Sébastien Garnault (CyberTaskForce) "Pro-Digital Sovereignty Rhetoric Often Trades Security for National Purity"

Sébastien Garnault, founder of CyberTaskForce and the Paris Cyber Summit, believes that debates on digital sovereignty are too radical.

JDN. In your view, the rhetoric around digital sovereignty goes too far. Why?

Sébastien Garnault. These arguments often promote a kind of digital nationalism, far removed from any pragmatism. Souveraine Tech is a good example, but there are others, ranging from identity-based sovereignty to the idea that everything should be open source, not to mention the blind nationalism pushed by some politicians I'd rather not name. Pro-sovereignty rhetoric often favors national purity over security. If a foreign solution is more effective than French ones in fighting child exploitation, why not use it?

Can you give a real-world example?

Let's take a case involving the government: the open source messaging app Tchap, part of LaSuite developed by Dinum, which is recommended for use in all ministries. As soon as it launched in 2019, a major vulnerability was discovered. For better security, it would make more sense to use the American app Signal, adding the security layer from the French company CryptoNext, which strengthens confidentiality. For sensitive communications, the French app Olvid can be useful. Sometimes, you need to rely on foreign solutions until French equivalents are ready. The DGSI used the American company Palantir until ChapsVision was able to replace it. But instead of encouraging French innovation, the government chose to develop Tchap itself—a product that is neither high-performing nor secure—just to have total control, all in the name of absolute sovereignty.

A large share of government data is critical... Don't you think it's risky to entrust it to non-European solutions?

For strategic and sovereign data, such as that related to the Ministry of the Armed Forces, I do believe total digital control is necessary, with sovereign solutions. For data from critical infrastructure operators like SNCF or EDF, it depends on how sensitive the data is. As for other, non-sensitive data—like that from the Tour de France du Numérique, for example—I don't think it needs to be hosted or processed by sovereign solutions. Yet if you listen to the advocates of digital sovereignty for everything, they'd have all data from all these organizations hosted in SecNumCloud, or even all civil society data.

In fact, even SecNumCloud doesn't satisfy them, since this certification can be obtained by hosting solutions that are joint ventures with American players, like S3NS with Thales and Google. They criticized ANSSI, France's national cybersecurity agency, for allowing such partnerships to be certified. Its director general, Vincent Strubel, defended the decision during a hearing at the National Assembly, explaining that the certification is more about security than sovereignty. And let's not forget, Americans sometimes use foreign solutions too...

Can you name some French solutions used by the United States?

The FBI uses services from Filigran, Thales supplies federal agencies and the U.S. military, Atos—which has a strong presence in the U.S.—provides cybersecurity solutions to federal agencies, OVH Cloud serves private American clients, and so on. Working with American suppliers is supposedly a problem for us, but supplying the U.S. isn't? Instead of framing it as France versus the United States, I advocate for mutual understanding of our different interests, without denying our disagreements. That's why every year in Washington, I organize meetings with a delegation of French lawmakers and companies—members of Hexatrust and the Alliance pour la confiance numérique, such as AnozrWay and Cap Gemini.

Isn't our cybersecurity investment strategy relevant?

The France 2030 acceleration strategy includes €720 million in public funding for cybersecurity. Some innovative companies like YeWeHack, now operating worldwide, have benefited—and that's a good thing. Other companies, which are not at all innovative (I won't name them), have also received support. Sometimes I feel these funding programs prefer to back low-value-added companies rather than take the risk of investing in high-potential innovations for the future. It's better to fund quantum computing than yet another detection solution you can find anywhere. We're also told that public procurement should go to French companies. But when it comes to equipping ministries with office software, the government prefers to develop LaSuite—the one I mentioned—instead of turning to French companies it has invested in, like Olvid. So the government is actually preventing French start-ups it invests in from having the administration as their first client...

This article was automatically translated from French. Read the original version: https://www.journaldunet.com/cybersecurite/1557759-les-discours-pro-souverainete-numerique-preferent-souvent-troquer-la-securite-contre-la-purete-nationale/