USB stick and state silence: digital complacency has struck again

Salah Abdeslam, convicted for the November 13 attacks, was taken into police custody for illegally possessing... a USB stick in prison.

Let us say it out loud: the logistical mastermind of the worst attacks France has ever known could have accessed digital data, in prison, in 2025.

And no one found that shocking until we stumbled on it by accident. Not one authority to anticipate it. Not one system to prevent it.

Just improvisation, protocols that no one follows, and a recklessness that, in another country, would have triggered a wave of forced resignations.

What exactly happened at Vendin-le-Vieil?

The facts first, because they are worse than the summary.

Salah Abdeslam is held at the Vendin-le-Vieil prison, in the Pas-de-Calais. He has a computer there, acquired in November 2024 through the ordinary procedure, with the authorisation of the prison administration. A machine with no connection to the outside world, whose USB ports were in principle supposed to be disabled.

On 15 January 2025, an inspection of that computer turned up traces of four USB sticks connected between December 2024 and January 2025. Analysis of the machine revealed numerous records in the form of file paths pointing to audio, image or video files, most of them official Islamic State or Al-Qaeda propaganda.

Four sticks. On a port that should never have worked. In a high-security prison.

The case only became public in November 2025, ten months later, a few days before the commemoration of the tenth anniversary of 13 November 2015. On 10 November, the national anti-terrorism prosecutor's office announced the opening of two judicial investigations: one into the handover of the stick, under the charges of handling the introduction of an illicit object given to an inmate, complicity and ordinary criminal conspiracy; the other for terrorist criminal conspiracy with a view to preparing crimes against persons. The inmate's former partner has been placed under formal investigation. According to the details reported by the press, she admitted buying a USB stick, loading it with jihadist propaganda and having it handed over during a prison visit.

The director general of the DGSI, Céline Berthon, stated for her part that Salah Abdeslam "is not implicated in any attack plot".

Fine. That is not what interests me here. What interests me is the USB port.

The problem is not Abdeslam, it is us

He is under a particularly close surveillance regime, and yet he can possess computer equipment, in a cell. He can handle it. He can plug a USB stick into it; or at any rate, he was able to. But above all: he can benefit from the pervasive complacency.

Because France has a problem: it loves to pretend to secure things. It puts procedures on display. It announces plans. It sets down words. But it does not do the work.

We check after the fact. We communicate a lot. But we protect little. And as always, the politicians rush to comment after the event, to reassure public opinion.

"Searches have been stepped up", "the system has been adapted", "sanctions will be taken"...

But the damage is already done: the fault does not lie in the incident, but in the acceptance that it could happen. When a terrorist of this magnitude, held in a high-security wing, can handle forbidden objects, that is not a "slip-up".

It is a failure of the whole system.

Is an inmate allowed to have a computer in their cell?

Yes. And that is precisely where the case becomes instructive, because none of this is a hole in the law. All of it is a hole in the way the law is applied.

Article R. 332-41 of the French prison code allows any detained person to acquire computer equipment through the administration and according to the terms it sets. A circular from the prison administration directorate dated 25 May 2009 fixes the conditions: new equipment, no wifi, no bluetooth, no disc burner, no connection to the outside world. And a formal ban on any medium that makes it possible to record or export information, USB sticks first among them.

The law has hardened further since. The decree of 8 July 2025 on organised crime units introduced an article R. 224-30 of the prison code that flatly prohibits, in those units, acquiring or holding computer equipment in a cell. It came into force on 10 July 2025. The computer in question had been acquired eight months earlier.

So let us recap. The rule existed. The ban on USB sticks existed. The disabling of the ports existed, on paper. Only one thing was missing: someone to check that a port deemed disabled really was disabled, and to check it more than once.

That is exactly the difference between a security policy and an applied security policy. In the organisations I work with, I find the same gap almost every time: the rule is written, it is often even well written, and no one ever measures whether it produces any effect. That has a name, it is documentary compliance. In a company, it ends in ransomware. Here, it ends in Islamic State propaganda in the cell of the only surviving member of the 13 November commandos.

Digital is also a weapon

And we need to start treating it seriously. We keep thinking of security as a lock on a door. But in 2025, weapons no longer always make noise. They circulate on sticks. In files. Through encrypted messages. Through invisible instructions.

One figure to take the measure of the ground: the Ministry of Justice recorded 80,000 mobile phones found in detention in 2024 alone. Not suspected, found. The volume is such that the administration writes in black and white, in a technical note of April 2026, that it rules out considering, for each of them, a judicial seizure with investigation or an administrative exploitation. In other words: we record, we do not act.

Technology is no longer an option. It is a territory. And we are leaving the borders open.

This is not a story about hackers. It is a story about a system with no backbone. We treat serious matters with a technocratic breeziness. We spend millions on "cybersecurity plans" that no one reads. We create committees. We make PowerPoints. But when it comes to acting, monitoring, owning the discipline, we give up.

What has the state changed since the affair?

Let us be honest: something has moved. And the way it moved says a great deal.

On 11 November 2025, Justice Minister Gérald Darmanin said he was "stunned" to learn that Salah Abdeslam had a computer in prison, specified that the machine was not connected to the outside world and that it had been authorised by the prison administration, and put an end to that access. Interior Minister Laurent Nuñez confirmed that the inmate no longer had either his computer or that USB stick.

On 21 November 2025, the ministry launched the "Zero mobile phones in prison" operation: 29 million euros of works across six facilities, Paris-La Santé, Arras, Dijon, Rennes-Vezin, Toulon-La Farlède and Toulouse-Seysses. In detail, 10 million for the passive security of buildings, 6.4 million for jammers, 4.43 million for reinforced grating, 1.7 million for millimetre-wave scanners, 1.3 million for staff equipment, 1.2 million to cover exercise yards, 1.05 million for anti-drone systems and 780,000 euros for X-ray tunnels. Nationally, 58 facilities equipped with anti-drone systems and 19 more announced before March 2026; 22 equipped with jammers and 13 more to come.

Then decree no. 2026-254 of 8 April 2026 added to the grounds that can lead to the withdrawal of sentence reductions the fact of having been disciplined for the introduction, possession or exchange of objects, data or substances liable to compromise the security of the facility. A circular of 9 April 2026 makes searches systematic and equips prosecutors to handle the phones found in detention.

That is better than nothing. Now read the list again: drones, scanners, X-rays, jammers, grating, passive security. Concrete and radio waves. Almost the entire effort goes into the physical envelope of the prison, in other words into the way an object gets in.

The one thing that actually failed is not on the list. An active USB port on an authorised machine is not fixed with reinforced grating or a GSM jammer. It is fixed with an asset inventory, configuration hardening, a controlled system image and a documented periodic check. IT asset management, a discipline with no press photo, no press conference and no spectacular budget line.

And meanwhile, on 1 April 2026, the administrative court of Lille suspended the decision maintaining the separation screen installed in the visiting room after the affair, for manifest error of assessment. Everyone plays their part. The administration overreacts after the fact on what is visible, the judge puts it back in its place, and the underlying question, the one that fits in five words (why was that port working?), is dealt with by no one.

There is no resilience without rigour

There is no security without discipline. And there is no serious public policy without a minimum of consistency. If France still wants to call itself a modern digital democracy, it must stop believing that it can outsource rigour. Security cannot be delegated. It is enforced, every day, in every gesture, in every flaw we refuse to tolerate.

And at a time when we are about to commemorate the 10th anniversary of the November 13 attacks, what remains? A terrorist in prison. And a country that, quite plainly, still has not understood.

Reclaiming the meaning of the word "security"

The solution is not digital. It is moral, political, structural. The problem is not the USB stick, but the fact that a man like Salah Abdeslam can still get anywhere near one. An individual who took part in the worst mass killing on French soil since the war has no business enjoying comfort or technological learning. No screen. No access. No contact. Not even the chance to look at a computer, still less to use one.

The right to rehabilitation cannot be a totem of moral impunity.

Society does not protect itself by re-educating those who set out to destroy it, but by guaranteeing that they can never threaten it again. Maximum-risk detention must be redefined: zero contact with the outside world, zero privilege, zero indulgence.

Not out of vengeance, but out of consistency. Because you cannot commemorate victims on one side, and hand a keyboard to their executioner on the other. Security is first and foremost this: the political courage to say that certain rights end where the memory of the innocent begins.

---

Sources

• franceinfo, November 2025, "Two judges appointed to investigate Salah Abdeslam's illegal USB stick and an attack plot involving his former partner" (in French)
• franceinfo, November 2025, "Salah Abdeslam is not implicated in any attack plot, says the head of the DGSI" (in French)
• franceinfo, November 2025, "USB stick handed to Salah Abdeslam in prison: what we know about the investigations" (inspection of 15 January, four USB sticks, content found)
• Les Surligneurs, legal framework for computer access in detention (articles R. 332-41 and R. 224-30 of the prison code, acquisition in November 2024)
• Légifrance, decree no. 2025-620 of 8 July 2025 on organised crime units
• CNews, 12 November 2025, "Justice Minister Gérald Darmanin stunned to learn that Salah Abdeslam had a computer in prison"
• Ministry of Justice, 21 November 2025, "Zero mobile phones in prison" operation (29 million euros, six facilities, breakdown of the measures)
• Ministry of Justice, circular of 9 April 2026 on illicit objects in detention and its DACG technical note on handling phones found in detention (80,000 in 2024)
• Légifrance, decree no. 2026-254 of 8 April 2026 on the withdrawal of sentence reductions
• RD Avocats, note on the ruling of the administrative court of Lille of 1 April 2026 (suspension of the separation screen in the visiting room)
• Presidency of the French Republic, commemoration of the 10th anniversary of the 13 November 2015 attacks