Protecting Canada and improving cyber defence: three challenges

Everyone wants a piece of cyber—everyone wants to talk about it, to make it part of their mandate, add it as a consideration, or make it a focus. Cyber can be tricky to define; it can be a national security problem, a law enforcement focus, a defence challenge, and an opportunity to advance foreign policy and set norms, among other goals. Many actors are involved in this dynamic space of defining, considering, and using cyber in Canada. These actors bring their own motivations, capabilities, and aspirations to the table. From within the government, they can include law enforcement, intelligence, public safety, defence, and foreign affairs departments and agencies. Outside of the government, these actors can include the private sector, civil society groups, academia, and individuals. The space is also interwoven with international connections, partnerships, and motivations outside of domestic borders. These actors and their goals for their role in cyber create complexity and some uncertainty. Yet, this complexity makes sense in some ways. Now more than ever, many different types of activities happen online. From a defence perspective, these complexities, uncertainties, and activities can also include cyber threats. Currently, Canada addresses cyber threats through the Communications Security Establishment (CSE) (including the Canadian Centre for Cyber Security) and the Department of National Defence (DND)/Canadian Armed Forces (CAF). The CAF’s main cyber unit is the Canadian Forces Network Operations Centre (CFNOC). CSE, the Cyber Centre, DND/CAF, and CFNOC also work with domestic partners to protect Canada from cyber threats. This may sound straightforward, but consider the mandates, missions, and capabilities of each of these actors and it gets complicated again. Even if the CSE Act, the Strong, Secure, Engaged: Canada’s Defence Policy (SSE), and the National Cyber Security Strategy define the missions, mandates, and responsibilities of cyber defence activities in Canada, there are still challenges to protecting Canada. Three main challenges to protecting Canada and improving cyber defence stand out. The first challenge is the changing threat environment; cyber threats are persistent, and they can be asymmetric, conventional, and subversive. The low barriers to engaging in cyber activities make it easier for adversarial actors to use cyber attacks to inflict damage. This damage may not necessarily result in loss of life or physical damage and thus operates outside of the threshold of war. Still, the impacts of cyber attacks can be significant. Adding to this, cyber attacks can be difficult to attribute actors and intentions, further complicating the responses and the abilities of responders. The second challenge is ‘Cold War mentalities’ about threats and technologies. Part of this mentality is thinking that ‘great power’ states are the only actors involved in conflicts. Sometimes the so-called bipolarity of the Cold War gets mixed in with current discussions about cyber conflicts. Multi-polar, bipolar, unipolar, and everything-polar assumes that all actors within states have the same strategy in mind. It also does not fully appreciate the role that other actors (like the private sector) play in this space, or even ‘collaborating’ national departments. The over fixation with technologies is also a problem. Like fixating too much on nuclear weapons and military hardware, and not enough on the diversity of cyber-related and emerging technologies of their uses, users, and capabilities, this mentality simplifies a complex and dynamic threat environment. Finally, the third challenge to improving cyber defence in Canada is making a ‘whole-of-government’ or ‘whole-of-society’ approach work. Both assume that coordination of initiatives and engagement with stakeholders are needed to address challenges. Both SSE and the National Cyber Security Strategy call for increased cooperation with domestic and international partners, but this may look different in real life. Put another way: too many cooks in the kitchen might result in an unbalanced and poorly paired meal. Roles and responsibilities need to be defined, budgets aligned, and meaningful participation and accountability ensured. And this is just at the federal level. Canada is not immune to cyber attacks. These attacks can and do occur. The next iterations of defence policy should consider these three challenges areas in proactively protecting Canada and improving cyber defence. Kristen Csenkey is a PhD candidate at the Balsillie School of International Affairs in Waterloo and a fellow at the Canadian Global Affairs Institute. The Hill Times