It’s a War Out There – Mechanical Sympathy

In the beginning of July the Communications Security Establishment (CSE-CST) produced two news briefs that many Canadians remain oblivious to. On July 9th a warning was published describing a Russian government backed foreign interference project that uses artificial intelligence to create false social media output from many different countries designed as propaganda for Russian state interests. By using these tools Russia hopes to direct national discourse in democratic countries, including Canada, in its favour.

The day before, on July 8th, CSE posted a warning about Chinese state sponsored cyber intrusions across public and private networks in many countries, including Canada, designed to give the Peoples Republic access to sensitive state and industry data. What is most concerning about these warnings is that they aren’t unique, they aren’t even rare.

We have come to depend on networked digital information in all aspects of our lives. For many this means social media on their phones, but our dependence on networked digital information runs far deeper than that. Essential systems like the power grid and water supply (and regular classroom activities) are managed through networked digital systems, as are our supply chains. This offers us tremendous opportunities for efficiency and oversight, but it also brings with it the danger of cyber-attack, and not by the stereotypical lone hoodied hacker.

Incredibly, in 2024 most Canadian schools do not teach any cybersecurity education at all. With the exception of New Brunswick there is no curriculum in Canada that even mentions cybersecurity. This has put us in a difficult situation as Canada faces a generational shortage of cyber-talent. But the real danger isn’t our failure to get students interested in working in the field, it’s the apathy and ignorance Canadians seem to revel in.

The vast majority of successful cyber-attacks depend on user ignorance to find a way in. Canadian defensive technologies are world class, but if the people using them are dangerously oblivious, that’s where the opportunity for abuse lies, which is why Russian and Chinese government organizations are focusing their attention there. If you want to destabilize a democracy, you create division in its people, and with most people going online wearing a blind fold of apathetic ignorance, it’s the easiest opportunity.

If you provided your military with state-of-the-art weapons but didn’t train any of them in how to use them, you wouldn’t have a very effective fighting force, yet that is how we approach cyber-readiness in Canada. Connected digital technologies have become central to most aspects of life, yet the vast majority of Canadians take no responsibility for the dangers these digital opportunities present.

Meanwhile, countries with vested interests in Canadian destabilization have created enormous offensive cyber-attack groups. China’s offensive cyber military arm – just their offensive cyber personnel – number more than the entire Canadian Armed Forces. But the threat doesn’t end there. In addition to large cyber-military capabilities, many foreign powers have also hired private companies to conduct foreign cyber-espionage. If you think the threats we face online are lone hackers trying to make a buck or two you’ve failed to grasp how cyber operations have evolved in the past decade.

Allied Western powers have built defensive systems in partnership with industry, but our ability to perform cyber-attacks on the scale that Russia and China do is anything but equal. If this were a ‘hot’ war the map would be dominated by those countries while Western responses are minimal in response. Unlike a conventional war, there would be no lines with safe zones behind them. In cyber-warfare you see malevolent skirmishes happening in every region of Canada; nowhere is safe because connected infrastructure is everywhere.

Around the edges of these state sponsored cyber-attacks partner organizations are leveraging similar tools for cyber-crime, often in an effort to fund the state sponsored attacks. The ransomware attack your company just paid to try and resolve may well be going to fund the next round of state sponsored digital violence.

Thinking that this is all someone else’s problem is one of Canada’s greatest weaknesses. ‘Loose lips sink ships’ was a common reminder during World War Two. It reminded people that you never knew who is listening and that your blabbing may well get people killed. The Twenty-First Century equivalent is ‘careless clicks can hack everything you depend on.’ Not as catchy, but terrifying.

One of the scariest parts of attending a cybersecurity conference is listening to the people trying to hold Canada together talking about how razor thin that line is. I’ve heard people who are defending against these wildly asymmetrical attacks say things like, “I’m amazed the lights are still on”, and “in the next five years we will have a cyber-attack that takes out critical infrastructure for weeks at a time.” Perhaps when we’re all sitting in the cold and dark wondering what happened we’ll also start to wonder why we didn’t so something about it when we had the opportunity.

Saying it’s a war out there isn’t hyperbole. Thanks to artificial intelligence many cyber attacks have become fully automated. These A.I. automated attacks iterate their approaches allowing even the most digitally illiterate criminals access to leading edge cyber incursion tools, and many foreign powers are more than happy to support that chaos for their own ends.

What’s a democracy to do? Start taking cyber-education and digital citizenship seriously. Instead of graduating students that only add to the cyber skills gap, we should be making all students (and the families they come home to every day) aware of this secret war we’re all on the battlefield of every time we pick up a device and access the interwebs. How many times have you amplified a social media post that may well have been written by a Russian A.I. bot with the intent to damage Canadian interests? Time to stand up to this hidden war.

I presented on using state of the art cloud based cyber simulation to teach essential cyber skills at the Serious Play Conference at UofT Mississauga this month. We have the tools to address the cyber-literacy gap in Canada and make our country cyber-secure, we just have to make using them in classrooms a priority.

You can sign up for CyberTItan now – it’s Canada’s biggest student cybersecurity competition. There are divisions for middle and high school students and youth groups can all join up. Teams are 4-6 students and you learn real world defensive cyber skills. Support is also provided if you need mentors. www.cybertitan.ca

Want to read more?

Why State-Sponsored Cyber Attacks are a Global Threat