Toronto Gets An Upgrade, And Yes, It Comes With Snow Boots

Bruce is parking himself at the Munk School for the academic year, fall in, spring out, which is a win for anyone who likes their tech policy with receipts and their threat models grounded in reality. He is spinning up an AI security reading group in the fall, teaching cybersecurity policy in the spring, and plugging into Citizen Lab, the Law School, and the Schwartz Reisman Institute. That combo is a proper lab bench for the messy intersection of code, rights, and power, plus Toronto feeds you well while you argue about it. Adjuncts do not get real sabbaticals, fine, but a change of venue with that roster is still a smart play, and frankly, an excuse for better dumplings between seminars is what the field needed.

So what actually happens when you gather curious brains around AI security instead of AI theater. You stop worshipping at the altar of vibes and start asking boring questions that move mountains. How do we detect model theft when the leak is two interns and a thumb drive. What is the realistic exposure from weight exfiltration, and who eats the liability when those weights show up in a rival startup with a different logo and the same quirks. How do you red team systems that change every other week without reinventing the playbook every time. Where does data provenance fail in the wild, not in white papers. How do you verify content at scale when the watermark breaks the moment someone screenshots it, then pastes it into a PDF like it is 2007. If the reading group chews on supply chain for training sets, jailbreak marketplaces, prompt injection against actual targets, agentic systems wandering off into billing APIs, and the ugly interface between corporate policy and criminal law, that is time well spent. Post the reading list early, keep it public, and make it a mixed table, students, civil society, weirdos who file FOIAs for fun, a couple of engineers who have been paged at 3 a.m. That is how you find fresh angles.

Spring’s cybersecurity policy class is where you connect the lab to the legislature, code to courts and budgets. Actual solutions look different from security theater. If the work is real, methodology is public, data is shared where it can be without hurting people, mitigations ship, and the people affected are in the room before the press release. If it is posturing, you get glossy PDFs, hypothetical harms, and vendor quotes about innovation. Citizen Lab has a long record of doing the former, think cutting through spyware fog with evidence that forced companies and governments to move, often grumbling, often late, but still moving. Fold in a law school that can translate findings into enforceable rules, and an institute that prototypes tools instead of manifestos, and you have a pipeline, research to policy to product to protection. And yes, that means arguments, because tradeoffs are not optional. Encrypt more, collect less, log what matters, fund maintenance, stop pretending compliance checklists equal safety, you know, the basics we would have finished already if procurement did not turn every fix into a 24 month pilgrimage.

Meanwhile, back in reality, cross border travel is a plot twist that bites the unprepared. Device searches happen, demands for passwords happen, both sides of that border can make your morning a lot longer than planned. If you are bouncing between Boston and Toronto, travel like a grown up. Carry a clean device, store your real data encrypted at home, use hardware keys for accounts, keep a contact you can call before you unlock anything, and know which rights apply in which line. If you are walking in with research that could get someone targeted, take it as seriously as you would a live exploit. The point is not paranoia, the point is not handing your work to the first uniform with a bored expression. And then there is winter, which is not hypothetical either. Good boots, thick socks, real gloves, hat you will not lose, drink water even when you do not feel thirsty, your brain does not run well on iced coffee fumes alone. Toronto’s cold is honest, which I respect. Also the city will bribe you to forgive it with incredible food, so deal.

Real talk versus performance art, this year can set a tone for how we handle AI and security without making things worse. Here is how you tell the difference between fixing and posturing. Do the convenings include targets of abuse, journalists, labor, public defenders, immigrant rights folks, not just the usual panelists in nice blazers. Do we publish negative results and kill ideas that do not work, or do we keep dressing them up because someone promised a keynote. Do we export playbooks anyone can reuse, syllabi, red team kits, model eval scripts, procurement language that a city CIO can drop into an RFP. Do we write plain text briefs that a councillor can read on the subway and still vote the right way. If the answer is yes a few times in a row, you have a center of gravity, not a calendar of events.

If you are that U of T student coming back after 50 years, first, respect, second, show up early. Watch for the reading group announcement, ask for open sessions, lobby for office hours that do not overlap with your day job, and if nobody posts a syllabus, be the person who nudges until it happens. Library, get the books, keep some on reserve, also buy more copies of the titles that always vanish by week two. Someone spin up a shared Zotero, and a repo of lecture notes with summaries normal people can read. Record the talks, publish transcripts, accessibility is not an optional feature. Take the year and turn it into muscle memory, things the institutions keep doing after Bruce goes back to Cambridge. If it works, Toronto becomes a waypoint for people who want to make AI safer in the real world, less smoke, more light. If it does not, well, at least the bagels were good, but I am betting on the former.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI