Industrial policy: the holy grail of French cybersecurity strategy?

The 2008 White Paper on Defence and National Security was the first major document to focus directly on national cyberthreats as a key risk to France’s sovereignty. It defined new priorities – such as cyberattack prevention and response – and established, in July 2009, the National Agency for the Security of Information System (ANSSI) as an inter-ministerial agency with national authority for the defence of information systems. In 2013, a new version of the White Paper reiterated that the capacity to detect and protect against cyberattacks was ‘an essential component of [France’s] national sovereignty and economic well-being’. The same year, the French government launched an ambitious programme and invested considerable efforts and expenditure into cybersecurity industrial policy. This article summarises the structural characteristics of public-private partnerships and outlines the different conflicts behind the industrial movements in the 2009–2015 period: representation of digital sovereignty versus corporate interest in the global market, national defence champions versus the start-up ecosystem.