Cybersecurity must not become an election issue

A summer that should have been enough

On 14 August, while the country was looking elsewhere, the French public accounts ministry published its press release no. 953. Illegitimate access to the information system of the Directorate General of Public Finances, occurring in June and July, obtained by hijacking the credentials of an officer and of an authorised third party. 678,438 rows of tax and land registry data extracted. The next day, the Paris prosecutor opened an investigation and entrusted it to the anti-cybercrime office. On the 18th, at a press conference, the director general brought the volume down to roughly 350,000 individuals and 250,000 business accounts, the attacker's figures containing duplicates, and disclosed a third breach detected the day before on a portal dealing with estates.

Meanwhile the same attacker claimed the extraction of the professional land registry server, 252,149 rows corresponding by their account to more than two million holders, on a system said to contain twenty million. Those last figures are a claim, not a confirmation, a distinction the press coverage largely flattened. The repetition, on the other hand, is nobody's claim. Three different defences gave way in eight weeks, in the same administration, across three perimeters with no technical relationship to one another, at an operator that had already acknowledged illegitimate access in February to the national bank account register affecting 1.2 million accounts.

Then came the education ministry on 17 August, the state cloud on the 22nd, the research institute for development, Docurba. A new term rarely opens on such an inventory.

The most troubling part sits in a document published four months earlier. On 9 April 2026, the national cybersecurity agency released the roadmap of priority efforts for the state's digital security for 2026-2027. On its very first page, the text notes that the intrusions and leaks affecting ministerial information systems in 2025 are a reminder of persistent serious vulnerabilities in those infrastructures. I wrote at the time that this document said everything without meaning to: it asked ministries for basic measures, multifactor authentication on administration accounts, removal of generic accounts, endpoint detection on workstations, restoration tests, all of which should have been in place long ago. The diagnosis was made, published, owned, and the choice had been made to make it public precisely to give it weight. The summer served as the demonstration.

And the problem is not primarily budgetary, contrary to much of what was said in August. The control that would have capped the theft of the 678,000 files had already been running at the tax authority since February, on a single file. Extending it did not call for a nine-figure top-up, it called for a decision and follow-through.

What Wallonia taught me about the weight of an electoral calendar

Between 2021 and 2024, I supervised around a hundred audits of Walloon public administrations, under the scheme led by Christophe Collignon, then minister for housing, local authorities and urban affairs. The programme was serious and costed. The Walloon government had released 750,000 euros for security audits, with completion expected by 30 March 2023 at the latest, 1.75 million euros for the purchase of cybersecurity equipment and services, and a 2.735 million euro grant to the inter-municipal body iMio to structure the offering for municipalities and public social welfare centres. The digital maturity barometer of local authorities published in 2023 had established that one local authority in five had suffered at least one incident in the previous two years.

The audits were carried out. What varied was what came next.

A mayor opens a sports hall. He cuts a ribbon in front of a renovated nursery. Nobody inaugurates network segmentation, nobody poses in front of a hardened directory. Cybersecurity spending has the disagreeable property of remaining entirely invisible when it works, and of looking like retrospective waste in periods when nothing happens. In front of a voter, it is hard to defend. In front of a municipal executive a few months before a ballot, it can be postponed at no apparent cost.

And 2024 brought Belgian local authorities two deadlines, regional and federal elections in June, municipal ones in October. A whole end of term tightened around those two dates. The audit recommendations delivered in 2023 entered a window in which few people wished to commit to spending voters would not see. The decision gap, that structural distance between the moment a risk is known and the moment it is acted on, does not play out only inside an executive's head. It also plays out in an institutional diary.

Then the Walloon government changed, the minister carrying the file left office, and the audit reports carried on existing. What had disappeared was the political sponsorship. In cybersecurity, a roadmap without a sponsor becomes a PDF.

NIS2: a consensual text held hostage by an arbitration that has nothing to do with it

The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was presented to the Council of Ministers on 15 October 2024, two days before the European deadline for transposing NIS2. The Senate adopted it on 12 March 2025. The National Assembly's special committee completed its examination in September 2025, unanimously, in the middle of the government's resignation, after adopting 244 amendments. Since then, the text has been waiting for a plenary sitting. It was not put on the agenda of the extraordinary session of July 2026. On 8 July 2026, the European Commission referred France to the Court of Justice of the European Union and demanded financial penalties, a lump sum and a daily fine until full notification of the transposition measures.

The most instructive part is the reason for the deadlock. It does not concern cybersecurity. On 4 February 2026, Philippe Latombe and Olivier Cadic, chairs of the special committees in the Assembly and the Senate, held a joint press conference to publicly denounce obstruction they attribute to the domestic intelligence service. At issue is Article 16 bis, introduced in the Senate by Olivier Cadic, which prohibits requiring encryption service providers to build in backdoors, a provision whose scope the Assembly even widened to cover any mechanism producing the same result. The interior ministry defends the opposite position, in the name of investigative access needs on drug trafficking and terrorism, and the argument deserves to be heard for what it is. The higher commission for digital affairs and postal services ruled in March 2026 in terms that leave no room for doubt: the delay is explained neither by a lack of parliamentary consensus nor by a crowded agenda, but by a targeted political disagreement. I developed this point when the French cyber framework was published, and it is a cousin of what Europe is attempting elsewhere with Chat Control.

This is exactly what I fear. A text that every political group approves on substance has been frozen for eighteen months because it carries an arbitration between two sovereign objectives, defensive security and intelligence access, which has nothing to do with the content of the directive. Around 15,000 French entities, against roughly 500 under NIS1, are waiting to know what will be asked of them, hostages to a confrontation they are not part of. As early as March 2026 the agency published a draft French Cyber Framework, specifying that it would remain a working document until transposition, while recommending that nobody wait to apply it.

This is where the distinction between compliance and resilience stops being a conference debate. An organisation that waits for the law before acting manufactures future compliance, whose due date depends on a parliamentary calendar it does not control. An organisation that acts now manufactures immediate resilience, which depends on no vote. The summer's attackers consulted neither the official journal nor the Assembly's order of business.

Post-quantum will not stand for election again in 2032

On 11 April 2024 the European Commission adopted a recommendation on a coordinated roadmap for the transition to post-quantum cryptography. The NIS cooperation group published that roadmap on 23 June 2025, with three milestones. By the end of 2026, each member state must have adopted its national migration plan and launched pilot projects on high and medium risk use cases, which means having started and not being ready, a nuance regularly flattened in summaries. By the end of 2030, critical infrastructure and high risk use cases must have switched over. By 2035, everything else.

France folded that timetable into its state digital security roadmap for 2026-2027, with first inventory steps in 2026 and 2027 and implementation objectives by 2030, tracked monthly by an interministerial committee.

Now look at those dates with an electoral calendar in front of you. The April 2027 ballot falls right in the middle of the cryptographic inventory phase, the least spectacular and the most decisive of the whole migration. An inventory has never won an election. An inventory not carried out in 2027 will be a migration not finished in 2030, because you cannot replace what you have not mapped.

I am currently working on a post-quantum migration roadmap. Identifying the algorithms to replace takes a few months. Guaranteeing that an organisation will hold that plan for nine years, while its leadership will have changed three times and its governance probably as often, is an entirely different exercise. At the scale of a state, multiply that difficulty by the frequency of changes of government and by every new executive's need to mark a break with the last.

There is a reason this deadline tolerates no postponement. Attackers are collecting encrypted traffic today that they cannot decrypt, betting on tomorrow's computing power. Harvest now, decrypt later. Health data intercepted in 2026 will still be sensitive in 2035, and a taxpayer's file does not expire either. Time lost on the inventory is never fully recovered, and it is paid for with data already stolen.

The campaign reflex: creating bodies rather than capabilities

In July 2026, Bruno Retailleau presented the technology section of his presidential programme at Station F, a document of some fifty pages titled « AI serving the French and their independence ». I read it in full and published the inventory on X.

What this document creates is almost exclusively bodies. A fully fledged ministry of artificial intelligence. A state chief technology officer with authority over information system architecture, procurement standardisation and the sovereignty doctrine, a role whose title already exists in the administration. A general inspectorate of digital affairs attached to the cybersecurity agency and reporting to the Prime Minister. An observatory of employment in the face of AI, when the existing statistical bodies already produce exactly this material, and when it is not their output that has been lacking these past ten years. Sectoral data spaces, a brand, a single desk for data centres, a single interface for European tenders that already exists. Then the paper deliverables: a sovereignty percentage with eight weighted criteria, a public score kept up to date, a list of solutions to be replaced, a map of dependencies, a national security doctrine, an annual publication of gains service by service. Some twenty artefacts all producing information about a capability that does not yet exist.

The most revealing passage is on page 30, and I am not sure its authors realise it. The document explains there that for almost every foreign tool equipping the state, a French alternative already exists, often already deployed somewhere in the administration. It therefore describes a problem of pure execution: we know what to do and we do not do it. The proposed answer is to publish a list and score the tools out of a hundred. A scoring scale does not migrate an information system.

On artificial intelligence, this exercise nonetheless remains legitimate, and that should be said plainly. AI raises questions on which a candidate has the right, and even the duty, to take a firm position: the desirable level of European regulation, the effect on public employment, the scale of investment, the room left for non-European players, the pace of deployment in public services. One can defend deregulation or its opposite without being incompetent. Democratic debate belongs there, and it should take place there.

In cybersecurity, there is nothing comparable to arbitrate. Nobody defends single-factor authentication, nobody proposes delaying post-quantum migration, no political sensibility claims a lower level of protection for the data of the citizens it administers. When a subject carries no substantive divide, all a campaign can add to it is structures and documents. And every new structure takes execution time from a calendar that has none left.

My criticism of this document is therefore in no way partisan. It would apply word for word to the digital section of any other party's programme, and I will make it identically when the others publish theirs. Sovereignty is not written in a PDF, it is decided with a budget, a team, a scope and a date, and those are precisely the four things found nowhere in the fifty-five pages.

What I want from citizens, and what I do not want from candidates

I want citizens to demand that the state protect their data with the same obviousness with which they demand that tap water be drinkable. I want the question put to ministers, prefects, mayors and heads of central administration, and put to them again. What I do not want is twelve candidates arriving in a campaign each with their own cyber doctrine.

A candidate has to stand out, that is the very nature of the exercise. Standing out on a technical roadmap means modifying it. Renaming the agency, redrawing the governance, redefining the scope of the entities concerned, re-announcing an existing budget under another heading. Each such modification costs twelve to eighteen months of re-familiarisation, contract renegotiation, team rebuilding and the resumption of relations with operators. Against a deadline set at the end of 2030, eighteen months is close to a third of the road left.

That leaves the question of sovereign duty, which is the real substance of the subject.

The taxpayer does not choose to entrust their data to the tax authority, the law obliges them. The parent does not choose to entrust their child's data to the education system, compulsory schooling compels them. The hospitalised patient does not negotiate the contents of their file. When the state collects by compulsion, protecting what it collects stops being a question of service quality and becomes an obligation flowing directly from that compulsion. We do not re-argue every five years the principle that the state must protect the physical integrity of the people it administers, we argue about the means. For data, that distinction has been lost along the way.

It is worth saying what the failure of that protection means. On the night of 20 to 21 August 2022, the hospital in Corbeil-Essonnes transferred newborns from its neonatal unit to other establishments. In December of the same year, the Versailles hospital triggered its emergency plan and transferred six patients, three of them in intensive care. In February 2024, the Armentières hospital temporarily closed its emergency department, before more than 950,000 patient files were released. In 2021, the Dax hospital spent close to 2.3 million euros rebuilding its information system.

None of these establishments was attacked because one political camp had won an election. None would have been spared by a different result. For the families concerned, the political colour of the minister responsible for the cyber file was of no importance whatsoever.

What would actually protect a roadmap

Three mechanisms would suffice, and none is original since all exist already in other fields.

The first is budgetary. Cybersecurity systematically loses the annual arbitration against a visible line, and it will lose it again this autumn during the examination of the 2027 budget. Multi-year programming, on the model of what military programming law does for defence, removes the subject from each year's negotiation. Programming can be revised, obviously. But revising it exposes you politically, whereas letting an annual budget line slip costs nobody anything.

The second concerns accountability. The state roadmap sets milestones dated 30 June 2026, 31 December 2026, then 2030. Their monitoring is handled monthly by an interministerial committee, which is useful internally and entirely invisible outside. Making that monitoring public and mandatory before parliament, whatever the government in office, changes the nature of the subject. A milestone measured publicly survives markedly better than a milestone announced at a press conference.

The third is a cross-party commitment, and it is by far the hardest to obtain. An agreement signed before the campaign rather than during it, covering three or four dated deadlines: the transposition of NIS2, the cryptographic inventory, the generalisation of multifactor authentication on state systems, for which the agency set a deadline of 31 December 2026. The signatories undertake not to reopen them. Anyone refusing to sign publicly accepts wanting to call the calendar into question, and must then explain why. The debate shifts from posture to responsibility, which is the only useful shift.

17 October 2024 passed without France having transposed NIS2. 31 December 2026 is coming, with the European post-quantum milestone and the national deadline on multifactor authentication. 31 December 2030 will follow. None of these three dates has ever appeared on a ballot paper, and none will move because an election is approaching.

Further reading

• The French state's cybersecurity roadmap: the document that says everything without meaning to
• Framework, backdoors and USB keys: France in cybersecurity, between clarity and anachronism
• FICOBA: 1.2 million bank accounts exposed. So now what?
• Chat Control 2.0: Europe is playing with our digital freedoms
• Cyberpsychology and power: how emotions are manipulated
• Hacking of the French tax authority: above all, do not give them more money (Atlantico, 21 August 2026)
• The concrete steps, by user profile, are gathered at etrecyber.fr.

Sources

• French public accounts ministry, press release no. 953 of 14 August 2026, and the tax authority's press conference of 18 August 2026.
• FrenchBreaches, public sector alerts, February and August 2026 (FICOBA, tax authority, land registry server, education ministry, state cloud, research institute, Docurba).
• ANSSI, Roadmap of priority efforts for the state's digital security 2026-2027, published 9 April 2026, and the SGDSN statement of the same day.
• NIS cooperation group, Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, 23 June 2025.
• European Commission, recommendation C(2024) 2393 of 11 April 2024 on a coordinated roadmap for the transition to post-quantum cryptography.
• European Commission, referral of France to the Court of Justice of the European Union for failure to notify NIS2 transposition measures, 8 July 2026.
• Press conference by Philippe Latombe and Olivier Cadic at the Senate, 4 February 2026, on the deadlock over Article 16 bis of the Resilience bill. Opinion of the higher commission for digital affairs and postal services, March 2026.
• Senate, adoption of the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, 12 March 2025. National Assembly special committee, examination completed September 2025.
• Les Républicains, AI serving the French and their independence, presented 7 July 2026 at Station F.
• Parliament of Wallonia, ministerial answers on support for local authority cybersecurity (audits, equipment, iMio grant).
• Agence du Numérique, Digital maturity barometer of local authorities, 2023.
• Senate and National Assembly, written and oral questions on hospital cyberattacks (Corbeil-Essonnes 2022, Versailles 2022, Dax 2021, Armentières 2024, Cannes 2024).