Background
Canada’s history and ultimately its emergence as a nation
depended heavily on citizen led militias who were willing to take up arms to
defend Canadian interests.[1] In its early years Canada was under constant
threat from foreign invasion, and it was through militias that key battles such
as the Siege of Quebec in 1775 were won.
Figure 1 Citizen militias in action at the Siege of Quebec (1775)
Without the combined support of both French and English
citizen militias in Quebec, the lower town barricades would have fallen to
American invaders and Canada as we know it may never have been.[2]
This is one of many moments where citizen militias, in this case those from
formerly opposing colonies, joined forces and supported the regular military in
protecting an emerging Canada.
Context
Due to the complexities of modern warfare, we leave physical
military conflict to professional soldiers in the 21st Century, but
cyber conflict is an emergent problem that every Canadian faces so passing this
responsibility to professionals has proven ineffective. From skirmishes with
cyber criminals to all out attacks by professional foreign cyber militaries on
missions to diminish Canada’s effectiveness as a society, modern cyber warfare
is aimed squarely at a citizenry who has been made helpless by deference to
central authority. This helplessness makes cyber-resiliency difficult to develop
as we have atrophied our citizens' expectations of empowered personal
engagement.
With criminal and foreign interests focused on disinformation
aimed squarely at unprepared Canadian hearts, minds and wallets, an approach in
keeping with our militia rich past is called for.
Looking at the
rapidly rising rate of cyber attacks (Figure 2) below, it quickly becomes
obvious that existing centralized attempts at improving cyber-literacy have
failed because with centralized authority comes the expectation that this is
someone else’s problem. The borderless nature of cyberattacks ties our police
services in knots.[3] Our
failure to monitor or effectively respond to online crime suggests dependence
on any central ‘pre-digital’ authority is problematic.
The concept of citizen led militias are fundamental to
Canada’s history and identity. By enabling modern localized cyber training and response
Canada would resolve previous failed attempts by placing the responsibility
where it belongs: with citizens. A
localized cyber militia would also resolve several other challenges our country
faces when it comes to developing our own cyber talent[4].
Failure to act or simply repeating previous approaches puts Canada at risk of ongoing
deterioration from foreign digital attacks.
Figure 2 Statistics Canada. Table 35-10-0002-01 Police-reported cybercrime, number of
incidents and rate per 100,000 population, Canada, provinces, territories,
Census Metropolitan Areas and Canadian Forces Military Police https://www150.statcan.gc.ca/t1/tbl1/en/tv.action?pid=3510000201
Leveraging
Canada’s History of Militias to Create a Modern Citizen Based Cyber Defence
With recent increases in support for the Canadian military
due to changes in the geopolitical status quo[5],
plans for the creation and support of a citizen led cyber militia would resolve
an ongoing problem that centralization of responsibility has failed to address.
The vast majority (over 88%[6])
of data breaches in Canada ’s defences come as the result of user ignorance and
error. Canada loses over five billion dollars a year to cyber-criminal and
foreign digital interference[7].
One of the first duties of Canada’s Cyber Militia would be to peer educate
citizens on the importance of disinformation and cyber security preparedness
and make them aware of the challenges they face. This change is essential
because reported cyber criminal activity has increased over 600% since 2014[8]
while remaining one of the least reported crimes (estimates suggest over 90% go
unreported). This data makes it clear that a centralized government approach is
ineffective in developing the cyber resilience our citizens need.
Canada also suffers from a shortage of experienced cyber specialists[9].
Academic programs have proven ineffective in resolving this problem because,
like policing, cybersecurity operations are an experiential/skills-based job
rather than an academic one. The best way to produce these applied experts is
through a trades-based apprenticeship and experiential training model that
local cyber militias could provide. In doing so these units would also uncover
regional talent and reduce Canada’s cyber-gaps by spreading cyber-opportunities
evenly across the country instead of centralizing it in a few urban areas.
A Canadian cyber militia would work with and through
industry, government and civil society spheres of influence by leveraging
citizens locally and establishing individuals as responsible for Canada’s
shared digital defence. Like a militia of old these groups would depend on
grassroots support. In a field like cybersecurity which suffers from
longstanding dominance by privileged groups,[10]
supporting local militias that are protecting their home communities would
create a Canadian shield the truly covers the country.
Canada spends billions to provide centralized
cyber-awareness prevention programs[11]
that are obviously ineffective against an onslaught of increasingly automated[12]
and well funded foreign campaigns. One only need look at the data to see this. To
make cyber and foreign disinformation awareness the responsibility of every
Canadian we need to de-centralize ineffective programs and pivot to a local
militia model that places cyber-readiness in the hands of grassroots groups at
the local level. Federal services that do advanced research and active defence
are not part of this change in focus, but the programs designed to spread
cyber-awareness and access to the field that aren’t working are.
The Canadian Shield is also a weapon
The final piece of the puzzle is organizing and indirectly
supporting the most advanced cyber militias to provide reconnaissance and
arms-reach offensive cyber operations against foreign interlopers. A government
response brings diplomatic strings and bureaucracy, but this arms length approach
to offensive cyber operations has already been effectively employed by many
other countries, including those doing the most egregious harm to Canada.
Other countries have approached this in different ways.
Awash in resources, China[13]
has more people working in offensive cyber operations in their military than
Canada has in its entire Forces. Russia offers a more resource limited approach
that is also very effective with arms-length former military and industry
groups performing offensive cyber operations that are incredibly effective
without getting tangled in government expectations.
Many cyber ‘powers’ utilize decentralized approaches to make
agile, effective use of digital systems for intelligence gathering and foreign
interference.[14] Canada
has not only fallen behind in developing offensive cyber capabilities but also
finds itself trying to defend against this astonishing array of approaches. Trying
to play a game with no offence leaves you with at best a draw and most likely a
loss. The development of cyber militias would quickly reverse that trend while
rapidly enabling a full suite of options for both defensive and offensive
operations.
Conclusion
Canada has a long history of self defence using local
militias. In 2025 Canadian citizens find themselves alienated from a
responsibility that should be placed squarely in their hands. In a world where
automated, state sponsored cyber attacks are something everyone will face,
leaving awareness and responsibility to people thousands of miles away is both
ineffective and ultimately frustrating.
Every Canadian who is online will face foreign
disinformation and potential harm from state sponsored criminal cyber campaigns
in the next year, yet most Canadians think it’s someone else’s job to be aware
of them and stop them. The most astonishing aspect is that it’s Canadians
themselves who open the door to many of these attacks. It’s time to put
responsibility for cyber awareness and literacy where it belongs, locally with
citizens.
By changing its focus from a wagging finger coming from
Ottawa to a supporter of locally based cyber-awareness and future talent
development, federal (and provincial) governments would reverse decades of
damage caused by cyber illiteracy, empower Canadians to defend our country
against foreign attacks that will only grow in the coming years, and ultimately
place cyber awareness and skills development where they belong: in the
communities that so desperately need it.
Figure 3 A
Canadian Citizen Cyber Militia for the 21st Century.
[1] Canada’s Militia and National Defence Acts,
Royal United Services Institute of Nova Scotia, Jan 20, 2025. https://rausi.ca/images/edocman/newsletters/rusins/Dispatches_2025-02-21.pdf
[2] 1775/76 – Battle for Quebec, Canada History
Society, militaryhistory.ca. https://militaryhistory.ca/1775-76-battle-for-quebec/
[3]
Combatting Cybercrime. Office of the Auditor General of Canada. https://www.oag-bvg.gc.ca/internet/English/att__e_44499.html
[4] One
in Six Canadian Cybersecurity Roles Go Unfilled: New Report Explores Talent
Shortage and Solutions. ICTC-CTIC. https://ictc-ctic.ca/news-events/one-in-six-canadian-cybersecurity-roles-go-unfilled-new-report-explores-talent-shortage-and-solutions
[5]
Department of National Defence, Jun 9, 2025. Canada’s new government is
rebuilding, rearming and reinvesting in the Canadian Armed Forces. https://www.canada.ca/en/department-national-defence/news/2025/06/canadas-new-government-is-rebuilding-rearming-and-reinvesting-in-the-canadian-armed-forces.html
[6] UNDERSTAND
THE MISTAKES THAT COMPROMISE YOUR COMPANY’S CYBERSECURITY. The Psychology of
Human Error, Stanford University. https://f.hubspotusercontent20.net/hubfs/1670277/%5BCollateral%5D%20Tessian-Research-Reports/%5BTessian%20Research%5D%20Psychology%20of%20Human%20Error%202022.pdf
[7]
Countering Foreign Interference, Public Safety Canada. https://www.publicsafety.gc.ca/cnt/ntnl-scrt/frgn-ntrfrnc/fi-en.aspx
[8]
The Impact of Cybercrime on internet users in Canada, Statista. https://www.statista.com/topics/4574/cyber-crime-in-canada/
[9] One in Six Canadian Cybersecurity Roles Go Unfilled: New
Report Explores Talent Shortage and Solutions. ICTC-CTIC. https://ictc-ctic.ca/news-events/one-in-six-canadian-cybersecurity-roles-go-unfilled-new-report-explores-talent-shortage-and-solutions
[10] How
more diverse recruitment can help close the cybersecurity talent gap. WEF. May
3, 2023. https://www.weforum.org/stories/2023/05/how-diverse-cybersecurity-recruitment-can-help-close-talent-gap/
[11] Canada
: The National Cybersecurity Agency’s Budget Has Nearly Doubled in Three Years.
Incyber.org. https://incyber.org/en/article/canada-national-cybersecurity-agencys-budget-nearly-doubled-three-years/
[12] Beyond
Phishing: Exploring the Rise of AI-enabled Cybercrime. UC Berkeley. January
2025. https://cltc.berkeley.edu/2025/01/16/beyond-phishing-exploring-the-rise-of-ai-enabled-cybercrime/
[13]
Military and Security Developments Involving the People’s Republic of China
2024. US Department of Defence. 2024. https://media.defense.gov/2024/Dec/18/2003615520/-1/-1/0/MILITARY-AND-SECURITY-DEVELOPMENTS-INVOLVING-THE-PEOPLES-REPUBLIC-OF-CHINA-2024.PDF
[14]
How Big 4 Nations Cyber Capabilities Threaten The West. DarkReading, Feb 9,
2024. https://www.darkreading.com/vulnerabilities-threats/how-big-4-nations-cyber-capabilities-threaten-the-west
