Paris braces for a barrage of cyberattacks

The Summer Olympics kicking off in Paris next month are set to bring more than 10,000 athletes and an estimated 15 million spectators to the French capital. Officials hope to keep sports on center stage, but behind the scenes, they’ve been fending off threats, including threats of cyberattack.

French President Emmanuel Macron has been pretty blunt about where those cyberattacks might stem from. In April, he told reporters he had “no doubt whatsoever” that Russia would target the Games.  

Russia’s athletes are barred from competing under the nation’s flag after its invasion of Ukraine.

In recent years, several Olympic host cities have faced and mostly managed cyberattacks, but as Antoaneta Roussi, cybersecurity reporter at Politico, tells Marketplace’s Lily Jamali, this year could be worse.

The following is an edited transcript of their conversation.

Antoaneta Roussi: During the Tokyo Olympics, which was held during the COVID-19 pandemic and, as we all remember, the world was constrained, they saw something like 450 million attacks. And that was considered small.

Lily Jamali: Four hundred and fifty million is small?

Roussi: Yeah, so you can only imagine the magnitude or the scale of the expected attacks in Paris. So, the most basic sort of cyberattack is a DDoS attack, which stands for “distributed denial of service.” And that is literally just so much traffic being targeted at a website that it collapses. So, the officials are expecting those kinds of attacks, which are relatively harmless. I mean, it’s an annoyance, for example, if the app of the Olympic Games or for the main Paris Olympics website goes down, but it’s not going to cause any real harm, and generally within a few hours, those attacks are usually confronted or prevented.

Jamali: But are there concerns that some cyberattacks could lead to actual physical violence or a disaster?

Roussi: Yeah. So, I spoke with the head of cybersecurity for the Paris Olympic committee, a man named Franz Regul, and he said he really hopes he’s not the first cybersecurity official for the Olympic Games that faces a cyberterrorist event. And what that means is essentially a cyberattack coordinated with a physical attack on the ground. So, for example, something like the surveillance cameras of a specific game or a specific event like the opening ceremony all go out at once, and so security officials don’t have visibility. And at the same time, there is an actual terrorist attack or an act of violence.

Jamali: So, what is France doing to prepare for potential cyberattacks? What do we know about that?

Roussi: France has been preparing for the last four years, and specifically the cybersecurity agency, which is abbreviated as ANSSI, has been preparing for cyberattacks for the last two years. And it’s been performing “pen tests,” which are penetration tests. These tests are literally cybersecurity officials attempting to penetrate the various websites or apps or whatever it is.

Jamali: So they’re testing their own system?

Roussi: Exactly. And then they’ve been raising awareness with different entities that will be involved in the Olympics. So, we’re talking critical infrastructure like energy, transport and airports, but also they’ve had a campaign for citizens and business owners, because the drawback of any major event in this geopolitical context right now is that France as a country could also be targeted. And I think what officials were afraid about is that business owners aren’t really aware of that. So, they’ve been trying to raise awareness, they’ve been trying to test their own security, and they seem confident. The French government did face sort of a mass attack in March. A hacker group attacked a critical network infrastructure that connects all the ministries on a network, and everything went down at the same time. That lasted 48 hours. And that was quite lengthy for France, which is a country very well developed in cybersecurity. But the head of ANSSI said to me that it was a test that went OK for us. And he said the goal is not to block 100% of the attacks that will happen during the Olympics. They weren’t able to block this one against the French ministries. But the goal is to block the most harmful attacks and raise the security level overall.

Jamali: Sticking with this issue of what’s being done to prepare, you’ve also written about how the French Parliament approved a bill recently that allows the experimental use of large-scale, real-time camera systems supported by algorithms that they say is supposed to spot suspicious behavior. This would be a first in Europe, but it sounds like it could potentially violate the [European Union’s] new AI rulebook. Is that right?

Roussi: Right. So, the French government published an executive order providing details on how AI-powered surveillance cameras and drones would work. And it’s been in line with the Parliament approving a controversial bill that allows this experimental use of large-scale, real-time camera systems to spot suspicious behavior during the Olympics. The system is set to be in place until March 2025, but what digital rights groups are afraid of is that, in fact, once it’s operated, it will be very hard to, to remove it following its installation. But yeah, it’s caused a stir within France and within Europe because it’s not exactly in line with the AI Act, but it’s also has rubbed privacy advocates the wrong way. And as you know, Europe is much more privacy-oriented than other places.

Jamali: Let’s talk about what we know in terms of where these threats are coming from. Have French officials talked about what kinds of actors they deem the biggest threat?

Roussi: French cyberofficials have talked about the threat actors, and they believe Russia to be the greatest threat actor in terms of cyberattacks. Of course, in terms of physical attacks, there has been a renewed threat of Islamic terrorist groups, especially following the Moscow concert hall attack earlier this year. After that, the French state was placed in sort of an emergency level vis-à-vis terrorism. The 2018 Winter Olympic cyberattack that happened in South Korea was attributed to Russia by U.K. and U.S. governments, although the Russian Foreign Ministry did deny it back then. But given the geopolitical context that we live in right now, with the ongoing war in Ukraine and the violence that’s happening in the Middle East, it could be a number of actors. It could be Iranians for France’s support of Israel, it could be Chinese hackers, who are very proficient and operate in more cyberespionage terms. Right now, you also have a lot of cybercriminals that are opportunistic and try to gain financial rewards from their attacks.

Jamali: And is there a sense that France’s role on the global political stage, being a stalwart of the West, makes them more of a target for these kinds of attacks?

Roussi: Yeah, for sure. France is a big geopolitical player and has taken strong positions in both conflicts, and they’re holding such a high-profile event at such a tumultuous moment in history. I think France is putting on a brave face, but I think that security officials are really concerned about what they will face during the Olympics.

More on this

President Macron had promised an extravaganza at the opening ceremony of this year’s Olympics, envisioned as a “moment of beauty, art and celebration of sports,” but potential threats from drones to automated weapons have made it an ordeal to plan.

For months, there’s been talk of moving the ceremony from a stretch of the Seine River running through Paris to a more conventional and easier-to-control setting like a stadium.

The possibility of a less ambitious opening ceremony is still on the table, although the French are sticking with Plan A for now.