Who can authorise a cyber operation in Europe?

Article L2321-2 allows state services to act when an attack targets systems on which France’s military or economic potential, security or survival depends. They may access the systems from which the attack originates to establish what is happening and neutralise its effects. The Prime Minister sets the conditions for using this power.

Defence Code, article L2321-2

The Chief of the Defence Staff commands military operations under the authority of the President and the government. France’s joint cyber command (COMCYBER) plans and coordinates offensive military cyber operations under the Chief’s orders. The public doctrine says the appropriate decision-maker must accept the risks. It leaves open which official signed off any particular operation.

Defence Code, article R*3121-1 · Armed Forces Ministry, public doctrine on offensive cyber operations (PDF)

ANSSI, France’s national cybersecurity agency, is a service of the Prime Minister. Its civilian role includes coordinating the defence of critical networks and organising help for victims of cyberattacks.

ANSSI’s place in government · ANSSI’s missions

The Federal Intelligence Service (BND) collects and analyses foreign intelligence for the federal government. Its statutory remit matters because Germany allocates separate responsibilities to its police and civilian cybersecurity agencies.

BND Act, section 1

Under the intelligence reform passed on 13 November, the head of the BND or their deputy would issue a time-limited framework order for extended intelligence measures. The Independent Control Council would review the lawfulness of the order in advance. The BND would immediately notify the Bundestag’s Parliamentary Oversight Panel of the order. That notification gives parliament oversight of the framework.

Bundestag vote · Bill, sections 49–51 · Adopted changes to section 96

A separate bill passed on 12 November concerns federal police powers and the Federal Office for Information Security (BSI). It addresses the BSI’s role in IT security and the respective responsibilities of the Federal Criminal Police Office and the Federal Police.

Bundestag vote · Federal government’s account

Formal promulgation remains to be verified for both measures. The intelligence reform gives 31 December 2026 as its general commencement date. The police and cybersecurity bill specifies the day after promulgation.

Intelligence reform, article 24 · Cybersecurity commencement clause · Adopted renumbering

Ukraine’s cybersecurity law already assigns the Ministry of Defence and the General Staff responsibilities for preparing the state to defend itself in cyberspace. Its Armed Forces already include Signals and Cybersecurity Troops.

Law 2163-VIII, article 8 · Defence Ministry on the existing troops

Parliament describes bill 12349 as placing the proposed Cyber Forces under the direct command of the Commander-in-Chief of the Armed Forces. The President, as Supreme Commander-in-Chief, would coordinate their political direction. That identifies the chain of command. Who signs off an individual operation remains an open question in the public record reviewed here.

Parliament’s explanation of the bill

Parliament approved the bill at first reading on 9 October 2025. A comparison text for the second reading was provided on 9 March 2026. The next milestone is a second-reading decision by the full parliament.

Official history of bill 12349 · McCyber on Ukraine’s volunteer hackers