Security and Resilience Any organization or individual can be a victim of malicious cyber activity. Victims may be individually targeted or part of a campaign affecting millions of internet users. As Canadians put more information online, they become increasingly attractive targets for malicious cyber actors. Canadian law enforcement agencies’ ability to protect Canadians from these actors, who may be anywhere in the world, is a growing challenge. Malicious cyber activity is often conducted for monetary gain. For example, phishing emails that appear to come from financial institutions can deceive people into providing their banking information. Ransomware can be deployed to encrypt files on a device or system, with a hacker demanding payment to restore access. Data breaches can result in personal and financial information (such as social insurance numbers, credit card information) being stolen from organizations’ online databases and subsequently sold in criminal marketplaces for activities like fraud, identity theft, or extortion. Malicious cyber actors can also be motivated by a specific cause — sometimes called “hacktivists” — such as exposing wrongdoing, protesting, or provoking embarrassment. They can also be enthusiasts, attempting to demonstrate their skill at hacking and to gain notoriety. On a larger scale, nation states and state-sponsored actors have the capability to steal our intellectual property or confidential business strategies to give their own economies a competitive advantage. Some nation states are also developing advanced cyber tools with hostile aims. There are risks to Canada’s national security and public safety if 13 of 35 • NATIONAL CYBER SECURITY STRATEGY