How can we protect our scientific and technical potential?

What are the main objectives of your mission?

Philippe Boulanger : In October 2022, I took over the task of coordinating the PPST working group set up at Sorbonne University ten months earlier. It covers four main functions. The first is to identify the priority actions to be taken and the resources to be mobilized to secure the research and training activities of twelve Sorbonne Université laboratories classified as PPST by the Ministry of Higher Education, Research and Innovation (MESRI). The second is to contact unit directors to discuss their research culture, the identity of their laboratory and the risks to which they are exposed. The third is to raise their awareness of the PPST by working on understanding the different areas of reflection and orientation dedicated to this field. And the last is to propose concrete recommendations to laboratory managers, the President of the University and her advisors

As a PPST project manager, I work closely with Sorbonne University's Defense Security Officer and his team. This group is the representative of the High Official for Defense and Security, who heads the MESRI Defense and Security Division. This unit includes a college of experts who designate the laboratories that must undergo PPST.

Can you explain the risks of foreign capture and interference in university activities?

Various reports by the French Senate and National Assembly, as well as studies by the Ministry of the Interior, provide detailed information on these risks. Directives issued by the General Secretariat for Defense and National Security also help us to understand the risks we face in terms of technological capture and foreign interference. The Senate's information report on "extra-European state influences in the French university and academic world and their impact", published in September 2021, reveals the ability of an external state to disseminate ideas and ways of thinking that run counter to our values by constructing an attractive discourse and narrative. The humanities and social sciences are particularly targeted. The report also exposes the risk of capturing sensitive scientific data and know-how, and the modes of intrusion into laboratories, with concrete examples from Australia, Canada, the United States and Europe.

Synonymous with espionage, technological capture involves clandestinely recording innovations, processes and work cultures for the benefit of a foreign power or player. In concrete terms, it involves taking photographs of sensitive or confidential documents, copying algorithms, illegally recording data, and so on.

While technology capture can take place over a very short period of time, foreign interference takes place over a long period of time. It tends to seek to influence our behavior by going against our democratic and academic values. This can take the form of ideological or political orientation, in order to transform minds without the use of force. The best way to combat these forms of influence from foreign powers is to develop the critical spirit, dialogue and exchange, respect for others, transparency, collegiality and diversity that are at the heart of our university culture.

How to secure research and training activities while maintaining international exchanges?

P. B.: Since the publication of the Interministerial Circular on PPST in November 2012, MESRI has been proposing a number of measures to help us protect ourselves, create a community of trust and adopt best practices.  
The working group I'm coordinating has retained six fundamental principles to think about implementing protection while ensuring the continuation of activities with as few constraints as possible.

The first is to strike the right balance between the constraints imposed by the PPST, whether ethical or material, and the resources available to Sorbonne University. The second is to get the research community to adhere to standards and best practices against interference and technological capture in PPST laboratories. The third is to gradually adopt these protection measures at a pace adapted to each laboratory. The fourth is to create a climate of trust to ensure that these measures are properly accepted and applied. The fifth is to designate professional skills, based on the security of premises, IT protection, management of administrative files, and management of research and international cooperation files. The last principle aims to improve knowledge of risks, threats and vulnerabilities in terms of PPST in each laboratory, so as to be in a position to deal with them.

Could you share a few examples of actions or measures that Sorbonne University would like to put in place to strengthen the security of research and education?

P. B.: Our recommendations focus on three major areas, all of which are fundamental guidelines for implementation. In terms of administrative management, there must be perfect consistency in actions and procedures between laboratory directors, the Defense Security Officer and Sorbonne University's administrative departments.

As far as IT protection is concerned, the working group proposed a dozen best practices drawn from official sources, but also from the advice of our experts within Sorbonne Université. These include the issue of data sharing, the creation of an internal communications platform for all laboratories classified as PPST, the protection of information when traveling abroad, the technical capabilities for implementing IT security, the identification of sensitive information, for example.

The final section deals with premises management and security. In particular, this means focusing not on the whole laboratory space, which can extend to dozens of rooms spread over different floors, but on a few relevant areas that need to be secured.

How do you plan to involve the university community in these security efforts?

P. B.:The implementation of the PPST depends on a good understanding of the issue, and on finding the right balance between protection and the pursuit of activities with the least possible constraints, depending on the researcher's activities. The first step is to train and raise awareness in the research community. The work of the working group showed that two levels needed to be taken into account: that which applies to all laboratories classified as PPST, and that which only concerns the laboratory in terms of its own research identity and work culture.

In terms of collective standards for all laboratories classified as PPST, we would like to set up a training session aimed at everyone from PhD students to senior lecturers. Delivered by a group of trainers from Sorbonne Université and an external network, this training would cover practical cases of protection (the use of a USB key, for example), major geopolitical risks (in economic intelligence, for example) and protection tools adapted to laboratories in the form of workshops.

In addition to these collective standards, individual standards specific to each laboratory are proposed, such as the organization of a training session on protection specific to the uses of the laboratory concerned.

The aim of this awareness-raising effort is not only to involve members of the community, but also to create a space of trust, exchange and sharing of information to promote our own protection. The aim is not to apply regulations without thinking, but to make everyone understand the importance of protecting themselves in an increasingly tense and uncertain geopolitical context.