← Back to Library

Canada fighting “billions” of attacks a day, cyber agency says

This piece cuts through the fog of national security secrecy to reveal a startling reality: Canada is under siege by billions of digital attacks every single day, yet the agency defending the nation operates largely in the shadows. Wesley Wark's interview with Communications Security Establishment (CSE) chief Caroline Xavier doesn't just list threats; it exposes how the very architecture of Canadian democracy and industry has become a battlefield for state-sponsored actors and criminal syndicates. For the busy reader, the takeaway is immediate and unsettling: the invisible war for data is already costing millions, and the stakes have never been higher.

The Invisible War Room

Wark frames the CSE not as a relic of the Cold War, but as a rapidly evolving entity that has had to reinvent itself to survive the digital age. He notes that the agency's origins stretch back to 1941 with the Examination Unit, a civilian bureau created to break enemy codes during the Second World War. This historical context is crucial; it reminds us that the Five Eyes alliance, which includes Canada, the US, and the UK, was born from the necessity of decoding foreign communications. Today, that mission has expanded exponentially.

Canada fighting “billions” of attacks a day, cyber agency says

The Walrus writes, "Today, we block billions of malicious actions daily, respond to thousands of cyber incidents annually, and issue pre-ransomware alerts that save Canadian organizations millions of dollars." This statistic is the anchor of the piece, grounding abstract fears in concrete, daily reality. It suggests that the agency is not merely reacting to disasters but is actively intercepting them before they cause harm. However, the sheer volume of these interceptions implies a system under constant, overwhelming pressure. The argument that the CSE is a "world-class authority" holds weight when you consider they prevented up to $18 million in losses last year alone through proactive alerts.

"The most persistent threat? Ransomware. It remains the most pervasive cybercrime affecting Canadians. The attacks are not just costly; they can cripple essential services like health care, energy, and transportation, putting lives and livelihoods at risk."

This quote lands with particular gravity because it shifts the conversation from financial loss to human safety. The Walrus effectively argues that cybercrime is no longer just a nuisance for IT departments; it is a direct threat to the physical well-being of the population. Critics might note that while the CSE highlights these successes, the decentralized nature of Canadian infrastructure means that many municipal and provincial systems remain vulnerable, creating weak links that a single breach could exploit. The piece acknowledges this, noting that "our critical infrastructure is often decentralized, managed at provincial and municipal levels, which can result in inconsistent cybersecurity standards."

The Double-Edged Sword of AI

One of the most compelling sections of the interview addresses the role of artificial intelligence. Wark does not shy away from the complexity of the issue, presenting AI as both a shield and a sword. The administration and the executive branch are increasingly reliant on these tools, yet the same technology is being weaponized by adversaries.

The Walrus puts it, "Malicious actors, including state-sponsored groups, are using AI to supercharge cyberattacks. From crafting convincing phishing campaigns to automating vulnerability scans and spreading disinformation, AI is amplifying the scale and sophistication of threats." This is a critical insight. It suggests that the speed of modern warfare has outpaced traditional defense mechanisms. The agency's ability to use machine learning to "spot anomalies in massive data streams" is a necessary countermeasure, but the article rightly points out that this is an arms race where the enemy is also evolving.

The coverage also touches on the weaponization of AI in the realm of democracy. "Our 2025 update on threats to Canada's democratic process highlights how AI is being weaponized to spread disinformation, harass public figures, and interfere with elections." This is a sobering reminder that the integrity of the voting process is now a primary target. The CSE's role here is delicate; as Xavier clarifies, "CSE does not monitor domestic communications or social media." Instead, they work through the Security and Intelligence Threats to Elections Task Force to identify foreign interference without infringing on civil liberties. This distinction is vital for maintaining public trust in a surveillance-adjacent agency.

Sovereignty and Global Conflict

The piece expands its scope beyond domestic defense to Canada's role in global conflicts, specifically the war in Ukraine and the security of the Arctic. Wark highlights how the CSE has provided satellite communications and actionable intelligence to support Ukraine, a move that aligns with Canada's broader foreign policy objectives.

The Walrus writes, "We've worked closely with domestic partners and international allies to provide actionable intelligence and cyber defence capabilities to protect both Canadian and Ukrainian interests." This demonstrates the interconnectedness of modern security; a cyberattack on a NATO ally is effectively a threat to Canadian sovereignty. The agency's work in the Arctic is equally significant, with "196 intelligence reports on Arctic security" shared in the past year alone to monitor Russian activity. This reinforces the idea that the CSE is not just a digital police force but a key player in continental defense and geopolitical strategy.

However, the article also touches on the controversial expansion of the CSE's powers. In 2019, legislation granted the agency the authority to conduct "active and defensive cyber operations." The Walrus notes that this means they can "do more than simply collect and report on these threats. We also take action to degrade the ability of foreign actors who would do us harm." While the agency insists these operations are strictly limited to foreign targets and subject to independent review, the concept of an intelligence agency actively disrupting foreign networks raises questions about escalation and accountability. A counterargument worth considering is whether such active operations might inadvertently draw Canada into conflicts or provoke retaliatory attacks on domestic soil.

Bottom Line

Wark's coverage succeeds in demystifying the CSE, transforming it from a shadowy entity into a critical, albeit overstretched, pillar of national resilience. The strongest part of the argument is its emphasis on the human cost of cyber warfare, particularly the threat ransomware poses to healthcare and energy. The biggest vulnerability, however, lies in the gap between the CSE's sophisticated capabilities and the fragmented cybersecurity standards of the private and municipal sectors it is tasked to protect. As the administration continues to grapple with the dual-use nature of AI and the rising assertiveness of state-sponsored actors, the reader should watch closely for how the government balances active cyber defense with the preservation of civil liberties and international stability.

Deep Dives

Explore these related deep dives:

  • Five Eyes

    The article mentions Canada's membership in Five Eyes as a key factor in its cyber vulnerability. Understanding the history, structure, and intelligence-sharing arrangements of this alliance provides essential context for why Canada faces heightened cyber threats from adversaries.

  • Communications Security Establishment

    The entire article is an interview with the CSE chief, yet many readers may not know the agency's full history, legal authorities, or how it compares to NSA/GCHQ. The Wikipedia article covers its wartime origins, controversies, and evolution into a cyber operations agency.

  • Ransomware

    Described as 'the most pervasive cybercrime affecting Canadians,' understanding the technical mechanics of ransomware, notable attacks like WannaCry and Colonial Pipeline, and the criminal ecosystem behind it would deepen readers' understanding of this threat.

Sources

Canada fighting “billions” of attacks a day, cyber agency says

by The Walrus · · Read full article

Hailshadow/iStock

This story was originally published on thewalrus.ca

By Wesley Wark

The annual reports from Communications Security Establishment Canada make for unexpectedly good reading. In recent years, the intelligence and cybersecurity agency has intercepted foreign espionage efforts, extremist networks, cybercriminal crews, and sprawling disinformation campaigns. The newest edition recounts how, in 2024, its units shut down a ransomware threat aimed at a Canadian industrial sector in only forty-eight hours.

The CSE patrols a vast digital turf, its most critical work largely invisible to the public. But as it prepares to turn eighty, the organization’s role has never been more central, with Canada’s most basic systems—from energy infrastructure to elections—now prime targets for adversaries.

CSE origins stretch back to 1941, when Canada created the Examination Unit (XU), the country’s first civilian bureau devoted to breaking and protecting coded communications. During the war, the XU decrypted enemy messages and forged intelligence relationships that would later anchor today’s Five Eyes alliance. The bureau’s success convinced Ottawa that understanding foreign networks was strategically indispensable, and, in 1946, the Communications Branch of the National Research Council was established—what we now know as CSE.

In the conversation that follows, I spoke to CSE chief Caroline Xavier, by email, about that legacy and the challenges facing the agency today.

You can’t share stories from thewalrus.ca on Facebook or Instagram because of Meta’s response to the Online News Act, but you can share this Substack article there.

Looking back, what would you say are the biggest changes that have affected the organization?

From its earliest days, CSE has operated behind the scenes. As technology evolved, so did CSE. We embraced computing early, becoming Canada’s largest supercomputer user by the mid-1990s. The fall of the Berlin Wall and the end of the Cold War challenged us to redefine our mission. We responded by expanding our workforce, recruiting linguists, engineers, and computer scientists, and fostering a more diverse and multidisciplinary organization.

The events of 9/11 reshaped global security, and CSE’s role was formally recognized under Canada’s Anti-Terrorism Act. In 2011, we became a stand-alone agency. And in 2019, the CSE Act expanded our mandate to include active and defensive foreign cyber operations. Another major milestone came in 2018 with the launch of our Canadian Centre for Cyber Security, or Cyber Centre. This unites cyber experts from across government, and has positioned us as a world-class authority on cybersecurity, defending Government ...