As in any investigation, he explained, the decision does not rest on a single element, but on a body of evidence: IP addresses, code in which traces in Farsi were reportedly found, a modus operandi and tools already observed in the group identified in the C4 report.
Being able to identify precisely the people behind an attack demonstrates, he indicated, the strength of French identification capabilities, their level of confidence and a potential capacity for retaliation.
The question, he continued, is whether France will respond in the same way, through a cyberdefense operation against this group, by annihilating it, for example.
This public designation is rare in French doctrine. It targets not only a state, but also a unit and named individuals.
One of the major challenges of cyberspace remains anonymization: in general, it is not known exactly who is behind an attack, nor which people are involved.
Mr. Goldstein linked this approach to a 2019 announcement by General Lecointre, then chief of the defense staff: France had developed attribution capabilities intended to strengthen offensive cyber operations and, henceforth, to strike back in a certain way.
"It is very rare for France to name a country directly,"said Mr. Goldstein, who recalled this principle on franceinfo. According to the framework set out by franceinfo, Iran is now accused by France of being behind the hacking of connected supermarket refrigerators. The aim of the attack was not, according to him, criminal, but rather to strike public opinion and obtain a media effect. That is how the attack was able to be detected.
It is this body of evidence, combined with a level of confidence that the French state considers high, that in his view authorizes such a direct public attribution.