What the advisory does and does not say
On 8 October 2026 the Canadian Centre for Cyber Security joined agencies from the United States, United Kingdom, Australia, Japan, New Zealand and Spain on joint advisory AA26-281A, according to a New Zealand report on the advisory. That report describes a 58-page document tying activity to Integrity Technology Group. It lists the co-sealers as the FBI, CISA, NSA, the UK's NCSC, Australia's ACSC, the Canadian Cyber Centre, Japan's National Police Agency and National Cybersecurity Office, New Zealand's NCSC and Spain's national intelligence centre.
A caution on scope. We have not been able to confirm that AA26-281A itself names routers or consumer IoT devices. The New Zealand report links routers and internet-connected gadgets only to a separate advisory from September 2024. The Cyber Centre's own page on that earlier advisory says Integrity Technology Group "has controlled and managed a botnet active since 2021". It lists the compromised devices as small office/home office routers, firewalls, network-attached storage and Internet of Things devices, and says the botnet held "between tens to hundreds of thousands of compromised devices."
So the evidence is a pattern, not a single document. The same company has been tied twice, two years apart, to infrastructure that depends on poorly secured devices. That is enough to ask what Canada requires of the people who sell those devices.
The gap in Canadian law
The answer is very little. Bill C-8 received royal assent on 16 June 2026, and the government's announcement says the Critical Cyber Systems Protection Act creates a framework for designated operators in four sectors: finance, telecommunications, energy and transportation. The release describes that framework as phasing in gradually. It does not mention consumer devices or IoT. A router on a kitchen counter or a camera in a corner shop is not a designated operator's critical cyber system.
That design is defensible. A first cybersecurity statute should be aimed at systems whose failure hurts the public, and Parliament was right to start with operators that have regulators, compliance staff and clear duties.
But the gap matters, because the threat model does not respect that boundary. A botnet of hijacked home routers is useful to a state-linked actor precisely because the devices sit outside any regulated perimeter. The people best placed to stop it are manufacturers, who ship the defaults, and they face no Canadian obligation.
The strongest case for a mandate, and why we still want it narrow
The best argument for regulation is an externality. A buyer of a $60 router pays for the product, not for the harm its compromise does to others. Warnings and consumer education do not fix that, because buyers cannot inspect firmware. Manufacturers who cut corners can undersell those who do not. Where the market fails this plainly, a baseline is not paternalism.
The counterweight is that device rules can be written badly. A broad certification regime, mandatory pre-market audits, or liability for any vulnerability would raise costs for small hardware makers and open-source firmware projects, and would push niche products out of the Canadian market. The pro-innovation answer is a short list of outcome-based requirements that any manufacturer can meet at close to zero marginal cost.
The UK shows how short that list can be. Its consumer connectable product security regime came into effect on 29 April 2024. Among other things, its passwords requirement says that passwords must be unique per product or definable by the user, and must not be easily guessable. That is a design rule, not a licensing scheme, and the UK has not required pre-market government approval.
The EU is heavier. The Cyber Resilience Act entered into force on 10 December 2024. Its reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, and its main obligations from 11 December 2027. Canadian manufacturers selling into Europe will meet those rules anyway. Ottawa's choice is therefore not whether its exporters comply with something. It is whether Canadian buyers get any protection at all.
What a proportionate Canadian baseline would look like
Four elements would do most of the work and avoid most of the harm:
- No universal default passwords. Credentials unique per device or set by the user at setup.
- A published vulnerability-reporting contact. So researchers have somewhere to send findings.
- A stated minimum support period. Manufacturers say how long they will ship security updates, so buyers can compare.
- Self-declaration, with enforcement after the fact. No pre-market approval. The Competition Bureau or a designated regulator would act against false claims.
Aligning with the UK and EU wording would let one product design serve all three markets, which keeps compliance cheap. Exempting open-source firmware development and low-volume hardware would protect the experimenters who produce much of the sector's innovation.
Why Parliament's priorities matter here
Parliament has not been idle on digital security. EFF reported on 22 October 2026 that Bill C-22, the Lawful Access Act, had passed the House of Commons and was before the Senate. EFF argues it expands surveillance powers and threatens the privacy and security of millions of people. We share those concerns. The contrast is instructive: legislative energy is going to measures that can weaken security, while a measure that would strengthen it, a floor for device makers, has no bill. Securing devices and protecting encryption are the same project.
The bottom line
Nothing in AA26-281A, as far as we can verify, proves that a Canadian baseline would have stopped a particular intrusion. Nor would a baseline end state-backed hacking; capable actors will always find new routes. The claim is smaller and sturdier. Canada has now lent its seal to multinational warnings about a vendor linked to compromised internet-connected equipment, while its newest cyber statute does not reach the consumer end of the market. ISED should consult on a short, outcome-based baseline, modelled on the UK's, with open-source and small-volume carve-outs, and report back before the next advisory arrives.