New Canadian Defence Investments: What's the Impact on Cyber?
PM Carney announced new defence investments to reach 2% GDP spending on the military this fiscal year, I take a look at the potential impact on Cyber
Canadian Cyber in Context is sponsored by
All views expressed belong to Canadian Cyber in Context and do not reflect the position of any sponsor.
On 9 June 2025, Prime Minister Mark Carney announced an additional ~$9 billion in defence investments for this fiscal year so that Canada can achieve its goal of 2% of GDP spending on defence by the end of the year. For many, this was a bit of a surprise for me and many others after Carney had previously promised not to hit the 2% defence funding for another couple of years. Nevertheless, we shan’t look the gift horse in the mouth. These announcements, along with the specifics, have been welcomed and applauded by many defence critics. This includes myself because the announcements include a sizeable portion not just for “cyber,” but also many other issues which overlap with cyber and digital capabilities. However, as much as there is to be optimistic about, there are still a lack of details as a result of how fast the government is moving. General areas have been identified for investment, but many specifics are still being determined.
Although the announcement mentions cyber capabilities and digital infrastructure, we still do not know much. Many decisions related to the investments remain up in the air and to be determined, but the commitment is there. Over the past couple of weeks, I have gotten a rough picture of what we can expect from technical briefings and speeches by CAFCYBERCOM officials.
While I am certainly delayed compared to others in getting out some commentary about these investments, I wanted to wait until I got to hear CAFCYBERCOM Commander Major General Dave Yarker speak, which sheds some light on some specifics of these investments. In addition, with the DND/CAF Departmental Results Report 2023-24 now out, this also gives us a lot more to understand what these investments may support.
What does the announced $9 billion in new defence investments include for cyber?
The Prime Minister’s announcement keeps it quite brief:
Building capacity in AI, cyber, quantum, and space is the usual language related to cyber capabilities, but what is particularly interesting are investments in “modern and secure digital infrastructure” and mentions of investments in “digital foundations.” This is great to see, but there remain many unanswered questions about what all of this entails and what these foundations are.
This is a fast-moving portfolio, and many specifics appear to still be in development, but there is a current direction and idea of what they want. This includes not only capabilities but also people and direct capacity for DND/CAF overall and CAFCYBERCOM. However, the backgrounder that DND has released provides more details:
The investments are divided into six primary categories, each likely to overlap with cyber and digital capabilities, but these three are the primary ones likely most connected to DND/CAF’s cyber capabilities.
There is a lot of vague information here, so let's parse out what this announcement says about cyber and digital capabilities.
There is an explicit $560 million for something being referred to as digital foundations, but this is not the only funding going to cyber/digital.
The $2.6 billion for “A Strong Fighting Force” and $1 billion for “expanding and enchancing existing and emerging military capabilities.”
This appears to be about recruiting and keeping cyber experts and investing in cyber and related capabilities such as AI and quantum.
At the very least, $560 million is going towards digital foundations. However, based on the descriptions in the backgrounder and the Prime Minister’s announcement, we know there is significant investment in digital modernization and cyber capabilities. As a result, it may not be out of the question to expect upwards of $1 billion to be spent directly on cyber and digital capabilities and even more on related/overlapping capabilities.
In light of this, I will examine in more depth what we know of the new defence investments and what potential relevant existing projects these investments could impact.
The Breakdown
The investments for cyber and digital capabilities are distributed between DND/CAF and CSE, but initial impressions appear that the bulk is going to DND/CAF. This is very noteworthy and good news because this has not always been the case. Historically, CSE has been considerably favored for any funding related to cyber or digital capabilities, which left DND/CAF significantly behind in digital modernization. The messaging given related to these new investments is that they hope to use the new money to push greate digital modernization.
CSE appears to be getting a massive boost in its budget, so part of these investments going to CSE seem to be helping to boost CSE’s overall budget.
On multiple occasions, investments in cyber and digital capabilities were specifically given to CSE instead of DND/CAF. This is not to say these funds were misused or should not have gone to CSE; CSE does tremendous work, but DND/CAF digital modernization has suffered from a lack of specific effort and funding. These new investments should hopefully put a dent in changing this.
Modern and Secure Digital Infrastructure/Digital Foundations
Although we have a general idea of what digital foundations mean, it is still a very vague and imprecise term. Broadly speaking, from what I have been able to understand, Digital Foundations is for a few different purposes. Like many other investments, it sounds like a lot of this new funding is meant to “grease the wheels,” whereby the bureaucratic and institutional mechanisms of the procurement process are being used to make decisions and decide on what DND/CAF needs are being funded. However, beyond this, what are the specific areas we can expect investment in, and what are the potential projects to benefit?
Digital modernization
The CAF Digital Campaign Plan identifies DND/CAF as “digitally aware” on the digital maturity model. This means that while DND/CAF are using digital tools and use data, these processes remain isolated and siloed with minimal cross-organizational data use or sharing. Under the Digital Campaign plan, they intend to make a significant push to become “digitally enabled.” This isn’t one singular action, but about a whole-of-DND/CAF effort to align towards digital modernization.
Secret Cloud
One of the key capabilities that I and many others think (or at least hope) that this funding will be going towards. A lot of the projects and policy for Secret Cloud has been a bit of a mess, a victim of losing key people and a general lack of prioritization or support. Over the last couple of years this has changed and there are signals that DND/CAF are finally getting a handle on what they need and have started the preliminary policy and architectural steps towards acquiring a cloud networking environment for secret data and operations.
There is no singular “secret cloud” project; it is distributed across several different ones. However, one of the foundational projects is Information Technology in Support of Command and Control (ITI in SP of C2), which has struggled to make much progress in the procurement process. There are other projects that would support acquiring secret cloud, some of which are mentioned below.
Digital Services Group
What is not often mentioned in relation to DND/CAF’s cyber and digital capabilities is how it has been stuck in change management for many years now. Finally, DND created the Digital Services Group, which combines all existing DND/CAF organizations into one to reduce redundancy and conflict. However, it is unclear to what degree the change management to develop the Digital Services Group has been successful. An initial review of the latest departmental results would indicate that there has been considerable progress over the last couple of years, but many questions remain.
If many of these investments are meant to support capacity to build up the forces, with the Digital Services Group as the administrative and supportive in relation to CAFCYBERCOM and charge of DND/CAF’s digital enterprise, it means they are at the center of these investments for digital foundations.
Departmental Results Give Hints
I will be releasing a full examination of DND/CAF’s latest Departmental Results next week, but we can take a small glimpse to get a better idea of where DND/CAF is related to digital modernization and likely areas for new defence investments. One way to interpret “digital foundations” is the intent to support and invest in the mechanisms and capabilities of digital technologies which drive current CAF-wide doctrine and strategic plans: connectivity and data.
Connectivity
One of the toughest policy issues regarding digital modernization that DND/CAF have had to resolve is how to procure and integrate secret cloud into CAF work and operations without costing security. This is both a policy and technology issue. With zero-trust security and identity management, a transition to cloud overall would likely be an improvement in DND/CAF cybersecurity overall due to the greater ability to centralize and manage the security of cloud networks. A central part of making this happen, especially under existing policies related to data classification, is ensuring the gateways are secure and managed. There were some specific mentions of Defence365, so seeing how much progress DND/CAF have made in developing its network architecture likely hints that some of the defence investments will be to help finish this work and finally stand up an initial instance of Secret Cloud.
Data Processing and Management
The ability to harness and use data is a critical component to digital modernization and how the CAF plans to operate in the future, so seeing a data costing guide and other components to equip DND/CAF to better use and acquire the means to process data.
DND/CAF are sitting on massive depositories of data. This is both regular business data, but also operational data. DND/CAF’s future operating concept of pan-domain command and control hinges on making use of this data.
Related Projects
There are a few projects that could be related, but is already being implemented or deployed, so they may not any additional direct investment. However, I have listed below a series of projects that could see some additional investment based on some of the indicators thus far. A few of these projects have had ongoing issues in its options analysis and definitions phases, so investments in some of these are likely to entail conditions of getting things back on track. One major component to some of these delays is turnover and losing expertise and others working on the project. As capacity building and recruitment is a major focus of the investments, the government is looking at investments in programmatics and people to make progress.
Budget: $50 million - $99 Million
Network Command Control Integrated Situation Awareness Capability
This is a particularly important one for digital foundations for network management and situational awareness.
Budget: $100 - $249 Million
Budget: $250 - $499 Million
DEFENCEx (Digital modernization of Defence Resource Business Management program, an audit of the modernization efforts in 2021 here)
Information Technology Infrastructure in Support of Command and Control
This is a particularly important one. All about getting data to the “shooters,” be it an F-35 or artillery.
Budget: $500 Million - $1 Billion
CF Land Electronic Warfare Modernization
Based on CAFCYBERCOM Commander’s recent comments, it appears they are very interested in modernizing and improving upon their electro-magnetic capabilities.
Budget: $ 1 Billion - $4.99 Billion
Land Command Support System Tactical Command and Control Information System Modernization
Modernized Command and Control Information System
This is a NORAD-modernization specific project for network modernization that will include cloud as a core component.
Budget: >$ 5 Billion