I stopped trusting my internet provider with anything important years ago. My mail, my domains and my spam filtering all run on infrastructure I control at kevinkatovic.com. People ask me why I’d bother when Bell, Rogers or Telus will host it for free. This is the answer: what the public record says about Canada’s big ISPs, and what I do differently.

The short version of the record

Year	Carrier	What happened	Source
2007	Bell, Telus Mobility, Fido	A U.S. data broker social-engineered its way past phone authentication and pulled call records, including the Privacy Commissioner’s own	OPC finding #2007-372
2015	Bell	“Relevant Ads” profiled customers’ browsing and app use on an opt-out basis; the Commissioner ruled it needed opt-in consent. Bell dropped the program	OPC finding #2015-001
2017	Bell	About 1.9 million customer email addresses and roughly 1,700 names and phone numbers taken by a hacker	Bell / CBC
2018	Bell	Hackers obtained data on “fewer than 100,000” customers	BCE / Global News
2021	Fido (Rogers)	Employees bypassed authentication, letting fraudsters repeatedly into a customer’s account	OPC finding #2021-004
2022	Rogers	One router configuration change knocked out wireless and wireline service for more than 12 million customers for about 15 hours	CRTC / Xona report
2026	Telus Digital	Confirmed breach; the attackers claim close to a petabyte of data, which hasn’t been verified	Telus / press

These come from Privacy Commissioner findings, a CRTC-commissioned report and the companies’ own disclosures. The pattern is consistent: authentication that a phone call can get past, data collection set to opt-out, and network changes rated “low risk” without testing. In my view that’s a culture problem, not bad luck. These companies follow PIPEDA and answer to the CRTC, but following the rules isn’t the same as caring.

The legal backdrop isn’t great either. Canada’s privacy law dates to 2000, breach reporting only became mandatory in November 2018, the big reform bill (C-27) died in January 2025, and its replacement (C-36) was only tabled in June 2026. Meanwhile lawful-access bills (C-2 in 2025, now C-22) keep pushing providers to hand over more.

What I do differently at kevinkatovic.com

I’m not an ISP, and I still need one to reach the internet like everyone else. What I don’t do is hand them my mail, my DNS or my identity. Here’s the setup in plain terms:

• My own mail server. Mail for my domains lands on a machine I run. No carrier inbox, nobody scanning it for ads, and no address that disappears if I switch providers.
• My own spam and phishing rules. I write filter rules for each scam campaign that hits me: fake giveaways, fake carrier and bank notices, sextortion. Most get blocked before they ever reach an inbox.
• Firewall blocks on repeat offenders. When a network keeps sending fraud, it gets cut off at the firewall, and I report it to the network’s abuse desk with the evidence attached.
• Signed DNS. My zone is DNSSEC-signed, so a resolver can tell if someone tampers with where my domain points.
• No front desk to social-engineer. There’s no call centre that can be talked into resetting my mail password. The 2007 and 2021 findings above were both about exactly that.
• Logs I actually read. I get a daily summary of new connections and anything unusual, and I take action myself instead of waiting for a ticket.

A lot of that work goes into taking down the scam sites behind the emails. If someone is impersonating your business, this takedown service gets the fake site pulled by its host and registrar.

What it costs to own your stack

Self-hosting isn’t free. You pay in hardware, power, a static IP and your own time, and when something breaks at 2 a.m. it’s on you. The upside is that no carrier’s culture decides how your data is handled. If you’re on the West Coast, cheap hydro helps a lot. This look at power strategies around Vancouver covers the same grid questions any home server faces. For bigger builds, this breakdown of data centre cost per megawatt and the map of Canada’s 2026 AI data centre boom show where the money is going, and an AI server configurator lets you price your own hardware piece by piece.

Should you leave your ISP’s email?

For most people, yes, even if you don’t self-host. A carrier email address ties your logins to a company you might leave, it’s a favourite phishing target, and it lives with a provider whose record is in the table above. Move to a provider you chose on purpose, or run your own if you have the skills. Either way, stop treating the free carrier inbox as a safe place.

FAQ

Is kevinkatovic.com an internet service provider?
No. It still connects to the internet through an ISP. The difference is that its mail, DNS and spam filtering run on infrastructure Kevin controls instead of a carrier’s.

Why not use my ISP’s email address?
If you change providers you lose the address, it’s a common phishing target, and it puts your logins with a company whose security record you didn’t choose.

What does DNSSEC do?
It cryptographically signs a domain’s DNS records so resolvers can detect if someone tampers with where the domain points.

Do Canadian ISPs follow privacy law?
They’re bound by PIPEDA and regulated by the CRTC. The critique is about their track record: Privacy Commissioner findings in 2007, 2015 and 2021, breaches in 2017, 2018 and 2026, and the 2022 Rogers outage.

Sources: Office of the Privacy Commissioner of Canada PIPEDA Reports of Findings #2007-372, #2015-001 and #2021-004 and its 2019 breach-record inspections; CBC and Global News on the May 2017 and January 2018 Bell breaches; CRTC / Xona Partners assessment of the July 8, 2022 Rogers outage (executive summary, July 2024); Insurance Journal, TechRadar and Cybersecurity Dive on the 2026 Telus Digital breach; CIPPIC, Michael Geist and Fasken on Bills C-2 and C-22; Gowling WLG and Fasken on Bill C-36 (June 2026). Opinion and commentary based on the public record cited above. Corrections welcome at support@kevinkatovic.com.

Cover graphic © 2026 Kevin Katovic, all rights reserved. To license it, email support@kevinkatovic.com.