Canadian Military Journal [Vol. 26, No. 3, Summer 2026 – Special Issue on the Cyber Domain and Artificial Intelligence]

Lieutenant-Colonel (LCol) Leslie Rediger joined the Canadian Armed Forces as a communications and electronics engineering officer in 2001, graduating in 2006 with a bachelor’s in mechanical engineering from the Royal Military College of Canada. For the first 15 years of her career, she enabled air operations as a communications and information systems officer at various RCAF wings and at 1 Canadian Air Division Headquarters. She deployed multiple times in support of Op ATHENA and Op REASSURANCE. In 2016, LCol Rediger transitioned to Signals Intelligence (SIGINT) Operations, serving as officer commanding the support squadron and as deputy commanding officer at Canadian Forces Station (CFS) Leitrim, and as chief of staff of Signals Intelligence at Canadian Forces Information Operations Group Headquarters. She was promoted to her current rank in 2020 and commanded Canadian Forces Station Leitrim from June 2023 to October 2025. She is currently the CAFCYBERCOM liaison officer to the United Kingdom. LCol Rediger holds a Master of Arts in Leadership from Royal Roads University and a Master’s in Defence Studies from the Canadian Forces College.

Strong, Secure, Engaged: Canada ’s Defence Policy, released in 2017, frames the “rapid evolution of technology” as a central driver of change in the global security environment, reshaping the character of conflict.^Footnote1 It also notes that the Canadian Armed Forces’ (CAF) use of cyberspace and emerging technology “brings significant operational benefits, but also creates critical vulnerabilities.”^Footnote2 This means that, to be competitive and to defend Canada’s interests, the CAF must be able to protect its assets, defend its freedom to manoeuvre in cyberspace, and be able and ready to leverage that operating environment to carry out its directed mandate.^Footnote3

To “maximize Canada’s effectiveness in cyberspace” in Our North, Strong and Free: A Renewed Vision for Canada’s Defence, the Government of Canada directed the CAF to establish the Canadian Armed Forces Cyber Command (CAFCYBERCOM).^Footnote4 This new command is intended to “improve the CAF’s ability to conduct cyber operations” and “enable the military to generate and employ cyber forces and other specialized capabilities on short notice and contribute to advancing Canadian interests and protecting Canadian, Allied and partner militaries at home and abroad.”^Footnote5

On 26 September 2024, CAFCYBERCOM was established, elevating and transforming the Canadian Forces Information Operations Group from a level-three formation to a command, administratively supported by the Digital Services Group but reporting directly to the Chief of the Defence Staff.^Footnote6 As the defence authority for cyber operations, it is responsible for the employment, generation, sustainment, management, and development of its allocated cyber forces, including signals intelligence (SIGINT) and joint electronic warfare.^Footnote7

Although it is relatively well known in the defence community that the Communications Security Establishment (CSE) is the Government of Canada’s foreign signals intelligence agency,^Footnote8 it is less well known that the CAF has its own integral SIGINT unit. Canadian Forces Station Leitrim has been conducting signals intelligence operations in the defence of Canada for almost 85 years.^Footnote9 The inclusion of the CAF’s SIGINT organization into the new cyber command may, on the surface, seem unusual, given that it is an intelligence function and the CAF already had an intelligence command. However, SIGINT has a particularly important nexus with cyber operations. A nexus that is only growing and gaining relevance in the interconnected, technology-rich world in which the CAF operates. SIGINT and cyber are two sides of the same coin; although they have different purposes, authorities, and capabilities, they are inexorably linked and mutually reinforcing. This article serves as an introductory discussion of the relationship between SIGINT and cyber operations in the military context, with the aim of illustrating their interdependencies and reinforcing nature, as they make their home in the new CAFCYBERCOM.

Lexicon

To begin this discussion, it is important to first define the terminology. Technological advancements in the information world tend to outpace doctrinal evolution. This means that there are no universally agreed-upon definitions for terms such as “cyberspace,” “cyber operations,” or the “cyber domain.” NATO, allies and partners have slightly different interpretations of these terms, and they are frequently used interchangeably. For this discussion, this article will reference the Department of National Defence’s Defence Terminology Bank for continuity.

Cyberspace and the Cyber Domain

Cyberspace is the “physical environment consisting of all assets that process, store or communicate digital data.”^Footnote10 Unlike the other operational environments in which the CAF operates—land, sea, air and space—cyberspace is “omnipresent within all other environments.”^Footnote11 The cyber domain is a broader term that encompasses not only cyberspace but also the infrastructure that supports and enables it, as well as its users and their related activities.^Footnote12

Cyberspace encompasses the cyber persona layer, which includes online profiles and other ways that people and things are represented online, while the cyber domain extends outward to include the actual humans who interact with cyberspace. Likewise, cyberspace encompasses the physical layer, including all computing hardware, phones, sensors, and data storage devices, while the domain captures that layer as well as the geographical layer, which represents the physical locations hosting the network devices and their surrounding environments.^Footnote13

Cyber Operations

The term “cyber operation” encompasses a wide range of activities conducted in cyberspace aimed at achieving strategic and tactical objectives, which are subdivided into defensive cyber operations (DCO) and offensive cyber operations (OCO). DCO focuses on activities to preserve and ensure freedom of action within cyberspace,^Footnote14 such as defending networks and data from adversaries. In contrast, OCO focuses on activities that project power through cyberspace to achieve specific effects.^Footnote15 The intent of OCO is to disrupt, degrade, and/or destroy the adversary’s freedom of movement in cyberspace or to affect adversary activities or capabilities in other ways via cyberspace.

The growing dependence of state and non-state actors on cyberspace, its integrated information systems, and sensors has necessitated a proportional increase in cyber operations capabilities within the CAF. It is critically important that the CAF be able to defend its territory in cyberspace and leverage this terrain to reach out and affect its adversaries. Strong, Secure, Engaged: Canada’s Defence Policy sets out the expectation that the CAF’s cyber forces are able “to target, exploit, influence, and attack [in cyberspace] in support of military operations”^Footnote16 by leveraging emerging platforms across the land, sea, air and space domains for integrated sensor systems.^Footnote17 The defence policy also highlights the requirement for the CAF to deny the adversary the ability to affect the CAF’s command, control, communication, intelligence, surveillance, and reconnaissance (C4ISR) capabilities, which are necessary to enable CAF operations globally. ^Footnote18

Signals Intelligence

The term “signals intelligence” encompasses everything from the intelligence discipline itself and the activities conducted to collect information from cyberspace and other parts of the electromagnetic spectrum to the end products fed into the broader intelligence system.^Footnote19 In essence, SIGINT is the interception, collection, decryption, translation, and analysis of communications and non-communications signals, as well as the production of reports to enable the overall intelligence-gathering process.^Footnote20 Due to the sensitivity of this work, the processes, capabilities and products require special protection and handling and thus cannot be openly discussed.^Footnote21

SIGINT is further broken down into three subcategories: communications intelligence (COMINT), electronic intelligence (ELINT), and foreign instrumentation systems intelligence (FISINT). COMINT is comprised of intelligence gathered from the interception of electromagnetic communications, such as voice or text, other than by the intended recipient.^Footnote22 ELINT focuses on electromagnetic non-communications transmissions, such as from radar systems.^Footnote23 These types of transmissions can provide information about their source, such as the frequency used, pulse rate, and direction of arrival, among other characteristics.^Footnote24 The final category, FISINT, is a more specific field and is defined as “intelligence derived from the intercept of foreign electromagnetic emissions associated with the testing and use of aerospace, surface and subsurface systems.”^Footnote25 FISINT is used to collect intelligence concerning transmissions and data from missile and control systems, for example.^Footnote26 The three subcategories of SIGINT work together to provide the critical intelligence necessary to enable national and continental defence objectives and to inform national security operations, foreign policy, and cybersecurity.^Footnote27

SIGINT has a long, clandestine history, closely guarded by those charged with its execution, operating from the shadows to enable CAF operations since the Second World War.^Footnote28 A cornerstone of military operations, SIGINT provides insight into adversary intentions, capabilities, and activities, underpinning strategic decision-making, defending the continent, and enhancing situational awareness for deployed forces worldwide.^Footnote29

Like cyber operations, the role that SIGINT plays in CAF operations has only grown in relevance in the context of modern warfare, where technological advancements have reshaped the battlefield, military strategy and intelligence-gathering activities. The increasingly interconnected information environment creates vulnerabilities, allowing the SIGINT enterprise access to adversary communications, sensors and weapons systems to produce critical intelligence on capabilities and intentions. The dramatically increased use of information technology systems, integrated sensors, and command and control systems have compounded the relevance of SIGINT in the defence of CAF assets and the exploitation of our adversaries, paving the way for active defensive and offensive cyber activities to exploit these same adversary vulnerabilities.

The SIGINT-Cyber Nexus

SIGINT operations leverage cyberspace and its embedded technologies to exploit the adversary’s reliance on digital communications, interconnected devices, and the pervasive use of sensors to generate intelligence across all operational domains, including cyberspace. Intelligence generated by these processes enables CAF operations at all levels, from the tactical to the strategic. The interception of adversary communications and sensor data provides real-time intelligence on adversary locations and movements across all domains (air, land, sea, space, and cyberspace), informing threat assessments and targeting cycles for decision-makers. At the strategic level, it shapes situational awareness by discovering adversary intentions, capabilities and emerging threats.^Footnote30

While SIGINT and cyber operations both involve the use of digital technologies and operate in the cyber domain, they differ in scope, methodology and objective. SIGINT is primarily focused on the passive collection of information and the analysis of signals, whereas cyber operations can be both passive and active. Defensive cyber operations focus on safeguarding information and communications systems from intrusion, proactively protecting and securing them and responding to attacks, while offensive cyber operations aim to penetrate, manipulate and exploit adversarial systems. However, conducting cyber operations requires a deep understanding of threat actors, digital infrastructure, and its potential vulnerabilities. SIGINT can support these activities by providing the intelligence needed to identify targets and assess threats.

SIGINT-enabled cyber operations

Cyber operations, whether defensive or offensive, rely heavily on accurate and timely intelligence. SIGINT serves as a foundational element in informing cyber operations by intercepting and analyzing communications and non-communications signals to identify vulnerabilities in systems, detect patterns of cyber activity and better understand threat actors. CAF cyber operators must be able to understand the topology of target networks, including how systems are interconnected, the protocols used, and the locations and nature of vulnerabilities within these networks.^Footnote31

For defensive cyber operations, SIGINT can be used to reveal the structure and behaviour of the digital environment, as well as the intent and capabilities of adversaries and other cyber threat actors. Moreover, SIGINT can contribute to threat intelligence by identifying indicators of compromise, allowing the CAF to harden systems, deploy countermeasures and respond to intrusions. For offensive cyber operations, SIGINT can inform target selection, timing and tactics to ensure that cyber actions are precise and effective.

SIGINT can also facilitate attribution—the process of determining who is behind a cyberattack. Attribution is achieved by correlating intercepted communications with known threat actor behaviour. This is especially important in the modern threat landscape, where state and non-state actors employ sophisticated methods to obfuscate their identities.

SIGINT is essential for mapping network topology and understanding cyber threats. Its role in cyber operations extends beyond interception, as it enables comprehensive analysis to inform strategic planning and shape situational awareness for decision-makers. For the CAF, this relationship is underscored by the grouping of both SIGINT and cyber units under the same command. The establishment of CAFCYBERCOM enables better communication and cooperation between these strategically essential capabilities.

Cyber support to SIGINT

Canada‘s initial SIGINT evolution was based on two main objectives: leveraging its unique geography to enable sovereign defence and utilizing that unique geography, along with homegrown collection initiatives, to contribute to and benefit from the Five Eyes intelligence partnership with the United States, the United Kingdom, Australia, and New Zealand.^Footnote32 These requirements still exist today. SIGINT is a team sport because the prevalence of information systems, sensors, and transmitters makes it nearly impossible to parse the digital tsunami generated from all these sources. Finding, decrypting, analyzing, and reporting on the right information to satisfy intelligence requirements to enable CAF operations is immensely challenging. Being able to share that burden with like-minded, collaborative nations increases the amount of data that can be processed and exploited. Without the partnership of Canada ’s allies, that challenge would likely be insurmountable, particularly when operations take place in cyberspace. Canada’s size and proximity to adversarial countries provide a geographic advantage that is leveraged to deliver unique contributions, enhancing relevance in this domain, facilitating access to partner intelligence, and positioning Canada to utilize the full might of the Five Eyes, enabling CAF operations around the world.^Footnote33 In the evolving digital landscape, this partnership is more important than ever. By investing in both sovereign and integrated SIGINT infrastructure, Canada ensures that its contributions are not only supplementary but also provide distinct and valuable intelligence to both CAF and Five Eyes operations. These sovereign capabilities enable Canada to align its operations with national security priorities, thereby enhancing the relevance and impact of its intelligence. Their integrated nature also allows Canada to strengthen collective defence and information-sharing across the alliance.

SIGINT operations rely heavily on secure network infrastructure, telecommunications and radio-frequency communications, data flow from sensors, complex computing functions, automation, data analysis and, most importantly, integration and communication with partners and allies. This infrastructure is spread across the nation and the world, creating a significant and enduring technical and security challenge. All this leverages cyberspace, and none of it would be possible without support from cyber operations. Adversary cyber operations pose a significant threat to CAF operations, including SIGINT, by denying or manipulating information, conducting rapid or sustained collection, or engaging in deception activities.^Footnote34

It is defensive cyber operations that ensure the freedom of manoeuvre in cyberspace for SIGINT operations while protecting the critical assets, systems and facilities required to seek out, find, analyze and disseminate SIGINT. Moreover, SIGINT and offensive cyber operations work together to identify access points and understand the terrain in cyberspace, enabling intelligence collection and the delivery of effects. This critical nexus between cyber and SIGINT operations ensures that both are effective and sustainable.

Conclusion

The establishment of CAFCYBERCOM reflects a deliberate recognition by the Government of Canada and the CAF that cyberspace is a contested operational environment in which the CAF needs to be able to manoeuvre, defend its terrain, and deliver effects. In this context, integrating SIGINT and cyber capabilities under a single command is a logical response to the realities of modern conflict. As this article has demonstrated, SIGINT and cyber operations are deeply interdependent. SIGINT provides the intelligence foundation that enables effective defensive and offensive cyber operations, while cyber capabilities protect, enable and amplify SIGINT collection and analysis. Together, they form a mutually reinforcing cycle that enhances situational awareness, supports decision-making, preserves the CAF’s freedom of action in all domains, and facilitates the projection of military power through cyberspace.

As threats continue to evolve in scale, sophistication and speed, the importance of this SIGINT-cyber nexus will only increase. Co-locating expertise, authorities and capabilities within CAFCYBERCOM positions the CAF to better integrate signals intelligence and cyber operations, strengthen partnerships with allies, and respond decisively in the omnipresent cyber domain. Ultimately, the effectiveness of the CAF’s cyber forces will rest not in the strength of individual capabilities, but in the power of collaboration, integration and innovation.