Encryption: France’s government moves to scrap the safeguard against backdoors

The economic cost of a backdoor · Part 1 of 7

Documentary investigation current to 7 November 2026. The parliamentary debate remains open as of that date.

France’s cybersecurity bill contains a proposed safeguard against compulsory measures that weaken encryption. The government wants to remove it, arguing that it could hamper criminal investigations and intelligence work. Behind the dispute over wording lies a practical economic question: what security will a business be able to buy, and who will bear the risk created by an additional means of access? ^S01S02

A boundary inside a security bill

The debate is scheduled to begin at 4 p.m. on Monday, 9 November 2026. France’s National Assembly is due to consider the bill on critical infrastructure resilience and stronger cybersecurity. The government has requested priority consideration of Article 16 bis on Tuesday the 10th, after questions to the government. At this investigation’s cut-off date, those are announced arrangements for a debate still to come. ^S04S08

This short article occupies an unusual place in the bill. The surrounding provisions organise incident prevention, supervision and institutional responsibilities. Article 16 bis draws a boundary: how far may public authorities require a supplier to alter the protections it provides to users? ^S01

Its wording addresses technical devices intended to deliberately weaken the security of systems and communications. It names master decryption keys, then extends the prohibition to any other mechanism or process enabling access to protected data without consent. It applies to encryption service providers, including qualified trust service providers. ^S01

In this debate, a master key means a means of decryption with a reach beyond that of an ordinary user. Yet the term is convenient shorthand for very different designs. Additional access could also involve a recovery function, an extra recipient or a software change. Its consequences would depend on how it worked and which data it could actually reach. ^S17S21

The government proposes deleting the entire article. The operative text of amendment 358 is just three words in French: “Supprimer cet article.” Its explanatory statement defends the capabilities of criminal investigators and intelligence services. It argues that a prohibition framed around all access without consent could undermine duties to cooperate that already exist in French law. ^S02

The amendment removes a proposed protection from a bill. Existing access powers arise under other provisions; deleting this safeguard specifies no additional decryption architecture. Assessing any future order would still require identifying its legal basis, the parties bound by it and the limits on its use. ^S01S02S10

The Senate vote and the committee’s position

The safeguard originated in the Senate on 12 March 2025, when senators adopted Olivier Cadic’s amendment. Official recorded division 227 lists 181 votes in favour and 134 against: 315 votes for or against, out of 334 senators taking part. The date appears in the official proceedings. ^S05

On 9 September 2025, the Assembly committee adopted Philippe Latombe’s amendment CS358, adding the words meaning “or process”. The text filed the following day incorporated that wording. The small expansion helps explain the disagreement: does the protection cover only a weakness introduced into a system, or could it also be invoked against an investigative procedure? This 2025 committee amendment is distinct from the government’s amendment 358 of 2026. ^S01S05S07

On 14 October 2026, the special committee endorsed six amendments proposing deletion, including those from the government and the lead rapporteur, Éric Bothorel. It acted under Article 88 of the Assembly’s Rules of Procedure, which governs this stage of preparing amendments for consideration in the chamber. ^S03S06

The decision clearly indicates the committee’s political position. The legislative decision still belongs to the full chamber. As of 7 November, the reference text remains the committee bill containing Article 16 bis; amendment 358 is marked as awaiting debate. Reporting that MPs had already removed the protection would be premature. Reporting that they had already imposed backdoors would go further still. ^S01S02S03

Method and scope

The bar proportionally divides the 334 voters in the Senate division of 12 March 2025: 181 for, 134 against and 19 abstentions. Votes for or against total 315. The timeline brings together separate procedural stages; spacing is schematic. The committee’s opinion under procedural Article 88 precedes a floor decision. As at 7 November 2026, sittings on 9 and 10 November remain scheduled.

An earlier dispute over the drug-trafficking bill explains some of the tension. In 2025, a separate provision, Article 8 ter, addressed obligations to provide access to messaging content. It was deleted in committee on 6 March; an attempt to restore it was rejected in the chamber on 20 March. That legislative history belongs to another bill. The comparison shows the continuity of the concerns, provided the proposed investigative power remains distinct from the safeguard now under discussion. ^S30

The government’s argument and the wording

Investigations often proceed without the subject’s consent. Wording that made consent the dividing line for all access to data could therefore conflict with legally authorised investigative acts. This is the executive’s strongest argument: the end of the sentence may reach further than its stated security objective. ^S02

The whole sentence nevertheless matters. Its opening addresses the incorporation of technical devices intended to weaken security deliberately. That condition supports another reading: the prohibition could concern changes that make a system vulnerable, while investigative powers continue to apply to data and capabilities already available. The disagreement turns on how these parts of the sentence interact. No judicial ruling resolving that question for this provision was found in the material examined. ^S01S02

The government also raises the risk of a cavalier législatif: a provision insufficiently connected to the original bill under France’s constitutional rules for parliamentary procedure. That is an admissibility and constitutional objection advanced by the amendment’s author. Any eventual review by the Constitutional Council would be separate from the technical assessment of a backdoor. ^S02

To clarify the disagreement, the debate needs to specify what a provider would be compelled to do. Requiring an operator to disclose data it holds, assist with an interception it can perform, or rebuild its service to make content accessible involves different acts. Useful drafting should make clear which act is required. ^S10S12S13

Deleting the article resolves the drafting dispute by removing the rule. Clarification would instead seek to define the safeguard and its relationship with existing powers. Parliament must choose between those approaches. To assess the choice, it needs verifiable examples of lawful acts that would actually be obstructed, and of technical changes that would be permitted in practice, each with its legal basis. That demand for specificity guides this investigation. ^S01S02

A legal order meets a technical design

Consider a business conversation protected by end-to-end encryption. The sender’s phone transforms the message into unreadable data for transmission. The recipient’s phone makes it readable on arrival. In this model, the means of reading the content remain at the endpoints; the provider carries the messages between them. Security also depends on authenticating the participants, protecting their devices and implementing the service correctly. ^S16S19S21

Several investigative avenues may remain. A provider might hold account data, timestamps or some routing information, depending on the service. These metadata describe aspects of the exchange. Their availability and detail vary. The label “end-to-end encrypted” alone does not tell an investigator which metadata exist or how much they reveal. ^S21S27

Content may also be obtained from a device, where its user reads or creates it. Subject to its own conditions and oversight, France’s Code of Criminal Procedure allows the capture of computer data, including data displayed on a screen or entered by a user. Such an operation acts at the endpoint. Recovering readable content there concerns the security of the endpoint; the encryption protecting the message between endpoints may still be functioning as designed. The operation’s technical reach must be assessed by examining the tool actually used. ^S12

A third situation arises when a person or provider has a means of decryption. Within its scope, Article L. 871-1 of the Internal Security Code requires cryptology service providers to supply the decryption information for data transformed using their services. It also allows them to be required to perform the decryption themselves, unless they demonstrate that they cannot comply with that request. Article 434-15-2 of the Criminal Code separately concerns refusal to disclose or apply secret decryption information known to the person concerned. The inability exception in the first provision relates to the provider being required to perform the decryption. ^S10S11

An authority might also seek a capability that the provider does not have. Something would then have to change: key distribution, the software, the list of recipients or another part of the architecture. That transformation raises the issue of exceptional access. The new capability would become a feature that has to be operated, secured and maintained. An authorisation defines when it may lawfully be used; the design determines how it can fail. This requires a separate assessment from requests for material that is already accessible. ^S17

Backups and linked devices complicate the picture further. A conversation may be well protected in transit yet accessible through a copy or an associated device. CISA’s mobile communications guidance, updated on 24 November 2025, accordingly recommends securing private messaging settings and practices. An assessment must follow the data through its actual journey. ^S19

Method and scope

A simplified functional model of end-to-end encryption. Content keys remain at the endpoints in the model shown. Copies, backups, linked devices and authentication require separate assessment. A key already available to a holder belongs to a different situation from the end-to-end model shown. Modifying an architecture to create additional access would require its own assessment. The three access routes below are alternatives, subject to their own legal and technical conditions.

One target can rely on a component shared by many

The word targeted first describes the authorisation: a person, an account, a period and a purpose. That is an essential legal safeguard. The extent of the technical risk depends on another question: what access would become possible if the mechanism were misused or compromised? ^S17S21

Imagine, for illustration, a service retaining an additional means of recovering keys for several accounts. An authorisation might concern only one account. The component carrying out the request must still protect all the others. It has to verify the requesting authority, authenticate its operator, restrict permissions, keep records, resist insider abuse and handle its own errors. Sharing that capability creates a common dependency. ^S17S23

The 2015 research report Keys Under Doormats examines this difficulty. Exceptional-access requirements add complexity, can undermine certain security properties and create targets concentrating sensitive information. The report is a technical risk analysis published before the French bill. It estimates neither the probability of a future intrusion in France nor its cost. ^S17

Capturing data from a device carries risks of its own. A tool used against a particular target may exploit a weakness present in many other devices. Its development, custody and deployment also require controls. Lawful Hacking, published in 2014, considers the implications of purchasing vulnerabilities and the possible misuse of the tools. The relevant comparison concerns the function added to a service, its potential for reuse and the dependencies it creates. ^S22

The European Court of Human Rights addressed the issue in Podchasov v. Russia, decided on 13 February 2024. In the Russian framework before it, the Court considered the consequences for all users of weakening end-to-end encryption and found a violation of Article 8. The judgment concerned that system for retaining and accessing communications, with its inadequate safeguards. Applying its reasoning to a French measure would require examining the particular measure and the controls surrounding it. ^S24

Method and scope

Conceptual model of an additional access capability relying on a shared component. The four account symbols aid explanation only: they measure neither victims, exposed accounts nor attack frequency. Authorisation targets one account, while the reach of a possible compromise depends on architecture and controls. No design is attributed to the French bill. Endpoint capture can also rely on a weakness present on multiple devices.

The American warning concerns infrastructure

Espionage against US telecommunications provides a concrete example of exposure. On 13 November 2024, the FBI and CISA announced that a campaign linked to the People’s Republic of China had compromised several telecommunications companies. Their statement described stolen call records, compromised private communications involving a limited number of targeted individuals, and copies of information subject to US law enforcement requests under court orders. Attribution to China is that of the US authorities. ^S18

These findings show the strategic value of networks and the surveillance-related information they handle. They establish that infrastructure and data were compromised. The statement does not demonstrate that attackers broke an end-to-end encryption protocol, or that the entire operation depended on a single lawful-access backdoor. ^S18

The security response is instructive. CISA recommends consistent use of end-to-end encrypted communications, with particular attention to people who face intensive targeting. Its initial mobile guidance appeared on 18 December 2024; the version dated 24 November 2025 strengthens precautions around private messaging. A public authority responsible for protecting infrastructure thus treats encryption as a way to reduce exposure. ^S19

The US case warrants examining concentrated access and the consequences of intrusion. It leaves the assessment of any future French mechanism open: that mechanism’s architecture would need to be described before a comparison could be made. The economic lesson concerns a dependency. An organisation can bear the consequences of a weakness at the intermediary carrying or processing its information. ^S18S21

The bill starts at the design stage

The first expense arises when an additional function must be built and maintained. Permissions have to be defined, procedures developed, failure conditions tested and secrets protected. The ability to change keys must be preserved. NIST’s key-management guidance covers this entire life cycle. Any added access capability has to be assessed within that wider system. ^S23

People and procedures are needed alongside the technology. Who receives a request? Who checks its legal basis and scope? Who has the necessary permissions? How is an account error handled, access revoked, or compliance with an authorisation demonstrated? These questions connect engineering with governance. As early as 2000, the IETF’s RFC 2804 highlighted the extra complexity of interception functions and the need to protect access to those functions. ^S21

Some costs might be reimbursed under the applicable legal framework. Article L. 871-1 leaves the conditions for state reimbursement of implementing its obligation to a decree. For the assistance systems covered by its own framework, Article D. 98-7 of the Postal and Electronic Communications Code provides for fair remuneration covering design, deployment, maintenance and the processing of requests, subject to its approval and funding arrangements. Reimbursement allocates the bill between the provider and the public budget. Commercial losses or damage associated with a different system would require a separate assessment. ^S10S13

The customer relationship follows. A business buys a service commitment, assurances and an allocation of responsibilities. If its supplier’s architecture or legal constraints change, it may need to revisit contracts, audits and the service’s suitability for the data entrusted to it. This is a possible economic mechanism; its significance depends on the imposed change and existing commitments. European requirements for managing supplier risk and securing data give that review a concrete basis. ^S14S25

Imagine an engineering consultancy exchanging an industrial design with a client. Its choice of messaging service depends partly on who can read the plans. If a new function lets a third party obtain the content, the team needs to reassess that assurance, identify the exchanges affected and decide whether to keep using the service. Audit time, a possible migration and staff training all require work, even without an intrusion. The review might conclude that the service remains suitable. It might also identify a gap between the new capability and the assurances on which the original choice depended. This hypothetical example illustrates how a technical change can feed through to a purchasing decision. The actual expense would depend on the added function and the alternatives available.

An incident would shift the spending again: investigation, containment, withdrawal of access, restoration of protections and compliance with applicable notification duties. Customers might have work of their own to carry out. The NIS2 Directive specifically includes incident handling, business continuity and supply-chain security among its risk-management measures. ^S14

The most lasting consequence could involve information already copied. Revoking a key or closing an access route may protect future exchanges. An intelligible copy obtained earlier remains usable by whoever holds it. For a business, the harm then depends on the content. A manufacturing secret, a negotiation, a customer file or material enabling fraud has different uses and a different period of value. These are loss scenarios to investigate case by case. ^S23S27

No defensible aggregate figure follows automatically from this chain. It would require a specified mechanism, implementation costs, the number of affected systems, the reach of a compromise and the losses avoided through investigations. A cost comparison must therefore begin with a consistent unit of analysis: a particular obligation applied to a defined set of services. Otherwise, apparently comparable figures may describe fundamentally different changes. A published average cost of cyberattacks would combine incidents with causes and scopes too different to measure the marginal effect of a backdoor. This investigation therefore retains the documented mechanisms and leaves the total unresolved.

Economic protection belongs within the security mandate

The NIS2 Directive requires covered entities to have policies and procedures on the use of cryptography and, where appropriate, encryption. Recital 98 encourages end-to-end encryption and calls for it to be reconciled with national security and investigative powers, in accordance with EU law. It also sets an explicit limit: this should not weaken end-to-end encryption. A recital helps interpret legislation; the operative duties must be read in the articles themselves. ^S14

That relationship calls for an assessment of specific measures. The European provisions preserve national competences and exclude certain activities. Describing NIS2 as a blanket ban on interception would go beyond the text. Treating cryptographic security as outside its purpose would overlook one of its express requirements. ^S14

For a business using a service, these demands can meet in a single procurement decision. The business must reduce exposure, understand its suppliers and protect its data, while its chosen provider may face duties to assist the authorities. Whether the obligations fit together depends on the precise architecture, assurances and controls. A service marketed as “sovereign” reveals little about those properties through that label alone.

An access capability could also provide a public benefit if it enabled investigators to obtain useful evidence in serious cases. Assessing that benefit would require knowing when it actually changes an investigation’s outcome, what alternatives are available and whether targets can shift their activities elsewhere. Europol and ENISA’s joint statement in 2016 acknowledged both the difficulty for investigations and the importance of strong encryption. It called for solutions that preserve collective security. ^S16

Counts of requests or interceptions describe activity. On their own, they do not measure the benefit of a new obligation imposed on an encrypted service. Nor does an additional technical capability guarantee effective use against every target. The analysis needs to compare defined mechanisms, each with its own benefits and risks. ^S21

Parliament needs to identify the capability being sought

The debate announced for November should show whether the Assembly keeps, changes or removes the protection in Article 16 bis. The bill’s subsequent passage between the two chambers and the final enacted text will then need to be followed. As of 7 November 2026, the outcome remains open. ^S01S02S04S08

The available documents support a more precise conclusion about the underlying question. A duty to assist must be tied to particular data, a capability actually held or an explicitly described technical change. That is the starting point for examining the reach of access, the dependencies it creates and how its economic consequences would be distributed. ^S10S17S21

The useful question for the chamber is therefore straightforward: what additional capability would have to be built, and which users would depend on it? A documented answer would allow the expected investigative gain to be weighed against the work and risk imposed on others. That is where the economic cost of a backdoor begins to become observable.

Reading guide

End-to-end encryption. Protection of content between the endpoints of a communication. Device security, copies and the identity of the participants remain critical. ^S16S19

Decryption information. The French legal expression convention de déchiffrement refers to the information needed to make encrypted data readable. Its availability and the ability to use it must be considered under the specific conditions of each legal provision. ^S10S11

Exceptional access and backdoors. A capability designed to let an authorised third party access otherwise protected data. Its architecture and risks vary; “backdoor” here refers to mechanisms that would weaken that protection. ^S17

Externality. A consequence of one party’s decision borne by others. In this analysis, the hypothesis to examine is that some technical risk is transferred to customers and to the people whose data pass through the service.

Method and limitations

This investigation brings together French parliamentary documents, legislation and primary technical publications consulted on 7 November 2026. Older sources are used for the mechanisms they describe, with their dates stated. Parliamentary information reflects the position documented at that cut-off. The graphics distinguish recorded votes, scheduled stages and conceptual models.

The material establishes public wording and positions. It provides neither access to secret operational systems nor a causal estimate of the investigative benefit or economic cost of exceptional access in France. The proposed cost chains are explicit inferences. US officials’ statements about the origin of the espionage campaign are attributed to those authorities. No interviews, penetration tests or encryption experiments are claimed.

One documentary discrepancy warrants a reservation. The page for amendment 358 is dated 3 October 2026, while its explanatory statement refers to activity during October 2026. The reviewed sources contain no public clarification of that mismatch. The volumes given in that passage are therefore excluded from the analysis. ^S02

Next: how encrypted communications protect economic activity, from the message itself to the copies and devices that retain it.

Further reading

The fifth part on hijacked access and damage distinguishes affected capabilities, recovery and the distribution of losses.

The fourth part on iCloud, borders and switching costs examines safeguards, contracts and migration planning.

The third part on state access to messages examines authorisation, technical capabilities, oversight and the allocation of costs.

The second part on messages, linked devices and backups follows a business secret and the means of recovering it.

The investigation into recovering funds after a cyberattack distinguishes access to information, freezing funds and returning them. The analysis of the US transition to post-quantum cryptography examines a separate security risk and the investment required to address it.

The sharing image is a conceptual illustration of additional access to protected messages. It represents the debated risk, without attributing a technical architecture to the bill.

Sources

1. S01 · Assemblée nationale · 2025-09-10 · Accessed 7 November 2026Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité : texte de commission n° 1779-A0
   Passages and scope

   Article 16 bis of committee bill 1779-A 0, filed 10 September 2025. Proposed safeguard concerning imposed technical measures intended to weaken security, master decryption keys and other mechanisms or processes. A bill under consideration, distinct from enacted law; the wording has competing interpretations.

   Additional primary document

2. S02 · Assemblée nationale / Gouvernement · 2026-10-03 · Accessed 7 November 2026Amendement gouvernemental n° 358 au projet de loi n° 1779 : suppression de l’article 16 bis
   Passages and scope

   Government amendment 358, filed 3 October 2026, still awaiting debate on 7 November. Deletes the entire article; its author invokes judicial and intelligence cooperation and a legislative-rider objection. The explanatory statement refers to activity during October 2026 despite its earlier filing date; those volumes are excluded. Deleting the safeguard specifies no new technical system.

3. S03 · Assemblée nationale · Accessed 7 November 2026Commission spéciale : réunion du mercredi 14 octobre 2026 au titre de l’article 88
   Passages and scope

   Meeting on 14 October 2026, 14:45–14:50. The committee endorsed six deletion amendments: 5, 66, 200, 358, 397 and 300. Under Rule 88, endorsement is separate from incorporation into the committee bill and a floor vote.

4. S04 · Assemblée nationale · Accessed 7 November 2026Ordre du jour de l’Assemblée nationale : conférence des présidents du 3 novembre 2026 et mise à jour annoncée le 4 novembre
   Passages and scope

   Order of business following the 3 November conference and the government’s 4 November letter. Page 1 schedules the bill’s consideration to start on Monday 9 November 2026 at 16:00. The linked PDF is updated over time; this is the schedule checked on 7 November, separate from evidence of a later sitting or vote.

5. S05 · Sénat · Accessed 7 November 2026Scrutin public n° 227 du 12 mars 2025 : amendement d’Olivier Cadic après l’article 16
   Passages and scope

   Recorded division 227 and proceedings of 12 March 2025: Cadic amendment 1 rectifié quinquies adopted, 181 in favour and 134 against. There were 315 votes for or against and 334 senators taking part, including 19 abstentions. The session year in the URL is separate from the event date. This is one stage of the bill’s passage.

   Additional primary document

6. S06 · Assemblée nationale · Accessed 7 November 2026Règlement de l’Assemblée nationale
   Passages and scope

   Rule 88(2): the committee accepts or rejects amendments without incorporating them into its proposals. Rule 90 addresses the committee text as the basis for floor consideration. Read alongside the specific meeting record S 03.

7. S07 · Assemblée nationale · 2025-09-05 · Accessed 7 November 2026Amendement CS358 de Philippe Latombe : ajout des mots « ou processus »
   Passages and scope

   Philippe Latombe’s CS 358, filed 5 September 2025 and adopted in committee on 9 September, adds the words meaning “or process”. It is separate from government amendment 358 of 2026. The author’s stated intention is distinct from judicial interpretation of the final wording.

8. S08 · Assemblée nationale · Accessed 7 November 2026Compte rendu de la deuxième séance du mercredi 4 novembre 2026
   Passages and scope

   Second sitting of 4 November 2026, change to the order of business. The government requests priority consideration of Article 16 bis on Tuesday 10 November after questions to the government, under Rule 95(5). An announced arrangement, separate from an adopted amendment or a later vote.

9. S10 · Légifrance · Accessed 7 November 2026Code de la sécurité intérieure : article L. 871-1
   Passages and scope

   Article L. 871-1, current version since 3 October 2015. Paragraph 1 concerns disclosure of decryption information; paragraph 2 allows providers to be required to perform decryption, with an inability exception for that implementation request. Paragraph 3 provides for rules on implementation and state financing. The conditions and recipients define its scope.

10. S11 · Légifrance · Accessed 7 November 2026Code pénal : article 434-15-2
    Passages and scope

    Article 434-15-2, current version since 5 June 2016. Concerns refusal to disclose or apply secret decryption information known to the person, under the prescribed judicial requisition and criminal scope. Knowledge of the information is a condition; a universal duty to redesign every encrypted service cannot be inferred.

11. S12 · Légifrance · Accessed 7 November 2026Code de procédure pénale : article 706-102-1
    Passages and scope

    Article 706-102-1, current version since 1 June 2019. Covers computer-data capture, including stored, displayed and entered data, under its procedural conditions and oversight. The law in force is distinct from its scheduled 2029 repeal. The technical reach depends on the endpoint tool actually used.

12. S13 · Légifrance · Accessed 7 November 2026Code des postes et des communications électroniques : article D. 98-7
    Passages and scope

    Article D. 98-7, current version since 4 November 2023. Paragraph III covers means for specified judicial and intelligence requests and their conditions. Paragraph IV provides for fair remuneration of studies, engineering, design, deployment, maintenance and request handling under the applicable approvals and financing arrangements. This regime does not establish general coverage of commercial losses.

    Additional primary document

13. S14 · European Parliament and Council / EUR-Lex · 2022-12-27 · Accessed 7 November 2026Directive (UE) 2022/2555 : NIS2
    Passages and scope

    NIS 2 Directive, Article 21 and recital 98. Risk management, incident response, continuity, supply-chain security and cryptography policies; supplier assessment and proportionate measures. Recital 98 encourages encryption and seeks consistency with national powers within EU law, while preserving end-to-end encryption. A recital informs interpretation; operative duties and exclusions require their own reading.

14. S16 · Europol and ENISA · Accessed 7 November 2026On lawful criminal investigation that respects 21st Century data protection : Europol and ENISA Joint Statement
    Passages and scope

    Complete two-page joint statement independently reviewed. Dated 20 May 2016, distinct from 25 May in the PDF filename. Discusses investigative needs, proportionality, collateral harm from weakening cryptographic mechanisms, endpoint alternatives and research preserving security. The agencies’ contribution is separate from a formal position of all EU institutions.

    Additional primary document

15. S17 · MIT Computer Science and Artificial Intelligence Laboratory · 2015-07-07 · Accessed 7 November 2026Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications
    Passages and scope

    MIT-CSAIL-TR-2015-026, complete report reviewed in an MIT-hosted author copy. Cover and repository date 6 July 2015; inner title and MIT announcement 7 July 2015. Executive summary, printed pages 2–3, discusses complex systems and concentrated access targets. Qualitative technical analysis, with no current French intrusion probability or aggregate cost estimate.

    Additional primary document

    Additional primary document

    Additional primary document

16. S18 · FBI and CISA · 2024-11-13 · Accessed 7 November 2026Joint Statement from FBI and CISA on the People’s Republic of China Targeting of Commercial Telecommunications Infrastructure
    Passages and scope

    Joint statement 13 November 2024, complete official CISA distribution independently reviewed. Confirms compromised telecom networks, call records, private communications of a limited targeted group and copied information subject to court orders. Attribution is to US authorities. It identifies neither a broken end-to-end encryption protocol nor one lawful-access backdoor as the entry point for the whole campaign.

    Additional primary document

17. S19 · CISA / official copy distributed by the US Government Publishing Office · 2025-11-24 · Accessed 7 November 2026Mobile Communications Best Practice Guidance : version 2
    Passages and scope

    Version 2 of the complete official five-page guidance reviewed through GovInfo. Version history:18 December 2024 and 24 November 2025. Page 1 gives the intended audience; page 2 covers end-to-end encryption, metadata, messaging precautions and linked devices. The security of the endpoint remains a separate requirement.

    Additional primary document

18. S21 · IETF / RFC Editor · 2000-05 · Accessed 7 November 2026RFC 2804 : IETF Policy on Wiretapping
    Passages and scope

    May 2000 informational RFC, full original text reviewed. Section 1, Summary position, covers additional protocol complexity and protecting access to interception functions; section 2 describes the Raven process. A historical technical-policy position, without a current attack probability or monetary cost estimate.

19. S22 · Northwestern Journal of Technology and Intellectual Property · 2014 · Accessed 7 November 2026Lawful Hacking
    Passages and scope

    Original journal abstract reviewed: Bellovin, Blaze, Clark and Landau, Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet,2014. Covers vulnerability-purchase markets, patching incentives and captured tools being repurposed. An abstract-level analysis, separate from an empirical assessment of every current tool or a monetary estimate for France.

20. S23 · NIST ; Elaine Barker · 2020-05-04 · Accessed 7 November 2026Recommendation for Key Management: Part 1 : General, Revision 5 (NIST SP 800-57 Part 1 Rev. 5)
    Passages and scope

    NIST SP 800-57 Part 1 Rev 5, final 4 May 2020. Original PDF and sections 5.3.3.2,5.5,8,9.1 and 9.3–9.5 reviewed: lifecycle, permissions, audit, recovery and shared-key compromise. General guidance, separate from an assessment or cost schedule for a French backdoor. Rev 6 was still listed as an initial public draft; the article uses the identified final historical source.

    Additional primary document

21. S24 · European Court of Human Rights / HUDOC · 2024-02-13 · Accessed 7 November 2026Podchasov c. Russie : requête n° 33696/19
    Passages and scope

    Original HUDOC judgment independently retrieved and paragraphs 76–81 reviewed. Judgment 13 February 2024; final 13 May 2024. Concerns the Russian retention, direct-access and decryption framework and its inadequate safeguards; Article 8 violation confirmed. Application to a French measure requires examining its particular design and safeguards, rather than treating the decision as an abstract ban on all targeted collection.

22. S25 · European Parliament and Council / EUR-Lex · 2016-05-04 · Accessed 7 November 2026Règlement (UE) 2016/679 : règlement général sur la protection des données
    Passages and scope

    GDPR, adopted 27 April 2016 and published 4 May 2016. Articles 28 and 32 reviewed for processor guarantees and processing security. Personal-data scope; no quantified migration cost or economic effect for every assistance duty is established.

23. S27 · CNIL · 2017-08-30 · Accessed 7 November 2026L’accès des autorités publiques aux données chiffrées
    Passages and scope

    Complete CNIL analysis 30 August 2017 reviewed. Covers accessible copies, information or means already available, endpoint collection and collective risks of backdoors/master keys. Historical institutional analysis, requiring service-specific scrutiny for current capabilities. ANSSI’s position is mentioned indirectly by CNIL, not verified from a separate ANSSI statement.

24. S30 · Assemblée nationale · 2025-02-28 · Accessed 7 November 2026Précédent narcotrafic : suppression de l’article 8 ter en commission et rejet de son rétablissement
    Passages and scope

    CL 312 was filed on 28 February 2025 and adopted on 6 March. On 20 March, recorded division 1102 rejected Marleix amendment 640 and identical proposals to restore Article 8 ter: 24 in favour, 119 against and six abstentions. The floor vote rejected restoration; the committee had already deleted the provision. This was a separate bill and scope.

    Additional primary document

    Additional primary document