Department of National Defence/Canadian Armed Forces
FINTRAC
Financial Transactions and Reports Analysis Centre of Canada
GAC
Global Affairs Canada
GC
Government of Canada
IRCC
Immigration, Refugees and Citizenship Canada
NSIRA
National Security and Intelligence Review Agency
PHAC
Public Health Agency of Canada
PS
Public Safety Canada
RCMP
Royal Canadian Mounted Police
SCIDA
Security of Canada Information Disclosure Act
TC
Transport Canada
Glossary of Terms
Contribution test
The first part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (paragraph 5(1)(a)).
Proportionality test
The second part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will not affect any person’s privacy interest more than reasonably necessary in the circumstances (paragraph 5(1)(b)).
Executive Summary
This review assessed Government of Canada (GC) institutions’ compliance with the disclosure and record-keeping requirements of the Security of Canada Information Disclosure Act (SCIDA) throughout 2024. The review also captured the volume of SCIDA disclosures and identified trends in its application across GC institutions over time.
NSIRA found that the Canada Border Services Agency (CBSA), Communications Security Establishment (CSE), Canadian Security Intelligence Service (CSIS), Global Affairs Canada (GAC), Immigration, Refugees and Citizenship Canada (IRCC), and the Royal Canadian Mounted Police (RCMP) generally complied with their record-keeping obligations under the SCIDA.
Due to the substantial increase of nearly 300% in disclosures from IRCC to CSIS in 2024, NSIRA focused its review primarily on these two institutions.
During the review period, IRCC and CSIS implemented a tiered request and disclosure process which reduced the amount of third-party information disclosed by IRCC, contributing to enhanced compliance with the SCIDA. However, NSIRA found instances when the information provided to IRCC by CSIS was limited and hampered IRCC’s ability to fulfill its obligations as a disclosing institution to satisfy itself that the information disclosed is in respect of an activity that undermines the security of Canada.
In addition, NSIRA found that IRCC lacked a formal policy governing the disclosure of information about minors.
NSIRA found that CSE, in three of its requests for information under the SCIDA, provided IRCC with more information than was relevant to its disclosures.
NSIRA made four recommendations designed to ensure that institutions minimize the privacy impact to individuals in their requests and disclosures under the SCIDA.
With regard to the SCIDA’s requirement in subsection 5.1(1) that recipient institutions destroy or return unnecessary personal information, NSIRA found that CSIS may not have complied in its retention of one disclosure containing erroneous personal information.
1. Introduction
Authority
This review was conducted under the authority of paragraphs 8(1)(a), 8(1)(b), and subsection 39(1) of the National Security and Intelligence Review Agency Act (“NSIRA Act”).
In accordance with section 39 of the NSIRA Act, this review fulfills NSIRA’s requirement to submit an annual report to the Minister of Public Safety regarding disclosures made under the Security of Canada Information Disclosure Act (SCIDA, or the Act) in the preceding calendar year.
Scope
The objective of this review was to assess Government of Canada (GC) institutions’ compliance with the SCIDA’s disclosure and record-keeping requirements in 2024. The review also tracked the volume of SCIDA disclosures, analyzed usage patterns across institutions and over time, and examined how GC institutions employed information-sharing agreements.
The review’s assessment of compliance was limited to GC institutions that disclosed or received information under the SCIDA in 2024: the Canada Border Services Agency (CBSA), Communications Security Establishment (CSE), Canadian Security Intelligence Service (CSIS), Global Affairs Canada (GAC), Immigration, Refugees, and Citizenship Canada (IRCC), and the Royal Canadian Mounted Police (RCMP).
Methodology
The review was primarily based on records provided to NSIRA by disclosing and recipient institutions under subsection 9(3) of the SCIDA. It was supplemented by an examination of the institutions’ SCIDA policies and procedures, as well as their responses to related information requests.
NSIRA assessed administrative and substantive compliance with the SCIDA’s record-keeping requirements for all disclosures made by CBSA, CSE, GAC, and the RCMP. With respect to disclosures from IRCC to CSIS, NSIRA reviewed a random representative sample of 250 disclosures.
Review Statements
The NSIRA Act grants NSIRA rights of timely access to any information in the possession or under the control of a department (except for Cabinet confidences) and to receive from the department any documents and explanations NSIRA deems necessary. NSIRA monitors cooperation with access requests, including the completeness and accuracy of disclosures, which inform its overall assessment of a department’s responsiveness in each review.
CBSA, CSE, CSIS, GAC, and the RCMP met NSIRA’s expectations for responsiveness during this review. IRCC only partially met NSIRA’s expectations for responsiveness, given extended delays in IRCC’s responses to requests for information.
2. Background
The SCIDA provides an explicit, stand-alone authority to disclose information between GC institutions in order to protect Canada against activities that undermine its security. Its stated purpose is to encourage and facilitate such disclosures.
Section 9 of the SCIDA prescribes record-keeping obligations for all institutions who disclose or receive information under the Act. Subsection 9(3) requires that these records be provided to NSIRA within 30 days after the end of each calendar year.
Subsection 5(1) of the SCIDA authorizes GC institutions to disclose information—subject to any prohibitions or restrictions in other legislation or regulations—to designated recipient institutions if the disclosing institution is satisfied that (a) the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (the “contribution test”); and (b) the information will not affect any person’s privacy interest more than is reasonably necessary in the circumstances (the “proportionality test”).
Subsection 5(2) requires disclosing institutions to, at the time of the disclosure, also provide information regarding the disclosure’s accuracy and the reliability of the manner in which it was obtained.
When a GC institution receives information under the Act, subsection 5.1(1) requires that the institution destroy or return any unnecessary personal information as soon as feasible after receiving it.
The SCIDA’s guiding principles reinforce the notion that effective and responsible disclosure of information protects Canada and Canadians. Of note, subsection 4(c) suggests that GC institutions enter into an information-sharing arrangement when they regularly disclose information to the same recipient.
In 2024, GC institutions made a total of 900 disclosures under the SCIDA (see Table 1). The number of disclosures increased 235% overall since 2023.
Table 1: Number of SCIDA disclosures made in 2024, by disclosing and recipient institution [all disclosures (proactive disclosures)]
Designated Recipient Institutions
Disclosing Institution
CBSA
CFIA
CNSC
CRA
CSE
CSIS
DND/CAF
Finance
FINTRAC
GAC
Health
IRCC
PHAC
PSC
RCMP
TC
TOTAL (proactive)
CBSA
–
–
–
–
–
(2)
–
–
–
–
–
–
–
–
(2)
–
(4)
GAC
–
–
–
–
(1)
41
(12)
–
–
–
–
–
–
–
–
7
(2)
–
49
(15)
IRCC
–
–
–
–
76
770
–
–
–
–
–
–
–
–
(1)
–
847
(1)
TOTAL (proactive)
–
–
–
–
77
(1)
813
(14)
–
–
–
–
–
–
–
–
10
(5)
–
900
(20)
This substantial increase in records was primarily driven by IRCC’s disclosures to CSIS, which grew nearly 300% from 194 in 2023 to 770 in 2024. IRCC previously disclosed similar information to CSIS under the Privacy Act, whereas now the SCIDA is the primary mechanism for CSIS to obtain immigration information. CSIS also credits the increase in disclosures to enhanced collaboration with IRCC aimed at improving operational staff awareness and understanding of the SCIDA regime.
As observed in prior years, institutions predominantly made disclosures following a request. Only 2% of disclosures were sent proactively by the disclosing institution.
Section 9 of the SCIDA establishes record-keeping obligations for both disclosing and recipient institutions. These requirements are designed to promote accountability and transparency by mandating the documentation of essential information, including descriptions of the disclosed or received data, the individuals involved, relevant dates, and the legal basis for the disclosure. Institutions are also required to record whether the information was destroyed or returned.
NSIRA’s analysis of records submitted by CSIS and IRCC revealed several minor discrepancies in record-keeping. These discrepancies can be attributed to duplicated, amended, and cancelled requests from CSIS. For example, in some cases, follow-up questions from CSIS regarding disclosures it had received were recorded by IRCC as a different request.
In addition, IRCC assigned sequential file numbers for a number of requests that were sent in 2024 but not processed until 2025. These disclosures were included in the record-keeping logs submitted to NSIRA. IRCC explained that, moving forward, it will only assign file numbers to requests that are completed in the current calendar year to minimize confusion.
IRCC also noted that it has committed to sharing its record-keeping log with CSIS on a quarterly basis to address potential discrepancies early. Clear and effective communication between disclosing and recipient institutions is vital to accurate record-keeping and enables secure information management, legal compliance, and administrative precision.
In August 2023, CSE and IRCC signed an information sharing agreement (ISA) to formalize their regular information exchanges and facilitate compliance with the SCIDA. The primary purpose of IRCC disclosures to CSE under the SCIDA is to determine a subject of interest’s legal citizenship status and/or immigration status in Canada. These disclosures help to ensure CSE’s lawfulness, as its mandate prohibits the direction of operational activities at Canadians and persons in Canada.
In its requests, CSE provides an individual’s identifying information in order for IRCC to conduct a search in the relevant systems, primarily the Global Case Management System (GCMS). The GCMS holds all citizenship and immigration information of Canadian citizens, foreign nationals, and permanent residents. It includes any application submitted by individuals as well as information entered by immigration officers and/or other departments, such as the CBSA.
At minimum, CSE provides IRCC with an individual’s full name and date of birth in its request. When available, CSE may include additional identifying information such as an individual’s known or suspected nationality, place of birth, and phone number(s), among others. The ISA between CSE and IRCC contains a comprehensive list of all the information that CSE may provide to assist IRCC in producing accurate results.
In three different instances, however, NSIRA observed that CSE provided IRCC with additional personal information that was not identified in the ISA. CSE explained that all relevant details were disclosed to increase the likelihood of IRCC yielding results. IRCC confirmed to NSIRA that it could not, and has never, leveraged the specific personal information provided by CSE to conduct its searches.
The ISA does not formally prohibit CSE from sharing information outside of the parameters agreed upon with IRCC. Nevertheless, CSE should verify whether the information it shares is relevant to the disclosing institution to avoid unnecessary sharing of personal data.
In the spring of 2024, IRCC and CSIS developed a tiered process for sharing under the SCIDA and introduced the classification of SCIDA requests and disclosures into “basic” or “advanced”. In implementing this process, IRCC and CSIS also formally adopted three standardized templates: a request letter, a checklist, and a response form. The checklist and response forms, in particular, aim to guide IRCC analysts in providing only necessary information and were included in all disclosures.
At minimum, a basic disclosure contains biographic details from the past five years, such as citizenship or immigration information, marital status, and contact information. It may also include photographs, recent employment information, travel history, and physical characteristics.
Should CSIS require an extensive personal history and supporting documents, such as scanned immigration applications, the request becomes an advanced SCIDA disclosure requiring additional rationale. This type of disclosure often contains information from a longer period of time (past ten years or more).
Previously, in order to share even basic biographic information, IRCC would include a scanned copy of an individual’s most recent immigration application (e.g. a passport or visa application). As a result, a number of disclosures from early in the review year contained third party information, such as unredacted guarantor, emergency contact, or reference information. NSIRA observed that the tiered system reduced the number of instances where IRCC included third party information in a basic SCIDA disclosure, in part because scanned copies of applications were no longer included.
Typically, IRCC will redact references from passport applications in an advanced disclosure. Other types of third-party information are redacted on a case-by-case basis.
The disclosure process begins when IRCC receives a request letter from CSIS containing a standardized list of items agreed upon by both institutions. This approach allows CSIS to identify only the information necessary for its request, addressing previous issues with customized and inconsistent information lists. For example, CSIS may request biographic details, such as citizenship and passport information, but choose not to request contact information. Advanced request letters include an option to receive scanned copies of applications.
Throughout 2024, the request letter, checklist, and response form evolved to meet the needs of IRCC and CSIS. NSIRA observed that new types of commonly requested information that had been previously absent from the request letter would be added as needed. In addition, IRCC combined the checklist and response form to reduce its administrative burden. The tiered process enabled IRCC to manage the increase in disclosures while limiting the amount of third-party information shared.
Importantly, IRCC’s decision to use a response checklist and form indicates an iterative process that improved the operational efficiency and legal compliance of both institutions under the SCIDA. Specific response times are prioritized into the following three categories: urgent life-threatening requests, priority operational requests, and routine requests. IRCC intends to prioritize requests from other institutions under the SCIDA in a similar manner.
The disclosures below briefly illustrate how the tiered process improved IRCC’s minimization of personal information in disclosures under the SCIDA. The first case represents a typical disclosure prior to the tiered system, while the second and third disclosures occurred after its introduction.
CSIS sent a letter to IRCC requesting the disclosure of information about a foreign individual under investigation relating to a particular institution. The request was to include records from the past five years.
Without a system to limit what information was shared, IRCC disclosed all available scanned copies of the individual’s study permit, work permit, permanent residence, and temporary resident visa applications. All documents provided in the disclosure were without redactions and included third party, minor, and financial information.
CSIS requested a basic SCIDA disclosure from IRCC for information relating to individuals affiliated with a particular foreign entity. In its justification, CSIS noted that the foreign entity and any individuals identified were of “national security interest” in relation to a CSIS investigation.
As this was a basic request, IRCC took steps towards limiting the disclosure by providing CSIS with a chart containing only the name, place and date of birth, status or immigration history, and the nature of affiliation. In email correspondence, IRCC stated that should CSIS require additional details or would like to request an advanced SCIDA for any or all of the individuals implicated, it would be required to include an additional detailed rationale.
CSIS requested an advanced disclosure from IRCC for information relating to several individuals with the justification that it had “reasonable grounds to believe” the subjects may have been in contact with “known members” of a foreign intelligence service. CSIS continued to justify its reasoning in detail, providing IRCC with a substantial amount of contextual information about the foreign entity in question and how the information it requested would contribute to its investigation.
CSIS also requested scanned copies of all documents in its request. IRCC disclosed nearly all categories of information requested by CSIS. In the checklist attached to the disclosure, IRCC stated that it had redacted third party information as well as other records that were irrelevant to CSIS’s request.
When compared to the first case, the delineation of basic and advanced disclosures under the SCIDA prevented the over sharing of personal information by IRCC in the second case without further justification. Despite CSIS’s expanded justification in the third case, IRCC did not include all the information in its holdings on the identified subjects because not everything was relevant.
SCIDA disclosures made under section 5(1) require IRCC to satisfy itself of two specific criteria. First, IRCC must satisfy itself that the disclosure will contribute to CSIS’s exercise of its jurisdiction in respect of activities that undermine the security of Canada. Second, IRCC must satisfy itself that the disclosure will not affect any person’s privacy interest more than is reasonably necessary in the circumstances. If IRCC is satisfied in both instances, it “may” make a disclosure. The onus is on the disclosing institution to assure itself that the information it discloses will contribute in the requisite sense.
While CSIS may not be required to share detailed information about its investigations, programs, or activities with IRCC, it needs to provide enough information in a request so that IRCC can responsibly exercise its discretion. A succinct high-level explanation of the link between the information sought and CSIS’s national security jurisdiction and responsibilities may be enough. However, disclosing institutions can seek clarification by requiring a more specific articulation of the activity that undermines the security of Canada that the request relates to.
In the majority of basic requests reviewed by NSIRA, CSIS elected to use scant phrasing in its justifications, such as “Subject is of national security interest in relation to the Service’s investigation of” the threat in question. In contrast, NSIRA observed other basic requests where CSIS demonstrated how the requested information would contribute to its investigations in a clear and descriptive manner in its justification. As a matter of course, advanced requests almost always contained robust justifications.
Inconsistencies in the description of the undermining activity in CSIS’s basic request letters did not often prompt IRCC to seek further clarification. In practice, IRCC maintained an institutional understanding that CSIS would only request information that will contribute to its mandate. NSIRA did not observe that IRCC conducted independent assessments based on a structured framework or consistent criteria.
IRCC has stated that it redacts any information it deems irrelevant in its disclosures to ensure that only pertinent details are disclosed. Particularly for advanced and bulk requests, IRCC was not always satisfied with CSIS’s justifications. NSIRA observed that IRCC either required additional rationale, disclosed less information than had been requested, or redacted unnecessary third-party information.
The absence of detailed justifications in SCIDA requests risks compromising compliance with paragraph 5(1)(b). Consequently, recipient institutions should provide disclosing institutions with the necessary information and rationale to satisfy the disclosing institution’s contribution threshold. A sufficient analysis of the activity that undermines the security of Canada requires that IRCC have knowledge of those circumstances.
In 2024, IRCC indicated that it had received an increase in requests for disclosures regarding minors and engaged with CSIS to ensure their privacy. IRCC’s existing SCIDA policy, however, does not address the treatment of minors in disclosures under the regime.
NSIRA observed that IRCC was inconsistent in its approach to disclosing information about minors and did not redact information appropriately in several disclosures reviewed. In at least one instance, IRCC stated that it had redacted a minor’s information. However, NSIRA observed that IRCC had done so inconsistently, leaving the minor’s name, date of birth, and national identification number unredacted elsewhere in the same disclosure. In other disclosures, IRCC either redacted information about a minor in full or chose not to make the disclosure at all.
The care attendant to a minor’s privacy rights in other areas of the law (as seen in, among others, the Criminal Code, the Youth Criminal Justice Act and various international conventions) indicates that minors may also attract a heightened privacy expectation in a national security context. Children under 16, for example, may not have a choice in submitting applications for passports which are completed on their behalf by a parent or guardian.
Subsection 5.1(1) of the SCIDA requires, as soon as feasible, the destruction or return of any personal information received under section 5 of the Act that is not necessary for a department to fulfill their lawful responsibilities related to national security. CSIS is excluded from this requirement by subsection 5.1(3) when a disclosure is retained pursuant to the performance of its duties and functions under section 12 of the CSIS Act.
In 2024, CSIS was the only institution to identify disclosures containing information that was destroyed or returned under subsection 5.1(1): three were deemed non-reportable, one was incorrect (wrong subject), and one had been disclosed by IRCC before CSIS could cancel the request, although it was not disseminated.
Shortly following receipt of the disclosure, CSIS assessed that the individual implicated was not the subject of the request. Despite the requirement to destroy the information, CSIS retained it in its entirety for “reference purposes.” When asked, CSIS confirmed the disclosure should not have been retained “in its totality and possibly at all” and that the matter had been referred to its internal compliance section.
To the extent that it is strictly necessary, section 12 of the CSIS Act allows CSIS to collect, analyse and retain on activities constituting threats to the security of Canada. However, as CSIS did not claim that this information was retained pursuant to section 12 of the CSIS Act, and thus was not strictly necessary to keep, the exception at 5.1(3) of the SCIDA did not apply and CSIS was required to destroy or return the information pursuant to 5.1(1).
This review marks the sixth year that NSIRA has examined GC institutions’ compliance with the SCIDA. NSIRA concluded that, within the disclosures reviewed, institutions generally adhered to the SCIDA’s requirements for disclosure and record-keeping.
NSIRA noted important improvements that streamlined the request and disclosure process between IRCC and CSIS and enhanced compliance. However, NSIRA observed risks with IRCC’s application of the substantive requirements under paragraphs 5(1)(a) and 5(1)(b) of the SCIDA.
NSIRA also identified possible non-compliance with subsection 5.1(1) of the SCIDA owing to CSIS’s retention of personal information that it had identified as unnecessary.
NSIRA’s recommendations in this review are designed to assist both recipient and disclosing institutions in adhering to the SCIDA’s privacy standards while effectively supporting national security and lawful mandates.
Annex A. Historical SCIDA Disclosures
Disclosing Institution
Designated Recipient Institutions under the SCIDA, Schedule 3
CBSA
CFIA
CNSC
CRA
CSE
CSIS
DND/CAF
Finance
FINTRAC
GAC
Health
IRCC
PHAC
PS
RCMP
TC
TOTAL
2023
CBSA
–
–
–
–
–
–
–
–
–
–
–
–
–
–
2 (2)
–
2 (2)
GAC
–
–
–
–
1 (1)
10 (0)
–
–
–
–
–
–
–
–
–
–
15 (1)
RCC
–
–
–
–
58 (0)
194 (7)
–
–
–
–
–
–
–
–
–
–
252 (7)
TOTAL
–
–
–
–
59 (1)
204 (7)
–
–
–
–
–
–
–
–
6 (2)
–
269 (10)
2022
CBSA
–
–
–
–
–
–
–
–
–
–
–
–
–
–
4
–
4
GAC
–
–
–
–
–
39
2
–
–
–
–
–
–
–
12
–
53
IRCC
–
–
–
–
59
56
–
–
–
–
–
–
–
–
–
–
115
RCMP
–
–
–
–
–
–
–
–
–
–
–
1
–
–
–
–
1
TOTAL
–
–
–
–
59
95
2
–
–
–
–
1
–
–
16
–
173
2021
DND/CAF
–
–
–
–
–
2
–
–
–
–
–
–
–
–
–
–
2
GAC
–
–
–
–
–
41
–
–
–
–
–
1
–
–
2
–
44
IRCC
–
–
–
–
68
79
–
–
–
2
–
–
–
–
–
–
149
TOTAL
–
–
–
–
68
122
–
–
–
2
–
1
–
–
2
–
195
2020
CBSA
–
–
–
–
–
1
–
–
–
–
–
–
–
–
3
–
4
GAC
–
–
–
–
1
25
–
–
–
–
–
1
–
–
13
–
40
IRCC
–
–
–
–
60
61
–
–
–
–
–
–
–
–
37
1
159
RCMP
–
–
–
–
–
–
–
1
–
–
3
–
5
–
–
–
9
TC
–
–
–
–
–
–
–
–
–
–
–
–
–
–
2
–
2
Other
–
–
–
–
–
1
–
–
–
–
–
–
–
–
–
–
1
TOTAL
–
–
–
–
61
88
1
–
–
3
–
6
–
–
55
1
215
2019
CBSA
–
–
–
–
–
1
–
–
–
–
–
–
–
–
2
–
3
GAC
–
–
–
–
–
23
–
–
–
–
–
3
–
1
15
–
42
IRCC
–
–
–
–
5
17
1
–
–
–
–
–
–
–
36
–
59
RCMP
–
–
–
4
–
–
–
–
1
3
–
1
–
–
–
–
9
TC
–
–
–
–
–
–
–
–
–
–
–
–
–
–
1
–
1
TOTAL
–
–
–
4
5
41
1
–
1
3
–
4
–
1
54
–
114
Annex B. Findings and Recommendations
NSIRA made the following findings and recommendations in this review:
Volume and Trend Analysis
Finding 1. NSIRA found that IRCC’s disclosures to CSIS under the SCIDA increased significantly in 2024.
Record Keeping Requirements – Section 9
Finding 2. NSIRA found that, within the sample of disclosures reviewed, every institution that disclosed or received information pursuant to the SCIDA in 2024 generally complied with its record-keeping obligations under section 9.
Information Sharing Agreements – Subsection 4(c)
Finding 3. NSIRA found that CSE provided IRCC with more information than necessary in three of its requests for disclosure under the SCIDA.
Recommendation 1. NSIRA recommends that CSE limit the sharing of information when requesting a disclosure under the SCIDA to only that which IRCC has identified as relevant to its information holdings.
Disclosure of Information Requirements – Section 5
Finding 4. NSIRA found that IRCC and CSIS’s implementation of a tiered request and disclosure process reduced the amount of third-party information disclosed by IRCC, which contributed to enhanced compliance with the SCIDA.
Finding 5. NSIRA found instances when the information provided to IRCC by CSIS was limited and hampered IRCC’s ability to fulfill its obligation as a disclosing institution to satisfy itself that the information disclosed is in respect of an activity that undermines the security of Canada.
Recommendation 2. NSIRA recommends that IRCC seek clarification from requesting institutions, as needed, to ensure it has all relevant information necessary to fulfill its obligations as a disclosing institution under the SCIDA, before making a disclosure.
Finding 6. NSIRA found that IRCC did not have a policy governing the disclosure of information concerning minors under the SCIDA.
Recommendation 3. NSIRA recommends that IRCC institute a policy on the disclosure of information related to minors that recognizes their distinct privacy interests.
Requirement to Destroy or Return – Subsection 5.1(1)
Finding 7. NSIRA found that CSIS may not have complied with subsection 5.1(1) of the SCIDA when it retained one disclosure containing personal information that was not necessary for exercising its jurisdiction.
Recommendation 4. NSIRA recommends that CSIS destroy all personal information in one disclosure that was not necessary for exercising its jurisdiction.
This quarterly report has been prepared by management as required by section 65.1 of the Financial Administration Act and in the form and manner prescribed by the Directive on Accounting Standards: GC 4400 Departmental Quarterly Financial Report. This quarterly financial report should be read in conjunction with the 2025–2026 Main Estimates.
This quarterly report has not been subject to an external audit or review.
The National Security and Intelligence Review Agency (NSIRA) is an independent external review body that reports to Parliament. Established in July 2019, NSIRA reviews Government of Canada national security and intelligence activities to assess whether they are lawful, reasonable, and necessary. The Agency also investigates complaints from members of the public on the activities of the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), as well as certain other national security-related complaints, independently and in a timely manner.
The NSIRA Secretariat supports the Agency in the delivery of its mandate. Independent scrutiny contributes to strengthening the accountability framework for national security and intelligence activities and to enhancing public confidence. Ministers and Canadians are informed whether national security and intelligence activities undertaken by Government of Canada institutions are lawful, reasonable, and necessary.
This quarterly report has been prepared by management using an expenditure basis of accounting. The accompanying Statement of Authorities includes the secretariat’s spending authorities granted by Parliament and those used by the secretariat, consistent with the 2025–2026 Main Estimates. This quarterly report has been prepared using a special-purpose financial reporting framework (cash basis) designed to meet financial information needs with respect to the use of spending authorities.
The authority of Parliament is required before money can be spent by the government. Approvals are given in the form of annually approved limits through appropriation acts or through legislation in the form of statutory spending authorities for specific purposes.
The Secretariat uses the full accrual method of accounting to prepare and present its annual financial statements that are part of the departmental results reporting process. However, the spending authorities voted by Parliament remain on an expenditure basis.
Highlights of the fiscal quarter and fiscal year-to-date results
This section highlights the significant items that contributed to the net increase or decrease in authorities available for the year and actual expenditures for the quarter ended December 31, 2025.
NSIRA Secretariat spent approximately 65% of its authorities by the end of the third quarter, compared with 63% in the same quarter of 2024–2025 (see graph 1).
Graph 1: Comparison of total authorities and total net budgetary expenditures, Q3 2025–2026 and Q3 2024–2025 (in millions of dollars)
Text version of Figure 1
Comparison of total authorities and total net budgetary expenditures, Q3 2025–2026 and Q3 2024–2025 (in millions of dollars)
2025-26
2024-25
Total Authorities
$20.4
$20.5
Q3 Expenditures
$3.8
$4.2
Year-to-Date Expenditures
$13.3
$13.0
Significant changes to authorities
As of December 31, 2025, Parliament had approved $20.4 million in total authorities for use by NSIRA Secretariat for 2025–2026 compared with $20.5 million as of December 31, 2024, for a net decrease of $0.1 million or 0.5% (see graph 2).
Graph 2: Variance in authorities as of December 31, 2025 (in millions of dollars)
Text version of Figure 2
Variance in authorities as of December 31, 2025 (in millions of dollars)
Fiscal year 2024-25 total available for use for the year ended March 31, 2025
Fiscal year 2025-26 total available for use for the year ended March 31, 2026
Vote 1 – Operating
18.9
18.5
Statutory
1.6
1.9
Total budgetary authorities
20.5
20.4
*Details may not sum to totals due to rounding*
The decrease of $0.1 million in authorities is mostly explained by a decrease in total carry-forward from the previous year.
Significant changes to quarter expenditures
The third quarter expenditures totalled $3.8 million for a decrease of $0.4 million when compared with $4.2 million spent during the same period in 2024–2025. Table 1 presents budgetary expenditures by standard object.
Table 1: Departmental budgetary expenditures by Standard Object (unaudited)
Fiscal year 2025-2026 (in thousands of dollars)
Variances in expenditures by standard object (in thousands of dollars)
Fiscal year 2025-2026: expended during the quarter ended December 31, 2025
Fiscal year 2024-2025: expended during the quarter ended December 31, 2024
Variance $
Variance %
Personnel
3,470
3,584
(114)
(3%)
Transportation and communications
90
131
(41)
(31%)
Information
5
15
(10)
(67%)
Professional and special services
242
437
(195)
(45%)
Rentals
13
40
(27)
(68%)
Repair and maintenance
5
27
(22)
(81%)
Utilities, materials, and supplies
0
(11)
11
(100%)
Acquisition of machinery and equipment
0
0
(0)
(0%)
Other subsidies and payments
20
15
(15)
(100%)
Total gross budgetary expenditures
3,825
4,238
(413)
(10%)
Professional and special services
The decrease of $195,000 is due to a decrease in use of several contractors.
Rentals
The decrease of $27,000 is due to the decommissioning of a rental building.
Repair and maintenance
The decrease of $22,000 is explained by some one-time office repairs in fiscal year 2024-2025.
Utilities, materials and supplies
The decrease of $11,000 is explained by the faster clearing of the acquisition card suspense account in 2025-26.
Other subsidies and payments
The decrease of $15,000 is explained by a decrease in the recovery of salary overpayments.
Significant changes to year-to-date expenditures
The year-to-date expenditures totalled $13.3 million for an increase of $0.3 million (2%) when compared with $13.0 million spent during the same period in 2024-2025. Table 2 presents budgetary expenditures by standard object.
Table 2: Departmental budgetary expenditures by Standard Object (unaudited) (continued)
Fiscal year 2025-2026 (in thousands of dollars)
Variances in expenditures by standard object (in thousands of
dollars)
Fiscal year 2025-26: year-to-date expenditures as of December 31, 2025
Fiscal year 2024-25: year-to-date expenditures as of December 31, 2024
Variance $
Variance %
Personnel
11,213
10,448
765
7%
Transportation and communications
164
266
(102)
(38%)
Information
20
28
(8)
(29%)
Professional and special services
1,858
2,026
(168)
(8%)
Rentals
38
82
(44)
(54%)
Repair and maintenance
27
67
(40)
(60%)
Utilities, materials and supplies
15
29
(14)
(48%)
Acquisition of machinery and equipment
0
20
(20)
(100%)
Other subsidies and payments
4
56
(52)
(93%)
Total gross budgetary expenditures
13,339
13,022
317
2%
Personnel
The increase in Personnel of $765,000 is due to an increase in both FTEs and average salary per FTE.
Transportation and communications
The decrease of $102,000 is mainly due to a reduction in travel and relocation across the Secretariat.
Rentals
The decrease of $44,000 is attributed to the decommissioning of a rental building, and the timing of invoicing for our HR system.
Repair and maintenance
The decrease of $40,000 is explained by some one-time office repairs in fiscal year 2024-2025.
Acquisition of machinery and equipment
The decrease of $20,000 is mainly explained by one-time equipment purchases in 2024-2025.
Other subsidies and payments
The decrease of $52,000 is explained by an overall decrease in the recovery of salary overpayments.
Risks and uncertainties
The funding received to offset pay increases was insufficient to cover such increases and as a result, NSIRA Secretariat will be required to reduce its overall staffing level to remain within budget. Reductions in staffing could cause a reduction in the number of reviews and investigations the Secretariat is able to produce on a yearly basis.
NSIRA Secretariat is closely monitoring pay transactions to identify and address over and under payments in a timely manner and continues to apply ongoing mitigating controls.
Mitigation measures for the risks outlined above have been identified and are factored into NSIRA Secretariat’s approach and timelines for the execution of its mandated activities.
Significant changes in relation to operations, personnel and programs
There has been one new Governor-in-Council appointment during the third quarter, Mr. Yves Côté.
Approved by senior officials:
Charles Fugère Executive Director
Martyn Turcotte Chief Financial Officer
Appendix
Statement of authorities (Unaudited)
Fiscal year 2025-2026 and 2024-2025 (in thousands of dollars)
Fiscal year 2025-2026
Fiscal year 2024–25
Total available for use for the year ending March 31, 2026
(note 1)
Used during the quarter ended December 31, 2025
Year to date used at quarter-end
Total available for use for the year ending March 31, 2025
(note 1)
Used during the quarter ended December 31, 2024
Year to date used at quarter-end
Vote 1 – Net operating expenditures
18,522
3,347
11,908
18,856
3,838
11,821
Budgetary statutory authorities
Contributions to employee benefit plans
1,908
477
1,431
1,601
400
1,201
Total budgetary authorities (note 2)
20,430
3,824
13,339
20,457
4,238
13,022
Note 1: Includes only authorities available for use and granted by Parliament as at quarter-end.
Note 2: Details may not sum to totals due to rounding.
Departmental budgetary expenditures by standard object (unaudited)
Fiscal year 2025-2026 and 2024-2025 (in thousands of dollars)
Fiscal year 2025-2026
Fiscal year 2024–25
Planned expenditures for the year ending March 31, 2026 (note 1)
Expended during the quarter ended December 31, 2025
Year-to-date used at quarter-end
Planned expenditures for the year ending March 31, 2025
Expended during the quarter ended December 31, 2024
Year-to-date used at quarter-end
Expenditures
Personnel
14,377
3,469
11,213
14,211
3,584
10,448
Transportation and communications
497
90
164
685
131
266
Information
42
5
20
76
15
28
Professional and special services
4,994
242
1,858
4,617
437
2,026
Rentals
281
13
38
309
40
82
Repair and maintenance
72
5
27
436
27
67
Utilities, materials, and supplies
74
0
15
58
(11)
29
Acquisition of machinery and equipment
93
0
0
65
0
20
Other subsidies and payments
0
0
4
0
15
56
Total gross budgetary expenditures
(note 2)
20,430
3,824
13,340
20,457
4,238
13,022
Note 1: Includes only authorities available for use and granted by Parliament as at quarter-end.
Note 2: Details may not sum to totals due to rounding.
Ottawa, Ontario, December 4, 2025 – The National Security and Intelligence Review Agency (NSIRA) 2024 Annual Report has been tabled in Parliament.
The report outlines NSIRA’s key achievements and progress, showcasing how the organization has played a vital role in shaping the national security and intelligence review landscape. Through its work, NSIRA fosters public trust, upholds democratic oversight, and safeguards the rights and freedoms of all Canadians.
2024 Review Highlights
In 2024, NSIRA completed nine reviews, including the Review of the Dissemination of Intelligence on People’s Republic of China Political Foreign Interference. Given its public interest, NSIRA determined that the report and its conclusions should be released to Parliament. As such, this review resulted in NSIRA’s first special report tabled under section 40 of the NSIRA Act.
Other key reviews in 2024 included:
Royal Canadian Mounted Police’s Human Source Program: Part of a three-part series examining how federal agencies manage and use human sources in national security operations.
The Lifecycle of CSIS’s Warranted Information: Assessed the entire lifecycle of warranted information, from the moment it is collected through processing, analysis, use, storage, and eventual retention or disposal.
Public Safety and Canadian Security Intelligence Service (CSIS) Accountability Mechanisms: Stemming from a Ministerial referral, NSIRA examined whether CSIS and the Department of Public Safety were effectively supporting Ministerial responsibility.
As of publication of the Annual Report, five of the nine reviews completed in 2024 have been published. Other reviews from 2024 are, as are unpublished reviews from previous years, undergoing processes in relation to redaction of potentially injurious information. NSIRA continues to advance all review reports submitted to the Minister, with additional publications expected upon completion of the redaction processes.
Recommendations, Redactions and Access
In 2024, NSIRA introduced dedicated follow-up cycles to evaluate how departments implement its recommendations. Work is underway to develop new internal tracking tools and protocols to improve awareness, follow-up, and public communications about institutional responses and progress.
While NSIRA has observed encouraging progress in the timeliness and completeness of responses from several reviewees, the Agency and Secretariat have faced ongoing challenges. Tensions persist regarding institutional resistance to NSIRA’s access rights, inconsistent disclosures in response to requests for information, and overbroad or unsubstantiated demands for redactions in access-to-information consultations.
NSIRA is exploring options to provide better real-time public visibility into these challenges to support greater departmental accountability.
2024 Complaints Investigations
From January 1 to December 31, 2024, NSIRA received 79 new complaints, including 67 related to CSIS. Of these, 52 (66%) involved delays in immigration and citizenship security screening. Under sections 14 and 15 of the CSIS Act, CSIS provides security advice to IRCC and CBSA, and CSIS advised that the time required can vary based on several factors. As shown in the statistics in the report, many complaints were resolved informally once CSIS completed its screening and issued a letter confirming that its advice had been provided to the requesting department.
NSIRA closed a total of 22 investigations in 2024, with 34 carried into 2025.
Strategic Direction
NSIRA finalized its 2024-2027 Strategic Plan, setting clear priorities for the next three years. The plan reaffirms NSIRA’s core values — Independence, Professionalism, Transparency, and Inclusiveness — and serves as a foundation for continuous improvement.
The Agency continues to closely collaborate with domestic and international partners to strengthen its review and investigative capabilities. NSIRA aspires to be a globally recognized centre of excellence and a hub for a professional community dedicated to national security accountability.
The National Security and Intelligence Review Agency (NSIRA, Review Agency) is pleased to present its 2024 Annual Report, highlighting key achievements, progress, and our direction for coming years.
2024 Key Highlights
In 2024, NSIRA observed a notable increase in the number of complaint investigations linked to immigration security screening delays.
Additionally, NSIRA has released its first Section 40 public interest report this year, marking an important milestone in its mandate. This report underscores NSIRA’s dedication to transparency and accountability in national security matters.
NSIRA’s 2024–2027 Strategic Plan
After five years of operation, NSIRA has developed its triennial strategic plan for 2024-2027, which will guide the Review Agency’s efforts in the coming years. The strategic plan focuses on NSIRA’s commitment to enhancing review; investigating complaints in a timely, fair, and efficient manner; fostering transparency; and strengthening public trust in NSIRA’s rigorous, fully independent review approach to Canada’s national security and intelligence activities.
NSIRA’s Role on the International Stage
NSIRA continues to strengthen its international partnerships, ensuring its work remains informed by, and a contributor to, global best practices in review. By engaging with international counterparts, NSIRA positions Canada as an active leader in upholding democratic values on the global stage.
We would like to thank the staff of NSIRA’s Secretariat for their expertise, efforts and resilience throughout this ambitious year and for their innovation, energy and commitment for the year ahead.
Marie Deschamps Colleen Swords Craig Forcese Matthew Cassar Foluke Laosebikan Jim Chu
Executive summary
Without specialized national security review, much security service conduct would be immunized from scrutiny by reason of national security secrecy. The National Security and Intelligence Review Agency (NSIRA)’s raison d’être is to ensure that there is no such immunity. NSIRA has two mandates: conducting national security reviews of security or intelligence activities and conducting investigations of complaints from the public brought against a subset of national security and intelligence services.
In five years of existence, NSIRA has become a robust and professional reviewbody that conducts reviews and investigates public complaints, which reflect thehighest standards and core values of Canadian society: democracy, transparencyand the rule of law.
This 2024 Annual Report outlines the multiple spheres of activity through which NSIRA has contributed meaningfully to shaping the landscape of national security and intelligence review. This work is central to strengthening public trust, ensuring democratic oversight, and safeguarding the rights and freedoms of all Canadians.
Reviews
The Reviews section of this report provides a summary of each of the nine review reports that were approved by Members during 2024, including the Review of the Dissemination of Intelligence on People’s Republic of China Political Foreign Interference, which resulted in NSIRA’s first special report tabled under section 40 of the NSIRA Act, where NSIRA determined that releasing the report and its conclusions to Parliament was in the public interest. The review reports that NSIRA presented to the relevant departments and agencies in 2024 contain 67 findings and 45 recommendations.
Complaint Investigations
During the last five months of 2024, NSIRA observed a significant increase of public complaints against CSIS, alleging process delays in immigration or citizenship security screening which resulted in NSIRA ingesting an unprecedented number of new complaints.
NSIRA in Context
1.1 About NSIRA
The National Security and Intelligence Review Agency (NSIRA, the Review Agency) is an independent entity that reviews and investigates public complaints related to national security or intelligence activities to assess their lawfulness, reasonableness, and necessity. NSIRA may have up to seven Members, supported by a Secretariat with expertise in law, technology and national security, and led by an Executive Director appointed by the Governor-in-Council.
NSIRA has two mandates: reviewing Government of Canada national security or intelligence activities and investigating public complaints related to those activities.
NSIRA’s approach in managing its review process is innovative. Review teams are comprised of individuals with diverse skill sets. They execute reviews under the direction of a designated NSIRA member and relevant Secretariat management personnel. Similarly, NSIRA’s model for investigations of complaints relies on an NSIRA Member serving in a quasi-judicial investigative role, supported by legal, registry, and research staff.
1.2 NSIRA’s Vision and Mission
1.3 Unique Functions of NSIRA
NSIRA holds a unique and pivotal position within Canada’s national security accountability framework. With a mandate spanning the entire federal government, NSIRA can review any national security or intelligence activity, irrespective of the department or agency involved. This extensive jurisdiction enables NSIRA to carry out comprehensive, integrated, in-depth reviews of sensitive operations.
NSIRA also functions as a complaint investigation body, primarily examining national security-related allegations against the Canadian Security Intelligence Service (CSIS) or the Communications Security Establishment (CSE), activities of the Royal Canadian Mounted Police (RCMP) closely related to national security, and denials of security clearance by federal departments. These public complaints often involve serious allegations, and NSIRA’s capacity to address them enhances access to justice and the protection of individual rights.
With access to classified and legally privileged information, NSIRA is uniquely equipped to examine whether national security powers are exercised incompliance with Canadian law.
1.4 NSIRA’s Domestic Partnerships
As part of Canada’s national security and intelligence accountability framework, NSIRA and the National Security and Intelligence Committee of Parliamentarians (NSICOP) serve complementary yet distinct roles. While both play crucial roles in ensuring accountability, they differ in structure and mandate.
NSICOP is a committee of parliamentarians and focuses its reviews on the effectiveness of the national security and intelligence agencies. It is impacted by events such as elections or dissolutions. NSICOP’s makeup makes it uniquely well positioned to examine both the efficacy of the national security and intelligence community, in particular, its legal frameworks, and broad strategic trends across the national security landscape.
NSIRA operates year-round and maintains consistent engagement regardless of the Parliamentary schedule. Its mandate is to focus on the legality and legal compliance of national security and intelligence activities through in-depth reviews that dig down vertically into the operational events conducted on the ground. To deliver on its mandate to investigate complaints, NSIRA’s continuous operations are essential to ensuring that investigations are conducted without delay.
NSIRA and NSICOP both enhance transparency and accountability in national security via their distinct mandates, which ensures a complete approach to independent review. They actively coordinate efforts and avoid duplication. The respective secretariats have established a strong working relationship. Together, NSICOP and NSIRA form a complementary system supporting democratic accountability and continuous legal scrutiny.
NSIRA is committed to working within a system of partnerships with key actors. It is part of a larger network of federal review and accountability bodies and regularly engages with the Civilian Review and Complaints Commission, the Office of the Intelligence Commissioner, the Office of the Auditor General, and the Office of the Privacy Commissioner (OPC). These collaborations are about best practices, ensuring aligned mandates, minimizing redundancy, and reinforcing a broader framework of transparency.
1.5 Sustaining an Independent Review Body
NSIRA’s independence is the cornerstone of its credibility and effectiveness as a national security review body. Operating independently from the executive branch, NSIRA conducts impartial and expert reviews of Canada’s most sensitive security and intelligence activities. This institutional autonomy is not just a privilege, it is an attitudinal necessity and a responsibility that NSIRA takes seriously. It’s vital for preserving the integrity of its operations and cultivating public trust.
The NSIRA Act grants access to all information held by reviewed departments, including classified and legally protected information, except for Cabinet confidences. This access allows NSIRA to independently review the legality, necessity, and proportionality of government actions.
NSIRA’s reports, findings, and recommendations are not subject to any editorial control from the prime minister or any other minister, nor are they subject to any editorial control from senior officials. This approach preserves NSIRA’s voice and commitment to transparency and accountability.
To uphold this independence, NSIRA invests in secure digital systems, enhances internal governance, and develops expertise through targeted hiring and training. These initiatives improve the professionalism and integrity of NSIRA’s work.
1.6 Protecting Democracy and Freedoms
NSIRA ensures Canada’s national security activities align with the rule of law and the Canadian Charter of Rights and Freedoms, enhancing public confidence in Canada’s national security framework. NSIRA’s role is vital in upholding a national security system based on legality and democratic accountability.
In 2024, NSIRA’s reviews tackled foreign interference, bulk data, and technology-enabled intelligence activities. NSIRA’s findings led to recommendations to keep these powers within legal and ethical limits. By reviewing the extraordinary powers of the national security community, NSIRA plays a vital role in preserving the integrity of the rule of law in Canada.
1.7 Transparency and Engagement
Transparency is a core value at NSIRA, shaping how the Review Agency conducts its work. Increasing public understanding of NSIRA’s work and its findings and recommendations is a fundamental value of the organization. NSIRA aims to ensure that Parliamentarians, media, civil society, academia, and the broader Canadian public remain engaged in its work, enabling them to form their independent views on national security or intelligence issues and to hold government accountable.
In the challenging context of national security operations, absolute public transparency could unfortunately provide adversaries and threat actors with information that might harm Canada’s security interests, as well as those of its allies. NSIRA applies a rigorous balanced approach to release as much information as possible about its work in its commitment to transparency and openness, while safeguarding genuinely injurious national security information.
In 2024, NSIRA enhanced its public reporting efforts by announcing on social media each time a report was submitted to a Minister and by informing the public that reports can be accessed under the Access to Information Act. NSIRA also began publishing backgrounders to provide Canadians with greater clarity on the context of its reviews. As part of its commitment to openness, the Agency launched an updated and more accessible website.
Additionally, in 2024, NSIRA expanded its outreach initiatives to enhance public awareness and understanding of its mandate. NSIRA hosted new events with civil society, media, and academia. These initiatives aimed to deepen the understanding of NSIRA’s role and to foster informed dialogue about NSIRA’s work.
1.8 NSIRA’s Role on the World Stage
NSIRA’s partnerships extend beyond Canada’s borders through its active role in the Five Eyes Intelligence Oversight and Review Council (FIORC). As a permanent member, NSIRA actively collaborates with review agencies from Australia, New Zealand, the United Kingdom and the United States, fostering robust collaboration and knowledge exchange.
NSIRA has established strong partnerships with European counterparts, including agencies involved in the Intelligence Oversight Working Group made up of Belgium, Denmark, the Netherlands, Norway, Sweden, Switzerland, and the United Kingdom. These partnerships transcend routine collaboration, enabling collective learning on review methodologies and facilitating coordinated knowledge exchange on the development of international review best practices.
NSIRA has also been an active collaborator in some initiatives led by certain United Nations divisions that aim to improve global partnerships in the review and oversight sector. This has led to engagement with new international partners, delivery on online training modules, and new contributions to global standards in review.
Through these international engagements, NSIRA plays an active role in shaping a global community of practice that promotes the values of rigorous independent review of national security or intelligence activities.
Highlights on Key Initiatives
2.1 Reviewee Responsiveness
Access to information is fundamental to NSIRA’s ability to conduct effective reviews and investigations. In 2024, NSIRA observed encouraging progress in the responsiveness of several reviewees, particularly regarding the timeliness and completeness of their responses.
Despite these improvements, frustrations persist: overbroad, unsubstantiated or excessive demands for redactions in access to information consultations a reoccurring in every file, inconsistent disclosures in response to requests for information are routine, institutional resistance to NSIRA’s access rights occurs, and outdated departmental information systems at times impede NSIRA’s ability to conduct its work. NSIRA raises these issues with senior departmental officials and escalates to the Minister when necessary, with mixed results. While responsiveness performance varies across departments, it is fair to say that the status quo is one where process challenges regularly challenge NSIRA’s ability to deliver on its mandate. NSIRA is looking at ways to provide better real-time public awareness of its responsiveness challenges so that relevant departments can be held accountable.
2.2 Follow-Up on Recommendations
Monitoring the execution of recommendations is pivotal to NSIRA’s commitment to facilitate systemic improvement. In 2024, NSIRA strengthened its follow-up practices by initiating dedicated review cycles designed to evaluate the implementation of prior recommendations. The timeliness and comprehensiveness of recommendation responses differ among departments and agencies.
To facilitate this endeavour, NSIRA is in the process of developing internal tracking tools and protocols to assist in ensuring more consistent awareness, follow-up, and public communications about institutional responses and progress on NSIRA’s recommendations. NSIRA will continue to make advances in the years to come on this significant initiative.
2.3 Investigations: Volume Increase and Streamlining Processes
In 2024, NSIRA addressed a surge of CSIS-related complaints from the public tied to delays in immigration and citizenship screening. More than half of the new complaints related to such delays. Several of those new complaints resulted in informal resolutions.
NSIRA advanced initiatives to improve and streamline its investigative processes and procedures, as detailed in this report’s Complaint Investigations section.
2.4 Three-Year Strategic Plan
In 2024, NSIRA finalized its 2024-2027 Strategic Plan, setting a clear direction for its priorities over the next three years. The plan reaffirms NSIRA’s core values —Independence, Professionalism, Transparency, and Inclusiveness — and serves as a foundation for continuous improvement. It positions both NSIRA and its Secretariat to deliver effective, forward-looking review and investigations of public complaints. NSIRA aims to maintain the highest standards by focusing on contemporary issues, applying rigorous methodologies, delivering on its mandates with impartiality and efficiency, and continuing to modernize NSIRA’s processes and leverage new technologies to accomplish improved outcomes for Canadians.
To support NSIRA’s mission, the strategic plan invests in sustainable corporate infrastructure. This includes fostering a culture of continuous learning and maintaining high standards in information management, security, and human resources. The NSIRA Secretariat strives to be an agile and efficient workplace that attracts and retains top talent.
NSIRA also emphasizes its continued collaboration with domestic and international partners to strengthen its review and investigative capabilities. NSIRA aspires to be a globally recognized centre of excellence and a hub for a professional community dedicated to national security accountability. Through this strategic vision, NSIRA reaffirms its role as the trusted eyes and ears of Canadians in an evolving security landscape.
2.5 New Offices Built to High Standards
Between 2021 and 2024, NSIRA’s Secretariat led the planning, development, and delivery of a new office space for its staff. This complex undertaking involved meeting the highest standards of security, functionality, and design, all while supporting NSIRA’s growing operational needs. Despite tight timelines and evolving requirements, the Secretariat successfully transitioned into the new space efficiently, securely, and with minimal disruption to NSIRA’s core mandate.
Reviews
3.1 Overview
NSIRA’s review mandate is outlined in subsection 8(1) NSIRA Act and includes reviewing national security or intelligence activities of CSE and CSIS, as well as those of any other federal departments and agencies.
The review reports presented in 2024 to the relevant departments and agencies contain 67 findings, and NSIRA issued 45 recommendations.
Table 1 lists the reviews that gave rise to the reports produced and submitted to the responsible minister(s) by NSIRA, in 2024.
Table 1. NSIRA review activities during 2024
Review
Department(s)
Status**
22-07—Canadian Security Intelligence Service
Lifecycle of Warranted Information
21-20—Royal Canadian Mounted Police’s Human
Source Program
RCMP
Published
22-12—Public Safety and Canadian Security
Intelligence Service Accountability Mechanisms
CSIS, GAC, PS,
DOJ
Published
23-11—Review of FederalInstitutions’ Disclosures
of Information under the Security of Canada
Information Disclosure Act in 2023
PS, CSE, CSIS,
GAC, RCMP, CBSA,
IRCC
Published
24-03—Review of Departmental Implementation of
the Avoiding Complicity in Mistreatment by Foreign
Entities Act for 2023
CBSA, CSIS, CSE,
DND/CAF, GAC,
RCMP
Submitted
23-07—Review of the Dissemination of Intelligence
on People’s Republic of China Political Foreign
Interference, 20218-2023
CSIS, RCMP, GAC,
CSE, PS, PCO
Published
**Status as of the writing of this report. A review is marked as “Submitted” when the review report has been approved by NSIRA members and sent to the relevant minister(s).
3.2 CSIS Reviews
22-07—Review of the Lifecycle of CSIS’s Warranted Information
NSIRA examined CSIS’s lifecycle management of data resulting from a specific and novel technical capability used to execute a Federal Court warrant. NSIRA inspected CSIS’s primary collection and processing system to directly observe how data was collected, processed, and managed.
CSIS introduced heightened non-compliance risks when deploying the technical capability with inadequate operational policies and procedures, inadequate data stewardship practices, and inadequate technical systems to handle the resulting data. Consequently, CSIS retained information without a clearly articulated authority.
CSIS did not consult with Public Safety Canada as required by the Ministerial Direction prior to using the novel technology under review. CSIS’s failure to consult may not have been in compliance with the CSIS Act. CSIS mischaracterized the novel technology as an extension of an existing CSIS technology and failed to inform Public Safety Canada in a timely manner. CSIS did not advise the Federal Court of this novel technology.
These shortcomings raised concerns about CSIS’s readiness to assess, prepare for and deploy other novel technologies.
Findings
Recommendations
Reviewee’s Response
[*Technology*] as a Novel Technology
Finding 1. NSIRA found that [*technology*] are a novel technology within CSIS’s suite of technical capabilities.
Finding 2. NSIRA found that [*technology*] introduce a significant expansion of collection capabilities and operational risks.
Finding 3. NSIRA found that CSIS does not have adequate policies and procedures to manage its [*technology*] program.
Finding 4. NSIRA found CSIS did not consult Public Safety Canada in a timely manner regarding its planned use of [*technology*] contrary to the Ministerial Direction to the Canadian Security and Intelligence Service on Accountability issued pursuant to section 6(2) of the CSIS Act. Moreover, CSIS may not be in compliance with section 7(1)(b) of the CSIS Act, which requires the Director to consult with the Deputy Minister when required pursuant to Ministerial Direction.
Recommendation 1. NSIRA recommends that CSIS establish and maintain adequate policies and procedures to manage its [*technology*] program.
Agree
Data Lifecycle Management
Finding 5. NSIRA found that CSIS incorrectly labelled some data collected during [*operation*] and no quality assurance or compliance process detected this prior to NSIRA’s technical inspection.
Finding 6. NSIRA found that CSIS retained collected information without clearly articulating the authority for its retention.
Finding 7. NSIRA found that CSIS does not adequately consider data stewardship requirements accruing from new collection activities, which introduces heightened non-compliance risks.
Recommendation 2. NSIRA recommends that CSIS prioritize investing in technical processes and systems that can assess, ingest, label, use, and destroy data in compliance with its legal obligations.
Agree
Risk Assessment Practices
Finding 8. NSIRA found that CSIS relies on the 2020 Framework for Cooperation Between Public Safety Canada and the Canadian Security Intelligence Service to operationalize the 2019 Ministerial Direction to the Canadian Security Intelligence Service on Accountability. However, the 2020 Framework does not fully capture the requirements of the 2019 Ministerial Direction.
Recommendation 3. NSIRA recommends that the 2020 Framework for Cooperation Between Public Safety Canada and the Canadian Security Intelligence Service be revised to fully align with the 2019 Ministerial Direction to the Canadian Security Intelligence Service on Accountability.
Agree
Recommendation 4. NSIRA recommends that the definition of “novel technique or technology” in the 2020 Framework for Cooperation Between Public Safety Canada and the Canadian Security Intelligence Service be revised to err on the side of inclusivity.
Agree
Recommendation 5. NSIRA recommends that CSIS ensure risk assessments performed throughout the lifecycle of new technologies and techniques are rigorous, documented and comprehensive in their scope.
Agree
Operational Technology Review Committee (OTRC)
Finding 9. NSIRA found that the creation of the Operational Technology Review Committee was an important step forward in CSIS’s management of new technologies and techniques.
Recommendation 6. NSIRA recommends that, as part of its ongoing development, the Operational Technology Review Committee refine its processes to:
consider data lifecycle requirements;
reference a definition of “novel technology” that has been agreed upon with Public Safety Canada as part of a revised Framework;
include a requirement to consult Public Safety Canada on plans or proposals to seek or develop novel techniques and technologies;
define how risk is assessed;
better document its technical, legal, foreign policy and reputational risks assessments.
Agree
Execution of Warranted Powers
Finding 10. NSIRA found that, in [*operation*], CSIS intended to [*specific operation details*] beyond warranted targets at a [*location].
Recommendation 7. NSIRA recommends that language in the [*warrant type*] Warrant more clearly describe the breadth and limitations of what constitutes incidental collection.
Partially Agree
Recommendation 8. NSIRA recommends that CSIS specify the warrant authority in the operational planning documents in support of [*sensitive info*] to be sought in the operation.
Agree
Regulations
Finding 11. NSIRA found that CSIS’s [*use of technology*] may not be in compliance with [*specific*] Regulations.
Duty of Candour
Finding 12. NSIRA found that CSIS did not advise the Court prior to using [*technology*] in the execution of warranted powers.
Recommendation 9. NSIRA recommends that the classified version of this report be shared with the Federal Court.
Partially Agree
23-05—Annual Review of Select CSIS Activities (ARSCA-CSIS)
In 2024, NSIRA launched a process called the Annual Review of Select CSIS Activities (ARSCA-CSIS). This review covers a range of operational categories which are either routinely communicated to NSIRA by CSIS under a standalone statutory obligation or are of unique interest to NSIRA due to high legal risks or findings of prior reviews. In previous years, NSIRA conducted annual reviews of CSIS Activities that were primarily focused on NSIRA’s requirement to report annually to the Minister of Public Safety. However, these reviews did not culminate in a final report with findings and recommendations issued pursuant to section 34 of the NSIRA Act. The work completed this year as part of the ARSCA-CSIS is being captured in a final report with findings and recommendations, thereby aligning with NSIRA’s other thematic reviews. The report, which starting this year will be completed annually, will also contain the results of NSIRA’s efforts in reviewing an aspect of the CSIS Threat Reduction Regime. The ARSCA-CSIS report that will provide a high level overview of CSIS activities during the 2024 calendar year has been completed in 2025. Its findings and recommendations will appear in NSIRA’s public annual report for the calendar year 2025.
3.3 CSE Reviews
23-02—Annual Review of Select CSE Activities (ARSCA-CSE)
In 2024, NSIRA launched a process called the Annual Review of Select CSE Activities (ARSCA-CSE). This review covers a range of operational categories which are either routinely communicated to NSIRA by CSE under a standalone statutory obligation, or are of unique interest to NSIRA due to high legal risks or findings of prior reviews. In previous years, NSIRA conducted Annual Reviews of CSE Activities that were primarily focused on NSIRA’s requirement to report annually to the Minister of National Defence. However, these reviews did not culminate in a final report with findings and recommendations issued pursuant to section 34 of the NSIRA Act. The work completed this year as part of the ARSCA-CSE is being captured in a final report with findings and recommendations, thereby aligning with NSIRA’s other thematic reviews. The ARSCA-CSE report that will provide a high level overview of CSE activities during the 2024 calendar year has been completed in 2025. Its findings and recommendations will appear in NSIRA’s public annual report for the calendar year 2025.
23-10—CSE’s Equities Management Framework
NSIRA review of CSE’s Equities Management Framework (EMF) resulted in ten findings and seven recommendations that relate to two areas of concern, as well as several shortcomings related to governance and practices. However, at the time of writing, the full report remains heavily classified. As such, more information regarding this review, along with the related findings and recommendations, will be made available at a later date.
3.4 Other Department Reviews
21-20—RCMP’s Human Source Program
This review was conducted alongside reviews of similar programs at the Canada Border Services Agency and the Department of National Defence/Canadian Armed Forces.
NSIRA’s review focused on three areas: risk management, duty of care to human sources, and ministerial direction accountability. NSIRA found that risk assessments were inconsistently applied, leading to varied assessments on source suitability. The RCMP was overly reliant on confidentiality promises and failed to fully consider risks to sources. Risk assessments often prioritized investigative outcomes over the safety of informants and lacked proper documentation.
Additionally, NSIRA found that the RCMP did not exercise the required “special care” when sources operated in sensitive sectors. There were no mechanisms to assess the cumulative impact of such operations. Anecdotal evidence suggested these practices negatively affected both investigations and Canadian society. In addition, at the time of writing, NSIRA was still awaiting responses from departments to its recommendations.
Findings
Recommendations
Reviewee’s Response
Policy Implementation
Finding 1. NSIRA found that
the RCMP’s dated human
source policy does not provide
a sufficient framework for the
consistent application of the
Source Development Unit
methodology in the proactive
recruitment of human sources.
Recommendation 1. NSIRA
recommends that the RCMP update
its human source policy to include,
at a minimum:
a centralized framework that
requires the Human Source
Program policy centre to
establish:
clear thresholds and
guidance on the appropriate
criteria for the use of
proactive recruitment
methods in national security
investigations,
strong oversight and
accountability by monitoring
and tracking policy
compliance; and
entrenched methodology
principles, including for the conduct of a standardized
approach to the assessment of
risk to human sources in all
national security investigations.
Policy Governance — Risk Assessment
Finding 2. NSIRA found that
the risk assessment for agents
is adequate because it is
comprehensive and details
the management of risk as a
shared responsibility involving
multiple independent
stakeholders.
Findings 3. The risk
assessment framework for
confidential informants is
inadequate. The current
assessments of risk:
are not well
documented and as
such do not provide
adequate or reliable
information to
decision-makers; and
are primarily focused
on operational security
and risk to the
investigation, as
opposed to risk to the
confidential
informants.
Recommendation 2. NSIRA
recommends that the RCMP revise
its risk assessment framework for
confidential informants to require
officers to consider all applicable
risks to the confidential informant,
and to aggregate and document
those risks, thereby providing for a
full accounting.
Agents — Duty of Care and Informed Consent
Finding 4. RCMP’s discharge
of its duty of care toward
agents is satisfactory because
the current process:
considers a wide range of
risks;
ensures that
obligations for
informed consent are
met;
accounts for risk
mitigation measures;
provides for
administrative
interviews; and
includes independent
third party
assessments.
Recommendation 3. NSIRA
recommends that the RCMP adjust
the parameters for the conduct of
agent interviews so that agent
feedback is more descriptive
concerning their experience; and
documented with greater
frequency.
Confidential Informants — Duty of Care and Informed
Consent
Finding 5. NSIRA found that
the RCMP over relies on the
promise of confidentiality and
does not adequately consider
the risk to confidential
informants.
Recommendation 4. NSIRA
recommends that the RCMP
improve its risk assessment
framework for confidential
informants. At a minimum, the
framework should:
consider the safety of the
confidential informant;
consider the particular
circumstances of the
confidential informant;
aggregate information that
allows for the detection of
outstanding vulnerabilities; and
provide for consent from the
confidential informant that is considerate of the risks
involved.
Recommendation 5. NSIRA
recommends that RCMP lower the
threshold to conduct administrative
interviews so they are conducted
with greater regularity and with a
greater proportion of confidential
informants.
Ministerial Direction — National Security Investigations in
Sensitive Sectors
Finding 6. NSIRA found that
the RCMP has not
demonstrated special care in
its national security
investigations in sensitive
sectors, contrary to
obligations under the
Ministerial Direction —
National Security
Investigations in Sensitive
Sectors.
Finding 7. NSIRA found that
the RCMP has an inadequate
framework to ensure the
appreciation of the cumulative
impact of national security
investigations in Canadian
Fundamental Institutions
Recommendation 6. NSIRA
recommends that the RCMP create
a specialized Sensitive Sector Unit
that is responsible for monitoring
and aggregating information on the
RCMP’s activities as they relate to
Canadian Fundamental Institutions,
assessing the impact of these
activities on the community, and
conduct long-term analysis of the
cumulative effects.
3.5 Multi-Departmental Reviews
22-12— Public Safety and Canadian Security Intelligence Service Accountability Mechanisms (CSIS, GAC, PS, DOJ)
Following a September 2022 referral by the former Minister of Public Safety (PS), NSIRA reviewed whether CSIS’s risk assessment model, Ministerial Direction, and information-sharing mechanisms supported the Minister’s discharge of their responsibilities for CSIS.
Directions to CSIS coming from political level actors—rather than the Minister or the CSIS Director—during an active operation created unnecessary danger for the CSIS team and caused harm to Canada’s international reputation.
CSIS and PS failed to provide timely and accurate information to the Minister, which may result from PS’s dependence on CSIS to identify and receive relevant information. This would inhibit PS’s ability to prepare independent advice to the Minister.
Certain Ministerial Directions to CSIS are subject to inconsistent and contradictory interpretation, which affects their implementation. The report raises a number of issues with the pillars of risk evaluated: operational, legal, foreign policy, and reputational.
Ultimately, the Minister of Public Safety may not be consistently supported and briefed about pertinent CSIS operations, which raises concerns about the possible erosion of ministerial accountability for the CSIS.
Findings
Recommendations
Reviewee’s Response
Accountability and Consequences for Halting the
Operation [*codename*]
Finding 1. NSIRA found
that a decision was made
to halt an active CSIS
operation overseas that
was not made by the CSIS
Director under section 6(1) of the CSIS Act, and for
which there is no written
record of a direction
comingfrom the Minister
of Public Safety under
sections 6(1) or 6(2) of the
CSIS Act.
Recommendation 1. NSIRA
Recommends that whenever there is a
decision affecting an active CSIS
operation, which is not made by the
Director of CSIS or their delegates, it
must come as a direction from the Minister of Public Safety under
section 6(1) of the CSIS Act and should
be accompanied by a written record in
keeping with section 6(2).
Agree
Finding 2. NSIRA found
that [*political-level
actors*] halted an active
operation, creating
unnecessary danger for the
CSIS team [**], and
caused harm to Canada’s
international reputation.
Responsibility for Briefing the Minister About [*codename*]
Findings 3. NSIRA found
that Public Safety and CSIS
failed in their responsibility
to provide timely and
accurate information to
the Minister of Public
Safety about [**] human
source [**] operation.
Public Safety’s Role in Relation to CSIS
Finding 4. NSIRA found
that Public Safety willingly
remains dependent on
CSIS to identify and
receive relevant
information, which inhibits Public Safety’s ability to
prepare independent
advice to the Minister
about the activities and
operations of CSIS.
Recommendation 2. NSIRA
recommends that the Minister of Public
Safety take action to ensure that the
Deputy Minister obtains any information
required to fulfill their responsibility to
provide independent advice to the Minister about the activities and
operations of CSIS.
Partially Agree
Ministerial Direction to CSIS
Findings 5. NSIRA found
that multiple Ministerial
Directions to CSIS are
subject to inconsistent and
contradictory
interpretation by those
responsible for their
implementation.
Recommendation 3. NSIRA
recommends that the Minister of Public
Safety consolidate ministerialdirections
into clear, concise and harmonized
instruments that are derived from
meaningful consultation among those
responsible for their implementation.
Agree
Findings 6. NSIRA found
that when preparing
Ministerial Directions to
CSIS, Public Safety
insufficiently consulted
with Global Affairs Canada
and CSIS.
CSIS’s Risk Assessment Process
Finding 7. NSIRA found
that CSIS’s risk
assessment process has
evolved to become the
central mechanism for
planning operations and
managing associated risks,
and, while it is generally
effective, it lacks clear guidance to employees on
when risk should be
reassessed as operations
evolve.
Legal Pillar
Findings 8. NSIRA found
that legal advice is often
absent from the final risk
assessment record for
CSIS operations.
Recommendation 4. NSIRA
recommends that CSIS, in consultation
with the Department of Justice and
Global Affairs Canada, ensure that legal
risk assessments are comprehensive
and memorialized in writing.
Agree
Findings 9. NSIRA found
that the scope of legal
considerations within legal
risk assessment is underinclusive.
Foreign Policy Pillar
Finding 10. NSIRA found
that Global Affairs Canada
and CSIS do not have a
shared vision with respect
to the role of Global Affairs
Canada in the foreign
policy risk assessment.
Recommendation 5. NSIRA
recommends that any pending changes
to CSIS’s risk assessment process
maintain a robust consultation and
information sharing mechanism between
Global Affairs Canada and CSIS.
Agree
Reputational Pillar
Finding 11. NSIRA found
that Public Safety is not
adequately contributing to
the preparation of reputational risk
assessments.
Recommendation 6. NSIRA
recommends that Public Safety and CSIS
develop a more robust consultation
mechanism for reputational risk
assessment for CSIS operational activities, and that these assessments
account for the risk of discreditingthe
Government of Canada.
Partially Agree
23-11— Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2023 (PS, CSE, CSIS, GAC, RCMP, CBSA, IRCC)
The purpose of this review was to determine whether Government of Canada (GC) institutions complied with the Security of Canada Information Disclosure Act (SCIDA)’s requirements for disclosure and record keeping in 2023. For the first time in SCIDA’s history, NSIRA has found full compliance with the Act, but NSIRA made seven recommendations to mitigate the risks of non-compliance.
Albeit compliant with the SCIDA, some IRCC disclosures presented a risk of non-compliance with SCIDA’s contribution and proportionality tests. The disclosing institution must be satisfied that both tests are met before making a disclosure under the SCIDA. Yet, four disclosures raised concerns with regard to the amount of personal information that IRCC disclosed.
At times, CSIS request letters were unclear, which hindered IRCC’s effort to conclude that the disclosure was authorized. The departments are required to provide information on the accuracy and reliability of the manner the disclosed information was obtained. However, NSIRA found that IRCC provided template statements on accuracy and reliability that were not always relevant.
CBSA’s record of disclosure form contradicts the SCIDA by suggesting that the provision of information on accuracy and reliability is optional.
Findings
Recommendations
Reviewee’s Response
Record Keeping Requirements — Section 9
Finding 1. NSIRA found that every
institution that disclosed or
received information pursuant to
SCIDA in 2023 complied with their
record keeping obligations under
section 9, but some records were
inaccurate or imprecise.
Contribution and Proportionality Tests — Subsection 5(1)
Finding 2. NSIRA found, within the
sample of disclosures reviewed
that disclosing institutions
demonstrated they had satisfied
themselves under the contribution
and proportionality tests in
compliance with subsection 5(1)
of the SCIDA.
Recommendation 1. NSIRA
recommends that disclosing
institutions explicitly address the
requirements of both
paragraphs 5(1)(a) and 5(1)(b) in the
records that they prepare under
paragraph 9(1)(e) of the SCIDA.
Agree
Finding 3. NSIRA found that IRCC
did not, in one instance,
independently consider whether
its disclosure related to activities
that fell under the SCIDA
exception for advocacy, protest, or
dissent. Instead, IRCC satisfied
itself of the SCIDA’s contribution
test based on assumptions about
how CSIS assessed activities that
undermine the security of Canada.
Recommendation 2. NSIRA
recommends that IRCC amend their
SCIDA policy to underscore that IRCC
must independently assess whether
the disclosure is authorized. This
assessment should consider whether
the activity amounts to one of the
exceptions to the SCIDA’s definition
of activities that undermine the
security of Canada.
Agree
Finding 4. NSIRA found that,
throughout the course of 2023,
IRCC improved the rigour of its
proportionality assessments
regarding disclosure of passport information. However, NSIRA
identified three instances where
IRCC disclosed visa information
without applying the same
rigorous approach, which risked
disclosing more personal
information than reasonably
necessary in the circumstances.
Recommendation 3. NSIRA
recommends that IRCC apply an
iterative approach to its
proportionality assessments, with a
view to disclosing only the minimum information reasonably necessary in
the circumstances to enable the
recipient institution to further their
investigation.
Agree
Finding 5. NSIRA found that CSIS
requests to IRCC used
inconsistent terminology and were
often unclear about the
relationship between the subject
of the request and its
investigation. At times, this lack of
clear communication hindered
IRCC’s efforts to satisfy itself that
the disclosure was authorized
underthe SCIDA.
Recommendation 4. NSIRA
recommends that CSIS use
consistent terminology, and be clear
about the nature of the link that has
been established between the
subject of a request and its
investigation, to assist IRCC in
satisfying itself of the proportionality
test.
Agree
Reliability and Accuracy Statement — Subsection 5(2)
Finding 6. NSIRA found that
disclosing institutions provided
information regarding the
accuracy of the information and
reliability of the manner in which it
was obtained in relation to all
disclosures. However, CBSA made
one verbal disclosure that did not
include an explicit statement on
accuracy and reliability.
Recommendation 5. NSIRA
recommends that institutions avoid
disclosures whenever
possible. When they must occur,
verbal disclosures should explicitly
convey the requisite information on
accuracy and reliability.
Agree
Finding 7. NSIRA found that
CBSA’s record of disclosure form contradicts the SCIDA by allowing
officials to opt out of providing
information regarding accuracy
and reliability.
Recommendation 6. NSIRA
recommends that CBSA harmonize its record of disclosure form with the
SCIDA, to convey the mandatory
nature of providing information on
accuracy and reliability at the time of
the disclosure.
Agree
Finding 8. NSIRA found that IRCC
used “templated” language to
describe the disclosure’s accuracy
and reliability that was not always
relevant or specific to the
circumstances of the disclosure.
Recommendation 7. NSIRA
recommends that IRCC tailor its
statements on accuracy and
reliability as to ensure that each
disclosure’s statement is specific to
the circumstances of the case.
Agree
Information Sharing Agreement — Subsection 4(c)
Finding 9. NSIRA found that
disclosures between IRCC and
CSE that occurred following the
enactment of their new
information sharing agreement
were compliant with both the
SCIDA and their information¬
sharing agreement.
24-03—Review of Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2023: Mitigation and Armed Conflict (CBSA, CSIS, CSE, DND/CAF, GAC, RCMP)
This review assessed departments’ compliance with the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACA) and their implementation of the ACA’s associated directions (ACA Directions) during the 2023 calendar year. It focused on how departments mitigated a substantial risk of mistreatment when sharing information with foreign entities.
NSIRA reviewed a number of cases concerning disclosures to foreign entities engaged in armed conflict and considered how armed conflict affected departments’ ability to mitigate.
Three departments that shared with foreign entities engaged in armed conflict may not have been compliant with the ACA Directions.
A foreign country’s involvement in armed conflict created challenges for departments in meeting their mitigation obligations under the ACA Directions. NSIRA further observed challenges related to disclosures contemplated to serve humanitarian objectives. NSIRA noted that the circumstances of armed conflict left few options for departments pursuing humanitarian objectives to mitigate the risks resulting from sharing.
NSIRA directed departments to conduct a study of information-sharing with the foreign entities of countries engaged in armed conflict to analyze challenges incompliance with the ACA Directions and gaps in the ACA regime. In addition, at the time of writing, NSIRA was still awaiting responses from departments to its recommendations.
Findings
Recommendations
Reviewee’s Response
Finding 1. NSIRA found that, in
the cases examined, CSIS, GAC,
RCMP, and IRCC’s mitigation
determinations demonstrated
common deficiencies, including:
inadequate design of
mitigation measures to
address the specific risks of
mistreatment present;
insufficient assessment of
caveats and assurances for
clarity and reliability; and
improper incorporation of
external considerations into
the determinations of
whether a substantial risk of mistreatment could be
mitigated.
Finding 2. NSIRA found that, in
the case examined, CSIS may not
have been in compliance with the
ACA Directions, as they were
unlikely to have sufficiently
mitigated a substantial risk of
mistreatment when sharing
information with a foreign entity.
Specifically, CSIS:
relied upon caveats and
assurances that were
inadequately designed to
address the specific risks of
mistreatment present; and
did not resolve substantial
deficiencies that
undermined the reliability of
the caveats and assurances.
Finding 3. NSIRA found that, in
the case examined, GAC’s poor
record-keeping practices
impeded NSIRA’s ability to
determine their compliance with
the ACA Directions.
Finding 4. NSIRA found that, in
the case examined, the RCMP
may not have been in compliance
with the ACA Directions, as they
were unlikely to have sufficiently
mitigated a substantial risk of
mistreatment when sharing
information with a foreign entity.
Specifically, the RCMP relied
upon caveats that were
inadequately designed to
address the specific risks of
mistreatment present.
Finding 5. NSIRA found that, in
the case examined, IRCC may
not have been in compliance with
the ACA Directions, as they were
unlikely to have sufficiently
mitigated a substantial risk of
mistreatment when sharing
information with a foreign entity.
Specifically, IRCC relied upon
measures that were inadequately
designed to address the specific
risks of mistreatment present.
Finding 6. NSIRA found that
many of DND/CAF’s mitigation
practices served to provide
decision-makers with
information necessaryto
determine whether a substantial
risk of mistreatment could be
mitigated.
Recommendation 1. NSIRA
recommends that departmental ACA
risk assessments include thorough
mitigation plans wherever a
substantial risk of mistreatment is
identified. These plans should:
consider whether all mitigation
measures proposed, taken
globally, adequately address the
specific risks alive in the case at
issue and are capable of
sufficiently lesseningthose risks;
evaluate the reliability of any
caveats and assurances
proposed and weigh histories of compliance according to their
quality;
exclude any external
considerations that are not
relevant to the question of
mitigation, including the risk of
not sharing, and strategic or
reputational considerations; and
include a plan to monitor for
indications of mistreatment and
adherence to caveats and
assurances following an
information exchange.
Finding 7. NSIRA found that a
foreign country’s involvement in
armed conflict created
challenges for departments in
meeting their mitigation obligations under the ACA
Directions when seekingto share
information with that country’s
entities.
Recommendation 2. NSIRA
recommends that officials clearly
document how each identified risk
was mitigated prior to disclosing
information to foreign entities.
Finding 8. NSIRA found that the
practicalrealities of compliance
with the ACA Directions can, in
certain circumstances, create a
dilemma for departments
seeking to share for humanitarian
purposes.
23-07—Review of the Dissemination of Intelligence on People’s Republic of China Political Foreign Interference, 2018-2023 (CSIS, RCMP, GAC, CSE, PS, PCO)
This review evaluated processes regarding how collected information was shared and escalated to relevant decision-makers, and indicated that there were significant disagreements in the national security and intelligence community as to whether, when, and how to share relevant information.
Three basic schisms existed: CSIS struggled to reconcile competing imperatives given the unique sensitivities of political foreign interference; the Security and Intelligence Threats to Elections (SITE) Task Force and the Critical Election Incident Public Protocol (CEIPP) Panel were geared toward broad, systematic interference and therefore could not adequately address riding-by-riding interference. PCO and CSIS analysts produced overviews of what they considered to be PRC foreign interference activities, but which the Prime Minister’s National Security and Intelligence Advisor (NSIA) saw as recounting standard diplomatic activity.
This challenging situation prompts us to ask how to address the so-called grey zone whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. NSIRA saw evidence of this challenge across the activities under review. NSIRA’s eight recommendations address these deficiencies. In addition, at the time of writing, NSIRA was still awaiting responses from departments to its recommendations.
Findings
Recommendations
Reviewee’s Response
CSIS’s Collection and Dissemination of Intelligence
on PRC Foreign Interference
in the 2019 and 2021 Federal Elections
Finding 1. NSIRA found that
CSIS’s dissemination of
intelligence on political foreign
interference during the 43rd
and 44th federal elections was
inconsistent. Specifically, in
certain instances:
the rationale for decisions
regarding whether, when,
and how to disseminate
intelligence was not clear,
directly affectingthe flow
of information; and
the threat posed by
politicalforeign
interference activities was
not clearly communicated
by CSIS.
Finding 2. NSIRA found that
CSIS’s dissemination and use
of intelligence on political
foreign interference were impacted by the concern that
such actions could interfere, or
be seen to interfere, in the
democratic process.
Finding 3. NSIRA found that
CSIS often elected to provide
verbal briefings as opposed to
written products in
disseminating intelligence on
political foreign interference
duringelections.
Finding 4. NSIRA found that
there was a disconnect within
CSIS between a region and
National Headquarters as to
whether reporting on political
foreign interference was
subject to higher thresholds of
confidence, corroboration and
contextualization for
dissemination.
Recommendation 1. NSIRA
recommends that CSIS develop,
in consultation with relevant
government stakeholders, a
comprehensive policy governing
its engagement with threats
related to political foreign
interference. This policy should:
make explicit CSIS’s
thresholds and practices for
the communication and
dissemination of intelligence
regarding political foreign
interference. This would
include the relevant levels of
confidence, corroboration,
contextualization and
characterization necessary
for intelligence to be
reported;
clearly articulate CSIS’s risk
tolerance for taking action against threats of political
foreign interference;
establish clear approval and
notification processes
(including external
consultations) for all
activities related to
counteringpolitical foreign
interference;
make clear any special
requirements or procedures
that would apply during
election/writ periods, as
necessary, including in
particular procedures for the
timely dissemination of
intelligence about political
foreign interference; and
consider best practices from
international partners (in
particular the Five Eyes)
regarding investigating and
reporting about political
foreign interference.
The SITE Task Force and the CEIPP Panel
Finding 5. NSIRA found that the
SITE Task Force and the CEIPP
Panel were not adequately
designed to address
traditional, human-based
foreign interference.
Specifically:
the SITE Task Force
focuses on threat activities
duringthe election period,
but traditional foreign interference also occurs
between elections;
Findings Recommendations Reviewee’s
Response
Global Affairs Canada’s
representation on the SITE
Task Force focused on
online foreign interference
activities; and
the CEIPP Panel’s high
threshold for a public
announcement is unlikely
to be triggered by
traditional foreign
interference, which
typically targets specific
ridings.
Recommendation 2. NSIRA
recommends that the SITE Task
Force align its priorities with the
threat landscape, including
threats which occur outside of the
immediate election period.
Recommendation 3. NSIRA
recommends that Global Affairs
Canada (GAC) and the Privy
Council Office ensure that GAC’s
representation on the SITE Task
Force leverages the department’s
capacity to analyze and address
traditional, human-based foreign
interference, in addition to the
online remit of the Rapid
Response Mechanism Team.
Recommendation 4. NSIRA
recommends that the Privy
Council Office empower the
CEIPP Panel to develop additional
strategies to address the full
threat landscape during election
periods, including when threats
manifest in specific ridings.
The Flow of Intelligence on PRC Foreign
Interference
Finding 6. NSIRA found that the
limited distribution of some
CSIS and CSE intelligence to
senior officials only reduced
the ability of the Royal
Canadian Mounted Police,
Global Affairs Canada, and the
Privy Council Office to
incorporate that intelligence
into their analysis.
Finding 7. NSIRA found that
CSIS and Public Safety did not
have a system for tracking who
received and read specific
intelligence products, creating
unacceptable gaps in
accountability.
Recommendation 5. NSIRA
recommends that, as a basic
accountability mechanism, CSIS
and Public Safety rigorously track
and document who has received
intelligence products. In the case
of highly sensitive and urgent
intelligence, this should include
documenting who has read
intelligence products.
Finding 8. NSIRA found that
the dissemination of
intelligence on political foreign
interference from 2018 to
2023 suffered from multiple
issues. Specifically:
intelligence consumers did
not always understand the
significance of the
intelligence they received
nor how to integrate it into
their policy analysis and
decision-making;
there was disagreement
between intelligence units
and senior public servants
as to whether activities
described in specific
intelligence products
constituted foreign
interference or legitimate
diplomatic activity.
Recommendation 6. NSIRA
recommends that Public Safety
Canada, Global Affairs Canada,
the Privy Council Office, and other
regular consumers of intelligence,
enhance intelligence literacy
within their departments.
Finding 9. NSIRA found that
there was disagreement
between senior public servants
and the NSIA as to whether
intelligence assessments
should be shared with the
political executive. Ultimately,
the NSIA’s interventions
resulted in two products not
reaching the political
executive, includingthe Prime
Minister.
Recommendation 7. NSIRA
recommends that the security
and intelligence community
develop a common, working
understanding of political foreign
interference.
Finding 10. NSIRA found that
the NSIA’s role in decisions
regarding the dissemination of
CSIS intelligence products is
unclear.
Recommendation 8. NSIRA
recommends that the role of the
National Security and Intelligence
Advisor to the Prime Minister,
including with respect to
decisions regarding the
dissemination of intelligence, be
described in a legal instrument.
Complaint Investigations
4.1 Overview
NSIRA is responsible for investigating complaints from members of the public related to national security. These investigations are carried out with consistency, fairness, and timeliness.
NSIRA’s jurisdiction covers complaints regarding activities conducted by CSIS or CSE, national security-related complaints against the RCMP, complaints in relations to security clearance denials and, referrals from the Canadian Human Rights Commission (CHRC) or under the Citizenship Act.
In 2024, NSIRA continued to investigate a wide range of complaints from previous years, successfully bringing several to a conclusion. NSIRA also initiated many new investigations, including with respect to a large increase in public complaints against CSIS regarding immigration and citizenship security screening, as detailed further below.
Finally, NSIRA continues to implement several initiatives aimed at enhancing and streamlining its processes and procedures.
Increase of complaints against CSIS regarding delays in immigration or citizenship security screening
From August to December 2024, NSIRA observed a significant increase of complaints against CSIS filed pursuant to section 16 of the NSIRA Act, alleging process delays in immigration or citizenship security screening. Out of 79 complaints received pursuant to s.16 of the NSIRA Act in 2024, 52 (66%) related to such delays. Of note, under ss. 14 and 15 of the CSIS Act, CSIS provides security advice to IRCC and CBSA regarding immigration or citizenship applicants. CSIS has advised NSIRA that the time it takes to provide security advice is influenced by several factors, including the prioritization of files, resource limitations, and priorities established by the Government of Canada, such as special immigration measures and humanitarian initiatives in response to crises around the world.
As depicted by the statistics found at the end of the current section, several of these complaints have resulted in informal resolutions. More specifically, upon completion of CSIS’s security screening of a complainant’s citizenship or immigration application, CSIS provides a letter that can be shared with the complainant which indicates that the advice has been provided to the requesting client, and that CSIS’s role is now complete. The complainant may then elect to continue with their complaint or informally resolve it.
4.2 Ongoing Initiatives
NSIRA’s Rules of Procedure govern the process for complaint investigations. While respecting the classified nature of the proceedings, they ensure that parties have the fullest opportunity to participate and make representations, and that all proceedings are conducted as informally and expeditiously as possible.
In 2024, NSIRA continued its internal review of the Rules of Procedure to identify issues and develop proposals for future revisions. The review aims to ensure that all investigations remain accessible, efficient, and procedurally fair.
Specifically, NSIRA also created a new rule on accessibility and accommodations. The rule will enable NSIRA to meet its commitment to identify, remove, and prevent barriers to accessibility to the greatest extent possible. This will help to ensure that those with disabilities can continue to fully participate in the complaint investigation process.
NSIRA also began developing another new rule to create a streamlined process for simplified investigations of non-complex complaints.
4.3 Investigation Report Summaries
Final Reports Issued
Harassment allegations against the Royal Canadian Mounted Police
(NSIRA File 07-407-13)
The Complainant alleged that RCMP members had shown up unannounced and without a warrant at their home. The Complainant alleged harassment by the said RCMP members during that unexpected visit. The RCMP members went to the Complainant’s home following an anonymous report, according to which the Complainant had made threats against the Prime Minister.
The interaction between the RCMP members and the Complainant was filmed by the bodycam worn by a municipal police officer. The video was submitted as evidence by the RMCP in the NSIRA investigation.
Following a review of the documentary evidence submitted by the RCMP and the Complainant, as well as an investigative interview with the latter, NSIRA found that under the implicit invitation provided by Common Law, the RCMP members had the right to go unannounced and without a warrant to the Complainant’s house to have a discussion with the said Complainant. The purpose of the RCMP members ’visit was to determine whether the Complainant posed a threat to the public and to the Prime Minister, not to substantiate any accusations against the said Complainant or to make an arrest.
NSIRA also found that the RCMP members had not harassed the Complainant during the interaction.
NSIRA found the Complainant’s allegations to be unsubstantiated.
Allegations against the Department of National Defence for denial of Top Secret security clearance and revocation of reliability status
(NSIRA File 07-404-30)
The Complainant alleged that, based on their voluntary disclosure during security interviews, they were denied a Top Secret security clearance and had their reliability status revoked, which resulted in their release from the Canadian Forces. NSIRA found that it had no jurisdiction to make findings and recommendations regarding revocation of reliability status and confined its discussion to matters implicating the security clearance decision only.
The Complainant alleged that the Vice Chief of the Defence Staff’s (VCDS) security clearance decision was flawed for several reasons, including that the Complainant’s sexuality influenced the VCDS decision; the VCDS did not take into account the Complainant’s mental health situation and failed to inquire about amental health nexus in their case and provide accommodation; the decision did not meet DND’s security screening standards; the decision was inconsistent with the recommendation offered by the Complainant’s commanding officer; and the decision did not acknowledge a number of considerations that might mitigate the seriousness of the adverse information against the Complainant.
NSIRA found the Complainant’s allegations to be unsubstantiated. Specifically, NSIRA found that the VCDS decision was not motivated by a concern or consideration of the Complainant’s sexuality or sexual orientation; that in the circumstances, no duty to accommodate was triggered for the purposes of the VCDS decision based on the Complainants mental health situation; that were unsubstantiated the allegations that the VCDS failed to meet security screening standards and that DND failed to properly review the surrounding circumstances; that the assertion that the VCDS decision was improper because it was inconsistent with the Complainant’s commanding officer’s recommendation was unsubstantiated; and that the Complainant’s other allegations, including those with respect to considerations that might mitigate the seriousness of the adverse information against them, did not individually or collectively render the decision unreasonable. In addition, NSIRA found no violation of procedural fairness.
However, NSIRA observed that certain exculpatory information was excluded from the Threat and Risk Assessment (TRA) before the decision-maker and recommended that this practice be rectified in the future. However, this omission did not amount to a breach of procedural fairness in the circumstances.
Allegations against CSIS for racial profiling, interrogation and harassment, information-sharing with foreign agencies, travel difficulties, and citizenship issues
(NSIRA File 07-403-05)
The Complainant alleged that CSIS had been racially profiling them; that CSIS agents harassed and interrogated them on multiple occasions; that CSIS shared information about them with foreign countries, leading to them having travel difficulties; that CSIS was responsible for their travel difficulties; and that CSIS put their citizenship application on hold.
SIRC took jurisdiction of this complaint in 2018, and when NSIRA came into force in2019, this investigation was deemed to be continued before NSIRA.
In the investigative report, NSIRA provided clarity on the standard of review in section 16 complaints — namely, that NSIRA is charged with making findings and recommendations with respect to legality, reasonableness, and necessity in the exercise of CSIS’s powers. In gauging reasonableness and necessity, the Member adopted an objective standard: would a reasonable person charged with exercising CSIS’s mandates and apprised fully of the facts, as were available to CSIS, conclude that CSIS’s exercise of its powers was necessary and proportional?
On the facts of this investigation, NSIRA found that the allegations were unsubstantiated, but made several recommendations. The recommendations addressed observations concerning how CSIS manages the aftermath of section 12 investigations and the circumstances in which CSIS should retract or correct information that it shared with foreign agencies.
Allegations against CSIS for conspiracy, electronic surveillance, travel difficulties, information sharing, and unlawful conduct
(NSIRA File 07-403-69)
The Complainant alleged that CSIS directed an unlawful seizure of their property in 2011; unlawfully shared information with Canadian and foreign authorities; conspired with government departments; harassed, surveilled, targeted, and intercepted their phone calls; acted unlawfully and breached their human or Charter rights. In addition, the Complainant alleged that they had issues reentering Canada after the impugned seizure took place due to CSIS’s activities. NSIRA found that the allegations were unsubstantiated.
Allegations against CSE for breach of consent and procedural fairness as part of security screening and hiring processes
(NSIRA File 07-406-04)
The Complainant alleged that, as part of their security screening and hiring processes at CSE, CSE breached their consent and procedural fairness; squandered government resources; failed to use approved security screening tools that have been approved by TBS and undergone the required Privacy Impact Assessment; received verbal disclosures or slander from the Complainant’s former employer regarding their character; harassed them; denied them a security clearance; and cited suitability concerns as a technique to circumvent NSIRA’s jurisdiction under section 18 of the NSIRA Act with respect to complaints related to denials of security clearances.
NSIRA concluded that the Complainant’s first allegation that CSE had breached their consent, and more specifically that CSE improperly used information the Complainant disclosed during their security interview for human resources and suitability purposes, was supported. The consent form signed by the Complainant in preparation for the security interview only contemplated the collection of information for the purpose of obtaining a security clearance. The evidence before NSIRA revealed that the Complainant was not advised prior to the security interview that the information collected could have been subsequently used for other purposes, including to assess their suitability for employment. Accordingly, NSIRA found that CSE had not complied with section 7 of the Privacy Act.
With respect to the Complainant’s remaining allegations against CSE, NSIRA found that they were unsubstantiated by the evidence.
In its Final Report, NSIRA issued two recommendations:
That CSE review the consent form that is presented to and signed by candidates prior to a security interview as part of the security screening process, and amend it accordingly; and
That CSE consider undertaking a Privacy Impact Assessment of its security interview questionnaire if one has not been conducted yet.
Allegations against CSIS for racism/racial profiling, harassment, slander, information-sharing with foreign agencies, travel difficulties
(NSIRA File 07-403-12)
The Complainant alleged that CSIS subjected them to harassment, racial profiling, and slander. The Complainant suggests that they were targeted because of their racial or ethnic background, legitimate political opinions, and due to their work as a confidential police informant. They suggested that, due to CSIS’s conduct, they had social, psychological and financial hardship, and difficulty travelling.
SIRC took jurisdiction of this complaint in January 2019, and when NSIRA came into force in July 2019, this investigation was deemed to be continued before NSIRA.
NSIRA found the Complainant’s allegations to be unsubstantiated. Specifically, it found that CSIS did not unlawfully investigate the Complainant or engage in racial profiling; did not target the Complainant because of their activities as a confidential police informant; did not slander or defame the Complainant, damage their reputation or sabotage their relationships; did not harass the Complainant or conduct interviews with them in an unlawful or unreasonable manner; did not unlawfully or unreasonably share information about the Complainant with foreign agencies or collude with them to interfere with their travel; did not breach the Complainant’s privacy rights under the Charter; and did not unlawfully retain personal information.
4.4 Other Outcomes
Allegations against CSIS’s role in delaying security assessment regarding immigration or citizenship applications
A number of Complainants filed complaints against CSIS alleging that CSIS caused a significant delay in providing security screening advice for their immigration or citizenship applications. CSIS provided letters to NSIRA that could be shared with the Complainants advising them that CSIS had provided its advice to the requesting client and that CSIS’s role in the security screening process was complete. As the Complainants’ main allegations against CSIS were in relation to the delay in the security screening, NSIRA inquired with the Complainants as to whether they wished to resolve their complaints in light of the update received. In the above-referenced files, the Complainants informed NSIRA that they did not wish to proceed with an investigation into their respective complaints against CSIS. As such, the matters were informally resolved in accordance with Rule 10.10 of NSIRA’s Rules of Procedure or withdrawn.
Deemed abandonment of complaint against a government department for denial of security clearance resulting rescinded job offer
(NSIRA File 07-404-25)
The Complainant alleged that, after being offered employment by a Government of Canada department conditional upon obtaining a Reliability and Secret clearance, they were denied said clearance because of a residency issue. The Complainant alleged that this was an inaccurate application of clearance policies, and that the employment offer was rescinded after the Complainant indicated that they would pursue the matter further.
NSIRA found the complaint to be deemed abandoned according to Rule 15.02 of NSIRA’s Rules of Procedure, following its reasonable attempts to communicate with the Complainant who refrained from participating in the process.
Informal resolution of a complaint regarding the denial of a security clearance
(NSIRA File 07-404-37)
The Complainant alleged that they were denied employment with an agency in the Government of Canada due to the denial of the required Top Secret security clearance. The Complaint alleged that the decision was based on inaccurate information and that the agency disregarded exculpatory information that the Complainant provided to correct the inaccuracies. The Complainant also alleged that they had a pending Secret security clearance application with another department that was unreasonably delayed.
Following an informal resolution meeting facilitated by NSIRA and attended by the Complainant and responding government agency, the parties asked NSIRA to place the investigation into abeyance pending the outcome of the Complainant’s Secret security clearance application. NSIRA granted the request. The Complainant subsequently informed NSIRA that they received their Secret security clearance and no longer wished to proceed with the complaint. NSIRA accepted the informal resolution.
4.5 Statistics on Complaint Investigations
January 1–December 31, 2024
INTAKE INQUIRIES
142
New complaints filed
79
National Security and Intelligence Review Agency Act (NSIRA Act),
section 16, Canadian Security and Intelligence Service (CSIS)
complaints
NSIRA Act, section 19, Royal Canadian Mounted Police (RCMP)
referred complaints
10
Citizenship Act, section 19
0
Canadian Human Rights Act, section 45 (CHRC referrals)
0
Decision on jurisdiction to investigate
Accepted
Declined
Withdrawn
NSIRA Act, section 16, CSIS complaints
22
10
7
NSIRA Act, section 17, CSE complaints
0
3
0
NSIRA Act, section 18, security clearances
0
2
0
NSIRA Act, section 19, RCMP referred complaints
3
2
0
Total
25
17
7
Active investigations as of December 31, 2024
34
NSIRA Act, section 16, CSIS complaints
23
NSIRA Act, section 17, CSE complaints
0
NSIRA Act, section 18, security clearances
4
NSIRA Act, section 19, RCMP referred complaints
7
Canadian Human Rights Act, section 45 (CHRC referrals)
0
Informal resolution in progress as of December 31, 2024
2
NSIRA Act, section 16 (CSIS complaints)
2
NSIRA Act, section 17 (CSE complaints)
0
NSIRA Act, section 18 (security clearances)
0
NSIRA Act, section 19 (RCMP referred complaints)
0
Canadian Human Rights Act, section 45 (CHRC referrals)
0
Total investigations closed
22
Abandoned
Final Report
Resolved Informally
Withdrawn
NSIRA Act, section 16, (CSIS complaints)
0
3
14
0
NSIRA Act, section 17, (CSE complaints)
0
1
0
0
NSIRA Act, section 18, (security clearances)
1
1
1
0
NSIRA Act, section 19, (RCMP referred complaints)
0
1
0
0
Canadian Human Rights Act, section 45 (CHRC referrals)
0
0
0
0
Total
1
6
15
0
Investigations carried to the next calendar year
34
NSIRA Act, section 16 (CSIS complaints)
23
NSIRA Act, section 17 (CSE complaints)
NSIRA Act, section 18 (security clearances)
4
NSIRA Act, section 19 (RCMP referred complaints)
7
Canadian Human Rights Act, section 45 (CHRC referrals)
0
Looking Ahead
5.1 Advancing NSIRA’s Vision
NSIRA’s vision — an accountable, transparent, and effective national security and intelligence community that upholds the rule of law — has guided every aspect of the Review Agency’s work in 2024. Through expanded transparency initiatives, timely public reporting, and continuous methodological refinement, NSIRA has demonstrated its commitment to achieving this vision. Whether through public-facing communications, the release of unclassified/redacted materials, or the ongoing enhancement of its website, NSIRA has remained focused on building public trust.
With the finalization of its 2024-2027 Strategic Plan, NSIRA has established a clear framework for advancing its mandate in the years ahead. The coming year will focus on strengthening the Review Agency’s core activities by enhancing review capacity and output, deepening subject-matter expertise, and expanding on the agility of complaint investigations.
Guided by its strategic priorities, NSIRA will place greater emphasis on proactive engagement. This includes increased outreach to the media, academic, civil society, parliamentarians, and domestic oversight bodies such as Agents of Parliament. NSIRA also aims to strengthen its relationships with international counterparts to continue sharing best practices and contribute to global efforts in national security accountability. These initiatives will support NSIRA’s continued evolution as a modern, transparent, and effective review body well positioned to meet the challenges of 2025 and beyond.
Annexes
Annex A: Abbreviations
Abbreviations and Full Names
Abbreviation
Full Name
ACA
Avoiding Complicity in Mistreatment by Foreign Entities Act
ARSCA-CSE
Annual Review of Select CSE Activities
ARSCA-CSIS
Annual Review of Select CSIS Activities
CAF
Canadian Armed Forces
CBSA
Canada Border Services Agency
CEIPP
Critical Election Incident Public Protocol
CHRC
Canadian Human Rights Commission
CSE
Communications Security Establishment
CSIS
Canadian Security Intelligence Service
DND
Department of National Defence
FIORC
Five Eyes Intelligence Oversight and Review Council
GAC
Global Affairs Canada
IRCC
Immigration, Refugees and Citizenship Canada
NSICOP
National Security and Intelligence Committee of Parliamentarians
NSIRA
National Security and Intelligence Review Agency
OPC
Office of the Privacy Commissioner of Canada
PCO
Privy Council Office
PS
Public Safety
RCMP
Royal Canadian Mounted Police
SCIDA
Security of Canada Information Disclosure Act
SIGINT
Signals Intelligence
SITE
Security and Intelligence Threats to Elections
TRA
Threat and risk assessment
TRM
Threat reduction measure
VCDS
Vice Chief of the Defence Staff
Sigle/acronyme
Dénomination
AMC
Affaires mondiales Canada
ASFC
Agence des services frontaliers du Canada
BCP
Bureau du Conseil privé
CCDP
Commission canadienne des droits de la personne
CPSNR
Comité des parlementaires sur la sécurité nationale et le
renseignement
CPVPC
Commissariat à la protection de la vie privée du Canada
CSERCC
Conseil de surveillance et d’examen du renseignement de la
Collectivité des cinq
CST
Centre de la sécurité des télécommunications
EACAC-CST
Examen annuel de certaines activités du CST
EACAS-SCRS
Examen annuel de certaines activités du SCRS
EMR
Évaluation de la menace et des risques
FAC
Forces armées canadiennes
GRC
Gendarmerie royale du Canada
IRCC
Immigration, Réfugiés et Citoyenneté Canada
LCISC
Loi sur la communication d’information ayant trait à la sécurité du
Canada
LECCMTIEE
Loi visant à éviter la complicité dans les cas de mauvais
traitements infligés par des entités étrangères
MDN
Ministère de la Défense nationale
MJ
Ministère de la Justice
MRM
Mesure de réduction de la menace
MSRE
Menace en matière de sécurité et de renseignements visant les
élections
OSSNR
Office de surveillance des activités en matière de sécurité
nationale et de renseignement
PPIEM
Protocole public en cas d’incident électoral majeur
The statistics and data below are provided as per NSIRA’s historical practice of including general data received annually from CSIS and CSE. NSIRA has not independently verified or assessed the numbers. Starting next year, such statistical data will be reproduced with the value added of NSIRA analysis and commentary as part of the summaries of the ARSCA-CSIS and ARSCA-CSE review reports.
CSIS Statistics and Data
2019
2020
2021
2022
2023
2024
Total Warrant Applications
24
15
31
28
30
28
Total Warrants issued by the Court
23
15
31
28
30
27
New Warrants
9
2
13
6
9
5
Replacements
12
8
14
14
10
13
Supplemental
2
5
4
8
11
9
Total Denied Warrants
1
0
0
0
0
1
Source: CSIS (NSIRA did not independently verify these numbers)
Note: The warrant statistics found here represent the total number of warrant
applications made to the Federal Court, independent of the actual number of warrants granted in each
application or the number of individuals who were the subject of warrants.
Total Number of Approved and Executed Threat Reduction Measures 2019-2024
2019
2020
2021
2022
2023
2024
Approved TRMs
24
11
23
16
14
11
Executed TRMs
19
8
17
12
19
15
Warranted TRMs
0
0
0
0
0
1
Source: CSIS (NSIRA independently verified these numbers)
Total Number of CSIS Targets, 2019-2024
2019
2020
2021
2022
2023
2024
Number of Targets
467
360
352
340
323
389
Source: CSIS (NSIRA did not independently verified these numbers)
Evaluation and Retention of Publicly Available, Canadian, and Foreign Datasets by CSIS, 2019-2024
2019
2020
2021
2022
2023
2024
Publicly Available Datasets
Evaluated
9
6
4
4
2
2
Retained
9
6
2
4
2
2
Canadian Datasets
Evaluated
0
0
2
0
1
0
Retained
0
0
0
2
0
0
Foreign Datasets
Evaluated
10
0
0
2
1
2
Retained
0
1
1
1
3
4
Source: CSIS (NSIRA did not independently verify this information).
Note: Datasets collected and evaluated in one year may receive ministerial, judicial or
other authorization in subsequent years. In addition, datasets may be retained for multiple years as
per the CSIS Act.
Authorizations, Commissions, and Directions Under CSIS’s Justification Framework, 2019-2024
2019
2020
2021
2022
2023
2024
Commissions by employees
1
39
51
61
47
34
Authorizations
49
147
178
172
172
175
Directions to Commit
15
84
116
131
116
128
Emergency Designations
0
0
0
0
0
0
Source: CSIS
Total Number of Non-Compliance Incidents Processed by CSIS, 2019-2024
2019
2020
2021
2022
2023
2024
Processed incidents
Administrative
–
53
64
42
48
54
Operational
40
19
21
17
31
28
Total
53
99
85
59
79
82
Breakdown of Non-compliance (all categories counted)
Canadian Law
–
–
1
2
4
5
CSIS Act
–
–
–
–
–
3
Charter
–
–
6
5
15
14
Warrant Conditions
–
–
6
3
11
13
CSIS Governance
–
–
8
15
27
25
Source: CSIS
Note: According to CSIS, each compliance instance was factored in all the categories in
which it was non-compliant. As a result, the sum of instances may exceed the total number.
Ministerial Authorizations
Name of ministerial authorization
Enabling section of CSE Act
Number of Authorizations Issued in 2024
Foreign Intelligence Authorization
26(1)
3
Cybersecurity Authorization for Federal and Non-Federal Infrastructures
27(1) and 27(2)
4
Defensive Cyberoperations Authorization
29(1)
1
Active Cyberoperations Authorization
30(1)
3
Source: CSE (NSIRA did not independently verify these numbers)
Ministerial authorizations issued in 2024
Ministerial Orders
Name of ministerial order
Enabling section of CSE Act
Designating Recipients of Canadian
Identifying Information Used, Analyzed or
Retained Under a Foreign Intelligence
Authorization
43
Designating Recipients of Information
Relatingto a Canadian or Person in
Canada Acquired, Used or Analyzed Under
the Cybersecurity and Information
Assurance Aspects of the CSE Mandate
44
Designating Electronic Information and
Information Infrastructures of Importance
to the Government of Canada
21
Designating Electronic Information and
Information Infrastructures of Ukraine as of
Importance to the Government of Canada
21
Designating Electronic Information and
Information Infrastructures of Latvia as of
Importance to the Government of Canada
21
Source: CSE (NSIRA did not independently verify these numbers)
Ministerial authorizations issued in 2024
Canadian Identifying Information
Type of request
Number of requests
received
Government of
Canada requests
909
Five Eyes requests
78
Non-Five Eyes
requests
6
Total
993
Source: CSE (NSIRA did not independently verify these numbers)
Requests for disclosure of Canadian IdentifyingInformation related to Fl, 2024
Disclosure type
Number of requests
Victim notifications
2,221
Disclosure to partners
9
Total
2,230
Source: CSE (NSIRA did not independently verify these numbers)
Disclosures of Canadian IdentifyingInformation related to Cybersecurity, 2024
Privacy Incidents
Type of incident
2024
Privacy incidents
75
Second-party privacy incidents
44
Non-privacy compliance incidents
13
Source: CSE (NSIRA did not independently verify these numbers)
Privacy and non-privacy compliance incidents related to CSE’s Fl mandate, 2024
Type of incident
2024
Privacy incidents
31
Non-privacy compliance incidents
9
Source: CSE (NSIRA did not independently verify these numbers)
Privacy and non-privacy compliance incidents related to CSE’s Cybersecurity mandate,
2024
Technical and Operational Assistance
Received
Approved
Denied
Cancelled
48
49
2
2
Source: CSE (NSIRA did not independently verify these numbers)
Requests for technical and operational assistance, 2024.
This quarterly report has been prepared by management as required by section 65.1 of the Financial Administration Act and in the form and manner prescribed by the Directive on Accounting Standards, GC 4400 Departmental Quarterly Financial Report. This quarterly financial report should be read in conjunction with the 2025–2026 Main Estimates
This quarterly report has not been subject to an external audit or review.
The National Security and Intelligence Review Agency (NSIRA) is an independent external review body that reports to Parliament. Established in July 2019, NSIRA reviews Government of Canada national security and intelligence activities to assess whether they are lawful, reasonable, and necessary. The Agency also investigates complaints from members of the public on the activities of the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), as well as certain other national security-related complaints, independently and in a timely manner.
The NSIRA Secretariat supports the Agency in the delivery of its mandate. Independent scrutiny contributes to strengthening the accountability framework for national security and intelligence activities and to enhancing public confidence. Ministers and Canadians are informed whether national security and intelligence activities undertaken by Government of Canada institutions are lawful, reasonable, and necessary.
This quarterly report has been prepared by management using an expenditure basis of accounting. The accompanying Statement of Authorities includes the agency’s spending authorities granted by Parliament and those used by the agency, consistent with the 2025–2026 Main Estimates. This quarterly report has been prepared using a special-purpose financial reporting framework (cash basis) designed to meet financial information needs with respect to the use of spending authorities.
The authority of Parliament is required before money can be spent by the government. Approvals are given in the form of annually approved limits through appropriation acts or through legislation in the form of statutory spending authorities for specific purposes.
The Department uses the full accrual method of accounting to prepare and present its annual departmental financial statements that are part of the departmental results reporting process. However, the spending authorities voted by Parliament remain on an expenditure basis.
Highlights of the fiscal quarter and fiscal year-to-date results
This section highlights the significant items that contributed to the net increase or decrease in authorities available for the year and actual expenditures for the quarter ended September 30, 2025.
NSIRA Secretariat spent approximately 47% of its authorities by the end of the second quarter, compared with 45% in the same quarter of 2024–2025 (see graph 1).
Graph 1: Comparison of total authorities and total net budgetary expenditures, Q2 2025–2026 and Q2 2024–2025 (in millions of dollars)
Text version of Figure 1
Comparison of total authorities and total net budgetary expenditures, Q2 2025–2026 and Q2 2024–2025 (in millions of dollars)
2025-26
2024-25
Total Authorities
$20.4
$19.5
Q2 Expenditures
$5.1
$5.3
Year-to-Date Expenditures
$9.5
$8.8
Significant changes to authorities
As of September 30, 2025, Parliament had approved $20.4 million in total authorities for use by NSIRA Secretariat for 2025–2026 compared with $19.5 million as of September 30, 2024, for a net increase of $0.9 million or 4.6% (see graph 2).
Graph 2: Variance in authorities as of September 30, 2025 (in millions of dollars)
Text version of Figure 2
Variance in authorities as of September 30, 2025 (in millions of dollars)
Fiscal year 2024-25 total available for use for the year ended March 31, 2025
Fiscal year 2025-26 total available for use for the year ended March 31, 2026
Vote 1 – Operating
17.9
19.5
Statutory
1.6
1.9
Total budgetary authorities
19.5
20.4
*Details may not sum to totals due to rounding*
The increase of $0.9 million in authorities is mostly explained by salary top-ups from Treasury Board Secretariat for updated collective bargaining agreements.
Significant changes to quarter expenditures
The second quarter expenditures totalled $5.1 million for a decrease of $0.2 million when compared with $5.3 million spent during the same period in 2024–2025. Table 1 presents budgetary expenditures by standard object.
Table 1: Departmental budgetary expenditures by Standard Object (unaudited)
Fiscal year 2025-2026 (in thousands of dollars)
Variances in expenditures by standard object (in thousands of dollars)
Fiscal year 2025-2026: expended during the quarter ended September 30, 2025
Fiscal year 2024-2025: expended during the quarter ended September 30, 2024
Variance $
Variance %
Personnel
3,674
3,856
(182)
(5%)
Transportation and communications
28
77
(49)
(64%)
Information
15
7
8
114%
Professional and special services
1,346
1,320
26
2%
Rentals
24
17
7
41%
Repair and maintenance
6
37
(31)
(84%)
Utilities, materials, and supplies
11
12
(1)
(8%)
Acquisition of machinery and equipment
0
8
(8)
(100%)
Other subsidies and payments
2
(38)
40
(105%)
Total gross budgetary expenditures
5,106
5,296
(190)
(4%)
Transportation and communications
The decrease of $49,000 is due to a reduction in travel and relocation across the department.
Repair and maintenance
The decrease of $31,000 is explained by some one-time office repairs in fiscal year 2024-2025.
Other subsidies and payments
The increase of $40,000 is explained by a increase in the recovery of salary overpayments.
Significant changes to year-to-date expenditures
The year-to-date expenditures totalled $9.5 million for an increase of $0.7 million (8%) when compared with $8.8 million spent during the same period in 2024-2025. Table 2 presents budgetary expenditures by standard object.
Table 2: Departmental budgetary expenditures by Standard Object (unaudited) (continued)
Fiscal year 2025-2026 (in thousands of dollars)
Variances in expenditures by standard object (in thousands of
dollars)
Fiscal year 2025-26: year-to-date expenditures as of September 30, 2025
Fiscal year 2024-25: year-to-date expenditures as of September 30, 2024
Variance $
Variance %
Personnel
7,744
6,864
880
13%
Transportation and communications
74
135
(61)
(45%)
Information
15
13
2
15%
Professional and special services
1,616
1,589
27
2%
Rentals
25
42
(17)
(40%)
Repair and maintenance
22
40
(18)
(45%)
Utilities, materials and supplies
15
40
(25)
(63%)
Acquisition of machinery and equipment
0
20
(20)
(100%)
Other subsidies and payments
4
41
(37)
(90%)
Total gross budgetary expenditures
9,515
8,784
731
8%
Personnel
The increase in Personnel of $880,000 is due to an increase in both FTEs and average salary per FTE.
Transportation and communications
The decrease of $61,000 is mainly due to a reduction in travel and relocation across the department.
Rentals
The decrease of $17,000 is attributed to the decommissioning of a rental building, and the timing of invoicing for our HR system.
Repair and maintenance
The decrease of $18,000 is explained by some one-time office repairs in fiscal year 2024-2025.
Utilities, materials and supplies
The decrease of $25,000 is due to faster acquisition card reconciliation, resulting in a decrease in the MasterCard suspense account.
Acquisition of machinery and equipment
The decrease of $20,000 is mainly explained by one-time equipment purchases in 2024-2025.
Other subsidies and payments
The decrease of $37,000 is explained by an overall decrease in the recovery of salary overpayments.
Risks and uncertainties
The funding received to offset pay increases was insufficient to cover such increases and as a result, NSIRA Secretariat will be required to reduce its overall staffing level to remain within budget. Reductions in staffing could cause a reduction in the number of reviews and investigations the Secretariat is able to produce on a yearly basis.
NSIRA Secretariat is closely monitoring pay transactions to identify and address over and under payments in a timely manner and continues to apply ongoing mitigating controls.
Mitigation measures for the risks outlined above have been identified and are factored into NSIRA Secretariat’s approach and timelines for the execution of its mandated activities.
Significant changes in relation to operations, personnel and programs
There have been no changes to the NSIRA Secretariat Program.
Approved by senior officials:
Charles Fugère Executive Director
Martyn Turcotte Chief Financial Officer
Appendix
Statement of authorities (Unaudited)
(in thousands of dollars)
Fiscal year 2025-2026
Fiscal year 2024–25
Total available for use for the year ending March 31, 2026
(note 1)
Used during the quarter ended September 30, 2025
Year to date used at quarter-end
Total available for use for the year ending March 31, 2025
(note 1)
Used during the quarter ended September 30, 2024
Year to date used at quarter-end
Vote 1 – Net operating expenditures
18,522
4,629
8,561
17,857
4,895
7,983
Budgetary statutory authorities
Contributions to employee benefit plans
1,908
477
954
1,601
401
801
Total budgetary authorities (note 2)
20,430
5,106
9,515
19,458
5,296
8,784
Note 1: Includes only authorities available for use and granted by Parliament as at quarter-end.
Note 2: Details may not sum to totals due to rounding.
Departmental budgetary expenditures by standard object (unaudited)
(in thousands of dollars)
Fiscal year 2025-2026
Fiscal year 2024–25
Planned expenditures for the year ending March 31, 2026 (note 1)
Expended during the quarter ended September 30, 2025
Year-to-date used at quarter-end
Planned expenditures for the year ending March 31, 2025
Expended during the quarter ended September 30, 2024
Year-to-date used at quarter-end
Expenditures
Personnel
14,377
3,674
7,744
13,205
3,856
6,864
Transportation and communications
497
28
74
685
77
135
Information
42
15
15
76
7
13
Professional and special services
4,994
1,346
1,616
4,624
1,320
1,589
Rentals
281
24
25
309
17
42
Repair and maintenance
72
11
15
436
37
40
Utilities, materials, and supplies
74
11
15
58
12
40
Acquisition of machinery and equipment
93
0
0
65
8
20
Other subsidies and payments
0
2
4
0
(38)
41
Total gross budgetary expenditures
(note 2)
20,430
5,106
9,515
19,458
5,296
8,784
Note 1: Includes only authorities available for use and granted by Parliament as at quarter-end.
Note 2: Details may not sum to totals due to rounding.
Without specialized national security review, much security service conduct would be immunized from scrutiny by reason of national security secrecy. NSIRA’s raison d’être is to ensure that there is no such immunity. NSIRA’s statute gives it two core mandates: conducting national security “reviews” of activities in the security and intelligence area; and conducting “investigations” of complaints brought against a subset of national security and intelligence services.
The review and investigation process serves to guard values essential to the Canadian project, including (especially) the rule of law: the notion that no one is above the law, and that a public official (including in the security and intelligence services) can only exercise powers found in the law. At the same time, NSIRA’s work “stress tests” the national security and intelligence community aiming to make them better as institutions at meeting their mandates.
The Strategic Plan lays out the NSIRA’s strategic goals and objectives in the further pursuit of excellence in national security review and complaints investigations. This roadmap comprises four key areas and reflects NSIRA’s unwavering commitment to independence, professionalism, transparency and inclusiveness. The Agency’s dedication to adapting to evolving challenges and innovate is demonstrated by its focus on technological advancement, robust security protocols, continuous learning, and streamlined internal services.
This strategic plan is not a fixed document but a living blueprint, guiding NSIRA in enhancing its existing commitment to accountability, and effectiveness. Each goal and objective stems from NSIRA’s mission to remain the trusted eyes and ears of Canadians in the evolving landscape of security and intelligence activities.
Vision, Mission, Values
Strategic Goals
Rigorous Reviews
NSIRA recognizes its pivotal role in conducting thorough and impactful national security and intelligence activities reviews. By focusing on contemporary and evolving topical issues, and employing relevant methodologies and rigorous analysis, NSIRA ensures that its reviews, in aggregate, comprehensively assess these critical activities’ legality, reasonability, and necessity. The commitment to maintaining the highest review standards is a prerequisite to serving as a trusted institution for Canadians. NSIRA’s reviews offer valuable findings and recommendations to stakeholders and decision-makers and inform Canadian society in a transparent manner that supports effective democracy and government accountability.
Efficient Complaint Investigations
The focus on fair and efficient investigations underscores the agency’s commitment to procedural fairness and impartiality, but also to access to justice principles that meaningfully empower complainants to be heard in a timely way and to see their matter investigated without delay. NSIRA diligently gathers and analyzes evidence, adhering to established investigative protocols and quasi-judicial best practices. The result is enhanced public trust and a robust contribution to upholding the rule of law.
Sustainable Corporate Infrastructure
Recognizing that rigorous reviews and effective investigations depend on mission support in the form of robust corporate and institutional infrastructure, NSIRA invests in cutting-edge technologies, specialized expertise, continuous learning, and a culture of collaboration. This ensures that information management and technology systems are optimized, that security postures reflect the highest standards, that human resources recruit and retain a workforce that is highly skilled, and that compliance to standard and financial management of the agency is efficient and agile. By providing a workplace that meets the highest expectations, NSIRA positions itself as capable of adapting to evolving challenges and making sustainable contributions to national security accountability.
Engaged Domestic and International Communities of Practice
NSIRA acknowledges the complexity of national security review challenges and the need for a collaborative approach. The emphasis on cooperation and engagement with domestic and international partners strengthens the effectiveness of reviews and investigations. In addition, by actively seeking opportunities to collaborate with Canadian and international accountability institutions, NSIRA contributes to developing global national security and intelligence review standards. The Agency becomes a vital participant in shaping the discourse on security, both at home and on the international stage. It becomes a recognized global centre of excellence in national security accountability and a global and national hub for a “community of review professionals”. NSIRA also continues to be a “learning organization”, drawing best practices from other bodies and jurisdictions into its own processes and procedures.
Objectives
Strategic Goal 1: Rigorous Reviews (R)
R 1.Maintain independence, strong ethical standards and professionalism.
R 2.Enhance review relevance through objective selection and prioritization criteria.
R 3.Enhance review quality, in terms of depth, clarity, drafting and conciseness,
including through key performance indicators.
R 4.Enhance review production levels, including by developing processes that
sustain a yearly production of 12 reviews.
R 5.Develop mechanisms promoting reviewee’s responsiveness to review
requirements, including through communications with agencies and escalation
of issues up to ministerial level.
R 6.Maintain transparency and pursue accessibility to the review work.
R 7.Increase accountability through tracking, dissemination and follow-up of
NSIRA’s findings and recommendations.
R 8.Innovate review methodology through the development of new review tools with
an emphasis on technology and sustainability.
R 9.Maintain an evergreen review process which guides all aspects of NSIRA
review.
I 1.Enhance procedures and investigative protocols to maximize efficient and expeditious investigations while adhering to principles of procedural fairness and independence and the highest standards of professionalism.
I 2.Maintain protocols for triaging investigations and establish key performance
indicators for the efficient and prompt conduct of investigations.
I 3.Implement advanced case management solutions that leverage automation and
data analytics to enhance the efficiency of investigative workflows and track key
performance indicators.
I 4.Develop and implement standardized protocols for handling, analyzing, and
storing digital evidence, ensuring a consistent and technologically advanced
approach.
I 5.Ensure accessibility of the rules of procedure and of the important legal
precedents in a manner that enables “equity of arms” between the government
and potential complainants and enhances access to justice.
I 6.Increase accountability through tracking, dissemination and follow-up of NSIRA’s
findings and recommendations.
I 7.Move to integrate new streams of complaints into the investigation process in a
fair and efficient manner, including by adopting novel approaches enabling
investigation of high-volume complaints.
C 1.Explore best avenues to optimize NSIRA’s legislative governance structure and
prepare for such change.
C 2.Establish strategic planning process to guide institutional priorities, use of
resources and deployment of activities.
C 3.Implement mechanisms promoting innovation, personnel development,
retention and wellbeing and demonstrating personnel diversity and expertise in
recruitment, training and retention.
C 4.Develop and implement means for insights and ideas generated through
domestic and international stakeholders to be shared and internalized within
NSIRA, ensuring that NSIRA remains a “learning organization”.
C 5.Ensure the implementation of, and reliance on, the communication strategy.
C 6.Develop and implement holistic information management infrastructure that
supports current activities and allows for collecting, storing, retrieving and
deleting information.
C 7.Continue to strengthen security measures, including access controls, cyber
security, surveillance systems, and facility security, to safeguard NSIRA’s
premises, assets and employees.
C 8.Implement measures to streamline administrative processes, reducing
bureaucratic inefficiencies and enhancing the speed and accuracy of internal
operations.
C 9.Invest in technology upgrades and innovations to modernize internal systems,
ensuring that NSIRA leverages cutting-edge tools for improved operational
efficiency.
C 10.Optimize and implement technologies that facilitate secure and efficient remote
work options, and regional access, ensuring flexibility and inclusiveness in
NSIRA’s workforce.
Strategic Goal 4: Engaged Domestic and International Communities of Practice (E)
E 1.Formulate and implement a comprehensive stakeholder engagement strategy
with domestic review bodies and agents of Parliament, international review
community, media and academic community.
E 2.Formulate and implement a comprehensive media relations and communications
strategy that assists media in reporting meaningfully and accurately on NSIRA’s
work.
E 3.Play an active role in developing global, national security and intelligence review
standards by participating in international forums and collaborative initiatives.
E 4.Develop and implement initiatives to enhance awareness and understanding of
NSIRA’s role, objectives, and impact among external stakeholders, including the
public, government officials, and other review/oversight bodies.
E 5.Continue to enhance staff-level expertise building through training and education
initiatives, both internal and external, and ensure that these opportunities are
broadly shared.
This quarterly report has been prepared by management as required by section 65.1 of the Financial Administration Act and in the form and manner prescribed by the Directive on Accounting Standards, GC 4400 Departmental Quarterly Financial Report. This quarterly financial report should be read in conjunction with the 2025–2026 Main Estimates.
This quarterly report has not been subject to an external audit or review.
Mandate
The National Security and Intelligence Review Agency (NSIRA) is an independent external review body that reports to Parliament. Established in July 2019, NSIRA reviews Government of Canada national security and intelligence activities to assess whether they are lawful, reasonable, and necessary. The Agency also investigates complaints from members of the public on the activities of the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), as well as certain other national security-related complaints, independently and in a timely manner.
The NSIRA Secretariat supports the Agency in the delivery of its mandate. Independent scrutiny contributes to strengthening the accountability framework for national security and intelligence activities and to enhancing public confidence. Ministers and Canadians are informed whether national security and intelligence activities undertaken by Government of Canada institutions are lawful, reasonable, and necessary.
This quarterly report has been prepared by management using an expenditure basis of accounting. The accompanying Statement of Authorities includes the agency’s spending authorities granted by Parliament and those used by the agency, consistent with the 2025–2026 Main Estimates. This quarterly report has been prepared using a special-purpose financial reporting framework (cash basis) designed to meet financial information needs with respect to the use of spending authorities.
The authority of Parliament is required before money can be spent by the government. Approvals are given in the form of annually approved limits through appropriation acts or through legislation in the form of statutory spending authorities for specific purposes.
Highlights of the fiscal quarter and fiscal year-to-date results
This section highlights the significant items that contributed to the net increase or decrease in authorities available for the year and actual expenditures for the quarter ended June 30, 2025.
NSIRA Secretariat spent approximately 22% of its authorities by the end of the first quarter, compared with 19% in the same quarter of 2024–2025 (see graph 1).
Graph 1: Comparison of total authorities and total net budgetary expenditures, Q1 2025–2026 and Q1 2024–2025
Significant changes to authorities
As of June 30, 2025, Parliament had approved $19.6 million in total authorities for use by NSIRA Secretariat for 2025–2026 compared with $18.4 million as of June 30, 2024, for a net increase of $1.2 million or 6.5% (see graph 2).
Graph 2: Variance in authorities as at June 30, 2025
The increase of $1.2 million in authorities is mostly explained by top-ups for updated collective bargaining agreements.
Significant changes to quarter expenditures
The first quarter expenditures totalled $4.4 million for an increase of $0.9 million when compared with $3.5 million spent during the same period in 2024–2025. Table 1 presents budgetary expenditures by standard object.
Table 1
*Details may not sum to totals due to rounding
Variances in expenditures by
standard object (in thousands of dollars)
Fiscal year 2025-26: expended during the quarter ended June 30, 2025
Fiscal year 2024-25: expended during the quarter ended June 30, 2024
Variance $
Variance %
Personnel
4,070
3,008
1,062
35%
Transportation and communications
46
58
-12
-21%
Information
0
6
-6
-100%
Professional and special services
270
269
1
0%
Rentals
1
25
-24
-96%
Repair and maintenance
16
3
13
433%
Utilities, materials, and supplies
4
28
-24
-86%
Acquisition of machinery and equipment
0
12
-12
-100%
Other subsidies and payments
2
79
-77
-97%
Total gross budgetary expenditures
4,409
3,488
921
26%
Personnel
The increase of $1,062,000 is explained by increases in average salaries due to updated collective bargaining agreements and an increase in FTEs.
Rentals
The decrease of $24,000 is explained by the elimination of temporary office space.
Repair and maintenance
The increase of $13,000 is explained by the need for some minor building repairs in 2025-26.
Utilities, materials, and supplies
The decrease of $24,000 is explained by unreconciled acquisition card purchases in 2024-25.
Acquisition of machinery and equipment
The increase of $12,000 is explained by several one-time equipment purchases in 2024-25.
Other subsidies and payments
The decrease of $77,000 is explained by a decrease in salary overpayments.
Risks and uncertainties
The funding received to offset pay increases was insufficient to cover such increases and as a result, NSIRA Secretariat will be required to reduce its overall staffing level to remain within budget. Reductions in staffing could cause a reduction in the number of reviews and investigations the Secretariat is able to produce on a yearly basis.
NSIRA Secretariat is closely monitoring pay transactions to identify and address over and under payments in a timely manner and continues to apply ongoing mitigating controls.
Mitigation measures for the risks outlined above have been identified and are factored into NSIRA Secretariat’s approach and timelines for the execution of its mandated activities.
Significant changes in relation to operations, personnel and programs
There have been no changes to the NSIRA Secretariat Program.
Approved by senior officials:
Charles Fugère Executive Director
Amanda Wark A/Chief Financial Officer
Appendix
Statement of authorities (unaudited)
(in thousands of dollars)
Fiscal year 2025-2026
Fiscal year 2024-2025
Total available for use for the year ending March 31, 2026 (note 1)
Used during the quarter ended June 30, 2025
Year to date used at quarter-end
Total available for use for the year ending March 31, 2025 (note 1)
Used during the quarter ended June 30, 2024
Year to date used at quarter-end
Vote 1 – Net operating expenditures
17,697
3,932
3,932
16,810
3,088
3,088
Budgetary statutory authorities
Contributions to employee benefit plans
1,908
477
477
1,601
400
400
Total Budgetary authorities (note 2)
19,605
4,409
4,409
18,411
3,488
3,488
Note 1: Includes only authorities available for use and granted by Parliament as at quarter-end.
Note 2: Details may not sum to totals due to rounding.
Departmental budgetary expenditures by standard object (unaudited)
(in thousands of dollars)
Fiscal year 2025-2026
Fiscal year 2024-2025
Planned expenditures for the
year ending March 31, 2026
2026 (note 1)
Expended during the quarter ended June 30, 2025
Year to date used at quarter-end
Planned expenditures for the year ending March 31, 2025
Expended during the quarter ended June 30, 2024
Year to date used at quarter-end
Expendituers
Personnel
14,377
4,070
4,070
13,205
3,008
3,008
Transportation and communications
497
46
46
685
58
58
Information
42
0
0
76
6
6
Professional and special services
4,169
270
270
3,577
269
269
Rentals
281
1
1
309
25
25
Repair and maintenance
72
16
16
436
3
3
Utilities, materials, and supplies
74
4
4
58
28
28
Acquisition of machinery and equipment
93
0
0
65
12
12
Other
subsidies and payments
0
2
2
0
79
79
Total gross
budgetary expenditures (note 2)
19,605
4,409
4,409
18,411
3,488
3,488
Note 1: Includes only authorities available for use and granted by Parliament as at quarter-end.
Note 2: Details may not sum to totals due to rounding.
Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2023: Backgrounder
Review of Federal Institutions’ Disclosures of Information under the Security of Canada Information Disclosure Act in 2023
Backgrounder
Backgrounder
The Security of Canada Information Disclosure Act (SCIDA) is intended to facilitate information sharing across government for national security purposes. Disclosures under SCIDA tend to include considerable personal information, such as passport information, citizenship status, and information gathered by diplomatic missions.
NSIRA is responsible for annually reviewing disclosures made during the previous calendar year and submits a report with its findings and recommendations to the Minister of Public Safety.
Annual reviews of disclosures by NSIRA are key to ensuring that Government of Canada (GC) institutions use SCIDA in a manner that respects the Canadian Charter of Rights and Freedoms and the privacy rights of the individuals whose information is being disclosed.
This report describes the results of a review by NSIRA of SCIDA disclosures made in 2023. It was tabled in Parliament by the Minister of Public Safety, as required under subsection 39(2) of the NSIRA Act, on June 13 2025.
Since NSIRA began reviewing GC institutions’ compliance with the Act five years ago, it has made recommendations to promote higher levels of compliance among GC institutions. This has resulted in those institutions adjusting their practices and increasingly demonstrating an improved understanding of their obligations.
This year, for the first time in SCIDA’s history, NSIRA has found full compliance with the Act. As such, the report contains seven recommendations aimed at improving the practices of GC institutions to ensure that this high level of compliance is maintained.
Department of National Defence/Canadian Armed Forces
FINTRAC
Financial Transactions and Reports Analysis Centre of Canada
GAC
Global Affairs Canada
GC
Government of Canada
IRCC
Immigration, Refugees and Citizenship Canada
NSIRA
National Security and Intelligence Review Agency
PHAC
Public Health Agency of Canada
PS
Public Safety Canada
RCMP
Royal Canadian Mounted Police
SCIDA
Security of Canada Information Disclosure Act
TC
Transport Canada
Glossary of Terms
Contribution test
The first part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (paragraph 5(1)(a)).
Proportionality test
The second part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will not affect any person’s privacy interest more than reasonably necessary in the circumstances (paragraph 5(1)(b)).
Executive Summary
The objective of this review was to determine whether Government of Canada (GC) institutions complied with the Security of Canada Information Disclosure Act (SCIDA)’s requirements for disclosure and record keeping in 2023. The review assessed GC institutions’ use of information-sharing arrangements, consistent with SCIDA’s guiding principles. The review also documented the volume of SCIDA disclosures and highlighted patterns in the SCIDA’s use across GC institutions and over time.
This is the fifth year that GC institutions have used the SCIDA and that NSIRA has reviewed their compliance with the act. Each year, NSIRA has made recommendations aimed at promoting compliance with the Act. Over the last five years, GC institutions have adjusted their practices and are increasingly demonstrating an improved understanding of their obligations. As a result, for the first time in SCIDA’s history, NSIRA found full compliance with the SCIDA. This allowed NSIRA to focus its review on in-depth analysis of the SCIDA’s contribution and proportionality tests.
For instance, some Immigration, Refugees and Citizenship Canada (IRCC) disclosures, albeit compliant with the SCIDA, presented a heightened risk of non-compliance with these two tests. One disclosure involving protest activity raised concerns regarding how IRCC arrived at the conclusion that the disclosure was related to activity that undermined the security of Canada, and thus complied with paragraph 5(1)(a) of the SCIDA. Three disclosures also raised concerns with regard to the amount of personal information that IRCC disclosed following its proportionality assessment, pursuant to paragraph 5(1)(b).
CSIS request letters, on which IRCC often relies to assess compliance with subsection 5(1), were at times unclear. This hindered IRCC’s effort to satisfy itself that the disclosure was authorised under the SCIDA.
IRCC provided templated statements on accuracy and reliability that were not always relevant or specific to the circumstances of the disclosure. In one case, the Canada Border Services Agency (CBSA) made a verbal disclosure that did not include an explicit statement about accuracy and reliability at time of disclosure. In addition, CBSA’s record of disclosure form contradicts the SCIDA by suggesting that the provision of information on accuracy and reliability is optional.
As encouraged by the SCIDA’s guiding principles, and as recommended by NSIRA previously, IRCC and the Communication Security Establishment signed an informationsharing agreement.
NSIRA made seven recommendations to mitigate risks of non-compliance and enshrine best practices in future years.
1. Introduction
Authority
This review was conducted pursuant to subsections 8(1)(b) and 39(1) of the National Security and Intelligence Review Agency Act (NSIRA Act).
The review satisfies the NSIRA Act’s section 39 requirement for NSIRA to submit a report to the Minister of Public Safety on disclosures made under the Security of Canada Information Disclosure Act (SCIDA, Act) during the previous calendar year.
Scope of the Review
The objective of this review was to determine whether Government of Canada (GC) institutions complied with the SCIDA’s requirements for disclosure and record keeping. The review assessed GC institutions’ use of information-sharing arrangements, consistent with SCIDA’s guiding principles. The review also documented the volume of SCIDA disclosures and highlighted patterns in the SCIDA’s use across GC institutions and over time.
The review included all GC institutions that disclosed or received information under the SCIDA in 2023: the Canada Border Services Agency (CBSA), Communications Security Establishment (CSE), Canadian Security Intelligence Service (CSIS), Global Affairs Canada (GAC), Immigration, Refugees and Citizenship Canada (IRCC), and Royal Canadian Mounted Police (RCMP). The review also included Public Safety Canada (PS), which provides SCIDA-related policy guidance and training across the GC.
Methodology
NSIRA assessed administrative compliance with the SCIDA’s record keeping obligations in respect of all disclosures made in 2023.
NSIRA assessed substantive compliance with the SCIDA’s disclosure requirements for a targeted sample of 27 disclosures, selected according to the parameters described in Annex A.
Review Statements
The NSIRA Act grants NSIRA rights of timely access to any information in the possession or under the control of a department (except for cabinet confidences) and to receive from the department any documents and explanations NSIRA deems necessary. NSIRA monitors cooperation with access requests, including the completeness and accuracy of disclosures, which inform its overall assessment of a department’s responsiveness in each review.
All reviewees met NSIRA’s expectations for responsiveness during this review.
2. Background
The SCIDA provides an explicit, stand-alone authority to disclose information between GC institutions in order to protect Canada against activities that undermine its security. Its stated purpose is to encourage and facilitate such disclosures.
Section 9 of the SCIDA prescribes record-keeping obligations for all institutions who disclose or receive information under the Act. Subsection 9(3) requires that these records be provided to NSIRA within 30 days after the end of each calendar year.
Subsection 5(1) of the SCIDA authorizes GC institutions to disclose information –subject to any prohibitions or restrictions in other legislation or regulations – to designated recipient institutions if the disclosing institution is satisfied that (a) the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (the “contribution test”); and (b) the information will not affect any person’s privacy interest more than is reasonably necessary in the circumstances (the “proportionality test”).
Subsection 5(2) requires disclosing institutions to, at the time of the disclosure,also provide information regarding the disclosure’s accuracy and the reliability ofthe manner in which it was obtained.
When a GC institution receives information under the Act, subsection 5.1(1)requires that the institution destroy or return any unnecessary personal informationas soon as feasible after receiving it.
The SCIDA’s guiding principles reinforce the notion that effective and responsible disclosure of information protects Canada and Canadians. Of note, subsection 4(c)suggests that GC institutions enter into an information-sharing arrangement when they regularly disclose information to the same recipient.
3. Findings, Analysis, and recommendations
Volume and Nature of Disclosures
In 2023, GC institutions made a total of 269 disclosures under the SCIDA (see Table 1).
Table 1: Number of SCIDA disclosures made in 2023, by disclosing and recipient institution [all disclosures (proactive disclosures)]
Designated Recipient Institutions
Disclosing Institution
CBSA
CFIA
CNSC
CRA
CSE
CSIS
DND/CAF
Finance
FINTRAC
GAC
Health
IRCC
PHAC
PSC
RCMP
TC
TOTAL (proactive)
CBSA
–
–
–
–
–
–
–
–
–
–
–
–
–
–
2
(2)
–
2
(2)
GAC
–
–
–
–
1
(1)
10
(0)
–
–
–
–
–
–
4
(0)
–
15
(1)
–
53
(32)
IRCC
–
–
–
–
58
(0)
194
(7)
–
–
–
–
–
–
–
–
–
–
252
(7)
TOTAL (proactive)
–
–
–
–
59
(1)
204
(7)
–
–
–
–
–
1
(0)
–
–
6
(2)
–
263
(10)
The number of disclosures increased 55% since 2022, reversing the slight downward trend in the number of disclosures observed across prior years. This shift is largely due to a 246% increase in disclosures from IRCC to CSIS. CSIS attributes this increase to a policy shift that led them to use the SCIDA to request information that IRCC previously provided under the Privacy Act.
As in previous years, disclosing institutions made the vast majority of disclosures following a request. Only 4% of disclosures were sent proactively by the disclosing institution.
Record Keeping Requirements – Section 9
Finding 1. NSIRA found that every institution that disclosed or received information pursuant to SCIDA in 2023 complied with their record keeping obligations under section 9, but some records were inaccurate or imprecise.
Section 9 of the SCIDA prescribes record-keeping obligations for all disclosing institutions, as well as institutions who receive information pursuant to a disclosure. These requirements include, among others, that records of the disclosure describe the information as well as indicate whether the information was destroyed or retained by the recipient. NSIRA’s cross-reference of records provided by disclosing and recipient institutions revealed some inaccuracies that were clarified through discussion with the institutions following receipt of their records:
Under paragraph 9(2)(a), CSE mislabelled the number of subjects that the disclosure pertained to in four (of 59) instances;
Under paragraph 9(2)(e), CSIS records included contradictory information as to whether the information received has been destroyed or retained; and
Under paragraph 9(1)(a), IRCC records included contradictory descriptions of the information disclosed.
NSIRA was unable to reconcile the information provided in relation to one case where the CBSA made a verbal disclosure to the RCMP. Based on the initial records provided by the RCMP and CBSA, NSIRA could not determine with certainty what personal information was shared, and when. In response to a recommendation from NSIRA’s SCIDA review for 2022, the CBSA developed a record of disclosure form to serve as a record overview. In this instance, the form was incomplete and contradicted the copy of the disclosure that was also provided to NSIRA.
As it did last year, NSIRA underscores the importance of administrative precision in preparing records, and notes that a record overview – when correctly prepared –supports compliance with SCIDA record keeping requirements.
NSIRA identified several instances in which the disclosing institution did not provide an explicit statement, under paragraph 9(1)(e), regarding the information that was relied on to satisfy the disclosing institution of the proportionality test. Three of these disclosures were included in NSIRA’s targeted sample for assessing the contribution and proportionality tests.
Contribution and Proportionality Tests – Subsection 5(1)
Finding 2. NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves under the contribution and proportionality tests in compliance with subsection 5(1) of the SCIDA.
To assess compliance with subsection 5(1), NSIRA first considered the explicit statements prepared by disclosing institutions under paragraph 9(1)(e), describing the information that was relied on to satisfy themselves that the disclosure was authorized under the Act. When an explicit statement was provided, NSIRA analysed and corroborated these statements by reviewing all other documents provided by GC institutions related to a given disclosure. Additional documents provided did not raise any concern with paragraphs 5(1)(a) and 5(1)(b) compliance.
For all 27 disclosures included in the sample, the disclosing institution provided anexplicit statement that demonstrated that they had satisfied themselves that thedisclosure would contribute to the recipient’s jurisdiction or its responsibilities.24.
For 24 of the 27 disclosures, the disclosing institution provided an explicit statement that demonstrated they had satisfied themselves that no one’s privacy would be affected more than reasonably necessary in the circumstances. In the remaining three disclosures, despite having no explicit statement, other documents provided by the disclosing institutions nevertheless demonstrated that they had satisfied themselves of the proportionality test.25.
While NSIRA found that institutions were generally compliant with paragraphs5(1)(a) and 5(1)(b), IRCC’s contribution and proportionality assessments demonstrated some deficiencies. These deficiencies form the basis of findings 3and 4.
Recommendation 1. NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.
SCIDA’s Exception for Advocacy, Protest, or Dissent
Finding 3. NSIRA found that IRCC did not, in one instance, independently consider whether its disclosure related to activities that fell under the SCIDA exception for advocacy, protest, or dissent. Instead, IRCC satisfied itself of the SCIDA’s contribution test based on assumptions about how CSIS assessed activities that undermine the security of Canada.
The contribution test under paragraph 5(1)(a) requires the disclosing institution to assess whether the disclosure relates to activities that undermine the security of Canada. These activities are defined by the Act and include, for example, espionage, covert foreign-influenced activities, terrorism, and significant or widespread interference with critical infrastructure. In its definition of activities that undermine the security of Canada, subsection 2(2) of the SCIDA includes an exception for advocacy, protest, dissent, or artistic expression. These, in and of themselves, do not constitute activities that undermine the security of Canada. The legislated exception helps to distinguish between legitimate forms of political dissent and national security threats.
In one instance, CSIS requested detailed information from IRCC related to an individual. The request sought current and past passport applications and these contain a great deal of personal information3.CSIS justified its request with anexcerpt from a news article which cited a quote uttered publicly by the individualduring a protest.
IRCC did not request any additional rationale from CSIS. It disclosed the individual’s passport application, including some associate’s information, along with the individual’s passport number, place of issue, and dates of issue and expiry.
In response to a query from NSIRA regarding on what basis it satisfied itself of the contribution test, IRCC explained that it “relies on the partner to accurately describe that the individual is tied to an activity that may undermine the security of Canada.” The IRCC official who authorized the disclosure further explained that IRCC assumed that CSIS had not relied solely on the individual’s statements quoted in the news article given the limits of CSIS’s authority to investigate lawful advocacy, protest or dissent under the CSIS Act.
The CSIS Act includes an exemption preventing CSIS from investigating lawful advocacy, protest or dissent, without the presence of threat related activities itemised in the CSIS Act. However, the SCIDA’s use of “activity that undermines the security of Canada” is a purposeful departure from the CSIS Act’s “threat to the security of Canada”. The distinction reflects legislative intent that the disclosing institution perform its own, fit-for-purpose assessment.
Subsection 5(1) of the SCIDA explicitly places the onus on the disclosing entity to assure itself that the disclosure is authorized. The process by which an institution satisfies itself should be grounded in an independent and factual assessment. In that context, a mere acquiesce of a request would not be sufficient, nor would a de facto reliance on the recipient respecting their enabling legislation. The threshold of satisfaction imports an objective standard that must be based on facts.
PS guidance notes that although the threshold imposed by subsection 5(1) does not hold institutions to perfection, they must make all reasonable efforts to satisfy themselves that the information will contribute to the recipient’s national security mandate. When encountering activities occurring in the context of political dissent or a protest, NSIRA expects institutions with a national security mandate to exercise caution when requesting information relating to an activity protected under the Canadian Charter of Rights and Freedoms (Charter) to further an investigation. At the same time, in this case, IRCC should have obtained more information prior to disclosure, to substantiate what activities were undermining the security of Canada to ensure the exception did not apply.
Recommendation 2. NSIRA recommends that IRCC amend their SCIDA policy to underscore that IRCC must independently assess whether the disclosure is authorized. This assessment should consider whether the activity amounts to one of the exceptions to the SCIDA’s definition of activities that undermine the security of Canada.
IRCC’s New Approach to Proportionality Assessments
Finding 4. NSIRA found that, throughout the course of 2023, IRCC improved the rigour of its proportionality assessments regarding disclosure of passport information. However, NSIRA identified three instances where IRCC disclosed visa information without applying the same rigorous approach, which risked disclosing more personal information than reasonably necessary in the circumstances.
In summer 2023, IRCC adopted a “higher” standard to satisfy itself that no person’s privacy interest would be affected more than reasonably necessary when disclosing passport information to CSIS. According to IRCC, this shift was prompted by a previous NSIRA recommendation that IRCC be explicit in their records that the proportionality test was met. Not only did IRCC adjust their record keeping practices, but they also turned their attention to the substantive issue at hand. Indeed, IRCC closely examined the privacy impact their disclosures may have when responding to CSIS requests.
As a result, when dealing with the absence of additional rationale from CSIS, IRCC became more conservative in the disclosure of information. For example, IRCC began redacting associate’s information in passport applications, limiting the provision of historical applications, and refraining from disclosing applications of minors. They adopted an iterative approach to disclosing passport information, which cultivated a more appropriate weighting of individuals’ privacy interests vis-à-vis the recipient’s investigative needs.
IRCC’s new approach to assessing the proportionality of passport information disclosures was not well-received by CSIS, who characterize their receipt of redacted passport applications as a “massive” hindrance to section 12 investigations. In internal correspondence, a CSIS analyst noted that they would prefer that “IRCC not filter down the info and let them [CSIS] make the assessment based on the knowledge of [national security] threats”.
Still, the discretionary nature of SCIDA disclosures make it such that IRCC may choose what information to disclose, if any. IRCC’s SCIDA Standard Operating Procedure states that requests for disclosure must provide sufficient information to justify the release of associate’s information. Under the SCIDA, it is entirely within IRCC’s purview to seek and obtain such justification prior to disclosing information.
IRCC’s increased attention to privacy interests in the context of passport application disclosures was not imparted to disclosures of information collected from visa applications. It is important to note that this distinction is not a factor that should be considered when assessing proportionality. Under the SCIDA, the privacy interests of citizens and non-citizens must be similarly assessed, and only treated differently in a visa application if no reasonable expectation of privacy is assessed.
Annex B presents the details of three disclosures in relation to which IRCC disclosed visa information to CSIS, concerning over 20 individuals, without having first established facts relevant to the conduct of an informed proportionality assessment. In these cases, either the identities of the subject of the request were unknown or the link between the subject of the disclosure and the threat had yet to be established. NSIRA would have expected IRCC to follow a more iterative approach to disclosing this information, consistent with its approach to passport disclosures in the later part of 2023. Such an iterative approach would have entailed disclosing only basic information until a greater connection to the activity that undermined the security of Canada could be established or the identity of the individual could be confirmed.
Additionally, the cases presented in Annex B are not fully consistent with IRCC policy, which underscores that “disclosing […] more personal information than is necessary could constitute a breach of a person’s reasonable expectation of privacy, a right protected by the Canadian Charter of Rights and Freedoms”. This is an important consideration since the proportionality of a given disclosure may be a factor in determining its Charter reasonableness.
Under the SCIDA regime, and as explained in PS guidance, the proportionality testis conducted to help determine the scope of what can be disclosed, and not necessarily whether the disclosure should occur. Thus, it would have been warranted for IRCC to assess how the sharing of each piece of information would impact the privacy of the individuals in question.
Recommendation 3. NSIRA recommends that IRCC apply an iterative approach to its proportionality assessments, with a view to disclosing only the minimum information reasonably necessary in the circumstances to enable the recipient institution to further their investigation.
CSIS Request Letters
Finding 5. NSIRA found that CSIS requests to IRCC used inconsistent terminology and were often unclear about the relationship between the subject of the request and its investigation. At times, this lack of clear communication hindered IRCC’s efforts to satisfy itself that the disclosure was authorised under the SCIDA.
96% of IRCC disclosures to CSIS were in response to a request. IRCC used the information in CSIS’s request letters to assure itself that a disclosure met both the contribution and the proportionality tests. While IRCC is always at liberty to request more information from CSIS to satisfy itself that the disclosure is authorized, in the majority of disclosures requested by CSIS, IRCC based its assessments solely on the information provided by CSIS in the request letter.
NSIRA reviewed all request letters sent by CSIS to IRCC. CSIS used a wide variety of terms to describe the nature of its interest in the subject of a request, such as:
The subject came to the attention of the Service
The subject is of interest for possible involvement in
The subject is of interest in connection with
The subject is believed to be an associate of a target
The subject is related to the threat
The individual is the subject of a Service investigation
The subject is part of a Service investigation
The subject is very closely associated to a CSIS subject of investigation
In most cases, CSIS did not define these terms or provide any more information on why the subject was of interest.
Furthermore, CSIS used the same (or similar) words when referring to different levels of interest. For example, “associated with” and “part of a Service Investigation” were used in requests for individuals with no known involvement in threat related activities and for individuals who CSIS has reason to suspect are involved in threat activities. In another instance, CSIS’s request letter stated that the subjects were related to the threat, but the connection between the threat and the individuals had not been established.
As a result of these inconsistencies and lack of clarity, IRCC could not understand key nuances relevant to its proportionality assessments. This issue is compounded by the fact the CSIS tended to request “any and all information” associated with the subject(s) of a request.
The relationship between the information requested and an investigation is an important factor considered by IRCC when assessing proportionality. Indeed, IRCC’s new approach to assessing proportionality takes into consideration the fact that information on associates contained in passport applications may not be material to the investigation. As a result, IRCC has often opted to redact some associate’s information, unless CSIS provided some indication that they are, or could be, implicated in the threat activity. In one of the several instances where CSIS stated that the subject of the request was “very closely associated to a CSIS subject of investigation”, IRCC requested an explanation to clearly link the subject of the request to the investigation. When CSIS did not provide it, IRCC opted to cancel the disclosure as it was not satisfied that the disclosure would meet the proportionality test.
It is essential that CSIS convey information in a clear and consistent manner given that IRCC takes this information into account in conducting its proportionality assessments. This is especially true when IRCC is disclosing associate’s information. When requesting information under the SCIDA, recipient institutions should, as a matter of course, facilitate disclosing institutions’ compliance with SCIDA thresholds by using clear and consistent terminology.
In late 2023, CSIS began centralizing its process for requesting IRCC SCIDA disclosures and developed a standard request form, which should help with consistency. As no requests were made in 2023 using these standard forms, NSIRA could not assess the effect of these changes in practice.
Recommendation 4. NSIRA recommends that CSIS use consistent terminology, and be clear about the nature of the link that has been established between the subject of a request and its investigation, to assist IRCC in satisfying itself of the proportionality test.
Reliability and Accuracy Statement – Subsection 5(2)
Finding 6. NSIRA found that disclosing institutions provided information regarding the accuracy of the information and reliability of the manner in which it was obtained in relation to all disclosures. However, CBSA made one verbal disclosure that did not include an explicit statement on accuracy and reliability.
Under the SCIDA, departments are required to provide information on the accuracy and the reliability of the manner in which the information being disclosed was obtained. They must do so at the time of the disclosure.
All written disclosures made in 2023 contained a statement on accuracy and reliability. However, CBSA made one proactive verbal disclosure of a tip to the RCMP, previously described in paragraph 19, in which it did not provide an explicit statement regarding accuracy and reliability at the time of disclosure.
Although the same information was shared again in writing two weeks later, an explicit, written statement on accuracy and reliability was only shared with the RCMP nearly two months later, when the CBSA disclosed additional information about the subject.
Subsection 5(2) states that “information” regarding accuracy and reliability “must” be provided at time of disclosure. NSIRA assesses in this case that, by its very nature, relaying that the information disclosed was derived from a tip conveyed information regarding accuracy and reliability to the RCMP. That said, an explicit, written statement is considered best practice. While verbal disclosures are not prohibited by the SCIDA, PS guidance notes that “[i]nformal communication cannot be used in lieu of the formal disclosure process or to replace the formal recordkeeping obligations.”
Recommendation 5. NSIRA recommends that institutions avoid making verbal disclosures whenever possible. When they must occur, verbal disclosures should explicitly convey the requisite information on accuracy and reliability.
Finding 7. NSIRA found that CBSA’s record of disclosure form contradicts the SCIDA by allowing officials to opt out of providing information regarding accuracy and reliability.
Although CBSA policy correctly reflects the mandatory nature of providinginformation on accuracy and reliability, its new record of disclosure form does not.The form includes a yes/no checkbox to indicate whether a statement confirmingthe accuracy and reliability was provided to the recipient institution. If the CBSAofficial selects “no”, they are prompted to explain why they elected to not provide astatement. This implies that it is discretionary and leaves the opportunity for CBSAto opt out of the requirement.
Further, the form does not specify that the statement must be provided at the timeof disclosure, as the SCIDA specifically demands.
Recommendation 6. NSIRA recommends that CBSA harmonize its record of disclosure form with the SCIDA to convey the mandatory nature of providing information on accuracy and reliability at the time of the disclosure.
Finding 8. NSIRA found that IRCC used templated language to describe the disclosure’s accuracy and reliability that was not always relevant or specific to the circumstances of the disclosure.
All IRCC disclosures made in 2023 included the same accuracy and reliability statement:
The information in this disclosure was provided by the Subject as part of their various applications to IRCC. The Subject declared that the information they provided as part of their applications was truthful, complete and correct. The information in this disclosure is accurate and reliable in so far as the Subject was truthful in their submissions to our Department. IRCC holds no information that would call into question the accuracy and reliability of the information provided by the Subject.
There are several cases where this statement provided by IRCC did not reflect the specific circumstances of the disclosure. For example, the statement above was included in a disclosure where no immigration or passport records were found and the only information disclosed was the lack of records. The same statement was used in disclosures of child general passport applications, which are actually completed by parents or legal guardians rather than by the subject themselves. When solely disclosing citizenship status to CSE, IRCC still included the same statement, despite the information disclosed not being provided by the subject as part of their application. In one case, the IRCC used the same statement in the disclosure but nevertheless contradicted itself by also stating that there was some reason to believe the information might not be accurate.
All of these cases point to a tendency of copying the accuracy and reliability information without giving sufficient attention to the relevance of the statement.
When instructing on the accuracy and reliability statement, the PS SCIDA guide suggests that “formulaic (templated) language should be avoided, unless the nature and source of information disclosed is derived from a routine process.” IRCC produces a large number of disclosures every year. While some language can be recycled, it is necessary that the statement remain an accurate representation of each disclosure. NSIRA has previously recommended that statements be clear and specific to the circumstances of the disclosure.
Recommendation 7. NSIRA recommends that IRCC tailor its statements on accuracy and reliability as to ensure that each disclosure’s statement is specific to the circumstances of the case.
Information Sharing Agreement – Subsection 4(c)
Finding 9. NSIRA found that disclosures between IRCC and CSE that occurred following the enactment of their new information sharing agreement were compliant with both the SCIDA and their information sharing agreement.
In past SCIDA reviews, NSIRA noted that some departments regularly use the SCIDA in a manner that warrants information sharing arrangements (ISA), as encouraged by subsection 4(c) of SCIDA. In 2022, NSIRA recommended that IRCC and CSE develop an ISA to govern their SCIDA disclosures.
In August 2023, IRCC and CSE signed an ISA. As a whole, the new ISA between IRCC and CSE supports compliance with SCIDA, with all key legislated requirements from SCIDA being included in the ISA. The agreement also adheres to the guidance on preparing ISAs recently developed by PS.
Of the 24 disclosures made after the ISA implementation, all were deemed compliant with the new agreement. NSIRA looked at each disclosure made under the ISA and assessed them against a majority of the requirements outlined in the agreement.
4. Conclusion
This is the fifth year that GC institutions have used the SCIDA and that NSIRA has reviewed their compliance with the act. Each year, NSIRA has made recommendations aimed at promoting compliance with the Act. Over the last five years, GC institutions have adjusted their practices and are increasingly demonstrating an improved understanding of their obligations. As a result, for the first time in SCIDA’s history, NSIRA found full compliance with the SCIDA.
This review assessed GC institutions’ compliance with requirements for recordkeeping in respect of all 269 disclosures that were made and received in 2023. It assessed their compliance with requirements for disclosure in relation to a targeted sample of 27 disclosures. All were compliant with SCIDA requirements, but NSIRA found that IRCC’s contribution and proportionality assessments demonstrated some deficiencies. An increased understanding of the activities that undermine the security of Canada would support a more thorough proportionality assessment and greater utility of the disclosed information.
NSIRA made recommendations aimed at promoting compliance with SCIDA, particularly with regard to how departments determine whether the contribution and proportionality tests have been met.
Annex A. Sample of Disclosures
Disclosures were selected for the sample based on the content of records provided to NSIRA under subsection 9(3), according to the following parameters:
At least two disclosures per discloser-recipient pair, if available;
At least one proactive disclosure per discloser, if available;
At least one requested disclosure per recipient, if available;
All disclosures identified by recipient institutions as including personal information that was destroyed or returned under the SCIDA, subsection5.1(1);
All disclosures for which there is a high-level discrepancy in the discloser and recipient records;
All disclosures made by an institution that is not listed in Schedule 3 of the SCIDA;
All disclosures received by institutions added to Schedule 3 in the preceding year; and
All disclosures that, based on the review team’s preliminary assessment, present a heightened risk of non-compliance under section 5.
Annex B. Cases Relating to IRCC’s Disclosure of Visa Information
Disclosure 1 (Economic Security Threat)
IRCC proactively disclosed to CSIS the visa applications of several individuals who received a work permit in various research fields linked to economic security threat. These applications included personal information such as employment history, travel history, contact information, photos, passport information, and associate’s information. This was part of IRCC’s effort to proactively identify and share with CSIS information about individuals that may engage in activities that pose a threat to Canada’s economic prosperity.
While the national security concern posed by these types of economic security threats is well documented, the role that these individuals played in that space was unknown. IRCC selected the individuals in question based on one threat related criteria, but the other criteria used to narrow the pool individuals from several hundreds to a few individuals were unrelated to the threat the individuals posed. Indeed, IRCC chose these additional arbitrary criteria mainly for practical reasons.
For greater clarity, there was no information indicating that any of the several individuals in question were involved in activities that undermine the security of Canada. Most of these applications were not initially referred to CSIS for security screening by IRCC, meaning that the visa officer was fully satisfied that the applicants posed no threat. In one case, the application was sent for security screening but CSIS returned a favorable recommendation and the individual was granted a visa.
The proactive sharing of complete visa application packages with CSIS risked affecting these individuals’ privacy more than was reasonably necessary in the circumstances.
Disclosure 2 (Foreign Entity)
CSIS requested passport information about any individuals with a valid visa currently working for a specific foreign entity. IRCC did not have any passport applications for the individuals that matched the search criteria, but nevertheless disclosed entire visa applications for some individuals. IRCC also provided information about individuals who had previously worked at the foreign entity, and individuals who did not have a valid visa. This misalignment between what was requested and what was disclosed does not reflect a proper tailoring of information to meet SCIDA’s contribution and proportionality tests.
None of these individuals had been linked to a specific activity that undermined the security of Canada, either at the time of the request nor following the disclosure. CSIS and IRCC’s inability to characterize the nature of the individuals’ relationship to threat activities created a risk that IRCC’s disclosure may have affected their privacy more than was reasonably necessary in the circumstances.
Disclosure 3 (Bulk Data)
CSIS sent a letter to IRCC requesting the disclosure of information within immigration applications on individuals including a spreadsheet with certain identifying personal information (called “selectors”). While large data-set requests and disclosures are not prohibited by the SCIDA, the requirements imposed by the contribution and proportionality tests must be applied to every discrete piece of information disclosed. As such, this type of information would need to be responsibly assessed prior to disclosure.
While the CSIS request letter provides extensive rationale as to why the threat actor named in the request letter poses a threat to national security, the IRCC officials that authorized the disclosure did not have contemporaneous information on how these selectors, and, by extension the individuals linked to these selectors, are linked to the threat actor.
Nevertheless, IRCC disclosed significant personal details pertaining to several individuals. For example, the disclosure included a foreign state visa refusal, information about military service, a personal picture, and other documents that would have been provided as part of a visa application.
This disclosure included more information than what CSIS requested. Given that the identity of the individuals are unconfirmed, as CSIS’s request clearly stated that the purpose of this request was for identification, this suggests that IRCC risked disclosing more than the least amount of personal information necessary for CSIS to further its investigation.
While the legislative burden to ensure that the disclosure is authorized under SCIDA falls on the disclosing entity, in this case IRCC, it may be very complex fora disclosing entity to discharge its obligation under paragraphs 5(1)(a) and 5(1)(b)with these types of large data-sets requests, particularly when the requester provides very little rationale linking each selector or individual to the activity that undermines the security of Canada.
Annex C. Overview of SCIDA Disclosures in Prior Years
Disclosing Institution
Designated Recipient Institutions under the SCIDA, Schedule 3
CBSA
GAC
CNSC
CRA
CSE
CSIS
DND/CAF
Finance
FINTRAC
GAC
Health
IRCC
PHAC
PS
RCMP
TC
TOTAL
2022
CBSA
–
–
–
–
–
–
–
–
–
–
–
–
–
–
4
–
4
GAC
–
39
2
–
–
–
–
–
–
–
–
–
–
–
12
–
53
IRCC
–
59
56
–
–
–
–
–
–
–
–
–
–
–
–
–
115
RCMP
–
–
–
–
–
–
–
–
–
–
–
–
–
–
1
–
1
TOTAL
–
59
95
2
–
–
–
–
–
–
–
–
–
–
16
–
173
2021
DND/CAF
–
–
–
–
–
–
–
–
–
–
2
–
–
–
–
–
2
GAC
–
–
–
–
–
–
–
–
–
–
–
–
–
–
2
–
44
IRCC
–
68
79
–
–
–
–
–
–
–
–
2
–
1
–
–
149
TOTAL
–
68
122
–
–
–
2
–
–
–
–
2
–
1
2
–
195
2020
CBSA
–
–
–
–
–
–
–
–
–
–
1
–
–
–
–
–
4
GAC
–
–
–
–
–
–
–
–
–
–
–
–
25
–
–
13
40
IRCC
–
60
61
–
–
–
–
–
–
–
–
–
1
–
37
–
159
RCMP
–
–
1
–
–
–
–
–
–
–
–
1
–
–
–
–
3
TC
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
2
2
Other¹⁰
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
1
TOTAL
–
61
88
1
–
–
3
–
–
–
–
6
–
55
1
–
215
2019
CBSA
–
–
–
–
–
–
–
–
–
–
–
–
–
–
1
–
3
GAC
–
–
–
–
–
–
–
–
–
–
–
–
23
–
–
–
42
IRCC
–
5
17
–
–
–
–
–
–
–
–
–
1
–
36
–
59
RCMP
–
4
1
–
–
–
–
–
–
–
–
–
–
3
–
–
8
TC
–
–
–
–
–
–
–
–
–
–
–
–
–
–
1
–
2
TOTAL
–
4
5
–
41
–
1
–
–
–
1
–
–
–
–
–
114
Annex D. Findings and Recommendations
Record Keeping Requirements – Section 9
Finding 1. NSIRA found that every institution that disclosed or received information pursuant to SCIDA in 2023 complied with their record keeping obligations under section 9, but some records were inaccurate or imprecise.
Contribution and Proportionality Tests – Subsection 5(1)
Finding 2. NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves under the contribution and proportionality tests in compliance with subsection 5(1) of the SCIDA.
Recommendation 1. NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.
Finding 3. NSIRA found that IRCC did not, in one instance, independently consider whether its disclosure related to activities that fell under the SCIDA exception for advocacy, protest, or dissent. Instead, IRCC satisfied itself of the SCIDA’s contribution test based on assumptions about how CSIS assessed activities that undermine the security of Canada.
Recommendation 2. NSIRA recommends that IRCC amend their SCIDA policy to underscore that IRCC must independently assess whether the disclosure is authorized. This assessment should consider whether the activity amounts to one of the exceptions to the SCIDA’s definition of activities that undermine the security of Canada.
Finding 4. NSIRA found that, throughout the course of 2023, IRCC improved the rigour of its proportionality assessments regarding disclosure of passport information. However, NSIRA identified three instances where IRCC disclosed visa information without applying the same rigorous approach, which risked disclosing more personal information than reasonably necessary in the circumstances.
Recommendation 3. NSIRA recommends that IRCC apply an iterative approach to its proportionality assessments, with a view to disclosing only the minimum information reasonably necessary in the circumstances to enable the recipient institution to further their investigation.
Finding 5. NSIRA found that CSIS requests to IRCC used inconsistent terminology and were often unclear about the relationship between the subject of the request and its investigation. At times, this lack of clear communication hindered IRCC’s efforts to satisfy itself that the disclosure was authorised under the SCIDA.
Recommendation 4. NSIRA recommends that CSIS use consistent terminology, and be clear about the nature of the link that has been established between the subject of a request and its investigation, to assist IRCC in satisfying itself of the proportionality test.
Reliability and Accuracy Statement – Subsection 5(2)
Finding 6. NSIRA found that disclosing institutions provided information regarding the accuracy of the information and reliability of the manner in which it was obtained in relation to all disclosures. However, CBSA made one verbal disclosure that did not include an explicit statement on accuracy and reliability.
Recommendation 5. NSIRA recommends that institutions avoid making verbal disclosures whenever possible. When they must occur, verbal disclosures should explicitly convey the requisite information on accuracy and reliability.
Finding 7. NSIRA found that CBSA’s record of disclosure form contradicts the SCIDA by allowing officials to opt out of providing information regarding accuracy and reliability.
Recommendation 6. NSIRA recommends that CBSA harmonize its record of disclosure form with the SCIDA, to convey the mandatory nature of providing information on accuracy and reliability at the time of the disclosure.
Finding 8. NSIRA found that IRCC used templated language to describe the disclosure’s accuracy and reliability that was not always relevant or specific to the circumstances of the disclosure.
Recommendation 7. NSIRA recommends that IRCC tailor its statements on accuracy and reliability as to ensure that each disclosure’s statement is specific to the circumstances of the case.
Information Sharing Agreement – Subsection 4(c)
Finding 9. NSIRA found that disclosures between IRCC and CSE that occurred following the enactment of their new information sharing agreement were compliant with both the SCIDA and their information sharing agreement.
