc.  This suggests that either France has not committed any offensive cyber activities (unlikely given the reach and value of cyber espionage) or does them less than other governments, thereby flying under the radar. In 2016, the former French head of the cyber group in France’s foreign intelligence agency DGSE, admitted that France conducted cyber espionage, among other “hacking operations.”

A key takeaway about this document is how it dovetails with Western thinking on cyber warfare and where it takes a different path. The document underscores France’s commitment to international cooperation, an important undertaking in an area where hostile activities traverse borders, time zones, and cultures. Working together means finding common ground and building consensus with like-minded governments. In this capacity, France is a consummate team player, ready to support friends and allies in helping establish state norms in cyberspace.

But the document also shows that France understands that such cooperation is a process that does not come to quick fruition. Understanding this, the document demonstrates a commitment to employing offensive cyber operations, and developing new cyber weapons, two areas that help France stand out individually. It is not just a member of a larger group but can and will stand on its own as a cyber-capable, cyber-potent country.

While France supports many aspects of its allies’ approaches to the cyber domain, France has shied away from some of the more striking moves meant to punish and deter hostile state cyber activity. Despite being targeted by a variety of hostile actors to include alleged state actors, France has not undertaken public condemnation of these governments nor has it levied legal (indictments) or economic (sanctions) measures. This shows that France has its own ideas on how to address state-driven cyber threats, which very well may have been an impetus for the development of the Military Cyber Strategy – it will strike back against any threat perceived to be detrimental to its national security. The ambiguous nature of identifying national security threats allows a lot of leeway in targeting and the execution of activities. States have been officially warned.

The list of countries known or at least believed to be serious cyber powers is growing, a testament to the nature of technology, the interconnected global environment, and the continued blurring of cyber space and geopolitics. To not have a dog in this fight is unthinkable and is why even smaller nations seek to acquire some form of offensive cyber capability, whether grown indigenously or contracted out. Perhaps a quiet player in the past, France is reimaging itself as a willing partner that shouldn’t be crossed or tested in cyberspace. Time will tell if this is merely an aspiration or a harbinger of things to come.