Language selection

Government of Canada / Gouvernement du Canada

Search


Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: RCMP Responses

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: RCMP Responses


Date of Publishing:

List of Acronyms

Abbreviation Expansion
2017 MD 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities
ACA (ACMFEA, or “the Act”) Avoiding Complicity in Mistreatment by Foreign Entities Act
ADM Assistant Deputy Minister
AMCC Avoiding Mistreatment Compliance Committee
CBSA Canada Border Services Agency
CRA Canada Revenue Agency
CRCC Civilian Review and Complaints Commission for the RCMP
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DFO Department of Fisheries and Oceans
DND/CAF Department of National Defence / Canadian Armed Forces
EPPP Enhanced Passenger Protect Program
FINTRAC Financial Transactions and Reports Analysis Centre of Canada
FIRAC Foreign Information Risk Advisory Committee
FPNS Federal Policing National Security
GAC Global Affairs Canada
GATE Governance, Accreditation, Technical Security and Espionage
HOM Head of Mission (or Chargé)
HRR Human Right Report
ICCPR International Covenant on Civil and Political Rights
ICE Integrated Collaborative Environment
INPL Intelligence Policy and Programs Division
IRCC Immigration, Refugees and Citizenship Canada
ISCG Information Sharing Coordination Group
LEAG Law Enforcement Assessment Group
LO Liaison Officer
MDCC Ministerial Direction Compliance Committee
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security Intelligence Review Agency
OiC Orders in Council
PPP Passenger Protect Program
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RFI Requests for Information
TC Transport Canada
Abréviation Développement
AL Agent de liaison
AMC Affaires mondiales Canada
ARC Agence du revenu du Canada
ASFC Agence des services frontaliers du Canada
CANAFE Centre d’analyse des opérations et déclarations financières du Canada
CCDM Comité de conformité à la directive ministérielle
CCEMT Comité de conformité pour éviter les mauvais traitement
CCETP Commission civile d’examen et de traitement des plaintes relatives à la GRC
CCRIE Comité consultatif sur les risques – Information de l’étranger
CDM Chef de mission (ou chargé de mission)
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CST Centre de la sécurité des télécommunications
DC Décret en conseil
DI Demande d’information
ECI Environnement collaboratif intégré
GASE Gouvernance, accréditation, sécurité technique et espionnage
GCER Groupe de coordination d’échange de renseignements
GEAL Groupe d’évaluation de l’application de la loi
GRC Gendarmerie royale du Canada
IM-2017 Instructions du ministre de 2017 visant à éviter la complicité dans les cas de mauvais traitements par des entités étrangères
INPL Direction des politiques et des programmes liés au renseignement
IRCC Immigration, Réfugiés et Citoyenneté Canada
Loi visant à éviter la complicité, la Loi Loi visant à éviter la complicité dans les cas de mauvais traitements infligés par des entités étrangères
MDN/FAC Ministère de la Défense nationale/Forces armées canadiennes
MPO Ministère des Pêches et des Océans
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PIDCP Pacte international relatif aux droits civils et politiques
PPP Programme de protection des passagers
PPP-A Programme de protection des passagers amélioré
RDP Rapport sur les droits de la personne
SCRS Service canadien du renseignement de sécurité
SMA Sous-ministre adjoint
SNPF Sécurité nationale et Police fédérale
SP Sécurité publique Canada
TC Transports Canada

Executive Summary

This review focuses on departmental implementation of directions received through the Orders in Council (OiC) issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”). This is NSIRA’s third annual assessment of the statutorily mandated implementation of the directions issued under the ACA.

This year’s review covers the 2021 calendar year and has been split into three sections. First, the review addresses the statutory obligations of all departments. Sections two and three of the review focus on in-depth analysis of how the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC) have implemented the directions under the ACA. NSIRA has used case studies, where possible, to examine these departments’ implementation of the ACA framework.

NSIRA has observed that this is the third consecutive year where there have been no cases referred to the deputy head level in any department. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Future reviews will be attuned to the issue of case escalation and departmental processes for decision-making.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

In last year’s review NSIRA identified Canada Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies. While CBSA and PS continue to make advancements these departments still have not fully implemented an ACA framework and supporting policies and procedures.

RCMP has a robust framework in place for the triage and processing of cases pertaining to the ACA. The in-depth analysis portion of this review found that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances. NSIRA also found that the RCMP has not developed mechanisms to update country and entity profiles in a timely manner, and the information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In the analysis of one of the RCMP’s Foreign Information Risk Advisory Committee (FIRAC) case files, NSIRA found that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments. The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested.

NSIRA found that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA. This is a marked change from the findings of the 2019 review that found decision-making was done at the Ministerial Direction Compliance Committee (MDCC) at Headquarters.

GAC has also not conducted an internal mapping exercise to determine which business lines are most likely to be implicated by the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

NSIRA also notes that GAC has no formalized tracking, or documentation mechanism for the follow-up of caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

During the review, GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC has provided NSIRA with all documents requested within a reasonable time frame.

This review assessed departments’ implementation of the directives received under the ACA and their operationalization of frameworks to address ACA requirements. As such, this review constitutes the first in-depth examination of the ACA within individual departments.

Authorities

This review is being conducted under the authority of paragraph 8(2.2) of the National Security Intelligence Review Agency Act (NSIRA Act), which requires National Security Intelligence Review Agency (NSIRA) to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”).

Introduction

This review will focus on departmental implementation of directions received through the Orders in Council issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act. The overarching objective of this review is to assess whether departments are meeting their obligations under the ACA and associated directions. NSIRA is mandated to conduct this review on an annual basis.

Background

Many departments and agencies in the Government of Canada routinely share information with foreign entities. Given that information sharing with entities in certain countries can result in a risk of mistreatment of individuals, it is incumbent upon the Government of Canada to evaluate and mitigate the risks that such sharing creates. This is particularly the case for information sharing related to national security and intelligence, where information often relates to alleged participation in terrorism or other criminal activity.

The 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities (2017 MD), defined the substantial risk of mistreatment as:

[A] personal, present and foreseeable risk of mistreatment. In order to be ‘substantial’, the risk must be real and must be based on something more than mere theory or speculation. In most cases, the test for substantial risk of mistreatment will be satisfied when it is more likely than not that there will be mistreatment; however, in some cases particularly where there is a risk of severe harm, the ‘substantial risk’ standard may be satisfied at a lower level of probability.

This review will be NSIRA’s third annual assessment of the implementation of the directions issued under the ACA. This review will build on the previous reviews conducted in respect of avoiding complicity in mistreatment. The first review was in respect to the 2017 MD. The second review assessed the directions issued under the ACA, but was limited to the four months from when the directions were issued to the end of the 2019 calendar year. The third review was NSIRA’s first full year assessment of the implementation of the directions issued under the ACA for the 2020 calendar year.

NSIRA has focused on conducting in-depth reviews of how departments implement the directions under the ACA. This approach builds on the foundational knowledge obtained over the last three years and reviews how departments operationalize the directions under the ACA by using case studies to assess departments ACA frameworks in practice.

The review, covering the 2021 calendar year has been split into three sections. The first section addresses NSIRA’s statutory obligations covering a full year review of all departments. This year NSIRA conducted an in-depth review of two departments: the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC), sections two and three respectively.

Methodology

Subsection 7(1) of the ACA imposes a statutory obligation on the deputy head to whom directions were issued to submit a report to the Minister regarding the implementation of those directions during the previous calendar year and publish a public copy of the report. The Minister must then provide the classified copy to NSIRA.

The obligations for departments noted above are mirrored in the NSIRA Act. Under subsection 8(2.2) of the NSIRA Act, NSIRA must, each calendar year, review the implementation of all directions issued under the ACA. Additionally, NSIRA has the statutory right to review the implementation beyond the specific requirements of the ACA, namely through its mandate to review any activity carried out by a department that relates to national security or intelligence.

The issued Orders in Council (OiC) include a reporting requirement, whereby decisions necessitating referral to the deputy head for determination must be reported to the Minister and subsequently the review bodies. This requirement creates additional accountability for decisions undertaken by departments and allows NSIRA to be informed of any potential issues outside of the annual reporting cycle.

This review encompasses the implementation of the directions for the 12 departments that were in receipt of the OiC pursuant to the ACA. The review period is January 1, 2021, to December 31, 2021. Additionally, NSIRA has selected two departments for more in-depth case study review: GAC and the RCMP. NSIRA will ensure that additional departments are selected for case study analysis in future years.

In completing this review, NSIRA considered legal authorities and governance frameworks. NSIRA also relied on documentation and information obtained through briefings with the departments.

Verification of Information and Responsiveness

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments.

The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. NSIRA found that overall, its expectation for responsiveness by the RCMP during this review were met.

GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested. NSIRA found that overall, its expectation for responsiveness by GAC during this review were met.

All Departments

Framework Updates and Reporting

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework, and supporting policies and procedures are still under development.

Based on submissions to NSIRA, ten departments have established frameworks and policies addressing whether the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual. The submissions provided to NSIRA by Canada Revenue Agency (CRA), Department of National Defence / Canadian Armed Forces (DND/CAF), and Transport Canada (TC) indicate that they are actively working on refining existing policies and frameworks. NSIRA, in last year’s report identified Canadian Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies.

Frameworks

CBSA advised that it has provisionally approved a framework for deciding whether a request for information from a foreign entity would result in a substantial risk of mistreatment of an individual. CBSA advised NSIRA that it issued direction to conduct an internal review with the goal of confirming the feasibility of operational implementation across multiple program areas.

PS has advised that a full suite of risk assessments are under development and that it intends to conduct information sessions to ensure other program areas not directly affected by the ACA are aware of information sharing obligations. PS also advised that the program area implicated by the Ministerial Directions (the Directions) has operationalized the policy and has ensured that their procedures and processes align with the requirements outlined in the departmental policy, Act and the Directions. These policies came into effect in January 2022, with “a few aspects” having not yet been finalized. The suite of risk assessments is still in development.

PS also intends to hold information sessions with various sections of the department that may not currently need to apply the Directions, but should nonetheless be aware of their existence should they develop new programs with an information sharing dimension.

In 2020, GAC initiated a full review of the Avoiding Mistreatment Compliance Committee (AMCC) as directed by its terms of reference. GAC has advised that notional recommendations have been developed to address the identified shortcomings. Recommendations include timeliness of Committee decisions, addressing duty of care issues, and reporting case outcomes regarding Committee decisions.

NSIRA has been advised that the AMCC’s secretariat review will be completed in 2022 and the terms of reference will be updated shortly after. In response to NSIRA’s inquires about risk analysis, GAC has advised that during the review period they created a new risk assessment form and are developing a broader orientation guide with the goal of supporting employees through the risk assessment and decision-making process. These issues are further explored in section two of this report.

RCMP has noted internal shortcomings in regards to country assessments and the inability to regularly update the reports. A framework has been provided to NSIRA on how the RCMP intends to remedy these shortcomings in the future to better serve the Foreign Information Risk Advisory Committee (FIRAC) process.

Reporting

Subsection 7(1) of the Act requires deputy heads to submit a report to the appropriate Minister on the implementation of directions received under the Orders in Council during the previous year. The ACA stipulates that report submissions are required before March 01 of each year.

All twelve departments have fulfilled their obligations to report to their respective ministers The Communications Security Establishment (CSE), and TC did, however, submit their reports shortly after the March 01 deadline.

Subsection 7(2) of the Act also requires deputy heads make an unclassified version of the report available to the public as soon as feasible after submission to the Minister. Reports were made available in all of the twelve departments.

Section 8 of the Act requires the Minister to provide a copy of the report to the National Security and Intelligence Committee of Parliamentarians (NSICoP), NSIRA and, if applicable, the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC).

The table below captures a summary of both the departmental responses to the implementation questions and NSIRA’s assessment regarding these responses. The assessment was based on the associated details provided by departments in the context of the specific information requested. If a specific requirement was not met, it has been flagged. The relatively few instances of these were connected with departments not meeting certain reporting obligations under the Act.

Summary Table 1.1 – Requirements under the Act
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
Cases referred to the deputy head? No No No No No No No No No No No No
Was a report submitted to the Minister? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Was the report made available to the public? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Did the Minister provide a copy to NSICoP, NSIRA, CRCC? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes

Case Triage and Escalation

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

All twelve departments indicated that they did not have any cases referred to the Deputy Head level for determination. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Therefore, all additional reporting requirements associated with this level of decision were not applicable.

Summary Table 1.2 – Cases Escalated, by Level of Approval
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
First Level. (Supervisor/Deputy Chief) 0 634 236 (23) 780) 0 Not Known/Not Tracked 48 6 2 401 55 0
Second Level (Manager/Chief) 0 325 176 (24) 243 0 Not Known/Not Tracked 48 6 2 401 55 0
Third Level(Director/DDG) 8(25) 69
Fourth Level (DG/Committee/ Working Group) 0 63 1 (26) 81 0 7 48 0 0 0 55 0
Fifth Level (ADM/A.Commis sioner/L1) 0 0 0 (27) 0 0 2 0 0 0 0 55 0
Sixth Level (Deputy Head) 0 0 0 0 0 0 0 0 0 0 0 0

NSIRA notes that this is the third consecutive year where there have been no cases referred to the deputy head level in any department.

Future reviews may be particularly attuned to the issue of case escalation and departmental processes for decision-making, as one of the stated objectives of NSIRA’s review of ACA obligations is to ensure that the assessment of risk is escalated to appropriate level of authority.

Implementation of Previous Recommendations

As part of this review, NSIRA requested information regarding the implementation of previous recommendations. The following analysis is based on responses received from departments.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

DND/CAF has advised NSIRA that as a result of its recommendation, the department has included the definition of “substantial risk” within the Chief of Defence Intelligence Functional Directive on DND/CAF Information Sharing Activities with Foreign Entities. However, it should be noted that DND/CAF has also adopted additional definitions including its definition of “foreseeable.” NSIRA has previously expressed its concerns in its 2019 detailed Annex of DND/CAF application of the MD regarding the DND/CAF interpretation of foreseeability. DND/CAF has also advised NSIRA that it leveraged the human rights assessment methodology from other organizations to develop the methodology for DND/CAF’s profiles. DND/CAF has also advised that it is actively participating with ACA-related interdepartmental working groups to share its country’s human rights methodology, procedures, and assessments, and raise concerns.

Of the twelve departments, CRA, CBSA, CSIS, DND/CAF, PS and TC have continued to adjust frameworks and policies as a result of the findings and recommendations from previous reviews of the ACA. While recommendations may not have been specific to individual departments, many have advised that they have taken into them into consideration and applied improvements more generally.

CRA for example in response to Recommendation #1 from NSIRA’s 2019 review (regarding the importance of conducting periodic internal reviews), has reviewed its exchanges of information procedures. As a result, CRA has implemented procedural changes where risk assessments deemed to be of low-risk are now approved at the manager level, whereas previously the minimum approval level was Director.

CBSA has provisionally approved its ACA policy and is currently conducting an additional review to ensure that the policy is operable across multiple program areas. CBSA has advised that the policy includes guidance on the disclosure of information, the request for information, and the use of information where there may be a substantial risk of mistreatment of an individual. As part of the policy, the CBSA has incorporated procedures and processes to assess risk and coordinate with its Senior Management Risk Assessment Committee.

PS has also finalized its draft policy in response to NSIRA’s 2020 ACA review finding that it did not finalize its policy frameworks in support of the Direction received under the ACA. PS has noted that a policy was approved and came into effect on January 1, 2022. NSIRA has been advised additional aspects of the policy are still being implemented, including the development of risk assessment tools.

Finally, TC has advised NSIRA that it has taken stock of feedback on the implementation of the ACA since initial promulgation of the Corporate Policy in August 2020. TC notes that its corporate policy is under revision and seeks to clarify and strengthen key elements. TC has advised that adjustments underway include refining language to further clarify roles, responsibilities program-level requirements, and timelines associated with implementation. To this end, TC is providing more guidance on reporting format and content requirements for program-level support to the annual reporting exercise.

At the program level, TC is reviewing the policy impact of changes (over the past year) to the functional structure and roles associated with the Passenger Protect Program (PPP). To date, the PPP is the only program activity that TC has identified where risks associated with the ACA may be present. The PPP is currently transitioning to an enhanced framework, which is expected to be fully implemented prior to March 2023.

NSIRA maintains its previous recommendation that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the ACA.

Royal Canadian Mounted Police

The ACA review for 2021 is NSIRA’s second full year assessment of the implementation of the Act. As discussed in the background to this review, NSIRA has complemented the knowledge gained through its annual review of the ACA with an in-depth analysis of the implementation of the Directions. The in-depth analysis highlights to departments some best practices within the Government of Canada as well as some potential issues in the adopted frameworks. This year, the RCMP and GAC were selected. As one of the “original” departments subject to the 2011 Ministerial Direction, the RCMP has had over a decade to develop, implement, and adjust its framework. GAC was selected because it was issued a Ministerial Directive in 2017 and due to its role as a primary developer of human rights reports.

Implementation of the ACA

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

In 2011, the RCMP was issued the Ministerial Direction on Information Sharing with Foreign Entities. However the issued MD only applied to information sharing in national security matters. In response to the 2011 MD, the RCMP created the Foreign Information Risk Analysis Committee (FIRAC), the Committee was renamed the Foreign Information Risk Advisory Committee following the issuance of the 2017 MD.

The 2017 MD’s scope was broadened to include all units and personnel of the RCMP, and FIRAC was expanded accordingly. The enactment of the ACA imposed the requirement of the Orders in Council directions to the Commissioner. The operational requirements between 2017 and 2019 remained the same. The RCMP’s Implementation of the ACA is composed of three key mechanisms, FIRAC, Law Enforcement Assessment Group (LEAG), and Annual Reporting.

FIRAC is an advisory body to senior management, tasked with providing RCMP personnel with a mechanism to review information exchanges where there may be a substantial risk of mistreatment. FIRAC is a central part of the determination making mechanism for cases with ACA considerations. The committee examines the operational context of each request, the application of risk-mitigation strategies, and the strength of assurances and makes recommendations to the responsible Assistant Commissioner.

It is important to note that the Terms of Reference for FIRAC were updated in December 2021, this is after the conclusion of the last FIRAC meeting on the case study discussed below. The previous Terms of Reference which were drafted following the issuance of the 2017 MD stated that “in case of information sharing where there is a clear operational need to proceed, but a substantial risk of mistreatment, the decision will be referred to the Commissioner for final approval, as per the MD and Operational policy”. The revised Terms of Reference identifies that the Assistant Commissioner, or Executive Director is responsible for deciding whether the substantial risk of mistreatment can be mitigated. The Terms of Reference now clearly stipulates that the Assistant Commissioner, or the Executive Director as the sole decision maker, and that FIRAC fulfills an advisory function. NSIRA cautions that this apparent or perceived delegation of the final decision to the Assistant Commissioner risks non-compliance with the purpose and object of the Act and the OiC.

The Committee is comprised of two rotating chairs and a number of members from various divisions within the RCMP. As a result of an internal review, the RCMP have adjusted membership of FIRAC to ensure that co-chairs were not making determinations on cases from their respective units, with the intention of removing situations where a real or apparent conflict of interest could arise.

FIRAC meets bi-monthly or on an as-needed basis when urgent, time sensitive cases arise. All recommendations made by the committee are non-binding. NSIRA has also observed that the addition of Committee members is planned for April 2022.

Over the last year, the RCMP have made efforts to improve their framework and have created tools to aid personnel in engaging with FIRAC. They have established a FIRAC Coordination Unit, which is responsible for conducting consultations with personnel in order to help triage potential cases and determine the appropriate level of FIRAC engagement. The RCMP have also developed a suite of tools outlining definitions and thresholds, mitigation strategies and FIRAC requirements.

The FIRAC Coordination Unit works with RCMP staff, and members to assist with the risk assessment process and determine if a FIRAC evaluation is required. The Coordination Unit’s roles and responsibilities have been adjusted with the stated goal of providing guidance and support to members to strengthen case submissions. The intent of the Unit is to improve upon record keeping, identify internal strategic level issues, engage with external federal partners on cross-cutting issues to enhance processes and practices, and to share outcomes of case-specific FIRAC meetings with LEAG to inform updates on foreign entity assessments.

The RCMP is also in the final stages of updating its operational manual with the goal of supporting the Direction’s consistent application across the RCMP. This update is intended to clarify roles and responsibilities, as well as thresholds and triggers that require an information exchange to be reviewed by FIRAC.

As will be addressed later in this report, the 2019 OiC includes a requirement for the case to be referred to the RCMP Commissioner for determination, where officials are unable to determine whether the risk of sharing information can be mitigated. Additionally, pursuant to section 3(1)c of the OiC, the RCMP Commissioner must report and disclose any information considered in making the determination or decision to NSIRA, the Civilian Review and Complaints Commission for the RCMP (CRCC), and the National Security and Intelligence Committee of Parliamentarians (NSICoP) in a timely manner, if certain information that was likely obtained through the mistreatment of an individual by a foreign entity was used, in order to prevent loss of life, or significant personal injury.

The LEAG is responsible for developing country assessment profiles and maintaining the Integrated Collaborative Environment portal, where the information is stored and accessed by officers as needed. NSIRA was informed that during the last few years, the LEAG team has been severely underfunded and under-resourced, resulting in country profiles that are out of date with a third of countries having no assessment report whatsoever.

An annual report detailing the implementation of the Act and any cases brought to the Commissioner for determination must be sent to the Minister of Public Safety, NSIRA, NSICoP and the CRCC. The RCMP must also disclose any information considered in the making of a determination or decision. For full description of the RCMP’s process please see Annex A: Departmental Frameworks.

The RCMP continues to improve upon FIRAC process. Recently, the RCMP has made strides to enhance products used to assess whether proposed information exchanges carry a substantial risk of mistreatment that require FIRAC assessments. These improvements include visual tools outlining the decision-making process, key definitions, mitigation strategies, and triggers for a FIRAC evaluation.

RCMP continues to make considerable progress on updating resources on the designated SharePoint site, the ACA training module, and policy in the RCMP operational manual. While these initiatives are still in progress, NSIRA commends the RCMP’s initiative in conducting an internal review of FIRAC, and making efforts to address identified shortcomings.

Information Sharing Framework and Risk Analysis

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment, is a best practice.

The RCMP’s information sharing framework as it relates to ACA is predicated on managing risk. While this is largely dependent on the use of assurances and caveats, investigators rely on the Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) assessment of the particular country or foreign entity in question. LOs/ADOs as part of their role, are expected to provide up-to-date information on current country and entity reports, relationships established with specific entities, and the RCMP’s history as it relates to information sharing and current human rights records. Investigators use this information to help inform a mitigation measure applied to a proposed information request, and/or disclosure.

In making assessments and providing recommendations to the Assistant Commissioner, FIRAC considers the specifics of the case included in the initial risk assessment (included in the FIRAC submission), the LEAG country assessment, as well as input from the Liaison Officers/Analysts Deployed Overseas (LO/ADO). A Record of Decision is completed after each meeting and highlights the history of sharing with the entities, the risks and mitigation measures discussed, and the final recommendation of the Committee. Based on the information provided in the Record of Decision and the recommendation of the committee, the Assistant Commissioner will then make a determination.

While the RCMP has not formalized a Gender Based Analysis within their ACA risk-related assessments, NSIRA notes that considerations applied in the RCMP’s country risk assessments identify vulnerable groups at risk of mistreatment under the “Human Rights Concerns for Specific Groups.” Individuals identified as at risk in a country/entity designated as medium risk would require a FIRAC assessment prior to any information exchanges.

NSIRA sampled twenty instances where FIRAC was convened. However, there were a number of cases where multiple FIRAC meetings pertained to the same case. For example, [**redacted**] which is examined in closer detail as part of the NSIRA’s sample file review, had three separate FIRAC meetings. The twenty FIRAC instances in the selected sample amount to sixteen individual cases. Requests made by NSIRA used the FIRAC nomenclature, and the RCMP fulfilled requests based on what was requested in the Requests for Information. The result was that NSIRA was only able to view case file information where the case was a touch point within the FIRAC process; the full operational case files were not provided.

NSIRA recognizes that the RCMP fulfilled its obligation when responding to our request for information. However, when it became clear that NSIRA had not obtained the entirety of the case, including the investigative file, significant time constraints prevented NSIRA from obtaining and considering the additional information in this review.

Outbound Information Sharing

NSIRA observed that in at least 35 percent of FIRAC cases sampled, the RCMP factored the potential for the negative impact of not sharing in their assessment. FIRAC’s assessment considers the risk of not sharing outbound information with a particular emphasis on maintaining, developing, or preserving a relationship with an information-sharing partner. Furthermore, the RCMP informed NSIRA that they will also consider the potential public risk to security of not sharing the information. NSIRA understands that the reliability of assurances and caveats depend crucially on the circumstances and the context of a particular case, but would strongly encourage the RCMP to base its rationale for sharing information primarily on the risk to the individual. NSIRA notes that the risk assessment and mitigating strategies (to minimize risk) are the primary tools to be used when assessing whether information is to be shared. The ACA and issued Orders in Council do not permit the weighing of external considerations such as relationship damage associated with not sharing information and public safety against the risk to the individual.

Mitigation and Assurance Measures

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

The RCMP advised NSIRA that any assurances or caveats that have or have not been adhered to in relation to information sharing with foreign entities are recorded within the investigative case file. The RCMP further explained that information is shared on a case-by- case basis by means of either the Liaison Officer responsible, or INTERPOL channels.

Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) are required to record their interaction in their notes which would be included within the operational investigative file. The RCMP has advised NSIRA these notes are where any violations of assurances or caveats would be recorded.

The RCMP explained that it relies on its overseas network to monitor the reliability of assurances and caveats, and that personnel meet regularly with law enforcement partners and foreign allied LOs. The RCMP further noted any indication of a deterioration in human rights within a country or specific report on mistreatment of an individual would be discussed and captured within the RCMP (operational) case file, and ultimately documented in the RCMP’s FIRAC risk assessment form.

As noted above, due to time constraints, NSIRA obtained information on FIRAC meetings and the supporting documents, and did not have an opportunity to review the RCMP’s operational case files. When NSIRA asked to provide rationales used to assess the reliability of assurances and caveats for the selected sample, NSIRA was referred back to the FIRAC risk assessment form (also known as Form 6517), and provided with the following:

The footnote highlights a number of case files. General and Supplementary reports on these files were reviewed in the preparation of this response. No concerns with respect to assurances were documented and only one instance with respect to caveats was identified. In this regard, [**redacted**] documents one instance wherein a partner agency had not adhered to a caveat’s requirement to coordinate actions – no allegation of mistreatment was documented on the file. The issue was raised with the partner agency and addressed.

NSIRA notes that while the [**redacted**] was in relation to a company operating in the [**redacted**], witness information was sought from the [**redacted**]. The LEAG Country Risk Assessment for [**redacted**], designated as medium risk, does cite an issue specific to the sharing of information and the use of caveats, but has not been updated since August 2018. The RCMP has advised that:

While the LEAG country assessment has not yet been updated, the LO would be expected to raise this issue in any future consultations with various investigative teams seeking to share with this entity.

NSIRA stresses the importance of the post-monitoring of assurances and caveats. NSIRA has observed that the issuance of an assurance, and/or caveat may sometimes rely on assurances provided by a specific official (within the foreign entity/country). Absent appropriate documentation, this may be problematic due to the fact that movement within positions is to be expected and assurances can no longer be valid if the individual has moved out of the position. Assurances must be followed up on and renewed to ensure they are being followed in the event of employee turnover.

Furthermore, there is no centralized process for the documentation of assurances. Rather, some documentation that is occasionally noted on specific investigative files may be problematic in situations where LOs/ADOs are rotational. If the investigative file is closed, the new LOs/ADOs to the post may not be aware of situations where assurances have not been respected.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Country and Entity Profiles

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In 2019, the RCMP conducted an internal review of its information sharing framework including LEAG and FIRAC. Based on this review, NSIRA recommended in 2019, that departments adopt internal reviews of their policies and processes as a best practice. While it is not the intention to cover items already identified in the (internal) review, NSIRA notes that three years have elapsed and the issues associated to country and entity assessments still remain.

Of the 90 assessments, the RCMP is currently using to base its risk assessments, 87 percent have not been updated since 2018, and the remaining thirteen percent have not been updated since 2019. Over the course of 2021, the RCMP did not update any of its country profiles. NSIRA has been advised that in 2022, [**redacted**] but cite funding constraints as a key challenge.

A key finding of the RCMP’s internal review relates composition of the profiles themselves, in that they: “do not sufficiently reflect the RCMP’s operational experience.” The review states that: “LEAG country and entity risk profiles are predominately based on open source information rather than input from operational units…” The RCMP through the course of the review emphasized the role and importance to the Liaison Officer during the FIRAC process, suggesting that the Liaison Officer is positioned to offset any shortcoming with the country and entity profiles. NSIRA notes the internal review highlights some of the challenges faced by the Liaison Officers, referring to the added responsibilities of the LEAG and the FIRAC processes as adversely affecting their ability to preform their regular duties.

NSIRA notes the RCMP’s ongoing efforts at improving its post-monitoring efforts. NSIRA looks forward to reviewing the progress made over the next year on the measures taken on updating the RCMP’s country profiles, and inclusion of post-monitoring of automating media monitoring and information sharing tracking mechanism with INTERPOL Ottawa.

Case Study: [**redacted**]

[**redacted**] the RCMP sought approval to interview a [**redacted**]

[**redacted**] The RCMP sought to [**redacted**] interview [**redacted**] in order to assess the current risk or threat [**redacted**] to Canada and Canadian citizens, [**redacted**]. The RCMP has advised that a “…successful interview could advance the investigation [**redacted**]and significantly improve the ability to identify the threat and risk [**redacted**] to [**redacted**] security.”

Additionally, the RCMP believed that “engagement with [**redacted**] may lead to [**redacted**] information and evidence [**redacted**].

[**redacted**]

The RCMP’s internal Country profile classifies [**redacted**] as a High-Risk Profile (RED). The profile notes serious documented allegations of human rights abuses [**redacted**] (but not limited to) torture [**redacted**] suspects routinely subjected to unfair trials. The RCMP had concerns that “If [**redacted**] could face torture and mistreatment [**redacted**]”. As per policy the case was escalated to the Foreign Information Risk Advisory Committee (FIRAC).

a) FIRAC [**redacted**]

[**redacted**], the FIRAC convened and discussed the request to interview [**redacted**] Committee found that there are substantial risks of mistreatment for [**redacted**] that there are currently no measures in place that could effectively mitigate the identified risks. FIRAC noted [**redacted**].

FIRAC did however also note, “that efforts should be made to better position possible future interviews.” They noted that [**redacted**] would “allow the RCMP to monitor the outcomes and assurances of discussions at a strategic level [**redacted**].

Accordingly, FIRAC recommended that the RCMP “engage in discussion [**redacted**] on the [**redacted**] potential for [**redacted**]. The Assistant Commissioner for [**redacted**] approved this recommendation.

Events of [**redacted**]

In response to the FIRAC recommendation, senior RCMP [**redacted**]

[**redacted**]

Based on [**redacted**] the investigative team sought FIRAC’s recommendation to allow [**redacted**] further discussions [**redacted**] in order to have the RCMP [**redacted**] interview with [**redacted**] and seek assurances [**redacted**].

[**redacted**]

[**redacted**], the FIRAC convened [**redacted**] to consider the request to engage and exchange information to [**redacted**] interview [**redacted**] to seek assurances [**redacted**]. The request was approved by FIRAC, if certain mitigation measures and assurances be received, [**redacted**].

Events of [**redacted**]

[**redacted**] RCMP [**redacted**] engaged the [**redacted**]. The RCMP [**redacted**] there is a [**redacted**] they would be interested in interviewing [**redacted**].

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

The RCMP [**redacted**] escalated the requests to interview [**redacted**] to FIRAC with additional mitigation measures.

[**redacted**]

[**redacted**]

FIRAC convened a meeting to discuss the request to share the personal information of [**redacted**].

The Committee concluded that there is a substantial risk of mistreatment [**redacted**] should the information be shared and that said risk cannot be mitigated by caveats and assurances. Accordingly, the Committee recommended that the information not be exchanged. This recommendation was based on the following concerns:

  • [**redacted**]
  • The existence of a significant risk of mistreatment that could not be mitigated [**redacted**].
  • Inability to guarantee [**redacted**]
  • Safety concerns based on information that may be derived from the interview;
  • [**redacted**]
  • [**redacted**]
  • Assurances were deemed insufficient to mitigate the risk, [**redacted**] to allow for an assessment of the confidence in the assurance.

FIRAC recommended [**redacted**] explore additional options to reduce the potential risk of mistreatment and then return to the committee for reconsideration. Among these options, the Committee suggested [**redacted**].

[**redacted**], the Assistant Commissioner [**redacted**] rejected FIRAC’s recommendation and allowed the sharing of information. He based his decision on the following:

  1. [**redacted**] the RCMP should consider the consequences of not sharing [**redacted**] as this would be detrimental for the relationship stating that “engagement [**redacted**] will give insight and influence”;
  2. [**redacted**]
  3. The importance of the RCMP maintaining a strong relationship [**redacted**].

The Assistant Commissioner then concludes, “failure to share presents risk that cannot be managed [**redacted**]. Although influence is not guaranteed, I believe it is the better choice”

A subsequent email by the Assistant Commissioner [**redacted**] outlined additional considerations that factored into the decision to reject FIRAC’s recommendations. These considerations focused on the risk of not sharing the information. The additional information included operational and strategic considerations [**redacted**]. The Assistant Commissioner stated that lack of engagement [**redacted**]. Strategically, the Assistant Commissioner noted the risk to relationship should the information not be shared, noting that “failure to follow through [**redacted**] and associated mitigation efforts articulated below will likely have a negative impact on the [**redacted**] relationship [**redacted**].

The Assistant Commissioner’s reasoning goes on to include a “necessity” analysis regarding the challenges [**redacted**] the importance of the information from the interview, and the importance of the relationship [**redacted**]. Of note, the Assistant Commissioner notes that [**redacted**] a strong relationship [**redacted**] will aid in plans to mitigate the greater risk while also managing the risk that exists today for the Canadian [**redacted**]. The Assistant Commissioner also concludes his email by stressing that it is his belief that sharing the information is required to reduce the risk of mistreatment [**redacted**] that lack of involvement will lead to greater risk.

Analysis

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated.”

The ACA and issued OIC place an absolute prohibition on the sharing of information where there is a substantial risk of mistreatment of an individual. Unless “officials determine that the risk can be mitigated, such as through the use of caveats or assurances and appropriate measures are taken to mitigate the risk”, the information cannot be disclosed. Section 1(2) of the OICs further stipulate, “that where officials are unable to determine whether the risk can be mitigated, the Commissioner must ensure that the matter is referred to the Commissioner for determination.

The Assistant Commissioner’s decision to share the information contrary to FIRAC’s recommendation, cites section 1(2) of the OIC and concludes that since the FIRAC is responsible for making a recommendation to the Assistant Commissioner then the Assistant Commissioner is the final decision maker. The Assistant Commissioner “made the decision that the risk can be mitigated.” The Assistant Commissioner did not consider that making the final decision in this instance ran contrary to the process set out in the FIRAC Terms of Reference, and contrary to the OICs. The OICs are clear, where officials are unable to determine whether the risk can be mitigated the matter must be referred to the Commissioner…” Accordingly, pursuant to section 1(2) of the OIC, NSIRA notes that this case should have been elevated to the Commissioner for determination.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

[**redacted**]

A number of assumptions characterize the justifications by the Assistant Commissioner to share the requested information.

[**redacted**]. However, this reasoning disregards [**redacted**]. It further dismisses the RCMP’s own reporting [**redacted**]. FIRAC’s record of decision which notes, [**redacted**]. The Assistant Commissioner accordingly disregards the possibility that [**redacted**].

In the alternative, the Assistant Commissioner relies on [**redacted**] but does not consider now the risk [**redacted**] may increase [**redacted**].

Secondly, the Assistant Commissioner’s reasoning relied on [**redacted**].

The Assistant Commissioner does not address FIRAC’s concerns for [**redacted**] the insufficiency of mitigation measures. Rather the Assistant Commissioner concludes [**redacted**] greater risk should the information not be shared – but does not explain why or how so? Nor does the Assistant Commissioner address FIRAC’s concerns regarding [**redacted**].

Additionally, the Assistant Commissioner’s decision considered and emphasized the importance of the relationship between the RCMP [**redacted**] While FIRAC expressed concern assurances would be respected. The Assistant Commissioner’s reasoning focuses on the importance of [**redacted**], that relationship [**redacted**].

As mentioned earlier, according to the RCMP:

“…while the ACA and OiC may not speak to external considerations, it does not prohibit strategic considerations as part of the totality of the analysis, rather than against the risk to the individual, including whether strategic partnerships may act as a mitigation measure. It is important to note that the ACA and OiC do not supersede our obligations under the RCMP Act.”

The RCMP further noted that: “…As such, any action or inaction could result in unwanted consequences, and to include them as a consideration to demonstrate due diligence, and that all aspects of an activity is considered is prudent. Strategic relationships, or more importantly, in this case, actions that jeopardize the strategic relationship, can lead to harm. The A/C clearly stated that.”

NSIRA notes that the assessment of mistreatment must be limited to whether the disclosure would result in a substantial risk of mistreatment to the individual and whether said risk may be mitigated. NSIRA strongly cautions against the use of additional considerations such as strategic relationships in the assessment of substantial risk.

It should be noted that the Assistant Commissioner did provide additional mitigation measures for consideration. However, those measures were all premised on [**redacted**]. The measures did not require that the assurances and the FIRAC suggested mitigation measures be adopted as a prerequisite to the information sharing.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Finally, in the case at hand the Assistant Commissioner responsible for approving the FIRAC recommendations was the same Assistant Commissioner supervising the business line of the case. In 2019 NSIRA recommended that “departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.” As discussed in paragraph 61 above, in 2021 the RCMP adjusted its FIRAC process such that there are co-chairs for the FIRAC. Adding an additional Chair (co-chairs) was to ensure that the Chair overseeing a specific FIRAC is not the one responsible for business line where the case originated. The case at hand demonstrates the need to emulate that structure at the senior level in order to maintain independent decision-making and ensure that the case focus is on the substantial risk of mistreatment to the individual rather than additional strategic considerations.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Global Affairs Canada

During the course of the review period from January 1, 2021, to December 31, 2021, six cases reported to having been referred to the Intelligence Policy and Programs Division (INPL) for further assessment. In the cases that were provided to NSIRA all were specific to Mission security, where Missions were dependent on local authorities to assist in situations where there was a potential threat to staff at the embassy or consulate. When asked about the low number of cases, GAC advised NSIRA that sharing personal identifying information with foreign entities was very rare in an ACA context.

Implementation of the ACA

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

On December 14, 2017, GAC was issued Ministerial Direction on Avoiding Complicity in Mistreatment by Foreign Entities (2017 MD). GAC had not received the Ministerial Direction on Information Sharing with Foreign entities (the 2011 MD) that was issued to a number of other departments.

The department manages a global network of over 175 missions in 110 countries, employing approximately 12,000 staff with an operating with a budget of over $7 billion.

When asked how the department operationalizes the Act, GAC referred to their outreach and training programs. GAC advised NSIRA that their training programs targeted specific staff to ensure awareness of and compliance with the ACA. The training outlines the roles and responsibilities regarding the ACA and Orders in Council requirements, and provides employees a definition of “substantial risk,” and points of contact at headquarters.

In 2021, NSIRA committed to further scrutinizing the processes regarding ACA triage and decision-making by reviewing both GAC and the RCMP. In the 2020 ACA review, NSIRA found that there were significant divergences in the evaluation of risk and required level of approvals across departments. In particular, NSIRA identified procedural gaps in GAC’s risk assessments that should have warranted escalation to the Deputy Minister.

When asked if GAC had initiated any adjustments, or changes to frameworks or policies as a result of the findings and recommendations from previous reviews of the ACA, GAC advised that adjustments had been made to the framework by creating a Mistreatment Risk Assessment form. They explained that the form would support the application of a more consistent threshold for elevating a case in the decision-making process, and would standardize how cases are documented. As of August 31, 2022, GAC has yet to implement the use of this form.

Currently, the Head of Mission (HoM, or Chargé) makes the initial assessment in determining if the risk of mistreatment to the individual may be mitigated below the substantial risk threshold. Only where the HoM identifies a concern as to the sufficiency of the mitigation measures or assessment, would the HoM seek guidance through the Intelligence Policy and Programs Division (INPL) generic e-mail.

INPL can assist the Mission in conducting a risk assessment. If at this point it is determined there is a substantial risk of mistreatment that cannot be mitigated and the Mission still wants to proceed, the responsible geographic Director General may request that the Avoiding Mistreatment Compliance Committee (AMCC) be convened. The AMCC provides a decision to the HoM. GAC has advised that the role of the AMCC:

….is to recommend risk-mitigation strategies, seek escalatory senior-level discussion and approval for decisions as required, up to and including the Deputy Minister of Foreign Affairs, and document how each case is managed. It is convened on an ad hoc basis to review the proposed disclosure, request, or use of information in cases in which prohibitions under the Directions may be engaged. The Committee is similar to structures that exist within other departments and agencies subject to the OiC.

In 2020 and 2021, GAC initiated a review of the Secretariat of the AMCC, formerly known as the Ministerial Direction Compliance Committee (MDCC). GAC has advised that notional recommendations have been developed to improve the working methods of the Committee and update the terms of reference. Explaining that the timeliness of Committee decisions, addressing duty of care issues, and final reporting of case outcomes regarding Committee decisions are currently being examined. It is expected that the AMCC Secretariat’s review will be completed in 2022 and the terms of reference updated shortly thereafter.

In the six cases provided over the review period, NSIRA observed that the final decision on whether to share information with local authorities was left to the HoM. This is best illustrated in the HANOI case where the mission was advised

To note, decision-making authority on such situations ultimately rests with mission/geo. INPL’s role—as departmental focal point for the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA)—is simply to advise on relevant considerations, not authorize.

In further correspondence between INPL and the Mission in Hanoi there appears to be the need for additional clarification on the decision-making roles in regards to applying the ACA. INPL further advised the Mission that “it is in fact the Mission’s responsibility to determine if there is a substantial risk of mistreatment or not.

The centralization of accountability with the HoM as opposed to headquarters represents a significant change in implementation since NSIRA’s in-depth review of GAC in 2019. Namely, in the previous review any cases where there was a potential substantial risk of mistreatment would require escalation MDCC (via the INPL) where the Committee would ultimately be responsible for deterring if the proposed mitigation measures are sufficient and if the information sharing should take place. This change in implementation threatens the independence of the process from individuals with a potential operational interest in the outcome of the information sharing.

Recommendation 5: NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Information Sharing Framework

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

GAC does not have any information-sharing arrangements with foreign entities related to the ACA. When asked in last year’s review how GAC monitors its information exchanges, the response provided reads as follows:

There is a handful of divisions at GAC that receive information that may have been obtained through mistreatment. Because of the very different type of information they each receive due to their specific mandates, each has a different process/framework for identifying information likely to have been obtained through the mistreatment. Therefore, there is not one unified set of processes at GAC for initially marking/identifying incoming information potentially derived from mistreatment.

GAC has also not conducted an internal mapping exercise to determine which business lines are subject to the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

When asked to elaborate on the nature of information exchanges triggering the ACA, GAC further clarified:

[T]hat information exchanges occur without formal arrangement with foreign entities, and the vast majority of the information that is exchanged does not pertain to individuals. Each information exchange situation is unique and occurs within a specific relational and country context.

Each instance of information sharing is handled on a case-by-case basis and escalated to the appropriate level based on the individual circumstances.

It is important to note that if the assessment determines that there is NOT a substantial risk of mistreatment, but that the exchange of information directly or indirectly involves personally identifiable information about an individual AND the country or foreign entities is not a trusted partner when it comes to human rights, GAC employees must still capture via a risk assessment form the reason why there is NOT a substantial risk of mistreatment and keep a thorough record.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

When determining whether there is a risk of mistreatment, GAC employees will leverage human rights reports, as well as any intelligence relevant to the country/entity associated with the information. The risk profile of the individual about whom information is shared is also taken into consideration when making a determination regarding whether a substantial risk of mistreatment exists. It is a collection of information that informs any assessment and respective decision, rather than a single tool.

Training is only mandatory for employees working in a high-risk mission or functions and offered as a suggestion for other staff at mission and headquarters. GAC has committed to establishing a dedicated ACA page on the intranet, along with supporting communication, however, employees are only encouraged to review it.

GAC provides an outreach program and training, for staff both at headquarters and at missions abroad on their ACA obligations. The ACA components are embedded in GAC’s Governance, Accreditation, Technical Security and Espionage (GATE) awareness program, the Legal and Policy Framework on Information Sharing, and a module in the Heads of Mission pre-posting training. These training courses outline the roles and responsibilities of officials regarding their ACA and Orders in Council obligations, including the definition of “substantial risk”, and key points of contact at headquarters. It is important to note that the GATE awareness program and that the ACA segment of the training is considered as an outreach tool and not a core training module, meant to provide situational awareness for Canadian- based staff on information security and intelligence topics. The training provided by the Department of Justice acts as the core training module for staff.

When asked about Consular Operations bureau training, GAC appeared to have only a cursory knowledge citing that they were aware from the 2021 Annual Report (on the Application of the Orders in Council Directions for Avoiding Complicity in Mistreatment by Foreign Entities) that ACA directions were included as part of the training session offered by the Consular Operations bureau.

The target employees for training at headquarters are outgoing Mission Security Officers, Management Consular Officers, Readiness Program Managers, Global Security Reporting Program Officers and Heads of Mission, as well as all members of the Intelligence Bureau. At mission, the training is provided to all Canada-based staff, including other government departments’ employees posted at missions. GAC has only recently begun tracking the number of staff that have been provided ACA training, and estimates that at least 300 GAC employees have been provided ACA-related training since 2020.

When further queried about the breakdowns of training provided, GAC posited that there are only a small proportion of GAC officers abroad that may encounter ACA-related decisions. With training only mandatory for some staff, NSIRA is concerned that given the volume of information exchanges, and the multiplicity of business lines there is very well potential that information sharing may be occurring, or not properly triggered by those without proper ACA knowledge.

In light of the fact that GAC engages with foreign entities with poor human rights records and operates in highly volatile environments, NSIRA expresses deep concern that GAC has not demonstrated that it has implemented ACA framework across business lines.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Human Rights Reporting

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

GAC develops classified human rights reports making them available to a number of internal Government of Canada partners. These reports are intended to provide an overview of the human rights situation of a particular country. They help inform Canada’s international engagement and programming decisions, including foreign policy, development, trade, security, and consular activities. Updated human rights reports (post 2019) include a designated section that addresses the Orders in Council and the ACA, and the circumstances of mistreatment within that country.

The coming into force of the ACA and the issuance of the Orders in Council resulted in a greater number of departments being subject to directions specific to the avoidance of mistreatment by foreign entities. Many of these departments did not have frameworks or any country assessments to support this obligation. This created an increased demand for the GAC Human Rights Reports.

Prior to Royal Assent of the ACA, GAC provided human rights reports to departments that were subject to the 2017 Ministerial Directives. GAC also works with partners to incorporate feedback on human rights reporting and considers input on countries of interest for subsequent reporting cycles. It is important to note that GAC does not keep statistics on how often, or which reports were requested/accessed by internal partners.

NSIRA recognizes that in 2021 GAC has recently implemented a prioritized list to update the human rights reports and has been making considerable headway during the review period, updating 25 percent of their profiles. A number of high-risk countries have been updated to reflect current events. Still, a number of reports are outdated and close to 60 percent of the 133 human rights reports have not been updated since 2019. For example, Pakistan, Somalia, Ukraine, and Yemen have not been updated since 2019, while South Africa and Belarus have not been reviewed since 2015.

Maintaining up-to-date reports will help ensure that critical human rights information is being used when making ACA determinations, this is especially vital considering that other department leverage GAC’s human rights report as part of their risk assessments. NSIRA notes that the Information Sharing Coordination Group coordinated by Public Safety Canada continues to work through the prioritization and the issues associated with the sharing of human rights reports across departments. It should be stressed that the GAC human rights reports are viewed as a supplement to what departments have already collected as part of their own assessments. For this reason GAC does not provide evaluative judgment on risk within their human rights reports, that is they do not designate whether a country or entity is high or low risk, consequently leaving departments to assess risk based on the information they have collected as part of their mandates.

NSIRA has been advised that the GAC country priority list was developed in consultation with partner departments and agencies, and relevant GAC divisions. And is based on an assessment of the operational needs of Canadian federal departments and agencies. While understanding the impact the pandemic had on operations, particularly at Missions abroad, NSIRA encourages GAC to develop, maintain, and continue to work with other departments and agencies to ensure countries’ HRRs are updated as regularly as possible.

Development of Human Rights Reports

GAC produces human rights reports in collaboration with its missions. Coordinated by GAC’s office of Human Rights, Freedoms and Inclusion directorate, the reports are used not only to inform risk assessments, but assist in the guidance of policy and programming decisions.

Missions are responsible for updating their human rights reports, and, if tasked, are linked to Head of Mission’s performance measurement agreements. Mission staff work collaboratively with geographic branches in the preparation of the reports. While headquarters is responsible for the tasking and coordination of the reports, it is Head of Mission that approves the report. The reports include information on the overall human rights context in the country, as well as an analysis of the significant human rights-related events that took place during the review period. Generally, reports are a collection of various sources, which include open source reporting, consultations with human rights organizations and civil society partners, and engagement with government authorities and stakeholders.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Assurances

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

GAC advised that there was no standardized approach in place to assess the reliability or document assurances received from foreign entities. Risk assessments are conducted on a case-by-case basis. When asked how assurances were developed, GAC stated that there was no statutory or regulatory language that specifically addressed the use of diplomatic assurances, but officials implicated in individual cases would consider the foreign entity’s credibility, recent precedents, the experiences of like-minded partners, and the feasibility of monitoring assurances and caveats to be communicated with the disclosure. It is the Mission’s responsibility to track and monitor whether assurances and caveats are being respected

NSIRA noted that on the ATHENS case provided by GAC, there was a concerted effort to ensure assurances and caveats were in place before information was shared with local authorities. It is in NSIRA’s opinion that the mission was attuned to their obligations under the Act (and directions) and tried to ensure the welfare of the individual detained by authorities. [**redacted**] Mission staff took remedial action to ensure that the individual is not at risk of mistreatment.

In the ATHENS case, [**redacted**]. NSIRA noted that there is no formalized tracking, or documentation mechanism for the follow-up caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix I: Findings and Recommendations

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework and supporting policies and procedures are still under development.

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment is a best practice.

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated”.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Recommendation 5 : NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix II: ACA Framework and Background

It is important to note how the legal frameworks have evolved over the past decade. In international law Canada is a state party to a number of international instruments including the International Covenant on Civil and Political Rights (ICCPR), and the Convention Against Torture and Other Cruel, Inhumane or Degrading Treatment or Punishment (CAT). Many of the prohibitions on mistreatment, in these conventions are now considered customary international law. These international commitments have been implemented in Canadian domestic law; most notably the prohibition on torture is clearly defined and codified in the Criminal Code under section 269.1.

In 2010, the Canadian Government implemented a general framework for “Addressing the Risks of Mistreatment in Information Sharing with Foreign Entities”. This was the first multidepartment instruction given by the government regarding the issue of information sharing and mistreatment.

The framework was followed by two detailed Ministerial Directions to departments in 2011 and 2017. The 2017 MD was issued to seven departments and created prohibitions on the sharing of information that may lead to a substantial risk of mistreatment that cannot be mitigated. The MD also provided clear parameters on the use of information potentially derived from mistreatment. Additionally, the MD broadened the scope of applicability to all information sharing with foreign entities and not just that pertaining to national security issues.

On July 12, 2019, the Avoiding Complicity in Mistreatment by Foreign Entities Act came into force. The Act codifies and enshrines Canada’s commitment to respect the Charter of Rights and Freedoms, and the international agreements prohibiting torture and other cruel, inhuman or degrading treatment or punishment that it is party to. A primary objective of enshrining these principles through statute rather than the previous use of Ministerial Directions was to ensure that Canada’s commitment to these principles does not rest with the Minister or Government in power. The ACA provides the statutory authority for the Governor in Council (GiC) to issue directions through Orders in Council. The Act imposes an obligation on the GiC to issue Orders in Council to at least seven specific departments. In September 2019, there were in total 12 Orders in Council issued to departments and agencies engaged in information sharing with foreign entities.

The Orders in Council prohibits the disclosure of information to any foreign entity where said disclosure would result in a substantial risk of mistreatment of an individual and prohibits the making of any requests to any foreign agency for information that would result in a substantial risk of mistreatment of any individual. Additionally, the issued Orders in Council places parameters on the use of information likely derived from mistreatment of an individual by barring its use where it may create a substantial risk of further mistreatment, as evidence in any judicial, administrative or other proceeding, or in any way that deprives someone of their rights and freedoms (unless determined by the deputy head that it is necessary to prevent loss of life or significant personal injury).

Ministerial Direction (2011)

  • Issued to CSIS, CSE, CBSA and RCMP;
  • DND developed similar internal instruction; but was not issued as a ministerial direction (functional directive); and,
  • Main criticism was that departments were permitted to weigh the value of the information against the risk of mistreatment

Ministerial Direction (2017)

  • Addition of GAC, and DND (to CSIS, CSE, RCMP, CBSA);
  • A number of changes, most significant were prohibitions of the disclosure and requesting of information, as well as new limits on the use of information (derived from mistreatment);
  • Requirement for departments to maintain policies and procedures to assess risks; and,
  • Inter-agency co-operation requirement

OiCs issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (2019)

  • Issued to twelve departments, six of which had never before received formal direction regarding information sharing with foreign entities (PS, FINTRAC, TC, IRCC, CRA and DFO); and,
  • Codified many provisions of the 2017 MD

As noted in the introduction, the legal framework governing the sharing of information with foreign entities applies to information pertaining to all individuals, regardless of whether they are detainees or not. There is currently no government-wide implementation policy for the ACA. However, the issued Orders in Council do provide guidance on the requisite threshold for information sharing and the requisite hierarchy of approval where there is uncertainty as to whether mitigation measures may sufficiently diminish the substantial risk of mistreatment. Public Safety Canada in 2018, set up an Information Sharing Coordination Group with the objective of sharing best practices between departments.

Individual departments develop their own internal framework and policies for the implementation of the ACA. Some departments that were previously subject to the MDs on Avoiding Complicity in Mistreatment by Foreign Entities had a greater opportunity to create internal processes, procedures and policies to identify when information sharing practices may create a substantial risk of mistreatment. These departments have developed structured approaches to recording assurances (verbal or written) received from the foreign entities whom they engage and possible mitigation strategies such that the threat is diffused below the substantial risk of mistreatment threshold.

Appendix III: Previous Recommendations

Past findings and recommendations
Report for Year 2018 Report for Year 2019 Report for Year 2020
Finding #1: Benefits of internal information sharing process reviews. NSIRA noted that periodic internal reviews of information sharing policies and processes supported their successful functioning in the long term. Finding #1: NSIRA found that several departments, new to the considerations of the Act, described considerable progress being made during the review period and afterwards to build out formalized frameworks to support implementation. Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.
Recommendation #1: Departments should conduct periodic internal reviews of their policies and processes for sharing information with foreign entities in order to identify gaps and areas in need of improvement. Finding #2: NSIRA found that departments conducting minimal information exchanges with foreign entities have not yet fully addressed the importance of having an official information sharing framework in place. Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.
Findings #2: Departments vary with respect to the independence of their decision-making. NSIRA examined the extent to which high-risk decision-making is removed from operational personnel who may have vested interest in the sharing. In some departments, the decision-makers have a direct operational interest in the sharing of information, creating the potential for conflict between operational imperatives and departmental obligations to respect the MD. In particular, NSIRA noted that:
  • CSE and the RCMP have the most independent processes.
  • The information sharing process implemented by GAC to date remove high-risk decision-making from “front line” personnel.
  • At CSIS and DND/CAF, decision makers typically have a direct operational interest in the sharing of information.
  • CBSA has not yet operationalized its information sharing processes.
Recommendation #1: NSIRA recommends that all departments in receipt of directions under the Act have official framework that ensure they can fully support the implementation of the directions. Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.
Recommendation #2: Departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested the outcome. Finding #3: NSIRA found that the differences and variability in departmental frameworks demonstrate a previous lack of coordination across the community and a need to identify best practices. Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.
Finding #3: Lack of standardized information sharing risk assessments. Under the 2017 MD, GAC, CSIS, CSE, and the RCMP all maintain their own sets of foreign country and/or entity profiles, while DND/CAF is currently developing its own as well. The existence of multiple different assessments is duplicative and unnecessary. It may also yield inconsistencies, as departments have at times come to quite different conclusions about foreign countries’ and entities’ human rights records and the associated risks of information sharing. Recommendation #2: NSIRA recommends that departments coordinate to identify best practices for all essential components of information sharing frameworks and that ISCG is leveraged to ensure these practices are shared where possible across the community to support the implementation of the Act.
Recommendation #3: Departments should develop:
  • Unified set of assessments of the human rights situation in foreign countries including a standardized ‘risk of mistreatment’ classification level for each country; and
  • To the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.
Finding #4: NSIRA found that there are inconsistencies in the application of existing sharing frameworks between departments, specifically concerning information evaluation thresholds, and decisions being elevated for senior level determinations.
Finding #4: The concept of “substantial risk” of mistreatment is not defined. Like the 2017 MD, the ACMFEA and its associated direction prohibit information sharing that would result in a “substantial risk” of mistreatment, Neither the ACMFEA nor its direction include a definition of substantial risk, however, despite the centrality of this concept to the regime. A definition of substantial risk existed in both the 2011 and 2017 MD; its absence now raises concerns about its interpretation in the future. Recommendation #3: NSIRA recommends that departments establish consistent thresholds for triggers in their information sharing frameworks, including initial evaluations against the concerns of the Act, when a case is to be elevated in the decision process, and how this is documented.
Recommendation #4: The definition of “substantial risk” should be codified in law or public direction. Finding #5: NSIRA found a lack of unification and standardization in the country and entity assessments being leveraged by departments, resulting in inconsistencies in approach/stance by the community when interacting with Foreign Entities of concern related to the Act.
Recommendation #4: NSIRA recommends that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the Act.

Annex A: Departmental Frameworks

Royal Canadian Mounted Police

Following receipt of the 2017 MD, the RCMP established a new Law Enforcement Assessment Group (LEAG). LEAG has a detailed Terms of Reference that outlines its membership as well as roles and responsibilities. LEAG’s primary task is to assess foreign countries and law enforcement entities with regard to the risk of mistreatment. In its assessments, LEAG considers a number of factors, including the human rights record of the country, specific foreign entities’ engagement in human rights abuses, local law enforcement’s history of respecting caveats, as well as country-specific risks to individual safety related to political views, religion, ethnicity, sexual orientation, and so on. LEAG thus “plays an integral role in informing FIRAC’s decision on whether to share information with foreign law enforcement entities.”

At present, the RCMP has categorized 146 approved country profiles, of which 20 are high risk, 69 are medium risk, and 57 are low risk. 51 country assessments remain outstanding. LEAG currently intends to update its profiles every two years, although LEAG will update some reports more frequently based on operational requirements. To date, 40 countries have been assessed as being a high priority for periodic updates due to the volume of information sharing conducted.

Graphic of FIRAC Process

Process

If an RCMP officer identified a need and wishes to share information with a foreign entity, they must follow a set process:

The officer must first consult a specific RCMP intranet website created by LEAG. The site lists countries by colour. If the officer finds that the country in question is “green”, he or she may proceed to share the information. If the country is “red”- or “yellow” and the circumstances of the proposed sharing match any of the case-specific factors and considerations listed- then the case must be referred to FIRAC. If a FIRAC is required, the officer completes a standard form which must be approved by the relevant Criminal Operations (CROPS) Officer or other approving officer. The form includes a summary of the information to be shared, the kind of sharing (request, disclosure or use), the operational context, the risks of sharing information, the investigative value of the information, possible mitigation strategies, and- where applicable- the actual information to be disclosed or used.

Once approved, the form is sent to the Director General (DG) responsible for the relevant program at RCMP headquarters for approval. Following approval, the DG submits the form to the FIRAC secretariat.

The FIRAC secretariat compiles a briefing package that includes the officer’s form, the country profile from LEAG, and any supporting documentation submitted by the DG. The briefing package is distributed to FIRAC members ahead of the meeting.

A FIRAC meeting is convened and the request is considered along with possible mitigation strategies. While the final decision regarding FIRAC’s recommendation rests with the Chair, in the vast majority of cases the decision is unanimous. Dissenting opinions are recorded in the Record of Decision (RoD). Once FIRAC has noted its recommendation, the RoD and an accompanying briefing note are sent to the Assistant Commissioner for final determination.

In cases where FIRAC cannot determine whether a substantial risk of mistreatment can be mitigated, the responsible Assistant Commissioner will provide the RoD to the Deputy Commissioner in order to obtain the Commissioner’s decision.

Global Affairs Canada

Framework Updates

Global Affairs Canada (GAC) indicated that no changes to their framework was made during the current review period.

Annex I: Global Affairs Canada Framework

Process

Triage

There is not one unified set of processes at GAC for determining whether information being used by the department is likely to have been obtained through the mistreatment of an individual by a foreign entity. If an official determines that information that he or she has received is likely to have been obtained through the mistreatment of an individual by a foreign entity and that official still wants to use the information, they are instructed in their training to consult with their Program management at HQ. Should that manager be unable to make a determination on their own as to whether the use would comply with the Act, they will consult the relevant departmental policy group and the department’s Legal Services Unit.

Senior Management Committees

The Avoiding Mistreatment Compliance Committee (AMCC) meetings focuses on the following:

  • Has the information, the use of which is being sought, likely been derived from mistreatment?
  • What are the proposed measures to mitigate the risks? What is the likelihood of their success?
  • Consider the justifications for and proportionality of any potential involvement with the foreign state or entity that may result in mistreatment.

The AMCC Secretariat will create a record of decision and circulate it for comment by AMCC members. Once finalized, it will be kept by the Secretariat for future reporting. The AMCC Secretariat follows up with the requesting official for updates on the outcome of the situation and requests a final update from the requesting official once the situation is resolved.

Global Affairs Canada’s human rights reports provide an evidence-based overview of the human rights situation in a particular country, including significant human rights-related events, trends and developments and include a section focused on mistreatment. There are no scores for countries however, and it is up to the officials to assess the risk based on the information in the reports.

Mitigation Measures

The Legal Services Unit and/or Intelligence Policy and Programs division will provide guidance on the limitations and the prohibitions of the use of information obtained through mistreatment. They are also able to propose potential mitigation measures, such as sanitization of the information, if there is a risk of further mistreatment; of depriving someone of their rights or freedoms; or if the information could be used as evidence in any judicial, administrative or other proceeding.

Share this page
Date Modified:

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: Minister of Foreign Affairs Responses

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021


Responses

Date of Publishing:

Share this page
Date Modified:

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: Report

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021


Report

Date of Publishing:

List of Acronyms

Abbreviation Expansion
2017 MD 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities
ACA (ACMFEA, or “the Act”) Avoiding Complicity in Mistreatment by Foreign Entities Act
ADM Assistant Deputy Minister
AMCC Avoiding Mistreatment Compliance Committee
CBSA Canada Border Services Agency
CRA Canada Revenue Agency
CRCC Civilian Review and Complaints Commission for the RCMP
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DFO Department of Fisheries and Oceans
DND/CAF Department of National Defence / Canadian Armed Forces
EPPP Enhanced Passenger Protect Program
FINTRAC Financial Transactions and Reports Analysis Centre of Canada
FIRAC Foreign Information Risk Advisory Committee
FPNS Federal Policing National Security
GAC Global Affairs Canada
GATE Governance, Accreditation, Technical Security and Espionage
HOM Head of Mission (or Chargé)
HRR Human Right Report
ICCPR International Covenant on Civil and Political Rights
ICE Integrated Collaborative Environment
INPL Intelligence Policy and Programs Division
IRCC Immigration, Refugees and Citizenship Canada
ISCG Information Sharing Coordination Group
LEAG Law Enforcement Assessment Group
LO Liaison Officer
MDCC Ministerial Direction Compliance Committee
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security Intelligence Review Agency
OiC Orders in Council
PPP Passenger Protect Program
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RFI Requests for Information
TC Transport Canada
Abréviation Développement
AL Agent de liaison
AMC Affaires mondiales Canada
ARC Agence du revenu du Canada
ASFC Agence des services frontaliers du Canada
CANAFE Centre d’analyse des opérations et déclarations financières du Canada
CCDM Comité de conformité à la directive ministérielle
CCEMT Comité de conformité pour éviter les mauvais traitement
CCETP Commission civile d’examen et de traitement des plaintes relatives à la GRC
CCRIE Comité consultatif sur les risques – Information de l’étranger
CDM Chef de mission (ou chargé de mission)
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CST Centre de la sécurité des télécommunications
DC Décret en conseil
DI Demande d’information
ECI Environnement collaboratif intégré
GASE Gouvernance, accréditation, sécurité technique et espionnage
GCER Groupe de coordination d’échange de renseignements
GEAL Groupe d’évaluation de l’application de la loi
GRC Gendarmerie royale du Canada
IM-2017 Instructions du ministre de 2017 visant à éviter la complicité dans les cas de mauvais traitements par des entités étrangères
INPL Direction des politiques et des programmes liés au renseignement
IRCC Immigration, Réfugiés et Citoyenneté Canada
Loi visant à éviter la complicité, la Loi Loi visant à éviter la complicité dans les cas de mauvais traitements infligés par des entités étrangères
MDN/FAC Ministère de la Défense nationale/Forces armées canadiennes
MPO Ministère des Pêches et des Océans
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PIDCP Pacte international relatif aux droits civils et politiques
PPP Programme de protection des passagers
PPP-A Programme de protection des passagers amélioré
RDP Rapport sur les droits de la personne
SCRS Service canadien du renseignement de sécurité
SMA Sous-ministre adjoint
SNPF Sécurité nationale et Police fédérale
SP Sécurité publique Canada
TC Transports Canada

Executive Summary

This review focuses on departmental implementation of directions received through the Orders in Council (OiC) issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”). This is NSIRA’s third annual assessment of the statutorily mandated implementation of the directions issued under the ACA.

This year’s review covers the 2021 calendar year and has been split into three sections. First, the review addresses the statutory obligations of all departments. Sections two and three of the review focus on in-depth analysis of how the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC) have implemented the directions under the ACA. NSIRA has used case studies, where possible, to examine these departments’ implementation of the ACA framework.

NSIRA has observed that this is the third consecutive year where there have been no cases referred to the deputy head level in any department. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Future reviews will be attuned to the issue of case escalation and departmental processes for decision-making.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

In last year’s review NSIRA identified Canada Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies. While CBSA and PS continue to make advancements these departments still have not fully implemented an ACA framework and supporting policies and procedures.

RCMP has a robust framework in place for the triage and processing of cases pertaining to the ACA. The in-depth analysis portion of this review found that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances. NSIRA also found that the RCMP has not developed mechanisms to update country and entity profiles in a timely manner, and the information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In the analysis of one of the RCMP’s Foreign Information Risk Advisory Committee (FIRAC) case files, NSIRA found that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments. The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested.

NSIRA found that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA. This is a marked change from the findings of the 2019 review that found decision-making was done at the Ministerial Direction Compliance Committee (MDCC) at Headquarters.

GAC has also not conducted an internal mapping exercise to determine which business lines are most likely to be implicated by the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

NSIRA also notes that GAC has no formalized tracking, or documentation mechanism for the follow-up of caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

During the review, GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC has provided NSIRA with all documents requested within a reasonable time frame.

This review assessed departments’ implementation of the directives received under the ACA and their operationalization of frameworks to address ACA requirements. As such, this review constitutes the first in-depth examination of the ACA within individual departments.

Authorities

This review is being conducted under the authority of paragraph 8(2.2) of the National Security Intelligence Review Agency Act (NSIRA Act), which requires National Security Intelligence Review Agency (NSIRA) to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”).

Introduction

This review will focus on departmental implementation of directions received through the Orders in Council issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act. The overarching objective of this review is to assess whether departments are meeting their obligations under the ACA and associated directions. NSIRA is mandated to conduct this review on an annual basis.

Background

Many departments and agencies in the Government of Canada routinely share information with foreign entities. Given that information sharing with entities in certain countries can result in a risk of mistreatment of individuals, it is incumbent upon the Government of Canada to evaluate and mitigate the risks that such sharing creates. This is particularly the case for information sharing related to national security and intelligence, where information often relates to alleged participation in terrorism or other criminal activity.

The 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities (2017 MD), defined the substantial risk of mistreatment as:

[A] personal, present and foreseeable risk of mistreatment. In order to be ‘substantial’, the risk must be real and must be based on something more than mere theory or speculation. In most cases, the test for substantial risk of mistreatment will be satisfied when it is more likely than not that there will be mistreatment; however, in some cases particularly where there is a risk of severe harm, the ‘substantial risk’ standard may be satisfied at a lower level of probability.

This review will be NSIRA’s third annual assessment of the implementation of the directions issued under the ACA. This review will build on the previous reviews conducted in respect of avoiding complicity in mistreatment. The first review was in respect to the 2017 MD. The second review assessed the directions issued under the ACA, but was limited to the four months from when the directions were issued to the end of the 2019 calendar year. The third review was NSIRA’s first full year assessment of the implementation of the directions issued under the ACA for the 2020 calendar year.

NSIRA has focused on conducting in-depth reviews of how departments implement the directions under the ACA. This approach builds on the foundational knowledge obtained over the last three years and reviews how departments operationalize the directions under the ACA by using case studies to assess departments ACA frameworks in practice.

The review, covering the 2021 calendar year has been split into three sections. The first section addresses NSIRA’s statutory obligations covering a full year review of all departments. This year NSIRA conducted an in-depth review of two departments: the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC), sections two and three respectively.

Methodology

Subsection 7(1) of the ACA imposes a statutory obligation on the deputy head to whom directions were issued to submit a report to the Minister regarding the implementation of those directions during the previous calendar year and publish a public copy of the report. The Minister must then provide the classified copy to NSIRA.

The obligations for departments noted above are mirrored in the NSIRA Act. Under subsection 8(2.2) of the NSIRA Act, NSIRA must, each calendar year, review the implementation of all directions issued under the ACA. Additionally, NSIRA has the statutory right to review the implementation beyond the specific requirements of the ACA, namely through its mandate to review any activity carried out by a department that relates to national security or intelligence.

The issued Orders in Council (OiC) include a reporting requirement, whereby decisions necessitating referral to the deputy head for determination must be reported to the Minister and subsequently the review bodies. This requirement creates additional accountability for decisions undertaken by departments and allows NSIRA to be informed of any potential issues outside of the annual reporting cycle.

This review encompasses the implementation of the directions for the 12 departments that were in receipt of the OiC pursuant to the ACA. The review period is January 1, 2021, to December 31, 2021. Additionally, NSIRA has selected two departments for more in-depth case study review: GAC and the RCMP. NSIRA will ensure that additional departments are selected for case study analysis in future years.

In completing this review, NSIRA considered legal authorities and governance frameworks. NSIRA also relied on documentation and information obtained through briefings with the departments.

Verification of Information and Responsiveness

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments.

The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. NSIRA found that overall, its expectation for responsiveness by the RCMP during this review were met.

GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested. NSIRA found that overall, its expectation for responsiveness by GAC during this review were met.

All Departments

Framework Updates and Reporting

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework, and supporting policies and procedures are still under development.

Based on submissions to NSIRA, ten departments have established frameworks and policies addressing whether the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual. The submissions provided to NSIRA by Canada Revenue Agency (CRA), Department of National Defence / Canadian Armed Forces (DND/CAF), and Transport Canada (TC) indicate that they are actively working on refining existing policies and frameworks. NSIRA, in last year’s report identified Canadian Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies.

Frameworks

CBSA advised that it has provisionally approved a framework for deciding whether a request for information from a foreign entity would result in a substantial risk of mistreatment of an individual. CBSA advised NSIRA that it issued direction to conduct an internal review with the goal of confirming the feasibility of operational implementation across multiple program areas.

PS has advised that a full suite of risk assessments are under development and that it intends to conduct information sessions to ensure other program areas not directly affected by the ACA are aware of information sharing obligations. PS also advised that the program area implicated by the Ministerial Directions (the Directions) has operationalized the policy and has ensured that their procedures and processes align with the requirements outlined in the departmental policy, Act and the Directions. These policies came into effect in January 2022, with “a few aspects” having not yet been finalized. The suite of risk assessments is still in development.

PS also intends to hold information sessions with various sections of the department that may not currently need to apply the Directions, but should nonetheless be aware of their existence should they develop new programs with an information sharing dimension.

In 2020, GAC initiated a full review of the Avoiding Mistreatment Compliance Committee (AMCC) as directed by its terms of reference. GAC has advised that notional recommendations have been developed to address the identified shortcomings. Recommendations include timeliness of Committee decisions, addressing duty of care issues, and reporting case outcomes regarding Committee decisions.

NSIRA has been advised that the AMCC’s secretariat review will be completed in 2022 and the terms of reference will be updated shortly after. In response to NSIRA’s inquires about risk analysis, GAC has advised that during the review period they created a new risk assessment form and are developing a broader orientation guide with the goal of supporting employees through the risk assessment and decision-making process. These issues are further explored in section two of this report.

RCMP has noted internal shortcomings in regards to country assessments and the inability to regularly update the reports. A framework has been provided to NSIRA on how the RCMP intends to remedy these shortcomings in the future to better serve the Foreign Information Risk Advisory Committee (FIRAC) process.

Reporting

Subsection 7(1) of the Act requires deputy heads to submit a report to the appropriate Minister on the implementation of directions received under the Orders in Council during the previous year. The ACA stipulates that report submissions are required before March 01 of each year.

All twelve departments have fulfilled their obligations to report to their respective ministers The Communications Security Establishment (CSE), and TC did, however, submit their reports shortly after the March 01 deadline.

Subsection 7(2) of the Act also requires deputy heads make an unclassified version of the report available to the public as soon as feasible after submission to the Minister. Reports were made available in all of the twelve departments.

Section 8 of the Act requires the Minister to provide a copy of the report to the National Security and Intelligence Committee of Parliamentarians (NSICoP), NSIRA and, if applicable, the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC).

The table below captures a summary of both the departmental responses to the implementation questions and NSIRA’s assessment regarding these responses. The assessment was based on the associated details provided by departments in the context of the specific information requested. If a specific requirement was not met, it has been flagged. The relatively few instances of these were connected with departments not meeting certain reporting obligations under the Act.

Summary Table 1.1 – Requirements under the Act
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
Cases referred to the deputy head? No No No No No No No No No No No No
Was a report submitted to the Minister? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Was the report made available to the public? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Did the Minister provide a copy to NSICoP, NSIRA, CRCC? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes

Case Triage and Escalation

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

All twelve departments indicated that they did not have any cases referred to the Deputy Head level for determination. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Therefore, all additional reporting requirements associated with this level of decision were not applicable.

Summary Table 1.2 – Cases Escalated, by Level of Approval
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
First Level. (Supervisor/Deputy Chief) 0 634 236 (23) 780) 0 Not Known/Not Tracked 48 6 2 401 55 0
Second Level (Manager/Chief) 0 325 176 (24) 243 0 Not Known/Not Tracked 48 6 2 401 55 0
Third Level(Director/DDG) 8(25) 69
Fourth Level (DG/Committee/ Working Group) 0 63 1 (26) 81 0 7 48 0 0 0 55 0
Fifth Level (ADM/A.Commis sioner/L1) 0 0 0 (27) 0 0 2 0 0 0 0 55 0
Sixth Level (Deputy Head) 0 0 0 0 0 0 0 0 0 0 0 0

NSIRA notes that this is the third consecutive year where there have been no cases referred to the deputy head level in any department.

Future reviews may be particularly attuned to the issue of case escalation and departmental processes for decision-making, as one of the stated objectives of NSIRA’s review of ACA obligations is to ensure that the assessment of risk is escalated to appropriate level of authority.

Implementation of Previous Recommendations

As part of this review, NSIRA requested information regarding the implementation of previous recommendations. The following analysis is based on responses received from departments.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

DND/CAF has advised NSIRA that as a result of its recommendation, the department has included the definition of “substantial risk” within the Chief of Defence Intelligence Functional Directive on DND/CAF Information Sharing Activities with Foreign Entities. However, it should be noted that DND/CAF has also adopted additional definitions including its definition of “foreseeable.” NSIRA has previously expressed its concerns in its 2019 detailed Annex of DND/CAF application of the MD regarding the DND/CAF interpretation of foreseeability. DND/CAF has also advised NSIRA that it leveraged the human rights assessment methodology from other organizations to develop the methodology for DND/CAF’s profiles. DND/CAF has also advised that it is actively participating with ACA-related interdepartmental working groups to share its country’s human rights methodology, procedures, and assessments, and raise concerns.

Of the twelve departments, CRA, CBSA, CSIS, DND/CAF, PS and TC have continued to adjust frameworks and policies as a result of the findings and recommendations from previous reviews of the ACA. While recommendations may not have been specific to individual departments, many have advised that they have taken into them into consideration and applied improvements more generally.

CRA for example in response to Recommendation #1 from NSIRA’s 2019 review (regarding the importance of conducting periodic internal reviews), has reviewed its exchanges of information procedures. As a result, CRA has implemented procedural changes where risk assessments deemed to be of low-risk are now approved at the manager level, whereas previously the minimum approval level was Director.

CBSA has provisionally approved its ACA policy and is currently conducting an additional review to ensure that the policy is operable across multiple program areas. CBSA has advised that the policy includes guidance on the disclosure of information, the request for information, and the use of information where there may be a substantial risk of mistreatment of an individual. As part of the policy, the CBSA has incorporated procedures and processes to assess risk and coordinate with its Senior Management Risk Assessment Committee.

PS has also finalized its draft policy in response to NSIRA’s 2020 ACA review finding that it did not finalize its policy frameworks in support of the Direction received under the ACA. PS has noted that a policy was approved and came into effect on January 1, 2022. NSIRA has been advised additional aspects of the policy are still being implemented, including the development of risk assessment tools.

Finally, TC has advised NSIRA that it has taken stock of feedback on the implementation of the ACA since initial promulgation of the Corporate Policy in August 2020. TC notes that its corporate policy is under revision and seeks to clarify and strengthen key elements. TC has advised that adjustments underway include refining language to further clarify roles, responsibilities program-level requirements, and timelines associated with implementation. To this end, TC is providing more guidance on reporting format and content requirements for program-level support to the annual reporting exercise.

At the program level, TC is reviewing the policy impact of changes (over the past year) to the functional structure and roles associated with the Passenger Protect Program (PPP). To date, the PPP is the only program activity that TC has identified where risks associated with the ACA may be present. The PPP is currently transitioning to an enhanced framework, which is expected to be fully implemented prior to March 2023.

NSIRA maintains its previous recommendation that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the ACA.

Royal Canadian Mounted Police

The ACA review for 2021 is NSIRA’s second full year assessment of the implementation of the Act. As discussed in the background to this review, NSIRA has complemented the knowledge gained through its annual review of the ACA with an in-depth analysis of the implementation of the Directions. The in-depth analysis highlights to departments some best practices within the Government of Canada as well as some potential issues in the adopted frameworks. This year, the RCMP and GAC were selected. As one of the “original” departments subject to the 2011 Ministerial Direction, the RCMP has had over a decade to develop, implement, and adjust its framework. GAC was selected because it was issued a Ministerial Directive in 2017 and due to its role as a primary developer of human rights reports.

Implementation of the ACA

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

In 2011, the RCMP was issued the Ministerial Direction on Information Sharing with Foreign Entities. However the issued MD only applied to information sharing in national security matters. In response to the 2011 MD, the RCMP created the Foreign Information Risk Analysis Committee (FIRAC), the Committee was renamed the Foreign Information Risk Advisory Committee following the issuance of the 2017 MD.

The 2017 MD’s scope was broadened to include all units and personnel of the RCMP, and FIRAC was expanded accordingly. The enactment of the ACA imposed the requirement of the Orders in Council directions to the Commissioner. The operational requirements between 2017 and 2019 remained the same. The RCMP’s Implementation of the ACA is composed of three key mechanisms, FIRAC, Law Enforcement Assessment Group (LEAG), and Annual Reporting.

FIRAC is an advisory body to senior management, tasked with providing RCMP personnel with a mechanism to review information exchanges where there may be a substantial risk of mistreatment. FIRAC is a central part of the determination making mechanism for cases with ACA considerations. The committee examines the operational context of each request, the application of risk-mitigation strategies, and the strength of assurances and makes recommendations to the responsible Assistant Commissioner.

It is important to note that the Terms of Reference for FIRAC were updated in December 2021, this is after the conclusion of the last FIRAC meeting on the case study discussed below. The previous Terms of Reference which were drafted following the issuance of the 2017 MD stated that “in case of information sharing where there is a clear operational need to proceed, but a substantial risk of mistreatment, the decision will be referred to the Commissioner for final approval, as per the MD and Operational policy”. The revised Terms of Reference identifies that the Assistant Commissioner, or Executive Director is responsible for deciding whether the substantial risk of mistreatment can be mitigated. The Terms of Reference now clearly stipulates that the Assistant Commissioner, or the Executive Director as the sole decision maker, and that FIRAC fulfills an advisory function. NSIRA cautions that this apparent or perceived delegation of the final decision to the Assistant Commissioner risks non-compliance with the purpose and object of the Act and the OiC.

The Committee is comprised of two rotating chairs and a number of members from various divisions within the RCMP. As a result of an internal review, the RCMP have adjusted membership of FIRAC to ensure that co-chairs were not making determinations on cases from their respective units, with the intention of removing situations where a real or apparent conflict of interest could arise.

FIRAC meets bi-monthly or on an as-needed basis when urgent, time sensitive cases arise. All recommendations made by the committee are non-binding. NSIRA has also observed that the addition of Committee members is planned for April 2022.

Over the last year, the RCMP have made efforts to improve their framework and have created tools to aid personnel in engaging with FIRAC. They have established a FIRAC Coordination Unit, which is responsible for conducting consultations with personnel in order to help triage potential cases and determine the appropriate level of FIRAC engagement. The RCMP have also developed a suite of tools outlining definitions and thresholds, mitigation strategies and FIRAC requirements.

The FIRAC Coordination Unit works with RCMP staff, and members to assist with the risk assessment process and determine if a FIRAC evaluation is required. The Coordination Unit’s roles and responsibilities have been adjusted with the stated goal of providing guidance and support to members to strengthen case submissions. The intent of the Unit is to improve upon record keeping, identify internal strategic level issues, engage with external federal partners on cross-cutting issues to enhance processes and practices, and to share outcomes of case-specific FIRAC meetings with LEAG to inform updates on foreign entity assessments.

The RCMP is also in the final stages of updating its operational manual with the goal of supporting the Direction’s consistent application across the RCMP. This update is intended to clarify roles and responsibilities, as well as thresholds and triggers that require an information exchange to be reviewed by FIRAC.

As will be addressed later in this report, the 2019 OiC includes a requirement for the case to be referred to the RCMP Commissioner for determination, where officials are unable to determine whether the risk of sharing information can be mitigated. Additionally, pursuant to section 3(1)c of the OiC, the RCMP Commissioner must report and disclose any information considered in making the determination or decision to NSIRA, the Civilian Review and Complaints Commission for the RCMP (CRCC), and the National Security and Intelligence Committee of Parliamentarians (NSICoP) in a timely manner, if certain information that was likely obtained through the mistreatment of an individual by a foreign entity was used, in order to prevent loss of life, or significant personal injury.

The LEAG is responsible for developing country assessment profiles and maintaining the Integrated Collaborative Environment portal, where the information is stored and accessed by officers as needed. NSIRA was informed that during the last few years, the LEAG team has been severely underfunded and under-resourced, resulting in country profiles that are out of date with a third of countries having no assessment report whatsoever.

An annual report detailing the implementation of the Act and any cases brought to the Commissioner for determination must be sent to the Minister of Public Safety, NSIRA, NSICoP and the CRCC. The RCMP must also disclose any information considered in the making of a determination or decision. For full description of the RCMP’s process please see Annex A: Departmental Frameworks.

The RCMP continues to improve upon FIRAC process. Recently, the RCMP has made strides to enhance products used to assess whether proposed information exchanges carry a substantial risk of mistreatment that require FIRAC assessments. These improvements include visual tools outlining the decision-making process, key definitions, mitigation strategies, and triggers for a FIRAC evaluation.

RCMP continues to make considerable progress on updating resources on the designated SharePoint site, the ACA training module, and policy in the RCMP operational manual. While these initiatives are still in progress, NSIRA commends the RCMP’s initiative in conducting an internal review of FIRAC, and making efforts to address identified shortcomings.

Information Sharing Framework and Risk Analysis

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment, is a best practice.

The RCMP’s information sharing framework as it relates to ACA is predicated on managing risk. While this is largely dependent on the use of assurances and caveats, investigators rely on the Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) assessment of the particular country or foreign entity in question. LOs/ADOs as part of their role, are expected to provide up-to-date information on current country and entity reports, relationships established with specific entities, and the RCMP’s history as it relates to information sharing and current human rights records. Investigators use this information to help inform a mitigation measure applied to a proposed information request, and/or disclosure.

In making assessments and providing recommendations to the Assistant Commissioner, FIRAC considers the specifics of the case included in the initial risk assessment (included in the FIRAC submission), the LEAG country assessment, as well as input from the Liaison Officers/Analysts Deployed Overseas (LO/ADO). A Record of Decision is completed after each meeting and highlights the history of sharing with the entities, the risks and mitigation measures discussed, and the final recommendation of the Committee. Based on the information provided in the Record of Decision and the recommendation of the committee, the Assistant Commissioner will then make a determination.

While the RCMP has not formalized a Gender Based Analysis within their ACA risk-related assessments, NSIRA notes that considerations applied in the RCMP’s country risk assessments identify vulnerable groups at risk of mistreatment under the “Human Rights Concerns for Specific Groups.” Individuals identified as at risk in a country/entity designated as medium risk would require a FIRAC assessment prior to any information exchanges.

NSIRA sampled twenty instances where FIRAC was convened. However, there were a number of cases where multiple FIRAC meetings pertained to the same case. For example, [**redacted**] which is examined in closer detail as part of the NSIRA’s sample file review, had three separate FIRAC meetings. The twenty FIRAC instances in the selected sample amount to sixteen individual cases. Requests made by NSIRA used the FIRAC nomenclature, and the RCMP fulfilled requests based on what was requested in the Requests for Information. The result was that NSIRA was only able to view case file information where the case was a touch point within the FIRAC process; the full operational case files were not provided.

NSIRA recognizes that the RCMP fulfilled its obligation when responding to our request for information. However, when it became clear that NSIRA had not obtained the entirety of the case, including the investigative file, significant time constraints prevented NSIRA from obtaining and considering the additional information in this review.

Outbound Information Sharing

NSIRA observed that in at least 35 percent of FIRAC cases sampled, the RCMP factored the potential for the negative impact of not sharing in their assessment. FIRAC’s assessment considers the risk of not sharing outbound information with a particular emphasis on maintaining, developing, or preserving a relationship with an information-sharing partner. Furthermore, the RCMP informed NSIRA that they will also consider the potential public risk to security of not sharing the information. NSIRA understands that the reliability of assurances and caveats depend crucially on the circumstances and the context of a particular case, but would strongly encourage the RCMP to base its rationale for sharing information primarily on the risk to the individual. NSIRA notes that the risk assessment and mitigating strategies (to minimize risk) are the primary tools to be used when assessing whether information is to be shared. The ACA and issued Orders in Council do not permit the weighing of external considerations such as relationship damage associated with not sharing information and public safety against the risk to the individual.

Mitigation and Assurance Measures

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

The RCMP advised NSIRA that any assurances or caveats that have or have not been adhered to in relation to information sharing with foreign entities are recorded within the investigative case file. The RCMP further explained that information is shared on a case-by- case basis by means of either the Liaison Officer responsible, or INTERPOL channels.

Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) are required to record their interaction in their notes which would be included within the operational investigative file. The RCMP has advised NSIRA these notes are where any violations of assurances or caveats would be recorded.

The RCMP explained that it relies on its overseas network to monitor the reliability of assurances and caveats, and that personnel meet regularly with law enforcement partners and foreign allied LOs. The RCMP further noted any indication of a deterioration in human rights within a country or specific report on mistreatment of an individual would be discussed and captured within the RCMP (operational) case file, and ultimately documented in the RCMP’s FIRAC risk assessment form.

As noted above, due to time constraints, NSIRA obtained information on FIRAC meetings and the supporting documents, and did not have an opportunity to review the RCMP’s operational case files. When NSIRA asked to provide rationales used to assess the reliability of assurances and caveats for the selected sample, NSIRA was referred back to the FIRAC risk assessment form (also known as Form 6517), and provided with the following:

The footnote highlights a number of case files. General and Supplementary reports on these files were reviewed in the preparation of this response. No concerns with respect to assurances were documented and only one instance with respect to caveats was identified. In this regard, [**redacted**] documents one instance wherein a partner agency had not adhered to a caveat’s requirement to coordinate actions – no allegation of mistreatment was documented on the file. The issue was raised with the partner agency and addressed.

NSIRA notes that while the [**redacted**] was in relation to a company operating in the [**redacted**], witness information was sought from the [**redacted**]. The LEAG Country Risk Assessment for [**redacted**], designated as medium risk, does cite an issue specific to the sharing of information and the use of caveats, but has not been updated since August 2018. The RCMP has advised that:

While the LEAG country assessment has not yet been updated, the LO would be expected to raise this issue in any future consultations with various investigative teams seeking to share with this entity.

NSIRA stresses the importance of the post-monitoring of assurances and caveats. NSIRA has observed that the issuance of an assurance, and/or caveat may sometimes rely on assurances provided by a specific official (within the foreign entity/country). Absent appropriate documentation, this may be problematic due to the fact that movement within positions is to be expected and assurances can no longer be valid if the individual has moved out of the position. Assurances must be followed up on and renewed to ensure they are being followed in the event of employee turnover.

Furthermore, there is no centralized process for the documentation of assurances. Rather, some documentation that is occasionally noted on specific investigative files may be problematic in situations where LOs/ADOs are rotational. If the investigative file is closed, the new LOs/ADOs to the post may not be aware of situations where assurances have not been respected.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Country and Entity Profiles

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In 2019, the RCMP conducted an internal review of its information sharing framework including LEAG and FIRAC. Based on this review, NSIRA recommended in 2019, that departments adopt internal reviews of their policies and processes as a best practice. While it is not the intention to cover items already identified in the (internal) review, NSIRA notes that three years have elapsed and the issues associated to country and entity assessments still remain.

Of the 90 assessments, the RCMP is currently using to base its risk assessments, 87 percent have not been updated since 2018, and the remaining thirteen percent have not been updated since 2019. Over the course of 2021, the RCMP did not update any of its country profiles. NSIRA has been advised that in 2022, [**redacted**] but cite funding constraints as a key challenge.

A key finding of the RCMP’s internal review relates composition of the profiles themselves, in that they: “do not sufficiently reflect the RCMP’s operational experience.” The review states that: “LEAG country and entity risk profiles are predominately based on open source information rather than input from operational units…” The RCMP through the course of the review emphasized the role and importance to the Liaison Officer during the FIRAC process, suggesting that the Liaison Officer is positioned to offset any shortcoming with the country and entity profiles. NSIRA notes the internal review highlights some of the challenges faced by the Liaison Officers, referring to the added responsibilities of the LEAG and the FIRAC processes as adversely affecting their ability to preform their regular duties.

NSIRA notes the RCMP’s ongoing efforts at improving its post-monitoring efforts. NSIRA looks forward to reviewing the progress made over the next year on the measures taken on updating the RCMP’s country profiles, and inclusion of post-monitoring of automating media monitoring and information sharing tracking mechanism with INTERPOL Ottawa.

Case Study: [**redacted**]

[**redacted**] the RCMP sought approval to interview a [**redacted**]

[**redacted**] The RCMP sought to [**redacted**] interview [**redacted**] in order to assess the current risk or threat [**redacted**] to Canada and Canadian citizens, [**redacted**]. The RCMP has advised that a “…successful interview could advance the investigation [**redacted**]and significantly improve the ability to identify the threat and risk [**redacted**] to [**redacted**] security.”

Additionally, the RCMP believed that “engagement with [**redacted**] may lead to [**redacted**] information and evidence [**redacted**].

[**redacted**]

The RCMP’s internal Country profile classifies [**redacted**] as a High-Risk Profile (RED). The profile notes serious documented allegations of human rights abuses [**redacted**] (but not limited to) torture [**redacted**] suspects routinely subjected to unfair trials. The RCMP had concerns that “If [**redacted**] could face torture and mistreatment [**redacted**]”. As per policy the case was escalated to the Foreign Information Risk Advisory Committee (FIRAC).

a) FIRAC [**redacted**]

[**redacted**], the FIRAC convened and discussed the request to interview [**redacted**] Committee found that there are substantial risks of mistreatment for [**redacted**] that there are currently no measures in place that could effectively mitigate the identified risks. FIRAC noted [**redacted**].

FIRAC did however also note, “that efforts should be made to better position possible future interviews.” They noted that [**redacted**] would “allow the RCMP to monitor the outcomes and assurances of discussions at a strategic level [**redacted**].

Accordingly, FIRAC recommended that the RCMP “engage in discussion [**redacted**] on the [**redacted**] potential for [**redacted**]. The Assistant Commissioner for [**redacted**] approved this recommendation.

Events of [**redacted**]

In response to the FIRAC recommendation, senior RCMP [**redacted**]

[**redacted**]

Based on [**redacted**] the investigative team sought FIRAC’s recommendation to allow [**redacted**] further discussions [**redacted**] in order to have the RCMP [**redacted**] interview with [**redacted**] and seek assurances [**redacted**].

[**redacted**]

[**redacted**], the FIRAC convened [**redacted**] to consider the request to engage and exchange information to [**redacted**] interview [**redacted**] to seek assurances [**redacted**]. The request was approved by FIRAC, if certain mitigation measures and assurances be received, [**redacted**].

Events of [**redacted**]

[**redacted**] RCMP [**redacted**] engaged the [**redacted**]. The RCMP [**redacted**] there is a [**redacted**] they would be interested in interviewing [**redacted**].

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

The RCMP [**redacted**] escalated the requests to interview [**redacted**] to FIRAC with additional mitigation measures.

[**redacted**]

[**redacted**]

FIRAC convened a meeting to discuss the request to share the personal information of [**redacted**].

The Committee concluded that there is a substantial risk of mistreatment [**redacted**] should the information be shared and that said risk cannot be mitigated by caveats and assurances. Accordingly, the Committee recommended that the information not be exchanged. This recommendation was based on the following concerns:

  • [**redacted**]
  • The existence of a significant risk of mistreatment that could not be mitigated [**redacted**].
  • Inability to guarantee [**redacted**]
  • Safety concerns based on information that may be derived from the interview;
  • [**redacted**]
  • [**redacted**]
  • Assurances were deemed insufficient to mitigate the risk, [**redacted**] to allow for an assessment of the confidence in the assurance.

FIRAC recommended [**redacted**] explore additional options to reduce the potential risk of mistreatment and then return to the committee for reconsideration. Among these options, the Committee suggested [**redacted**].

[**redacted**], the Assistant Commissioner [**redacted**] rejected FIRAC’s recommendation and allowed the sharing of information. He based his decision on the following:

  1. [**redacted**] the RCMP should consider the consequences of not sharing [**redacted**] as this would be detrimental for the relationship stating that “engagement [**redacted**] will give insight and influence”;
  2. [**redacted**]
  3. The importance of the RCMP maintaining a strong relationship [**redacted**].

The Assistant Commissioner then concludes, “failure to share presents risk that cannot be managed [**redacted**]. Although influence is not guaranteed, I believe it is the better choice”

A subsequent email by the Assistant Commissioner [**redacted**] outlined additional considerations that factored into the decision to reject FIRAC’s recommendations. These considerations focused on the risk of not sharing the information. The additional information included operational and strategic considerations [**redacted**]. The Assistant Commissioner stated that lack of engagement [**redacted**]. Strategically, the Assistant Commissioner noted the risk to relationship should the information not be shared, noting that “failure to follow through [**redacted**] and associated mitigation efforts articulated below will likely have a negative impact on the [**redacted**] relationship [**redacted**].

The Assistant Commissioner’s reasoning goes on to include a “necessity” analysis regarding the challenges [**redacted**] the importance of the information from the interview, and the importance of the relationship [**redacted**]. Of note, the Assistant Commissioner notes that [**redacted**] a strong relationship [**redacted**] will aid in plans to mitigate the greater risk while also managing the risk that exists today for the Canadian [**redacted**]. The Assistant Commissioner also concludes his email by stressing that it is his belief that sharing the information is required to reduce the risk of mistreatment [**redacted**] that lack of involvement will lead to greater risk.

Analysis

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated.”

The ACA and issued OIC place an absolute prohibition on the sharing of information where there is a substantial risk of mistreatment of an individual. Unless “officials determine that the risk can be mitigated, such as through the use of caveats or assurances and appropriate measures are taken to mitigate the risk”, the information cannot be disclosed. Section 1(2) of the OICs further stipulate, “that where officials are unable to determine whether the risk can be mitigated, the Commissioner must ensure that the matter is referred to the Commissioner for determination.

The Assistant Commissioner’s decision to share the information contrary to FIRAC’s recommendation, cites section 1(2) of the OIC and concludes that since the FIRAC is responsible for making a recommendation to the Assistant Commissioner then the Assistant Commissioner is the final decision maker. The Assistant Commissioner “made the decision that the risk can be mitigated.” The Assistant Commissioner did not consider that making the final decision in this instance ran contrary to the process set out in the FIRAC Terms of Reference, and contrary to the OICs. The OICs are clear, where officials are unable to determine whether the risk can be mitigated the matter must be referred to the Commissioner…” Accordingly, pursuant to section 1(2) of the OIC, NSIRA notes that this case should have been elevated to the Commissioner for determination.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

[**redacted**]

A number of assumptions characterize the justifications by the Assistant Commissioner to share the requested information.

[**redacted**]. However, this reasoning disregards [**redacted**]. It further dismisses the RCMP’s own reporting [**redacted**]. FIRAC’s record of decision which notes, [**redacted**]. The Assistant Commissioner accordingly disregards the possibility that [**redacted**].

In the alternative, the Assistant Commissioner relies on [**redacted**] but does not consider now the risk [**redacted**] may increase [**redacted**].

Secondly, the Assistant Commissioner’s reasoning relied on [**redacted**].

The Assistant Commissioner does not address FIRAC’s concerns for [**redacted**] the insufficiency of mitigation measures. Rather the Assistant Commissioner concludes [**redacted**] greater risk should the information not be shared – but does not explain why or how so? Nor does the Assistant Commissioner address FIRAC’s concerns regarding [**redacted**].

Additionally, the Assistant Commissioner’s decision considered and emphasized the importance of the relationship between the RCMP [**redacted**] While FIRAC expressed concern assurances would be respected. The Assistant Commissioner’s reasoning focuses on the importance of [**redacted**], that relationship [**redacted**].

As mentioned earlier, according to the RCMP:

“…while the ACA and OiC may not speak to external considerations, it does not prohibit strategic considerations as part of the totality of the analysis, rather than against the risk to the individual, including whether strategic partnerships may act as a mitigation measure. It is important to note that the ACA and OiC do not supersede our obligations under the RCMP Act.”

The RCMP further noted that: “…As such, any action or inaction could result in unwanted consequences, and to include them as a consideration to demonstrate due diligence, and that all aspects of an activity is considered is prudent. Strategic relationships, or more importantly, in this case, actions that jeopardize the strategic relationship, can lead to harm. The A/C clearly stated that.”

NSIRA notes that the assessment of mistreatment must be limited to whether the disclosure would result in a substantial risk of mistreatment to the individual and whether said risk may be mitigated. NSIRA strongly cautions against the use of additional considerations such as strategic relationships in the assessment of substantial risk.

It should be noted that the Assistant Commissioner did provide additional mitigation measures for consideration. However, those measures were all premised on [**redacted**]. The measures did not require that the assurances and the FIRAC suggested mitigation measures be adopted as a prerequisite to the information sharing.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Finally, in the case at hand the Assistant Commissioner responsible for approving the FIRAC recommendations was the same Assistant Commissioner supervising the business line of the case. In 2019 NSIRA recommended that “departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.” As discussed in paragraph 61 above, in 2021 the RCMP adjusted its FIRAC process such that there are co-chairs for the FIRAC. Adding an additional Chair (co-chairs) was to ensure that the Chair overseeing a specific FIRAC is not the one responsible for business line where the case originated. The case at hand demonstrates the need to emulate that structure at the senior level in order to maintain independent decision-making and ensure that the case focus is on the substantial risk of mistreatment to the individual rather than additional strategic considerations.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Global Affairs Canada

During the course of the review period from January 1, 2021, to December 31, 2021, six cases reported to having been referred to the Intelligence Policy and Programs Division (INPL) for further assessment. In the cases that were provided to NSIRA all were specific to Mission security, where Missions were dependent on local authorities to assist in situations where there was a potential threat to staff at the embassy or consulate. When asked about the low number of cases, GAC advised NSIRA that sharing personal identifying information with foreign entities was very rare in an ACA context.

Implementation of the ACA

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

On December 14, 2017, GAC was issued Ministerial Direction on Avoiding Complicity in Mistreatment by Foreign Entities (2017 MD). GAC had not received the Ministerial Direction on Information Sharing with Foreign entities (the 2011 MD) that was issued to a number of other departments.

The department manages a global network of over 175 missions in 110 countries, employing approximately 12,000 staff with an operating with a budget of over $7 billion.

When asked how the department operationalizes the Act, GAC referred to their outreach and training programs. GAC advised NSIRA that their training programs targeted specific staff to ensure awareness of and compliance with the ACA. The training outlines the roles and responsibilities regarding the ACA and Orders in Council requirements, and provides employees a definition of “substantial risk,” and points of contact at headquarters.

In 2021, NSIRA committed to further scrutinizing the processes regarding ACA triage and decision-making by reviewing both GAC and the RCMP. In the 2020 ACA review, NSIRA found that there were significant divergences in the evaluation of risk and required level of approvals across departments. In particular, NSIRA identified procedural gaps in GAC’s risk assessments that should have warranted escalation to the Deputy Minister.

When asked if GAC had initiated any adjustments, or changes to frameworks or policies as a result of the findings and recommendations from previous reviews of the ACA, GAC advised that adjustments had been made to the framework by creating a Mistreatment Risk Assessment form. They explained that the form would support the application of a more consistent threshold for elevating a case in the decision-making process, and would standardize how cases are documented. As of August 31, 2022, GAC has yet to implement the use of this form.

Currently, the Head of Mission (HoM, or Chargé) makes the initial assessment in determining if the risk of mistreatment to the individual may be mitigated below the substantial risk threshold. Only where the HoM identifies a concern as to the sufficiency of the mitigation measures or assessment, would the HoM seek guidance through the Intelligence Policy and Programs Division (INPL) generic e-mail.

INPL can assist the Mission in conducting a risk assessment. If at this point it is determined there is a substantial risk of mistreatment that cannot be mitigated and the Mission still wants to proceed, the responsible geographic Director General may request that the Avoiding Mistreatment Compliance Committee (AMCC) be convened. The AMCC provides a decision to the HoM. GAC has advised that the role of the AMCC:

….is to recommend risk-mitigation strategies, seek escalatory senior-level discussion and approval for decisions as required, up to and including the Deputy Minister of Foreign Affairs, and document how each case is managed. It is convened on an ad hoc basis to review the proposed disclosure, request, or use of information in cases in which prohibitions under the Directions may be engaged. The Committee is similar to structures that exist within other departments and agencies subject to the OiC.

In 2020 and 2021, GAC initiated a review of the Secretariat of the AMCC, formerly known as the Ministerial Direction Compliance Committee (MDCC). GAC has advised that notional recommendations have been developed to improve the working methods of the Committee and update the terms of reference. Explaining that the timeliness of Committee decisions, addressing duty of care issues, and final reporting of case outcomes regarding Committee decisions are currently being examined. It is expected that the AMCC Secretariat’s review will be completed in 2022 and the terms of reference updated shortly thereafter.

In the six cases provided over the review period, NSIRA observed that the final decision on whether to share information with local authorities was left to the HoM. This is best illustrated in the HANOI case where the mission was advised

To note, decision-making authority on such situations ultimately rests with mission/geo. INPL’s role—as departmental focal point for the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA)—is simply to advise on relevant considerations, not authorize.

In further correspondence between INPL and the Mission in Hanoi there appears to be the need for additional clarification on the decision-making roles in regards to applying the ACA. INPL further advised the Mission that “it is in fact the Mission’s responsibility to determine if there is a substantial risk of mistreatment or not.

The centralization of accountability with the HoM as opposed to headquarters represents a significant change in implementation since NSIRA’s in-depth review of GAC in 2019. Namely, in the previous review any cases where there was a potential substantial risk of mistreatment would require escalation MDCC (via the INPL) where the Committee would ultimately be responsible for deterring if the proposed mitigation measures are sufficient and if the information sharing should take place. This change in implementation threatens the independence of the process from individuals with a potential operational interest in the outcome of the information sharing.

Recommendation 5: NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Information Sharing Framework

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

GAC does not have any information-sharing arrangements with foreign entities related to the ACA. When asked in last year’s review how GAC monitors its information exchanges, the response provided reads as follows:

There is a handful of divisions at GAC that receive information that may have been obtained through mistreatment. Because of the very different type of information they each receive due to their specific mandates, each has a different process/framework for identifying information likely to have been obtained through the mistreatment. Therefore, there is not one unified set of processes at GAC for initially marking/identifying incoming information potentially derived from mistreatment.

GAC has also not conducted an internal mapping exercise to determine which business lines are subject to the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

When asked to elaborate on the nature of information exchanges triggering the ACA, GAC further clarified:

[T]hat information exchanges occur without formal arrangement with foreign entities, and the vast majority of the information that is exchanged does not pertain to individuals. Each information exchange situation is unique and occurs within a specific relational and country context.

Each instance of information sharing is handled on a case-by-case basis and escalated to the appropriate level based on the individual circumstances.

It is important to note that if the assessment determines that there is NOT a substantial risk of mistreatment, but that the exchange of information directly or indirectly involves personally identifiable information about an individual AND the country or foreign entities is not a trusted partner when it comes to human rights, GAC employees must still capture via a risk assessment form the reason why there is NOT a substantial risk of mistreatment and keep a thorough record.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

When determining whether there is a risk of mistreatment, GAC employees will leverage human rights reports, as well as any intelligence relevant to the country/entity associated with the information. The risk profile of the individual about whom information is shared is also taken into consideration when making a determination regarding whether a substantial risk of mistreatment exists. It is a collection of information that informs any assessment and respective decision, rather than a single tool.

Training is only mandatory for employees working in a high-risk mission or functions and offered as a suggestion for other staff at mission and headquarters. GAC has committed to establishing a dedicated ACA page on the intranet, along with supporting communication, however, employees are only encouraged to review it.

GAC provides an outreach program and training, for staff both at headquarters and at missions abroad on their ACA obligations. The ACA components are embedded in GAC’s Governance, Accreditation, Technical Security and Espionage (GATE) awareness program, the Legal and Policy Framework on Information Sharing, and a module in the Heads of Mission pre-posting training. These training courses outline the roles and responsibilities of officials regarding their ACA and Orders in Council obligations, including the definition of “substantial risk”, and key points of contact at headquarters. It is important to note that the GATE awareness program and that the ACA segment of the training is considered as an outreach tool and not a core training module, meant to provide situational awareness for Canadian- based staff on information security and intelligence topics. The training provided by the Department of Justice acts as the core training module for staff.

When asked about Consular Operations bureau training, GAC appeared to have only a cursory knowledge citing that they were aware from the 2021 Annual Report (on the Application of the Orders in Council Directions for Avoiding Complicity in Mistreatment by Foreign Entities) that ACA directions were included as part of the training session offered by the Consular Operations bureau.

The target employees for training at headquarters are outgoing Mission Security Officers, Management Consular Officers, Readiness Program Managers, Global Security Reporting Program Officers and Heads of Mission, as well as all members of the Intelligence Bureau. At mission, the training is provided to all Canada-based staff, including other government departments’ employees posted at missions. GAC has only recently begun tracking the number of staff that have been provided ACA training, and estimates that at least 300 GAC employees have been provided ACA-related training since 2020.

When further queried about the breakdowns of training provided, GAC posited that there are only a small proportion of GAC officers abroad that may encounter ACA-related decisions. With training only mandatory for some staff, NSIRA is concerned that given the volume of information exchanges, and the multiplicity of business lines there is very well potential that information sharing may be occurring, or not properly triggered by those without proper ACA knowledge.

In light of the fact that GAC engages with foreign entities with poor human rights records and operates in highly volatile environments, NSIRA expresses deep concern that GAC has not demonstrated that it has implemented ACA framework across business lines.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Human Rights Reporting

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

GAC develops classified human rights reports making them available to a number of internal Government of Canada partners. These reports are intended to provide an overview of the human rights situation of a particular country. They help inform Canada’s international engagement and programming decisions, including foreign policy, development, trade, security, and consular activities. Updated human rights reports (post 2019) include a designated section that addresses the Orders in Council and the ACA, and the circumstances of mistreatment within that country.

The coming into force of the ACA and the issuance of the Orders in Council resulted in a greater number of departments being subject to directions specific to the avoidance of mistreatment by foreign entities. Many of these departments did not have frameworks or any country assessments to support this obligation. This created an increased demand for the GAC Human Rights Reports.

Prior to Royal Assent of the ACA, GAC provided human rights reports to departments that were subject to the 2017 Ministerial Directives. GAC also works with partners to incorporate feedback on human rights reporting and considers input on countries of interest for subsequent reporting cycles. It is important to note that GAC does not keep statistics on how often, or which reports were requested/accessed by internal partners.

NSIRA recognizes that in 2021 GAC has recently implemented a prioritized list to update the human rights reports and has been making considerable headway during the review period, updating 25 percent of their profiles. A number of high-risk countries have been updated to reflect current events. Still, a number of reports are outdated and close to 60 percent of the 133 human rights reports have not been updated since 2019. For example, Pakistan, Somalia, Ukraine, and Yemen have not been updated since 2019, while South Africa and Belarus have not been reviewed since 2015.

Maintaining up-to-date reports will help ensure that critical human rights information is being used when making ACA determinations, this is especially vital considering that other department leverage GAC’s human rights report as part of their risk assessments. NSIRA notes that the Information Sharing Coordination Group coordinated by Public Safety Canada continues to work through the prioritization and the issues associated with the sharing of human rights reports across departments. It should be stressed that the GAC human rights reports are viewed as a supplement to what departments have already collected as part of their own assessments. For this reason GAC does not provide evaluative judgment on risk within their human rights reports, that is they do not designate whether a country or entity is high or low risk, consequently leaving departments to assess risk based on the information they have collected as part of their mandates.

NSIRA has been advised that the GAC country priority list was developed in consultation with partner departments and agencies, and relevant GAC divisions. And is based on an assessment of the operational needs of Canadian federal departments and agencies. While understanding the impact the pandemic had on operations, particularly at Missions abroad, NSIRA encourages GAC to develop, maintain, and continue to work with other departments and agencies to ensure countries’ HRRs are updated as regularly as possible.

Development of Human Rights Reports

GAC produces human rights reports in collaboration with its missions. Coordinated by GAC’s office of Human Rights, Freedoms and Inclusion directorate, the reports are used not only to inform risk assessments, but assist in the guidance of policy and programming decisions.

Missions are responsible for updating their human rights reports, and, if tasked, are linked to Head of Mission’s performance measurement agreements. Mission staff work collaboratively with geographic branches in the preparation of the reports. While headquarters is responsible for the tasking and coordination of the reports, it is Head of Mission that approves the report. The reports include information on the overall human rights context in the country, as well as an analysis of the significant human rights-related events that took place during the review period. Generally, reports are a collection of various sources, which include open source reporting, consultations with human rights organizations and civil society partners, and engagement with government authorities and stakeholders.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Assurances

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

GAC advised that there was no standardized approach in place to assess the reliability or document assurances received from foreign entities. Risk assessments are conducted on a case-by-case basis. When asked how assurances were developed, GAC stated that there was no statutory or regulatory language that specifically addressed the use of diplomatic assurances, but officials implicated in individual cases would consider the foreign entity’s credibility, recent precedents, the experiences of like-minded partners, and the feasibility of monitoring assurances and caveats to be communicated with the disclosure. It is the Mission’s responsibility to track and monitor whether assurances and caveats are being respected

NSIRA noted that on the ATHENS case provided by GAC, there was a concerted effort to ensure assurances and caveats were in place before information was shared with local authorities. It is in NSIRA’s opinion that the mission was attuned to their obligations under the Act (and directions) and tried to ensure the welfare of the individual detained by authorities. [**redacted**] Mission staff took remedial action to ensure that the individual is not at risk of mistreatment.

In the ATHENS case, [**redacted**]. NSIRA noted that there is no formalized tracking, or documentation mechanism for the follow-up caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix I: Findings and Recommendations

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework and supporting policies and procedures are still under development.

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment is a best practice.

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated”.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Recommendation 5 : NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix II: ACA Framework and Background

It is important to note how the legal frameworks have evolved over the past decade. In international law Canada is a state party to a number of international instruments including the International Covenant on Civil and Political Rights (ICCPR), and the Convention Against Torture and Other Cruel, Inhumane or Degrading Treatment or Punishment (CAT). Many of the prohibitions on mistreatment, in these conventions are now considered customary international law. These international commitments have been implemented in Canadian domestic law; most notably the prohibition on torture is clearly defined and codified in the Criminal Code under section 269.1.

In 2010, the Canadian Government implemented a general framework for “Addressing the Risks of Mistreatment in Information Sharing with Foreign Entities”. This was the first multidepartment instruction given by the government regarding the issue of information sharing and mistreatment.

The framework was followed by two detailed Ministerial Directions to departments in 2011 and 2017. The 2017 MD was issued to seven departments and created prohibitions on the sharing of information that may lead to a substantial risk of mistreatment that cannot be mitigated. The MD also provided clear parameters on the use of information potentially derived from mistreatment. Additionally, the MD broadened the scope of applicability to all information sharing with foreign entities and not just that pertaining to national security issues.

On July 12, 2019, the Avoiding Complicity in Mistreatment by Foreign Entities Act came into force. The Act codifies and enshrines Canada’s commitment to respect the Charter of Rights and Freedoms, and the international agreements prohibiting torture and other cruel, inhuman or degrading treatment or punishment that it is party to. A primary objective of enshrining these principles through statute rather than the previous use of Ministerial Directions was to ensure that Canada’s commitment to these principles does not rest with the Minister or Government in power. The ACA provides the statutory authority for the Governor in Council (GiC) to issue directions through Orders in Council. The Act imposes an obligation on the GiC to issue Orders in Council to at least seven specific departments. In September 2019, there were in total 12 Orders in Council issued to departments and agencies engaged in information sharing with foreign entities.

The Orders in Council prohibits the disclosure of information to any foreign entity where said disclosure would result in a substantial risk of mistreatment of an individual and prohibits the making of any requests to any foreign agency for information that would result in a substantial risk of mistreatment of any individual. Additionally, the issued Orders in Council places parameters on the use of information likely derived from mistreatment of an individual by barring its use where it may create a substantial risk of further mistreatment, as evidence in any judicial, administrative or other proceeding, or in any way that deprives someone of their rights and freedoms (unless determined by the deputy head that it is necessary to prevent loss of life or significant personal injury).

Ministerial Direction (2011)

  • Issued to CSIS, CSE, CBSA and RCMP;
  • DND developed similar internal instruction; but was not issued as a ministerial direction (functional directive); and,
  • Main criticism was that departments were permitted to weigh the value of the information against the risk of mistreatment

Ministerial Direction (2017)

  • Addition of GAC, and DND (to CSIS, CSE, RCMP, CBSA);
  • A number of changes, most significant were prohibitions of the disclosure and requesting of information, as well as new limits on the use of information (derived from mistreatment);
  • Requirement for departments to maintain policies and procedures to assess risks; and,
  • Inter-agency co-operation requirement

OiCs issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (2019)

  • Issued to twelve departments, six of which had never before received formal direction regarding information sharing with foreign entities (PS, FINTRAC, TC, IRCC, CRA and DFO); and,
  • Codified many provisions of the 2017 MD

As noted in the introduction, the legal framework governing the sharing of information with foreign entities applies to information pertaining to all individuals, regardless of whether they are detainees or not. There is currently no government-wide implementation policy for the ACA. However, the issued Orders in Council do provide guidance on the requisite threshold for information sharing and the requisite hierarchy of approval where there is uncertainty as to whether mitigation measures may sufficiently diminish the substantial risk of mistreatment. Public Safety Canada in 2018, set up an Information Sharing Coordination Group with the objective of sharing best practices between departments.

Individual departments develop their own internal framework and policies for the implementation of the ACA. Some departments that were previously subject to the MDs on Avoiding Complicity in Mistreatment by Foreign Entities had a greater opportunity to create internal processes, procedures and policies to identify when information sharing practices may create a substantial risk of mistreatment. These departments have developed structured approaches to recording assurances (verbal or written) received from the foreign entities whom they engage and possible mitigation strategies such that the threat is diffused below the substantial risk of mistreatment threshold.

Appendix III: Previous Recommendations

Past findings and recommendations
Report for Year 2018 Report for Year 2019 Report for Year 2020
Finding #1: Benefits of internal information sharing process reviews. NSIRA noted that periodic internal reviews of information sharing policies and processes supported their successful functioning in the long term. Finding #1: NSIRA found that several departments, new to the considerations of the Act, described considerable progress being made during the review period and afterwards to build out formalized frameworks to support implementation. Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.
Recommendation #1: Departments should conduct periodic internal reviews of their policies and processes for sharing information with foreign entities in order to identify gaps and areas in need of improvement. Finding #2: NSIRA found that departments conducting minimal information exchanges with foreign entities have not yet fully addressed the importance of having an official information sharing framework in place. Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.
Findings #2: Departments vary with respect to the independence of their decision-making. NSIRA examined the extent to which high-risk decision-making is removed from operational personnel who may have vested interest in the sharing. In some departments, the decision-makers have a direct operational interest in the sharing of information, creating the potential for conflict between operational imperatives and departmental obligations to respect the MD. In particular, NSIRA noted that:
  • CSE and the RCMP have the most independent processes.
  • The information sharing process implemented by GAC to date remove high-risk decision-making from “front line” personnel.
  • At CSIS and DND/CAF, decision makers typically have a direct operational interest in the sharing of information.
  • CBSA has not yet operationalized its information sharing processes.
Recommendation #1: NSIRA recommends that all departments in receipt of directions under the Act have official framework that ensure they can fully support the implementation of the directions. Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.
Recommendation #2: Departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested the outcome. Finding #3: NSIRA found that the differences and variability in departmental frameworks demonstrate a previous lack of coordination across the community and a need to identify best practices. Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.
Finding #3: Lack of standardized information sharing risk assessments. Under the 2017 MD, GAC, CSIS, CSE, and the RCMP all maintain their own sets of foreign country and/or entity profiles, while DND/CAF is currently developing its own as well. The existence of multiple different assessments is duplicative and unnecessary. It may also yield inconsistencies, as departments have at times come to quite different conclusions about foreign countries’ and entities’ human rights records and the associated risks of information sharing. Recommendation #2: NSIRA recommends that departments coordinate to identify best practices for all essential components of information sharing frameworks and that ISCG is leveraged to ensure these practices are shared where possible across the community to support the implementation of the Act.
Recommendation #3: Departments should develop:
  • Unified set of assessments of the human rights situation in foreign countries including a standardized ‘risk of mistreatment’ classification level for each country; and
  • To the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.
Finding #4: NSIRA found that there are inconsistencies in the application of existing sharing frameworks between departments, specifically concerning information evaluation thresholds, and decisions being elevated for senior level determinations.
Finding #4: The concept of “substantial risk” of mistreatment is not defined. Like the 2017 MD, the ACMFEA and its associated direction prohibit information sharing that would result in a “substantial risk” of mistreatment, Neither the ACMFEA nor its direction include a definition of substantial risk, however, despite the centrality of this concept to the regime. A definition of substantial risk existed in both the 2011 and 2017 MD; its absence now raises concerns about its interpretation in the future. Recommendation #3: NSIRA recommends that departments establish consistent thresholds for triggers in their information sharing frameworks, including initial evaluations against the concerns of the Act, when a case is to be elevated in the decision process, and how this is documented.
Recommendation #4: The definition of “substantial risk” should be codified in law or public direction. Finding #5: NSIRA found a lack of unification and standardization in the country and entity assessments being leveraged by departments, resulting in inconsistencies in approach/stance by the community when interacting with Foreign Entities of concern related to the Act.
Recommendation #4: NSIRA recommends that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the Act.

Annex A: Departmental Frameworks

Royal Canadian Mounted Police

Following receipt of the 2017 MD, the RCMP established a new Law Enforcement Assessment Group (LEAG). LEAG has a detailed Terms of Reference that outlines its membership as well as roles and responsibilities. LEAG’s primary task is to assess foreign countries and law enforcement entities with regard to the risk of mistreatment. In its assessments, LEAG considers a number of factors, including the human rights record of the country, specific foreign entities’ engagement in human rights abuses, local law enforcement’s history of respecting caveats, as well as country-specific risks to individual safety related to political views, religion, ethnicity, sexual orientation, and so on. LEAG thus “plays an integral role in informing FIRAC’s decision on whether to share information with foreign law enforcement entities.”

At present, the RCMP has categorized 146 approved country profiles, of which 20 are high risk, 69 are medium risk, and 57 are low risk. 51 country assessments remain outstanding. LEAG currently intends to update its profiles every two years, although LEAG will update some reports more frequently based on operational requirements. To date, 40 countries have been assessed as being a high priority for periodic updates due to the volume of information sharing conducted.

Graphic of FIRAC Process

Process

If an RCMP officer identified a need and wishes to share information with a foreign entity, they must follow a set process:

The officer must first consult a specific RCMP intranet website created by LEAG. The site lists countries by colour. If the officer finds that the country in question is “green”, he or she may proceed to share the information. If the country is “red”- or “yellow” and the circumstances of the proposed sharing match any of the case-specific factors and considerations listed- then the case must be referred to FIRAC. If a FIRAC is required, the officer completes a standard form which must be approved by the relevant Criminal Operations (CROPS) Officer or other approving officer. The form includes a summary of the information to be shared, the kind of sharing (request, disclosure or use), the operational context, the risks of sharing information, the investigative value of the information, possible mitigation strategies, and- where applicable- the actual information to be disclosed or used.

Once approved, the form is sent to the Director General (DG) responsible for the relevant program at RCMP headquarters for approval. Following approval, the DG submits the form to the FIRAC secretariat.

The FIRAC secretariat compiles a briefing package that includes the officer’s form, the country profile from LEAG, and any supporting documentation submitted by the DG. The briefing package is distributed to FIRAC members ahead of the meeting.

A FIRAC meeting is convened and the request is considered along with possible mitigation strategies. While the final decision regarding FIRAC’s recommendation rests with the Chair, in the vast majority of cases the decision is unanimous. Dissenting opinions are recorded in the Record of Decision (RoD). Once FIRAC has noted its recommendation, the RoD and an accompanying briefing note are sent to the Assistant Commissioner for final determination.

In cases where FIRAC cannot determine whether a substantial risk of mistreatment can be mitigated, the responsible Assistant Commissioner will provide the RoD to the Deputy Commissioner in order to obtain the Commissioner’s decision.

Global Affairs Canada

Framework Updates

Global Affairs Canada (GAC) indicated that no changes to their framework was made during the current review period.

Annex I: Global Affairs Canada Framework

Process

Triage

There is not one unified set of processes at GAC for determining whether information being used by the department is likely to have been obtained through the mistreatment of an individual by a foreign entity. If an official determines that information that he or she has received is likely to have been obtained through the mistreatment of an individual by a foreign entity and that official still wants to use the information, they are instructed in their training to consult with their Program management at HQ. Should that manager be unable to make a determination on their own as to whether the use would comply with the Act, they will consult the relevant departmental policy group and the department’s Legal Services Unit.

Senior Management Committees

The Avoiding Mistreatment Compliance Committee (AMCC) meetings focuses on the following:

  • Has the information, the use of which is being sought, likely been derived from mistreatment?
  • What are the proposed measures to mitigate the risks? What is the likelihood of their success?
  • Consider the justifications for and proportionality of any potential involvement with the foreign state or entity that may result in mistreatment.

The AMCC Secretariat will create a record of decision and circulate it for comment by AMCC members. Once finalized, it will be kept by the Secretariat for future reporting. The AMCC Secretariat follows up with the requesting official for updates on the outcome of the situation and requests a final update from the requesting official once the situation is resolved.

Global Affairs Canada’s human rights reports provide an evidence-based overview of the human rights situation in a particular country, including significant human rights-related events, trends and developments and include a section focused on mistreatment. There are no scores for countries however, and it is up to the officials to assess the risk based on the information in the reports.

Mitigation Measures

The Legal Services Unit and/or Intelligence Policy and Programs division will provide guidance on the limitations and the prohibitions of the use of information obtained through mistreatment. They are also able to propose potential mitigation measures, such as sanitization of the information, if there is a risk of further mistreatment; of depriving someone of their rights or freedoms; or if the information could be used as evidence in any judicial, administrative or other proceeding.

Share this page
Date Modified:

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023: Report

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023


Report

Date of Publishing:

Revisions

Pursuant to section 40 of the National Security and Intelligence Review Agency Act (NSIRA Act), NSIRA may submit a special report to the appropriate Minister on any matter related to NSIRA’s mandate. The Minister must then table the special report in Parliament within 15 sitting days.

Prior to the submission of such a report, subsection 52(1)(b) of the NSIRA Act requires NSIRA to consult with the deputy heads concerned to ensure that the special report does not contain information the disclosure of which would be injurious to national security, national defence or international relations or is information that is protected by solicitor-client privilege, the professional secrecy of advocates and notaries or litigation privilege.

This document is NSIRA’s section 40 special report. It is a revised version of the classified report provided to the Prime Minister on March 5, 2024. Revisions were made to remove injurious information. Where information could simply be removed without affecting the readability of the document, NSIRA noted the removal with three asterisks (***). Where more context was required, NSIRA revised the document to summarize the information that was removed. Those sections are marked with three asterisks at the beginning and the end of the summary, and the summary is enclosed by square brackets (see example below).

EXAMPLE: [**Revised sections are marked with three asterisks at the beginning and the end of the sentence, and the summary is enclosed by square brackets.**]

List of Acronyms

Abbreviation Expansion
CEIPP Critical Election Incident Public Protocol
CTSN Canadian Top Secret Network
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DND Department of National Defence
DM Deputy Minister
FI Foreign Interference
GAC Global Affairs Canada
HUMINT Human Intelligence
IAS Intelligence Assessment Secretariat
ISR Independent Special Rapporteur
MP Member of Parliament
NHQ National Headquarters
NSIA National Security and Intelligence Advisor
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security and Intelligence Review Agency
PCO Privy Council Office
PRC People’s Republic of China
PMO Prime Minister’s Office
PSB Protective Security Briefing
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RRM Rapid Response Mechanism
SIGINT Signals Intelligence
SITE TF Security and Intelligence Threats to Elections Task Force
TRM Threat Reduction Measure
UFWD United Front Work Department
Abréviation Développement
AC Administration centrale
AMC Affaires mondiales Canada
BCP Bureau du Conseil privé
CPM Cabinet du premier ministre
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CSNR Conseiller à la sécurité nationale et au renseignement
CST Centre de la sécurité des télécommunications
DER Direction de l’évaluation du renseignement
DTFU Département du travail du Front uni
GRC Gendarmerie royale du Canada
GT MSRE Groupe de travail sur les menaces en matière de sécurité et de renseignements visant les élections
HUMINT Renseignement humain (Human Intelligence)
IE Ingérence étrangère
MDN Ministère de la Défense nationale
MRM Mesure de réduction de la menace
MRR Mécanisme de réponse rapide
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PPIEM Protocole public en cas d’incident électoral majeur
RCTS Réseau canadien Très secret
RPC République populaire de Chine
RSI Rapporteur spécial indépendant
SCRS Service canadien du renseignement de sécurité
SIGINT Renseignement électromagnétique (Signals Intelligence)
SISP Séance d’information sur la sécurité préventive
SM Sous ministre
SP Sécurité publique Canada

Executive Summary

The security and intelligence community is of the consensus view that political foreign interference is a significant threat to Canada, and that the People’s Republic of China (PRC) is a major perpetrator of this threat at all levels of government. Nonetheless, the present review of how intelligence related to PRC political foreign interference was disseminated from 2018 to 2023 (a period covering the last two federal elections) indicates that there were significant disagreements between constituent components of that community, both within and across organizations, as to whether, when, and how to share what they knew.

Underlying these disagreements and misalignments was a basic challenge for the security and intelligence community: how to address the so-called “grey zone” whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. NSIRA saw evidence of this challenge across the activities under review, including in decisions about whether to disseminate information and how to characterize what was shared. The risk of characterizing legitimate political or diplomatic behaviour as a threat led some members of the intelligence community to not identify certain activities as threat activities. 

Intelligence is by its nature provisory. It does not constitute proof that the described activities took place, or took place in the manner suggested by the source(s) of the information. At the same time, the fact that it is not proof does not mean it should be withheld – by this standard, very little (if any) intelligence would ever be shared. What is required – between collection and dissemination – is an evaluation of the intelligence and a decision as to whether it should, or should not, be communicated in some way.

With respect to disseminating intelligence about foreign interference in elections, the Canadian Security Intelligence Service (CSIS) confronted a basic dilemma. On one hand, information about foreign interference in elections was a priority for the government, and CSIS had geared its collection apparatus toward investigating political foreign interference. On the other, CSIS was sensitive to the possibility that the collection and dissemination of intelligence about elections could itself be construed as a form of election interference. A basic tension held: any action – including the dissemination of intelligence – taken by CSIS prior to or during an election must not, and must not be seen to, influence that election. 

This dynamic was known within CSIS, but is not formally addressed in policy or guidelines. It was not always clear, particularly to those collecting intelligence, what the general rationale and/or policy guiding the dissemination of intelligence on political foreign interference was, let alone how that rationale/policy applied to specific decisions. Overall, the perception arose within CSIS that rules and decisions were being made, and frequently changed, absent a coherent strategy or guiding principles.

NSIRA recommends that CSIS develop a comprehensive policy and strategy specifically pertaining to all aspects of how CSIS engages – investigates, reports about, and takes action against – threats of political foreign interference. This would bring coherence across the organization. It would also signal to Government of Canada stakeholders that CSIS has carefully considered all aspects of political foreign interference, including its unique sensitivities, and is reporting and advising on those threats using rigorous standards and thresholds. 

CSIS is a member of the Security and Intelligence Threats to Elections (SITE) Task Force, along with the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), and Global Affairs Canada (GAC). One of the Task Force’s primary functions is to provide coordinated intelligence reporting to a panel of senior public servants, the Critical Election Incident Public Protocol (CEIPP) Panel, during writ periods. These two bodies were established to receive, analyze, and respond to intelligence coming from the intelligence community with respect to foreign interference in federal elections.

The orientations of the SITE Task Force and CEIPP Panel were geared toward addressing broad, systematic, and largely online interference (such as that witnessed in the 2016 US presidential election). As such, they could not adequately address so-called traditional, human-based, riding-by-riding interference. NSIRA recommends several adjustments to the SITE Task Force and CEIPP Panel, meant to ensure that the full range of threats associated with foreign interference is adequately addressed by these two entities moving forward.

Outside the election context, the intelligence community collects intelligence on PRC political foreign interference on an ongoing basis. This intelligence is shared both horizontally within the community and vertically to senior decision makers, including elected officials.

During the review period, CSIS lacked the ability to definitively track who had received and read its intelligence. This was partly a consequence of the internal tracking systems of the various recipient departments, which may not have comprehensively captured this data. In the end, however, it is incumbent on CSIS, as the originator of sensitive information, to control and document access.

The consequences of not knowing who has received what manifested in the controversy regarding intelligence related to the PRC targeting of a sitting Member of Parliament.

The media and public conversation regarding this intelligence focused on two CSIS products, one from May 2021 and the other from July 2021. In fact, neither product was the mechanism through which the Minister and Deputy Minister of Public Safety were initially meant to be informed of the PRC’s threat activities against the Member of Parliament and his family. Rather, [**prior to May 2021**] there [**was CSIS intelligence**] related to the PRC’s targeting of the Member of Parliament. CSIS sent [**this intelligence**] to named-recipient lists which included the Deputy Minister and Minister of Public Safety.

Public Safety confirmed that at least one [**redacted**] was provided to the Minister [**prior to May**] 2021, likely as part of a weekly reading package. However, the department was unable to account for [**redacted**]. This is an unacceptable state of affairs. NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received and, as appropriate, read intelligence products. 

At the same time, tracking who has received what is not a panacea. There must be interest on the part of consumers for the intelligence they receive, and an understanding as to how the intelligence can support the fulfillment of their responsibilities.

In 2021, PCO and CSIS analysts produced reports meant to serve as synthesizing overviews of PRC foreign interference activities, but which the National Security and Intelligence Advisor to the Prime Minister (NSIA) saw as recounting standard diplomatic activity. This disagreement played a role in those intelligence products not reaching the political executive, including the Prime Minister.

The gap between CSIS’s point of view and that of the NSIA is significant, because the question is so fundamental. CSIS collected, analyzed, and reported intelligence about activities that it considered to be significant threats to national security; one of the primary consumers of that reporting (and the de facto conduit of intelligence to the Prime Minister) disagreed with that assessment. Commitments to address political foreign interference are straightforward in theory, but will inevitably suffer in practice if rudimentary disagreements as to the nature of the threat persist in the community.

NSIRA recommends that regular consumers of intelligence work to enhance intelligence literacy within their departments and that, further, the security and intelligence community develop a common, working understanding of what constitutes political foreign interference. While the NSIA plays a coordinating role within the security and intelligence community, the bounds of this role are not formally delineated. As such, the extent of their influence in decisions regarding the distribution of CSIS intelligence products is unclear. NSIRA therefore recommends that the role of the NSIA, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Introduction

Authority

This review was conducted under the authority of paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act (NSIRA Act).

Scope of the Review

The scope of the review included all intelligence on People’s Republic of China (PRC) foreign interference in federal democratic institutions and processes from 2018 to 2023. The specific focus was on the flow of this intelligence within government. That is, from the collectors of intelligence to consumers of intelligence (“clients”), including senior public servants and elected officials.

The review included the following departments and agencies:

  • The Canadian Security Intelligence Service (CSIS)
  • The Communications Security Establishment (CSE)
  • The Royal Canadian Mounted Police (RCMP)
  • Global Affairs Canada (GAC)
  • Public Safety Canada (Public Safety)
  • The Privy Council Office (PCO)

These are the core members of the security and intelligence community with mandates relevant to foreign interference in Canadian democratic institutions and processes. The review also received information from Elections Canada regarding its relationship with, and the information it received from, the departments and agencies noted above.

Methodology

NSIRA gathered information through a variety of means. This included:

  • Document Review (approximately 17,000 documents);
  • Nine (9) Briefings;
  • Fourteen (14) Interviews;
  • Twenty-one (21) Requests for Information;
    • These included requests for documents as well as requests for written responses to questions.
  • Direct Access to CSIS’s operational database and corporate repository.
  • Direct access to CSE’s foreign intelligence reporting database.

The NSIRA Act grants NSIRA rights of timely access to any information in the possession or under the control of a reviewed entity (reviewee), with the exception of Cabinet confidences, and to receive from them any documents and explanations NSIRA deems necessary.

Initially, NSIRA did not request the release of Cabinet confidences, as the scope of the review did not include policy responses to foreign interference from government, focussing instead on the flow of information within government. However, in his initial public report, the Independent Special Rapporteur on Foreign Interference (ISR), the Right Honourable David Johnston, recommended that NSIRA be given access to any Cabinet confidences that were provided to him for his review. In light of this recommendation, on June 7, 2023, NSIRA wrote to the Prime Minister to request that all Cabinet confidences related to its review be released to the Review Agency, and not just those reviewed by the ISR. 

On June 13, 2023, an Order in Council authorized the release, to NSIRA, of the Cabinet confidences reviewed by the ISR. The scope and focus of NSIRA’s review differs from the ISR’s May 23, 2023 report. The ISR’s report focused specifically on intelligence related to foreign interference in the 43rd and 44th general federal elections and reported on in the media. To safeguard the integrity of its reviews and maintain its independence, NSIRA could not consider a subset of Cabinet confidences (those provided to the ISR) without reviewing all other Cabinet confidences relevant to NSIRA’s particular scope and focus. NSIRA’s broader request to the Prime Minister went unanswered. As a result, NSIRA declined to consider the subset of Cabinet confidences that were provided. Given the scope of the review, NSIRA is nonetheless confident that it received all information necessary to fully support its analysis, findings and recommendations. Pursuant to its obligations under s. 13 of the NSIRA Act, NSIRA cooperated with the National Security and Intelligence Committee of Parliamentarians (NSICOP) to avoid any unnecessary duplication of work in relation to each organization’s review of the topic of foreign interference.

Review Statements

CSIS, CSE, the RCMP, GAC, and Public Safety met NSIRA’s expectations for responsiveness during this review.  PCO only partially met NSIRA’s expectations, due to delays in responding to requests for information.

NSIRA was able to verify information for this review in a manner that met expectations.

Background

Beginning in the fall of 2022, a series of reporting by The Globe and Mail and Global News cited classified CSIS documents on PRC foreign interference into Canadian democratic institutions and processes, including the 43rd and 44th federal elections. This reporting raised concerns regarding the government’s response to the threat of foreign interference and, consequently, the integrity of Canada’s democratic institutions and processes.

On March 9, 2023, NSIRA announced that it would initiate the present review of the production and dissemination of intelligence on foreign interference with respect to the 43rd and 44th federal elections. The review’s focus was on the flow of this information within government, in order to address the fundamental question: did the security and intelligence community adequately report information to those responsible for protecting Canada’s democratic processes and institutions from threats of foreign interference? The granularity of this question – which includes comparing collected raw information to the intelligence ultimately disseminated in finished products – lent itself to NSIRA’s unique mandate and access, including direct access to CSIS’s systems and the ability to speak to intelligence officers in the field. Broader policy considerations (for example what policymakers did or did not do with the information they received) were considered out of scope, and should be addressed by other organizations reviewing activities in this area, including NSICOP and the Commission of Inquiry under the direction of the Honourable Marie-Josée Hogue. NSIRA’s question is foundational in that an effective response requires adequate information.

Political Foreign Interference

Foreign interference includes covert, clandestine or deceptive activities undertaken by foreign actors to advance their strategic, geopolitical, economic, and security interests. This can occur in any sphere of society, including the private sector, academia, the media, and the political system. The latter, political foreign interference, is a subset of foreign interference more broadly.

A prominent example of political foreign interference is the spreading and amplifying of disinformation on social media platforms, such as was perpetrated by Russia during the 2016 US presidential election. Also prevalent are “traditional” (human-based) forms of interference which consist of, among other things: cultivating relationships with political officials for the purpose of interference activities; the recruitment and coercion of individuals involved in politics (including political staff); illicit, illegal, or clandestine financial donations to politicians or political parties; and targeting diaspora communities through threats and intimidation.

According to Canada’s security and intelligence community, the largest perpetrator of foreign interference (political or otherwise) in Canada is the PRC. The PRC engages in widespread and systematic interference operations at all levels of government. These activities are generally the purview of the PRC’s United Front Work Department (UFWD), which is dedicated to shaping and influencing perceptions of, and policy toward, the PRC on a global scale, through a variety of overt and covert means. While the UFWD has been in existence for decades, it is widely recognized that its activities have accelerated following the accession of Xi Jinping to permanent leadership of the PRC, coinciding with increasing tensions between the PRC and Western nations, including Canada.

CSIS has reported about foreign interference since its inception in 1984. The CSIS Act defines “threats to the security of Canada” in section 2, including what it calls “foreign influenced activities” which are “activities that are detrimental to the interests of Canada and are clandestine or deceptive or involve a threat to any person.”

CSIS’s reporting on PRC foreign interference has been subject to public controversy in the past. Most notably, in 2010, then-CSIS Director Richard Fadden made public statements regarding PRC political foreign interference in Canada, indicating that CSIS was investigating multiple politicians whom it believed were “under the influence of a foreign government.” These comments generated significant public criticism, including from the House Committee on Public Safety and National Security, which concluded that “the allegations made by the Director of CSIS tarnished the reputation of politicians and of the Chinese-Canadian community.”  

Eventually, in [**redacted**], CSIS created dedicated desks to investigate PRC foreign interference; [**One sentence edited and one sentence deleted to remove injurious information. The sentences described the organization of CSIS investigations**]. CSIS noted to NSIRA that the volume of foreign interference activity was significant, [**redacted**].

In the following years, investigations have continued to evolve, even as the sensitivity of investigating and reporting about political foreign interference (as demonstrated by the Fadden controversy) remains acute. This tension – between pushing forward on investigations related to foreign interference and tempering such efforts to account for the sensitivities involved – permeated all of the activities examined below. Intelligence is by its nature provisory. It does not constitute proof that the described activities took place, or took place in the manner suggested by the source(s) of the information. That intelligence was “collected” does not imply, necessarily, that it ought to have been disseminated to government clients. At the same time, the fact that it is not proof does not mean it should be withheld – by this standard, very little (if any) intelligence would ever be shared. What is required – between collection and dissemination – is an evaluation of the intelligence and a decision as to whether it should, or should not, be communicated in some way. This process, and these decisions, are fundamental to the work of the security and intelligence community. They are at the heart of the present review.

Findings, Analysis, and Recommendations

This section presents the review’s findings, supporting analysis, and resulting recommendations. The section is organized into three parts, as follows:

  • Part 1 reviews CSIS’s dissemination of intelligence on PRC foreign interference in the 43rd and 44th federal elections. Assessing this flow was the principal aim of the review. NSIRA selected three cases for in-depth review. The details of these cases, along with other information reviewed by NSIRA, inform general findings related to the dissemination of intelligence on PRC political foreign interference, culminating in a broad recommendation to CSIS regarding its governance in this area. 
  • Part 2 examines the role of the Security and Intelligence Threats to Elections (SITE) Task Force and Critical Election Incident Public Protocol (CEIPP) Panel. These bodies were established to receive, analyze, and respond to intelligence provided by the intelligence community. The analysis highlights deficiencies and provides recommendations to better position these bodies to address the threat of political foreign interference.
  • Part 3 steps away from the election-specific context, to assess the broader flow of intelligence on PRC political foreign interference across the security and intelligence community between 2018 and 2023, including to senior public servants and elected officials. Particular attention is given to CSIS’s methods of dissemination, and the role of the National Security and Intelligence Advisor (NSIA) to the Prime Minister. This analysis includes an overview of the dissemination of intelligence regarding the PRC’s targeting of a Member of Parliament, and an assessment of the dissemination of two in-depth analytical intelligence products on PRC political foreign interference.

Taken collectively, these components offer insight into the overall challenges associated with how intelligence about PRC political foreign interference moved within the Government of Canada during the review period.

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

NSIRA reviewed the intelligence produced by CSIS, CSE, GAC, PCO, and the RCMP related to foreign interference in the 43rd and 44th federal elections. In three cases – one from 2019, two from 2021 – NSIRA examined how CSIS disseminated intelligence to relevant entities in the government of Canada, including the SITE Task Force and CEIPP Panel.

Case Study 1 (2019 election)

Case Study 1 involved collected intelligence on PRC foreign interference activities in support of a federal election candidate.

Intelligence associated with this case was widely disseminated, including to the SITE Task Force, the candidate’s party, Elections Canada, the Office of the Commissioner of Canada Elections, senior public servants (including the CEIPP Panel), the Minister of Public Safety, and the Prime Minister. However, in certain instances the dissemination of intelligence lacked timeliness and clarity.

For example, CSIS disseminated and then recalled a key analytical intelligence product on the case prior to the election. On October 1, 2019, CSIS released a six-page National Security Brief on PRC foreign interference activities associated with the case. The brief was disseminated to a list of named recipients, including senior public servants and representatives of the SITE Task Force. Ten days later, on October 10, CSIS recalled the product, and requested that all recipients destroy the copies that had been provided. This decision was taken by the CSIS Director, following a conversation with the NSIA. When asked by NSIRA to explain the rationale behind recalling the product, CSIS indicated that neither the Director nor the Director’s office could remember the specifics of the decision, other than that it was by request of the NSIA.

At the same time, the analysis and associated assessment included in the product were provided (though not necessarily with the same detail) in oral briefings. On September 28, CSIS (in its capacity as a member of the SITE Task Force and facilitated by PCO) briefed Secret-cleared members of the candidate’s party on the intelligence indicating PRC foreign interference. Two days later, on September 30, the CSIS Director briefed this intelligence and CSIS’s assessment to the CEIPP Panel.

The Prime Minister was not directly briefed by CSIS on intelligence regarding PRC foreign interference associated with the case until February of 2021, sixteen months following the election. Nonetheless, the Prime Minister may have indirectly been made aware of the relevant CSIS intelligence. PCO noted that a briefing by PCO to the Prime Minister’s Office (PMO) on “issues related to [Case Study 1] likely took place in late September/early October 2019”, but could not provide NSIRA any documentation to this effect. Further, there is evidence to suggest that the Prime Minister was informed of the content of CSIS’s September 28 briefing on September 29.

In December 2019, the PCO Assistant Secretary of Security and Intelligence prepared a memorandum to the NSIA recommending that the NSIA brief the Prime Minister’s Chief of Staff on CSIS’s assessment [**redacted**]. The briefing would also have raised the potential vulnerabilities in the candidate nomination process. PCO indicated that there was no record confirming that the memorandum was delivered to the NSIA (though PCO was “confident that [the NSIA] was made aware of the information it contained”) and no record that the PMO was briefed as per the memorandum’s recommendation. The NSIA and the Clerk of the Privy Council, as members of the CEIPP Panel, received the September 30, 2019, briefing. In January 2020, CSIS briefed them again on the same issue. CSIS then briefed the Minister of Public Safety on the case in March 2020.

Figure 1: Graphic of Key dates, dissemination of intelligence on Case Study 1

Figure 1. Keydates, dissemination of intelligence on Case Study 1

[**Figure has been edited to remove injurious information**]

Early intelligence reporting on foreign interference activities related to the case did not sufficiently distinguish typical political activity from threat-related foreign interference. While this distinction was largely implicit, absent a clear articulation of why CSIS believed that specific activities constituted foreign interference, consumers – particularly those familiar with the tactics of political campaigns – may not have appreciated the intended import of the intelligence provided.

Case Study 2 (2021 election)

Case Study 2 involved collected intelligence on PRC foreign interference activities [**redacted**].

Intelligence associated with Case Study 2 was disseminated to [**redacted**], the SITE Task Force, the CEIPP Panel and, shortly following the election, the Prime Minister.  

While this dissemination was timely, CSIS deviated from its most common dissemination practices by limiting the number of written Intelligence Reports. It is unclear whether there was an explicit, blanket decision to suspend all Intelligence Report production on Case Study 2 during the election period, or whether the lack of Intelligence Reports was the natural consequence of case-by-case situational factors.

CSIS considered several options for addressing/mitigating foreign interference in this case. [**redacted**]. CSIS deliberated as to whether [**redacted**] should occur before or after the election. Ultimately, the risks of [**redacted**] were considered prohibitive. CSIS noted in particular the risk that if its efforts became public, CSIS might be blamed for interfering in the democratic process [**redacted**].

[**Two sentences deleted to remove injurious information. The sentences describe the dissemination of intelligence related to PRC foreign interference activities**].

Figure 2: Graphic of Key dates, dissemination of intelligence on Case Study 2

Figure 2. Key dates, dissemination of intelligence on Case Study 2

[**Figure has been edited to remove injurious information**]

As in Case Study 1, there were also issues in terms of consumers understanding the intended significance of the intelligence provided. For example, a member of the CEIPP Panel requested clarification as to how the activities were “deceptive and clandestine” (key components of CSIS’s definition of foreign interference) [**redacted**]. [**redacted**]. CSIS further noted that the PRC [**redacted**], ignoring the general notice from GAC to all foreign diplomatic missions in Canada that direct or indirect [**involvement**] in the election was inappropriate.

The intelligence CSIS collected was provided to relevant entities – in particular the CEIPP Panel [**redacted**] – in advance of the election. Indeed, according to those familiar with the Panel’s work, [**redacted**] was considered a clear “success” in terms of the 2021 election. This perception is generally shared by CSIS, [**redacted**] informing senior public officials [**redacted**].  

Nonetheless, CSIS deviated from its most common dissemination process, at least partly as a consequence of the subject matter (political foreign interference).  Further, that CSIS could not definitively say whether an explicit decision had been made to eschew written intelligence products is itself indicative of a lack of clarity with respect to how intelligence on political foreign interference ought to be handled, particularly during elections.

Overall, Case Study 2 is most instructive not as an example of the failed or inadequate dissemination of intelligence, but as further illustration of the unique challenges associated with disseminating intelligence on political foreign interference that, when combined with other examples and cases, reveal broader, systemic issues with how CSIS communicates the information it collects about political processes.

Case Study 3 (2021 election)

Case Study 3 involved collected intelligence on PRC foreign interference across several ridings in a specific geographic region, as well as broader campaigns, with a nexus to that region, targeting the election as a whole. There were multiple pieces of intelligence, on different activities, collected at different times, from different sources, subject to different caveats and considerations, disseminated (or not) at different moments, in different formats, to different recipients. 

Decisions regarding whether, when, and how to disseminate this intelligence were the subject of disagreement, uncertainty, and lack of communication within CSIS. This disconnect was largely between intelligence officers collecting intelligence in the region, and those responsible for disseminating that intelligence at National Headquarters (NHQ) (NHQ includes both the [**dedicated unit in NHQ combining operational and analytical capabilities (hereafter referred to as “dedicated unit in NHQ”)**]  and the CSIS executive). Put simply, intelligence officers did not understand why some of the intelligence they collected was either not disseminated at all or disseminated following what they perceived to be atypical delays. NHQ, by contrast, often had reasons for not disseminating (or delaying) intelligence – typically tied to the unique nature of political foreign interference – that were not communicated or, in the absence of standard criteria or rationale, appeared arbitrary.

Intelligence related to PRC foreign interference in a particular riding is a case in point. [**One sentence deleted to remove injurious information. The sentence discussed the date(s) of collection and the threat activities described by the intelligence**]. The desk collecting and analyzing this intelligence believed it was worthy of being placed into an Intelligence Report for dissemination, particularly because it related directly to the election. In [**Fall 2021**], multiple emails were sent from the region to the [**dedicated unit in NHQ**] requesting an explanation as to why the information had not been disseminated. Eventually, the intelligence was placed into an Intelligence Report (***) and disseminated on [**redacted**] 2021. To the desk, this delay (***) significantly reduced the impact of the information.  

Additional intelligence [**redacted**] regarding other examples/instances of PRC foreign interference was never disseminated. In [**redacted**] 2021, a regional analyst drafted an analytical product incorporating this intelligence in order to detail [**redacted**] PRC foreign interference. However, a senior analyst at the [**dedicated unit in NHQ**] found that the draft product insufficiently contextualized [**redacted**] PRC foreign interference. While the regional desk recognized [**redacted**] it nonetheless believed that appropriate caveats (as are often included in CSIS reporting [**redacted**]) could have sufficiently contextualized the information.  

[**Dedicated unit in NHQ**], by contrast, believed that [**redacted**] problematized the intelligence, such that reporting it would require “contextualizing [**redacted**]. The concern was that the [**redacted**] information [**redacted**] if disseminated absent this context and characterization. For the region, this perceived reticence to push out collected information suggested that different standards were being applied to intelligence on political foreign interference.

There were also challenges and disagreements with respect to intelligence pertaining to broader interference campaigns. Following the election, a political party sent a letter to PCO detailing what they believed to be foreign interference against their candidates in thirteen federal ridings. At the core of the party’s concerns was an online disinformation campaign directed against them.

The SITE Task Force, specifically CSIS and GAC’s Rapid Response Mechanism (RRM) team, devoted significant analysis to this campaign. Ultimately, neither CSIS nor the RRM definitively linked the campaign directly to the PRC. The SITE Task Force’s After Action Report for the 2021 election, finalized in December 2021, concluded that [**one sentence edited to remove injurious information. The sentence summarized the SITE Task Force’s conclusion that it could not definitively link online narratives against the political party to a foreign state actor**]

However, prior to the publication of this report, in [**redacted**] 2021, CSIS collected intelligence [**redacted**] the online disinformation campaign against the political party.

There was disagreement within CSIS as to how to characterize [**redacted**] in the online campaign, and whether or not intelligence about [**redacted**] should or should not be disseminated as intelligence indicating PRC foreign interference. [**Two sentences deleted to remove injurious information. The sentences discussed competing perspectives between the region and a dedicated unit in NHQ regarding how to characterize intelligence regarding potential foreign interference activities**]

The crux of these competing perspectives was differing orientations to, and appreciation for, the sensitivities associated with reporting about political foreign interference, which manifested in different attitudes regarding the threshold for intelligence reporting. [**Two sentences deleted to remove injurious information. The sentences described competing interpretations within CSIS with respect to certain intelligence on possible foreign interference activities, and corresponding differences of opinion regarding dissemination of that intelligence**] This would ensure consumers of the intelligence that CSIS was not simply reporting on the normal political activity [**redacted**] routinely involved in the political process, but rather on activities which posed a threat to Canada’s national security.  

A draft Intelligence Report detailing [**redacted**] in foreign interference during the 2021 election was not disseminated. Rather, this intelligence was repurposed into a more general product on [**redacted**] foreign interference activities overall. In July 2022, [**dedicated unit in NHQ**] advised the region that they were delaying publication of the longer intelligence product until they could secure [**redacted**]for the inclusion of [**redacted**] SIGINT as part of the analysis. The region, by contrast, felt that the product as drafted sufficiently established [**redacted**] threat activities, and ought to be disseminated right away. Given that CSIS could itself view the [**redacted**] SIGINT, delaying dissemination to include this information in the product suggests CSIS felt the need to convince consumers of CSIS’s assessment [**redacted**] rather than simply providing that assessment in its capacity as the security intelligence service of Canada. [**Dedicated unit in NHQ**] further noted that the CSIS executive planned to discuss the product with senior officials outside of CSIS (including the NSIA and the Clerk of the Privy Council) prior to finalization.

Figure 3: Graphic of Key dates, dissemination of intelligence *** in 2021 election

Figure 3. Key dates, dissemination of intelligence [**redacted**] in 2021 election

[**Figure has been edited to remove injurious information**]

Discussions about the product continued over the winter and spring of 2023, culminating in a decision to publish the product in July 2023 for CSIS-only distribution. As of November 2023, CSIS’s intelligence regarding the [**redacted**] potential involvement in foreign interference activities against the 2021 election has not been disseminated in a written intelligence product outside of CSIS, [**redacted**] years since it was initially collected.

Evaluating CSIS’s dissemination of intelligence

Finding 1: NSIRA found that CSIS’s dissemination of intelligence on political foreign interference during the 43rd and 44th federal elections was inconsistent. Specifically, in certain instances:

  • The rationale for decisions regarding whether, when, and how to disseminate    intelligence was not clear, directly affecting the flow of information; and
  • The threat posed by political foreign interference activities was not clearly   communicated by CSIS.

Finding 2: NSIRA found that CSIS’s dissemination and use of intelligence on political foreign interference was impacted by the concern that such actions could interfere, or be seen to interfere, in the democratic process.

Finding 3: NSIRA found that CSIS often elected to provide verbal briefings as opposed to written products in disseminating intelligence on political foreign interference during elections.

Finding 4: NSIRA found that there was a disconnect within CSIS between a region and National Headquarters as to whether reporting on political foreign interference was subject to higher thresholds of confidence, corroboration and contextualization for dissemination.

Within CSIS, political foreign interference is considered a subset of foreign interference more generally, while investigations touching on democratic institutions and processes are subsumed within broader procedures governing CSIS’s treatment of Canadian Fundamental Institutions.  However, intelligence on political foreign interference presents several distinct challenges which are not addressed in policy or guidelines.

CSIS confronted a basic dilemma. On one hand, information about foreign interference in elections was a priority for the government, and CSIS’s collection apparatus was geared toward investigating political foreign interference. On the other, CSIS was sensitive to the possibility that the collection and dissemination of intelligence about the election could itself be construed as a form of election interference. A basic tension held: any action – including the dissemination of intelligence – taken by CSIS prior to or during an election must not, and must not be seen to, influence that election. 

This dynamic was known within CSIS, but is not formally stated in policy or guidelines. Even more importantly, the specific criteria or considerations by which CSIS might balance these potentially competing imperatives are opaque. Absent their clear articulation, decisions appeared arbitrary. It was not always clear, particularly to those collecting intelligence, what the general rationale and/or policy guiding the dissemination of intelligence on political foreign interference was, let alone how that rationale/policy applied to specific decisions. Absent this clarity, frustration mounted (as one email opined, “if we’re not going to inform and share what we know, why are we collecting it?”).

Further, there was no clear basis to justify a decision to take action (including to outwardly report information), leading to a natural risk aversion on the part of decision-makers. Inevitably, this created frustration for those presenting decision-makers with options. Finally, because the rationale remained amorphous, there was no possibility of reasoned discussion and debate within CSIS regarding the proper calibration between the competing imperatives (to inform, but not to influence), nor any consistency in how they were balanced.

There were several instances in which intelligence was not placed into short, raw Intelligence Reports but instead held back for inclusion in longer, analytical pieces. The unique dynamics of political foreign interference may suggest that, in general, such analytical products are better vehicles for reporting collected information; as it stood, the decisions appeared ad hoc, to the point of suggesting a reluctance to place information in Intelligence Reports, as is CSIS’s typical dissemination process.

Likewise, the preference for oral briefings as the mode of dissemination during elections represented a deviation from CSIS’s most common dissemination practices. Whether justified or not, this deviation suggested special practices associated with political foreign interference in the absence of policy or procedures articulating what those special practices are or ought to be, while also creating challenges for tracking and documenting the provision of information.

This opacity with respect to process extended to approvals for counter political foreign interference activities. Whereas formal approval authority for a particular activity might reside at a certain level (for example Regional Director General), there was a recognition that the informal approval level for counter political foreign interference-related activities was the senior executive, including the Deputy Director of Operations or Director. Although not dictated by policy, it also became standard practice to “sensitize” or inform officials from PCO before CSIS could undertake certain counter-foreign interference activities.

For example, prior to the 2021 election, CSIS conducted Protective Security Briefings (PSB) in an effort to educate Members of Parliament (MPs) as to the threat of foreign interference. A regional desk planned a set of PSBs for a limited set of local MPs they determined to be at higher risk for being targets of political foreign interference. However, NHQ directed that the PSBs be paused, so that the [**dedicated unit in NHQ**] could devise a national PSB strategy along the same lines, based on lessons learned from a similar campaign prior to the 2019 election.

The national campaign was designed [**one sentence edited and one sentence deleted to remove injurious information. The sentences described CSIS methods and tactics**]. Such interest, if revealed, might be construed as inappropriate CSIS involvement in the democratic process.

Likely as a consequence of this sensitivity, the national campaign was further complicated by an extensive approvals process, which ultimately expanded to include sensitizing officials at PCO and Public Safety prior to conducting the briefings. In the end, the complexity and delay associated with the national campaign meant that it could not occur as planned. Instead, the region proceeded with as many of its initially planned PSBs as it could prior to the start of the writ period. Contact with MPs during the writ period was deemed inappropriate.

General sensitivities associated with counter-political foreign interference activities also influenced a [**one sentence edited and three sentences deleted to remove injurious information. The sentences described the objectives and implementation of a CSIS operational activity**]. This was a “conscious choice…due to political sensitivities” which, CSIS assessed, may have reduced the intended strategic impact of the [**CSIS operational activity**].  

Finally, sensitivities also influenced the dissemination of specific intelligence products. Most prominently, as discussed above, intelligence collected in [**redacted**] 2021 was ultimately published in an intelligence product for CSIS-only distribution in July 2023. After extensive delay, revision, and consultation, a senior CSIS executive decided not to disseminate the product more widely (see Case Study 3). 

At the core of the issues discussed above is a lack of clarity and communication pertaining to CSIS’s investigations of political foreign interference. Overall, the perception arose within CSIS that rules and decisions were being made, and frequently changed, absent a coherent strategy or guiding principles.

Intelligence is not evidence. Nor is it wild speculation, conjecture, or rumour. In theory, the threshold or standard for what intelligence is disseminated is uniform across the spectrum of threat-related activities. In practice, however, the cases examined demonstrate that, at the very least, there was a perception that standards were higher for intelligence related to political foreign interference. Although a senior CSIS executive told NSIRA that intelligence standards for political foreign interference were not different as compared to other threat-related information, they also outlined that there are sensitivities associated with disseminating intelligence about an individual involved in politics. For example, such information could have an impact on the career of that individual, including their ability to participate in democratic processes.

In some instances, regional collectors and analysts believed that CSIS NHQ (both [**dedicated unit in NHQ**] and senior management) placed too great an emphasis on “smoking guns” in terms of connecting activities directly to state actors.

Pushing for additional corroboration is a fundamental part of intelligence work. Standards, by their very definition, are meant to be uniform, and not differ by circumstance. Yet insisting that the push for corroboration or the standards for dissemination are the same for political foreign interference as compared to other reporting is untenable if it does not accurately reflect how decisions are made in practice. The failure to appreciate and account for the distinct nature of political foreign interference leads to confusion and consternation.

Political foreign interference often operates in the “grey-zone” between legitimate, overt political/diplomatic activity and covert, clandestine interference. Many of the consumers of intelligence on political foreign interference are familiar with political (in the case of ministers, members of parliament, and political parties) or diplomatic (for example officials at GAC) activities. This creates challenges for CSIS with respect to intelligence consumers in terms of making clear to consumers why the reporting is important and threat-related.

In short, CSIS is reporting about activities taking place in the milieu of the clients they serve. The practical implication is that any intelligence that is disseminated must sufficiently distinguish between legitimate and illegitimate activity. This can be difficult in practice, especially as the nature of PRC foreign interference in particular consists of the steady accumulation over time of activities and pressure that, in isolation and absent additional context, may appear innocuous, but in sum constitute a campaign to interfere in Canada’s democracy. PRC foreign interference is a growing rumble, not a loud bang.

There are several key shortcomings related to CSIS’s dissemination and use of intelligence on political foreign interference. First and foremost, CSIS has not clearly articulated its risk tolerance for counter political foreign interference activities. A defined risk tolerance allows those approving action to understand the parameters within which CSIS is comfortable operating.

Second, and relatedly, the approvals process for counter politicalforeign interference activities does not always reflect actual practice. For example, there are few clear directions and expectations in existing CSIS policy regarding when and why external entities – such as Public Safety and PCO – will be consulted prior to particular actions or activities, and none that account for the specific dynamics of counter political foreign interference activities noted above. Of note, in May 2023 the Minister of Public Safety issued a Ministerial Direction to CSIS on Threats to the Security of Canada Directed at Parliament and Parliamentarians, which outlines consultation principles in that specific context. However, the MD does not pertain to foreign interference against other democratic institutions.

Third, CSIS does not make explicit its thresholds for production and dissemination specifically related to intelligence on political foreign interference. That is, the level of confidence and corroboration required for collected information to be placed in an intelligence product, and the level of additional contextualization, such that the product can be disseminated to Government of Canada clients. The sensitivities associated with this type of intelligence, and the corresponding requirements for greater confidence and corroboration as compared to other types of security intelligence, should be acknowledged. For example, CSIS may wish to evaluate whether [**redacted**] criteria for Intelligence Report production are well suited for the specific nature of intelligence on political foreign interference.   

What is needed, ultimately, is a comprehensive policy and strategy specifically pertaining to all aspects of how CSIS engages – investigates, reports about, and takes action against – threats of political foreign interference. This would bring coherence across all regions and NHQ, and generally facilitate greater understanding and communication between levels of the organization, from intelligence officers to analysts to senior management. At the same time, it would signal to Government of Canada stakeholders, and in particular senior decision-makers, that CSIS has carefully considered all aspects of political foreign interference, including its unique sensitivities, and is reporting and advising on those threats using rigorous standards and thresholds. 

Canada is not alone in facing PRC political foreign interference. In the last several years, all of Canada’s Five Eyes partners (Australia, New Zealand, the US, and the UK) have publicly acknowledged the threat posed by PRC foreign interference to their respective democracies. There is a significant opportunity to leverage these shared experiences into best practices.

Recommendation 1: NSIRA recommends that CSIS develop, in consultation with relevant government stakeholders, a comprehensive policy governing its engagement with threats related to political foreign interference. This policy should:

  • make explicit CSIS’s thresholds and practices for the communication and dissemination of intelligence regarding political foreign interference. This would include the relevant levels of confidence, corroboration, contextualization and characterization necessary for intelligence to be reported;
  • clearly articulate CSIS’s risk tolerance for taking action against threats of political foreign interference;
  • establish clear approval and notification processes (including external consultations) for all activities related to countering political foreign interference;
  • make clear any special requirements or procedures that would apply during election/writ periods, as necessary, including in particular procedures for the timely dissemination of intelligence about political foreign interference; and,
  • consider best practices from international partners (in particular the Five Eyes) regarding investigating and reporting about political foreign interference.

Part 2: The SITE Task Force and the CEIPP Panel

In the wake of well-documented Russian foreign interference in the 2016 US presidential election, the Government of Canada instituted a suite of measures meant to protect the integrity of federal elections. Three such measures are pertinent to the present review:

  • Critical Election Incident Public Protocol (CEIPP) Panel. Established by Cabinet directive, the CEIPP is in place during the election period and administered by a panel of senior public servants.  The Panel assesses security and intelligence information to determine whether to make a public announcement that “an incident or an accumulation of incidents has occurred that threatens Canada’s ability to have a free and fair election.” The Protocol was not invoked – that is, no public announcements were made – in either the 2019 or 2021 election.
  • The Security and Intelligence Threats to Election (SITE) Task Force. The SITE Task Force is composed of representatives from CSIS, CSE, the RCMP, and GAC. The primary purpose of the Task Force is to provide coordinated intelligence reporting on threats to elections to the CEIPP Panel.
  • G7 Rapid Response Mechanism (RRM). Established at the 2018 G7 meeting in Charlevoix, Canada’s RRM is housed within GAC, and focuses on foreign threats to democratic processes via threat analysis and reporting on online information manipulation activities by foreign state actors. The RRM team serves as GAC’s representative on the SITE Task Force.

These entities played significant roles with respect to the flow of intelligence on PRC foreign interference during the 2019 and 2021 elections. In essence, the SITE Task Force served – or was intended to serve – as a conduit for threat intelligence, while the Panel stood in receipt of that information, with a unique mandate to communicate, or not, with the Canadian public regarding the information it was provided.

Finding 5: NSIRA found that the SITE Task Force and the CEIPP Panel were not adequately designed to address traditional, human-based foreign interference. Specifically:

  • The SITE Task Force focuses on threat activities during the election period, but traditional foreign interference also occurs between elections.
  • Global Affairs Canada’s representation on the SITE Task Force focused on online foreign interference activities.
  • The CEIPP Panel’s high threshold for a public announcement is unlikely to be   triggered by traditional foreign interference, which typically targets specific ridings.

The structure and orientation of both the Task Force and the Panel were shaped by the imperative to protect elections against widespread and coordinated foreign interference occurring up to and including Election Day. That is, to protect Canadian elections from the type of foreign interference (largely online disinformation) witnessed in the US and elsewhere.

At the same time, the security and intelligence community recognized that human-based, so-called “traditional” foreign interference had been, and continued to be, the most significant threat to Canadian democratic processes and institutions. For example, the SITE Task Force’s 2021 threat overview noted that foreign interference actors predominately used human-based tactics “partly as a result of the way that Canada conducts its elections…but also due to the efficacy of HUMINT-based influence operations as compared to cyber activities given the structure of the Canadian electoral system.” Overall, the predominance of traditional foreign interference was known prior to 2019, and subsequent experience reinforced this perception.

Despite this recognition, the parameters of the SITE Task Force and the CEIPP Panel are not aligned with the nature of the threat stemming from traditional foreign interference.

In a post-election Panel debrief, a Panel member noted that a major, widespread and successful interference campaign did not occur and that the election had been “clean” despite “some stuff” occurring. The foreign interference in a specific riding [**redacted**], according to this panelist, was “not material to the election” and therefore not of direct concern to the Panel’s remit. At the same meeting, the CSIS Director asserted that the “strongest case” of PRC foreign interference during the election were the events cited in this riding. The Director also lamented that “the machine” (the SITE Task Force and the CEIPP Panel) was not set up to address foreign interference outside of the election period.

Unlike broad patterns or campaigns (such as widespread online disinformation), intelligence on traditional foreign interference in elections is typically granular and specific, pertaining to the activities of individuals in particular ridings. Assessing the impact of those activities at the riding-by-riding level requires receiving and analyzing all relevant intelligence on an ongoing basis. This is doubly challenging given the short time frame in which elections occur.

Similarly, a core feature of traditional foreign interference is that it takes place over the long term, and is not confined simply to election periods. While the SITE Task Force is in continual operation, its capacity and operational tempo is reduced outside election periods. Moreover, its focus remains on the election period, and on the outcome/integrity of the vote on Election Day. These features undermine the Task Force’s ability to fully address traditional foreign interference, which is not confined to election periods and threatens democratic institutions more broadly. 

Consider also the inclusion of the RRM team as GAC’s representation on the Task Force. The RRM is specifically geared toward the online space, and monitoring social media for potential foreign interference activities, including the spreading and amplification of disinformation. By contrast, GAC’s capacity to analyze intelligence related to, and devise potential responses against, traditional foreign interference is not sufficiently represented on the Task Force. Traditional foreign interference frequently runs through [**redacted**]. There is a significant role for GAC to play in terms of response (for example issuing démarches or expelling diplomats) and interpretation (for example on the difference between foreign interference and legitimate diplomatic activity) that extends beyond the RRM team’s specific remit.

Finally, the CEIPP Panel’s threshold for a public announcement as to the integrity of the election is geared toward broad, systematic foreign interference such as that constituted by online disinformation campaigns or other cyber activities. This means that, in practice, the public may hear nothing from the Panel, even as significant foreign interference takes place, so long as that interference remains below what is recognized to be an incredibly high threshold.

A lack of public communication – transparency – creates several potential issues and can be interpreted in multiple ways. If information about specific foreign interference attempts emerges following the election, no communication during the election may be interpreted as a lack of action, or lack of willingness to take action, on the part of the government. If no such information emerges, the lack of communication, and associated implication that the integrity of the election was not threatened by foreign interference, may give a false impression as to the level of foreign interference that occurred.

Recommendation 2: NSIRA recommends that the SITE Task Force align its priorities with the threat landscape, including threats which occur outside of the immediate election period.

Recommendation 3: NSIRA recommends that Global Affairs Canada (GAC) and the Privy Council Office ensure that GAC’s representation on the SITE Task Force leverages the department’s capacity to analyze and address traditional, human-based foreign interference, in addition to the online remit of the Rapid Response Mechanism Team.

Recommendation 4: NSIRA recommends that the Privy Council Office empower the CEIPP Panel to develop additional strategies to address the full threat landscape during election periods, including when threats manifest in specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

This final section of the report steps away from the election-specific context to consider the flow of intelligence on PRC foreign interference between 2018 and 2023 more broadly. As noted, political foreign interference is everywhere and all the time. The intelligence community collects intelligence on PRC political foreign interference on an ongoing basis. This intelligence is shared both horizontally within the community and vertically to senior decision makers, including elected officials.

The responsible sharing of intelligence between organizations is an important feature of a healthy security and intelligence community. While sensitivities, particularly of sources and methods, make the classification of material necessary, and the need-to-know principle further conscribes the circle of individuals who may view certain information, the cross-fertilization of intelligence enhances the ability of organizations to inform decision-makers from the perspective of their particular mandates.

Finding 6: NSIRA found that the limited distribution of some CSIS and CSE intelligence to senior officials-only reduced the ability of the Royal Canadian Mounted Police, Global Affairs Canada, and the Privy Council Office to incorporate that intelligence into their analysis.

With respect to intelligence on PRC foreign interference, reporting from the core “collectors” (CSIS and CSE) informed intelligence analysis by the other security and intelligence organizations under review (GAC, the RCMP, and PCO).

However, this cross-fertilization was not without issues. For example, a GAC assessment from late August 2021 discusses CSIS intelligence indicating PRC political interference but omits other, specific CSIS intelligence directly relevant to GAC’s assessment. Given the sensitivity of the intelligence, however, the CSIS Intelligence Report pertinent to, but missing from, GAC’s analysis was sent to “named recipients only”, meaning that although senior officials at GAC had access to it, analysts within GAC’s Intelligence Bureau did not. This dynamic was typical of many Intelligence Reports produced and disseminated on PRC political foreign interference, making it challenging, on occasion, for recipient organizations to incorporate that intelligence into their own analytical assessments. 

In the case of the expulsion of PRC diplomat Zhao Wei in May 2023,  [**redacted**]. (At the same time, disagreements persisted between CSIS and GAC as to what does or does not constitute “legitimate diplomatic activity”.)

A similar dynamic pertained to CSE SIGINT on PRC foreign interference. While many End Product Reports – CSE’s standard intelligence product – were incorporated into GAC, PCO, and RCMP analysis, some of the most pertinent intelligence was classified at a level which significantly limited its distribution, due to the sensitivity of the collection method. This intelligence was available to a limited number of individuals (including senior officials) within government who possessed the requisite indoctrination.

There is a balance to be struck between protecting sensitive information by limiting its distribution and ensuring pertinent information is shared to inform intelligence analysis and potential action across the government. NSIRA did not assess whether specific intelligence products were or were not “over-classified”, other than to note that decisions regarding classification have direct consequences for dissemination.

Finding 7: NSIRA found that CSIS and Public Safety did not have a system for tracking who received and read specific intelligence products, creating unacceptable gaps in accountability.

Intelligence is shared within the Government of Canada in a multitude of ways. CSIS intelligence in particular may be shared directly by secure email, or by uploading products to platforms such as the Canadian Top Secret Network (CTSN) and CSE’s SLINGSHOT repository.  Hard copies of products can be disseminated via CSE’s Client Relations Officer (CRO) program, with embedded officers serving clients in various departments and agencies. Some departments, such as GAC and Public Safety, have their own in-house intelligence dissemination officers. Secure emails with intelligence products in attachment provide instructions to contacts regarding who in the department should receive the product (for example Deputy Ministers and Ministers).

During the review period, CSIS lacked the ability to definitively track who had received and read its intelligence. Partly this was a consequence of the internal tracking systems of the various recipient departments, who may not have comprehensively captured this data. In the end, however, it is incumbent on CSIS, as the originator of sensitive information, to control and document access.

Intelligence on the PRC targeting of a Member of Parliament

The consequences of not knowing who has read what manifested in the controversy regarding intelligence related to the PRC’s targeting of a sitting Member of Parliament.

In May 2023, media reporting revealed that the Government of Canada had intelligence that a Member of Parliament and his family members had been “targeted” for sanction by the PRC.

The media and public conversation centered around two CSIS products. First, a July 2021 CSIS Intelligence Assessment [**sentence edited to remove injurious information. The sentence described the contents of the Intelligence Assessment, which included intelligence related to PRC foreign interference activities**]. And second, a May 2021 “Issues Management Note” sent by CSIS to senior government officials to inform them that CSIS would be briefing two MPs (including the Member of Parliament in question) on PRC threat-activities against them.

The focus on these two products was misplaced. Neither was the mechanism through which the Minister and Deputy Minister of Public Safety were initially meant to be informed of the PRC’s threat activities against the Member of Parliament and his family.

Rather, [**prior to May 2021**] there was [**CSIS intelligence**] related to the PRC’s targeting of the Member of Parliament. [**CSIS intelligence was**] sent to named recipients lists which included the Deputy Minister and Minister of Public Safety. [**CSIS intelligence**] was disseminated by secure email directly to individuals and departmental contacts. The departmental contacts were directed to provide the information to named senior individuals, including the Minister of Public Safety, as these officials would not have had direct access to secure email. Additional named recipients of [**CSIS intelligence**] included the NSIA, the Clerk of the Privy Council, the Deputy Minister of National Defence, the Foreign and Defence Policy Advisor, the Chief of CSE, and other senior officials at GAC, PCO, DND, CSE, and Public Safety.

CSIS disseminated [**redacted**] 2021. [**Sentence deleted to remove injurious information. The sentence summarized CSIS intelligence**] Public Safety indicated to NSIRA that [**CSIS intelligence**] was distributed internally the week of [**redacted**] 2021 and that the “only indication is that it was sent to senior management.”  

Next, on [**redacted**] 2021, CSIS disseminated [**redacted**] containing intelligence that [**Sentence edited to remove injurious information. The sentence summarized CSIS intelligence**] Public Safety indicated to NSIRA that [**CSIS intelligence**] was distributed internally the week of [**redacted**], 2021 and that the “only indication is that it was sent to the Minister.”

Finally, on [**redacted**] 2021, CSIS disseminated [**Sentence edited to remove injurious information. The sentence summarized CSIS intelligence**] The information was required urgently as [**redacted**]. Public Safety indicated to NSIRA that it had no record of receiving this [**CSIS intelligence**].

Figure 4: Graphic of Key dates, dissemination of intelligence on targeting of a federal MP

Figure 4. Key dates, dissemination of intelligence on targeting of a federal MP

[***Figure has been edited to remove injurious information***]

As noted above, Public Safety stated that at least one [**piece of CSIS intelligence**] was provided to the Minister of Public Safety, likely as part of a weekly reading package in [**redacted**] 2021. This would have preceded by several months both the Issues Management Note of May 2021 and the Intelligence Assessment of July 2021. There is no indication that [**redacted**] was provided to the minister, despite the fact that he was a named recipient on the distribution list.

Most problematic is Public Safety’s inability to account for [**redacted**]. In the wake of the public controversy in 2023, CSIS and Public Safety compiled a chronology of relevant events. Public Safety suggested that perhaps “human error” accounted for the gap in its records, and that the file may have accidently been deleted. Further, the CSIS Director and the NSIA requested that the joint CSIS-PS chronology reflect the fact that “the distribution of a document does not indicate that a document was received or read by the recipient.” This notion – of a possible black hole between the dissemination of a critical product and its receipt on the other end – is a demonstrably unacceptable state of affairs.

As this case makes clear, it is incumbent on CSIS to implement a system that comprehensively tracks the dissemination and receipt of its own intelligence, including, in the case of certain prioritized intelligence, who has read specific products. Prioritized intelligence could include highly sensitive and urgent intelligence, for example regarding threats of foreign interference against elections or other key democratic institutions or processes.

Recommendation 5: NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received intelligence products. In the case of highly sensitive and urgent intelligence, this should include documenting who has read intelligence products.

At the same time, tracking who has read what is not a panacea. There must be interest on the part of consumers for the intelligence they receive, and an understanding as to how the intelligence can support the fulfillment of their responsibilities.

Finding 8: NSIRA found that the dissemination of intelligence on political foreign interference from 2018 to 2023 suffered from multiple issues. Specifically:

  • Intelligence consumers did not always understand the significance of the intelligence they received nor how to integrate it into their policy analysis and decision-making;
  • There was disagreement between intelligence units and senior public servants as to whether activities described in specific intelligence products constituted foreign interference or legitimate diplomatic activity.

Finding 9: NSIRA found that there was disagreement between senior public servants and the NSIA as to whether intelligence assessments should be shared with the political executive. Ultimately, the NSIA’s interventions resulted in two products not reaching the political executive, including the Prime Minister.

Finding 10: NSIRA found that the NSIA’s role in decisions regarding the dissemination of CSIS intelligence products is unclear.

In multiple briefings and interviews from across the community, NSIRA heard about the challenge of articulating the “so-what” in intelligence analysis. Part of this challenge stems from so-called “literacy gaps” between the intelligence and policy communities; that is, low policy literacy on the part of intelligence analysts, and low intelligence literacy on the part of policy analysts or policymakers. This gap can create confusion as to what intelligence is for, and what can be done about the threats that intelligence describes.

Consider for example the emphasis on “actionable” intelligence or “recommendations” for action that consumers look to the intelligence community to provide. Not all intelligence will come with these characteristics. Instead, intelligence may be provided for information and awareness purposes only (including to increase the salience of important trends and threats). Intelligence analysts explained that, ultimately, it is the consumers of intelligence who have the mandate to take action (including to shape strategic policy), while the analyst’s job is to provide them with information that best allows them to do so.

The core function of the intelligence process is the provision of intelligence analysis to policymakers. In-depth analysis – the weaving together of disparate data into a coherent narrative, with judgments and assessments as to the implications of the information presented – is the purview of dedicated units within security and intelligence agencies, such as CSIS’s Intelligence Assessment Branch (IAB) and PCO’s Intelligence Assessment Secretariat (IAS). It is the job of analysts to contextualize collected intelligence for senior consumers.

The dissemination of intelligence to the political executive can occur verbally, in both formal and informal briefings, by senior public servants, such as Deputy Ministers and, in the case of the Prime Minister, the NSIA. At the same time, written analytical products can provide the political executive with key analysis and pressing takeaways regarding threats to the security of Canada.

PCO “Special Report”

In the fall of 2021, the acting NSIA received a series of briefings from PCO IAS on PRC foreign interference. In order to understand more about the issue the acting NSIA commissioned a “Special Report” that would combine foreign intelligence (the traditional purview of IAS) with domestic, security intelligence (CSIS’s domain).

In broad terms, the Special Report was intended to provide a “summary assessment of China’s foreign interference (FI) activities, both in Canada and internationally.” The report was based on over [**redacted**] CSIS reports, [**redacted**] reporting, and open source analysis. Key judgements included that the “Canadian intelligence community is of the consensus view that China poses the most significant foreign interference (FI) threat to Canada” that “Canada remains [**redacted**] to China’s FI efforts”, and finally that “China’s FI efforts are sophisticated, persistent and multidimensional. Electoral interference is only a subset of China’s broader FI efforts.”  

In late November 2021, IAS shared a draft of the report with CSIS for comment and feedback. A senior CSIS executive responded positively to the product, suggested a few areas for improvement, and provisionally approved PCO’s proposed dissemination list, contingent on the CSIS Director also reviewing the report. The list included “Senior PMO” as well as deputy ministers (or equivalent) across relevant departments (Justice, GAC, DND, Public Safety, CSIS and CSE). At the same time, PCO IAS requested that its production team provide a copy of the report to the Clerk of the Privy Council, the Deputy Clerk, and PMO (noting that the acting NSIA had already received a copy).

This did not occur. Shortly following the emailed request, a senior employee within IAS contacted the production team in person and told them not to share the product as instructed, as IAS had “determined that a feedback and steerage discussion with the a/NSIA…was required first, before finalizing the report and sharing it more broadly.” In mid-December, the acting NSIA provided additional feedback on the paper, which was incorporated into a second draft. This feedback concerned the tone of the paper, and in particular clarifying whether what the paper described included standard diplomatic activity.

In January 2022, a new NSIA was appointed. IAS briefed the new NSIA on the Special Report, and provided them, along with other senior executives in the NSIA’s branch, a hard copy with a covering note. The covering note was sent by the Assistant Secretary of IAS (the most senior individual within IAS) and addressed to the NSIA. It briefly described the contents of the Special Report and explicitly recommended that the report be approved and “provided to select Deputy Ministers and Cabinet Ministers.”

In February 2022, there were no bilateral meetings between the Assistant Secretary of IAS and the NSIA, and no further discussions on the Special Report. PCO explained to NSIRA that the Freedom Convoy in Ottawa and Russia’s invasion of Ukraine were the government’s top security priorities during this period. In early March 2022, elements of the Special Report were included in talking points prepared for the NSIA ahead of a briefing. NSIRA did not obtain the details as to who the NSIA briefed at this time as they were withheld by PCO as a Cabinet confidence. In April 2022, an electronic version of the Special Report was made available to the NSIA [**redacted**] but was not accessed during that time. PCO had no further records of any discussions regarding the Special Report, until renewed interest following portions of the report appearing in media reporting in early 2023.

Figure 5: Graphic of Key dates, PCO “Special Report”

Figure 5. Key dates, PCO “Special Report”

[**Figure has been edited to remove injurious information**]

Ultimately, the Special Report remained in draft form, and was never approved, finalized, or disseminated. While several senior public servants at CSIS and PCO read draft versions of the product,  it never reached Cabinet Ministers or the PMO.

PCO cited several reasons to NSIRA as to why the Special Report was never disseminated. The relevant portion of their response is provided in full here:

The report was not published for various reasons. First, its original purpose was to inform the then A/NSIA…on foreign interference, which it accomplished. [The] A/NSIA, [the new] NSIA [as of January 2022], as well as other senior PCO officials benefitted broadly from the analysis, which helped inform the development of policy advice and engagement with counterparts. Furthermore, the document was drafted immediately prior [to] the “Freedom Convoy” and the start of the Russia-Ukraine war. The Government, the NSIA and, to some extent, IAS were focused on these pressing priorities. In addition, the domestic analysis portion of the assessment was largely based on already published and disseminated CSIS material. While depicting an alarming situation, it did not refer to any specific issue that would have required a government decision or an immediate tactical response.

As such, given the fact that the document had fulfilled its purpose, other pressing priorities had emerged, and that the NSIA had outstanding questions and comments pertaining to the document, [the NSIA] did not direct [the Assistant Secretary of IAS] to publish the document, nor did [the Assistant Secretary of IAS] choose to publish the product on [their] own authority. This “test-case” analysis – which combined domestic and foreign intelligence – was nonetheless useful and demonstrated the potential of that type of assessment moving forward.

PCO did not specify to NSIRA what the NSIA’s “outstanding questions and comments pertaining to the document” were, and how they may have contributed to the decision not to finalize the report and disseminate it to the political level. Nor did the NSIA indicate the authority of the Assistant Secretary of IAS to disseminate intelligence products contrary to a decision from the NSIA. Moreover, the expressed purpose of the report was to provide a general overview of PRC foreign interference, not to provide information requiring a specific “government decision or…immediate tactical response.” The point, in other words, was precisely to depict “an alarming situation”, for the awareness of decision-makers. Indeed, the rationale outlined by PCO above belie sentiments expressed in internal PCO correspondence, in which analysts and management alike discuss the import of the Special Report, in addition to the support and concurrence for the report’s analysis provided by a senior CSIS executive and a senior CSIS intelligence analyst. There was a feeling within IAS that the report would be impactful, given the full view it provided of PRC foreign interference activities. Elsewhere, a CSIS executive noted that the product was being developed “to provide to decision makers so they understand the enormity of the situation.” This feeling is reflected in the aforementioned recommendation, in January 2022, that the Special Report be shared with members of Cabinet.

CSIS “Targeting Paper”

In early 2021, a CSIS analyst produced a report combining SIGINT [**one sentence edited and one sentence deleted to remove injurious information. The sentences discussed collection methods and technical systems**]. The report provided analysis of PRC foreign interference activities against federal Canadian political actors [**redacted**]. The intent was to provide an overview to policymakers of the PRC’s strategy and tactics related to the “targeting” (for influence/interference) of [**redacted**]. CSIS characterized the report as the “most complete and detailed analysis of PRC foreign interference directed against political actors produced to date.”

A final draft of the report – known as the “Targeting Paper” – was completed in June 2021. According to CSIS, the report was circulated at this time to a small number of senior officials (though NSIRA cannot confirm this as it is not reflected in CSE tracking logs for the product). Nonetheless, the product remained unpublished and was not formally disseminated. 

CSIS provided several reasons as to why the report did not move forward at the time, including logistical challenges associated with the classification of the material (which made distribution difficult), the impact of COVID-19, management turnover, legal issues [**redacted**], and the overall sensitivity of the content (which required consulting on distribution with the senior executive). According to a senior CSIS executive, there was never any intent for the report not to go out, as it was considered to be an important product. 

In October 2022, the author of the report reached out to CSIS management to push for the product’s publication, given the significant interest in foreign interference generated by the media leaks. In November 2022, CSIS began coordinating [**redacted**] the report’s publication. The intent was to publish the report in CSE’s SLINGSHOT repository as a CSIS product. Over the next two months, conversations centred on the distribution list and intended “roll out” of the report. CSIS determined that it would initially go to senior public servants and, shortly thereafter, to the “political level” (e.g. relevant ministers). In early February, a limited distribution list of senior public servants was finalized. The report was then published in SLINGSHOT on February 13, 2023.

Nine days later, on February 22, the report was made inaccessible. During the period in which the product was available, records indicate that it was seen by roughly 40 public servants, including the NSIA, the Clerk of the Privy Council, and the CSIS Director.

The decision to make the report inaccessible was made by the CSIS Director, at the request of the NSIA. When asked about this decision by NSIRA, the Director’s office replied that “to the [Director’s] recollection it was decided [to pause the report] because the information was extremely sensitive and there needed to be further discussions regarding its distribution. The request was not to limit or censor the report but to ensure proper readership.” Specifically, according to the Director, the NSIA’s concern was that the “distribution list was too large given the content.” As of November 2023, no revised distribution list had been approved, and the report remained unavailable.

PCO confirmed that the NSIA’s request to pause the product was predicated on the NSIA’s belief that the initial distribution list was too wide. In addition, however, “the NSIA had posed questions for CSIS response pertaining to what possible actions could/would be taken about the intelligence contained in the report.” CSIS, for its part, made no reference to any such request in their responses to NSIRA regarding the product. Most strikingly, PCO explained that it “was also the NSIA’s view that the activity indicated in the report did not qualify as foreign interference, but was rather part of regular diplomatic practice.” PCO claims that this position was supported by unnamed Deputy Ministers. This is in stark contrast to CSIS’s characterization of the report as the most complete and detailed analysis of PRC foreign interference directed against Canadian political actors.

On February 24, a meeting was held at PCO to discuss the product. Attendees included the CSIS Director, the NSIA, the Chief of CSE, the Clerk of the Privy Council, the DM of Public Safety, the DM of GAC, and the report’s author (a senior CSIS analyst). According to CSIS, the outcome of this meeting was a request from the NSIA to produce a shorter and “sanitized” (i.e., with names [**redacted**] anonymized) version of the report specifically for the Prime Minister.

The CSIS analyst completed a Prime Minister-version of the report on March 9, 2023. As of November 2023, the Prime Minister has not seen, read, or had access to this product. The CSIS Director was unaware of this fact. In terms of dissemination, the CSIS analyst (the report’s author) explained that they required an approved distribution list, which only the Director and NSIA could provide, and that they could not action the report independently. CSIS further explained that “the Director’s office staff were aware…that no action on the PM version would be taken without a new distribution list from the [Director] and NSIA” but that “conflicting priorities during the spring and summer meant that the Director’s Office did not raise the issue with the Director.” Given that “neither the NSIA nor the NSIA’s office followed up with the Director on the status of the request for a PM version of the report” the Director was under the impression “that the PM had seen it.”

Figure 6: Graphic of Key dates, CSIS “Targeting” Paper

Figure 6. Key dates, CSIS “Targeting” Paper

[**Figure has been edited to remove injurious information**]

While CSIS was clear that this version of the report was drafted specifically for the Prime Minister, the Director noted that the ultimate decision as to whether or not to provide it to the Prime Minister rested with PCO. According to PCO, however, “the report in question was not specifically for the Prime Minister’s consumption.” This again is a jarring contrast in perspectives between CSIS and PCO. CSIS is under the impression that the outcome of the February 24 meeting was a directionfrom the NSIA to create a version of the Targeting Paper for the Prime Minister; this is difficult to reconcile with the NSIA’s position that this same product was not specifically intended for the Prime Minister. Moreover, based on CSE tracking records, no other senior officials – including from PCO or PMO – have seen the condensed version of the product either. As far as CSIS is aware, “the draft has not been actioned in any way.”

While the NSIA plays a coordinating role within the security and intelligence community, the bounds of this role are not formally delineated. Furthermore, given their proximity to the Prime Minister, the NSIA’s position on certain actions or decisions may carry considerable weight within the community. As such, the extent of their influence in decisions regarding the distribution of CSIS intelligence products is unclear. Ostensibly, the February 22 decision to “pause” the initial version of the Targeting Paper was made by the Director. In reality, the decision appears to have been made by the NSIA (recall, as an analogous example, the NSIA’s request to recall a CSIS intelligence product about foreign interference in the 2019 election; see paragraph 27, above).

The PCO Special Report and the CSIS Targeting Paper offer interesting parallels. Both products were meant to serve as synthesizing overviews of available intelligence on PRC political foreign interference. In the end, neither report was disseminated to the political executive, for similar reasons. The reports could have been provided for strategic planning purposes to policymakers; instead, the NSIA considered them in terms of the concrete actions/steps which could be taken in light of the intelligence provided and did not disseminate them further. 

There were also questions as to whether the reports actually described foreign interference, or instead recounted standard diplomatic activity, to the point of a flat disagreement in this regard with respect to the Targeting Paper. In assessing intelligence, disagreement and debate are important and healthy. Nonetheless, the delta between CSIS’s point of view and that of the NSIA in this case is significant, because the question is so fundamental. CSIS collected, analyzed, and reported intelligence about activities that it considered to be significant threats to national security; one of the primary consumers of that reporting (and the de facto conduit of intelligence to the Prime Minister) evidently disagreed with that assessment. Commitments to address political foreign interference are straightforward in theory, but will inevitably suffer in practice if rudimentary disagreements as to the nature of the threat persist in the community.

Recommendation 6: NSIRA recommends that Public Safety Canada, Global Affairs Canada, the Privy Council Office, and other regular consumers of intelligence, enhance intelligence literacy within their departments.

Recommendation 7: NSIRA recommends that the security and intelligence community develop a common, working understanding of political foreign interference.

Recommendation 8: NSIRA recommends that the role of the National Security and Intelligence Advisor to the Prime Minister, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Conclusion

The security and intelligence community is of the consensus view that political foreign interference is a significant threat to Canada, and that the PRC is a major perpetrator of this threat at all levels of government. Nonetheless, the present review of how intelligence related to PRC political foreign interference was disseminated from 2018 to 2023 (a period covering the last two federal elections) indicates that there were significant disagreements between constituent components of that community, both within and across organizations, as to whether, when, and how to share what they knew.

Three basic schisms existed. First, within CSIS: the Service struggled to reconcile competing imperatives (report but don’t interfere) given the unique sensitivities of political foreign interference, particularly in and around elections. This resulted in deviations from typical dissemination practices, and corresponding consternation on the part of some intelligence collectors and analysts.

Second, in the “machine” of election security: the SITE Task Force and CEIPP Panel were geared toward broad, systematic interference and therefore could not adequately address so-called traditional, riding-by-riding interference, despite the recognition that this type of threat is the most prevalent in Canada. The Panel’s threshold meant that it did not communicate to the Canadian public about the foreign interference it observed in either the 2019 or 2021 federal elections.

Third, between intelligence analysts and senior public servants: PCO and CSIS analysts produced overviews of what they considered to be PRC foreign interference activities (and therefore threats to national security) but which the NSIA saw as recounting standard diplomatic activity. This fundamental disagreement led, in part, to those intelligence products not reaching the political executive, including the Prime Minister.

These disagreements and misalignments underscore a basic challenge: the so-called “grey zone” whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. This challenge was ever-present in the activities under review, influencing decisions about whether to disseminate and how to characterize what was shared, while raising sensitivities in terms of reporting about activities which skirt the political and diplomatic realms. The risk of characterizing legitimate political or diplomatic behaviour as a threat led some members of the intelligence community to not identify certain activities as threat activities. 

The security and intelligence community grappled with these challenges during a time of significant geopolitical change. Canada’s relationship with the PRC, in particular, has deteriorated since 2018. Not coincidently the trajectory over the review period was toward greater recognition and consensus as to the extent of the threat posed by PRC foreign interference. Yet even as the community comes into alignment, there remain significant impediments to the flow of information about this threat. The recommendations provided in this report address these deficiencies. Their aim, in the end, is to ensure that those receiving intelligence – the decision- and policy-makers ultimately responsible for the security of the country – are able to take effective, informed action.

Annex A. Findings and Recommendations

NSIRA made the following findings and recommendations in this review:

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

Finding 1: NSIRA found that CSIS’s dissemination of intelligence on political foreign interference during the 43rd and 44th federal elections was inconsistent. Specifically, in certain instances:

  • The rationale for decisions regarding whether, when, and how to disseminate intelligence was not clear, directly affecting the flow of information; and
  • The threat posed by political foreign interference activities was not clearly communicated by CSIS.

Finding 2: NSIRA found that CSIS’s dissemination and use of intelligence on political foreign interference was impacted by the concern that such actions could interfere, or be seen to interfere, in the democratic process.

Finding 3: NSIRA found that CSIS often elected to provide verbal briefings as opposed to written products in disseminating intelligence on political foreign interference during elections.

Finding 4: NSIRA found that there was a disconnect within CSIS between a region and National Headquarters as to whether reporting on political foreign interference was subject to higher thresholds of confidence, corroboration and contextualization for dissemination.

Part 2: The SITE Task Force and the CEIPP Panel

Finding 5: NSIRA found that the SITE Task Force and the CEIPP Panel were not adequately designed to address traditional, human-based foreign interference. Specifically:

  • The SITE Task Force focuses on threat activities during the election period, but traditional foreign interference also occurs between elections.
  • Global Affairs Canada’s representation on the SITE Task Force focused on online foreign interference activities.
  • The CEIPP Panel’s high threshold for a public announcement is unlikely to be triggered by traditional foreign interference, which typically targets specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

Finding 6: NSIRA found that the limited distribution of some CSIS and CSE intelligence to senior officials-only reduced the ability of the Royal Canadian Mounted Police, Global Affairs Canada, and the Privy Council Office to incorporate that intelligence into their analysis.

Finding 7: NSIRA found that CSIS and Public Safety did not have a system for tracking who received and read specific intelligence products, creating unacceptable gaps in accountability.

Finding 8: NSIRA found that the dissemination of intelligence on political foreign interference from 2018 to 2023 suffered from multiple issues. Specifically:

  • Intelligence consumers did not always understand the significance of the intelligence they received nor how to integrate it into their policy analysis and decision-making;
  • There was disagreement between intelligence units and senior public servants as to whether activities described in specific intelligence products constituted foreign interference or legitimate diplomatic activity.

Finding 9: NSIRA found that there was disagreement between senior public servants and the NSIA as to whether intelligence assessments should be shared with the political executive. Ultimately, the NSIA’s interventions resulted in two products not reaching the political executive, including the Prime Minister.

Finding 10: NSIRA found that the NSIA’s role in decisions regarding the dissemination of CSIS intelligence products is unclear.

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

Recommendation 1: NSIRA recommends that CSIS develop, in consultation with relevant government stakeholders, a comprehensive policy governing its engagement with threats related to political foreign interference. This policy should:

  • make explicit CSIS’s thresholds and practices for the communication and dissemination of intelligence regarding political foreign interference. This would include the relevant levels of confidence, corroboration, contextualization and characterization necessary for intelligence to be reported;
  • clearly articulate CSIS’s risk tolerance for taking action against threats of political foreign interference;
  • establish clear approval and notification processes (including external consultations) for all activities related to countering political foreign interference;
  • make clear any special requirements or procedures that would apply during election/writ periods, as necessary, including in particular procedures for the timely dissemination of intelligence about political foreign interference; and,
  • consider best practices from international partners (in particular the Five Eyes) regarding investigating and reporting about political foreign interference.

Part 2: The SITE Task Force and the CEIPP Panel

Recommendation 2: NSIRA recommends that the SITE Task Force align its priorities with the threat landscape, including threats which occur outside of the immediate election period.

Recommendation 3: NSIRA recommends that Global Affairs Canada (GAC) and the Privy Council Office ensure that GAC’s representation on the SITE Task Force leverages the department’s capacity to analyze and address traditional, human-based foreign interference, in addition to the online remit of the Rapid Response Mechanism Team.

Recommendation 4: NSIRA recommends that the Privy Council Office empower the CEIPP Panel to develop additional strategies to address the full threat landscape during election periods, including when threats manifest in specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

Recommendation 5: NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received intelligence products. In the case of highly sensitive and urgent intelligence, this should include documenting who has read intelligence products.

Recommendation 6: NSIRA recommends that Public Safety Canada, Global Affairs Canada, the Privy Council Office, and other regular consumers of intelligence, enhance intelligence literacy within their departments.

Recommendation 7: NSIRA recommends that the security and intelligence community develop a common, working understanding of political foreign interference.

Recommendation 8: NSIRA recommends that the role of the National Security and Intelligence Advisor to the Prime Minister, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Share this page
Date Modified:

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023: Notification Letter

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023


Notification Letter


Date of Publishing:

Letter to the Prime Minister

April 26, 2024

The Right Honourable Justin Trudeau, P.C., M.P.
Prime Minister of Canada
80 Wellington Street
Ottawa, ON K1A 0A2

Dear Prime Minister,

On behalf of the National Security and Intelligence Review Agency (NSIRA), it is my pleasure to present you with our special report on the Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023.

This review was conducted under the authority of paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act (NSIRA Act).

The review assessed the flow of information, within government, regarding political foreign interference activities carried out by the People’s Republic of China between 2018 and 2023, a period covering the last two federal general elections. Consistent with its mandate and the terms of reference, NSIRA reviewed, among other things: the dissemination practices of the Canadian Security Intelligence Service; the operation of key entities established by the government to protect the integrity of Canada’s elections; and the role of senior public servants, including the National Security and Intelligence Advisor to the Prime Minister, in the dissemination of intelligence. You received a classified version of this report on March 5, 2024.

From the outset of its review, while working independently from the National Security and Intelligence Committee of Parliamentarians (NSICOP), NSIRA helped ensure there was no unnecessary duplication of work between the two review bodies. On March 5, 2024, NSIRA notified NSICOP, as well as the Public Inquiry into Foreign Interference in Federal Electoral Processes and Democratic Institutions, that NSIRA’s classified report had been finalized and provided to you.

At that time, NSIRA further informed you that it was of the opinion that it was in the public interest to report on this matter and would therefore, pursuant to section 40 of the NSIRA Act, be submitting to you a special report to be tabled in Parliament. Over a period of six weeks, in accordance with paragraph 52(1)(b) of the NSIRA Act, NSIRA undertook the required consultations with the deputy heads of concerned agencies and departments to ensure that this special report does not contain information the disclosure of which would be injurious to national security, national defence, or international relations or information that is subject to solicitor-client privilege, the professional secrecy of advocates and notaries, or litigation privilege.

Recognizing the importance of this topic to Canadians, NSIRA made every effort to draft the report in a manner that would be largely releasable. NSIRA sought specific explanations for the redactions that were made and is satisfied that the presented version of the report is the most thorough version that can be released. The findings and recommendations in NSIRA’s classified report did not contain any injurious or privileged information. As such, the findings and recommendations of the special report are identical to those contained in the classified report. 

In line with obligations under the NSIRA Act, this report must be tabled in each House of Parliament within the first 15 days on which that House is sitting. NSIRA will not comment on the contents of its report until such time as this special report is tabled in Parliament, owing to parliamentary privilege.

This report contains 8 recommendations. We ask that the Government indicate to NSIRA whether it agrees with these recommendations and, if so, to explain how they will be implemented. The thorough and timely consideration of NSIRA’s recommendations is essential to ensuring that NSIRA’s efforts with regard to the accountability of government institutions yield results. If and when available, NSIRA may publish the Government’s responses to its recommendations alongside the version of this report on NSIRA’s website and may include them in an Annual Report.

Yours sincerely,

The Honourable Marie Deschamps, C.C.

Chair // National Security and Intelligence Review Agency

Share this page
Date Modified:

Communications Security Establishment’s Governance of Active and Defensive Cyber Operations: Government Responses

Communications Security Establishment’s Governance of Active and Defensive Cyber Operations


Government Responses

Date of Publishing:

Executive Summary

This was NSIRA’s first review of CSE’s governance of Active and Defensive Cyber Operations (ACO/DCOs). The review assessed the governance framework that guides the conduct of ACO/DCOs and whether CSE appropriately considers its legal obligations and the foreign policy impacts of operations.

CSE’s authority to conduct ACO/DCOs was introduced in 2019 through the Communications Security Establishment Act. These powers did not exist prior to the introduction of that legislation and are important new capabilities for the Government of Canada. The current global environment is clarifying the relevance of these capabilities and authorities for Canada. 

 In keeping with its commitment to lawfulness, CSE has worked diligently and methodically to operationalize these new authorities. As CSE continues to develop this capability, it is proceeding cautiously to ensure all activities are carried out in accordance with the CSE Act, and in line with Canada’s international obligations, in particular those highlighted in Canada’s recently published statement on the application of International Law in cyberspace.

CSE acknowledges the crucial role that review bodies play in the national security and intelligence community and CSE welcomes reviews by and recommendations from these review bodies. NSIRA’s recommendations from its review of CSE’s ACO/DCO governance framework will help guide the development of CSE’s capabilities so that CSE can continue to ensure lawfulness as well as effectiveness, efficiency and responsiveness.

As a crucial partner in the ACO/DCO governance framework, NSIRA engaged GAC in this review and made recommendations in relation to both GAC and CSE. CSE and GAC are pleased to provide the following response to NSIRA’s recommendations.


Recommendation no.1:

CSE should more precisely define the classes of activities, associated techniques, and intended target sets to be undertaken for Active and Defensive Cyber Operations as well as their underlying rationale and objectives, both in its Applications and associated Ministerial Authorizations for these activities.

CSE’s response:

CSE agrees with this recommendation.

While CSE agrees with this recommendation, CSE notes that the Minister is always provided with a sufficient amount of information and detail necessary to assess the application and grant an authorization.

CSE agrees that, where operationally appropriate, combining the information contained in briefings and presentations into the written application and authorisation will provide a more comprehensive written record. CSE has begun refining the information included in Active Cyber Operations (ACO) and Defensive Cyber Operations (DCO) applications and authorisations.


Recommendation no.2:

GAC should include a mechanism to assess all relevant foreign policy risk parameters of Active and Defensive Cyber Operations within the associated Ministerial Authorizations.

GAC’s response:

GAC agrees with this recommendation.

GAC already includes a consideration of a wide variety of factors in its Foreign Policy Risk Assessment, as identifiable in the Foreign Policy Risk Assessment template.

CSE has also in the past provided separate operational/technical risk assessments in its mission plans. This has included additional information about the targets and their activities on the GII, the technologies they use, or the complex technical systems CSE develops and deploys to conduct these operations.


Recommendation no.3:

CSE and GAC should establish a framework to consult key stakeholders, such as the National Security and Intelligence Advisor to the Prime Minister and other federal departments whose mandates intersect with proposed Active Cyber Operations to ensure that they align with broader Government of Canada strategic priorities and that the requirements of the CSE Act are satisfied.

Joint CSE and GAC response:

In principle, CSE and GAC agree with this recommendation.

All relevant Government of Canada stakeholders whose mandates may intersect with a planned ACO are consulted. We agree with the importance of ensuring alignment with broad Government of Canada strategic priorities and believe there are a number of avenues already in place through which updates can be shared and consultations can be undertaken with the broader security and intelligence community as and when needed. Examples of this include the Assistant Deputy Minister (ADM) and Deputy Minister (DM) level security and intelligence committee infrastructure (e.g. ADM National Security Operations Committee, DM Operations Committee) and the geographic-specific committee infrastructure. Additionally, there is a community-wide intelligence priority process that provides a framework and guidance for intelligence-related activities such as cyber operations.

We appreciate that as the types of ACOs considered and undertaken broaden, the current model for consulting government departments and agencies may need to evolve. CSE and GAC will work together to evolve an appropriate consultation framework over time as needed.


Recommendation no.4:

CSE and GAC should develop a threshold that discerns between an Active Cyber Operation and a pre-emptive Defensive Cyber Operation, and this threshold should be described to the Minister of National Defence within the applicable Ministerial Authorizations.

Joint CSE and GAC response:

CSE and GAC disagree with this recommendation.

CSE and GAC cannot agree with this recommendation as it refers to an activity (pre-emptive Defensive Cyber Operation) that is not provided for in the Communications Security Establishment Act (CSE Act) and that CSE does not conduct.

Under the DCO aspect of CSE’s mandate in section 18 of the CSE Act, CSE is authorized to carry out activities on or through the global information infrastructure to help protect federal institutions’ electronic information and information infrastructures and electronic information and information infrastructures designated under the CSE Act as being of importance to the Government of Canada (relevant infrastructure). The threat does not need to have compromised the information or infrastructure before a DCO is initiated, but it must present a credible threat to the designated information infrastructure(s). (U) In circumstances where CSE is aware a cyber threat exists but this threat has not manifested as a threat to the designated infrastructure(s), CSE can consider conducting an ACO. CSE can only conduct an ACO if it can satisfy the Minister that any intended activities would degrade, disrupt, influence, respond to or interfere with the capabilities, intentions or activities of a foreign individual, state or organisation or terrorist group as they relate to international affairs, defence or security.

If NSIRA believes that CSE and GAC need to more clearly define the threshold between an ACO and a DCO, then CSE and GAC also disagree with this recommendation on the basis that the CSE Act clearly sets out the conditions that CSE must satisfy before undertaking cyber security activities, DCOs or ACOs. There is no need for any other threshold to be created.


Recommendation no. 5:

In its applications to the Minister of National Defence, CSE should accurately describe the potential for collection activities to occur under separate authorizations while engaging in Active and Defensive Cyber Operations.

CSE’s response:

CSE agrees with this recommendation.

CSE already accurately describes the potential for collection activities, and the authority for such activities, in its applications to the Minister of National Defence.  CSE has taken steps to ensure that applications for and authorizations of ACOs and DCOs clearly reference the authorizations under which any acquisition of information required to achieve the intended outcome of the ACO or DCO is conducted.

Importantly, CSE is not permitted to acquire information under an ACO or DCO authorization. The acquisition of the information relied on to conduct ACO and DCO activities is authorised under CSE’s foreign intelligence authorization, cybersecurity authorization or an emergency authorization. The use of this information in support of ACO and DCO purposes is outlined in CSE’s foreign intelligence and cybersecurity authorizations. These authorizations are reviewed by the Intelligence Commissioner who assesses the reasonableness and proportionality of the acquisition and use of information for ACO and DCO purposes.


Recommendation no. 6:

CSE should include all pertinent information, including targeting and contextual information, within all operational plans in place for a cyber operation, and in materials it presents to GAC.

CSE’s response:

CSE disagrees with this recommendation.

GAC requires sufficient and pertinent information upon which to base its analysis related to foreign risk and international law. CSE has worked with GAC to share the appropriate level of operational detail that GAC has requested to conduct their work.  This need is reflected in the CSE-GAC Governance Framework whereby GAC is provided with an operation-specific Mission Plan to inform its Foreign Policy Risk Assessment. GAC is satisfied with the information provided by CSE. When GAC has required additional information to conduct its Foreign Policy Risk Assessment or international law assessment, CSE has provided the supplemental information requested.


Recommendation no. 7:

CSE should provide a structured training program to its employees involved in the execution of Active and Defensive Cyber Operations (ACO/DCOs), to ensure that they have the requisite knowledge of CSE’s legal authorities, requirements, and prohibitions, as required by the associated Ministerial Authorizations.

CSE’s response:

CSE agrees with this recommendation.

To supplement the existing mandatory annual training and testing that covers CSE’s legal authorities, requirements and prohibitions, CSE will consider developing a tailored training program for employees involved in the planning and execution of ACOs and DCOs.


Recommendation no. 8:

CSE and GAC should provide an assessment of the international legal regime applicable to the conduct of Active and Defensive Cyber Operations. Additionally, CSE should require that GAC conduct and document a thorough legal assessment of each operation’s compliance with international law.

Joint CSE and GAC response:

CSE and GAC partially agree with this recommendation.

In the time since this review concluded, GAC and CSE have continued to develop the process for assessing the international legal implications of cyber operations, with GAC’s Legal Bureau documenting a thorough legal assessment of each operation’s compliance with international law.

Procedurally, CSE submits a Mission Plan to GAC requesting a Foreign Policy Risk Assessment. Once received, GAC’s Legal Bureau leads a consultation process with Department of Justice (DOJ) counsel from both CSE’s and GAC’s Department of Legal Services (DLS), and in some cases, with DOJ counsel from the Constitutional, Administrative and International Law Section (CAILS), to discuss the international law implications of the planned operation as described in the Mission Plan. (U) These discussions are summarised in a written legal assessment recorded in the Foreign Policy Risk Assessment and are grounded in the international law analysis the GAC Legal Bureau has been developing over many years, including in the Government of Canada’s comments on the draft chapter of Tallinn Manual 2.0 in 2016, the development of the Draft Desk Book coordinated by GAC’s Legal Bureau and produced in August 2019, and the extensive legal analysis done in advance of the original ACO and DCO MAs.

GAC notes that it would be unusual to produce a comprehensive legal assessment of applicable law with respect to a range of potential or hypothetical operations that might be conducted by Canada, its allies and its adversaries in any field, cyber or otherwise. Rather it is GAC’s practice, like that of States generally, to produce legal assessments in relation to specific proposed activities or operations or court cases or other potential disputes.

GAC has consolidated its international legal analysis into a public statement on international law applicable to cyberspace. This public statement was developed and completed through extensive interdepartmental consultations among legal and policy experts, as well as an analysis of other national statements and leading publications and processes, including Tallinn Manual 2.0, the Swiss-led Expert Dialogue on International Law and Cyber, the Dutch-led Hague process, the Swiss-led Informal Consultations on International Humanitarian Law and Cyber Operations, the Oxford Process, and the US Cyber Command annual Legal Conference. Canada has joined like-minded and other nations in producing a public statement, in part to advance ongoing multilateral processes at the United Nations and elsewhere, to further develop common understandings and a broader consensus on how international law applies in cyberspace.


Recommendation no. 9:

CSE and GAC should communicate to one another all relevant information and any new developments relevant to assessing risks associated with a cyber operation, both in the planning phases and during its execution.

Joint CSE and GAC response:

CSE and GAC agree with this recommendation.

In the time since this review concluded, CSE and GAC have increased the frequency of working-level exchanges. Under the GAC-CSE Foreign Cyber Operations Governance Framework, GAC and CSE will bolster the existing points of contact and develop standard operating procedures for CSE and GAC to mutually provide any new information or developments relevant to a cyber operation.

Share this page
Date Modified:

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023: Statements

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023


Statements

Date of Publishing:

Access to Cabinet Confidences

Dear Prime Minister,

The National Security and Intelligence Review Agency (NSIRA) has initiated a review of the production and dissemination of intelligence on foreign interference in the 43rd and 44th Canadian federal elections, including how intelligence was communicated across agencies, departments and other groups in the Government of Canada.

The Right Honourable David Johnston, in his capacity as the Independent Special Rapporteur on Foreign Interference (ISR), noted in his May 23, 2023 report that he was “given access to any Cabinet documents relevant to the foreign interference issues” in the scope of his review.  He further recommended that the government disclose to NSIRA those Cabinet confidences provided to him for his review. The government has accepted this recommendation.

The scope of NSIRA’s review is distinct from the scope of the ISR’s review. In order to ensure the integrity of our review and not limit or influence our evidence base, NSIRA must have access to all documents contained in any class of documents provided, rather than a subset of these documents.

Therefore, NSIRA respectfully requests that all Cabinet confidence documents related to our review be released to us, and that all documents provided during the course of this review be without redaction for Cabinet confidence.

NSIRA recognizes the exceptional nature of this request and appreciates the significance of disclosing the requested documents. We look forward to your assistance in enabling NSIRA to access all requested documents, and to fulfilling the objectives of our independent review.

Yours sincerely,

The Honourable Marie Deschamps, C.C.
Chair, National Security and Intelligence Review Agency

Statement from NSIRA on its Review of the GOC’s Production and Dissemination of Intelligence on Foreign Interference in the 43rd and 44th Canadian Federal Elections

NSIRA considers transparency and independence to be fundamental values at the core of its mandate.  While safeguarding information that could compromise national security, NSIRA is committed to transparency and promoting democratic accountability in every possible way through its work. Through its reviews, NSIRA acts as proxy for the public and serves to enhance the trust in Canada’s oversight and review mechanisms. NSIRA has designed, scoped, and begun its review on foreign interference in the 43rd and 44th Canadian federal elections exercising this independence. In the spirit of transparency and clarity, NSIRA underscores that while the subject matter of NSIRA’s review overlaps with matters contained in NSICOP’s ongoing review and the Independent Special Rapporteur’s (ISR) report of 23 May 2023, NSIRA’s review has a different scope and follows NSIRA’s own methodology as demonstrated by its published Terms of Reference . While there may be an opportunity in NSIRA’s final report to note any observations or findings related to the ISR’s work, the purpose of NSIRA’s report is to present findings and recommendations from NSIRA’s review.

NSIRA notes that the ISR suggested that “all the documents that were provided to (him) should be provided to NSICOP and NSIRA for them to review comprehensively and identify any different conclusions than (his).” Subsequently, the government provided NSIRA with a limited number of documents originally withheld for Cabinet Confidence. In all its reviews, NSIRA requires reviewees to adhere to the NSIRA Expectations for Responsiveness in Reviews. This expectation goes to NSIRA’s independence and to the integrity of its reviews. If NSIRA is to review Cabinet confidences, it must be able to review all Cabinet confidences relevant to its review. The NSIRA Chair has sent a letter to the Prime Minister requesting that all Cabinet confidence documents related to NSIRA’s review be released to the Review Agency, and that all documents provided during the course of the review be without redaction for Cabinet confidence. A copy of that letter is published on NSIRA’s website, available online here.

Contact

For more information, please contact:

Media Relations
NSIRA
media-medias@nsira-ossnr.gc.ca

Statement from the National Security and Intelligence Review Agency on Submitting its Special Report on Political Foreign Interference to the Prime Minister

On April 26, NSIRA provided its Special Report on the Government of Canada’s production and dissemination of intelligence on foreign interference in the 43rd and 44th Canadian federal elections to the Prime Minister.

The Special Report is a redacted version of the classified report initially sent to the Prime Minister and the Ministers of Public Safety, National Defence and Foreign Affairs on March 5.

As required by section 52(1)(b) of the NSIRA Act, NSIRA consulted with deputy heads of each department and agency involved in the review to ensure that the Special Report does not contain injurious or privileged information. 

From the outset of its review, while working independently from the National Security and Intelligence Committee of Parliamentarians (NSICOP), NSIRA ensured there was no unnecessary duplication of work between the two review bodies.

In line with obligations under the NSIRA Act, the Special Report must be tabled in each House of Parliament within the first 15 days on which that House is sitting.

Owing to parliamentary privilege, NSIRA will not comment on the contents of its report until this special report is tabled in Parliament.

Recognizing the importance of this topic to Canadians, NSIRA made every effort to draft the report in a manner that would be largely releasable. Once it is tabled in Parliament, NSIRA will promptly share the Special Report with the public through its website, ensuring transparency and public awareness.

Share this page
Date Modified:

Vision, Mission & Values

NSIRA Vision, Mission and Values Graphic
NSIRA Vision, Mission and Values Graphic

Vision


An accountable , transparent and effective national security and intelligence community that upholds the rules of law.

Mission


To serve as the trusted eyes and ears of Canadians – through independent, expert review and investigation of the Government of Canada’s national security and intelligence activities.

Values


Independence

We are fair and impartial – the trusted eyes and ears of Canadians.

Professionalism

We are a highly trained, skilled and experienced workforce, producing rigorous and impactful work.

Transparency

We shed light on national security accountability and contribute to the public conversation.

Inclusiveness

We are a diverse workforce that values and benefits from a broad range of perspectives.

Share this page
Date Modified: