French companies, what exposure to espionage risks?

Espionage is thea clandestine collection of sensitive or secret information for the benefit of a foreign power, group, organization, individual or company. From this perspective, industrial espionage aims to clandestinely appropriate commercial, industrial or technological information for the benefit of one or more competing actors.

the great classics

Economic espionage takes many forms and experts in this field compete on originality. There are classic forms such as physical intrusions into sensitive locations (companies, laboratories, etc.) or theft of employee equipment. Malicious actors can also use more covert methods when manipulating so-called fragile people. Each time, the goal is to steal strategic or technological data.

Between 2008 and 2010, a French employee of EDF would have been targeted by Spanish intelligence services. Disappointed with her career, this employee felt resentful towards her employer. It was playing on that person’s ego that the Spanish agents tried to manipulate him. The DGSI also gave the example of a young French researcher who was approached by a foreign agent posing as an employee of a consulting firm. As the exchanges and meetings progressed, this agent sought to retrieve confidential information from the latter.

The risk of foreign investment

Competing economic actors also use the financial weapon to achieve their goals. Foreign investments can serve as a pretext to collect industrial know-how, targeting strategic sectors of French economic and scientific heritage. french services regularly warn about the risks of foreign investment. By financially holding a company, the investor can have access to strategic data or transfer technological know-how to another country. Cases of economic espionage in foreign investment funds have been documented by the DGSI. In February, DGSI gave the example of the acquisition of a company by a foreign entrepreneur. The latter aimed at a company with high technological potential but with financial difficulties. Gradually, the entrepreneur plundered the company’s technological know-how to transfer this expertise to foreign competitors.

Faced with this type of threat, State services sometimes refuse certain foreign investments to preserve their strategic sectors. In 2021, the French State has, for example, opposition to the acquisition of Carrefour by the Canadian company Couche-Tard. The French authorities are said to have judged that an acquisition of Carrefour would be risky for the country’s food security.

Universities and research laboratories are also targets of these investments. Those of mobile phone giant Huawei are under close surveillance in France. This company, long suspected of spying, invests heavily in universities and research centers in France and abroad. This company is particularly interested in research in artificial intelligence, big data or telecommunications. But some of the investments are refused by French authorities. In 2019, Huawei gave 700 thousand euros to Telecom Paris and proposed a 5-year partnership between the two entities. Here again, the French state opposed this investment.

cyber risk

There are also more technical methods that target corporate computer systems. The security of IT systems has been considerably affected by the health crisis and teleworking. In addition, due to confinement, employees used unsafe and flawed means of communication. In 2019, for example, Airbus was the target of various attacks (through its subcontractors) that would have as its objective the theft of technical and commercial documents. The attackers allegedly tried to steal engine information from the A400M (military transport plane) and the A350 (civil transport plane).

Finally, on a much larger scale, some states resort to massive industrial espionage thanks to their technological, political or legal domination. As such, state espionage scandals relating to economic interests are legion. In 2013, Edward Snowden already warned of massive US spying. According to the revelations of this whistleblower, the NSA would have developed programs (PRISM, XKeyscore, GENIE) to collect massive data on the internet. In 2015, a German newspaper revealed that the federal state had spied on senior French officials on behalf of the United States.

In addition, some States use their legal and technological apparatus to capture as much data as possible about individuals, organizations or companies. This is particularly the case for Cloud Act, passed in May 2018, which allows US authorities to collect data from US tech companies even if the servers are overseas. This means that the United States can have access to all information sent by mail (encrypted or not) of American origin. It is not just WhatsApp or Signal, as this law affects other companies such as Facebook Messenger (Meta), Gmail (Google) or Outlook (Microsoft). Additionally, the Cloud Act makes it easier (under a bilateral agreement) for a foreign government to collect data from US technology companies.

If the classic forms of economic espionage are known and can be limited by state services, reducing massive data collection is much more complex. It is above all a political problem, which concerns digital sovereignty.

For more:

Leave a Comment