CSEC summer report also a bummer


 Posted on June 28th, 2025 –

The annual Communications Security Establishment Canada report for 2024 to 2025 mentions Toronto a few times but mostly as an afterthought. I still think it’s worth a look though. You can download the report here or read it online.

It begins with an assurance by current Chief Caroline Xavier (she/her) that:

Equity, diversity, inclusion and accessibility inform everything we do and are essential to helping us deliver our mission.

Thank goodness I’m not running the place because my decisions would likely be informed by shit like effectiveness and adherence to/promotion of the Establishment’s mission:

The Communications Security Establishment Canada is Canada’s agency responsible for foreign signals intelligence, cyber operations, and cyber security.

We gather foreign signals intelligence to defend Canada’s national security. We keep the Government of Canada’s information secure. We work with industry and academia to protect Canadians from cyber threats.

Oddly, on page 46 under the sub-heading “Inclusivity in our external representation” (part of the “CSE is Growing and Learning” section), it is noted that:

We worked hard this year to embed EDIA into every facet of our work … including pronouns and a land acknowledgement

Yet there’s nary a land acknowledgement to be found in the entire report! Begs the question, if CSIS can do it then why can’t CSEC?

But not to worry, out of the 56 page report (of which 17 pages are fluff like full-page photos, decorative graphics, and section titles), CSEC has dedicated 4 full pages (plus generous sprinklings elsewhere), to advertising its initiatives on equity, diversity, inclusivity, and accessibility.

So if an acknowledgement or two slip through the cracks then … you know … shit happens. But I can see how shit like this can happen when I read things like:

Our diversity—whether in our backgrounds, skills, talents or motivations—is our strength.

Bringing in people with differing backgrounds, skills, and talents at a superficial level seems like a good idea but am I the only one to suspect that differing “motivations” could be somewhat problematic? Like, would it be considered a sufficiently diverse motivation if an applicant openly wished to destroy CSEC from within?

Maybe a uniquely diverse dearth of motivation is what produced the dearth of land acknowledgements in the report.

But let’s put all that aside for a moment and summarize what else the Establishment gets up to in their spare time. In late 2024 the report claims that CSEC detected and disrupted a foreign ransomware group within 48 hours. Also in 2024 CSEC boasts of helping to take RT off the air in Canada and of assisting in thwarting some botnets. In addition they spent some time providing intel for the military:

This year, we delivered timely intelligence for many named operations, including operations UNIFIER, REASSURANCE and HORIZON.

A number of the same foreign targets of CSEC are the same as those entities targeted by CSIS, namely:

  • the PRC’s expansive and aggressive cyber program presents the most sophisticated and active state cyber threat to Canada today
  • Russia’s cyber program furthers Moscow’s ambitions to confront and destabilize Canada and our allies
  • Iran uses its cyber program to coerce, harass and repress its opponents, while managing escalation risks

While CSEC openly assists the governments of Ukraine and Latvia, domestically they seem more interested in keeping tabs on people:

In 2024 to 2025, following a series of cyber incidents targeting northern institutions, and with the Minister’s authorization, the Cyber Centre began proactively deploying sensors to territorial government IT assets in Yukon, the Northwest Territories and Nunavut. These sensors detect malicious cyber activity in devices at the network perimeter and in the cloud. They are one of the Cyber Centre’s most important tools for defending systems of importance to the Government of Canada

Some people will say that these actions only target government infrastructure and help to increase security but those same people must also admit that simultaneously spreading the attack surface decreases security:

CSE operates Canada’s Top Secret Network (CTSN), a secure IT network used to collaborate and communicate at the Top Secret level. This year, CSE supported major site expansions for existing CTSN clients, including the National Security and Intelligence Review Agency (NSIRA), PCO, Justice Canada and the RCMP, resulting in a 20% increase of deployed endpoints. In the upcoming year, CSE will onboard 3 new government departments to CTSN:

  • Environment and Climate Change Canada
  • Public Prosecution Service of Canada
  • Office of the Commissioner of Canada Elections

Why does Environment and Climate Change need access to top secret information? Maybe it’s for the same reasons that the government Covid jab contracts remain mostly secret.

Other than producing a lot of digital paperwork and giving presentations, it doesn’t seem like CSEC is very involved in most operational matters. Given how often the government ignores even this diminished function of the Establishment does not paint a rosy picture.

Between CSIS’ covert complaints and CSEC’s diverse distractions I don’t think it’s any wonder that Canada’s secret security apparatus relies heavily on the Five Eyes.

That being said, I’m pretty sure that it’s not the priority of the US, UK, Australia, or New Zealand to keep Canadians safe so I don’t find these or other partnerships reassuring. Something to keep in mind as the summer simmers and international intrigues increase.

Comments are closed.