The Canadian Armed Forces (CAF) needs to be ready to “fight for its freedom of action in cyberspace” amidst a “transformational” change in information technology, a newly released internal document reads.
The 2016 document laid out the Canadian Armed Forces views in approaching “cyber warfare” – a field of operations that had been facing increasing scrutiny at the time, amid high-profile global hacks and interference allegations, including operations conducted solely through computer systems as well as cyber tools deployed to assist conventional military operations.
Its release comes as Global News has learned of an independent review of the Communications Security Establishment’s (CSE) use of “active” cyber measures is expected in the coming weeks. Alongside the military, CSE is the only government agency explicitly authorized to conduct what are often referred to as cyber attacks.
The 2016 document warned that Canada’s military had a “relatively poor” understanding of the long-term impacts of the increasing use of cyber operations in modern warfare.
“Friendly access to, and use of cyberspace is not only potentially contestable – but actively contested,” the document read. “In addition, as militaries have discovered their vulnerabilities in cyberspace they have come to discover those of their adversaries. The cyber domain is contested, and the CAF can expect to have its operations resisted through military cyber operations.”
The document was released under access to information law and reviewed by Global News.
It offers insight into the CAF’s “doctrine” at the time when it comes to cyber-warfare – now considered a key domain of fighting war alongside more traditional land, maritime and air operations, in particular after Russia’s invasion of Ukraine targeted the country’s critical infrastructure networks.
And the document outlines concerns that Canada was already falling behind allies in its approach to cyber operations, even though the force felt it was “too early” in 2016 to draft a “rigid” cyber warfare doctrine.
The CAF is one of two organizations in the Canadian government that is authorized to carry out what are often referred to as “offensive” cyber operations. CSE was explicitly granted that power under the Liberals and has publicly confirmed it has conducted those operations in recent years.
Where is cyber warfare happening now?
The use of cyber operations in war and conflict has increased since the 2016 document was circulated within the CAF. The starkest example of the use of cyber tools alongside conventional warfare has been Russia’s ongoing invasion of Ukraine.
Canada and its allies have accused Moscow of repeated and sustained cyber attacks, both in connection with the conflict and on Western countries who have supported Kyiv’s war efforts.
While the document repeatedly stresses that cyber defence is paramount, the uncensored pages are less clear on Canada’s approach to conducting offensive cyber attacks – both in peacetime and during actual conflict.
In a statement of principles in 2022, the Canadian government outlined how it views cyber operations in the context of international law. In general, according to the statement, Canada would weigh the severity of a cyber operation in the same manner it would a physical attack.
For instance, a bomb could destroy a factory’s power source and halt production, but so could a cyber attack. Either action could “amount to a violation of the rule of territorial sovereignty with respect to the affected State.”
The statement notes that all publicly reported state cyber operations to date have generally been viewed as falling below the threshold of “armed conflict.”
The 2016 CAF document sets out its own preliminary classification for cyber operations ranging from the relatively minor “cyber security event” to “cyber fire” – lethal or non-lethal actions that “seek to create first-order effects against a target’s capability.”
Speaking at a defence conference in Ottawa Thursday, Defence Minister Bill Blair highlighted the CAF’s assistance to Ukranian forces in defending networks against Russian aggression.
“We’re also bringing our cyber expertise to our NATO allies, including in Latvia, where we’ve deployed military and civilian personnel to help protect critical networks there,” Blair told the audience at the Ottawa Conference on Security and Defence.
“And in fact, a report that was published by the British House of Commons Intelligence and Security Committee stated that Canada is, with the U.K., and I quote ‘at the head of the pack’ on cybersecurity.”
While that may be true, the CAF has faced severe recruitment and retention issues in recent years. On Thursday, CBC News reported that the CAF’s combat readiness is getting worse, with only 58 per cent of the Forces able to respond if a crisis was called by NATO allies.
The news outlet quoted an internal December 2023 document that stated “where demand for the CAF is increasing, our readiness is decreasing.”
“If what you have been doing for decades is no longer working for you, you can’t just keep doing it. Over the past three years, more people have left than have entered (the CAF),” Blair said to Global News parliamentary bureau chief Mercedes Stephenson on Thursday.
“That is, frankly, a death spiral for the Canadian Armed Forces. We cannot afford to continue on that pace. We’ve got to do something differently.”
Blair has called for more defence spending in recent months. The next federal budget – potentially the Liberal government’s last before a general election – is scheduled to be released on April 16.