What’s inside

1. The one-paragraph version
2. What a network really is
3. Everything needs an address
4. Your message gets chopped into pieces
5. Routers: the world’s fastest mail sorters
6. Names instead of numbers (DNS)
7. Who asks, who answers
8. The stack of jobs (layers)
9. The Web is not the internet
10. The actual physical stuff
11. The Canadian chapter
12. Padlocks, privacy and staying safe
13. Who owns the internet? (Nobody)
14. What it costs the planet
15. The whole journey, start to finish
16. What happens next, connecting everyone
17. AI is changing what the internet is for
18. Who gets to control it
19. Proving things are real
20. Telling true from false
21. Words you now know
22. Sources

Part 1The one-paragraph version

The internet is a huge pile of computers connected by wires, radio signals and light, all of which have agreed to follow the same set of rules for passing messages along.

That’s it. That’s the whole idea. Everything else in this primer is a detail hanging off that sentence.

The reason it feels like magic is that the details happen very fast and completely out of sight. When you tap a video, roughly ten different systems do their jobs in about a quarter of a second, and none of them show their work. So the rest of this is really just that hidden part, written out slowly enough to follow.

About 6 billion people, around 74% of everyone alive, used the internet in 2025. About 2.2 billion people still don’t have it at all.^[1] So it is big, but it is not everywhere, and it is not everyone.

Part 2What a network really is

Take two tin cans and a piece of string. Pull the string tight, talk into one can, and your friend hears you out of the other. Congratulations, you built a network. It has two members and one wire.

Now imagine you all want to talk to each other, not just to you. You and three friends need six strings. You and four friends need ten. You and a hundred friends need 5,050. By the time you get to a whole city, you’d need more string than there is string.

So nobody does that. Instead, everybody runs one wire to a shared box in the middle, and that box passes messages along. The box is the thing that makes big networks possible.

Your home has one of these boxes. It’s the thing with blinking lights, and it does two jobs: it’s a switch or router that connects your devices to each other, and it’s the doorway out to everything else.

Now here’s the leap. The internet is what you get when you connect the boxes to each other. Your house’s box connects to your neighbourhood’s box, which connects to your city’s box, which connects to a really big box in a building downtown, which connects by cable to a box in another country. Networks of networks of networks. The word “internet” literally means “between networks.”

Part 3Everything needs an address

Imagine mailing a letter with no address on the envelope. The post office would have no idea what to do with it. Same problem here: if a message is going to travel across the world, every machine along the way needs to know where it’s headed.

So every device on the internet gets an IP address. IP stands for Internet Protocol, and “protocol” is just a fancy word for “the agreed rules.” An IP address looks like this:

142.250.190.78

Four numbers, each between 0 and 255, separated by dots. That’s the old style, called IPv4, and it allows about 4.3 billion different addresses.^[2]

Four billion sounds like plenty. It wasn’t. There are more than 4.3 billion phones, laptops, TVs, watches, doorbells and fridges wanting addresses, and the world officially ran short years ago.^[2]

So there’s a newer style, IPv6, which looks like this:

2607:f8b0:400b:80c::200e

Stop and thinkBefore you read on, why would anyone bother inventing a whole new address format, instead of just being cleverer about reusing the old ones? (Both actually happened. Only one of them keeps working forever.)

Uglier, but it allows about 340 trillion trillion trillion addresses.^[2] That is enough to give an address to every grain of sand on Earth and still have almost all of them left over, so this is not a shortage anyone expects to run into again.

Part 4Your message gets chopped into pieces

Here’s the single cleverest idea in the whole system, and it’s a bit surprising the first time you hear it.

When you send something (a photo, a message, one second of a video) it does not travel as one lump. It gets sliced into hundreds or thousands of small pieces called packets. Each packet gets a little label on the front saying where it came from, where it’s going, and which piece number it is.

Then the packets are released into the network. Here’s the strange bit: nothing requires them to take the same route. Each one is handled independently, so they can go different ways and arrive out of order. The computer at the other end reads the piece numbers, puts them back in order, and reassembles your photo.

In practice, modern networks usually try to keep one conversation on one path, because that’s a bit faster. But they don’t have to, and when a cable breaks mid-download, that freedom is what saves you.

Why do it this way? Three reasons, and they’re all good ones.

• Sharing. If messages travelled as one lump, one person downloading a movie would block the wire for everyone else. Small packets take turns, so everyone gets a slice.
• Survival. If a cable gets cut or a machine crashes, the packets just go around the damage. No single broken piece takes down the whole thing.
• Repair. If packet 47 goes missing, your computer notices the gap and asks for just that one piece again, not the whole photo.

Part 5Routers: the world’s fastest mail sorters

So a packet is loose in the world with an address on it. Who moves it?

Routers. A router is a specialised computer whose only job is to look at a packet’s destination address, decide which wire gets it closer, and shove it out that wire. Then it forgets about it entirely and grabs the next one. Big routers do this millions of times per second.

Crucially, a router does not know the full route to the destination. It only knows the next step, like asking for directions and being told “take the second left, then ask again.” Each router hands the packet to the next router, which does the same thing, until one of them recognises the address as being on its own network and delivers it. Each of these steps is called a hop.

A packet crossing an ocean typically makes somewhere between ten and thirty hops. You can watch this happen, see the box below.

traceroute cbc.ca      # Mac / Linux
tracert cbc.ca         # Windows

Routers know which way to send things because they constantly gossip with their neighbours: “here’s the list of places I can reach, and here’s the chain of networks you’d go through to get there.” Each router keeps its own list of who to hand what to, and the gossip spreads when something changes, usually in seconds, sometimes a few minutes. Nobody maintains a master map of the internet. It’s a rumour that stays roughly accurate.

Part 6Names instead of numbers (DNS)

You have never typed 208.80.153.224 into a browser. You type wikipedia.org. Those are the same place. But routers only understand numbers. Something has to translate.

That something is the Domain Name System, or DNS. It is the internet’s phone book, and it is one of the largest databases humans have ever built.

Here’s what happens the instant you hit Enter:

1. Your laptop asks a nearby helper computer called a resolver, usually run by your internet company: “what’s the number for wikipedia.org?”
2. If the resolver doesn’t already know, it asks a root server. The root server doesn’t know either, but it knows who handles .org names.
3. The .org server doesn’t know the exact answer, but it knows which machine holds Wikipedia’s records.
4. That machine gives the real number. The resolver hands it back to your laptop and remembers it for a while, so the next person asking gets an instant answer.

Those root servers sit at the very top of the whole naming system. There are 13 root server names, lettered A through M, a number fixed decades ago because 13 addresses was all that fit in one small network message.^[3] But those 13 names are not 13 machines. Through a trick called anycast, each name is copied to many physical machines around the world, and your request goes to the nearest copy. As of August 2026 there were 2,003 root server machines run by 12 independent organisations, 12 rather than 13 because one of them runs two of the letters.^[4]

Stop and thinkStep 4 above says the resolver remembers the answer for a while. Why would it bother? And what would the internet feel like if it didn’t?

nslookup cbc.ca

Part 7Who asks, who answers

Almost everything on the internet is one of two roles.

A client asks for things. Your phone, your laptop, your game console, these are clients. They’re the customers.

A server answers. A server is not a mysterious object; it is just a computer that has been left switched on, plugged into a fast connection, and told to wait for questions. The one serving Wikipedia is a computer in a building. If you unplugged it, Wikipedia would go down.

Servers live in data centres — warehouses full of racks of computers, humming loudly, kept cool, with backup generators outside in case the power fails. The phrase “in the cloud” means “on somebody else’s computer in a building somewhere.” There is no cloud. There is a warehouse in Virginia, or Ireland, or Quebec.

Part 8The stack of jobs (layers)

Getting a message across the world is too big a job for one set of rules, so it’s split into layers. Each layer does one job and hands the result to the layer below it. The genius of this is that each layer can be swapped out without breaking the others, which is why the internet survived the jump from telephone lines to fibre optics to 5G without being redesigned.

Think of posting a birthday card:

• The message. You write “Happy birthday!” That’s the part you care about. On the internet this layer is things like HTTP/HTTPS (web pages), email, and video calling.
• The packaging. You put the card in an envelope. On the internet this is TCP or UDP. TCP is careful — it numbers everything, checks nothing got lost, and re-sends what did. UDP is fast and doesn’t check, which is what you want for live video, where a re-sent frame from two seconds ago is useless.
• The address. You write the address on the envelope. That’s IP.
• The vehicle. The truck, the plane, the letter carrier. On the internet this is Wi-Fi radio waves, copper wires, fibre optic glass, or a mobile signal.

If you ever hear a network engineer say “layer 3” or “layer 7,” they’re using a longer seven-layer numbering scheme called the OSI model. In that scheme IP is layer 3 and HTTP is layer 7. The names above are what matter; the numbers are just shop talk.

Put TCP and IP together and you get TCP/IP, the pair of rules that essentially is the internet. On 1 January 1983, the old research network was supposed to finish switching over to TCP/IP. In reality the changeover took months and plenty of machines were late, but most people still mark that date as the birth of the internet as we know it.^[17]

The people who wrote those rules, Vint Cerf and Bob Kahn, did not patent them or charge for them. Anyone could build a network that spoke TCP/IP, for free. That choice is a large part of why it spread everywhere.

Part 9The Web is not the internet

This one trips up a lot of adults, so it’s worth being precise.

The internet is the roads. The World Wide Web is one kind of traffic on those roads.

The internet came first, by about twenty years. The first message ever sent between two computers over the network that became the internet went out on 29 October 1969. A student at UCLA named Charley Kline tried to type “login” to a machine at Stanford Research Institute. He got as far as “lo”, and the system crashed.^[5] A good first word for a network, as it turned out.

The Web arrived in March 1989, when a scientist at CERN in Switzerland named Tim Berners-Lee wrote a proposal for a way to link documents together across computers. By December 1990 he had built the first web browser, the first web server, and the world’s first website. On 30 April 1993, CERN put the web software into the public domain — free for anyone, forever, with no licence fee.^[6][7] That decision is a large part of why the Web took over the world instead of staying a niche tool.

Plenty of things use the internet without touching the Web: email, video calls, online games, streaming apps, the software update your phone downloaded last night, messages between two banks. Closing your browser doesn’t disconnect you from the internet, any more than parking your car closes the road.

Part 10The actual physical stuff

Here is the part people find hardest to believe: the internet crosses oceans in cables lying on the seafloor. Not satellites. Cables.

Those pulses of light are carrying exactly the numbered packets from Part 4. The physics changes completely between your Wi-Fi, a copper wire and a strand of glass; the packets travelling through them do not. That is the layering from Part 8 doing its job.

These cables are, for most of their journey across the deep ocean, about as thick as a garden hose. Inside are strands of glass fibre roughly the width of a human hair, carrying pulses of light. Near the shore, where anchors and trawlers are a danger, they get wrapped in armour.^[8]

And satellites? They handle a tiny sliver. By one U.S. regulator’s count, satellites carry about 0.37% of America’s international capacity.^[8] Practically all intercontinental internet traffic goes through glass on the seafloor. When you video-call someone in Europe, your voice is a beam of light in a hose at the bottom of the Atlantic.

Stop and thinkA satellite sits about 550 km up; the Atlantic is roughly 5,000 km across. So why does the cable win, when the satellite path looks so much shorter?

How your house connects

Your Wi-Fi router talks to your devices by radio. That’s it. Wi-Fi is a short-range radio link, usually reaching one building. It is not the internet. From your router, a wire (fibre, coaxial cable, or phone line) runs to your Internet Service Provider, or ISP, the company you pay. Your ISP connects to bigger networks, and so on up the chain.

This is why “the Wi-Fi is down” and “the internet is down” are different problems. Your Wi-Fi can be perfect while the cable outside your house is cut.

Where networks meet

When one ISP’s network needs to hand traffic to another’s, they meet at an Internet Exchange Point (IXP), a neutral building full of routers where dozens of networks plug into a shared switch and swap traffic directly. Without IXPs, two companies in the same city might route their traffic through another country just to reach each other, which is a problem Canada has had rather badly.

Part 11The Canadian chapter

The biggest Canadian meeting point is TorIX, the Toronto Internet Exchange, founded in 1997 and now the largest exchange point in the country. It’s a not-for-profit. Over 250 organisations connect to it, from buildings including 151 Front Street West in Toronto.^[9][10] Canada now has roughly 12 internet exchange points, in cities from Vancouver to Charlottetown.^[11]

Boomerang routing. For a long time (and still, in some cases) data sent from one Canadian city to another would leave the country, travel through the United States, and come back. Hence the name. Why? Because Canadian providers bought their links from American networks. It was cheaper than building connections to each other at home.

CIRA runs the .ca domain, and it puts this plainly. Many Canadian providers buy their links through the United States. CIRA calls that “costly and inefficient.”

Their fix is exchange points. Build enough of them here, CIRA says, and “data travelling between Canadian entities never needs to leave the country.”^[11]

Researchers at the University of Toronto add a second worry. It isn’t only about speed and cost. Data that crosses a border falls under another country’s surveillance laws.^[12] You can decide for yourself how much weight to put on that, but the physical fact (that the packets go where the wires go, not where the border is) is not in dispute.

Where the cables land. Halifax is one of the places transatlantic cables come ashore in Canada.^[13]

Atlantic Canada has done this job a long time. The first transatlantic telegraph cable that worked landed at Heart’s Content, Newfoundland, in 1866, which is the same ocean and more or less the same idea, a century and a half earlier.

The .ca ending is Canada’s own piece of the naming system from Part 6. It’s run by CIRA, a Canadian non-profit. Not a government department. Not a foreign company.^[14]

Part 12Padlocks, privacy and staying safe

Remember from Part 5 that your packets get read and handled by every router in between. In the early days, that meant anyone along the path could read what you sent, like mailing every letter as a postcard.

The fix is encryption: scrambling a message so only the intended recipient can unscramble it. That’s what the s in HTTPS means. When your browser shows a padlock, three things are true:

• The contents are scrambled, so routers in the middle see gibberish.
• Nobody in the middle can secretly change what you sent.
• The site proved it is who it claims to be, using a digital certificate issued by an organisation your browser trusts.

This used to be rare. In 2015, fewer than 30% of web connections were encrypted. It’s now around 80% globally and close to 95% in the U.S., largely because a non-profit called Let’s Encrypt began giving away certificates for free, they now protect close to a billion websites.^[15]

Stop and thinkEncryption protects the delivery of your message but not what you chose to send. What would it take to protect the contents too, and could any technology do that?

Who can see what

• Your ISP can see which sites you connect to (the names, from your DNS lookups and connection addresses) but with HTTPS it can’t read the pages themselves.
• The website sees your IP address, roughly what device you’re on, and whatever you type into it.
• Whoever runs the Wi-Fi you’re using sees roughly what your ISP sees. Public Wi-Fi is much safer than it used to be because of HTTPS, but it’s still someone else’s network.

Three habits worth building

1. Different password for every account. Companies get broken into. If one password gets stolen and you used it everywhere, everything opens. A password manager makes this painless.
2. Two-step login where it’s offered. A stolen password alone then isn’t enough to get in.
3. Slow down when something is urgent. Nearly every successful scam works by creating panic — your account is locked, you’ve won something, act now. Real organisations are fine with you closing the message and going to their website yourself.

Part 13Who owns the internet? (Nobody)

This surprises people. There is no head office. There is no CEO of the internet. No single country, company or person owns or controls it.

What exists instead is a set of organisations that each look after one narrow, boring, essential thing:

• ICANN coordinates the naming and numbering, the DNS from Part 6 and the addresses from Part 3, making sure .ca means one thing worldwide and no two machines get the same address.
• The IETF writes the technical rules. Anyone can join. Anyone can propose a change. The rules are published as free documents called RFCs, “Requests for Comments,” a name that tells you a lot about the culture. The IETF’s famous motto is that it believes in “rough consensus and running code”: if you want to change how the internet works, the way to win the argument is to build something that works and show people.
• Regional registries hand out blocks of IP addresses to networks in each part of the world.
• Thousands of separate companies and organisations own the actual cables, routers and buildings. Your ISP owns its bit. A university owns its bit. Nobody owns the whole.

This is why the internet is hard to switch off, and also why nobody can force it to improve. Change happens by persuasion and by lots of separate parties choosing to adopt something. It’s slow. It is also the reason one physicist’s side project at CERN could become the World Wide Web without needing anybody’s permission.

Part 14What it costs the planet

All of this runs on electricity. The warehouses full of servers, the routers running 24 hours a day, the cooling systems keeping it all from overheating, and the device in your hand.

Two things are true at once here, and it’s worth holding both.

The internet also saves a great deal of energy. A video call instead of a flight. A downloaded album instead of a shipped CD. A doctor’s appointment you don’t drive to.

Those are real savings. For a lot of things, the digital version is far lighter than the physical one it replaced.

But the growth is real and speeding up. And one thing matters more than almost anything else: where the electricity comes from.

Take two identical data centres. Run one on hydro power in Quebec. Run the other on coal. Same building, same machines, completely different footprint.

Most of Canada’s electricity is already low-carbon. That makes this one of the better places on Earth to put a data centre, worth knowing when you hear about a new one being built near you.

Stop and thinkTwo identical data centres, one in Quebec and one somewhere else, can have very different footprints. Why? You already have everything you need to answer this.

So the useful response isn’t guilt about watching a video. It’s knowing which questions to ask.

Where does the power come from? Is the cooling water returned to the river, or used up? Are the machines getting efficient faster than demand is growing?

All three have real answers. All three are worth asking when someone proposes a new facility near you.

Part 15The whole journey, start to finish

This part is deliberate revision. Everything in it has appeared already; this is the first time you’ll see all of it moving at once, which is a different thing from having read about each piece.

You’re on a couch in Toronto. You type cbc.ca and press Enter. Here is everything that happens, in order, in roughly a quarter of a second.

1. Your laptop needs a number, not a name. It asks its DNS resolver: what’s the address for cbc.ca?
2. The resolver either remembers, or asks a root server, then the .ca server, then CBC’s own name server, and comes back with an IP address.
3. Your laptop opens a connection to that address. It sends a short “hello, are you there?” packet, the server answers, your laptop confirms. This three-message handshake takes one round trip and must finish before any real data moves.
4. Then comes the encryption handshake, the two sides agree on a secret scramble, and your laptop checks the server’s certificate. That’s the padlock appearing. Only now can a real request be sent.
5. Your laptop builds the request, “please send me the homepage”, and hands it to TCP, which chops it into numbered packets. IP stamps each one with the destination and your return address.
6. The packets go out over Wi-Fi radio to your router, then down the wire from your building.
7. Your ISP’s routers pass them hop by hop toward the destination. If CBC’s network and your ISP both connect at TorIX, the packets may never leave Toronto. If not, they might detour through the U.S. and back.
8. The packets reach a server in a data centre, which reassembles them and reads the request.
9. The server sends the page back, in packets, over whatever route works right now.
10. Your laptop reassembles them in order, notices packet 112 is missing, asks for just that one again, gets it, and completes the set.
11. Your browser reads the HTML, requests the images and styling (each of which repeats steps 1–9), and draws the page.

Eleven steps. Dozens of machines. Several countries, possibly. Glass, copper, radio waves and electricity. And a set of rules that a few thousand people wrote down and gave away for free.

That’s the internet. Not a cloud. A machine you can point at.

Part 16What happens next — connecting everyone

Nobody knows the future of the internet. But not all guesses are equally worthless, and telling them apart is a skill you can actually learn.

So this section does something the rest of the primer doesn’t: it labels its own confidence. Every claim below carries one of three tags, and you should treat them very differently.

Getting everyone connected

Happening now The address shortage is quietly ending. Remember IPv4 running out? On 28 March 2026, for the first time, more than half the people reaching Google did so over IPv6, 50.1%.^[19] Eighteen years after the transition began.

Two honest caveats on that. It was a single-day peak, not a permanent crossing, 28 March was a Saturday, and these numbers run higher at weekends when people are on home connections. And other measurers disagree: around the same time APNIC said about 42–43%, and Cloudflare said 40.1%.^[19]

None of them is lying. Google measures its own visitors. APNIC weights its samples by each country’s estimated number of internet users. Cloudflare counts web requests. When three careful sources disagree, the answer is a range, not a winner.

Happening now Satellites are finally doing something useful. Not for the backbone; that’s still cables, as Part 10 explained. But for the places cables were never going to reach. As of 8 August 2026 an independent astronomer’s catalogue counted 10,923 working Starlink satellites in orbit.^[21] SpaceX said in June 2026 that it had 12 million customers, that second figure is the company’s own, and nobody audits it.^[22]

Happening now Canada’s connection gap is not where the headline says it is. The target is 50 Mbps down and 10 Mbps up for 98% of Canadians by 2026 and 100% by 2030. As of May 2026 the national figure was 97.4%.^[26] Nearly there.

Now look underneath the average, which is where averages always hide the story:

Careful with those last two: they come from the CRTC’s 2024 survey, published in March 2026, so they’re about eighteen months older than the 97.4%.^[27] The gap has probably narrowed since then, though nothing suggests it has closed.

To make it concrete: in Nunavut today the home internet package is 15 Mbps down, 2 Mbps up, with a 300 GB monthly cap, and it’s sold in only four of the territory’s twenty-five communities.^[28] That’s under a third of the speed the rest of the country calls a minimum, with a limit most households elsewhere would blow through in a week.

In April 2026 the federal government committed $87 million to bring all 25 communities to 50/10 with no data cap by March 2029 — about 11,650 households, delivered by Northwestel using fibre and Telesat capacity.^[28] Construction can’t start until after the 2027 sealift, the annual ocean resupply that brings heavy materials north before the ice returns.

There is no more Canadian sentence in this entire document: the internet build schedule is set by when the ice lets the ships in.

Committed, could slip 6G is real, and further away than the advertising suggests. In June 2026, 3GPP, the body that actually writes mobile standards, approved the timeline. The protocol freeze lands in December 2028, with the final code freeze in March 2029.^[29] The ITU’s window for submitting candidate technologies runs February 2027 to February 2029, with evaluation continuing after that.^[30]

No standards body, regulator or operator has committed to a commercial deployment date. The “around 2030” you’ll see quoted is an industry expectation worked backwards from the standards schedule, a reasonable inference, but not a promise from anyone. Anything sold as 6G before 2029 is a trial.

Part 17AI is changing what the internet is for

More than half of internet traffic is no longer people. That single fact is reshaping who the web gets built for, and what it costs to run.

Happening now Most internet traffic is no longer people. In July 2026, Cloudflare, which sits in front of a large share of the web and can therefore count, reported that more than half of internet traffic is now non-human. Software talking to software. And the mix shifted: 52% of crawler requests were for AI training as of June 2026, up from 22% in spring 2025.^[31]

This matters because it strains an old bargain. For thirty years the deal was: let search engines read your pages, and they send you readers. In the week of 19–26 June 2025, Cloudflare measured one AI company making about 70,900 page requests for every single visitor it sent back.^[32]

Happening now People are clicking through less. The best evidence isn’t a survey; it’s real browsing behaviour. Pew Research watched what 900 American adults actually did across 68,879 Google searches in March 2025. When an AI summary appeared, people clicked a normal search result 8% of the time. With no summary, 15%. Roughly half. Only 1% clicked a link inside the summary itself.^[34]

Google disagrees. In August 2025 the head of Google Search wrote that total clicks to websites were “relatively stable year-over-year.” That post contains no figures, no chart and no methodology.^[35]

You’re allowed to weigh a published, replicable measurement against an unquantified assertion from an interested party, and reach a conclusion. That isn’t bias. That’s how evidence works. It would also be fair to note that Pew measured one month, in one country, early in the rollout, and that Google can see data nobody outside the company can, both of which are fair points to hold at the same time.

Nobody knows How this gets settled. Two routes are open. One is public standards: the IETF has a working group writing a successor to robots.txt, the decades-old file where a site states what crawlers may take. As of April 2026 it was still a draft, with no published standard.^[36] The other route is one company deciding. Since July 2025 Cloudflare has asked every new site whether to allow AI crawlers, and from 15 September 2026 it blocks training and agent crawlers by default on pages that show ads.^[37]

Stop and thinkWhy would a website happily let a search engine read every page, but not an AI company? What did it get from the search engine that it doesn’t get from the AI?

A humbling detail: as of June 2025, only about 38% of the top 10,000 websites had a robots.txt file at all, and among those, one major AI crawler was blocked by about 8%.^[38] The polite old system was barely used before anyone started fighting about it.

The electricity problem, honestly

Happening now Here is the fact that reframes the whole energy conversation, and almost nobody mentions it.

Between 2010 and 2018, global data centre electricity use rose about 6%. Over the same period the amount of computing they did rose about 550%, their storage grew about 25-fold, and internet traffic grew more than tenfold.^[39] Efficiency swallowed nearly all the growth. For a decade we got vastly more internet for almost no extra power.

That era is over. A US national lab report in December 2024 states it plainly: the shift to AI hardware “ended the era of generally flat data center energy use.” American data centres went from about 60 TWh in 2014, 1.8% of national electricity, to 176 TWh in 2023, or 4.4%.^[40]

The strongest thing about this claim is who makes it. Four of the researchers behind the good-news 2020 paper are also authors on the 2024 report announcing it had ended, including its lead author.^[39][40] The people who documented the efficiency miracle are the ones telling you it stopped. That’s what updating on evidence looks like, and it’s why I weight this above most energy claims you’ll read.

Committed, could slip That same report projects US data centres at 325 to 580 TWh by 2028, somewhere between 6.7% and 12% of all American electricity.^[40]

Notice the top of that range is nearly double the bottom. The width is the message. When forecasters publish an honest range, read the range, not the midpoint, and definitely not whichever end a headline picked.

Real pressure is already showing up on real grids:

• Ireland. Data centres used 23% of all metered electricity in the country in 2025, up from 5% in 2015.^[41] More than all rural households combined. Since December 2025, new Irish data centres must bring their own generation or storage to match what they draw.^[42]
• The US mid-Atlantic. In the December 2025 auction that secures future power supply for the PJM grid, prices hit the regulatory cap. Of roughly 5,250 MW of forecast load growth, PJM attributed about 5,100 MW to data centres — around 97%, though that percentage is my arithmetic on their two numbers, not a figure PJM prints.^[43]
• Alberta. The grid operator received 29 data centre connection requests totalling more than 16,000 MW and capped new connections at 1,200 MW while it works out a framework.^[44] Queue numbers are requests, not commitments, most projects in any interconnection queue never get built.
• Quebec. In February 2026 Hydro-Québec asked its regulator to charge new data centres over 5 MW 13¢/kWh, and crypto mining 19.5¢, roughly double current large-industrial rates. The stated reason: make these industries cover their own costs.^[45]

Part 18Who gets to control it

The popular story is that the internet is splitting apart. The measured story is stranger: it is technically holding together while quietly concentrating into very few hands.

This is the most politically contested thread in the primer, so I’ll be careful, including about the claims that would flatter my own framing.

Happening now Governments switch the internet off more than they used to. In 2025 there were 313 documented shutdowns across 52 countries, a record, up from 304 in 2024 and 289 in 2023. Myanmar led with 95, then India with 65.^[47]

Happening now Undersea cables keep getting cut, and the sabotage story is weaker than the headlines.

Start from the baseline in Part 10: 150 to 200 cable faults happen every year, normally. The industry body that tracks them says 70–80% are accidents, anchors and fishing gear, and deliberate damage is under 1% of the annual total.^[48] Any individual cut is far more likely to be a bad day at sea than an act of war.

Now the famous incidents, and what investigators actually concluded:

• Taiwan, January 2025. A ship’s captain was convicted and sentenced to three years, upheld on appeal. This is the one real conviction. But prosecutors did not bring the harsher national-security charge — by their own account, they never established who, if anyone, directed him.^[49]
• Sweden–Latvia, January 2025. Swedish prosecutors closed the case as an accident: bad weather, technical faults and suspected poor seamanship.^[50]
• Finland–Estonia, December 2024. Charges were dismissed in October 2025 because the court found Finnish law didn’t reach the incident under the law of the sea. It never ruled on whether it was deliberate. Under appeal.^[50]
• Baltic, November 2024. Swedish investigators concluded it could not be determined whether the damage was intentional. They did not rule sabotage out, and they were obstructed, unable to interview the crew aboard.^[50]
• Red Sea, February 2024. The leading theory, still not confirmed, is the dragging anchor of a cargo ship that had been hit by a missile and abandoned. Damage caused by a war, but probably not a cable-cutting operation.^[51]

The summary that survives checking: a cluster of suspicious incidents in tense waters, where attribution has repeatedly failed to survive contact with a courtroom. That is genuinely worrying, it suggests the law struggles to reach this. But “we couldn’t prove it” is not “we proved it,” and a primer that blurred those two would be teaching you a bad habit while claiming to teach you a good one.

Happening now The real change is concentration, not fragmentation. Three companies run most of the world’s cloud: Amazon 28%, Microsoft 20%, Google 15%, 63% between them as of mid-2026.^[52]

You can watch the consequence when one of them stumbles. On 18 November 2025, Cloudflare had its worst outage since 2019 and large parts of the web returned errors for about five and a half hours. It was not an attack, Cloudflare said so explicitly. A routine database permissions change made an internal configuration file roughly double in size, pass a hard limit nobody expected to hit, and crash the software that handles traffic.^[53] A month earlier, an Amazon region went down for about fourteen and a half hours because of a timing bug in its own automated DNS system that produced an empty record.^[54]

Part 2 said the internet has no single point of failure. That’s still true of the design. It’s becoming less true of the practice, because so much now rests on so few providers, and both of those outages were self-inflicted configuration errors, not attacks. The failure mode isn’t villains. It’s complexity.

Part 19Proving things are real

The internet is replacing every lock it has, and almost nobody noticed. Meanwhile the problem of proving a photo is genuine turns out to have no solution at all.

Happening now The internet is quietly replacing all its locks, and you probably haven’t noticed.

Remember the padlock from Part 12. The maths behind it, where your browser and a server agree on a shared secret, relies on problems that are hard for ordinary computers. A sufficiently powerful quantum computer would make them easy.

Nobody has built one. But there’s a specific reason not to wait, and it has a name: “harvest now, decrypt later.” Someone can record your encrypted traffic today, store it, and decrypt it in fifteen years when the machine exists. If what you sent still matters then (medical records, state secrets, someone’s identity) it was never really protected.

So the replacement is already underway, and it has been remarkably fast. The new algorithms were published by the US standards body on 13 August 2024.^[58] Here is Cloudflare’s measurement of its own traffic since:

Over 65% by April 2026, from under 3% at the start of 2024.^[59] You took part in this. You did it by updating your browser.

The counterweight: only about 10% of origin servers, the machines actually holding the websites, support the new method.^[59] Protection needs both ends. Browsers moved fast; the rest of the internet has not.

Committed, could slip There are now real deadlines. A US executive order signed in June 2026 requires federal systems to have quantum-resistant key exchange on their most important systems by the end of 2030, and signatures by the end of 2031.^[60] The UK’s cyber security centre set milestones at 2028, 2031 and 2035.^[61]

Nobody knows When a quantum computer could actually break today’s encryption. This is the genuinely open question, so here’s the spread rather than a number.

A survey of 26 specialists, published in 2026, put the odds of breaking today’s standard encryption within ten years at 28–49%, and within fifteen years at 51–70%.^[62] That spread is the disagreement, these are experts who cannot agree with each other.

Meanwhile the engineering estimates keep falling. In 2019 a leading researcher estimated 20 million qubits would be needed; by 2025 the same researcher said under one million.^[63] More aggressive 2026 estimates go lower still, but one of them would need 120 years of running time to actually finish the job, a detail the headlines drop.^[64] For scale: Google’s Willow chip has 105 physical qubits.^[64]

So: no official body names a date. Institutions are acting on 2030–2035 anyway. That’s not a contradiction; it’s what good risk management looks like when you don’t know. You don’t have to predict the fire to buy the extinguisher.

Proving a picture is real (and why it can’t quite work)

Nobody knows As AI-made images improve, there’s a push to attach a tamper-evident record to photos — where taken, by what camera, what edits were made. The main effort is called C2PA, or Content Credentials, backed by Adobe, the BBC, Google, Microsoft, OpenAI, Sony and others. Some Google Pixel and Sony cameras support it. It is not yet an international standard.^[65]

Here’s why I’ve tagged this “nobody knows” rather than “happening now”:

• Four countries’ cyber security agencies, including Canada’s, published a joint note stating that the credential “does not allow a consumer to determine whether a piece of content is true.” It records who, when and how. Not whether.^[66]
• A peer-reviewed teardown in April 2026 found that different conforming checkers disagree about the same file, that timestamps aren’t properly bound to the content, and that signing certificates expire long before the legal retention periods for the media they sign.^[67]
• Ordinary re-encoding by social platforms strips the credential entirely.
• Privacy researchers warn the same records could reveal which journalist took a photo, on which device.^[68]
• And the one that can’t be engineered away: point a certified camera at a screen showing a fake, and you get a perfectly valid credential.

Provenance can attest to a pipeline. It can never attest to reality. That isn’t a bug someone will fix; it’s the shape of the problem. Which means judging whether a source is trustworthy is a skill no badge is going to replace.

Part 20Telling true from false

Proving a photo is real is a technical problem. Proving a claim is true is a human one, and there is a specific, teachable habit that works. This is the most useful part of the primer.

First, three words worth being precise about. Canada’s own cyber security centre defines them like this:^[75]

• Misinformation, false, but shared by someone who thinks it’s true.
• Disinformation, false, and spread deliberately to manipulate people.
• Malinformation, based on truth, but exaggerated or twisted so it misleads.

The difference is intent. Someone’s uncle sharing a wrong health tip is misinformation. A government paying people to post that same tip is disinformation. Identical falsehood, completely different problem, completely different fix. Lumping them together is how most arguments about this go wrong in the first thirty seconds.

Happening now False stories really do travel faster, inside one specific pool. In 2018, MIT researchers studied about 126,000 stories shared on Twitter over eleven years. Falsehoods reached 1,500 people roughly six times faster than true stories, and were 70% more likely to be re-shared.^[76]

And the finding that should stay with you: bots spread true and false news at exactly the same rate. The reason falsehood won was people. Humans did it, by choosing what to pass on.^[76]

Happening now Why it works on you anyway: repetition. Hearing a statement a second time makes it feel truer. The unsettling part, demonstrated repeatedly since 2015, is that this happens even when you already know the right answer. Psychologists call it “knowledge neglect”, your brain uses the feeling of familiarity as a shortcut instead of checking the facts it already holds.^[80]

The scale, honestly: the effect is small, not overwhelming. A nudge, not a spell. But it works on wild conspiracy claims and boring trivia at about the same strength,^[80] and it stacks.

Which gives you something genuinely useful: the thing to watch for isn’t one brilliant lie. It’s the same small claim, a hundred times, from a hundred accounts. Repetition is the technique. Recognising repetition as a technique is most of the defence.

Nobody knows The AI catastrophe that hasn’t arrived, yet. Before the 2024 elections, a great many people predicted deepfakes would decide them. Researchers went and looked afterwards. In the UK general election they found 16 confirmed viral cases of AI disinformation; across the EU and French elections, 11. They found no evidence any result was affected.^[81]

Canada’s 2025 federal election got measured too. Researchers found 5.86% of election-related images on X, Bluesky and Reddit were deepfakes. That sounds alarming, until you look at who saw them. Harmful deepfakes were 0.12% of all views on X, and nearly half of all the deepfakes found were jokes or not political at all.^[82] (That study is a preprint and hasn’t been peer-reviewed yet, so treat the numbers as preliminary.)

Prevalence and reach are different things. Something can be everywhere and seen by almost nobody. Any statistic that gives you one without the other is only half a fact.

Do not file this as “so it’s fine.” The same researchers document real harm that has nothing to do with election results: deepfake pornography targeting women in politics, more than $200 million in deepfake-driven fraud in early 2025 alone, and a newer trick, flooding the web with fake articles specifically to poison what AI chatbots repeat.^[83]

So the sentence that fits the evidence is three separate claims, and you should resist anyone who merges them: no proven effect on election outcomes. Rising volume and sophistication. Real, documented harm elsewhere.

The one habit that actually works

Researchers gave the same web pages to three groups: 10 professional fact-checkers, 10 history PhDs, and 25 Stanford students.

One task: which of two doctors’ organisations is more trustworthy? One was the real professional body. The other was a small splinter group with a similar-sounding name and a very official-looking website.

These are not unintelligent people. The students were taken in by a logo and a convincing web address.^[84]

The difference wasn’t intelligence, and it wasn’t knowledge. It was a habit.

The historians and students read vertically, they stayed on the page and studied it closely, the way you’d read a book. The fact-checkers read laterally: they left almost immediately, opened new tabs, and asked a different question: what does the rest of the internet say about whoever made this page?

On another task, fact-checkers uncovered a hidden public-relations-firm connection in an average of 51 seconds. The historians took nearly four minutes. Eighty percent of the students never thought to check who was paying for the site at all.^[84]

The researchers’ own summary is the line worth memorising: the fact-checkers “read less but learned more.”

The caveat I owe you: that study had 10, 10 and 25 people in it. It’s been hugely influential and the mechanism makes obvious sense, but it is one small study, and I’d be breaking my own rules if I called it settled. Notice that you just applied the skill to the study about the skill.

What’s been tested, and how well it works

Three approaches have been properly trialled. Here’s what they actually deliver, including where the researchers disagree with each other.

• Teaching lateral reading. The clearest mechanism of the three. In one study of 574 students, scores rose from 2.25 to 3.75 out of 9 after lessons.^[85] Look at the second number: after the training they still got fewer than half right. Real improvement. Nowhere near solved.
• Prebunking. Short videos that show you a manipulation trick before you meet it in the wild. A large study (about 30,000 people, including 22,632 on YouTube) found solid gains in lab conditions but only about a 5% improvement in the real-world YouTube test.^[86] Critics argue the gains are mostly generalised suspicion of everything, including true news, rather than a better ability to tell them apart, and a 2026 preregistered study found no improvement in that ability at all.^[87] That disagreement is unresolved. Also worth knowing: game-based versions fade within about nine days, while video versions last around a month.^[88]
• Accuracy nudges. Simply prompting someone to think about whether a headline is accurate, before they share. The first big result was later replicated at about half the original size.^[89] Everyone now converges on roughly the same answer: real, robust, and small, around a 10% reduction in sharing false headlines.^[90]

The most encouraging thing here isn’t any of the three results. It’s that the two rival research groups, who spent years publicly finding fault with each other’s work, eventually ran a study together to test whether their methods combined.^[91]

That’s what the thing this primer keeps pointing at actually looks like in practice. Not certainty. People arguing in public, in a way that lets them be shown wrong, and then changing their minds where the evidence goes.

One last thing.

Go back and look at Reginald Fessenden’s card, near the cables in Part 10.

His 1900 achievement, the first human voice sent by radio, has a plaque on an island in Maryland. His 1906 Christmas Eve broadcast has no newspaper coverage from the time and didn’t surface until the late 1920s. Both stories circulate. The second one circulates more, because it’s a better story.

That’s the whole problem, in one man, from 1906. It is not new. The internet didn’t invent it, and no badge, law or algorithm is going to solve it for you.

The answer isn’t “trust nothing”; that’s just a different way of being fooled, and it’s the failure mode the prebunking critics are worried about. The answer is smaller and much more doable:

Leave the page. Open a tab. Find out which one has the plaque.

Who has to prove how old they are

Happening now Several countries now require age checks to reach parts of the internet. The UK’s rules took effect in July 2025; Australia banned under-16s from major social media in December 2025. Canada’s version, Bill S-209, passed the Senate in April 2026 and is awaiting second reading in the House of Commons; it is not law.^[69]

The early results are genuinely mixed, and worth seeing before anyone tells you it obviously worked or obviously failed:

• UK, one year on: more than 69 million age checks across 32 services in six months, and the share of children encountering checks rose from 25% to 43%. But 33% of first-page Google results still led to sites with no checks at all.^[70]
• Australia, seven months on: 4.7 million under-16 accounts removed or restricted, yet about 70% of children who had accounts before the ban still had them, and there was no clear drop in cyberbullying complaints.^[71]
• How children actually get around checks: 63% by lying about their age. Only about 10% use tools that disguise their location.^[72] The VPN angle got most of the coverage; it’s the smaller effect.

Both sides, stated properly. Digital rights groups point at a concrete cost: an age-verification supplier used by Discord was breached in October 2025, exposing around 70,000 government ID images.^[73] Meanwhile more than 50 children’s safety organisations and bereaved families signed a statement in January 2026 supporting effective age assurance while opposing blanket under-16 bans, arguing bans push children toward less safe places and cut off support networks for vulnerable young people, including LGBTQ+ teenagers.^[74]

So the real disagreement isn’t “age checks: yes or no.” It’s bans versus graduated, risk-based checks, and who ends up holding your identity documents. If someone presents this to you as a simple two-sided fight, they haven’t read the people they claim to agree with.

What you can actually affect

Almost everything in Parts 16 to 20 is a decision, not a weather forecast. Decisions have deciders, venues and dates. Here’s where the ones above get made, and every item on this list takes public input.

One last thing

Every part of this primer describes something people built and could have built differently. TCP/IP was given away instead of patented. CERN put the Web in the public domain. ICANN said no to a superpower’s ally. Someone decided Nunavut’s internet build waits for the sealift. Someone is deciding, right now, what a data centre pays for electricity in Quebec.

The internet isn’t weather. It’s an enormous pile of arguments that got settled, most of them in public, many by people who weren’t important at the time. Those arguments are still open, and you can read them.

That’s the actual point of understanding how it works.

Words you now know

Packet

A small numbered piece of a larger message, with a from-address and a to-address on it.

IP address

The numeric address of a device on the internet. IPv4 looks like 208.80.153.224; IPv6 is much longer and there are vastly more of them.

Router

A machine that reads a packet’s destination and forwards it one step closer. It only knows the next hop, not the whole path.

Hop

One step from one router to the next.

DNS

The Domain Name System, the internet’s phone book, turning names like cbc.ca into numbers.

Root server

The top of the DNS hierarchy. 13 names, over 2,000 actual machines worldwide.

Server

A computer left switched on to answer requests. Lives in a data centre.

Client

A device that makes requests — your phone, laptop, console.

TCP / UDP

The two main ways of packaging data. TCP checks nothing was lost; UDP is faster but doesn’t check.

HTTP / HTTPS

The rules for requesting web pages. The S means encrypted.

ISP

Internet Service Provider, the company that connects you to everyone else.

IXP

Internet Exchange Point, a neutral building where many networks meet and swap traffic directly.

Encryption

Scrambling a message so only the intended recipient can read it.

Boomerang routing

When data between two points in one country leaves and re-enters it on the way.

The Web

One kind of traffic on the internet, linked pages, viewed in a browser. Invented twenty years after the internet.

Data centre

A warehouse full of servers, kept cool and powered. What people mean by “the cloud.”

Handshake

The short back-and-forth two machines do to open a connection, before any real data moves.

ICANN

The body that coordinates names and numbers worldwide, so no two machines get the same address.

IETF

The open body that writes the internet’s technical rules. Anyone can join and propose a change.

Anycast

Copying one address onto many machines worldwide, so your request goes to the nearest copy.

Misinformation

False information shared by someone who believes it’s true.

Disinformation

False information spread deliberately, to manipulate.

Malinformation

Information based on truth, but exaggerated or twisted so it misleads.

Lateral reading

Leaving a page to check elsewhere who made it, instead of studying the page itself. The habit that works.

Deepfake

An image, video or voice generated or altered by AI to look real.

Post-quantum encryption

New scrambling methods designed to survive a future quantum computer.

Sources

Every number and date in this primer traces to one of these. Where a figure was current as of a specific date, that date is noted, because these change.

1. ITU, Facts and Figures 2025 — Internet use. 6 billion users, 74% of the world’s population, ~2 billion offline. itu.int
2. Internet Society, FAQ on IPv6 adoption and IPv4 exhaustion. IPv4 ≈ 4.3 billion addresses; IPv6 = 2¹²⁸. internetsociety.org
3. Netnod, DNS root server FAQ. Why there are 13 root server names. netnod.se
4. Root Server Technical Operations Association. 2,003 operational instances, 12 operators, as of 11 August 2026. root-servers.org
5. ICANN, The First Message Transmission (2019). Charley Kline, UCLA to SRI, 29 October 1969; “lo”. icann.org
6. CERN, The birth of the Web. Web software placed in the public domain 30 April 1993. home.cern
7. CERN, Web at 30 — Web History. March 1989 proposal; December 1990 first browser, server and website. web30.web.cern.ch
8. TeleGeography, Submarine Cable FAQs. 600+ cables, 1.5 million km, ~200 faults/year, garden-hose thickness, satellites at 0.37% of U.S. international capacity (FCC). Figures as of early 2026. telegeography.com
9. TorIX, Who is TorIX?. Not-for-profit, 250+ connected organisations. torix.ca
10. Wikipedia, Toronto Internet Exchange. Founded 1997; largest IXP in Canada; sites at 151 Front St W, 45 Parliament St, 905 King St W. wikipedia.org
11. CIRA, Internet Exchange Points. 12 Canadian IXPs; north-to-south transit through the U.S. described as costly and inefficient. cira.ca
12. Obar, J. & Clement, A., Internet Surveillance and Boomerang Routing: A Call for Canadian Network Sovereignty. papers.ssrn.com · See also the IXmaps research project: ixmaps.ca
13. Submarine Networks, Halifax Cable Landing Station. submarinenetworks.com
14. CIRA, About CIRA. Canadian non-profit managing the .CA domain. cira.ca
15. Let’s Encrypt, 10 Years of Let’s Encrypt Certificates (December 2025). HTTPS from under 30% in 2015 to ~80% globally and ~95% in the U.S.; approaching one billion sites protected. letsencrypt.org
16. International Energy Agency, Energy and AI — Energy demand from AI. Data centres ≈415 TWh (1.5% of global electricity) in 2024; base case ≈945 TWh (just under 3%) by 2030. iea.org
17. Vint Cerf, Marking the birth of the modern-day Internet, Google. The 1 January 1983 switch from NCP to TCP/IP. blog.google
18. Environmental and Energy Study Institute, Data Centers and Water Consumption. Large facilities up to 5 million gallons/day; U.S. data centres ≈449 million gallons/day in 2021; average WUE 1.9 L/kWh. eesi.org
19. The Register, Google says IPv6 finally passed 50% (April 2026), and APNIC Blog, Google hits 50% IPv6 (28 April 2026). 50.1% single-day peak on 28 March 2026; APNIC ~42–43%, Cloudflare 40.1%, mid-April 2026. Different measurers, different populations. blog.apnic.net
20. CircleID, IPv4 Market in H1 2026: A Price Reset, Not a Market Collapse. ~5.0M addresses across 596 priced transactions, average $20.04, down 35.7% year-on-year; ~$52 for large blocks in late 2023. circleid.com
21. Jonathan McDowell, Starlink Statistics. 10,939 in orbit, 10,923 working, as of 8 August 2026. Independently catalogued. planet4589.org
22. SpaceX, announced 4 June 2026: over 12 million active customers in 160+ countries. Company-reported and not independently audited. finance.yahoo.com
23. Telesat press release, 4 August 2026. C$2.3 billion 15-year Arctic contract with Canada’s Defence Investment Agency, 65°–90°N; constellation 156→225 satellites, +44% capacity; MDA Space C$474M award; global service from Q1 2028. telesat.com
24. Telesat press release, 13 September 2024. C$2.14B federal loan with warrants for 10% of Telesat LEO shares; C$400M Quebec loan with warrants for a further 1.87%. telesat.com
25. Northwestel and Telesat, 2 April 2026. Multi-year agreement to buy Lightspeed capacity and retail 50/10 unlimited in the North. telesat.com
26. Innovation, Science and Economic Development Canada, Progress toward universal access to high-speed Internet. 97.4% national at 50/10 as of May 2026; urban 99.8%, rural 87.4%; targets 98% by 2026 and 100% by 2030. ised-isde.canada.ca
27. CRTC news release, 18 March 2026, reporting 2024 Facilities Survey data: territories 69.6%, First Nations reserves 65.7%. Note the figures are from 2024 even though published in 2026. Also announces the Broadband Fund’s Indigenous stream consultation. canada.ca
28. Government of Canada backgrounder, 2 April 2026, and Nunatsiaq News. Current service 15/2 Mbps with a 300 GB cap in 4 of 25 communities; $86,976,502 to reach all 25 at 50/10 unlimited (~11,650 households) by March 2029; construction begins after the 2027 sealift. canada.ca
29. 3GPP, Release 21 timeline, published 10 June 2026. Protocol (Stage-3) freeze December 2028; ASN.1/OpenAPI freeze March 2029. 3gpp.org
30. ITU-R WP 5D IMT-2030 process timeline. Technology submission window February 2027 – February 2029, with evaluation and consensus-building continuing after. techblog.comsoc.org
31. Cloudflare, The agentic Internet: a bot traffic report, 1 July 2026. More than 50% of internet traffic non-human; 52% of crawler requests for AI training as of June 2026, up from 22% in spring 2025. blog.cloudflare.com
32. Cloudflare, Crawl-to-refer ratios on Radar, 1 July 2025. ~70,900 page requests per referral for one AI crawler, week of 19–26 June 2025. blog.cloudflare.com
33. Cloudflare, From crawl to click, 29 August 2025. One crawler’s ratio fell from 286,930:1 in January 2025 to 38,065:1 in July — about 87%. Over the same period OpenAI’s fell ~10% and Google’s rose from 3.8 to 5.4. blog.cloudflare.com
34. Pew Research Center, published 22 July 2025 (data collected March 2025). 900 US adults, 68,879 Google searches: 8% clicked a result when an AI summary appeared vs 15% when none did; 1% clicked a link inside the summary. pewresearch.org
35. Liz Reid, VP and Head of Google Search, 6 August 2025: total organic click volume “relatively stable year-over-year.” The post contains no figures, chart or methodology. blog.google
36. IETF AIPREF working group documents. As of April 2026 still an Internet-Draft; no RFC published. datatracker.ietf.org
37. Cloudflare press release, 1 July 2025 (every new domain asked whether to allow AI crawlers, plus pay-per-crawl), and Content Independence Day, 1 July 2026 (from 15 September 2026, training and agent crawlers blocked by default on ad-displaying pages for new domains). blog.cloudflare.com
38. Cloudflare, From Googlebot to GPTBot: who’s crawling your site in 2025, 1 July 2025. robots.txt found on 3,816 of the top 10,000 domains (38%); GPTBot disallowed by 312 of those (8.2% any disallow, 6.5% full block). Sample dated 6 June 2025. blog.cloudflare.com
39. Masanet, Shehabi, Lei, Smith & Koomey, Recalibrating global data center energy-use estimates, Science, 28 February 2020. Energy +6% from 2010–2018 while compute instances +550%, storage ×25, IP traffic more than ×10. datacenters.lbl.gov
40. Shehabi, Smith, Hubbard, Newkirk, Lei, Siddik, Holecek, Koomey, Masanet & Sartor, 2024 United States Data Center Energy Usage Report, Lawrence Berkeley National Laboratory, December 2024. “Ended the era of generally flat data center energy use.” 60 TWh (1.8%) in 2014 → 176 TWh (4.4%) in 2023 → 325–580 TWh (6.7–12.0%) projected for 2028. Note the overlapping author list with the 2020 paper. eta-publications.lbl.gov
41. Central Statistics Office (Ireland), Data Centres Metered Electricity Consumption 2025, released 7 July 2026. 23% of metered electricity in 2025, up from 5% in 2015. cso.ie
42. Commission for Regulation of Utilities (Ireland), decision on new electricity connection policy for data centres, 12 December 2025. cru.ie
43. PJM Interconnection, 2027/2028 Base Residual Auction results, 17 December 2025. Cleared at the FERC-approved cap of $333.44/MW-day; of ~5,250 MW of forecast load growth, ~5,100 MW attributed to data centre demand. The “97%” is arithmetic on those two figures, not a number PJM publishes. pjm.com
44. Alberta Electric System Operator, 4 June 2025. 29 proposed data centre projects totalling more than 16 GW; interim connection limit of 1,200 MW. globenewswire.com
45. Hydro-Québec application to the Régie de l’énergie, filed 19 February 2026. 13¢/kWh for data centres over 5 MW; 19.5¢/kWh for blockchain and crypto mining. lapresse.ca
46. PolitiFact, 12 June 2026, rating a 5 June 2026 statement Mostly False. The 267% figure describes wholesale nodal prices (April 2020 – April 2025), and wholesale supply is 30–50% of a retail bill. Accurate comparators: US residential prices up ~42% over five years; Washington DC up 94% (March 2021 – March 2026). politifact.com
47. Access Now / #KeepItOn, Internet Shutdowns in 2025 annual report, March 2026. 313 shutdowns in 52 countries (304 in 2024, 289 in 2023); Myanmar 95, India 65. Includes the methodology’s own limits: undocumented cases, Myanmar undercounted, India’s court-published orders, and why continuous-censorship states record few shutdowns. accessnow.org
48. International Cable Protection Committee, media FAQ, updated 20 May 2026. 150–200 faults per year; 70–80% from accidental human activity; sabotage under 1% of annual damage. iscpc.org
49. Tainan District Court, 12 June 2025; upheld by the Taiwan High Court Tainan Branch, 29 August 2025. Three-year sentence for intentional cable damage. Prosecutors’ own release confirms the party directing the act was never identified; the harsher national-security-tier offence was not charged. pf.org.tw
50. Baltic incidents. Sweden–Latvia (Vezhen): Swedish prosecutors closed the case 14 October 2025, finding weather, technical faults and suspected poor seamanship, not a deliberate act. Finland–Estonia (Eagle S): Helsinki District Court dismissed charges 3 October 2025 on jurisdiction under the law of the sea, without ruling on intent; under appeal. Baltic November 2024 (Yi Peng 3): Swedish Accident Investigation Authority, 15 April 2025 — it “cannot be determined with certainty” whether damage was intentional; sabotage not ruled out, and investigators were denied access to interview the crew. valtioneuvosto.fi
51. Kentik, What caused the Red Sea submarine cable cuts?, 31 March 2024. The dragging anchor of the abandoned Rubymar is described as “the leading theory” but “yet to be confirmed.” kentik.com
52. Synergy Research Group, 30 July 2026. Q2 2026 cloud infrastructure share: Amazon 28%, Microsoft 20%, Google 15%. srgresearch.com
53. Cloudflare post-mortem, Cloudflare outage on November 18, 2025. Explicitly “not caused, directly or indirectly, by a cyber attack.” A database permissions change doubled the rows in a bot-management feature file, exceeding a hardcoded limit and crashing the proxy. Impact 11:28–17:06 UTC. blog.cloudflare.com
54. Amazon Web Services post-event summary, us-east-1, 19–20 October 2025. “A latent race condition in the DynamoDB DNS management system that resulted in an incorrect empty DNS record.” Full resolution across services took about 14.5 hours. aws.amazon.com
55. ICANN CEO Göran Marby to Ukraine’s Minister of Digital Transformation, 2 March 2022, declining to revoke Russian domains or disable root servers. ICANN “has no sanction-levying authority”; its mission “does not extend to taking punitive actions.” A separate request to RIPE NCC regarding IP addresses was also refused. icann.org
56. The Record, on Russia’s regional internet-disconnection test of 7–9 December 2024 covering Chechnya, Dagestan and Ingushetia. On NSDI mirroring rather than replacing the ICANN root, see the SplinterCon technical presentation of 13 June 2024 — note this is an unattributed conference paper, the weakest source cited in this primer. therecord.media
57. Media Ecosystem Observatory (McGill / University of Toronto), The News Canadians Actually See, Summer 2026. Facebook posts by news outlets −65%, Instagram −74%; engagement −48% in large cities vs −89% in mid-sized cities and rural areas; survey of 8–13 January 2026 found only 41% of Facebook users correctly knew news was blocked, with 30% believing it was not. mediatechdemocracy.com
58. NIST, first three finalised post-quantum encryption standards (FIPS 203, 204, 205), published 13 August 2024. nist.gov
59. Cloudflare, Post-quantum roadmap, 7 April 2026. Over 65% of human traffic post-quantum encrypted, from under 3% at the start of 2024, 29% at the start of 2025 and 52% in December 2025 — but only about 10% of origin servers support it. blog.cloudflare.com
60. US Executive Order 14412 and OMB Memorandum M-26-15, June 2026. Post-quantum key establishment on high-value systems by 31 December 2030; digital signatures by 31 December 2031. whitehouse.gov
61. UK National Cyber Security Centre, Timelines for migration to post-quantum cryptography, 20 March 2025. Discovery and planning by 2028; highest-priority migrations by 2031; complete by 2035. ncsc.gov.uk
62. Global Risk Institute / evolutionQ, Quantum Threat Timeline Report 2025, published 9 March 2026. Survey of 26 experts: 28–49% likelihood of breaking RSA-2048 within 10 years; 51–70% within 15 years. globalriskinstitute.org
63. Craig Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, 21 May 2025 — revising the same author’s 2019 estimate of 20 million qubits. arxiv.org
64. Physics World, 26 May 2026, on 2026 resource estimates. A ~10,000-qubit approach would need roughly 120 years of runtime against RSA-2048; Google’s Willow chip has 105 physical qubits. Treat aggressive estimates as resting on assumptions that still require future breakthroughs. physicsworld.com
65. Coalition for Content Provenance and Authenticity. Specification 2.4 (April 2026); ISO/CD 22144 not yet published as an international standard. c2pa.org
66. NSA, Australia’s ACSC, the Canadian Centre for Cyber Security and UK NCSC, Content Credentials: Strengthening Multimedia Integrity in the Generative AI Era, January 2025. Content Credentials do “not allow a consumer to determine whether a piece of content is ‘true’.” media.defense.gov
67. Golaszewski, Krawetz, Sherman, Zieglar et al., Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short, 23 April 2026. Conforming validators disagree on the same file; timestamps not cryptographically bound to content; certificate expiry conflicts with legal retention periods. arxiv.org
68. World Privacy Forum, Privacy, Identity and Trust in C2PA, June 2025. Warns that provenance metadata can identify a specific device and owner, with particular risk to journalists. worldprivacyforum.org
69. Parliament of Canada, Bill S-209, Protecting Young Persons from Exposure to Pornography Act. Passed the Senate 15 April 2026; first reading in the House of Commons 30 April 2026; awaiting second reading. parl.ca
70. Ofcom, one-year report on Online Safety Act age checks, 15 July 2026. Over 69 million age checks across 32 services in six months; children encountering checks up from 25% to 43%; 33% of first-page Google results still led to unprotected sites. ofcom.org.uk
71. Australian eSafety Commissioner evaluation, reported July 2026, on the under-16 social media minimum age in force from 10 December 2025. 4.7 million accounts removed or restricted; roughly 70% of children who previously had accounts still had them; no clear decline in cyberbullying complaints. theconversation.com
72. UK Department for Science, Innovation and Technology / BMG, Children’s circumvention behaviours online, 14 July 2026 (n=2,299, ages 11–17). 39% had circumvented an age check at least once; 63% of those did so by posing as someone else; about 10% used location-changing tools. gov.uk
73. Electronic Frontier Foundation, Age verification is a privacy nightmare, 28 May 2026, citing the October 2025 breach of a third-party age-verification vendor used by Discord, which exposed roughly 70,000 government ID images. eff.org
74. Joint statement from 50+ children’s and online-safety organisations, experts and bereaved families, January 2026, supporting highly effective age assurance while opposing blanket under-16 social media bans. mollyrosefoundation.org
75. Canadian Centre for Cyber Security (CSE), How to identify misinformation, disinformation, and malinformation (ITSAP.00.300), updated March 2024. The three definitions are quoted from this page. cyber.gc.ca
76. Vosoughi, Roy & Aral, The spread of true and false news online, Science 359(6380), 9 March 2018. ~126,000 stories, ~3 million people; truth took about six times as long as falsehood to reach 1,500 people; falsehoods 70% more likely to be retweeted; bots spread true and false news at the same rate. science.org
77. Allen, Howland, Mobius, Rothschild & Watts, Evaluating the fake news problem at the scale of the information ecosystem, Science Advances 6(14), 3 April 2020. News of any kind is at most 14.2% of Americans’ daily media diet; fake news is 0.15%. science.org
78. Budak, Nyhan, Rothschild, Thorson & Watts, Misunderstanding the harms of online misinformation, Nature 630, 5 June 2024. A review, not new data: exposure is “rare and concentrated among a narrow fringe with strong motivations to seek out such information.” nature.com
79. Altay, Berriche & Acerbi, Misinformation on Misinformation: Conceptual and Methodological Challenges, Social Media + Society, 28 January 2023. Notes that the 2018 Twitter study sampled only already-disputed stories — a limit its own authors acknowledged — and that the nuance was lost in coverage. journals.sagepub.com
80. Fazio, Brashier, Payne & Marsh, Knowledge does not protect against illusory truth, Journal of Experimental Psychology: General 144(5), 2015 — the “knowledge neglect” finding. Replicated for implausible and conspiracy statements: Fazio, Rand & Pennycook (2019) and Bowes & Fazio, registered replication, Psychonomic Bulletin & Review, 2026. Effect sizes are small (d ≈ 0.2–0.4). link.springer.com
81. Alan Turing Institute / CETAS, AI-Enabled Influence Operations: Threat Analysis of the 2024 UK and European Elections, 19 September 2024. 16 confirmed viral cases in the UK general election, 11 across the EU and French elections; no evidence of impact on any result. cetas.turing.ac.uk
82. Livernoche, Musulan, Yang, Godbout & Rabbany (Mila / McGill / Université de Montréal), Deepfakes in the 2025 Canadian Election, December 2025. 5.86% of election images were deepfakes; harmful ones were 0.12% of views on X; 49.4% of detected deepfakes were benign or non-political. Preprint — not peer-reviewed. arxiv.org
83. CETAS / Alan Turing Institute, From Deepfake Scams to Poisoned Chatbots: AI and Election Security in 2025, 17 November 2025. Over $200 million in deepfake-driven fraud in early 2025; data-poisoning attacks aimed at contaminating AI chatbot outputs; still no evidence of tangible impact on 2025 election outcomes. cetas.turing.ac.uk
84. Wineburg & McGrew, Lateral Reading and the Nature of Expertise, Teachers College Record 121(11), 2019. 10 fact-checkers, 10 historians, 25 Stanford undergraduates. Fact-checkers 2.0/2.0, historians 0.7/2.0, students 0.16/2.0, with 60% of students choosing the splinter group; fact-checkers averaged 51 seconds to uncover a PR-firm connection. Note the small sample. stacks.stanford.edu
85. McGrew & Breakstone, Civic Online Reasoning Across the Curriculum, AERA Open 9(1), 2023. 574 ninth-graders, pretest 2.25 → posttest 3.75 out of 9. The authors note it was not a randomised trial and had no control group. files.eric.ed.gov
86. Roozenbeek, van der Linden, Goldberg, Rathje & Lewandowsky, Psychological inoculation improves resilience against misinformation on social media, Science Advances 8(34), 24 August 2022. Six randomised studies (n=6,464) plus a YouTube field study (n=22,632); manipulation-technique recognition rose about 5% in the field test. science.org
87. Modirrousta-Galian & Higham, Journal of Experimental Psychology: General, 2023, and Seabrooke, Modirrousta-Galian & Higham, Psychonomic Bulletin & Review, 2026. Argue via signal detection theory that these interventions mostly produce general scepticism rather than better discrimination between true and false, and identify a difficulty confound in earlier positive results. discovery.ucl.ac.uk
88. Maertens, Roozenbeek, Simons, Lewandowsky, Maturo, Goldberg, Xu & van der Linden, Psychological booster shots targeting memory increase long-term resistance against misinformation, Nature Communications 16:2062, 11 March 2025. N=11,759. Game-based effects were not significant at 9 days; video-based retained roughly 78% of effect at 30 days. nature.com
89. Roozenbeek, Freeman & van der Linden, How accurate are accuracy-nudge interventions? A preregistered direct replication, Psychological Science 32(7), 11 June 2021. Roughly 50% attenuation of the original effect. journals.sagepub.com
90. Pennycook et al., Shifting attention to accuracy can reduce misinformation online, Nature 592, 17 March 2021; and Pennycook & Rand, Accuracy prompts are a replicable and generalizable approach, Nature Communications 13:2333, 2022 — 20 experiments, N=26,863, about a 10% reduction in sharing false headlines. The authors describe the effects as “modest in size.” nature.com
91. Nature Human Behaviour, 2024: Inoculation and accuracy prompting increase accuracy discernment in combination but not alone — the two rival research groups publishing together. nature.com
92. Foran & Bilodeau, Shifting perceptions of misinformation in Canada, Statistics Canada, released 13 May 2026 (Canadian Social Survey Wave 17, collected spring 2025). 80% saw suspected false information at least monthly; 61% very or extremely concerned; 47% say it is harder to tell true from false than three years ago. www150.statcan.gc.ca
93. Government of Canada, Safe Social Media Act (Bill C-34), introduced 10 June 2026 — seven content categories, none of which is falsity. Its predecessor, the Online Harms Act (Bill C-63), died on the Order Paper when Parliament was prorogued on 6 January 2025. C-34 was not yet law at the time of writing. canada.ca