Canadian Military Journal [Vol. 26, No. 3, Summer 2026 – Special Issue on the Cyber Domain and Artificial Intelligence]

Christina Marcotte is a deputy director in the International Security Branch at Global Affairs Canada. She spends too much time reading about history and still thinks Vespasian is the most underrated Roman Emperor. The views expressed are her own.

As Canada heads further into the 21^st century, I am drawn to the words of 19^th century British Prime Minister Lord Palmerston: “We have no eternal allies, and we have no perpetual enemies. Our interests are eternal and perpetual, and those interests it is our duty to follow.”^Footnote1

This commentary will describe actions by the Government of Canada (GC) to protect and advance Canadian security interests in an era of technological power. It will focus on cyberspace and cyber tools, including Artificial Intelligence (AI) (for the purposes of this commentary, I will leave aside the presumed transformative benefits of AI and other technology on business processes). Within this scope, I will focus on the adoption of technology by the state and the governance of its use, both in a responsible way. Responsibility in this context means actions reinforce the international cooperation that has benefitted Canada and respect Canadian democratic principles. Doing so in these two ways reinforces the governance systems that have allowed Canada and Canadians to prosper.

On the first point, security in the 21^st century requires a state to adapt to changing technologies. Without the adaptation, it leaves Canadians exposed to threats to their personal and financial information and leaves Canada at a disadvantage when facing threats from adversary state and non-state actors. Foreign militaries, espionage agencies, criminals, online activists and other malicious actors operate in cyberspace.

With the vast number of threats facing citizens in cyberspace, it would be a violation of the social contract by Canada towards its citizens not to develop and use tools to counter those threats. The social contract includes the agreement that the government will use the money citizens provide to protect them. The capability to act in cyberspace to disrupt and degrade malicious cyber actors, including criminals and the cyber infrastructure criminals use, is part of that protection.^Footnote2

On the second point, on governance, this is linked to the Rules Based International System (RBIS). The RBIS is the international context that has evolved since WWII and features multilateralism and its institutions such as the United Nations (UN), international law, treaties, and norms.

Canada’s economic prosperity is a result of the RBIS providing stable, predictable rules for global trade and economic interactions. At the same time, the RBIS provides Canada with a stable security situation by providing a system to cooperate on international challenges and to develop mutually agreed-to codes of conduct and behaviour. As one of 193 UN member states, and a middle power in a world of increasing numbers of middle powers along with several superpowers, Canada cannot shape the world to its views. Working with like-minded countries is in Canada’s interests. The RBIS provides a known and reliable framework for cooperation. It is not perfect, but its underlying values of equality and predictability are far better for Canada than a system where strength alone determines who wins.

In the context of the RBIS, a core pillar of Canada’s principles and processes is responsibility. There are two aspects of responsibility. The first is the responsibility to act; the second, to act responsibly. First, those states that can act, should. It is the act of a responsible state to take action when it can. To contest the space where malicious actors operate. To leave the space uncontested leaves citizens vulnerable and at risk, more than they need to be. This is equally true for Canadian citizens as well as citizens of states that lack the wealth and means to take the same actions as Canada can.

Those actions must also be responsible. Canada must use those tools responsibly, in accordance with the RBIS. Specifically, the Framework of Responsible State Behaviour, which Canada publicly committed to at the UN.^Footnote3 The Framework includes the recognition that international law applies to cyberspace, the adherence and implementation of agreed-to norms (in particular the 11 UN norms), implementation of cyber-related Confidence Building Measures, and capacity building for developing states^Footnote4.

Using tools responsibly supports and reinforces the RBIS, the same RBIS that has benefitted Canada. This is critical at a time when the RBIS is facing challenges. Real and current challenges from states that are seeking to re-shape the global system to benefit their interests, regardless of the impact on other states, or to benefit from the weakness of other states in a “might makes right” system.

As a democratic country, Canada’s responsible state behaviour also includes accountability and transparency. Accountability means Canada adheres to its obligations under applicable international and domestic law, its commitments to voluntary norms and other public commitments, as well as specific, additional governance such as the military chain of command. Transparency means Canada will be public about its capabilities and how it uses them (not including the details of operations) and subject to the appropriate oversight. Both are important to prevent abuse of power and to ensure citizens’ confidence in their government.

Turning first to accountability. Technology is used as a tool of state power, which includes AI, whether for espionage, weapons and arms, or other uses not yet foreseen. Yet technology and AI are not separate from the infrastructure that supports it. When I write, “AI will be used as a tool of state power,” it also means “AI will be used in cyberspace and as a cyber tool of state power.” Cyber is both a domain and a tool. Cyberspace is a domain of civilian and military activity the same as land, sea, air, and space, a place with dimensions through which operations take place. And it is through the RBIS that states worked out how to govern cyberspace. Canada already has clear rules and norms when it comes to cyberspace and using cyber tools, in particular the Framework for Responsible State Behaviour mentioned above. And as AI is integrated into weapons, the use of those weapons will still be governed by rules of engagement and applicable law.

AI is also more than the next step in cyber, and it is difficult to anticipate all its potential uses. States are aware of this and are currently working within the RBIS to govern how they use AI as a tool of state power. On the military AI side, there are several plurilateral initiatives specific to AI and military use. These include the 2023 United States-led Political Declaration on Responsible Military Use of Artificial Intelligence and Autonomy,^Footnote5 which was launched at the Dutch-led Responsible AI in the Military Domain Summit (REAIM 2023). In addition, NATO’s 2024 Revised AI Strategy includes an aim specific to responsible behaviour: “to provide a foundation for NATO and Allies to lead by example and encourage the development and use of AI in a responsible manner for Allied defence and security purposes.”^Footnote6 On the multilateral side, there is also UN Resolution 79/239 on Artificial Intelligence in the military domain.^Footnote7

Domestically, the Government of Canada is accountable to its citizens for its actions. Actions over the past several years also speak to its credibility as a responsible actor and in meeting its security commitments to its citizens. Actions by the federal government include the publication of a National Cyber Security Strategy in 2018 and in 2024,^Footnote8 the creation of the Canadian Centre for Cyber Security in 2018, the creation of the RCMP’s National Cybercrime Coordination Centre, also in 2018, the prevalence of technologies in the Department of National Defence’s 2017 Strong, Secure, Engaged,^Footnote9 and 2024 Our North: Strong and Free,^Footnote10 and updated legislation for the Communications Security Establishment in 2019.^Footnote11

Less visible to the public, but equally important was the creation in 2018 of a unit at Global Affairs Canada to focus on cybersecurity policy internationally and which now also includes AI governance. This unit has the expertise required to represent Canada and Canada’s security interests at the United Nations and other multilateral forums and leads on coordinating Canada’s contribution to international initiatives such as the United Kingdom- and France-led effort to counter the proliferation of cyber intrusion tools (Pall Mall Process).^Footnote12 In addition to this unit, Global Affairs Canada’s international law division has lawyers who specialize in cyberspace. This unit contributed meaningfully to the RBIS and to transparency by the Government of Canada by developing and publishing Canada’s position on the applicability of international law in cyberspace.^Footnote13

Other measures taken by the Government of Canada for transparency include 2017’s Defence strategy Strong, Secure, Engaged, initiative 88, that specifically says the Canadian Armed Forces would “develop the capability to conduct active cyber operations focused on external threats to Canada in the context of government-authorized military missions. The employment of this capability… will be subject to the same rigour as other military uses of force. Cyber operations will be subject to all applicable domestic and international law, and proven checks and balances such as rules of engagement, targeting and collateral damage assessments.”^Footnote14 Whether those cyber tools are enhanced by AI or not, they will still be subject to accountability mechanisms. By being public about the military’s use of active (also called offensive) cyber operations and how they will be governed, Canada reinforces the RBIS.

The Communications Security Establishment Act (CSE Act) is also public about Canada’s active cyber operations. Section 30 of the CSE Act states that the Ministers of National Defence and Foreign Affairs authorize active cyber operations and subsequent sections of the CSE Act detail the types of activities authorized and prohibited and the procedures for authorization.^Footnote15

In addition, from both a democratic principle and transparency perspective, the National Security and Intelligence and Review Agency (NSIRA) and the National Security and Intelligence Committee of Parliamentarians (NSICOP) play key roles. NSIRA’s mandate includes the review and investigation of Government of Canada national security and intelligence activities to ensure that they are lawful, reasonable and necessary.^Footnote16 Broadly speaking, NSICOP reviews the legislative, regulatory, policy, administrative and financial framework for national security and intelligence and any activity carried out by a department that relates to national security or intelligence.^Footnote17 NSIRA and NSICOP must each submit to the Prime Minister an Annual Report, and the Prime Minister tables the Committee’s reports in both Houses of Parliament.

On a last note, being a responsible technological actor also gives Canada credibility when increasing cooperation with partners and allies. The scale and scope of the threats mean Canada cannot protect its security alone, and these partnerships are essential. They are essential to understand the threats, develop the best ways to mitigate and manage the threats, and to counter them. Working together takes trust; it takes even more trust to work effectively together. This credibility, from the congruence between Canada’s behaviour and its words, helps establish Canada as a trusted partner. This includes in longstanding partnerships such as NATO, as well as newly developing and deepening ones as Canada pursues its Indo-Pacific Strategy.

As Canada looks towards the future, as Canada meets its security needs in the years ahead, Canada will continue to be a responsible state player in cyberspace and will be as new technologies are introduced. This includes how Canada will use AI and any other technology as a tool of state power. New technological advancements and the developments associated with them will not change the social contract between Canadians and their government, nor the government’s continued work to protect its citizens. The actions taken to date by the GC demonstrate this commitment. Continuing to act as a responsible state player demonstrates the commitment to the governance systems internationally and domestically that have allowed Canadians to prosper.