Canada is deciding whether it wants to get into the business of cyberwar

To hack or not to hack?

That’s the conversation that is happening in an array of Western militaries, as details emerge of Russian interference in the American election, Chinese infiltration of various North American systems, and the recent hacking of the Ukranian power grid.

The question, now, is whether one good hack deserves another, and if NATO militaries ought to be using their military computer systems to hit back at actors and states that have stolen data and attacked critical infrastructure.

In Canada, the woman at the heart of that discussion says that while she can’t talk “conclusively” about how Canada is going to respond to cyber attacks against its systems, the option is definitely on the table.

Brigadier General Francis Allen, Director of Cyber for the Canadian Armed Forces, spoke to VICE News last week about a renewed push to bolster the Canadian Armed Forces’ cyber operations — under the four main pillars of ‘secure, operate, defend, sustain’ — but remained vague about whether Canada would be getting into the hacking business.

“Our focus is on ensuring that we are able to defend ourselves and conduct our military operation despite whatever the intent of adversaries may be, despite the environment,” she said over the phone on Friday.

The cyber chief noted the Department of National Defense has launched a series of consultations with industry to figure out technological solutions to beat hackers and defend Canadian systems. That, she says, will be bolstered by new training programs for military personnel and recruitment specifically targeting skilled technology operators.

“It lets us look at how, when we deliver this in the future, we want to have a heightened ability to defend at advanced threats.”

Allen says she’s not getting into details, yet, because she doesn’t want to preempt a public consultation on the future of the Canadian military that is currently wrapping up — but she did say that cyber attacks are a growing concern for the military.

“In general, for sure there’s been a steady increase in the number of state and non-state actors — criminals, terrorists, hackers — that really do have the ability to conduct some disruptive activities,” Allen said, specifically referencing cyber attacks against critical infrastructure in Ukraine. “So it’s really not to anyone’s surprise that there are bad actors out there, so we need to be sure that we can defend and respond to that.”

Exactly what that response looks like will be the million dollar question — and made relevant by the fact that Canada is facing a steady stream of state-sponsored hackers — and Allen is no stranger to the conversation.

Allen’s 2002 thesis, entitled CN(Eh?) — A Recommendation for the CF to Adopt Computer Network Exploitation and Attack Capabilities, spells out exactly how Ottawa can, and should, authorize the armed forces to go on the offense when it comes to cyber warfare.

“The purpose of this paper is to demonstrate that the Canadian Forces should adopt [computer network exploitation] and [computer network attacks] as military capabilities,” Allen wrote in her introduction to the paper. Later, the brigadier general — then a lieutenant colonel completing a degree at the Canadian Forces College — wrote that military hacking “should be recognized as special operations capabilities.”

Allen, who was appointed to the top cyber job in June 2015, could have her marching orders dictated by the defense policy review underway. It highlights the option of building hacking tools into the Canadian military’s armory.

“Cyber capabilities can be used to disrupt threats at their source, and can offer alternative options that can be utilized with less risk to personnel and that are potentially reversible and less destructive than traditional uses of force to achieve military objectives,” a public consultation document explains. It concludes: “We must consider how to best position the Canadian military to operate effectively in this domain.”

Defense Minister Harjit Singh Sajjan himself, in a sit-down interview with VICE News in Halifax last November, sidestepped the question of whether the Canadian military would look to establish, or even use, cyber as a weapon.

“We need to be mindful of how cyber is going to be used, and how we prevent future attacks, and we have had these discussions,” Sajjan said.

Sajjan was in Halifax for the Halifax International Security Forum where, coincidentally, Senator John McCain was reportedly approached by an intermediary regarding an intelligence report alleging that President-Elect Donald Trump had been the subject of an espionage campaign by the Russians as part of a wider plot to interfere with the American election.

That wider plot, which involved an advanced effort to compromise emails, computers, and networks of various American political players, prompted President Barack Obama to issue retaliation — although he decided to do so in a more analog way, expelling dozens Russian intelligence and diplomatic officers.

But while neither the United States nor Canada have engaged in overt cyberwar with any foreign state as of yet doesn’t mean that it hasn’t been on the table. Blogger Bill Robinson last year compiled a short history of the early discussions on cyber war in Canada.

Jason Kenney, Sajjan’s predecessor in the defense job whose government first kick-started the effort to upgrade the Canadian Armed Forces’ cyber operations, was a little more direct when he was asked in an interview with VICE News whether the Canadian military would ever conduct pre-emptive or retaliatory cyber attacks.

“I think you can reasonably assume that when the military develops a command, it has to have the capability to be both offensive and defensive,” Kenney said in 2015. “Potentially hostile countries need to know that, if they are going to launch cyber attacks against our critical systems, Canada and its allies have the capacity to retaliate.”