Editor’s note: This two-part examination comes from Ian Bradbury, a former Canadian defence and national-security practitioner who now works as a security consultant. The series explores how threats are assessed and how Canadians can distinguish what is known from what is suspected or remains unknown. Part One examines contingency planning, evidence and the meaning of a threat. Part Two considers how new information should change assessments—and why protective action does not necessarily mean an attack is imminent.
OTTAWA — Prime Minister Mark Carney’s description of possible U.S. military action against Canada as an “extreme tail risk” raises a question Canadians deserve to have answered clearly: what does preparing for such a contingency actually tell us about the danger?
Carney said the scenario was “not a base case,” but that it would be irresponsible not to prepare. Canadians should understand that distinction: a government can examine a highly unlikely event because its consequences would be catastrophic. The existence of a contingency assessment does not, by itself, establish that an attack is expected.
Assessing the threat requires more: evidence of capability and intent, access and opportunity, and a reasoned judgement about likelihood. Public communication should explain what can be disclosed about those findings, what remains uncertain and how the scenario compares with other threats facing Canada.
That distinction between possibility, evidence and precaution runs through both this national debate and the response to threats against Islamic schools across Canada. Understanding it is essential to judging what authorities know—and what their actions actually mean.
These two recent stories caught my attention. Reporting on Carney’s contingency planning received broad media coverage, discussion and speculation. So did threats against Islamic schools and institutions across Canada, which resulted in police investigations, increased patrols and additional security measures.
On the surface, the two stories have very little in common. One concerns a national-level contingency involving Canada’s closest ally. The other concerns communicated threats against schools and community institutions. Yet both expose the same underlying problem: we have become remarkably comfortable talking about threats while becoming remarkably poor at understanding them.
A contingency plan is not a prediction.
A precautionary response is not a determination that an attack is imminent.
A communicated threat is not necessarily evidence of authenticity, capability or intent.
An association is not an attribution.
An allegation is not an established fact.
These are not minor distinctions or arguments over semantics. They determine how a threat should be understood, what weight should be given to available information, what response may be warranted and where that threat sits within the wider security environment. When these distinctions are routinely collapsed, the result is not simply public confusion. It creates analytical gaps and blind spots that distort how threats are understood, prioritized and acted upon.
Canada and our allies are operating in an era of greyzone and multi-domain warfare where threats, intimidation, disruption, influence operations and other forms of coercion are increasingly being used to create uncertainty, impose costs and influence behaviour without necessarily crossing the threshold of conventional conflict.
Institutions are being targeted, communities unsettled and public confidence further strained. This is the stark reality of our time and it impacts Canadians, Canadian strategy, the Canadian information environment, and overall Canadian readiness, whether one recognizes or accepts this reality or not.
The problem is not simply that there are more threats.
We are operating inside an increasingly complex threat and information environment in which hostile actors, governments, political movements, extremist networks, traditional and social media, institutions and ordinary citizens can all contribute to the movement and amplification of information.
A threat can move from a communication to a police response, from there to a headline, then into political commentary and public discussion within hours, often while investigators are still trying to establish what actually happened. The speed at which information moves does not strengthen the underlying evidence, but it can give preliminary, incomplete or poorly supported claims disproportionate weight.
Poor threat understanding degrades domain awareness.
It creates blind spots, distorts priorities, redirects attention and resources, generates unnecessary fear or false reassurance, strengthens narratives unsupported by evidence and encourages connections to be drawn before they have been established.
It can also narrow the analytical frame so significantly that whatever threat currently dominates political or media attention begins to stand in for the broader threat environment.
Threat assessment is concerned with assessing possibilities, not predicting events. It requires us to establish what is known, identify what remains unknown, evaluate the available evidence, test the assumptions underpinning the assessment and make judgements about what that evidence supports at a particular point in time.
It also requires an understanding of the aggregated threat environment. Individual threats do not exist in analytical isolation.
A threat may be highly consequential but unlikely, or immediate but relatively limited in consequence.
Conversely, a less dramatic threat may have a considerably stronger evidentiary foundation, demonstrated hostile intent or an established record of activity. Asking whether something could happen is therefore not enough.
Almost anything can be made to sound possible if the analytical threshold is set low enough. The harder questions concern what evidence exists, who may be responsible, what capability exists, what intent can reasonably be assessed, whether the actor has access and opportunity, what assumptions underpin the assessment, how likely the action actually is and where that threat sits within everything else we know.
The recent discussion of possible U.S. military action against Canada provides a useful example. Governments are supposed to examine potential threats to the national interest, including scenarios that may be highly unlikely but potentially consequential. This is routine security and defence work in Canada and among our allies. Serious national security and defence planning would be impossible if governments only examined events they already expected to occur.
The challenge is not whether governments should examine unlikely scenarios. They should. The challenge is understanding what that examination actually tells us.
Carney declined to provide details about what the examination involved. That an assessment was conducted is not the issue. Nor does the existence of an assessment tell us what it concluded. The issue is how that assessment has been presented and situated within the broader threat environment facing Canada. The public statement tells us little about the evidence, assumptions and indicators underpinning the assessment, how likelihood was judged, what confidence was attached to that judgement or where the scenario ranked against other threats facing the country.
Without that context, an “extreme tail risk” can take on a significance in public discussion that the underlying assessment may not support. Publicly elevating an extreme contingency without properly situating it within the broader threat environment distorts the threat picture presented to Canadians and risks drawing attention away from threats for which hostile activity, capability, intent or demonstrated effects are already more firmly established.
This matters because Canada already faces persistent threats across foreign interference, cyber operations, Arctic security, influence activity and other forms of hostile or hybrid activity. Those threats do not become less consequential because another scenario is more politically dramatic or attracts greater public attention. Selective focus can be as damaging to threat understanding as analytical error because it narrows the scope through which the threat environment is understood and creates precisely the blind spots that sound assessment should prevent.
The language used to describe the U.S. contingency also makes the assessment harder to situate. “Extreme tail risk” is financial terminology rather than terminology normally used across threat analysis, security and defence.
It conveys the idea of a highly consequential event at the extreme end of a probability distribution, but it does not tell Canadians where the scenario actually sits within the national security threat picture or what analytical weight should be attached to it relative to other threats.
Every assessment rests on assumptions. Some are explicit. Others become embedded in institutional thinking to the point that they are rarely stated. They may concern how an actor is expected to behave, whether an alliance or relationship is assumed to remain stable, what capabilities are believed to exist, what intentions are considered plausible or what conditions are expected to continue. When circumstances change, those assumptions have to be tested. That is part of sound analysis. Testing an assumption, however, does not establish its opposite.
Retired General Wayne Eyre, who served as Chief of the Defence Staff from 2021 to 2024, described the possibility of U.S. military action against Canada as a “very, very small probability.” He also observed that the fact it was now being discussed reflected a significant change in the security environment. Those positions are not contradictory. The existence of the contingency may tell us something important about changes in the strategic environment without establishing that the scenario itself has become likely.
Canada can reasonably examine a highly consequential contingency involving the United States while simultaneously facing more established threats from Russia, China and other hostile actors. The analytical requirement is to maintain sufficient domain awareness to understand the aggregated threat environment, where individual threats sit within it, what evidence supports each assessment, what remains uncertain and what level of confidence can reasonably be attached to the conclusions.
