The French government debuts Tchap, its messaging app with end-to-end encryption, and open sources the code; a security flaw has already been found and patched
Context & Ripple Effects
Tchap is the delivery vehicle for a plan France announced a year earlier, when it said it was building its own encrypted messenger to fend off state-level espionage amid President Macron's inner circle's fondness for Telegram (that 2018 commitment). Launching it as open source is the credibility play: publishing the code invites exactly the kind of public scrutiny that surfaced the flaw now patched before wider rollout.
The stakes show up later in the arc: France eventually moved to push staff off Signal, WhatsApp, and Telegram entirely (the prime minister's December 2023 uninstall order pointed at Olvid instead), and Tchap itself remained a target years on (a 2026 breach via a hijacked user account). This debut is the first move in a sovereignty strategy that runs through all of it.
First-order effects
- French civil servants gain a domestically controlled end-to-end encrypted channel, reducing reliance on Telegram and other foreign apps for sensitive internal communication.
- Open-sourcing the code means independent researchers can audit Tchap immediately — and did, finding the flaw that was patched at launch.
Second-order effects
- Foreign messaging providers lose a high-profile government customer segment in France, foreshadowing the later directive to uninstall Signal, WhatsApp, and Telegram on official devices.
- Other European governments weighing sovereign communications tools get a reusable, auditable codebase instead of building from scratch.
Third-order effects
- If the pattern holds, state-built encrypted infrastructure becomes the default for government communications, while foreign E2EE platforms face both commercial displacement and legal pressure — a posture France later extended to prosecuting Telegram's CEO over its cryptology practices.
- Open-sourced state cryptography shifts trust from vendor promises to verifiable code, setting an expectation that government-grade encryption must be publicly inspectable.
The trend: Governments are replacing foreign encrypted messengers with sovereign, open-source alternatives they can audit, host, and legally defend on their own terms.