Canada's digital defences are lagging. Now what?

0:00Do more at the University of New Brunswick. UNB is different. You won't just spend the next few years with your nose in a book. You'll spend it making new friends, learning hands-on, and growing into the version of yourself who's ready to make a difference. At UNB, not only will you get a world-class education, you'll get the support and networking help you need to launch full speed into your career. Things like work-study opportunities, real-world projects, and community-based experiential learning will set you up to do more at the University of New Brunswick. Visit domore.unb.ca to learn more. Frequency podcast network. Stories that matter, podcasts that resonate. When was the last time you changed the password to your banking app? Or to your Instagram account? Hmm?

1:00How serious are you taking cybersecurity and digital defense? And is Ottawa taking it as serious as they should? Just last week, AI Minister Ivan Solomon announced Ottawa's data center framework, a non-binding, five-point list that lays out expectations for provinces and territories as they steer through the highly unpopular activity of building data centers in their communities. If we don't build the infrastructure of the future here, we will have to buy it from somewhere else. And if we don't innovate here, we will rent that from someone else. And if we don't make the rules here, we will have to follow someone else's. Sure, data centers and a sovereign digital footprint are important to ensuring cybersecurity, but they're not paramount. First, Canada should maybe ask itself, do we have the infrastructure to be digitally sovereign? Canadian softwares, domestic teams, Canadian decision makers,

2:00before maybe signing a contract for an American company to build a mega data center in rural Alberta? And for the cybersecurity systems that are already in place in hospitals, airports, library, school boards, are they getting the updating and modernizing needed to ensure they're actually keeping Canadians safe? I'm Maria Castan, and today on the big story, I'm talking to David Shipley, CEO and co-founder of Bo Ceron Security, to discuss how Canada can beef up its digital defense, balance innovation with safety, and whether Prime Minister Karinny's Davos speech is actually walking the walk in terms of digital sovereignty. David, thank you so much for joining me today on the big story. Glad to have you back. Thanks for having me again. When I think of cybersecurity, I think of firewalls. I think of multi-factor authentication, changing my password of VPN.

3:04I think of those random security questions, like when a website asks, like, what was the name of your second grade teacher? You know, all this to say, I think of those more personal, smaller scale security mechanisms to protect me and my devices. But I'm curious to know, David, how can we make sense of digital security on a national defense level? What we have to realize is that we haven't been having that conversation about what does it mean to be secure and sovereign in a time when we were all told 26 years ago that borders were no longer going to matter. That technology was inherently good. We were on the march to democracy everywhere, and we were about to enter an era of techno-utopia. And that's not what we got. What we got was 25 years of intense, open conflict, a new cold war,

4:05and technology that became so pervasive throughout our entire economy and our way of life that now a shutdown has massive implications economically and security wise. Let's talk with economically. And when Microsoft sneezes, we all get pneumonia. All of a sudden, if there's a problem in Microsoft 365, schools can't operate. Businesses are no longer effectively operating. The cloud turns out can rain. So that's a problem. But when we think about what keeps the lights on and the water flowing, a lot of people think we still have the critical infrastructure, the analog, old school, reliable technology of the past. And it's now hyper-connected. And we did it intentionally for energy efficiency,

5:05for convenience to get through the pandemic. And that created all new avenues for vulnerability. And so now we live in a more hostile world, where there are now new ways for people to attack us. And conceptually, our government is still coming out of the shock that we can no longer be the couch surfers of NATO that are allies to the south have now become, if not enemies, not our besties for sure. And the world changed. David, I'm wondering if we could zoom it out a little bit. When we're talking about Canada's defense strategy, historically speaking, where has Ottawa focused most of its efforts and investment on? Like what kind of defense you think would be? Areal systems, military training, where has investment historically gone towards? Well, I mean, the historical trend in Canadian defense spending is, what is the minimum amount possible we can spend on this so we don't get called out

6:07by our NATO peers, or at least not called out too embarrassingly in such a way? And we've, we have written on the co-tales of our own nation's history and our oversized contribution in past global conflicts. And we're like, remember us, we were there in the First World War and Second World War. We're still doing it today. It's like, man, that's almost 100 years ago. Everyone else is like, guys, like what have you done lately? So we've, we've underspanted massacres, and I'm a Canadian Army veteran, right? I remember using, you know, uniforms designed in the, in the 1970s, and a radio that was used in the Vietnam War in the late 1990s. Right? So we were never big on modern equipment. I mean, we had sea king helicopters, which were older than, you know, military service age for retirement for some folks. So, you know, we never invested well in this. And then when it came to national defense in terms of anything digital,

7:08as we started to realize, hey, we're under attack. It became all about protecting the government itself. And so massive investments over the last decade, things like the federal government's own strategy have all been about building a castle around the government network itself, government systems, and in other areas. It hasn't been about protecting us, the surfs outside of the castle. And I've often told folks is that we live in the digital dark ages. You know, it's good luck. The Vikings are coming and we're behind our castles, and you're all off to fend for yourself. Here's some advice about 2FA. Cool. That hasn't worked out well for us. You know, David, the last time you and I spoke, we discussed the Canadian border services agency, Kiosk Outages. They were happening one after the other across the country at airports. And you said that Canada had been neglecting its IT systems for quite some time now. And you just kind of alluded to that.

8:09We're not really the best or the front leader in modernization when it comes to tech. You know, that conversation had me wondering where else our country could be paying closer attention to in terms of modernization, you know, and tech infrastructure. Like what's happening, for example, at our hospitals? You know, you said they're protecting and they're building this castle around government agencies. But what about our school boards, our libraries? Like, are they being neglected as well? Absolutely. And it's because of the politics of it. So let's start with hospitals. There's not a single provincial politician who's going to get reelected because they increased funding for cybersecurity for the hospitals. Right? They open a new wing. They hired more doctors. I mean, you're talking about a country, by the way, too, that doesn't even fund modern medical equipment purchasing properly. Every hospital runs around with massive fundraisers, fundraisers from the private sector

9:10to buy capital equipment because we don't actually still invest in our much-mounted universal healthcare system. The way it actually requires. We still beg borrow to build that side. So in that overall environment, are we shocked that we have insecure IT networks running minimum viable and possibly less than minimum viable teams who are underpaid compared to what they can make in the private sector and we're shocked that the system is easily compromised with multi-site ransomware attacks. Should we be? No. Um, didn't invest, got robbed. We live in a bad digital neighborhood. So that's hospitals and hospitals are worlds better equipped than schools. You know, K to 12 school district IT staffs are heroes you never get to see. The fact that they keep those networks running on thoughts, prayers, bubblegum,

10:11blood and way more tears than people will ever know is a miracle. And you know, it's they face an interesting environment. They've got all these external attackers trying to gather incredibly sensitive data on students and staff, whether that's medical history, whether that's employment information, etc. Trying to protect all of that information against a host of external threats. Oh, and these kids who are curious and learning technology and maybe getting into trouble in ways that they shouldn't be. So schools. But possibly the worst off of all, our municipalities. How many hacks have we talked about in Canada? And it seems like every year a new bar is set for the largest municipality ever. You know, the previous title holder before the city of Hamilton was the city of St. John and it was a three million dollar attack. That's three million dollars out of a city whose budget is beyond stretched.

11:11In Hamilton, it was a massive hit, including not even getting their five million dollar insurance coverage because they hadn't implemented multi-factor authentication. So municipalities are in a bad way and of course that affects a lot of services people rely on. But most importantly, it's the menisably run infrastructure, water treatment and waste water. Cybersecurity is a major part of a modern military. It also affects businesses, utilities, hospitals and regular people like you. Luckily, the University of New Brunswick has built one of Canada's top networks for cybersecurity and defense. Researchers at UNB work with marine technologies, artificial intelligence, underwater systems, Arctic defense and more. UNB is leading the research and

12:11innovation, addressing some of Canada's most important security challenges. And you could join them. Do more at the University of New Brunswick. Visit domore.unb.ca to learn more. David, I think we should talk about the D-word data centers. I mean, they're there's certainly not a bad favorite for a variety of reasons. Canadians have a lot of pushback on them, you know, be it water usage, energy usage, noise pollution, so on and so forth. The reality is, you know, if we are looking to beef up digital defense, a huge part of that hinges on sovereign data systems. And you know, Ottawa has made an effort at acknowledging that, you know, last week they released their data center framework that outlined, you know, their expectations of the provinces and territories. Although it was in binding though, which I thought was really interesting. You said all these expectations, but the, you know, provinces and territories don't necessarily have to follow them. What did you, what did you make of the framework?

13:16Well, I think one of the interesting things that I think politicians would do well to remember is remember when we were talking about pipelines and this concept of social capital emerged, which was never fully well defined, but it was basically people's goodwill and willingness to allow this infrastructure to be built, tolerated, to do the cost benefit analysis and realize, okay, we're fine with that. And you're saying, you know, pipelines is a good analogy for this because it ebbs and flows. Canadians are very much open to pipelines right now because of the existential security threat that we have. The big AI companies, because they have used doomer economics to terrify the markets into thinking that these companies are the biggest thing to ever happen technologically since the innovation of fire, which boosted their company valuations at the exact same time they destroyed all social capital. That's fascinating. The only

14:17thing these companies burn through faster than investor cash was people's goodwill. What a surprise that everyday Canadians are saying, wait a second, did you tell me that this thing was going to take all of our jobs? It has been used to pollute every social media site on the planet with garbage slop video, which I hate. And it seems like only these tech bro billionaires are going to benefit from that. So what a surprise that Canada put a massive screw you sign out to the big tech billionaires I don't want this. I mean, we're we're nimbby nature in many respects. We don't like new things. We were very sort of wary of that. And then we have been given absolutely no reason to want to embrace these AI data centers. When you think about the fact that the experience in the United States of communities embraced these data centers is skyrocketing electricity costs. Right, we're in an age of massive cost increases, the affordability crisis and all of a sudden we're like our power

15:18built too. I can tell you in New Brunswick where political interference artificially suppressed our power prices below well below market rates and then accumulated debt like you've never seen. And now the bill has come due. We're we're quite cranky about power prices. The rest of Canada I can see being extraordinarily upset by that. So it's a pocketbook issue. It's it's and it's also I don't want these in my community. It doesn't benefit me. It threatens the middle class way of life. The so-called knowledge economy that I was sold is the future of jobs and you know, now the AI companies are pivoting away and saying, oh no, no, it's not going to destroy all the jobs. Well, sorry guys, you kind of played that card and you created this master and I have to live with it. So I don't think it's it's going to go well. I think what's interesting is that there are few issues that unite the political left and the political right in North America. The way that hating social media companies and hating AI companies that has many you've got a coalition of the

16:20you know, the fire left and and the most virulent mega folks you can imagine will actually get in a room and agree and maybe that's a good thing. But it's probably bad news if you're in the AI data center developer. Are Canadian data centers like the end all be all to beefing up like cyber security and like sovereign data? Like what other infrastructure could Canada be looking towards to strengthen digital defense then? I actually think that the AI data center is it's a bit of misdirection and the reason I say that is that like whoever controls the data center controls the data. So cool, an American company owns a data center in Alberta in meta. Is that sovereign Canadian data? No, I mean we can't even seem to hold meta accountable for anything. It's interesting that US courtrooms have held meta more accountable than our quote unquote sovereign parliament fascinating.

17:21So no, I don't believe that simply having a data center equals data sovereignty. I think the questions are deeper than that. Like do we have Canadian made software? Do we have distinct legal Canadian entities who control that data center? These are the bigger questions. The rest of it is just window dressing. And it's window dressing while jacking up our power bills is probably not exactly a net benefit. So does Canada have the infrastructure to do that then? Like the Canadian like Canadian software is Canadian teams like do we have it then? Well, I mean here's a great example for my day job. So I run a 45 person security awareness company. We are the only remaining Canadian security awareness company. Biggest company in my space is an American company called No Before. They have 70,000 customers. I have 2000. And so there are choices. But interestingly enough, even public sector entities will still buy American over Canadian. We might we might fight it out

18:25at the grocery store, but you know the RFP we shape these requirements. We've got the pricing here. Oh, I guess we're going to buy that American tool. I mean, it not for not that I look at that and go, okay, we can, but there are trade-offs. You're choosing to buy Canadian. They're positives to that. There are also sometimes, okay, maybe my company doesn't have all of the same things that this 300 million dollar American funded company has. But did you actually need those things? And what's the tradeoff on that side? So, so we can, but it's not without costs and choice. And I think that's the the interesting question. And I think this is the interesting read of this conflict between us in America is for America, this is a trade dispute. This is about, you know, quid per quail and percentages, etc. And increasingly for Canadians, this is about our long-term existence as an independent nation able to set its own national policy. And so this is about survival.

19:26Except when it's not. Except when we're like, well, you know, it's going to go back to normal in two years. It's fine, etc. So we'll see. So do you think Prime Minister Karni then has kind of crawled back a little bit on his Davos speech? Or what do you think? I mean, we've seen him make, you know, strides in the public about choosing Canadian and, you know, really putting those elbows up. But in the digital sphere or in the cyber security sphere, do you think he hasn't really walked the walk? Well, I think abandoning the digital tax credit got him nothing. Except the mouse came back after it got the cookie and wanted a glass of milk on Canadian content. And, you know, I don't know whether it's because of their political ineptitude or it was brilliance on our side, but the moment they touched the the the rail of Canadian politics languages. That's this thing went huge, right? We Lake Ontario think pissed us off, but he really want to start a war. You tell us that you're going to remove French language and and requirements to

20:28protect French Canadian culture to a liberal Prime Minister. Like, you imagine what that cabinet room looked like. The faces would have been furious, right? So I think he did. I think he realized he got nothing from it. And I think in the totality when they realized they couldn't even save trucks in Ontario, they walked away. And then the part from a trade perspective and this goes back to our digital security conversation is this we gave away the farm digitally with Kuzma. If you go back and look at the amount of things we capitulated on in digital policy in that trade agreement, we threw our future economy, our current economy under the bus to save the manufacturing economy. And it got us nothing. And so the interesting question is is that while we're in this trade dispute, what more digital policy is going to be inflicted upon Canada that we surrender, that we don't realize that we're giving away the future sovereign state, that we might exist in a in a transitory state for a time, but in all meaningful sense, if all of your tech,

21:3390% of your tech is American tech. I really am dependent anywhere. The Europeans are asking this question a big way. France is ditching windows. They're embracing Linux. They are looking at European owned, hosted, provided. Were they're looking increasingly to have values-based conversations with other countries that actually share Western liberal democratic values. So we have this opportunity. And I'm actually traveling to Europe to keynote a Belgian cybersecurity conference. And we'll be talking about this cyber renaissance and this idea of building and buying technology based on shared values. Prime Minister is going to give a speech to open the European Parliament. That I think is going to be the follow up to Davos. So Davos was the rhetorical caught everyone's attention. What are we doing about it? Yeah. What can everyday Canadians be doing in, you know, our day to day to ensure that we're up to day on our own cybersecurity and we're doing our own digital diligence in terms of defending ourselves. I mean, the basics remain true in 2026.

22:38Strong, long, unique, complex passwords wherever you can. There is a Canadian company. One password that makes a password manager highly recommend them. Making sure you keep your devices patched. When you hear about a software vulnerability, it means that it's already been known to attackers for months, sometimes years. And so you don't get to put that software update off anymore. Because what happens is when it gets announced, it creates a hacking feeding frenzy now powered by AI. So being last to patch is being like being the last person that the running away from the bear. The bear is chasing you now. Multifactor authentication everywhere as much as you can. Turn it all on. Any is good, but the authenticator apps are the best. And if you're really super paranoid, the hardware, token keys, you plug into your computer, like having a physical key, it turned your ignition on in your car. If you don't got that key, you're not getting into those accounts. That's great ways to protect it. But I would tell everyday Canadians there's more you

23:39can do for society right now than just protecting yourself. There are really important discussions happening on nationally about regulating American big tech in the forms of the Safe Social Media Act, in the new privacy legislation. These are important parliamentarians need to hear from you to say, I support these important freedom protecting pieces of legislation that empower me to have control over my own data, that rein in these companies that have become the new big tobacco. When Facebook cuts an $18 billion check without batting an eye, which is less than one quarter's worth of profits, we were past the debate of whether these companies have hurt Canadian kids. It's who knew what went and how much they wanted to pay. Well, are we going to trust these folks to sell self-police them or are we going to pass the laws we talked about? Canada talks a big game. We get the elbows up. We puff our chest. And when we follow through, we're a force to be reckoned with.

24:39Are we going to follow through? Are we going to defend ourselves? Are we going to put legislation in place? And then I think the conversation for the provinces and the federal government is this? Are we going to protect our schools, our hospitals, and our municipal critical utilities? Because we're not. Right now, the Canadian Center for Cybersecurity is so focused on trying to keep China out of our national telecommunications networks, which is federally regulated. They don't have any time for water. A Quebec municipality, 400 people, the mayor watched a video of a Russian hacking crew trying to tamper with their internet-connected water safety systems. They were brazen about it. They have no fear. This wasn't even the greatest Russian hacking team. At the same time, 100 water utilities in the United States were hacked by a run. And there were cities that declared states of emergency because they were down to people manually running equipment to keep toilets flushing and water running. And Canada remembers.

25:43Or should remember what happens when water safety systems go south. That's the walker-tons story. People die and people live with decades-long life-altering illnesses. So that's what we need to do. It's big stuff. It's more than the standard sort of patch your stuff, put your strong passwords and protect your own. You got to be an active citizen. The kind of sovereign democracy we want to live in requires people to take an interest in these technology policy issues and get off the bench. Such an important conversation, David, I really appreciate you coming on to have it with me. Thanks for the opportunity and the soapbox. And that was the big story. So when was the last time you changed your passwords? This episode may be your sign to do just that. If you enjoyed this conversation, give it a rating. If you have thoughts on it, be sure to send them to us. Hello at thebigstorypodcast.ca. Don't miss our sister shows in this economy and big headlines. Those come right out of this

26:43feed every week and every day, respectively. I'm Maria Kastain. Thanks for listening. We'll talk tomorrow. Do more at the University of New Brunswick. UNB is a world-class university offering a world-class education, get personalized support to explore career opportunities, build the skills and confidence employers value, and connect with mentors and future employers. From class registration to career preparation, UNB is where you'll do more. Visit domore.unb.ca to learn how.