A/75/123 Definition of standards of responsible behaviour: a major achievement France has established a set of mechanisms, through its national doctrine, governance arrangements and laws, to apply the norms of behaviour recommended in the reports of the Group of Governmental Experts, in particular the 2015 report (A/70/174). The information provided below is intended, without being exhaustive, to illustrate the ways in which France has sought to implement the norms. Norm (a): Consistent with the purposes of the United Nations, including to maintain international peace and security, States should cooperate in developing and applying measures to increase stability and security in the use of information and communications technologies (ICTs) and to prevent ICT practices that are acknowledged to be harmful or that may pose threats to international peace and security. France has taken a set of measures in response to this norm, in particular by consolidating a national cybersecurity strategy focused on defence, prevention, resilience and cooperation. In our strategic review of cyberdefence, issued in February 2018, 3 a doctrine for crisis management is established and our objectives are clarified. The French model, in which a distinction is made between institutions that are responsible for offensive capabilities and those that conduct defensive missions, is confirmed, and the diplomatic objective of developing confidence and stability in cyberspace is strongly affirmed. France is also establishing bilateral strategic dialogues with various partners on cybersecurity issues. It is also active in many forums for regional and international cooperation and coordination, as mentioned above. France has also recognized that it has the capacity to conduct defensive and offensive military operations in cyberspace in order to guarantee its national sovereignty, in strict compliance with national and international law. In order to ensure transparency and consistency, it made its doctrines accessible to as many people as possible in 2019 by publishing several documents on, among other things, military doctrine related to offensive cyberwarfare, and a white paper on international law applied to military operations in cyberspace. This desi re to clarify and share the country’s vision should make it possible to limit misunderstandings and uncertainties, and thus help to consolidate confidence and transparency in cyberspace. France encourages all other States to do the same. Norm (b): In case of ICT incidents, States should consider all relevant information, including the larger context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences. France has established the following crisis management procedures and national structures and policies in the event of a technology-related incident: – An interministerial crisis cell, deployed in the event of a major crisis; – A cybercrisis coordination centre that meets every month and comprises technical or operational layers and a high-level, interministerial, strategic layer whose members analyse cyberincidents in a broader context, evaluate their consequences and may consider attribution. For France, the attribution of an attack and the decision to make that attribution public are sovereign prerogatives. __________________ 3 20-08285 Available at www.sgdsn.gouv.fr/uploads/2018/02/20180206-np-revue-cyber-public-v3.3publication.pdf. 33/84