The latest Canadian Cyber in Context Cyber News Rewire is now out. It’s been a busy week with talk of amendments on Bill C-22 and the introduction of Bill C-34, Canada’s attempt to ban social media for children, and much more. www.cyberincontext.ca/p/canadian-c...

Just wait until compute power also faces export controls.

The Government of Canada is running an AI and Cybersecurity course for IT-classified employees through the GC Digital Talent platform. talent.canada.ca/en/it-traini...

If DND/CAF had secret cloud, this would be less of a concern. Except we also currently rely on US secret cloud and cloud based command and control in NORAD. Once again, government simply doesn't understand cyber or information infrastructure. www.cbc.ca/news/politic...

Foundations of Digital Sovereignty: Chapter 6 If Canada is serious about increasing our sovereign cloud capacity, government procurement is by far the most powerful tool at our disposal. canadianshieldinstitute.ca/latest-updat...

NEW: malware developers added nuclear & biological weapons text to to their spyware. Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner. Cleanest practical example I can think of for why over-indexing on first order "safety" is risky. 1/

Most of my law practice is advising technology companies expanding their markets, into or out of Canada. If Bill C-22 Lawful Access passes, "Made In Canada" will mean "Backdoored", significantly harming the international market for Canadian technology products and services.

My thanks to Quinn Henderson for speaking with me for this story. My understatement of the century: "It's not instilling a lot of trust." www.readthepeak.com/p/why-are-se...

“Palantir is first of all a dehumanizing company. It is a terrifying company because of the amount of political and financial support it has.” Gift link:

Amnesty is recruiting a Technologist in their team researching digital surveillance abuse, this is an amazing position in an amazing team. Location is limited to a few places and deadline is really soon careers.amnesty.org/jobs/vacancy...

The latest Canadian Cyber in Context Canadian Cyber News Rewire is now available. The Government’s new AI Strategy has dropped and everyone but the AI companies are unhappy. Beyond this, ongoing coverage of Bill C-22 and other news. www.cyberincontext.ca/p/canadian-c...

Canadian employers are paying the price after AI proves unable to replace laid off staff www.theglobeandmail.com/business/car...

I've played enough Shadowrun for this to make total sense.

Thank you @aballinga.bsky.social for speaking with me about risks related to DND's Palantir contract. Why was this a sole-source contract? We're focusing on the contract itself, but why did CAFSOFCOM think Palantir was the only one that could do this? www.thestar.com/politics/fed...

The Department of National Defence kept secret how much it paid for a contract with the controversial American tech company Palantir, according to newly released documents that show the deal was worth $30 million more than the government disclosed to Parliament www.thestar.com/politics/fed...

Apparently shitposting about Palantir leads to three interviews with journalists.

It would certainly be swell if the government of Canada stopped releasing terrible policies and strategies related to cyber security and digital policies. I already have too much to write about.

Thanks to @kehyslop.bsky.social for talking with me about some of the digital sovereignty and digital protection concerns related to the Vancouver School Board's plan to introduce Copilot for students. A great article, highly recommend reading it.

Today we're publishing Chapter 5 of our policy series on digital sovereignty. This week we're looking at cloud security, and the way that foreign powers can interfere with Canadian data. canadianshieldinstitute.ca/latest-updat...

I mentioned this in an interview yesterday. Much of the case for the push for AI in Canada rests on a productivity argument. And so far that argument is largely built on faith.

The Sweden’s Armed Forces are voicing their concern in their new cloud strategy regarding reliance on the US tech giants for cloud services due to FISA and the Cloud Act www.svt.se/nyheter/inri...

What's happening at MSRC now belatedly confirms the rumors from 1-2 years ago when a bunch of security researchers who left the department said the "bad corporate guys" had effectively taken over and the S in MSRC stopped standing for "security"

I regularly have people ask me about Mythos these days, so here are my thoughts: Finding bugs is never the hard part. Fixing them is. How’s your organizational alignment? Are your engineers burned out? How is your production resilience? Before you worry about the new shiny, focus on your basics

Yesterday, petition e-7115 was officially presented in the House of Commons of Canada by MP Jeff Kibble 🇨🇦! This means the call for secure coding standards across the Government of Canada is now part of the official parliamentary record. Security was discussed in parliament. This is HUGE. 1/2

Dropping 0day isn’t the worst thing a researcher can do. It’s not ideal, but at least orgs can take steps to mitigate. Non disclosure is far worse. What drives researchers toward non disclosure? Threats from vendors. Researchers aren’t criminals unless their crime is curiosity.

I missed this from @rgblights.bsky.social a week ago - aside from continuing to highlight the risk of Volt Typhoon, this also appears to be the first specific attribution of the group to a PRC entity in public: cyberdefensereview.army.mil/Portals/6/Do...

This is the norm of how Microsoft operates, not the outlier. Any level of criticism, whether technical or policy-related, will prompt them to attack you to save face. At the very least, when I experienced it a couple of years ago, I wasn't labelled a criminal.

It's been fun watching non-defence people get to discover how deranged CADSI is.

I agree with much that has already been said, but what's not said enough: There's nothing special about Palantir. They just been in the game long enough specializing in defence and security to have name recognition. There are many Canadian firms that could do the exact same thing.

This week, in Chapter 4 of Foundations of Digital Sovereignty, we're talking about the value of data, and the role of governance in the digital economy. We need to reframe the terms of how data is used, to protect Canadians from exploitation: canadianshieldinstitute.ca/latest-updat...

Australia has lodged a complaint with Canada's Privacy Commissioner regarding privacy breach by Canadian-owned VIQ Solutions.

NEW: In the first piece in a series about the biggest cybersecurity mysteries ever, I looked at what we know about the Shadow Brokers, the group that leaked several NSA hacking tools a decade ago. Even after all this time, their identity remains unknown, despite causing havoc all over the internet.

My latest Canadian Cyber News Rewire is out, where I compile Canadian and Canada-relevant news stories. I am slowly integrating Parliamentary and procurement coverage as well. Lots going on this past week on Bill C-22, AI, and more. www.cyberincontext.ca/p/canadian-c...

Because I see so many people getting this wrong, here is a thread on how the Government of Canada (GC) governs cybersecurity and how it's not centralized. There is no single "lead" organization, but at least seven central departments are involved in specific GC cyber security activities.

Intellectual property is a key governance structure for the 21st century digital economy. If Canada is going to meaningfully assert our digital sovereignty, we need a better national IP strategy. Read Chapter 3 of Foundations of Digital Sovereignty: canadianshieldinstitute.ca/latest-updat...

One pertinent problem in military studies is access to classified and restricted settings and handling that information in the research process. Join us on 17 September to discuss approaches and challenges. Hosts: @sjms.bsky.social & @forsvarshogskolan.bsky.social Learn more 👇 #civmilsky #milsky

Same energy:

As soon as the Canadian Shield Institute was announced, I had high hopes and expectations, and they continue to exceed them with fantastic work.

In its submission, the [national security and intelligence] watchdog said Bill C-22 “fundamentally alters the reach of government by extending the exercise of its powers to Electronic Service Providers,” and calls for more meaningful oversight www.theglobeandmail.com/politics/art...

Comments on the Intelligence Commissioner's 2025 annual report luxexumbra.blogspot.com/2026/05/what...

I really dislike the framing of this. "Deal" makes it sound mutual and between two legitimate entities. A ransom to a criminal entity, which was paid under duress. Plain and simple. globalnews.ca/news/1184501...

On this day in 2017, the WannaCry ransomware outbreak began.

www.canada.ca/en/radio-tel... With the increasing use of AI across sectors, the CDRF is facilitating a discussion with stakeholders on competition, privacy and copyright law, and telecommunications and broadcasting regulation.

Latest Canadian Cyber in Context Canadian Cyber News Rewire available. Continuing coverage of the Alberta electoral list scandal and news about the US government demanding that Google give information on a Canadian citizen over anti-ICE posts. www.cyberincontext.ca/p/canadian-c...

In January, a phishing message arrived on my Signal account, supposedly from "Signal Support." I was able to turned the tables on the attackers and get a unique view of the wide-scale campaign by the attacker's targeting journalists and politicians I was target #13,730 in their database.

I continue to be flabbergasted that other (non-insane) governments aren't making similar changes. The Canadian government won't shut up about how important "digital sovereignty" is, and then it pours resources into posting everything to Twitter and Facebook.

So, I have a different take than @lhn.bsky.social & @agreenberg.bsky.social. This is the norm now. Ransomware groups know the power of supply chain attacks and actively seek this kind of disruption. Whether it is the Jaguar attack earlier this year, shutting down car dealerships last year…

Meetings between Germany's Cyber Head and CAFCYBERCOM. But of course, this article doesn't expand on that at all and gives us a "supply chain that is worried about cyber" as if it's from 2022. www.cbc.ca/news/politic...

well, well, well disinfowatch.org/foreign-inte...