Canada’s electronic intelligence agency says it carried out authorized cyber operations against foreign cybercriminals involved in the online trade of chemicals used to manufacture fentanyl, while also significantly expanding its intelligence and cyber defence activities in the Arctic amid growing strategic competition in the region.
The details are outlined in the Communications Security Establishment’s (CSE) 2025–2026 Annual Report, which describes how Canada’s signals intelligence agency increasingly integrated foreign intelligence, cyber operations and cyber defence to counter transnational crime, state-sponsored threats and emerging security challenges.
One of the report’s most notable examples involves a case study describing how CSE disrupted online brokers operating outside Canada who facilitated the purchase and sale of precursor chemicals used to produce synthetic opioids such as fentanyl.
According to the report, CSE discovered in 2025 that foreign-based cybercriminals were acting as intermediaries in the illicit precursor chemical market. After collecting foreign intelligence to better understand the network and its activities, the agency developed options to interfere with those operations.
The report says CSE then conducted authorized active cyber operations that disrupted and diminished the brokers’ ability to operate. It states those actions were carried out under the agency’s legal authorities while supporting broader Canadian law enforcement objectives aimed at reducing fentanyl trafficking and protecting public health.
The annual report places those activities within a wider government effort to combat transnational organized crime.
CSE says it provides foreign signals intelligence on international drug trafficking logistics and supply chains while working alongside agencies including the Royal Canadian Mounted Police, Canada Border Services Agency, Canadian Security Intelligence Service, FINTRAC and Public Safety Canada through the Joint Operational Intelligence Cell (JOIC). The agency says it strengthened intelligence-sharing through initiatives such as the Secure Intelligence Regional Forum and hosted a classified Fentanyl Awareness Day in July 2025 that brought together government officials, law enforcement and public health representatives to coordinate responses to the illicit drug trade.
The report also highlights a broader expansion of Canada’s intelligence posture in the Arctic, describing the region as an increasingly important national security priority.
CSE says growing interest from Russia and the People’s Republic of China is creating a more complex security environment that extends beyond conventional military and cyber threats. According to the report, foreign activity increasingly includes economic initiatives and influence operations intended to shape access to infrastructure, resources and decision-making across the Arctic.
To address those challenges, the agency says it increased intelligence capabilities designed to close information gaps about foreign governments’ intentions, capabilities and activities across the region. The intelligence also supports cyber defence operations through the Canadian Centre for Cyber Security, allowing government partners to respond more quickly to emerging threats.
During the reporting period, CSE shared classified Arctic intelligence with multiple Canadian government departments and international allies. The reports, produced with support from the Canadian Security Intelligence Service (CSIS), examined foreign political objectives, military capabilities, technological developments, economic interests and research activities in the region. The agency also said it actively pursued intelligence on foreign cyber actors attempting to target Arctic-related systems.
The report outlines several initiatives aimed at strengthening Arctic partnerships, including continued leadership of the Arctic Intelligence Coordination Group with the Privy Council Office, cyber resilience work with Indigenous partners, classified threat briefings for territorial governments, participation in Arctic Security Working Group activities, and international signals intelligence forums focused on polar regions. CSE also said it has deployed advanced cyber sensors on territorial government networks to detect and mitigate malicious cyber activity affecting northern infrastructure.
Beyond those specific examples, the report describes a broader shift toward integrating intelligence collection with operational cyber capabilities.
CSE says its foreign cyber operations are authorized under the CSE Act and are designed either to defend systems important to the Government of Canada or to disrupt foreign threats before they can affect Canada’s international affairs, defence or security interests. The agency notes that active cyber operations cannot target Canadians or anyone located in Canada and require authorization from both the Minister of National Defence and the Minister of Foreign Affairs.
The agency says combining foreign intelligence, cyber operations and cyber defence has enabled it to move more quickly from identifying threats to taking action against them. Throughout the year, CSE reports using that integrated approach to counter ransomware groups, violent extremist organizations, hostile state cyber activity and transnational criminal networks.
The report covers CSE’s activities between April 1, 2025, and March 31, 2026.
