Is Canada's Security Screening Failing?

0:08 Hello and welcome back to the Global Intelligence Weekly Wrap Up. I'm your host, Neil B. Son, a retired intelligence officer with the Canadian Security Intelligence Service, and the director of the Global Intelligence Knowledge Network. Each week I take open source reporting from various news reports around the world on espionage, sabotage, national security, foreign interference and terrorism, and provide you with the insights, analysis, and intelligence to help you understand the shadowy world of spies, how it affects your career, your country, and your safety.

0:34 It's been a busy week, from concerns over Canada's security screening process to suspected Russian drone attacks against Germany. There's a lot to discuss, so let's get started. We begin this week in Canada, where the federal government is considering changes to its national security screening system following the arrest of a Canadian intern accused of espionage while working at NATO headquarters in Belgium.

0:53 On October 21st, David Morrison, Prime Minister Mark Carney's senior diplomatic and international affairs advisor, appeared before the House of Commons Standing Committee on Public Safety and National Security. Morrison suggested that a government-wide registry of security clearance information could help federal departments identify relevant personal security information, reduce duplication, and improve the effectiveness of security screening.

1:16 But this raises an important question. If an individual has already been identified as having engaged in dishonest behavior during a federal government employment process, shouldn't that information be available to the people responsible for determining whether that individual can be trusted with classified information?

1:30 And if that information isn't being shared, what other warning signs might be slipping through the cracks? Regular listeners may remember that we discussed this very issue during our October 9th episode of Global Intelligence Weekly Wrap-Up. The case involved Bi Wei Zhang, also known as Claire Zhang, a Canadian national arrested by Belgian authorities on the 24th of July.

1:51 Zhang had been working as an intern at the Supreme Headquarters Allied Powers Europe or Shape in Mons, Belgium. She was arrested on allegations involving espionage for a third country and participation in criminal organization. Reuters reported that the allegations were linked to China, although Chinese Embassy rejected suggestions that Zhang had been spying for Beijing.

2:10 What makes this case particularly concerning is the information that was already available before her arrest. In 2023, Canada's Public Service Commission determined that Zhang had committed fraud during an appointment process involving the Canada Border Services Agency. The conduct reportedly involved submitting applications using different names and email addresses without clarifying that they came from the same individual.

2:32 Zhang challenged the finding, but the federal court dismissed her application for judicial review in 2024. Despite this finding, Public Safety Minister Gary Anasanguri confirmed earlier this month that Global Affairs Canada had granted the individual a security clearance. And this brings us to the latest parliamentary testimony.

2:49 Morse explained that the responsibility for security clearances is divided across several government organizations. The Treasury Board Secretariat establishes the overall policy framework. RCMP and CESIS provide criminal checks and national security assessments within their respective mandates, but the ultimate responsibility for granting a clearance rests with the federal department or agency making the decision.

3:10 This is an important distinction. CESIS does not simply grant security clearances to every federal employee. It provides security assessments and advice that departments consider alongside other information when determining whether an individual should receive access to sensitive or classified material.

3:25 In our October 9th episode, we identified four questions that investigators needed to answer. 1. When was Zhang's clearance granted? What information was available at the time? Who knew about the earlier finding of fraud? And four, how was that information assessed? Those questions remain relevant today.

3:44 A finding of dishonesty in an employment process does not automatically establish that someone is engaged in espionage, but honesty, reliability, and trustworthiness are fundamental considerations when assessing an individual's suitability for access to classified information. The proposed government-wide registry could improve how departments identify existing clearance information.

4:02 However, a registry alone would not necessarily resolve the underlying problem. A record is only useful if it has relevant information that is accurate, accessible to authorized decision makers, and properly evaluated, and this is where Morrison's other recommendations become particularly important. He suggested greater consistency in the use of open source background checks, common training standards, improved access to relevant human resource information, and continuing personnel security assessments through an individual's employment.

4:29 These are not simply administrative improvements, they are counterintelligence safeguards. During our December 12, 2025 episode, we discussed Canadian military intelligence member, Master Warrant Officer Matthew Robar, who faced allegations involving the unauthorized communication of safeguarded defense information to a foreign entity.

4:46 We returned to the broader issue of espionage and insider threats during our December 27th yearly wrap-up. Those discussions highlighted an important principle. The greatest vulnerability is not always someone attempting to penetrate a secure facility from the outside. Sometimes it is someone who has already been granted limited access.

5:03 We revisited that concern on our October 9th episode when we examined the Zhang investigation alongside allegations involving a former German intelligence chief, August Hanning, and the admitted fraud committed by former senior CIA official David J. Resch. Although these cases involve different circumstances and legal proceedings, they demonstrate why security screening cannot be treated as a one-time administrative exercise.

5:26 In security screening, as with anything, people's circumstances change. Financial difficulties, undisclosed relationships, significant changes in behavior, and attempts to obtain information outside assigned duties can all warrant further examination. Although none of these factors alone can or will establish espionage, they must still be assessed objectively, proportionately, and in context.

5:46 An effective security screening program must be capable of recognizing changes that could indicate an emerging insider threat, and it must ensure that relevant concerns reach the peoples responsible for making security decisions. Wesley Warke, a senior fellow at the Center for International Governance Innovation, told Parliamentary Committee that Canada's current security screening system is unsustainable.

6:06 He argued that CESIS is carrying a substantial screening workload in addition to its core intelligence responsibilities. Warke suggested Canada consider following the United Kingdom's example by establishing a separate, centralized organization responsible for security clearances. This raises another important consideration.

6:22 Would removing some of the administrative security screening burden from CES allow the service to dedicate more resources to investigating espionage, foreign interference, terrorism, and other threats to national security? Potentially, but centralization also introduces questions about accountability, privacy, information sharing, and the security of clearance records themselves.

6:42 The centralized systems contain sensitive personal information that would be a track target for hostile intelligence services. Any reform would therefore need strong safeguards governing who has access to that information, how it is protected, and how decisions can be reviewed. There's another dimension to this story that deserves attention.

6:59 Canada's security screening system doesn't operate in isolation. When Canada's personnel are assigned to sensitive positions with organizations such as NATO, the effectiveness of our screening procedures can have consequences for our international partners. Allied intelligence relationships depend on trust, and that trust extends beyond the intelligence being shared to the people authorized to access it.

7:19 As we discussed in October, NATO security personnel reportedly identified concerns that ultimately contributed to the investigation involving Zhang. That demonstrates the importance of having multiple layers of security rather than relying exclusively on initial clearance. From my perspective, the issue isn't simply that Canada needs a new registry or another set of screening procedures.

7:37 It's whether the government can demonstrate that relevant information is being collected, shared, assessed, and acted upon throughout an individual's employment. A security clearance should never be interpreted as a permanent guarantee of trustworthiness. It is an assessment based on information available at a particular point in time.

7:54 The challenge is ensuring that the assessment remains relevant as circumstances change, and until we know precisely what information was available when Zhang received her clearance and how that decision was made, we cannot conclusively determine where the screening process may have failed. What we can say is that the largest parliamentary testimony identifies specific areas where Canada's system could be strengthened.

8:14 The next question is whether those recommendations will result in measurable improvements. Because when it comes to national security, identifying a vulnerability is only the first step. Addressing it before it can or is exploited is truly what matters. According to Reuters, Germany's armed forces, the Bundesrear, have classified the threat of Russian sabotage as significant, the second highest level on their internal threat assessment scale.

8:55 This is the first time the threat has been assessed at this level. The reassessment follows the discovery in September of a crash drone near Wundstorf military base in Lower Saxony. Investigators also discovered a container holding high explosives near the drone. What makes this particularly concerning is that German investigators believe the drone may have been intended to target German military aircraft, and this isn't an isolated incident.

9:17 In August, German authorities accused Russia of carrying out an attempted explosive drone attack at Litchbig Hale Airport, where aircraft supporting Ukraine were reportedly targeted. Russia has denied involvement in sabotage operations against European countries. But German military intelligence is now assessing something particularly important.

9:35 Russia may not simply possess the capability to conduct these operations. German authorities believe Moscow's willingness to employ potentially lethal sabotage against Germany and German military targets has increased. That represents a significant change in the threat assessment. For listeners who have been following the Global Intelligence Weekly wrap-up, this story should sound familiar.

9:55 We've been examining the evolution of sabotage and proxy operations across Europe for several months. At our September 11th episode, we discussed attacks against Germany's electrical infrastructure and the vulnerabilities that relatively simple acts of physical sabotage can expose. In the same episode, we examined reports concerning suspected Russian activity near Slavbard, where NATO allies were investigating potential threats to undersea communication cables.

10:18 Then again on September 25th, we examined a suspicious fire at a Starlink ground station in Poland. Polish officials believed the incident involved deliberate sabotage, but we were careful to explain that Russian responsibility had not been publicly established. We also discussed an assessment from Denmark's Defense Intelligence Service warning that Russia was expected to intensify its hybrid operations against NATO in the West.

10:40 Now, less than a month later, Germany is raising its own military sabotage threat assessment. This is a significant progression. We have moved from examining individual incidents involving electrical grids, communication infrastructure, and transportation networks to a formal military assessment, warning that German armed forces themselves may face direct attacks.

10:59 And there's another detail worth examining. Additional reporting from Germany's WDR in Studzettung indicates that technical analysis suggests the drone discovered near Wusstorff may actually have been lying there for approximately two years. The discovery is recent, but the suspect activity may be considerably older.

11:17 That distinction matters because the intelligence significance lies partly in what the investigators are now learning about the potential duration and nature of the threat. German investigators have also identified other incidents of suspected reconnaissance involving sensitive military infrastructure.

11:33 These reportedly include suspicious drone flights near an Aero 3 missile defense site and obsolete associated with Patriot Air Defense maintenance. Authorities also discovered a concealed camera monitoring a strategically important railway station in Minden. Now we need to be cautious here. These incidents do not by themselves establish that every suspicious drone flight or surveillance device was directed by Russian intelligence.

11:57 But collectively, they raise an important intelligence question. Are we observing unrelated security incidents? Or are some of these activities part of a broader effort to identify vulnerabilities, monitor military movements, and prepare for future disruption? This is precisely the type of question intelligence services and NATO military need to ask themselves.

12:16 And it brings me to something particularly relevant this week. I just completed teaching another session of my Sabotage and Proxy Operations and Military Intelligence course through the University of Ottawa's Professional Development Institute. As part of its National Security and Intelligence Certificate Program, during the course, we examined how sabotage operations have evolved, how intelligence services can employ intermediaries or proxies, and why attribution remains one of the most difficult challenges in identifying state-directed hostile activity.

12:43 We also discussed how seemingly minor incidents can become more significant when examined collectively. I'll leave a link in the notes in the transcript for those of you who are interested in taking the course. So what do we have? A suspicious drone sighting, a camera position near transportation infrastructure, damage to an electrical station, and an attempted attack against aircraft.

13:03 Viewed individually, these may appear to be separate security or criminal investigations, but intelligence analysis requires us to examine the relationship between the events, the capabilities involved, the possible objectives, and the evidence connected to those activities and these particular actors.

13:19 It's also important to understand the distinction between sabotage and proxy operations. Sabotage describes the activity intended to damage, destroy, or disrupt a target. A proxy operation describes an arrangement in which an actor uses another individual organization to conduct activity on its behalf, potentially creating distance between the operation and whoever directed it.

13:40 Not every act of sabotage is a proxy operation, but when a foreign intelligence service recruits or directs intermediaries to conduct sabotage, those two methods can intersect, and the strategic objective may extend well beyond the immediate physical damage. Disrupting equipment deliveries, delaying military training, increasing security costs, and creating public anxiety can all affect a country's willingness or ability to support Ukraine.

14:05 That is a broader concern reflected in Germany's latest assessment. Germany's decision to raise its sabotage threat level is significant not simply because of the discovery of an explosive equipped drone. It's significant because German authorities are reassessing the possibility that their own military personnel and facilities could be directly targeted.

14:24 The Bundschwehr is responding by strengthening protective measures, including patrols and technical surveillance at vulnerable installations. But the larger lesson extends beyond Germany. As we've repeatedly discussed on the Global Intelligence Weekly wrap-up, modern sabotage campaigns can target military facilities, civilian infrastructure, and the systems connecting them.

14:44 The challenge for Intelligence and Security Agency is to identify which incidents are connected, establish responsibility through credible analysis and evidence, and intervene before reconnaissance or preparation develops into an attack. For Canada and other NATO members, this isn't just a European security problem.

15:00 An attack intended to disrupt one ally's ability to support Ukraine can have consequences for the entire alliance. The intelligence takeaway is this individual incidents tell us what happened. Identifying patterns help us understand what may happen next and how to possibly prevent it. And that is why the continuing evolution of sabotage and proxy operations deserves attention not just from the military, law enforcement, or intelligence organizations, but from all of us.

15:46 According to Agence France Press, the men, aged twenty four and twenty five, were rearrested on October twentieth under Section 3 of Britain's National Security Act, which addresses conduct assisting a foreign intelligence service. One of the men is a British citizen, the other holds British and Iranian citizenship.

16:01 Both men were from London. The investigations follows an incident on September 27th, near RAF Fairfurt in Gloucestershire. Police responded to suspicious vehicles and found three vans containing petrol. Armed officers and bomb disposal specialists attended, but no explosives were discovered. Seven men were initially arrested and released on bail.

16:20 Two have now been rearrested in connection with suspected foreign intelligence assistants. RAF Fairfort is strategically important. It supports United States Air Force deployments, including long-range bombers, and has been used for American operations against Iranian targets. That makes it a plausible location of interest to an adversary seeking information about military activity.

16:40 But the precise purpose of the suspected activity remains unknown. Bruce investigators have described Iranian state involvement as highly likely while continuing to examine the nature of that involvement and the intended objective. Iran denies involvement. At the time of this reporting, no charges have been announced.

16:56 We won't make an unjustifiable leap from suspicious vehicles to a proven plot of attack on the base. Investigators must establish what the individuals were doing, who directed them, and whether any criminal offenses occurred. But this story does have connections to a case that we followed previously in episodes of the Global Intelligence Weekly wrap-up, specifically the case of Daniel Khalif.

17:15 In November of 2024, we examined Khalif's trial. He was a former British Air Royal Corps of Signal Soldier accused of collecting sensitive military information and collecting and communicating with Iranian intelligence contacts. The evidence included information about military communications and serving personnel, including Special Forces members.

17:33 Khalif claimed he was trying to deceive Iranian intelligence as part of his own unauthorized operation. The jury rejected his defense on the espionage related charges. He was also notorious for escaping the Woodsworth prison in 2023 by hiding beneath a food delivery vehicle before being recaptured. When we returned to the story in February 2025, he was sentenced to 14 years and three months for spying for Iran and escaping custody.

17:57 He was acquitted of a separate bomb hoaxed charge. That distinction is important when recalling the case. Now to be fair, the Khalif case is one of an insider threat. He had legitimate access to military information because of his job. The Fairford suspects have not been publicly identified as military personnel, and there is no established link between them and Khalif.

18:17 But the cases illustrate two different potential approaches to the same broad intelligence problem. One concerns access from inside a military organization. The other concerns suspected activity outside a strategically important military installation. There is a wider historical context here as well.

18:32 In October of 2024, we discussed MI5 Director General Ken McCullum's warning that British intelligence and police had responded to 20 potential lethal, Iranian-backed plots since January of 2022. Many involve threats against dissidents and critics of Taram. The Khalif case added the concern of Iranian intelligence contacts within armed forces.

18:52 The Fairford investigation raises questions about potential interest in military operations themselves. These events do not establish one connected campaign. They do, however, show why British counterintelligence officials remain concerned about the breadth of potential Iranian state activity. Section 3 of Britain's National Security Act is also significant.

19:10 It allows authorities to investigate suspected assistance to a foreign intelligence service, even where the public evidence does not establish theft of classified documents or a completed act of sabotage. The law does not prove the allegations in the case. It helps explain the nature of the investigation.

19:25 From an intelligence perspective, the distinction between suspicion, assessment, and proof matters. Police may have strong grounds to suspect foreign direction while still needing to establish exactly what occurred and whether the evidence supports charges. And that brings us to the thread connecting most of these segments for this week.

19:41 In Canada, we're examining whether the right information reaches the people responsible for granting and maintaining security clearances. In Germany, the concern is reconnaissance and potential sabotage against military infrastructure. In Britain, investigators are examining suspected assistance to Iranian intelligence near an airbase.

19:59 And in our next segment, we'll discuss a NATO cyber base where Russian linked operators obtain authorized network access to a defense contractor. Different countries, different actors, and different methods. But each story turns in some way on access, access to sensitive positions, facilities, networks, personnel, or operational information.

20:20 The intelligence challenge is to identify vulnerabilities and hostile activity early, assess them with evidence, and intervene before access can be exploited further. That is the difference between understanding an emerging threat and simply investigating the damage after the fact. As I alluded to in the previous segment, our final segment this week keeps us in Europe.

20:48 But this time we're moving from physical sabotage to cyber espionage. And what makes this story particularly interesting is that we've been following the activities of Russian military intelligence against NATO for some years. According to Cyberscoop, cybersecurity researchers have uncovered a Russian-linked espionage campaign targeting three organizations and two NATO member countries.

21:10 Those targets include a naval shipholder, a manufacturer of military aircraft engines, and a law enforcement agency. The countries and organizations haven't been publicly identified. The investigation was conducted by Semantics Threat Hunter team, which attributes the activity to a group known as ABT or Advanced Persistent Threat 28, also called Fancy Bear, Force Blizzard, and Swallowtail.

21:35 Western governments have linked this group to Unit 26165 of Russia's military intelligence service or the GRU. And the targets are particularly significant. We're talking about organizations that can possess sensitive information about military production, engineering capabilities, procurement, supply chains, and national security operations.

21:54 This isn't simply a case of hackers trying to steal credit card information or demand ransom. Activity semantics identified is consistent with intelligence collection operation, but what did the attackers actually accomplish? The investigation provides a detailed picture of how the attackers gained access to one of their targets.

22:11 On July 24, 2026, an employee at the Naval Shipbuilding Company opened a malicious Microsoft document received through email. The document installed a backdoor called HookEdge. A backdoor is a piece of malicious software that allows an unauthorized individual to access a compromised computer and potentially issue commands without the legitimate user's knowledge.

22:34 In this case, the attackers used a hidden instance of Microsoft's Edge browser to communicate with their malicious infrastructure. The objective was to make the activity look conspicuous by using software and network traffic that might otherwise appear legitimate. But the most interesting part of the investigation is what happened next.

22:51 Semantic observed the attackers repeatedly returning to the compromised computer. This wasn't simply malware running an automated series of instructions. There is evidence of human operators making decisions, collecting credentials, and exploring the network. They established a persistent communications tunnel that could provide access deeper into the organization's system.

23:10 They also developed a previously undocumented tool capable of decrypting and executing malicious software directly and a computer memory. That technique can make identifying and analyzing malicious activity more difficult. Semantic observed evidence associated with the intrusion through September 24th.

23:27 However, researchers could not determine whether the attackers maintained uninterrupted access throughout that period. And there's another important limitation. Although the investigators documented credential theft and unauthorized access, they could not establish whether sensitive defense information was successfully stolen.

23:43 That's a distinction we need to remember. This was a documented compromise of a defense contractor's network, but we cannot claim that Russian intelligence successfully obtained naval designs or military technology. Now here's where the previous reporting becomes particularly useful. Let's go back more than two years.

24:00 In our September 13, 2024 episode, the Global Weekly Intelligence wrap-up examined accusations from German domestic intelligence agencies concerning Russian GRU cyber operations against NATO and European Union countries. That investigation involved GRU Unit 29155, an organization associated with cyber operations and other clandestine activities.

24:22 Now, Unit 29155 is not the same organization as Unit 26165, which is associated with APT-28 activity we're discussing today. We need to be clear about that. But the broader intelligence significance still remains. In September 2024, we were examining warnings that Russian military intelligence was conducting cyber operations against Western countries and critical infrastructure.

24:46 Two years later, we're examining another GRU link campaign, this time involving documented access to a NATO defense contractor. Different units and different operations, but the same overarching concern. Russian military intelligence is actively directed against Western security services. But the same overarching concern.

25:06 Russian military intelligence activity directed against Western security interests. Then, in our March 7, 2025 episode, we returned to the threat of Russian cyber operations against critical infrastructure. We discussed how previous incidents, including the destructive Natpeya attack in 2017, demonstrated that cyber operations could have consequences extended far beyond their initial targets.

25:30 Notpetya caused a widespread disruption to business and infrastructure internationally. The earlier example illustrates an important distinction. Cyber operations can be conducted to collect intelligence, disrupt services, destroy information, or achieve several objectives. The latest APT-28 activity appears to have been directed toward the espionage.

25:50 There is no public evidence establishing that the shipbuilder intrusion was intended to cause physical destruction. But the historical record demonstrates why understanding an adversary's access and capabilities is important. And then we have a development from May 2025 that connects even more directly to today's story.

26:07 The United States National Security Agency, the FBI, CISA, and International Intelligence and Cyber Security Partners used a joint warning about Russian GRU cyber operations targeting Western logistics and technology organizations. The advisory specifically identified Unit 26165. That's the same GRU unit associated with APT-28.

26:30 According to that assessment, Russian cyber operations have been targeting organizations involved in coordinating, transporting, and delivering assistance to Ukraine. The campaign included attempts to compromise logistic providers, technology companies, and organizations connected to transportation infrastructure.

26:47 The advisory also described the targeting of internet connected cameras in Ukraine and neighboring NATO countries. Why would Russian military intelligence be interested in cameras? Because information about the movement of equipment, vehicles, and supplies can have considerable military intelligence value.

27:03 An intelligence service doesn't necessarily need to steal a classified military document to obtain useful information. Sometimes observing what equipment is moving, how frequently shipments occur, and which transportation routes are being used can provide valuable operational intelligence. Now compare that 2025 warning with the latest semantic findings.

27:22 Last year, Western intelligence agencies were warning about Russian efforts to collect information concerning the movement and delivery of military assistance. This week, we're examining Russian-linked intrusion involving organizations that build and maintain military capabilities. That suggests a continuing intelligence interest in the wider system supporting NATO and Ukraine.

27:41 And that's a much more meaningful connection than simply observing that Russia continues to conduct cyber attacks. Dick O'Brien, a principal intelligence analyst with Semantic Threat Hunter team, told Cyberscoop that the human-directed activity demonstrated the shipbuilder was a genuine target rather than an accidental infection.

27:59 The attackers weren't simply distributing malware and hoping something useful would happen. Investigators observed operators actively exploiting access to a particular organization, and that raises the question of what intelligence requirements may have been driving the operation. Consider the potential value of the targets.

28:15 A naval shipbuilder may possess information about vessel construction, production schedules, military contracts, and engineering capabilities. An aircraft engine manufacturer may hold information about propulsion technology, maintenance requirements, and production capability. A law enforcement organization may hold investigative information and sensitive operational records.

28:35 We don't know which of those categories of information the attackers were seeking, but each could provide intelligence value to a foreign military intelligence organization. And there's another connection worth making. In our September 18th, 2026 episode, we examined reporting primanthropic about suspected Russian state-linked cyber espionage after incorporating artificial intelligence into reconnaissance, fishing, malware development, and other intelligence activities.

29:00 The earlier case involved activity assessed as consistent with reporting about APT-29, commonly associated with Russian Foreign Intelligence Service, the SBR. Today's investigation concerns APT-28 and the GRU. Again, two different intelligence organizations, but the comparison demonstrates how cyber espionage continues to evolve.

29:20 In September, we discussed how artificial intelligence could accelerate intelligence collection. Now we're examining how established cyber espionage operators are developing techniques to conceal communications, steal credentials, and maintain access to sensitive networks. And when we place those developments alongside the 2024 GRU warnings and the 2025 Joint Advisory, we begin to see longer-term patterns.

29:43 The objective of gaining access to sensitive Western information remains consistent. What changes are the targets, tools, and techniques employed to accomplish that objective? There are several lessons that I believe are particularly relevant for Canada and our NATO allies. First, foreign intelligence services don't need to penetrate a government's intelligence agency to obtain valuable national security information.

30:05 Defense contractors, manufacturers, technology companies, and transportation providers can hold information that is extremely valuable for a foreign state adversary. Second, the initial compromise may involve a relatively familiar method. In this case, a malicious email attachment opened the door. More sophisticated activity came afterward, when the attackers began exploiting the access they had obtained.

30:27 And third, the ability to identify unauthorized activities after an intrusion is just as important as preventing the initial compromise. The attacks in this case were able to seal credentials, explore the networks, and establish additional means of access. That creates opportunities for further intelligence collections, even if investigators cannot establish that sensitive information was ultimately stolen.

30:49 There is also an important intelligence distinction between access and intent. An intelligence service may seek access to a network because it has an immediate requirement for information. It may also seek access because that network could become useful later. That doesn't mean every compromise is preparation for sabotage, and it certainly doesn't establish that this particular intrusion was intended to support a destructive attack.

31:12 But persistent access can create options for an adversary. Those options are precisely why counterintelligence and cybersecurity organizations need to understand not only whether the system was compromised, but what an attacker could potentially do with the access obtained. When we examine this week's story in isolation, we see a Russian-linked cyber espionage campaign targeting NATO defense-related organizations.

31:34 But when we compare it with our previous reporting from 2024, 2025, and 2026, a more significant picture emerges. We've examined Russian GRU operations against NATO countries. We've discussed destructive cyber attacks and their consequences for critical infrastructure. We've followed official warnings about Russian efforts to collect intelligence on Western military logistics supporting Ukraine.

31:56 And now we're examining a documented intrusion into a NATO naval shipbuilder alongside targeting of an aircraft engineer, manufacturer, and a law enforcement agency. These are not necessarily components of one coordinated operation, but they do demonstrate a persistent Russian intelligence interest in the organizations, technology, and infrastructure that support Western military capabilities.

32:18 And that brings us back to something we've discussed repeatedly on this podcast. Espionage isn't always about stealing classified documents. Sometimes it's about understanding how an adversary operates, how its equipment is manufactured, how its military is applied, where their vulnerabilities exist, and how its capabilities might be affected during a future confrontation.

32:38 For Canada and our NATO allies, protecting national security means protecting more than government secrets. It means protecting the people, companies, infrastructure, and information that allow our military and security institutions to function, because an adversary doesn't necessarily need to know what they're planning to do.

32:55 Sometimes knowing what you're capable of doing is intelligence enough. Well, that's going to wrap it up for this week. I want to thank Andrew Coyne for his guest appearance and talk at the Pillar Society speaker series on Tuesday evening. It was a very impressive presentation concerning Canada's current state as it relates to a multitude of national security concerns.

33:13 And if you're fortunate enough to be at the presentation, you may purchase one of Andrew's latest books, The Crisis of Canadian Democracy. If not, you can order on Amazon, and I highly suggest that you do. The Pillar Society is an organization of former Canadian intelligence professionals, and if you enjoy the content that I discuss on this podcast, you can check it out on their website.

33:33 I'll leave a link in the show notes. And if you want to support the Global Intelligence Knowledge Network and the Global Intelligence Weekly wrap-up, you can do that with a one-time or ongoing contribution. Please go to the BuzzBrope page and the transcript in the show notes. Your contributions help keep this type of content available to everyone.

33:49 So, until next week, stay curious, stay informed, and stay safe.