***

Science and technology were making great strides at the end
of the nineteenth century, to the point where we were beginning to discover
problems with the reality we thought we lived in. Newtonian physics does a
great job of describing what we see around us, but it turns out this is an
illusion created by the scale at which we operate. It’s like thinking the earth
is flat because it looks that way, but it only looks that way because we’re not
big enough to see it; reality is in the eye of the beholder.

What we discovered as we looked closer with better
technology was that the universe isn’t a deterministic machine. The double slit
experiment caused great confusion because it looked like light was both a wave
and a particle. Rutherford’s gold foil experiment suggested that the recently
discovered atom was almost entirely empty space. Most of what you breathe in is
vacuum! The universe is much stranger than we first thought, and it isn’t
deterministic at all, but very much probabilistic. Einstein hated this ‘spooky
action at a distance’ quantum nonsense, but through the 20^th Century
we’ve come to understand that this is how the universe works.  Most people don’t know this because education
finds teaching science in a Newtonian way easier. Professor Brian Cox has a
good quote in his book, The
Quantum Universe: “It’s not Newton for big things and quantum for small
things, it’s quantum all the way.”

This emerging quantum awareness created the first quantum
revolution. Once we recognized that quantum effects happen around us all the
time, we started designing technology that made use of these newly discovered natural
phenomena. If you think this is only for exotic university labs, you’re wrong. The
flash memory that you’re likely reading this through depends on quantum
tunnelling to work, as do lasers, MRIs and super conductors.

So, what’s all this talk about quantum computing and what
the heck does this have to do with cybersecurity? In the 1970s many researchers
started theorizing about quantum computing and Richard Feynman put it together
in the early 80s, then the race was on to build the theory. What’s the
difference between this and passive 20^th Century quantum technology?
We’ve developed the technology and theory now to engineer quantum outcomes
rather than just using what nature gives us. As you might imagine, this is
incredibly difficult.

I had an intense chat with Dr. Shohini Ghose, the CTO of the
Quantum Algorithms
Institute at the end of our quantum cybersecurity readiness training day
this week in BC. She was (quite rightly) adamant that we can’t know quantum
details without observing them and when we observe them, we change them, but my
philosophy background has me thinking that I’m going to try anyway. An
unobserved universe is entirely probabilistic. It only becomes the reality we
see when we perceive it. It reminds me of the crying angels in my favourite Doctor Who episode.
This bakes most people’s noodles, but the math clearly indicates that in
measuring a photon’s location we can’t also know its velocity and direction –
that’s the uncertainty
principle in action. I’m probably wrong about all of that, but I’d rather
people take a swing at understanding this strangeness rather than being afraid
of being wrong.

Alright, we’re halfway through this thing and you haven’t
mentioned anything cyber once! If you think about the electronic systems we
use, they’re entirely Newtonian. They reduce information to ones and zeroes and
produce the kind of certainty we all like, but this is a low-resolution approach
that is about to hit its limit. We’re building transistors so small now that electrons
are tunnelling through the nanometer thick walls (atoms are mainly empty space,
remember?) between transistors, rendering future miniaturization impossible;
we’re nearing the limits of our Newtonian illusion. That means the end of
Moore’s Law! Panic in the disco!

Quantum computers don’t use electronics as a common base. A
quantum computer processor might be ionized particles, or photons, or nanotech engineered
superconductors, and those are just a few of the options. By isolating these
tiny pieces of the cosmos away from the chaos of creation and applying energy
to them in incredibly intricate ways, we can create probability engines that
use astonishing mathematics to calculate solutions to problems that linear
electronic machines could never touch, but unlike classic computers we need to
do this without observing the process or all is lost. Imagine if you had to
design the first microprocessors in the dark and you’re a fraction of the way
towards understanding how difficult it is to build a quantum computer, but it’s
happening!

We’re currently in what’s called the NISQ (noisy
intermediate scale quantum) computing stage. We’re still struggling with
applying just enough energy to get a particle to polarize how we want it to,
all while keeping the noise (heat, radiation) of reality out. That’s why you
see quantum computers in those big cylinders as a chandelier. The cylinders are
radiation shields and containers to cool everything down to near absolute zero
(gotta keep that thermal noise out), and the chandelier is to keep the electronic
noise of the control systems (old school electronics) away from the quantum
processor.

My favourite quote from the PhDs I’ve talked to is, “a
viable quantum computer is five years out. And if I’m wrong, it’s four years.”
What does that mean for ICT types? Quantum computers don’t do linear. When you
give them a problem, they leverage that state of being everywhere at once to
produce massively parallel computing outcomes completely foreign to what we’re
familiar with in our multi-core processors. Quantum algorithms are designed to
blackbox the calculation, so observation doesn’t spoil quantum processes and
then spit out answers as probabilities.

What does that mean for cybersecurity? Peter Shor came up
with an elegant idea in the mid-90s that uses a Quantum Fourier Transformation
to calculate the periodicity in prime number factoring. If you can calculate
the period of two large, factored primes (there is a repeating pattern), you
can reverse engineer those primes. In RSA encryption or anything else that uses
factoring you could calculate the private key and tear apart the encrypted
transport layer handshakes rendering secure internet traffic a thing of the
past. From there you could imitate banks or governments or simply decrypt
traffic without anyone knowing you’re there. You won’t see cybercriminals doing
this because the tech’s too tough, but nation states will, though you won’t see
them either because they will be quietly collecting all of that encrypted
online data Imitation Game
style. This process may already have begun with harvest now, decrypt later (HNDL).

There is much more to quantum technologies in cybersecurity
than the encryption panic though. Recent research suggests that instead of running
into limits with electron tunnelling in transistors, our new quantum 2.0
engineering could leverage this quantum effect to create Qtransistors
magnitudes smaller and much faster than what we have now. Cybersecurity will
have to integrate that technology as it evolves. Quantum communication is
another challenge. NIST
is making mathematical quantum resistant algorithms as I type this, but you
could also leverage quantum entanglement itself to create quantum key encryption.
China has an entire network of satellites testing these hack proof comms links
now. There could be quantum locked portions of the internet in 15 years where
high security traffic goes. Guess who is going to have to manage those secure networks.

If you’re in cybersecurity there is much more to quantum
than panicking about encryption. Anyone in the field would be well served by
digging in and researching this fascinating technological emergence. My
colleague, Louise Turner, and I presented at the Atlantic Security Convention
on this in April. Give
our presentation a look. There are lots of links to fascinating resources.
It’s time to free your mind, Neo.

We have the resources, cooperation is what’s missing.

In the year since I’ve been working to establish connections between the many entities in Canada’s cybersecurity industry intent on education and career pathways illumination, but what I’ve found are siloed organizations (private, public and NFP) fixated on IP and market share whose idea of collaboration is creating partnerships to defeat what they perceive as competition. This isn’t collaboration so much as it’s about combining resources to compete more effectively.

Creating A Canadian Cybersecurity Ecosystem (Oct ’22)

How Cybersecurity Might Become More Diverse, Equitable and Inclusive (Dec ’22)

You Want to Teach WHAT?!? Reconfiguring Technology in Schools to Empower Pedagogy (Oct ’23)

Cyber Education in Canada is Broken, Here’s How to Fix It (Nov ’23)

***

The majority of attacks are US focused, but if you consider Canada has 1/10th the people, we actually face similar numbers of attacks per capita.

One of the ways I’ve escaped Canada’s siloed approach to, well, pretty much everything, is to look internationally for organizations interested in working collaboratively on the cyber-problem. That would be the one where we put all our critical infrastructure onto a global network that was never designed to be secure and then struggle with wave after wave of increasingly automated cyber-attacks in an environment where the attack surface has become impossibly complicated post COVID.

I started by looking at the World Economic Forum’s review of the new US Cyber-Strategy, which is focusing on protecting critical infrastructure and improving collaboration both domestically and internationally to create more effective cyber-defences. Canada’s strategy is designed to encourage competition rather than collaboration and has resulted in our being one of the most targeted countries globally. 

The US strategy seems to be aware of this North American predilection for relentless market dominance fixated competition and is attempting to put resources into a collaborative mindset. That approach became apparent to me when I attended the Global Conference on Cyber Capacity Building this fall.

***

Through looking into WEF and the UN I came across the Global Forum for Cybersecurity Excellence (GFCE). In June I pitched this proposal on helping cybersecurity practitioners become aware of the coming threats to encryption that quantum computing brings: GFCE Proposal – Cybersecurity in the Age of Quantum Advantage.docx. The elevator pitch is: quantum computing will break most of the encryption standards we depend on for everything from our online financial systems to military communications in the next decade, and likely much sooner.

The GFCE got back to me and said they felt that quantum awareness was an important piece of the puzzle and a good fit with their Global Conference on Cyber Capacity Building (GC3B) happening in Accra, Ghana at the end of November. They invited me to develop the research and present it at the event.. I’m currently seconded with both ICTC working on cyber-education outreach and the Quantum Algorithms Institute developing education for quantum readiness. QAI supported this research and I got in touch with Louise Turner, a former student now in the inaugural cohort of cybersecurity at Queens University, and she and I put the paper together.

While doing two jobs I beavered away on the paper in the background and Louise (who was juggling her third year course load) and I managed to get the paper in on time. While all that was going on we were both jumping through the hoops in terms of visas and medical requirements to take what would be both of our first trips to Africa.

It all came together at the end of November and we found ourselves at Pearson Airport in Toronto getting on a plane to Washington and then across the Atlantic to Accra. The entire process felt insurmountable, but I’ve found that if you chip away at seemingly monumental projects like this you get the pieces in place – just don’t expect it to happen all at once and pace yourself.

A particular frustration was all the dead ends I chased in terms of finding support for both the research and going to the event itself. I was disappointed to not get support from organizations I have long relationships with who claim to champion just this sort of digital engagement. I went out of my way to attend academic events, but when I asked any of my contacts in those organizations about support, I found the doors firmly closed. Every form of federal support is safely locked to academic partnerships in a way that makes it impossible for anyone but an internal PhD to claim them; those Canadian silos are exceptionally good at taking care of themselves. I talked to many professors in a multitude of schools but they all disappeared back into their funded, tenured worlds after making noises about how important this kind of work is. That’s ok, we did it ourselves.

***

It was snaining in Toronto when we left, but on the ground in Ghana after 12 hours of misery in a middle seat next to the only guy bigger than me on the plane (why don’t airlines use smart tech to arrange seating better?), we found ourselves on the ground in Africa! The VISA support by the Ghanese government had been spectacular in Canada and the hospitality was just as special at the Accra Airport. A senior military officer ushered us through customs in seconds and out to the GC3B desk where we got connected to our hotel and suddenly found ourselves tearing through Accra traffic, stunned by the sights and sounds… and heat (Accra is only 600kms north of the equator)!

 

The conference flags were all around the city. From our anonymity in Canada, we suddenly found ourselves at a very welcoming international event.

The Accra City Hotel was where we’d been put up for the conference and was only a ten minute drive from the very fancy Kempinski Hotel where the conference was taking place. We had lunch and then collapsed in our rooms for the afternoon after over 24 hours on the road.

The week before we’d built a powerpoint: QAI GFCE cyber in the age of quantum research presentation.pptx that was designed to gently introduce cybersecurity policy and technical practitioners to quantum computing. We went over it after our afternoon naps on the pool deck in the sweltering heat and humidity of an Accra evening. Louise helped pioneer women in cybersecurity in our school back in 2018/19 when she was in grade 10 and I’ve known her ever since, so we knew each other’s strengths and felt ready to go with the presentation the next morning. That night we had a fantastic Ghanan buffet and then hit the hay.

Since we were presenting on the periphery of the main conference we got to meet the Global Forum for Cyber Excellence working groups who were the organizers of the research presentations. This gave us ‘behind the scenes’ access to the conference before the main event kicked off the next day. It quickly became apparent that the research presentations needed more time to do them justice. We heard from researchers from all over the world studying everything from regionally specific cyber challenges to international projects on how cyber is presented in the media – to call it fascinating would be an understatement.

Louise and I stepped up for our presentation and knocked it out of the park. We’d de-tuned the technical details in it (Louise was happy to get into explaining how lattice based mathematical encryption actually works), but the GFCE was keen to focus on making it an introduction to quantum computing and how it will change cyber practices in the next few years. My being a teacher was considered a benefit in introducing this technology that is often obscured by academics fixating on its technical complexities. To ensure equitable access we focused on ensuring everyone had access to publicly available research that would assist them in further exploring the technology. This is an area where Canada excels – putting publicly available material online for anyone in the world to access, so we made good use of the many Canadian cyber and quantum resources available.

We must have done well because we were the only presentation who was asked questions by the reviewer running the event and we ended up late to lunch because we had a line of attendees wanting to ask further questions. There is a lot of curiosity out there around quantum technologies but not a lot of people developing accessible education for the public; it tends to be an academically isolated industry.

The rest of that first day at the Global Conference on Cyber Capacity Building was fascinating because it wasn’t really about the conference, but instead about the mechanics of the GFCE. By the time we were heading back to the hotel I felt like I’d found my tribe and was determined to see what else I could do with them. This was the collaboration and mutually supportive approach to cyber that I’d been missing.

I use Twitter as a way to bookmark ideas and resources so I can find them later when I’m building one of these blog posts. My feed from the conference probably tells the story better than a summary here, but to say it was engaging and eye opening would be underselling it. The GC3B worked every angle from policy and diplomacy to technical cooperation and regional partnerships all the way through to international collaboration. It changed the way I see cybersecurity because it moved me beyond the veiled, siloed and somewhat paranoid world of Canadian cyber.

Kwame Nkrumah Mausoleum in Accra – well worth a visit.

On the bus ride over (which was an adventure in itself – African commuter buses have drop down seats so the bus is shoulder to shoulder in every row without an exit aisle), I was at a loss to understand how we appeared to be the only Canadians at an international conference where over 100 countries were in attendance. The US State Department had helped fund the event, as had the EU, and we’d met Australians and many other Commonwealth nationalities, but not a single Canadian. The Australian told us about how her government’s local office had picked her up at the airport, taken her out for lunch and made sure she was OK at her hotel. Ours sent us a PDF of things to do in Accra.

All of this prompted me ask the Swede sitting next to me how Canada is seen in the international community. I’d honestly expected to hear nice things and assumed we’d simply not been involved in all the clandestine activities of our government at this event, but that’s not what came out. The Swede described Canadian participation in world cyber cooperation to be ‘selfish and minimalist’, which came as a shock despite what I’d observed (it’s a teacher survival mechanism to ignore the worst and assume it’s my misunderstanding). The Estonian in front of us chipped in with, “I think Canada asks what the minimum is to look like they are involved in a project, give it and then that’s the last we hear from them.” Attendees from a dozen other countries all nodded in agreement. I did the most Canadian thing imaginable and apologized for my government and all the organizations that are funded by it – even though they’d all ignored my own requests for support prior to the event.

***

As I floated into the pool later that night pondering how I’m going to dress for the final day of the conference with a suit jacket soaked through with sweat (I went with just a shirt for the final day), I found that I wasn’t cowed by what seems to be an insurmountable cultural problem we face as a country. Internally we have the resources and education to make cybersecurity a viable pathway. Canada should be poised to help solve the world’s cyber-skills shortage, but instead our plan is to (as it has been in so many other cases) take that talent from other places that need it for our own ends, and do as little as possible to support international cyber development to ensure an equitable digital transformation for all.

I’m a fan of Paul Theroux’s travel books. His trip across Oceania ends in Hawaii where he stays at one of the top resorts that is staggeringly expensive. Over the week he finds it coddling and restful, but he comes to the conclusion that when people have money, they mainly use it to keep other people away. The fancy resort provided privacy and a lack of bother from others – that was its main purpose and where the money got spent. Canada is a wealthy country and it seems we use our wealth in much the same way, to isolate ourselves from others. It’s not very flattering.

Over 100 countries in attendance. Didn’t see a single Canadian in any of the dozens of presentations and none were presenting. I know for a fact that Canada has some of the top cybersecurity practitioners on the planet, but they don’t like to share?

***

I arrived at the last day of the conference with a head full of thoughts. This lack of engagement by my country (at least in person, evidently Canada was one of the first to endorse the Accra Call) suggested that the lack of cooperation I see domestically is reflected in our international engagement too. My background and interest is in educational engagement with cybersecurity and other emerging technologies that I feel are essential to students making smart decisions about their futures, so to end the conference I attended Session 4.26: Thinking out of the box to inspire a new generation of cybersecurity talent:

  

You might not have watched that video, but this sort of brainstorming and mutual support is just what we need if we’re going to produce a cybersecure future. This doesn’t happen behind closed doors or at a distance. I hear a lot of Canadians talking about the Canadian government as though it’s distinct from them. This cool distance creates problems with how Canadians understand their own country and their role in it, but this distance also freezes out possibilities for international collaboration, which must be about more than sending money.

I had a great chat in that session on developing cyber talent with a young man from Ghana who had started off as a hacker before coming over to the defenders. He described that journey, especially in a place where you can’t drink the water and social services are often non-existent, as difficult because the payouts for being a bad guy are always going to be better. To hear people who are living in what Canadians would consider poverty talking about how they can work together to create equitable digital transformation that will improve standards of living for all was inspiring. You’d have to be the worst kid of self-serving bureaucratic robot to think otherwise.

***

On the final morning we reconvened at the Kempinski and ended the conference with many promises of future work together. It was inspiring and I couldn’t help but get a bit teary, especially when they included the presentation awards for Ghana’s Student National Cybersecurity Competition…

An all-female team won Ghana’s student cybersecurity challenge!

Having been deeply involved in Canada’s student cybersecurity competition since its inception, I was interested to see this presentation. Some stats for comparison:

Ghana has 475 high schools, 50 participated in the national student cybersecurity competition, that’s an 11% participation rate. You might think that low but Canada is currently at 0.6% of high schools participating nationally in CyberTitan has been running for six years (the Ghanan CCS is in its third year). The siloed nature of Canada’s regionalized education system (we are the only developed country in the world without a national education strategy) has a lot to do with that.

An all-girl team won the 2023 edition of their SCC. No all-girl team in Canada has ever come close, which makes for an interesting comparison on access to STEM education opportunities between the two countries. If money is used to keep people at a distance, male dominance in cybersecurity is certainly operating along similar lines in Canada. There is much to do in terms of gender equity in the Canadian tech ecosystem.

There were two ministers and other members of parliament at the awards celebration for these students. No member of Canadian parliament, minister or not, has ever attended CyberTitan nationals. Another example of our remote/arms-length governing? At the very least it highlighted the lack of value we seem to place on securing our critical infrastructure in a digital future that will increasingly depend upon it.

***

On the long plane ride home I was reflective. Was it easy doing this thing? Not at all. I spent a lot of time talking myself out of it for various reasons, and burned a lot of cycles trying (unsuccessfully) to find support to do it. Without Louise coming on and helping carry the research load, I think I may well have talked myself out of going, and what a shame that would have been.

Winnie knows how it feels. Whoever is doing Xmas decorating at Dulles is a bit… chaotic in their approach, but I like it!

Doing the research outside of my regular working hours wasn’t easy, and managing the many logistical requirements both medical and paperwork wise was also a heavy load to carry, but it’s these extras that I always get the most out of in my work. If you look at my LinkedIn you won’t see me bragging about the work I’m paid to do, but rather the projects I chase beyond those expectations. At the end of the day I’m mission driven. After twenty-years in the classroom and building one of the most successful digital skilling programs in Canada in the most unlikely of places, I want to take what I’ve learned and spark opportunities like that nationally, so more Canadian students can access emerging technologies and make informed decisions about where to go next. That this is a struggle continues to baffle me, but I’m committed to climbing that mountain.

Regrets? None. This wasn’t easy but that’s exactly why we need people to put the work in and make this sort of connection happen. Am I frustrated by Canada’s approach? Yes, but that too is a challenge rather than a loss, and one that we will overcome with vision and determination.

With a renewed commitment we will see a meaningful Canadian presence at the next Global Conference on Cyber Capacity Building taking place in Geneva in two years. I intend to be working with the GFCE by then in their education working group if not elsewhere in the organization. I hope I can bring more Canadians into it too.

Kintsugi has played a part in my motorcycling.

There is another term in Japanese that takes the derision found in English out of making old things work. I’ve long enjoyed the concept of ‘kintsugi‘ or ‘golden joinery’, which is the repairing of old things using gold to embellish the fix rather than trying to hide it. In typical Japanese fashion it raises what is seen as banal work in the West to an artform. A concept that combines jugaad’s celebration of a fix beyond rules based approaches with kintsugi’s raising of that fix to an artform is where a good candidate for work in cybersecurity should find themselves inspired. When I started in cyber I found my  IT background helped in terms of understanding the mechanics of what was happening, but my kintsugi powered jugaad approach is what has allowed me to thrive.