🔴 Data Breaches Are Finally on the Political Radar.

The scene looks like a script from the 1980s series Whiz Kids. A fifteen-year-old, from his bedroom, by changing a few characters in a web address, gets access to the data of twelve million French citizens.
⠀
Except that we are no longer in the 1980s, and this is not just any data.

It was one of the servers of the ANTS (the Agence nationale des titres sécurisés, the agency that issues ID documents) that hold the first and last names, dates of birth, email addresses and login credentials of twelve million French citizens registered for a passport or a national ID card.

The very same documents that come with a highly particular ceremony: a secure process, an appointment at the town hall, biometric technology used to generate your secure passport.

Except that the data that was hacked is the data you enter online before you even set foot in the town hall.

⠀
In 2015, in the United States, the OPM (Office of Personnel Management) was hacked and 5.6 million fingerprints of federal employees and applicants were stolen, many of them belonging to staff with security clearances. That attack was attributed to China.
⠀
But that is not what we are dealing with here. This is a 15-year-old kid in his bedroom, with two damning facts:

• The flaw had been publicly reported seven months earlier.
• The state spends between €700 million and €1 billion a year to prevent this kind of incident.

The political response, two weeks after the fact, was not to fix the chain of responsibility that allowed the leak, but to announce an administrative reorganization and a budget fund. After several years of nonstop hacking of every piece of data the French possess, the state is trying to regain control by making announcements.

The only good news is that it is the Prime Minister who has taken the matter in hand.

Introduction

⠀
None of this is anecdotal: major changes have been announced in how the state organizes its digital operations. This reorganization raises a great many questions among experts.
⠀
I recently attended a dinner of IT and security chiefs from large corporations. One of the things that struck me was that many of them now consider the state, within their chain of suppliers, to have become a weak link, a security risk.
⠀
Which means that the data that companies and citizens entrust to the state is no longer considered fully secure.

But this is nothing new: every French citizen has figured it out, through the hacks of health insurance data (Viamedis and Almerys, February 1 and 5, 2024, 33 million policyholders), of France Travail, the national employment agency (March 2024, 43 million people), of Parcoursup, the university admissions platform, and of course of the Agence nationale des titres sécurisés (ANTS) on April 15, 2026, 12 million accounts.
⠀
The government's strategy was silence at first. You only had to watch the Minister for Digital Affairs dodge the questions put to her in the Senate on data leaks by Senator Catherine Morin-Desailly, and let the Minister of National Education answer in her place. That was a month ago.

And that, of course, was before the introduction of Mythos, Anthropic's new model, probably already operational at the NSA and in certain American agencies. Some voices in the cybersecurity world are predicting an even larger number of vulnerabilities. (links at the end of this newsletter)

⠀
The organization that has been announced can only be seen for what it is: a patch, pending the day the person and the team elected in 2027 propose a new organization of the state's digital operations.

Will we leave behind the platform state, which has been a failure, and return to a more technical, more inspired vision?
⠀
Because what these incidents dismantle is the myth of the non-techie who sees digital as a career booster, but who does not know much about it and has become a risk to the security of public services.

Beyond entirely rethinking the place of digital within the state, we will also have to break the myth of regulation, the one the digital sector clings to like a mussel to its rock.
⠀
Regulation (or, to be precise, excessive over-regulation) is the myth of the model student who has ticked every box but has never worked on the technical side of these systems.

Would you board a plane whose safety checklist had been drawn up by compliance specialists rather than by engineers?

Because there is one thing I have learned in 40 years in computing, having spent time with the greatest hackers (Mitnick, LOD, MOD, and Neuralien to keep it French) and the best security specialists (such as Dan Farmer, the creator of SATAN) in the 1990s: beyond technical expertise, the best sysadmins have intuitions about what needs doing. That intuition is essential to securing systems. Making them spend their days filling out forms disconnects them from that intuition, and therefore from real security.
⠀
All the brilliant people I see who have these skills end up drowning in administrative processes that, on top of everything else, no longer leave them time to think about the next waves of risk.
⠀
How many CISOs have the time to think through the implications of agentic AI, which is becoming a formidable attacker?

The head of GCHQ (Britain's NSA) recently explained that 100 countries around the world now have the means to launch cyberattacks on Britain. I see no reason France would be spared. (link at the end of the article)
⠀
At my think tank, The Sovereign Way, we published a note for our clients on the Lecornu government's announcements following the Agence nationale des titres sécurisés leak.

Rereading it, it seemed to me that it said something broader: the French state suffers not only from a cybersecurity deficit, but from a deficit of technical command.

For paying subscribers, I have reproduced it in full below. 👇